Overview

overview

10

Static

static

3

2026-10-15...ck.exe

windows10-2004-x64

10

2026-10-15...ck.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    144s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    15/10/2026, 22:22

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe
  • Size 1.6MB
  • Sample261015-2ae93set2n
  • SHA256 bb4209c4ad7e29b1665e0ef22eecdeddfdaa59c4ed75c3c441122285434919e2
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryexecutionnabucurpersistenceransomwarespywarestealertrojan

Malware Config

Signatures

  • Family: Nabucur

    Nabucur is a ransomware first seen in 2015.

    ransomwarenabucur
  • Modifies visibility of file extensions in Explorer 2 TTPs 62 IoCs
    defense_evasion
  • UAC bypass 3 TTPs 62 IoCs
    defense_evasiontrojan
  • Renames multiple (94) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 7 IoCs
    persistence
  • Drops file in System32 directory 2 IoCs
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 61 IoCs
    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry key 1 TTPs 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 20 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2520
    • C:\Users\Admin\IwQQEYso\EYIIcwkk.exe
      "C:\Users\Admin\IwQQEYso\EYIIcwkk.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious use of FindShellTrayWindow
      PID:4708
    • C:\ProgramData\MiwYwsgw\gQYMYwkA.exe
      "C:\ProgramData\MiwYwsgw\gQYMYwkA.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Reads the TCP/IP host and domain name from the registry
      PID:4164
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:2860
      • C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe
        C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1388
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock"
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:5824
          • C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe
            C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:2496
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock"
              6⤵
              • Executes a command shell one-liner
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4628
              • C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe
                C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock
                7⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:3144
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock"
                  8⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4280
                  • C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe
                    C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock
                    9⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of WriteProcessMemory
                    PID:5144
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock"
                      10⤵
                      • Suspicious use of WriteProcessMemory
                      PID:1492
                      • C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe
                        C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock
                        11⤵
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of WriteProcessMemory
                        PID:4248
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock"
                          12⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:4852
                          • C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe
                            C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock
                            13⤵
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of WriteProcessMemory
                            PID:1736
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock"
                              14⤵
                              • Suspicious use of WriteProcessMemory
                              PID:4508
                              • C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe
                                C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock
                                15⤵
                                • System Location Discovery: System Language Discovery
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of WriteProcessMemory
                                PID:4204
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock"
                                  16⤵
                                  • Executes a command shell one-liner
                                  • Suspicious use of WriteProcessMemory
                                  PID:1036
                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe
                                    C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock
                                    17⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of WriteProcessMemory
                                    PID:4792
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock"
                                      18⤵
                                      • Executes a command shell one-liner
                                      • Suspicious use of WriteProcessMemory
                                      PID:3556
                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe
                                        C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock
                                        19⤵
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:4556
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock"
                                          20⤵
                                            PID:5200
                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe
                                              C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock
                                              21⤵
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:4392
                                              • C:\Windows\SysWOW64\cmd.exe
                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock"
                                                22⤵
                                                  PID:4364
                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe
                                                    C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock
                                                    23⤵
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:1712
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock"
                                                      24⤵
                                                      • Executes a command shell one-liner
                                                      PID:4304
                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe
                                                        C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock
                                                        25⤵
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:5312
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock"
                                                          26⤵
                                                          • Executes a command shell one-liner
                                                          PID:2696
                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe
                                                            C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock
                                                            27⤵
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            PID:1148
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock"
                                                              28⤵
                                                              • Executes a command shell one-liner
                                                              PID:1700
                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe
                                                                C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock
                                                                29⤵
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                PID:2312
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock"
                                                                  30⤵
                                                                    PID:5804
                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe
                                                                      C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock
                                                                      31⤵
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      PID:5520
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock"
                                                                        32⤵
                                                                        • Executes a command shell one-liner
                                                                        PID:5552
                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe
                                                                          C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock
                                                                          33⤵
                                                                            PID:2892
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock"
                                                                              34⤵
                                                                              • Executes a command shell one-liner
                                                                              PID:928
                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe
                                                                                C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock
                                                                                35⤵
                                                                                  PID:556
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock"
                                                                                    36⤵
                                                                                    • Executes a command shell one-liner
                                                                                    PID:1268
                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe
                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock
                                                                                      37⤵
                                                                                        PID:3968
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock"
                                                                                          38⤵
                                                                                          • Executes a command shell one-liner
                                                                                          PID:3456
                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe
                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock
                                                                                            39⤵
                                                                                              PID:2544
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock"
                                                                                                40⤵
                                                                                                  PID:3584
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe
                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock
                                                                                                    41⤵
                                                                                                      PID:4700
                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock"
                                                                                                        42⤵
                                                                                                          PID:5792
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe
                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock
                                                                                                            43⤵
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            PID:2080
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock"
                                                                                                              44⤵
                                                                                                                PID:5656
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe
                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock
                                                                                                                  45⤵
                                                                                                                    PID:3324
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock"
                                                                                                                      46⤵
                                                                                                                        PID:4344
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe
                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock
                                                                                                                          47⤵
                                                                                                                            PID:3888
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock"
                                                                                                                              48⤵
                                                                                                                              • Executes a command shell one-liner
                                                                                                                              PID:3048
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe
                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock
                                                                                                                                49⤵
                                                                                                                                  PID:4588
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock"
                                                                                                                                    50⤵
                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                    PID:544
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe
                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock
                                                                                                                                      51⤵
                                                                                                                                        PID:4916
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock"
                                                                                                                                          52⤵
                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                          PID:5564
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe
                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock
                                                                                                                                            53⤵
                                                                                                                                              PID:4080
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock"
                                                                                                                                                54⤵
                                                                                                                                                  PID:3736
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe
                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock
                                                                                                                                                    55⤵
                                                                                                                                                      PID:6124
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock"
                                                                                                                                                        56⤵
                                                                                                                                                          PID:5452
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe
                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock
                                                                                                                                                            57⤵
                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                            PID:1928
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock"
                                                                                                                                                              58⤵
                                                                                                                                                                PID:5928
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe
                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock
                                                                                                                                                                  59⤵
                                                                                                                                                                    PID:4428
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock"
                                                                                                                                                                      60⤵
                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                      PID:5572
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe
                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock
                                                                                                                                                                        61⤵
                                                                                                                                                                          PID:4636
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock"
                                                                                                                                                                            62⤵
                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                            PID:4736
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe
                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock
                                                                                                                                                                              63⤵
                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                              PID:6080
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock"
                                                                                                                                                                                64⤵
                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                PID:1644
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe
                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock
                                                                                                                                                                                  65⤵
                                                                                                                                                                                    PID:2216
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock"
                                                                                                                                                                                      66⤵
                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                      PID:5748
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe
                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock
                                                                                                                                                                                        67⤵
                                                                                                                                                                                          PID:4972
                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock"
                                                                                                                                                                                            68⤵
                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                            PID:4512
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe
                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock
                                                                                                                                                                                              69⤵
                                                                                                                                                                                                PID:4072
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock"
                                                                                                                                                                                                  70⤵
                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                  PID:748
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe
                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock
                                                                                                                                                                                                    71⤵
                                                                                                                                                                                                      PID:5700
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock"
                                                                                                                                                                                                        72⤵
                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                        PID:2132
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe
                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock
                                                                                                                                                                                                          73⤵
                                                                                                                                                                                                            PID:5764
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock"
                                                                                                                                                                                                              74⤵
                                                                                                                                                                                                                PID:1704
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe
                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock
                                                                                                                                                                                                                  75⤵
                                                                                                                                                                                                                    PID:3820
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock"
                                                                                                                                                                                                                      76⤵
                                                                                                                                                                                                                        PID:3172
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe
                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock
                                                                                                                                                                                                                          77⤵
                                                                                                                                                                                                                            PID:4520
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock"
                                                                                                                                                                                                                              78⤵
                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                              PID:5916
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe
                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock
                                                                                                                                                                                                                                79⤵
                                                                                                                                                                                                                                  PID:2620
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock"
                                                                                                                                                                                                                                    80⤵
                                                                                                                                                                                                                                      PID:4240
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe
                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock
                                                                                                                                                                                                                                        81⤵
                                                                                                                                                                                                                                          PID:2996
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock"
                                                                                                                                                                                                                                            82⤵
                                                                                                                                                                                                                                              PID:2924
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe
                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock
                                                                                                                                                                                                                                                83⤵
                                                                                                                                                                                                                                                  PID:4088
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock"
                                                                                                                                                                                                                                                    84⤵
                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                    PID:4264
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe
                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock
                                                                                                                                                                                                                                                      85⤵
                                                                                                                                                                                                                                                        PID:1800
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock"
                                                                                                                                                                                                                                                          86⤵
                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                          PID:1592
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe
                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock
                                                                                                                                                                                                                                                            87⤵
                                                                                                                                                                                                                                                              PID:5440
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock"
                                                                                                                                                                                                                                                                88⤵
                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                PID:3192
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe
                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock
                                                                                                                                                                                                                                                                  89⤵
                                                                                                                                                                                                                                                                    PID:1220
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock"
                                                                                                                                                                                                                                                                      90⤵
                                                                                                                                                                                                                                                                        PID:4776
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe
                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock
                                                                                                                                                                                                                                                                          91⤵
                                                                                                                                                                                                                                                                            PID:5472
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock"
                                                                                                                                                                                                                                                                              92⤵
                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                              PID:5484
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe
                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock
                                                                                                                                                                                                                                                                                93⤵
                                                                                                                                                                                                                                                                                  PID:4644
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock"
                                                                                                                                                                                                                                                                                    94⤵
                                                                                                                                                                                                                                                                                      PID:1484
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe
                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock
                                                                                                                                                                                                                                                                                        95⤵
                                                                                                                                                                                                                                                                                          PID:4108
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock"
                                                                                                                                                                                                                                                                                            96⤵
                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                            PID:1448
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe
                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock
                                                                                                                                                                                                                                                                                              97⤵
                                                                                                                                                                                                                                                                                                PID:4276
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock"
                                                                                                                                                                                                                                                                                                  98⤵
                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                  PID:4716
                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                    99⤵
                                                                                                                                                                                                                                                                                                      PID:2868
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe
                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock
                                                                                                                                                                                                                                                                                                      99⤵
                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                      PID:2660
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock"
                                                                                                                                                                                                                                                                                                        100⤵
                                                                                                                                                                                                                                                                                                          PID:1048
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe
                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock
                                                                                                                                                                                                                                                                                                            101⤵
                                                                                                                                                                                                                                                                                                              PID:5596
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock"
                                                                                                                                                                                                                                                                                                                102⤵
                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                PID:4684
                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                  103⤵
                                                                                                                                                                                                                                                                                                                    PID:1276
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock
                                                                                                                                                                                                                                                                                                                    103⤵
                                                                                                                                                                                                                                                                                                                      PID:4688
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock"
                                                                                                                                                                                                                                                                                                                        104⤵
                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                        PID:3328
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock
                                                                                                                                                                                                                                                                                                                          105⤵
                                                                                                                                                                                                                                                                                                                            PID:2768
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock"
                                                                                                                                                                                                                                                                                                                              106⤵
                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                              PID:3716
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock
                                                                                                                                                                                                                                                                                                                                107⤵
                                                                                                                                                                                                                                                                                                                                  PID:5868
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock"
                                                                                                                                                                                                                                                                                                                                    108⤵
                                                                                                                                                                                                                                                                                                                                      PID:1776
                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock
                                                                                                                                                                                                                                                                                                                                        109⤵
                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                        PID:424
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock"
                                                                                                                                                                                                                                                                                                                                          110⤵
                                                                                                                                                                                                                                                                                                                                            PID:2980
                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock
                                                                                                                                                                                                                                                                                                                                              111⤵
                                                                                                                                                                                                                                                                                                                                                PID:3260
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                  112⤵
                                                                                                                                                                                                                                                                                                                                                    PID:5400
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                      113⤵
                                                                                                                                                                                                                                                                                                                                                        PID:5288
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock
                                                                                                                                                                                                                                                                                                                                                        113⤵
                                                                                                                                                                                                                                                                                                                                                          PID:1824
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                            114⤵
                                                                                                                                                                                                                                                                                                                                                              PID:3288
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                115⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:5032
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                    116⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:2516
                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                        117⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:2236
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                            118⤵
                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                            PID:4760
                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                              119⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:3416
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                                  120⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                  PID:4472
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                                    121⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:5104
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                                        122⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:1208
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                                            123⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:4152
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                124⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                PID:4112
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                  125⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:5620
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                  124⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:2324
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                      125⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:2196
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                      124⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                      PID:5744
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                  122⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                  PID:1080
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                    123⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:4140
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                    122⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:5368
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                        123⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:5844
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                        122⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                        PID:5516
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                          123⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:1132
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GoYMYsII.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                          122⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:2800
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                              123⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:2904
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                123⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                PID:5304
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                          120⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                          PID:2364
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                          120⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:5768
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                            120⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                            PID:4228
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                              121⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:4188
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\secgsEEs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                              120⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                              PID:4104
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                121⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                PID:692
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                          118⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                          PID:3096
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                          118⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                          PID:2336
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                          118⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                          PID:4384
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                            119⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:3036
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tAsAQAYY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                            118⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:3044
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                119⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                PID:4320
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                          116⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                          PID:4412
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                          116⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:5256
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                            116⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                            PID:3476
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZCIocsYU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                            116⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                            PID:4720
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                              117⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                              PID:2240
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                        114⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                        PID:4296
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                        114⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                        PID:1500
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                        114⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                        PID:3444
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OCUggAUU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                        114⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:6040
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                            115⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                            PID:5620
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                      112⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                      PID:5328
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                        113⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:5416
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                        112⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:4956
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                          112⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                          PID:5944
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CookQkko.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                          112⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                          PID:4788
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                            113⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                            PID:4140
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                      110⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                      PID:3036
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                        111⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:4948
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                        110⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:6028
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                            111⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:5960
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                            110⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                            PID:1112
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\twgckYcg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                            110⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:944
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                111⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                PID:2396
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                          108⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                          PID:2564
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                            109⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:3580
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                            108⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:4596
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                109⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5776
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                108⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                PID:3552
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                  109⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4928
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nqwcQoQE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                  108⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5900
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                      109⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3760
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                        109⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5104
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                  106⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4348
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                  106⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5032
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                  106⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5812
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                    107⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2064
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xoccggMo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                    106⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5436
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                      107⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4288
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                104⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                PID:2896
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                104⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5088
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                    105⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5972
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                    104⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:892
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KCUUgkMs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                    104⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3024
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                      105⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4120
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                        105⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4176
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                  102⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2704
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                    103⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3752
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                    102⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3156
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                      102⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1132
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                        103⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3728
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KQUIUQwk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                        102⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1152
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                            103⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5768
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                      100⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5960
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                      100⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4548
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                      100⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:588
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qoYMkUcc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                      100⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4560
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                          101⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2812
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                    98⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2324
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                      99⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3480
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                      98⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1788
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                        98⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2516
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vSUQYIEo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                        98⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2332
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                          99⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3408
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                    96⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3032
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                    96⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5216
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                    96⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1264
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XcgYwEco.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                    96⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5904
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                      97⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5648
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                94⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                PID:3160
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                  95⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1368
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                  94⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5288
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                    94⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5768
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SOMkQsII.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                    94⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3564
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                      95⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6020
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                        95⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4820
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                  92⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1276
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                  92⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2812
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                    92⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1768
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GeIMcoYw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                    92⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3692
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                      93⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5420
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                90⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                PID:4412
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                90⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1780
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                  90⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5648
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vcwcIYAg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                  90⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5816
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                      91⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4592
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                88⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                PID:2632
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                88⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5812
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                  88⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2324
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pagsMcEo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                  88⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3012
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                      89⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1660
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                86⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                PID:5620
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                86⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                PID:4276
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                86⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                PID:3288
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                  87⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5416
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TccwMwkM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                  86⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2744
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                    87⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2676
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                              84⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                              PID:6020
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                85⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5996
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                84⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                PID:2396
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                84⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                PID:1368
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dqEYMQQo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                84⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                PID:1732
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                  85⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2504
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                            82⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                            PID:4644
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                            82⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                            PID:4208
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                            82⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                            PID:4796
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cmMgEUIM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                            82⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:852
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                83⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                PID:4684
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                          80⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                          PID:1048
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                            81⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:2508
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                            80⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                            PID:2196
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                            80⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                            PID:3760
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IeYAwoIg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                            80⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:3868
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                81⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                PID:2980
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                          78⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                          PID:4252
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                          78⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                          PID:2336
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                          78⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                          PID:4528
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vqUUcooQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                          78⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:5820
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                              79⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                              PID:4776
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                        76⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                        PID:4740
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                        76⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                        PID:2744
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                        76⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                        PID:4268
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DiccwYIU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                        76⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:1068
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                            77⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                            PID:5304
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                      74⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                      PID:5288
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                      74⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:3944
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                        74⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                        PID:1252
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                          75⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:5324
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FMYIwcwM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                          74⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                          PID:5064
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                            75⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                            PID:1592
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                      72⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                      PID:1632
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                      72⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                      PID:3848
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                      72⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                      PID:4104
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YwQkEsEw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                      72⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                      PID:4416
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                        73⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                        PID:5972
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                  70⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                  PID:912
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                  70⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                  PID:1132
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                  70⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                  PID:2508
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\koocogsc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                  70⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                  PID:2960
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                    71⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:476
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                      71⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                      PID:4712
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                68⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                PID:2904
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                68⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:4484
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                  68⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                  PID:3476
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                    69⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:3080
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\COAwQUQg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                    68⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                    PID:6012
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                      69⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                      PID:4748
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                66⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                PID:2516
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                66⤵
                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                PID:2396
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                66⤵
                                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                PID:3564
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HScsMIkY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                66⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:3264
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                    67⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                    PID:1264
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                              64⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                              PID:2504
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                              64⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                              PID:3552
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                              64⤵
                                                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                              PID:5288
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zMgEwooI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                              64⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:2472
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                  65⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                  PID:5744
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                            62⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                            PID:4884
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                            62⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:6028
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                              62⤵
                                                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                              PID:4416
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iMckIsYM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                              62⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:3224
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                  63⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                  PID:1864
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                            60⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                            PID:2488
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                            60⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:5476
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                              60⤵
                                                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                              PID:476
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WUEYswwI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                              60⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                              PID:4856
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                61⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                PID:3300
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                          58⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                          PID:5580
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                          58⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:5776
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                            58⤵
                                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                            PID:5844
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VkYYQkQc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                            58⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:1404
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                59⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                PID:2064
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                          56⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                          PID:5648
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                          56⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:3560
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                            56⤵
                                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                            PID:2508
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VIIMYMYQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                            56⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:5588
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                57⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                PID:5440
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                          54⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                          PID:5856
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                          54⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:3528
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                            54⤵
                                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                            PID:4788
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BuMkAwYo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                            54⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                            PID:4860
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                              55⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                              PID:2960
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                        52⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                        PID:2380
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                        52⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:3264
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                          52⤵
                                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                          PID:2740
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PqMAAgwc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                          52⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:5340
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                              53⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                              PID:4460
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                        50⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                        PID:1912
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                        50⤵
                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                        PID:3160
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                        50⤵
                                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                        PID:748
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wKYoUgQs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                        50⤵
                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                        PID:5724
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                          51⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                          PID:4760
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                    48⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                    PID:4188
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                    48⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:5404
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                      48⤵
                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                      PID:1944
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yYkgsIok.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                      48⤵
                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                      PID:3312
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                        49⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                        PID:4260
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                  46⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                  PID:4288
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                  46⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:5960
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                    46⤵
                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                    PID:3080
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                      47⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:3828
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vqQEYwcQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                      46⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                      PID:920
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                        47⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                        PID:3480
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                  44⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                  PID:6008
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                  44⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                  PID:4120
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                  44⤵
                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                  PID:6124
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vsAAYEEo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                  44⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:4880
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                      45⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                      PID:4560
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                42⤵
                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                PID:5992
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                42⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:5844
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                  42⤵
                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                  PID:4644
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AKIEwAIE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                  42⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:3452
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                      43⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                      PID:912
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                40⤵
                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                PID:5932
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                40⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:2740
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                  40⤵
                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                  PID:4928
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ccgAogsM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                  40⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                  PID:4488
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                    41⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                    PID:1152
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                              38⤵
                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                              PID:3300
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                              38⤵
                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                              PID:2504
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                              38⤵
                                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                              PID:4684
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IucIQQMM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                              38⤵
                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                              PID:3248
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                39⤵
                                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                PID:5468
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                          36⤵
                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                          PID:4956
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                          36⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:4636
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                            36⤵
                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                            PID:4920
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jAMQoIgA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                            36⤵
                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                            PID:3484
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                              37⤵
                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                              PID:5328
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                        34⤵
                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                        PID:5572
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                        34⤵
                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                        PID:1220
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                        34⤵
                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                        PID:940
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zcsAEUYc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                        34⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:4476
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                            35⤵
                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                            PID:4188
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                      32⤵
                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                      PID:2868
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                      32⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:3120
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                        32⤵
                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                        PID:2704
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xgIYkIMU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                        32⤵
                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                        PID:464
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                          33⤵
                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                          PID:3828
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                    30⤵
                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                    PID:5996
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                    30⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:4996
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                      30⤵
                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                      PID:6036
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mYowEcwM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                      30⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:5380
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                          31⤵
                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                          PID:2676
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                    28⤵
                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                    PID:2648
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                    28⤵
                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                    PID:4948
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                    28⤵
                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                    PID:3728
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yCIgQgoQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                    28⤵
                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                    PID:2112
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                      29⤵
                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                      PID:4604
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                26⤵
                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                PID:4348
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                26⤵
                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                PID:2220
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                26⤵
                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                PID:4412
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\aaEcAoYw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                26⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:2480
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                    27⤵
                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                    PID:3416
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                              24⤵
                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                              PID:1788
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                              24⤵
                                                                                                                                                                                                                                                                                                                                                                PID:3160
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                24⤵
                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                PID:5988
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zMowUQMI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                24⤵
                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                PID:3228
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                  25⤵
                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                  PID:6080
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                            22⤵
                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                            PID:4208
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                            22⤵
                                                                                                                                                                                                                                                                                                                                                              PID:4196
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                              22⤵
                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                              PID:5416
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FaYsUssU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                              22⤵
                                                                                                                                                                                                                                                                                                                                                                PID:2672
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                  23⤵
                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                  PID:4268
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                            20⤵
                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                            PID:4176
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                            20⤵
                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                            PID:3752
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                            20⤵
                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                            PID:2084
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZmYsooEE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                            20⤵
                                                                                                                                                                                                                                                                                                                                                              PID:4076
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                21⤵
                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                PID:5356
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                          18⤵
                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                          PID:5504
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                          18⤵
                                                                                                                                                                                                                                                                                                                                                            PID:3736
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                            18⤵
                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                            PID:912
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CkskcIww.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                            18⤵
                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                            PID:5948
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                              19⤵
                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                              PID:4384
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                        16⤵
                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                        PID:3040
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                        16⤵
                                                                                                                                                                                                                                                                                                                                                          PID:4640
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                          16⤵
                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                          PID:4736
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qsIAEMYI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                          16⤵
                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                          PID:1900
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                            17⤵
                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                            PID:1188
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                      14⤵
                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                      PID:4264
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                      14⤵
                                                                                                                                                                                                                                                                                                                                                        PID:4584
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                        14⤵
                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                        PID:1732
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uOsMUMAM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                        14⤵
                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                        PID:5880
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                          15⤵
                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                          PID:3580
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                    12⤵
                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                    PID:1368
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                    12⤵
                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                    PID:3248
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                    12⤵
                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                    PID:2980
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dusQksIA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                    12⤵
                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                    PID:2432
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                      13⤵
                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                      PID:5324
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                10⤵
                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                PID:5416
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                10⤵
                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                PID:4232
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                10⤵
                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                PID:2636
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ziIksosc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                10⤵
                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                PID:3208
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                  11⤵
                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                  PID:5436
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                            PID:2576
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                            PID:3044
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                            PID:2592
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LisgkYII.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                            PID:4580
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                              9⤵
                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                              PID:556
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                        PID:2812
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                                          PID:2564
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                          PID:5868
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EmMsMsMY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                          PID:6016
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                            PID:3656
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                      PID:3124
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                      PID:4180
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                      PID:3608
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iWskEEUg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                      PID:5860
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                        PID:3024
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                  PID:980
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                  PID:6064
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                  PID:4840
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JyoUQkwQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                  PID:4784
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                    PID:5168
                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\zeEsscMI\zwMEYwkE.exe
                                                                                                                                                                                                                                                                                                                                C:\ProgramData\zeEsscMI\zwMEYwkE.exe
                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                PID:1196
                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\MiwYwsgw\gQYMYwkA.exe
                                                                                                                                                                                                                                                                                                                                C:\ProgramData\MiwYwsgw\gQYMYwkA.exe
                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                PID:5560
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\IwQQEYso\EYIIcwkk.exe
                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\IwQQEYso\EYIIcwkk.exe
                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                                                                                                                                                                                PID:4744

                                                                                                                                                                                                                                                                                                                              Network

                                                                                                                                                                                                                                                                                                                                    MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                                                                                    Reconnaissance

                                                                                                                                                                                                                                                                                                                                    Resource Development

                                                                                                                                                                                                                                                                                                                                    Initial Access

                                                                                                                                                                                                                                                                                                                                    Execution

                                                                                                                                                                                                                                                                                                                                    Command and Scripting Interpreter

                                                                                                                                                                                                                                                                                                                                    2
                                                                                                                                                                                                                                                                                                                                    T1059

                                                                                                                                                                                                                                                                                                                                    Visual Basic

                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                    T1059.005

                                                                                                                                                                                                                                                                                                                                    Windows Command Shell

                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                    T1059.003

                                                                                                                                                                                                                                                                                                                                    Persistence

                                                                                                                                                                                                                                                                                                                                    Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                    T1547

                                                                                                                                                                                                                                                                                                                                    Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                    T1547.001

                                                                                                                                                                                                                                                                                                                                    Privilege Escalation

                                                                                                                                                                                                                                                                                                                                    Abuse Elevation Control Mechanism

                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                    T1548

                                                                                                                                                                                                                                                                                                                                    Bypass User Account Control

                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                    T1548.002

                                                                                                                                                                                                                                                                                                                                    Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                    T1547

                                                                                                                                                                                                                                                                                                                                    Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                    T1547.001

                                                                                                                                                                                                                                                                                                                                    Defense Evasion

                                                                                                                                                                                                                                                                                                                                    Abuse Elevation Control Mechanism

                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                    T1548

                                                                                                                                                                                                                                                                                                                                    Bypass User Account Control

                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                    T1548.002

                                                                                                                                                                                                                                                                                                                                    Hide Artifacts

                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                    T1564

                                                                                                                                                                                                                                                                                                                                    Hidden Files and Directories

                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                    T1564.001

                                                                                                                                                                                                                                                                                                                                    Impair Defenses

                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                    T1562

                                                                                                                                                                                                                                                                                                                                    Disable or Modify Tools

                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                    T1562.001

                                                                                                                                                                                                                                                                                                                                    Modify Registry

                                                                                                                                                                                                                                                                                                                                    4
                                                                                                                                                                                                                                                                                                                                    T1112

                                                                                                                                                                                                                                                                                                                                    Credential Access

                                                                                                                                                                                                                                                                                                                                    Credentials from Password Stores

                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                    T1555

                                                                                                                                                                                                                                                                                                                                    Credentials from Web Browsers

                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                    T1555.003

                                                                                                                                                                                                                                                                                                                                    Unsecured Credentials

                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                    T1552

                                                                                                                                                                                                                                                                                                                                    Credentials In Files

                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                    T1552.001

                                                                                                                                                                                                                                                                                                                                    Discovery

                                                                                                                                                                                                                                                                                                                                    System Information Discovery

                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                    T1082

                                                                                                                                                                                                                                                                                                                                    System Location Discovery

                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                    T1614

                                                                                                                                                                                                                                                                                                                                    System Language Discovery

                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                    T1614.001

                                                                                                                                                                                                                                                                                                                                    System Network Configuration Discovery

                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                    T1016

                                                                                                                                                                                                                                                                                                                                    Lateral Movement

                                                                                                                                                                                                                                                                                                                                    Collection

                                                                                                                                                                                                                                                                                                                                    Data from Local System

                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                    T1005

                                                                                                                                                                                                                                                                                                                                    Command and Control

                                                                                                                                                                                                                                                                                                                                    Exfiltration

                                                                                                                                                                                                                                                                                                                                    Impact

                                                                                                                                                                                                                                                                                                                                    Replay Monitor

                                                                                                                                                                                                                                                                                                                                    Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                    Downloads

                                                                                                                                                                                                                                                                                                                                    gQYMYwkA.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\MiwYwsgw\gQYMYwkA.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 7e61aceb9bf99736f07e01ec63f553b41cb98d68d8882608515741b7002fae67
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    gQYMYwkA.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\MiwYwsgw\gQYMYwkA.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 f17a44b99a66aec11924657e125da1e580321074cd6a3de50e71626e30f4fbc2
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    gQYMYwkA.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\MiwYwsgw\gQYMYwkA.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 7d484640c836a90de84704d646ca2d75bd6516f57c2d363379e2cf91985b7de3
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    gQYMYwkA.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\MiwYwsgw\gQYMYwkA.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 1d82a0ebe54aa0b0df66171df4779f1e134df936df178592820efaf9913a6b36
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    gQYMYwkA.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\MiwYwsgw\gQYMYwkA.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 5f040671d7d510306246e2e488005896d6554c803fd80f2aeb4563da657d7a48
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    gQYMYwkA.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\MiwYwsgw\gQYMYwkA.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 d066189222b7ea7e0f0f341fffc3cf7292219a1e5e15f20fe2d8117408cfed32
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    gQYMYwkA.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\MiwYwsgw\gQYMYwkA.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 20120ffad78da5562ad409388c57013f8a96a5408d7e45a1dd8ab73294c2e822
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    gQYMYwkA.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\MiwYwsgw\gQYMYwkA.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 03546f764565f5c51764a0abf3c5a94c5f2f758e5f5dea78a906b9ba64727609
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    gQYMYwkA.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\MiwYwsgw\gQYMYwkA.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 d00ce68e299098a7279e2cd8b7ce7f3859f4a19e03cc13c1ad3d2f67d5b5fa0d
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    gQYMYwkA.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\MiwYwsgw\gQYMYwkA.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 a9665122f28438b32a818a2f1300ee114cd12ea5d3104419c08d728d468726ce
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    gQYMYwkA.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\MiwYwsgw\gQYMYwkA.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 d5df31e36e93accda49ce4ee0032aa2d94d4c8adb1e8833351aa67871894d4da
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    gQYMYwkA.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\MiwYwsgw\gQYMYwkA.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 5ac583a5c64cff614acd2d965eed959638c60767e25ed01a8562b0cc45165a33
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    gQYMYwkA.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\MiwYwsgw\gQYMYwkA.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 286e12e85cbeb61526dd1dc9c5e6dae726db5e489a98471eb5d8f949cbb69ced
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    gQYMYwkA.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\MiwYwsgw\gQYMYwkA.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 797023233d1fd3a998bb905e7349a354ebb1d5cd88121514d6da9ee769033511
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    gQYMYwkA.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\MiwYwsgw\gQYMYwkA.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 379699031d53dbd1f00f3fec27e194396f975c68718c4e109bb2d510155a2b24
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    gQYMYwkA.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\MiwYwsgw\gQYMYwkA.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 73c04ca619d3289a3b3e97fec9f985f1e5edaf79334f0c1d3299a9772941ebac
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    gQYMYwkA.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\MiwYwsgw\gQYMYwkA.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 87740319f9a53010e616851cd1f0f94c2582623a61ae7912d2b95a89d5298c67
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    gQYMYwkA.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\MiwYwsgw\gQYMYwkA.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 7bc878df8c3a0a3e17f7f89cc8ab46d8969a941c2f3c91312b97ebf2bd6e200f
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    gQYMYwkA.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\MiwYwsgw\gQYMYwkA.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 6f9b72b040e878a6999188eeb4b15c0c9c2f64233eb1d3ef4190ebcc338303f2
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    gQYMYwkA.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\MiwYwsgw\gQYMYwkA.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 7be4ee8b8d58d1ab55274e44e517cb8c9b0cb470e4b018e3ab15266b9ea5b49e
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    gQYMYwkA.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\MiwYwsgw\gQYMYwkA.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 a6b8737cc836dcf819cf89aab964790024527fa4bdc89d4b647df57667377d43
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    gQYMYwkA.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\MiwYwsgw\gQYMYwkA.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 70c06e27b75aab3ed1b964b64c7319c843614003928fe37a9bff76f379781247
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    gQYMYwkA.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\MiwYwsgw\gQYMYwkA.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 4ff8d2e999a6666a1cb4a42d635f5f49bdfe4f8f229a8ea2fba9cf35f302913e
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    gQYMYwkA.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\MiwYwsgw\gQYMYwkA.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 a0b383f3538866e4612012854dc511e9f1c39d75a1c66a3bf12233dab6f8ae69
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    gQYMYwkA.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\MiwYwsgw\gQYMYwkA.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 5a921eca93736aef918521577b9d9dcdd646f295e822d4912907942a5a5e4aa4
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    gQYMYwkA.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\MiwYwsgw\gQYMYwkA.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 ed20e871b69fc2427ba9a21d058eabc98d760ba2491c7a742d08678f0870185b
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    gQYMYwkA.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\MiwYwsgw\gQYMYwkA.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 09de61fbfe51f2b6d75a939920b8bf17287b336c83352d47b93d11d3add2b546
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    gQYMYwkA.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\MiwYwsgw\gQYMYwkA.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 a25b094c69f965e61b6a40c18462837d2cbea22ac7b360c19ee738d2ea4eb002
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    gQYMYwkA.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\MiwYwsgw\gQYMYwkA.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 58121c4c3d5b74c4670ac46e195aadb04b5d7d7c680a7cf07fecc0a76764069a
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    gQYMYwkA.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\MiwYwsgw\gQYMYwkA.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 ff123e255e6785921da6327fc58ac3c3b8e500d90954ebd8b5c2c3b5d2f7a741
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    gQYMYwkA.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\MiwYwsgw\gQYMYwkA.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 955538b96a10b3bc69920860f71d20c04e59e6ca913c8710b6fe064e516ce970
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    gQYMYwkA.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\MiwYwsgw\gQYMYwkA.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 ea5f27eef9cd1420eb461611e24813e39009525bf54fe639f5e2d760dd80c06e
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    gQYMYwkA.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\MiwYwsgw\gQYMYwkA.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 55d353fae912f6fdaa4488342639055d5594609916eff188b67b761f559c4b4a
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    gQYMYwkA.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\MiwYwsgw\gQYMYwkA.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 b33d4fc571c05950ccc13788d4a61217cb28a79e3d1c4299cf1c8766a086fe79
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    OSUI.txt
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\OSUI.txt
                                                                                                                                                                                                                                                                                                                                    • Size 7KB
                                                                                                                                                                                                                                                                                                                                    • SHA256 6b6a8091e65f0dbbdbed5610f405fdf074270b0c9290cf8f1994b73768780779
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    zwMEYwkE.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\zeEsscMI\zwMEYwkE.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 cd266d479294b4d189fc8d684d395c823ec0c4781ec0e8163b0595f3c40042a9
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9457bc22e7a51a3b53bd6a56f32c950_elex_virlock
                                                                                                                                                                                                                                                                                                                                    • Size 7KB
                                                                                                                                                                                                                                                                                                                                    • SHA256 df698096381d4ed7725639c0f5266cc0d6094357bc43f7e14c6bc7ef5fbbeae2
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    AEEQ.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\AEEQ.exe
                                                                                                                                                                                                                                                                                                                                    • Size 2.3MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 7bd8b5eec85bf6c4a326a9e790e81e7f469ce16cef7da560c6b5e11e9e8474a5
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    AIUG.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\AIUG.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 e9a042819e019eb8ee8d4dda4c7cb0e022ecff86220c0bbbae309cad92aa8bdd
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    AIwi.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\AIwi.exe
                                                                                                                                                                                                                                                                                                                                    • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 6160288c6b0525955d83365adf00d1bdc5c0584d146806d2a0e40d0e781641b8
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    AUMc.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\AUMc.exe
                                                                                                                                                                                                                                                                                                                                    • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 3892efdb332f7471e5166fa6ebbee54196b5bda8001cbb7c0be1cf0757ae8f3e
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    AUsU.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\AUsU.exe
                                                                                                                                                                                                                                                                                                                                    • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 45cc8827c88e8d5d7d1b21aae82c9a51a03785854d29fb2dbcd3e3778d4a0984
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    AYky.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\AYky.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 d4ef0c5b5d39a87d0a94d1dc189a97276a51ae034c6bfddb6e96ef35746f1bf0
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    Akkq.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\Akkq.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 5a11c763d13b5b584058e908972171bfe0501e43dcb5abab1dab37f3327c10bc
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    CQEM.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\CQEM.exe
                                                                                                                                                                                                                                                                                                                                    • Size 5.2MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 1ad9ad07179d0b05b692f6eef0198e71aaa582d6e1edccd84674907c0af6649d
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    CQUq.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\CQUq.exe
                                                                                                                                                                                                                                                                                                                                    • Size 2.5MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 6cdc1be172920582fa2be797367a493d4f9610aa6623a21ec54a27505301c7e2
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    CQkS.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\CQkS.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 343b59b2bd4f3204ee0479f76a22cf0b3554b021dd8f41322c41111a05ce51b8
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    CUsC.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\CUsC.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 5712b7de690154446eb4bb707cc834ab5bd0905267d99aebf98df044e68a4c86
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    CkUO.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\CkUO.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 d688d633a68370172821a9b2e7c41a6f63e63bbc3992c1a3b3d4615546245f9e
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EMAE.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\EMAE.exe
                                                                                                                                                                                                                                                                                                                                    • Size 3.3MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 d72770f5d4105ea89656d556619e2d3c0fc9eb95dc12be05c529a799f65a6cc0
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EMwS.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\EMwS.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 c97033cea0986e1be85aee90a69147829e9aa27dcad16a0eddc270f3186ab9c0
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EYso.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\EYso.exe
                                                                                                                                                                                                                                                                                                                                    • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 978a8e520dbf3844d2575bd9758bdde3f49a2f6671515ffa0830f23eef78b81f
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    Eoci.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\Eoci.exe
                                                                                                                                                                                                                                                                                                                                    • Size 2.3MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 1479f71a17e844f085b957cf47e1c7dfcb226ee42af0026d741ba52ded5c5a50
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EwAc.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\EwAc.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 b000f15f44616e18f1a22602d694aaa17c50bb004f37e345dc0173a622356e5c
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    GAcw.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\GAcw.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 8e3671f0aba2ee218338d4e2511a9f3577f82788486df1d80e7be800bfdac862
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    GEgg.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\GEgg.exe
                                                                                                                                                                                                                                                                                                                                    • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 4bca509e421cd71c565cbb40e88e36f4a6157382ca13e53017ec4d257331a408
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    GEwO.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\GEwO.exe
                                                                                                                                                                                                                                                                                                                                    • Size 2.5MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 83eabadf5539fecf5f47bc696c6d71449b5a95fee625e94e9ecf8a3ef24cf0b2
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    GMoi.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\GMoi.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 94ebe6f376f5c7f2522c5800b85bdead1f8644a3683c8272adeecae4af35974f
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    GQYY.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\GQYY.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 9d24b7a8e90dc1437cdb7945235ecc4946b1f48f12b70b89fe108e2744f838fb
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    GUog.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\GUog.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 792771c9b750f00799c93995baf572aadd4ea34c8253fc6633c8235de82c1e2b
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    GYcm.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\GYcm.exe
                                                                                                                                                                                                                                                                                                                                    • Size 2.4MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 91506b45904f7f3592044530e4f8cf0ee49febb8f7648afd060436bb276dd39c
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    GoIM.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\GoIM.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 a99522360c869db6d1aa1d60a5f5e6906462655c0e7e9e6a8bf6914fed6bee4b
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    GoUo.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\GoUo.exe
                                                                                                                                                                                                                                                                                                                                    • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 6d06a633073b8cc0025b3c26966371487ab75dd1ee2cb74a95aaab9686cb87b7
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    GwAI.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\GwAI.exe
                                                                                                                                                                                                                                                                                                                                    • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 14207dbd62e3d0d953eca4e588602010244e0a5c2f8399ce240c977df54a2941
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    Icga.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\Icga.exe
                                                                                                                                                                                                                                                                                                                                    • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 24426c7e738ec933ce1fdef9a58d353a2211c31a3a02364f5d7af1e548c337df
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    KAQk.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\KAQk.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 10184eaa49e2efe413c831e13cd0c7ca6f275e03e355796d66913574a1e80864
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    KIwA.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\KIwA.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 fec346c4b4f78f84660989faebccf805631118bb078d677ca43f4c86b61fe7dc
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    KMgS.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\KMgS.exe
                                                                                                                                                                                                                                                                                                                                    • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 a58acd8281fb3c964a5c712bd4f5dc7edd972dadcfd30f2ac1493b0008478107
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    KOQU.ico
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\KOQU.ico
                                                                                                                                                                                                                                                                                                                                    • Size 4KB
                                                                                                                                                                                                                                                                                                                                    • SHA256 119061f905398193977c21e4b6787c9c42b3c7d8eb05b8d2ee33394ac5873619
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    KQAK.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\KQAK.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 ce76dd5652e221e4dce47ace1f0c29bb77abc93053d85c0f65753e39024b9cad
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    KsUU.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\KsUU.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 265fd8c11cb9e19005eb86e8222f710ee4a3925538876e28bf13b1ac445f8175
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    MEIK.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\MEIK.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 c2923030a414544a26f1c7e0d5db77eb4c232969801f529e0278ae677f480527
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    MMsk.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\MMsk.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 7b1098d2d52b3de31d9572370bc69dada36fada132f8925c3731a88aefe423cd
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    MgYY.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\MgYY.exe
                                                                                                                                                                                                                                                                                                                                    • Size 2.3MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 999ea8fc8d2cc984539b55b5911241cd9aaa21b5ddf14e0b7439f4f25726a5d8
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    OIMO.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\OIMO.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 5a8e57674eef0c2b721dc1134ad4898ebcc5dcb96f9a7b255dba586d36a34932
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    OgUg.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\OgUg.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 ce00334f34c2991b1781ff83a38660607226b14dfd86b632ac339a4c2a827ca6
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    OwwU.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\OwwU.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 945cf7b7c888a425426289fe341dad00cbd63c3e9038958fa37d42f4f39f5314
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    QgIw.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\QgIw.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 d76b0ef8f3f4c5e749c59662c4e46f0fed2e5855be53a798b7c916d201dac7c3
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    Qgcg.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\Qgcg.exe
                                                                                                                                                                                                                                                                                                                                    • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 633e70dde9ac716a6fedf2f2029a4ebf102da4bb66fc2db5985576e63f83a08e
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    QoYi.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\QoYi.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 4b4b91f39f65275f69bf5e35d1e73be4a24a29f260f00350b2a8372996922e74
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    QsUS.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\QsUS.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 919fe3b13f79c30206e268062ff32f067cfe4f17801b5b5be1d85502dcf3ad7b
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    SAci.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\SAci.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 993a46813d01562a603e96b347cdf1b420321f0644c212e3f96e2ff8616dbf6e
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    SEMc.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\SEMc.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 5f4569c4dcae564a0733da80b4e1d7d204ea5cd1e1baf0ddbabc2064e1f27720
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    SakM.ico
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\SakM.ico
                                                                                                                                                                                                                                                                                                                                    • Size 4KB
                                                                                                                                                                                                                                                                                                                                    • SHA256 4b700d3ddd9647f8b7da5a6d85d969ac492102d6c1053b1977d7bca36c2a324b
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    ScYY.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\ScYY.exe
                                                                                                                                                                                                                                                                                                                                    • Size 3.0MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 ca25c65071820bab77bd309a2e9436a531e5ebc7fa64f79bef3335722c370038
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    ScoO.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\ScoO.exe
                                                                                                                                                                                                                                                                                                                                    • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 8ebc6a9fa0f62b4c8ac2d2fb8b00e35bb1661dfab60d636d171b274a68218a0b
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    SkUa.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\SkUa.exe
                                                                                                                                                                                                                                                                                                                                    • Size 3.1MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 9fb60c8b0da0d23aef5855ce159cc8f14b2dd2c5801ed904abf93f787b098209
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    Skok.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\Skok.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 3014dccef81a20171b43409f3c66c344290d47e7b70ee3f893f6ee570ab4e641
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    SoAI.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\SoAI.exe
                                                                                                                                                                                                                                                                                                                                    • Size 2.3MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 49d5323dd0a61099095ae78a42a25fe895f1283cb19738457b7bb98a7046c786
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    SsES.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\SsES.exe
                                                                                                                                                                                                                                                                                                                                    • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 f9e28714809246abb23c65005629e4d76f50d6269dd9f82a0e6112dc03fcaa47
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    UAUM.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\UAUM.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 0ae39d73a0006aedb2be9fb8eae3e124c04d775743a53f31b73d32a78cad2968
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    UMcm.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\UMcm.exe
                                                                                                                                                                                                                                                                                                                                    • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 05a5211d3752b3cd9d428f1732bae244974782e0fa07f510000d139da16feca9
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    UUYK.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\UUYK.exe
                                                                                                                                                                                                                                                                                                                                    • Size 3.0MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 b857b690676a738d2e79b657fd516af7242f995e999ed4c8e7da3c507667f6b2
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    Ucsm.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\Ucsm.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 75df56cb724befaa0abb2991ce2b9c2b883e79585a122a81023a0df8d2142b5d
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    UgMS.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\UgMS.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 2aa5238436b0c6bbce26490e9f5fe9567d1109801e8996b2b71846ea947a7a62
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    WIYC.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\WIYC.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 cbe830d317327fb10922d27c5eb59febb32c60a088e681d697edd1866ab422ff
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    WkMw.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\WkMw.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 a2feb384f4ef5d24965f562aba5ecb79185a0d92b940c907ee37e0cabb19d438
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    YYMg.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\YYMg.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 d0a1b242ce23761d8120624fc6e747cd452e112b0e70f1e411070e7d34e00b12
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    YcQk.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\YcQk.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 b273fde078020f40b04e232444e0bbd6f91d5ae534ec6bb5edf2ee2b74a3a8d0
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    Yesc.ico
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\Yesc.ico
                                                                                                                                                                                                                                                                                                                                    • Size 4KB
                                                                                                                                                                                                                                                                                                                                    • SHA256 71254090503179540435a1283d04301f3d5ba48855ae8c361d4ac86e3abd2865
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    Yugg.ico
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\Yugg.ico
                                                                                                                                                                                                                                                                                                                                    • Size 4KB
                                                                                                                                                                                                                                                                                                                                    • SHA256 701a17a9ee5c9340bae4f0810f103d1f0ca5c03141e0da826139d5b7397a6fb3
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    aYkS.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\aYkS.exe
                                                                                                                                                                                                                                                                                                                                    • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 f001f88c2005a9f1a029aa802a4e988ff360f482d4baa6e77207f4f0deb7fb39
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    akYc.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\akYc.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 c1c54abb73bb8c63f455aedc817889ec6740fbac16991fd8bfa56312a0d781e7
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    awkm.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\awkm.exe
                                                                                                                                                                                                                                                                                                                                    • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 9a312ee7034d7dde198a8175b791c0c9ff5f32ad9ccf03391108feb94eb7cdab
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    cAkQ.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\cAkQ.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 441a38fa5bfae6013b15e2b6484043c7991dd607ac72d1656460a7876ef312e2
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    cEIi.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\cEIi.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 f1378cf25307c69549a7bc00e8c8b0442567aee28e5190ea0105fb957d00a5b4
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    coEo.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\coEo.exe
                                                                                                                                                                                                                                                                                                                                    • Size 2.6MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 c93a7427f77fbfbb0fd1211054450d0157b0747b6614c93227809bbe1d622e2e
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    cwMa.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\cwMa.exe
                                                                                                                                                                                                                                                                                                                                    • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 e0a66a435dd8dee3e694a62a1a33cc91ce7ee88ceaeb5610e09b837a1c428f13
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    eIkW.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\eIkW.exe
                                                                                                                                                                                                                                                                                                                                    • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 cf8d854085433ab15c88ccf637377b38e1e8bbd4b7f18f2645af6741db48d688
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    eMUw.ico
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\eMUw.ico
                                                                                                                                                                                                                                                                                                                                    • Size 4KB
                                                                                                                                                                                                                                                                                                                                    • SHA256 955ad377b15d14e80d8eb194375f26e0e9e339b1cfc1e4047e16ae0e0f90fe24
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    file.vbs
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\file.vbs
                                                                                                                                                                                                                                                                                                                                    • Size 19B
                                                                                                                                                                                                                                                                                                                                    • SHA256 59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    gAEg.ico
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\gAEg.ico
                                                                                                                                                                                                                                                                                                                                    • Size 4KB
                                                                                                                                                                                                                                                                                                                                    • SHA256 2dd714e9df3921b1194d3d890f6509ca5ee753d81f9fd83dbeec831440d22938
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    gUwE.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\gUwE.exe
                                                                                                                                                                                                                                                                                                                                    • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 b6494922ff6f186db08e7ea3572bc5009de4397f8531a5f27a41d8564eb1bea0
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    gYgC.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\gYgC.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 c7c13960eef1337cb7d42b9c06e2f2749e3d7d1a9ebc91b5f6c86bbd48498cb0
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    ggIG.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\ggIG.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 db1c9b5609ce82a8fa05ca222bb862e66e73721d1e384c9e687630a51d36aba0
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    goAo.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\goAo.exe
                                                                                                                                                                                                                                                                                                                                    • Size 3.3MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 18d79baa6dd06c157a755d8b1b16dff0d07891a021b30f1c0a2f6dc9ff66f9bb
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    goEu.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\goEu.exe
                                                                                                                                                                                                                                                                                                                                    • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 095a80ad13d6535985aaaee59a46f04b7938eda8c75f4dd34504ffeb2c5620f4
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    iEAi.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\iEAi.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 c719a382d7001ea28cdccdcb4f1ae9c70eeaf3ad1ff83595de19cb3aecd80a03
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    iEsM.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\iEsM.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 d722c2c7525ae9735805a963844e60d26b3700a96de9eaf872f9e0e3dff136ea
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    iEsm.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\iEsm.exe
                                                                                                                                                                                                                                                                                                                                    • Size 3.6MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 a3c7b87e8b099112588a8cf7d79f3d9652912c5d4020d459924bd98537946a1d
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    iWskEEUg.bat
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\iWskEEUg.bat
                                                                                                                                                                                                                                                                                                                                    • Size 112B
                                                                                                                                                                                                                                                                                                                                    • SHA256 ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    icwG.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\icwG.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 783ca5f80e77a27ea8889e2d5ccf676cdc5ffa84b54b328dad5bd7b66748dcba
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    ikgY.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\ikgY.exe
                                                                                                                                                                                                                                                                                                                                    • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 ba07ff957ed4509094d101bc2fee33e637d59e8950cab48391f8892f574588ad
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    kAgE.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\kAgE.exe
                                                                                                                                                                                                                                                                                                                                    • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 20ad9055b6a0017c6250451d9cc3e8d10fb6ea582e196d3d69b2e77c477aba3c
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    kAsM.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\kAsM.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 75379bdb53ffbe733d600bbde8fd6b390949dd1e8cb7c37029ff515873788845
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    kCYo.ico
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\kCYo.ico
                                                                                                                                                                                                                                                                                                                                    • Size 4KB
                                                                                                                                                                                                                                                                                                                                    • SHA256 8fca10b6f4873e2116b823c0de6cb3622e02fba68294dafa19c4d65c131b3405
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    kcgS.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\kcgS.exe
                                                                                                                                                                                                                                                                                                                                    • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 53e1f17fe0aa12ccf2be6ec11759ab972d61067e1586753484d1517623ce6076
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    kkEa.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\kkEa.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 bd35647665189c6bba270e07d25b3d7f581df3d5df11cf3d40b0a1df655f89be
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    koUw.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\koUw.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 c3eff7cbe80d5b1ea08acf3e103c3a6beb24853a9bf13cf9c14ea3c5b6c659dd
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    ksQM.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\ksQM.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 bbab127732857e47226fdeb9e228a0f3e85f3cc88f6da81cd1632b785c8bf59c
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    mIkE.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\mIkE.exe
                                                                                                                                                                                                                                                                                                                                    • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 50a4066a97aef8237e97a36a118c0f1c4e413e7f74a2d7addd8f3aaffdf2d3cd
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    mIoy.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\mIoy.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 10d6b195e38fb650a283f04b5132335db47819db59a2a07aac66b6265c83476a
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    mUAK.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\mUAK.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 ef102e753d281101f8a77d51790603fdfcde34bd9204e6934c1e580cd2941aa0
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    mYks.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\mYks.exe
                                                                                                                                                                                                                                                                                                                                    • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 864531e9222ce697060db807e16815c4c9eb35eb51876833d8ddc1f8d6521047
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    moAU.ico
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\moAU.ico
                                                                                                                                                                                                                                                                                                                                    • Size 4KB
                                                                                                                                                                                                                                                                                                                                    • SHA256 114dae4c54ca426f78e50998727dac92942261d71ca5b2dbaf413794dcf8ad82
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    moUC.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\moUC.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 be07856d6c35794743a1f1675b32813998222f0c8c520e704abacad6db37e9f6
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    msYI.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\msYI.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 a15838e974e31ae6dbf3b5b4aff8f416cd6355d9e240a206bf119571577a2430
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    oAgo.ico
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\oAgo.ico
                                                                                                                                                                                                                                                                                                                                    • Size 4KB
                                                                                                                                                                                                                                                                                                                                    • SHA256 ed7913a5b4914f6343f312915bd957b6c72c09c3061985d38d2d8b6c4241af51
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    oEEs.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\oEEs.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 bef6a0915a504b0e83fb413066a28a891e56421b52b9419f9d4365e488dc49fb
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    oQQe.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\oQQe.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 590753c21afa0449e24651c53394bb5bbfef83325b82a0f31fd487ebb9ee81f5
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    oYYs.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\oYYs.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 06be7a54ea4a6497f18ccfa665e40dbfb1333415966c5a6739d046155ab590dd
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    okkE.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\okkE.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 8c55bb26c7da23d243c7577a6c4a8b025cb188aca7ca67e636ab7e3ada6b2f60
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    ooMm.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\ooMm.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 b0fe3bacb339b094ae71ed80a35d4f9e3123bf3919de3b5e8dac5b07ef9fa0dd
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    osgA.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\osgA.exe
                                                                                                                                                                                                                                                                                                                                    • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 1c475dd8d8826fb1636fcb464f39e168c454a1c9b3d8b02484b60aa60e6548a5
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    qAYm.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\qAYm.exe
                                                                                                                                                                                                                                                                                                                                    • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 e12d36292c2b482d4af6b64cfa7a69e998e33967467fb03528482342c34c911e
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    qMEc.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\qMEc.exe
                                                                                                                                                                                                                                                                                                                                    • Size 2.4MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 a54b243d54c6e5b189cd6ad67455f4c66e2126d5a694453b62578af8cbfe5f22
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    qQIQ.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\qQIQ.exe
                                                                                                                                                                                                                                                                                                                                    • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 ea76e594a5e31bc35da846aff67415900d93f42abadad1aff8f9d4677f77af52
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    qUQM.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\qUQM.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 83a1a1f4c9ce35973ee80d7e3edf79ccb83238e9257cf1a4d7c5c4afdab4dbe0
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    qYsO.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\qYsO.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 985c6a215c131938dea95c4c57f3c84e2aaa5aa1c98c806fd323823e96e13e2b
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    qoIE.ico
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\qoIE.ico
                                                                                                                                                                                                                                                                                                                                    • Size 4KB
                                                                                                                                                                                                                                                                                                                                    • SHA256 6b1018b4e474afacb1c54331284d85fdbc2bb5e945466dcbda91231feeac5fd4
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    qsEi.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\qsEi.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 8926410e1f4b40ab26e6c63fee39e0736e544e9f8988dc3b2ebefddc8daff2a5
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    sooG.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\sooG.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 efab4c8a0d4f911c30c08268412351509ff1117728b607ea18b56f535ed94e90
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    uYMg.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\uYMg.exe
                                                                                                                                                                                                                                                                                                                                    • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 29b95a35aee620120936df1824db617d6257d039de5f88e1a2ee074b4385f066
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    uYQo.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\uYQo.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 b58701962ae5627354b3d9384b3a548e63563f248b786ddb6bb657b2cbb8f439
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    uYUm.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\uYUm.exe
                                                                                                                                                                                                                                                                                                                                    • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 07d56100c5bbd036c84fdad41aa24cd81c14fdd1bc503923be1e96f10974823e
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    ugQW.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\ugQW.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 96b6cec84576a5531bc5e241e4156b3864b040b6d0d1c269bd6c9367f1535b79
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    uoMU.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\uoMU.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 aee2d816b92ef2254053a5a02cb175c1280ca4a17d15637477e113b88c60347d
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    uygA.ico
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\uygA.ico
                                                                                                                                                                                                                                                                                                                                    • Size 4KB
                                                                                                                                                                                                                                                                                                                                    • SHA256 0e140fda863f8fb77d504391b920972bfc33da1bf087ebc7728bc700d402d0f3
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    wEcu.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\wEcu.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 b976181f5ecba94c69a48352fcd162cfd51b3be815602864014ccb0a5c1f3a54
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    wQMo.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\wQMo.exe
                                                                                                                                                                                                                                                                                                                                    • Size 2.8MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 ea19dc4a7bd118652a848fd299b0eccb2afd7ee6a80786cea4eeeea945512906
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    wgMI.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\wgMI.exe
                                                                                                                                                                                                                                                                                                                                    • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 17884e5aec1b61d4895620613e5b4824a65584cad6dbaa4bf8c815c77d79ae9a
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    wkIi.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\wkIi.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 9ac543915ddc4b15e6d3bc5514b0765ec8ddb5d2e598b4a4147ef068135dcbf0
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    wwQg.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\wwQg.exe
                                                                                                                                                                                                                                                                                                                                    • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 b2b1f3800ee40f06ec5a78a02d9a5092962f396ffe60e772b58c90a933278a47
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    yCYA.ico
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\yCYA.ico
                                                                                                                                                                                                                                                                                                                                    • Size 4KB
                                                                                                                                                                                                                                                                                                                                    • SHA256 e4c00332694cb4a7fdbc6dc19cd1eef271dff84d8a0a601e70f48e597351cf82
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    yIYc.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\yIYc.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 0762f1d2b00e599a5a76fba1cbb52b1850f2cdb9189bbc64c41d25ca7908e2aa
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    yIsm.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\yIsm.exe
                                                                                                                                                                                                                                                                                                                                    • Size 2.8MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 c7398a13dff4967b51caf13144b07e611ada56544b60ad7ae691b48e5c7e3759
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    yYYm.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\yYYm.exe
                                                                                                                                                                                                                                                                                                                                    • Size 2.3MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 a6c58023916d282f6aba1dabe45dea8cdb3f792a07d109fb12a6adef06acc927
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    ywUK.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\ywUK.exe
                                                                                                                                                                                                                                                                                                                                    • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 82299c0e3195e62557a0a5f86472cd4646794a3c158e5343a43ab2c06f69dbd4
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    yyAg.ico
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\yyAg.ico
                                                                                                                                                                                                                                                                                                                                    • Size 4KB
                                                                                                                                                                                                                                                                                                                                    • SHA256 e5798e3d8c1af62d997a27bc2fb7333639a4f20e9753cf7a5b0639cd93f96448
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EYIIcwkk.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\IwQQEYso\EYIIcwkk.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 09a96c3557c262551cdf27d43d9f719e1165f89c30363533a73cf74e3b9413bb
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\IwQQEYso\EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 ba7932a66d0bd83383ce99b085a1d9db6d9228b0ca9a5e7054d6f665abbf546c
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\IwQQEYso\EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 a4fe79fa14ed64bb3b821bb41477bcfdc4e0ae95049983ab64f1ccd5eb341201
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\IwQQEYso\EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 01f8d041531584dc1d723cf66b9bc0d8db81ecf348d820d8a2c7a7668264ef06
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\IwQQEYso\EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 aee976e0d40fded5ef525940161ecf791f2a8069d59ca4746df3656846109ccc
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\IwQQEYso\EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 b0a2c2b35d9305d170bd6c44e593ae5a84d20f1bfd22b8d7c181800b986433d0
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\IwQQEYso\EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 78c3e059f109ad09c6cef9a66e9712dfa2d52b5f133b37680068758abbd508bd
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\IwQQEYso\EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 cf57bddaae5eb42871dfa84b33524fdad258d2d4c4185dcbf1404802cf81cfc4
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\IwQQEYso\EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 bc7bf699da3e489790e3a972355862f4726e98c20651b852d6eeaf62be58ef6e
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\IwQQEYso\EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 7dd9680943504ca00323992b1e28d2f8bd0f3be22d3282505b9a2a85e828085a
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\IwQQEYso\EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 67415df6029e589c2490885d06cb4245d0406f4134ea5792f632d7add972c6c4
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\IwQQEYso\EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 3b9301da8e21695598911b7133961b2d24d71491d9971f5139a71a2aff5723c8
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\IwQQEYso\EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 b35eddfc06d4d9a23652d2c689d907e774ac4e284ea1fc0b869834d5f14b72fd
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\IwQQEYso\EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 facaeda18b1bd3b3546417fd8feeabbdf08a60104048869589b4157d48c5059e
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\IwQQEYso\EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 f969efc75e4fa1c64c14dd7d3db59ee690d448a05cbd415e9a4750c078572aae
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\IwQQEYso\EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 6c30763319fe821ba3dde5584afc85e194b69d122890d9b78b944543c4abf4a1
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\IwQQEYso\EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 3a2563bebe2b3af21e774b723e23bd592e2ae52a1ba198914777a63bb959c3ed
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\IwQQEYso\EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 626a6c07e25a6701880c2952d11a78300a4e686b2b1e5b2f91db4be3db98150d
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\IwQQEYso\EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 a5f14d4e62e290b092ea2915e367438890470a9d34b0880bcda56bec34f550d7
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\IwQQEYso\EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 38ac088361d59f4e55cdf658ca3dba288c85d0dff4e34b48540931093e37b03c
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\IwQQEYso\EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 27975b6708663de71d59a575416ac33f3b73b3e24f4a97636a49008f47a06fff
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\IwQQEYso\EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 0f05c808812e59448282399160dcc6bbbf947a3bbd8df88e4a73ef8ef01ff7b9
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\IwQQEYso\EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 04508f6a53a4d78c71d1200b07b853e4e189600af3373d9e56ac363ff69312c7
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\IwQQEYso\EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 e53283988c38851507ae6c0f33d0bba34df539d322c2fe3cc1b669403617a474
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\IwQQEYso\EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 0472d86865330aa7c276127c45cc9e763720600bae754d81daa9c8dda99b8795
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\IwQQEYso\EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 910253b85e25751531cbdb70ec5567d7e91100293b29a9bc670804c1f3077429
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\IwQQEYso\EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 1707a0411405c947d55cb60b199c7c0b143d3bf74606102f514314887a1d7824
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\IwQQEYso\EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 202a149c7554deb6a7d14a779d3e27606726f7912adfbb1adefaa0014d68bdd7
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\IwQQEYso\EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 310cca16380bb191232f2379284925b90ca58bcdbf04581fb928f86e5e268083
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\IwQQEYso\EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 dbfb4823f793a0fdd397ae5e7657467f0824f3e08be27e7af8955d63b716e182
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\IwQQEYso\EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 988b4c70bb1b5b78f56233750cdc560060080958255251f4b6338f82b8a3f36e
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\IwQQEYso\EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 872c59704159cdc8dcc430ba7ed98a8f00b57fd6b649fd61aecd22bf0cd6c7b9
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\IwQQEYso\EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 cf8d563bb08057de7dc6202c759cc1431b3eabfbc0b23e82ec52311a5b78464a
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\IwQQEYso\EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 c1eaec4d3a8f7a975161a9a95e28492ca9d45684b0607c929b009426665f0583
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\IwQQEYso\EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 faeefad953ed6f42c391e7e1803aa25a0c6d24a5f5870bd118cf1e6600649815
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\IwQQEYso\EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 789d1338fc1a403e7fb55227d24a194285cf42473f6a366e58749627abe8ace2
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\IwQQEYso\EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 47f3711f7005a9e472b1f9b3ba7f811d04a21c4e4f9b7ce34afc4fb85ceed2e5
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\IwQQEYso\EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 23133d495b07a7ebf1806823852f5a1ce7ceba8811c73b80d90daa5870b9744c
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\IwQQEYso\EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 094820643613031757956e9a959452d5ba4d00fd9cd22020d6450feda6fca791
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\IwQQEYso\EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 07fb551a51cf9b65345f4c039c64b4a7fe2ea64caa35ee63ce102fb93fac4275
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\IwQQEYso\EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 bce264ead91bd1738b292c80069506bcf575749472c254005498f06ca5cd0f52
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\IwQQEYso\EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 89633488e956da0dec030d661487ac22cca2e43e55f03e530228984b53c567b9
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\IwQQEYso\EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 85eb3ce04a56aa9177303ee066bbb9a8aeb07170b5b9a12c3efdd0d2eefe8048
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\IwQQEYso\EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 2eb484938eb85508d3e07fb6444410b9612b798796226877629433f713c3269c
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\IwQQEYso\EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 60ce2b88ccf5a81e8408202cda1b0f4b710ec4157cf597154daa3ab2d533975b
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\IwQQEYso\EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 d218250f96e173aa9683a15bf601f8af37ae826e93874848c7b8d22613eb8806
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\IwQQEYso\EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 9bafad82ef396f2fccf210e69727988a30e9caa220d00f9052291af8a43d643c
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\IwQQEYso\EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 6c6247988e16b22e2173b43559344bae0c03ec0a3a7e76d03c731fee7f18d53c
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\IwQQEYso\EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 df5b382037b32fd4310a659b0769ec351b0b3d02afa8417c6ee5005dca259dac
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\IwQQEYso\EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 dcf51b487889cd1c19f1b5ded1be1c2d1311fc220014b5b993da20ae48a40d0a
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\IwQQEYso\EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 efeba4146e12206229fee562c49b85529cf7674e41054c7dee1f36bddf2e0a6a
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\IwQQEYso\EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 ca0a6481b77b74d80edeba95b13614fdf6b08bbedc37135aafb518b3e91c8c2f
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\IwQQEYso\EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 b1b3fa6ee5351ebfed936c4b25974586e212e09aa54ac37c8c899c43ea19ec0d
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\IwQQEYso\EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 00f7336cd76dbe12f45a255155afcc1b211a3fda5acf881a13558a5ede62edb5
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\IwQQEYso\EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 a47230304f571c931c38d64db4ddbe485f3d18d1541914e3522954cb74b270cc
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\IwQQEYso\EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 6b072c4a4bcb7819ae444ac59ac08f6b1ebcdd901ecbcda130da53a2b49a4bde
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\IwQQEYso\EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 655221bbf5731e78ca0fb15e1024f3b226cf9536904f6f2b464f2dd5671dbcfd
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\IwQQEYso\EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 c131f2189fe740cc3b958f10451b75aa25031b5421b31efb3dacd2949f85630d
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\IwQQEYso\EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 0a2cb89e188caf9228c1a71480dfd56dceb58d8b757b362e9ef4c1c29a4478f4
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\IwQQEYso\EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 a8f811a02daca8e0aa6eb306fc1510401fd8eb0454bed915ad6900a898a28cbd
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\IwQQEYso\EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 14779d3824a3d4df5a11447217563388d9b55ae195c903801186860459f157ab
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\IwQQEYso\EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 cef93809cab28e7a6514886239e81e6599adad3ff7aebce55cd069b1368141db
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\IwQQEYso\EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 b3ee627108a9f99063d0529d2e6a124d98a392b93f0f9dab99007a927bb8e043
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\IwQQEYso\EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 9b8c23f147b5a9e2710e784e9b598bfa71508c631388b3964534c8382777786e
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\IwQQEYso\EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 56c2985cce4d3503c2710ce4a0dc13a86f48c6b5b4686df8657a8d73e2257b5b
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\IwQQEYso\EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 3883808cf613989bbe2bc9e5cca4af76acae595191c2df424d53f6ffb14b9059
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\IwQQEYso\EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 6ce9cd35b3f069a0fb9b38939b5a0f3d0a23603fcb7ee50c777dcd701eae3cb2
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\IwQQEYso\EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 084851c0220b0c6ea96ca76d9776a7688ec1ff8079af609aaba4acfdeda7adf4
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\IwQQEYso\EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 f2092344a8296795751737b2fa7190e28db62356977ac5ef90e68b64415a03a5
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\IwQQEYso\EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 7d6b7db474669b59b1c3ef6e0884e45e47b66996ea30a851767bebbae145ac7d
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\IwQQEYso\EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 07f9cea103900a345511df2ee1254f11a7e93c84671c59baeddf52cb18171c0e
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\IwQQEYso\EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 8a863655e2882ee31cb29c2e4d8593e5e4d6986ed556c116c12f69587aac2272
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\IwQQEYso\EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 a1fd2407b37688d2fb365353e7b97cf934fbcad4a0f5b4cb5c9a6e58203d2c86
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\IwQQEYso\EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 268fa8719d2720e232ecf291e2cd4dcb6cd8faf436219e8ea24962179fe16129
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\IwQQEYso\EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 21449051d934f0d339d53a2b016bf97f3b950870ecde9d5ab0df6585c45daa09
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\IwQQEYso\EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 b689c2c7476f2b48c2730a573db584a8c26e3b621ba5e9d4dab9cf2f4ce3127e
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\IwQQEYso\EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 aa7d6396330ca2413fc519b8aa3da160580dbaf21026ef71dd79bc8759456c56
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\IwQQEYso\EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 cf0984ca07981eedbea892e6d8b86de316d1e242b62e6c9a1c360c5f08f9b764
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\IwQQEYso\EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 f16ce0ec94c36795467c50b16dedcdf4c1bf6cd254a8dd8688d7b1c79be87bd5
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\IwQQEYso\EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 b51b860749a3ad3f8ccef22b55be4993aaa74e1c004b29eff4d964e8bbe2b550
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\IwQQEYso\EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 05999747e72a728fd69f2cd448ee2d32c411286e561e0a26141d7c042a47ed14
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\IwQQEYso\EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 9bf1c04eb17f07349bec2d7fdfdd2b801c3a09c499aa82de17a3358cbb7c58c9
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\IwQQEYso\EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 c302c2bb4f473a73570c81de78df6c4e75bb83d9a4e49f20a29750018be13988
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\IwQQEYso\EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 9120e2f903105a289576fed5696b2186ce7b19feba0b26fbff4e3ba997546592
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\IwQQEYso\EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 6bc796d513ac2a6a1d36c683ac82176b44ff1002f8c1cd9462a1f93bb8a005de
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\IwQQEYso\EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 a8f4059e009808b48b4e646bf30c9d48ea6814b9db027343a9e3d92ac7a977e1
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\IwQQEYso\EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 4bd5a7e9facde4328124e55d3600f8d7c7e59ef889c1dd3ddb9dc963c2e45e33
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\IwQQEYso\EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 657671e9c3306c6d40ad0f1509a32449e0a3c29580cefd1e51940a45089f9e95
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\IwQQEYso\EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 cc8721faf95f3edcd9f3b77e113e913e9c73422e6b38b6b3696c653aa115202f
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\IwQQEYso\EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 c74fb05df670733ac13451c48969f62bb39fe2da34ca8e7f032c85a24e814f69
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\IwQQEYso\EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 481f700d00d4c95cc5d6376a689a35318f0b484804310f657de8241d96d19264
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\IwQQEYso\EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 0dc0767a13ceaa8bbee38b7c4a483a017f7e7df1cc49269dcacc7518f22b182b
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\IwQQEYso\EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 f743373b70ca5bcffe0a65f82eab723dcb19954a8eb2519f9db7f1e5089fc107
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\IwQQEYso\EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 b08f106c61e6e42047bd9af181b5a12f8070b94b6581b8cebb76ca59c4fb22bc
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\IwQQEYso\EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 d512b82fd237cad41ce0f030dc23974927ce0e6fe6c0446f19b06aacab0cf5fc
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\IwQQEYso\EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 5a7f4a7ac44734a6078ed9672d5a6e5bed13bb663f3b9f12256015dc04d5445b
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\IwQQEYso\EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 517bf761269a91db7e79a30f467b53ba5889b112279fc6253ae3c41971e376da
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\IwQQEYso\EYIIcwkk.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 5ff280e9095d23ffece58a218f1ee46cf2e14e738b90565962e7c35c6c5f6a03
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    memory/424-1961-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/556-272-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/1148-228-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/1196-19-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/1196-2092-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/1220-1856-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/1388-48-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/1712-205-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/1736-131-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/1736-109-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/1800-1838-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/1824-1986-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/1824-1973-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/1928-1196-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/2080-313-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/2216-1730-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/2312-238-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/2496-61-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/2520-31-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/2520-32-0x0000000000AA0000-0x0000000000AC0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/2520-0-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/2520-1-0x0000000000AA0000-0x0000000000AC0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/2544-291-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/2620-1807-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/2660-1913-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/2768-1944-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/2892-260-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/2892-247-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/2996-1816-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/3144-67-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/3144-83-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/3260-1977-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/3260-1963-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/3324-324-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/3820-1785-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/3888-335-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/3968-282-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/4072-1754-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/4080-380-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/4088-1829-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/4108-1891-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/4164-16-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/4164-2087-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/4204-143-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/4248-115-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/4276-1899-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/4392-187-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/4428-1699-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/4520-1794-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/4556-175-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/4588-343-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/4636-1709-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/4636-1700-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/4644-1877-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/4688-1931-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/4700-301-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/4708-8-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/4708-2081-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/4708-1731-0x00000000021F0000-0x0000000002210000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/4708-360-0x00000000021F0000-0x0000000002210000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/4744-2107-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/4792-154-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/4916-350-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/4916-358-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/4972-1745-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/5032-1999-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/5144-98-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/5312-219-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/5440-1846-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/5472-1869-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/5520-251-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/5560-2097-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/5596-1922-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/5700-1763-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/5764-1776-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/5868-1953-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/6080-1722-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/6124-893-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download