Overview

overview

10

Static

static

3

2026-10-27...ck.exe

windows10-2004-x64

10

2026-10-27...ck.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    147s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    28/10/2026, 17:03

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock.exe
  • Size 1.6MB
  • Sample261028-vk2shaew9p
  • SHA256 3a0dc4abd1f7b2dc3ad5a29dab599a2cba47f47412897f799a1e72c13af8c4a1
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryexecutionnabucurpersistenceransomwarespywarestealertrojan

Malware Config

Signatures

  • Family: Nabucur

    Nabucur is a ransomware first seen in 2015.

    ransomwarenabucur
  • Modifies visibility of file extensions in Explorer 2 TTPs 26 IoCs
    defense_evasion
  • UAC bypass 3 TTPs 26 IoCs
    defense_evasiontrojan
  • Renames multiple (110) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Executes dropped EXE 6 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 8 IoCs
    persistence
  • Drops file in System32 directory 2 IoCs
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 26 IoCs
    execution
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 52 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 10 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry key 1 TTPs 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 9 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4608
    • C:\Users\Admin\ZocsgcQo\QKUcIIEU.exe
      "C:\Users\Admin\ZocsgcQo\QKUcIIEU.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      PID:3532
    • C:\ProgramData\sccUAgIs\OCwQsksA.exe
      "C:\ProgramData\sccUAgIs\OCwQsksA.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Reads the TCP/IP host and domain name from the registry
      PID:1348
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock"
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4540
      • C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock.exe
        C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4312
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock"
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:2824
          • C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock.exe
            C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:5152
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock"
              6⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:2044
              • C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock.exe
                C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock
                7⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:2880
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock"
                  8⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:1464
                  • C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock.exe
                    C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock
                    9⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of WriteProcessMemory
                    PID:2688
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock"
                      10⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:6108
                      • C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock.exe
                        C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock
                        11⤵
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of WriteProcessMemory
                        PID:2132
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock"
                          12⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:3520
                          • C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock.exe
                            C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock
                            13⤵
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of WriteProcessMemory
                            PID:5944
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock"
                              14⤵
                              • Executes a command shell one-liner
                              • Suspicious use of WriteProcessMemory
                              PID:2124
                              • C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock.exe
                                C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock
                                15⤵
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of WriteProcessMemory
                                PID:2248
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock"
                                  16⤵
                                  • Executes a command shell one-liner
                                  • Suspicious use of WriteProcessMemory
                                  PID:2976
                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock.exe
                                    C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock
                                    17⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of WriteProcessMemory
                                    PID:3608
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock"
                                      18⤵
                                      • Executes a command shell one-liner
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of WriteProcessMemory
                                      PID:244
                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock.exe
                                        C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock
                                        19⤵
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:4724
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock"
                                          20⤵
                                          • Executes a command shell one-liner
                                          PID:4080
                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock.exe
                                            C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock
                                            21⤵
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:404
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock"
                                              22⤵
                                              • Executes a command shell one-liner
                                              PID:1860
                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock.exe
                                                C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock
                                                23⤵
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:3124
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock"
                                                  24⤵
                                                  • Executes a command shell one-liner
                                                  PID:2400
                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock.exe
                                                    C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock
                                                    25⤵
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:3284
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock"
                                                      26⤵
                                                      • Executes a command shell one-liner
                                                      PID:5352
                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock.exe
                                                        C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock
                                                        27⤵
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:3844
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock"
                                                          28⤵
                                                          • Executes a command shell one-liner
                                                          PID:2088
                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock.exe
                                                            C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock
                                                            29⤵
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            PID:3280
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock"
                                                              30⤵
                                                              • Executes a command shell one-liner
                                                              PID:4008
                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock.exe
                                                                C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock
                                                                31⤵
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                PID:1304
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock"
                                                                  32⤵
                                                                  • Executes a command shell one-liner
                                                                  PID:4780
                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock.exe
                                                                    C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock
                                                                    33⤵
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:5360
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock"
                                                                      34⤵
                                                                      • Executes a command shell one-liner
                                                                      PID:4024
                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock.exe
                                                                        C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock
                                                                        35⤵
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:3524
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock"
                                                                          36⤵
                                                                          • Executes a command shell one-liner
                                                                          PID:1100
                                                                          • C:\Windows\System32\Conhost.exe
                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                            37⤵
                                                                              PID:2256
                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock.exe
                                                                              C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock
                                                                              37⤵
                                                                                PID:3296
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock"
                                                                                  38⤵
                                                                                  • Executes a command shell one-liner
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  PID:4432
                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock.exe
                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock
                                                                                    39⤵
                                                                                      PID:3384
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock"
                                                                                        40⤵
                                                                                        • Executes a command shell one-liner
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:5080
                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock.exe
                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock
                                                                                          41⤵
                                                                                            PID:3920
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock"
                                                                                              42⤵
                                                                                              • Executes a command shell one-liner
                                                                                              PID:3412
                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock.exe
                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock
                                                                                                43⤵
                                                                                                  PID:2996
                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock"
                                                                                                    44⤵
                                                                                                    • Executes a command shell one-liner
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    PID:2480
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock.exe
                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock
                                                                                                      45⤵
                                                                                                        PID:3756
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock"
                                                                                                          46⤵
                                                                                                          • Executes a command shell one-liner
                                                                                                          PID:4684
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock.exe
                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock
                                                                                                            47⤵
                                                                                                              PID:5608
                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock"
                                                                                                                48⤵
                                                                                                                • Executes a command shell one-liner
                                                                                                                PID:4048
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock.exe
                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock
                                                                                                                  49⤵
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  PID:2348
                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock"
                                                                                                                    50⤵
                                                                                                                    • Executes a command shell one-liner
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    PID:1268
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock.exe
                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock
                                                                                                                      51⤵
                                                                                                                        PID:3548
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock"
                                                                                                                          52⤵
                                                                                                                          • Executes a command shell one-liner
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          PID:4912
                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                          52⤵
                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                          • Modifies registry key
                                                                                                                          PID:2364
                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                          52⤵
                                                                                                                            PID:4380
                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                            52⤵
                                                                                                                            • UAC bypass
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            • Modifies registry key
                                                                                                                            PID:4116
                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HmEgEIIU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock.exe""
                                                                                                                            52⤵
                                                                                                                            • Executes a command shell one-liner
                                                                                                                            PID:296
                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                              53⤵
                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                              PID:2360
                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                        50⤵
                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                        • Modifies registry key
                                                                                                                        PID:3716
                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                        50⤵
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        • Modifies registry key
                                                                                                                        PID:1176
                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                        50⤵
                                                                                                                        • UAC bypass
                                                                                                                        • Modifies registry key
                                                                                                                        PID:1812
                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                          51⤵
                                                                                                                            PID:4192
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SuMIoAko.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock.exe""
                                                                                                                          50⤵
                                                                                                                          • Executes a command shell one-liner
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          PID:3988
                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                            51⤵
                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                            PID:480
                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                      48⤵
                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                      • Modifies registry key
                                                                                                                      PID:5144
                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                      48⤵
                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                      • Modifies registry key
                                                                                                                      PID:4112
                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                      48⤵
                                                                                                                      • UAC bypass
                                                                                                                      • Modifies registry key
                                                                                                                      PID:4836
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\waEUAQgc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock.exe""
                                                                                                                      48⤵
                                                                                                                      • Executes a command shell one-liner
                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                      PID:4996
                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                        49⤵
                                                                                                                          PID:5688
                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                          49⤵
                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                          PID:5156
                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                    46⤵
                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                    • Modifies registry key
                                                                                                                    PID:720
                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                    46⤵
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    • Modifies registry key
                                                                                                                    PID:2616
                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                    46⤵
                                                                                                                    • UAC bypass
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    • Modifies registry key
                                                                                                                    PID:2012
                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JaIEwgUI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock.exe""
                                                                                                                    46⤵
                                                                                                                    • Executes a command shell one-liner
                                                                                                                    PID:5388
                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                      47⤵
                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                      PID:3432
                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                44⤵
                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                • Modifies registry key
                                                                                                                PID:1200
                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                  45⤵
                                                                                                                    PID:4764
                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                  44⤵
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  • Modifies registry key
                                                                                                                  PID:692
                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                  44⤵
                                                                                                                  • UAC bypass
                                                                                                                  • Modifies registry key
                                                                                                                  PID:2360
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fsEYQAQE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock.exe""
                                                                                                                  44⤵
                                                                                                                  • Executes a command shell one-liner
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  PID:5012
                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                    45⤵
                                                                                                                      PID:3852
                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                      45⤵
                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                      PID:944
                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                42⤵
                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                • Modifies registry key
                                                                                                                PID:2520
                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                42⤵
                                                                                                                • Modifies registry key
                                                                                                                PID:960
                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                42⤵
                                                                                                                • UAC bypass
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                • Modifies registry key
                                                                                                                PID:4380
                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nmwIgwMs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock.exe""
                                                                                                                42⤵
                                                                                                                • Executes a command shell one-liner
                                                                                                                PID:3728
                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                  43⤵
                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  PID:3156
                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                            40⤵
                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                            • Modifies registry key
                                                                                                            PID:1132
                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                            40⤵
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            • Modifies registry key
                                                                                                            PID:6032
                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                            40⤵
                                                                                                            • UAC bypass
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            • Modifies registry key
                                                                                                            PID:4848
                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WWYksscg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock.exe""
                                                                                                            40⤵
                                                                                                            • Executes a command shell one-liner
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            PID:3808
                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                              41⤵
                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                              PID:5292
                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                        38⤵
                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                        • Modifies registry key
                                                                                                        PID:4628
                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                        38⤵
                                                                                                        • Modifies registry key
                                                                                                        PID:2428
                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                          39⤵
                                                                                                            PID:4124
                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                          38⤵
                                                                                                          • UAC bypass
                                                                                                          • Modifies registry key
                                                                                                          PID:3904
                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                            39⤵
                                                                                                              PID:3104
                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OegsQcoI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock.exe""
                                                                                                            38⤵
                                                                                                            • Executes a command shell one-liner
                                                                                                            PID:2264
                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                              39⤵
                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              PID:3232
                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                        36⤵
                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        PID:4928
                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                        36⤵
                                                                                                        • Modifies registry key
                                                                                                        PID:3076
                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                        36⤵
                                                                                                        • UAC bypass
                                                                                                        PID:5392
                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                          37⤵
                                                                                                            PID:5668
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dwQUEggA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock.exe""
                                                                                                          36⤵
                                                                                                          • Executes a command shell one-liner
                                                                                                          PID:3208
                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                            37⤵
                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                            PID:568
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                      34⤵
                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                      • Modifies registry key
                                                                                                      PID:4684
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                      34⤵
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      • Modifies registry key
                                                                                                      PID:5444
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                      34⤵
                                                                                                      • UAC bypass
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      PID:1768
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VYQMowgI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock.exe""
                                                                                                      34⤵
                                                                                                      • Executes a command shell one-liner
                                                                                                      PID:4252
                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                        35⤵
                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                        PID:2384
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                  32⤵
                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                  • Modifies registry key
                                                                                                  PID:1216
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                  32⤵
                                                                                                    PID:5824
                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                    32⤵
                                                                                                    • UAC bypass
                                                                                                    • Modifies registry key
                                                                                                    PID:5936
                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HUckIows.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock.exe""
                                                                                                    32⤵
                                                                                                    • Executes a command shell one-liner
                                                                                                    PID:4740
                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                      33⤵
                                                                                                        PID:2768
                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                        33⤵
                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        PID:4664
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                  30⤵
                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  • Modifies registry key
                                                                                                  PID:6124
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                  30⤵
                                                                                                  • Modifies registry key
                                                                                                  PID:6112
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                  30⤵
                                                                                                  • UAC bypass
                                                                                                  • Modifies registry key
                                                                                                  PID:4192
                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                    31⤵
                                                                                                      PID:4616
                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AOkocMoE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock.exe""
                                                                                                    30⤵
                                                                                                    • Executes a command shell one-liner
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    PID:1080
                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                      31⤵
                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                      PID:6000
                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                28⤵
                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                • Modifies registry key
                                                                                                PID:1700
                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                28⤵
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                • Modifies registry key
                                                                                                PID:1812
                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                28⤵
                                                                                                • UAC bypass
                                                                                                • Modifies registry key
                                                                                                PID:5080
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AuoIQkco.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock.exe""
                                                                                                28⤵
                                                                                                • Executes a command shell one-liner
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                PID:5524
                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                  29⤵
                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                  PID:5952
                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                            26⤵
                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            • Modifies registry key
                                                                                            PID:3268
                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                            26⤵
                                                                                            • Modifies registry key
                                                                                            PID:5048
                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                            26⤵
                                                                                            • UAC bypass
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:5980
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WAgcMQoA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock.exe""
                                                                                            26⤵
                                                                                            • Executes a command shell one-liner
                                                                                            PID:5212
                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                              27⤵
                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                              PID:5336
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                        24⤵
                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                        • Modifies registry key
                                                                                        PID:4184
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                        24⤵
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        • Modifies registry key
                                                                                        PID:3128
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                        24⤵
                                                                                        • UAC bypass
                                                                                        • Modifies registry key
                                                                                        PID:2256
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kEAMYEQU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock.exe""
                                                                                        24⤵
                                                                                        • Executes a command shell one-liner
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:2484
                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                          25⤵
                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                          PID:5668
                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                    22⤵
                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                    • Modifies registry key
                                                                                    PID:4684
                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                    22⤵
                                                                                    • Modifies registry key
                                                                                    PID:3852
                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                    22⤵
                                                                                    • UAC bypass
                                                                                    PID:4268
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hiIgcAIs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock.exe""
                                                                                    22⤵
                                                                                    • Executes a command shell one-liner
                                                                                    PID:5528
                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                      23⤵
                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:3428
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                20⤵
                                                                                • Modifies visibility of file extensions in Explorer
                                                                                • Modifies registry key
                                                                                PID:5824
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                20⤵
                                                                                • Modifies registry key
                                                                                PID:4708
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                20⤵
                                                                                • UAC bypass
                                                                                • Modifies registry key
                                                                                PID:788
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TMAkAkkQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock.exe""
                                                                                20⤵
                                                                                • Executes a command shell one-liner
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:4680
                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                  21⤵
                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                  PID:2768
                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                            18⤵
                                                                            • Modifies visibility of file extensions in Explorer
                                                                            • System Location Discovery: System Language Discovery
                                                                            • Modifies registry key
                                                                            PID:692
                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                            18⤵
                                                                            • Modifies registry key
                                                                            PID:3104
                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                            18⤵
                                                                            • UAC bypass
                                                                            • System Location Discovery: System Language Discovery
                                                                            • Modifies registry key
                                                                            PID:3156
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FwsUUkYM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock.exe""
                                                                            18⤵
                                                                            • Executes a command shell one-liner
                                                                            PID:2624
                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                              19⤵
                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                              PID:2140
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                        16⤵
                                                                        • Modifies visibility of file extensions in Explorer
                                                                        • Modifies registry key
                                                                        PID:2332
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                        16⤵
                                                                        • Modifies registry key
                                                                        PID:1096
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                        16⤵
                                                                        • UAC bypass
                                                                        PID:5688
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EEcgggAM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock.exe""
                                                                        16⤵
                                                                        • Executes a command shell one-liner
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:5884
                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                          17⤵
                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                          PID:4936
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                    14⤵
                                                                    • Modifies visibility of file extensions in Explorer
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Modifies registry key
                                                                    PID:5352
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                    14⤵
                                                                    • Modifies registry key
                                                                    PID:2616
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                    14⤵
                                                                    • UAC bypass
                                                                    • Modifies registry key
                                                                    PID:4056
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kcMIkoMc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock.exe""
                                                                    14⤵
                                                                    • Executes a command shell one-liner
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:2628
                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                      15⤵
                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                      PID:2744
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                12⤵
                                                                • Modifies visibility of file extensions in Explorer
                                                                • System Location Discovery: System Language Discovery
                                                                • Modifies registry key
                                                                PID:4396
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                12⤵
                                                                • System Location Discovery: System Language Discovery
                                                                • Modifies registry key
                                                                PID:2608
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                12⤵
                                                                • UAC bypass
                                                                • System Location Discovery: System Language Discovery
                                                                PID:4048
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AuQMgEMY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock.exe""
                                                                12⤵
                                                                • Executes a command shell one-liner
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:4044
                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                  13⤵
                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                  PID:2112
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                            10⤵
                                                            • Modifies visibility of file extensions in Explorer
                                                            • System Location Discovery: System Language Discovery
                                                            • Modifies registry key
                                                            PID:5024
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                            10⤵
                                                            • Modifies registry key
                                                            PID:944
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                            10⤵
                                                            • UAC bypass
                                                            • System Location Discovery: System Language Discovery
                                                            • Modifies registry key
                                                            PID:4676
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DwYIAYcw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock.exe""
                                                            10⤵
                                                            • Executes a command shell one-liner
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:4704
                                                            • C:\Windows\SysWOW64\cscript.exe
                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                              11⤵
                                                              • Executes a VBScript file via the Windows Script Host.
                                                              PID:3544
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                        8⤵
                                                        • Modifies visibility of file extensions in Explorer
                                                        • System Location Discovery: System Language Discovery
                                                        PID:5824
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                        8⤵
                                                        • Modifies registry key
                                                        PID:4764
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                        8⤵
                                                        • UAC bypass
                                                        • Modifies registry key
                                                        PID:1036
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZGgUYUIs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock.exe""
                                                        8⤵
                                                        • Executes a command shell one-liner
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:2932
                                                        • C:\Windows\SysWOW64\cscript.exe
                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                          9⤵
                                                          • Executes a VBScript file via the Windows Script Host.
                                                          PID:384
                                                  • C:\Windows\SysWOW64\reg.exe
                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                    6⤵
                                                    • Modifies visibility of file extensions in Explorer
                                                    PID:4936
                                                  • C:\Windows\SysWOW64\reg.exe
                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                    6⤵
                                                    • System Location Discovery: System Language Discovery
                                                    • Modifies registry key
                                                    PID:6004
                                                  • C:\Windows\SysWOW64\reg.exe
                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                    6⤵
                                                    • UAC bypass
                                                    • System Location Discovery: System Language Discovery
                                                    • Modifies registry key
                                                    PID:5844
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xoQccIsE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock.exe""
                                                    6⤵
                                                    • Executes a command shell one-liner
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:3620
                                                    • C:\Windows\SysWOW64\cscript.exe
                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                      7⤵
                                                      • Executes a VBScript file via the Windows Script Host.
                                                      • System Location Discovery: System Language Discovery
                                                      PID:4616
                                              • C:\Windows\SysWOW64\reg.exe
                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                4⤵
                                                • Modifies visibility of file extensions in Explorer
                                                • System Location Discovery: System Language Discovery
                                                • Modifies registry key
                                                PID:4136
                                              • C:\Windows\SysWOW64\reg.exe
                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                4⤵
                                                  PID:4124
                                                • C:\Windows\SysWOW64\reg.exe
                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                  4⤵
                                                  • UAC bypass
                                                  PID:4656
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AOYoQMwI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock.exe""
                                                  4⤵
                                                  • Executes a command shell one-liner
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:2252
                                                  • C:\Windows\SysWOW64\cscript.exe
                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                    5⤵
                                                    • Executes a VBScript file via the Windows Script Host.
                                                    • System Location Discovery: System Language Discovery
                                                    PID:5276
                                            • C:\Windows\SysWOW64\reg.exe
                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                              2⤵
                                              • Modifies visibility of file extensions in Explorer
                                              PID:3516
                                            • C:\Windows\SysWOW64\reg.exe
                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                              2⤵
                                              • System Location Discovery: System Language Discovery
                                              • Modifies registry key
                                              PID:2616
                                            • C:\Windows\SysWOW64\reg.exe
                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                              2⤵
                                              • UAC bypass
                                              • Modifies registry key
                                              PID:2904
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eMIgwosM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock.exe""
                                              2⤵
                                              • Executes a command shell one-liner
                                              • Suspicious use of WriteProcessMemory
                                              PID:1384
                                              • C:\Windows\SysWOW64\cscript.exe
                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                3⤵
                                                • Executes a VBScript file via the Windows Script Host.
                                                • System Location Discovery: System Language Discovery
                                                PID:2332
                                          • C:\ProgramData\GqYIUwoM\ZakUUYgw.exe
                                            C:\ProgramData\GqYIUwoM\ZakUUYgw.exe
                                            1⤵
                                            • Executes dropped EXE
                                            • Adds Run key to start application
                                            • Drops file in System32 directory
                                            PID:5312
                                          • C:\ProgramData\sccUAgIs\OCwQsksA.exe
                                            C:\ProgramData\sccUAgIs\OCwQsksA.exe
                                            1⤵
                                            • Executes dropped EXE
                                            • Adds Run key to start application
                                            • Reads the TCP/IP host and domain name from the registry
                                            • System Location Discovery: System Language Discovery
                                            PID:1948
                                            • C:\Users\Admin\ZocsgcQo\QKUcIIEU.exe
                                              "C:\Users\Admin\ZocsgcQo\QKUcIIEU.exe"
                                              2⤵
                                              • Executes dropped EXE
                                              • Adds Run key to start application
                                              • Reads the TCP/IP host and domain name from the registry
                                              PID:4928
                                          • C:\Users\Admin\ZocsgcQo\QKUcIIEU.exe
                                            C:\Users\Admin\ZocsgcQo\QKUcIIEU.exe
                                            1⤵
                                            • Executes dropped EXE
                                            • Adds Run key to start application
                                            • Drops file in Windows directory
                                            • Reads the TCP/IP host and domain name from the registry
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious use of FindShellTrayWindow
                                            PID:4896

                                          Network

                                                MITRE ATT&CK Enterprise v16

                                                Reconnaissance

                                                Resource Development

                                                Initial Access

                                                Execution

                                                Command and Scripting Interpreter

                                                2
                                                T1059

                                                Visual Basic

                                                1
                                                T1059.005

                                                Windows Command Shell

                                                1
                                                T1059.003

                                                Persistence

                                                Boot or Logon Autostart Execution

                                                1
                                                T1547

                                                Registry Run Keys / Startup Folder

                                                1
                                                T1547.001

                                                Privilege Escalation

                                                Abuse Elevation Control Mechanism

                                                1
                                                T1548

                                                Bypass User Account Control

                                                1
                                                T1548.002

                                                Boot or Logon Autostart Execution

                                                1
                                                T1547

                                                Registry Run Keys / Startup Folder

                                                1
                                                T1547.001

                                                Defense Evasion

                                                Abuse Elevation Control Mechanism

                                                1
                                                T1548

                                                Bypass User Account Control

                                                1
                                                T1548.002

                                                Hide Artifacts

                                                1
                                                T1564

                                                Hidden Files and Directories

                                                1
                                                T1564.001

                                                Impair Defenses

                                                1
                                                T1562

                                                Disable or Modify Tools

                                                1
                                                T1562.001

                                                Modify Registry

                                                4
                                                T1112

                                                Credential Access

                                                Credentials from Password Stores

                                                1
                                                T1555

                                                Credentials from Web Browsers

                                                1
                                                T1555.003

                                                Unsecured Credentials

                                                1
                                                T1552

                                                Credentials In Files

                                                1
                                                T1552.001

                                                Discovery

                                                System Information Discovery

                                                1
                                                T1082

                                                System Location Discovery

                                                1
                                                T1614

                                                System Language Discovery

                                                1
                                                T1614.001

                                                System Network Configuration Discovery

                                                1
                                                T1016

                                                Lateral Movement

                                                Collection

                                                Data from Local System

                                                1
                                                T1005

                                                Command and Control

                                                Exfiltration

                                                Impact

                                                Replay Monitor

                                                Loading Replay Monitor...

                                                Downloads

                                                ZakUUYgw.exe
                                                • Path C:\ProgramData\GqYIUwoM\ZakUUYgw.exe
                                                • Size 1.6MB
                                                • SHA256 61a50eaa6f1d525623ad7b625d637d741d5bb5bd8397afa9e0c1017bfe373c0c
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                SYMA.txt
                                                • Path C:\ProgramData\SYMA.txt
                                                • Size 7KB
                                                • SHA256 6b6a8091e65f0dbbdbed5610f405fdf074270b0c9290cf8f1994b73768780779
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                OCwQsksA.exe
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.exe
                                                • Size 1.6MB
                                                • SHA256 edc5dd537fdeb89ab81bb790b9852999d5ba1e55f6566c194db7ac99cfe1bad9
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 93c8d5253228cd860564d80610ac01e6cc4d86f67cec2e56a284441b6343dcfb
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 d4896a0a502c57c8454c92f6f4b2c88a758c3d6ab79ff495caef695f17e6dc60
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 e77812ff8d63faf65db6755de22c7ebb558ede19235fb1d6d3b4f1dc8fb678b8
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 134415e4b26d8edd9c0a31e6a0d3790c4cfceb7427e36b387dd7cce3772c6399
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 62396d17168aff37c3dd15e20d4a4fdce91de87e1a18e26c6ec7e8523e492ecb
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 e274ab0ff96e485f0cb8a126a6ee60a8e03c1e354d29de827bc3f06e1a21f951
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 c50ddcb9a63664a9f7432b2982e982b33a19c1ed2790e69471ff3e02c8e6b970
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 512cd0345109cb17a4b4d3c41ab225fb6934d705078f76ee1a3afc28a4aa49ac
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 16456b382b1436df7fb7a19ebd73d6c6f1f483ce63bac3053c73869e16ff17c7
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 5a706d955d0bbe41458e53263e8101efe00593f7e746e53076baedf6c9554208
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 4c05a1f0c637e2278f0072b5e15918e4ae4dc97097a6705c1231961377245043
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 79cc6e07d434b40cb7ea64355c1147be9f831be90569463d152f8874ba7436a8
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 8e14d104c551d5ca30d88b66f8ac64be233811feb6a5987781400d457331531c
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 94bb45d319461432f16a1aa13e75293ee459d55138c3cb2321157a2a0d5388ee
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 efc105e648b5ec8ef38c43fb278e126622ce00329562c1610ce70767f5b377a5
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 9f84a2219ecfb0855ad13372abfa81ea9c02d161a2b59584a61e2fe862c587ab
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 dd355a8f5020cd8a9cffb983ac7239cfd4e72bfdd137380e200329e04fc9a659
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 fc6e65e089e2f743afc59922875f5eb0ee02f3a566ca4ec80bd3c9d3aa862c16
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 0b0f51e35386ad449b00a3c0a6d185a6f16e4df1672ed44dedc31a6c82ccb5db
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 e5384bb7867bbe10de844ec8f9b63c849772f8832d06940d8dd35912ce93706f
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 e20a502ea2d49e20330131d90933d73ecf54255bf625b3e316fb65c315d71c88
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 6088576a090faeb9bd98275cddc9e1d7b84a122e723b5337665b8ea7dce3659d
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 66f8e576d1b299deff5e9ecd0d7039dc39302dd7beb959871a4160a41d787e58
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 3677f073d7f346c4eff310085d526ace50635ccf60b255d6a906f325d6a8b1cd
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 9aa1c7ba594d9709ffd8616095a06192edea4376d734433df525f74ecfc61879
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 3a7da77df0e9f78a22115bb569a55800c99c367f299eb40bd0365e9d153dea5d
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 634252fdce4c8dc3b951bed8b4a0a3fd5bfa996d734e4d2172495094dc094b82
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 c0fa0a477acb0762679364e675d7c5fccc32e1654e4bbbbc3fb36bc6ac47baca
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 89b56938e8f30808a150db32b361ef12c2b0c99ff2a664326c10cf4a2da5b8db
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 5eaa075e2e4843246475beb8b4bc07ba4bdec1c96c85be9d5ce270c571dbf771
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 6824bdfdf73019160c85b6a689dccf327be97ad2d235932db3fcf89404fd36fb
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 6a89e7c952e9b26479b02293f9a07cd3e4a67a1fd942e54ab0c456178cf8a812
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 10ea0d1b4c798e2d93892fddade21f5c5701eb4978d32e9a6a5e1fa6d5a99cdc
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 87823c142fd31700d2d29aa7ca85f229d2bd21b152a7f589a6747832f1f37ae0
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 b184419ec01b074ec8051009c70e80475f1415c94b3d9e139f9aba9df5dfe341
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 13826ec0c85ed70b69884e87936f8b4a5579c2e7c4bd353e4ea116d54a0643bb
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 a51e6f5d442fd46a0f217dd4a574224b7a384deea82f38f3f084a6a04f65d5ce
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 79d03d9e86b70ae0f4424add4809e9e76d96d0607247e3e899ff1f652c314e9e
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 9f7b824c1ae3f6b8e838d2daeb0cbe955ee4a5eb3a2a8bd52f4ae9ce52e2c80a
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 51524320ffad7df2a5b4f044900cd285f6a8991c1795542490e4858bb4bb722f
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 a46d90ef16f28d37011f84f61549f5402dab34b1e2fe20eed458e2a1219a2aa7
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 13cf5f321624d273d3ffe3a85d52f533ae1811b9e4c810445bb73bf3d62f5d41
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 61f15bfdd92aecc3f042f98d72a58fe80f368eecf69c2e19f0b4b641f1f08329
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 e25bfc48488ff5a2075c0a68653b1a14647550da9513bda63fc515b84ef5b715
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 1b3535be3caa2e6217b9ff7a024c78c8165eab6052402129e13604ec236629be
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 2b6ea1e0f1258bf2994db85a957db08a9d3ff53be37d69d3f6c1e6a0f436c918
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 d1e1228c8ac98bbe2c363dafb7314660ec383dee26d23ce848dd998cc7020af9
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 002a332aab9e20a293acb752e7dd2ec2efae5ebe03b4510f2bd60f9594ef8ed7
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 d3cd1232feba2fa839be05425a2a169f0116452d9a5ec90343ea840d582e1eb0
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 81e0c119f650860d72f9faf299608d44ba30d4f2e19366816438f889194debfd
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 0f083cdee5471731a6fa0b641dc2d66cba069b3f8172f47e6c7c3f6dbb2d176c
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 fffed6c49386877366f7561023e932989044da51d5eff1d2e8ea042c9425fe82
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 9b5e4e0e01c6f362c682773e57d81059866da25baf0ae56f5d339020f121583a
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 b65c0c6ca5405a60a7b960a87b8b504e63c146f96b31e6ad5eeee95acf92598c
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 21aa8e67d989be88f509e89e490cc2fdb322df9db639225b711948ab83bbc4d2
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 9986dfb6d94cb6b6d4683c5165043726fa340d9cc740b48252eaf9e975b437b3
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 bbb04c67e26f4e0e1016427debbedd1e80dc9ceba45c5ace90b2a259db50de43
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 33c692dfef3fb93650f208c586a08fde575550f3ae6cc0b6e30fdbfe162e8c72
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 f826fbfa14a38dfcf86863166525a86546f84719c99b6d4bbc80f204d3578ac2
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 20f37fad5049d0d8131710feb7f1fc34d621a51f2d119b346e2b6513ff1922c8
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 00d00b12747de0b514410a4fc6cc08a7eef9840ff08b7032321e86afe7cb3757
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 732bed070557d4b9b266036ce1487c36dad4ef4c5752e4a3e264947b2e70f6df
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 1c7bec5f516ac132b441fa59e1d4aa33d4de667c4bf58c9c92cc81d23d8e07d6
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 7953cc97a9ea1033e6491751d20fba4172a4ccaf8595ee7baf33396e19cf247f
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 4c7b9ae59894fc147ec765ce09a353efd7c9199cba4ea7cb6885e4eae99316cc
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 303c9d345b59680263cbf4ff830db2644c8852e697f4ec2a8b31659c145c90ef
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 2fda168ee7182df24eb109fbc92a4962a4a4a30f4934ce6bb7283374d6bf6fa1
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 c6650c0587dccfe1b20c85384cb624eb59c36d589e349e7f26b71bd70b692353
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 c8d9b35012e58301e72872612553dd7276c56a141bc63473746cb47793400881
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 62b485c36e226fc6e55d8e30c6e3ff5804a007c1ca7aead8ae3ae5000a2b540b
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 3c8cc382356a7ec4ed72ba9e48b136cbab93bfa144a1e6ffb6273fef9903e4f9
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 23f00096f435132513314db52c9b3d733d99adf4b11ea2235c7e043af31459a1
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 6e9aca9d09332e5e4c63935327185b4ccc55fe102da1a4c4668dab22846346da
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 6fdb67566324539814d5c7110cd418a65c6df14d65f457b8675d2203c08e51fb
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 a5134dfe060ab1c6341f3154f8dd7895812465e7284f2f0e38310688a171b969
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 2870bdc92578a2c6c085f0421b87a8a44c47b54829df5947c1581f2597b8338d
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 4d5df6a44ca2ded7e4db2e5188fd91fa6e1490b98858003314fdba9fa65fd7f1
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 ce5a09834c5f901c07cb5cbd48ab1c01e531e2bb95435db97c8c789f9761a4ab
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 50404de59b5526e833e589e62db36102fc06171f9f55433f5650b5dc0477e092
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 43fd58985d584b0416d1bcc77b5f9e2fd9f50a55027eb1a4e4ed2a07d7de0410
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 47ff3db41f187a4f71c3ccb0fa0540a90aebe0736e59a8ea9e05f3d964afa83e
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 63fc130c0dab4f46747cb3a1d47248a3ecfb1bd50c502408085a053c504aa8a8
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 c733fe97be19e3b43881893db75e450a65c70b8920c4736e0134392bcae40c14
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 2efbdb05a7eacc0c591b22e55bbd7f9f235406f8ce22812c7e60501fa193da86
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 c54d170114b5161e875c5a5fb2595faa8c4c107986f32a9c16fd759bf08e16ee
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 e74213c49ab2fee65deaa5346dc30a734eb048fe6c5f64ebd6933e15c80d7474
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 40c673229fe99ef6ea85799a0ccdd0f350b0192c41ac48ce29d3f390e6bd26ff
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 f3cef61013b8c5821aff2a58ce0d7cb6a3db87ca801e0d128abb3dcb8192258b
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 c492d692db097e3b6eb3cf98e993a12c64f0c2d6176478a90958b2cace19ef03
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 dcfc5c891315f6caf00d2555aebcda29fb81b2679cff66a63aefb08044023fbc
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 d0b9498e77eccdcd1a7f6297bf1cd2f11e2b3087c05090ff5bd9a3f5daa1bec8
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 3c1151cac28d637f0f2edb50de90ca7f271084a8e243c5f6a7711bf5580407d6
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 8ae97dc87f90e2170f24d226b57b874991069044d92161c3b6b53d888c27be1d
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 667b136da8d12848dca6492de51f15b9fc382161cbf5975df958906ec501ea12
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 acb8fabb817cd2e2b60426eaf4f1b74690b4504461e5aa8c3330128afca6741c
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 83b528d67674a971f4cd1499e4994853557145253de21283fd0d378694390216
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 a8ba14975d9a1e18ec2aa5948adccde992120a58b3639141786cda243568a819
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 f5a0e5c8dcffbb878d4ed676fe6e6343b8e05d6aca47297c40dd8657ccec6920
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 75d181f7c322d06f0ff77980e23f8ab9093a0d7c18c42da5a1a13147f47db924
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 4c004a0a3102f694f94fe7f41a6249d1b4bdd3e886beafa32a6469e7aa7aa25e
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 9aba2c8797ec23f9ecda21b509514f98b444777360de3b707017d74c92f1cd08
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 87b3bc8ada072bb656b427fe59f3c1e00829a91927542772153dd4514436627d
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 390e8aa025d19744c6bc38800c46eb89c646810a08edb70d09eae94dcbde7ac9
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 710b12530dda6efa04e52b84e86fe49d0e797f3e330f15516329d3bbb2af579b
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 1aac19c01d894738e5fc1f6e687480d5e2efc19de9877382c6dfd59c63e93938
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 b09fbc9a03b50183b96bd04b671e848ef36d0b50912a7c634f8455b2b62065c8
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 d993edc67628bce69b73ac517e692d933928a5e0a9e1f05bd12fad7e501746f9
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 17558cd1d1f0e7ad451c669459b5d244167403d06304c50a5413a269927f596d
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 7c9c060eb5480eed630da84cb6a8d949033d374ce08a89a3454959c128a57839
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 29da33e2fab8db99b1b8a813564a0c4065b29c1b537363f54d857e763fe2d51e
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 f82e7f74cd5ec9d398b7e4651d5016c78a8c5fff4aabaa1deb3f15212945b58e
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 6084330c4e24a87598b327794a9c15783e8098dad9dc86086a75d4cda15a6f10
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 aecfce20286e4555252862f4ccd74c5a1b56a5f95a9f3feaf2fbf9c1a83b2104
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 0a97e956518abf4692349cfb47b7bf02611ba88771d309ce4a4d13dac9a8e4b7
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 42d87a382fa139cdab4fc70f716ab7d47fa3af05e9f7e4b17eae5871abbbb296
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 1ca4cdff468d220042568b8d29c39f7f761f802ea1f6e6e8091ecc010c01c98d
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 c75ea888748f6587df6f561f5f6d6ebc3d8022e310efa7566f93efb73da6a112
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 62318f2c5a19b02e63788fa2cf32ff547d0a6045d2f971e3a1a75977a68a7b05
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                OCwQsksA.inf
                                                • Path C:\ProgramData\sccUAgIs\OCwQsksA.inf
                                                • Size 4B
                                                • SHA256 168b836d1d553b3310dc3fe92376d79567fc58018ce65c3ba5781a0232cd3eec
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock
                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-10-27_e331540ce2dd4a49fa27bb10acf8902e_elex_virlock
                                                • Size 7KB
                                                • SHA256 01e6054deaa10abf99b02a9d4adef290aa76557a0f7d281d1ea6fd40b2020c1b
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                AOYM.ico
                                                • Path C:\Users\Admin\AppData\Local\Temp\AOYM.ico
                                                • Size 4KB
                                                • SHA256 ed7913a5b4914f6343f312915bd957b6c72c09c3061985d38d2d8b6c4241af51
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                AQAw.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\AQAw.exe
                                                • Size 2.1MB
                                                • SHA256 46014a2d82ee132f683c3c1d5b56279bc042bc3aef5aff31cfb6b3add8991233
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                AQkc.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\AQkc.exe
                                                • Size 2.4MB
                                                • SHA256 584de3c464cf421d11a277f049a321b761a6877a222c0bac951d6f928119373e
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                AoIO.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\AoIO.exe
                                                • Size 1.9MB
                                                • SHA256 d38ae6407ce270b62f70e3e7fcebc8bfacbc4985b9caaa4c222aa9419c682348
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                AoQG.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\AoQG.exe
                                                • Size 1.6MB
                                                • SHA256 e78c0ded2b465a5456ed224e0329a189f0f8e8784517e2e733bc10941d9ac76b
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                Aogo.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\Aogo.exe
                                                • Size 1.8MB
                                                • SHA256 714baeea6d90dd39f8713ba18c76e69b5c127789731602222c2b8cfde8b0b06a
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                Aoks.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\Aoks.exe
                                                • Size 2.1MB
                                                • SHA256 1c0d02dd72989bef0de9a8388bb9cf812c1d8cc0e8788afa998f15ff707ffdef
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                AwkG.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\AwkG.exe
                                                • Size 1.6MB
                                                • SHA256 feaa935109af83e7a1e3e6a01925dff1d18dd346ea8551615ea70e04832d86cd
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                CMEa.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\CMEa.exe
                                                • Size 2.2MB
                                                • SHA256 2602e88e443bd01899b647ffe15d2f6acce0b8614aa761e9a571a5a6431cdbc9
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                CMIE.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\CMIE.exe
                                                • Size 1.9MB
                                                • SHA256 96f932506215f2cdff2f050d5feaefd4c233ec24511e40acf06576f3a017f195
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                CYUM.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\CYUM.exe
                                                • Size 1.6MB
                                                • SHA256 923ca871a04ba02cd3ad626957395f09e47d6c179154a72a233445763b2d785f
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                CcAs.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\CcAs.exe
                                                • Size 2.2MB
                                                • SHA256 b810a8d2435ce69a179a2ba88252fbfa9f88a679f128d15103a139502bcb799d
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                CgYE.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\CgYE.exe
                                                • Size 2.6MB
                                                • SHA256 725af6a3b85e0807b3607c4330a02978810a33d6b2609dce41abd73eda4e6723
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                Cgww.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\Cgww.exe
                                                • Size 2.1MB
                                                • SHA256 b1d0a416db6dcaa13180e83ae7f2f5f31b354939c57ed5a2919dc5e758a23b37
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                CkEI.ico
                                                • Path C:\Users\Admin\AppData\Local\Temp\CkEI.ico
                                                • Size 4KB
                                                • SHA256 e4c00332694cb4a7fdbc6dc19cd1eef271dff84d8a0a601e70f48e597351cf82
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                CoIq.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\CoIq.exe
                                                • Size 1.9MB
                                                • SHA256 9cc44f7b7fffd78d680baee51d6408f898cb82e0f4ab5038786e51f44d0b087c
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                EEkS.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\EEkS.exe
                                                • Size 1.6MB
                                                • SHA256 621d292acb3126405ee94acd45c5e4a8970c0a28467c35d3babb2f770f1d1cc2
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                EYsS.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\EYsS.exe
                                                • Size 1.7MB
                                                • SHA256 9cd0984f5b36ddb389da7bd09b30b9da87a9c6483e4f9cdc4fcb1a0281e40e83
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                EgUA.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\EgUA.exe
                                                • Size 1.6MB
                                                • SHA256 a8fa65c294ed1a5b3533935d2129e3b67fb1d9e51928881e16b081831001e518
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                GYsG.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\GYsG.exe
                                                • Size 1.9MB
                                                • SHA256 f3ec4ac9f85448dec5d05bd89e71a291f621cc538b370d126fb45bd19abfbcb6
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                GiIw.ico
                                                • Path C:\Users\Admin\AppData\Local\Temp\GiIw.ico
                                                • Size 4KB
                                                • SHA256 955ad377b15d14e80d8eb194375f26e0e9e339b1cfc1e4047e16ae0e0f90fe24
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                GkoU.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\GkoU.exe
                                                • Size 2.6MB
                                                • SHA256 ec3ad5cab9e84e7d89adfbcfcfe70b011ca18fecd9313ee8e41136864ae5faa4
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                GoYO.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\GoYO.exe
                                                • Size 2.0MB
                                                • SHA256 a42d76edc6e64b00cf94621c076b1f72cfc962d41ae7573209eac2b4117f3e7d
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                IMIY.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\IMIY.exe
                                                • Size 2.9MB
                                                • SHA256 f9ddb1c72055bca2a58415b1097b0c48d8759e739aae6ba96fce87d391366bad
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                Ikkg.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\Ikkg.exe
                                                • Size 1.6MB
                                                • SHA256 a2c0c45b8c1237da994517b3823307e663250a46a399df0f5b478af5a51bc527
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                IsAa.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\IsAa.exe
                                                • Size 1.6MB
                                                • SHA256 2309e124ae3db0c463fa50a7da22dfb703a1022e579235dd071896396fa7e5e1
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                Iscu.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\Iscu.exe
                                                • Size 1.6MB
                                                • SHA256 ecc242a5537919d753a3d1a0130bddfaa2fb988cea2dd1cab4aa7a722c6ac4ce
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                IswM.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\IswM.exe
                                                • Size 2.2MB
                                                • SHA256 be0b6252b181cec01eb1384f5ef3aede374264a4a992efd576a954481b0c25f9
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                KYoy.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\KYoy.exe
                                                • Size 1.9MB
                                                • SHA256 8cf9a91f504b31ca923a44b78cdf9d7341833d197a291e3c727ecd0d67405f67
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                KqUk.ico
                                                • Path C:\Users\Admin\AppData\Local\Temp\KqUk.ico
                                                • Size 4KB
                                                • SHA256 e1131246c60ad423586203bb8b9287e365051101ddbf532132bd47ef03ab86c8
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                MEQI.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\MEQI.exe
                                                • Size 2.5MB
                                                • SHA256 86a7ac0c8bc99ad3c39622bd209acaef650a9a7480ea269283d66c7a551732c3
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                MMkG.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\MMkG.exe
                                                • Size 2.0MB
                                                • SHA256 ac68790dc24c819c3fb5a6e852f18d86bf14a988c37113a3f8561c696d226536
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                MgYo.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\MgYo.exe
                                                • Size 2.2MB
                                                • SHA256 f0f370aedb8fd804fa98e7f87704896db4cc2a60ec258f4e1775452309a7a92c
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                Mkck.ico
                                                • Path C:\Users\Admin\AppData\Local\Temp\Mkck.ico
                                                • Size 4KB
                                                • SHA256 6b1018b4e474afacb1c54331284d85fdbc2bb5e945466dcbda91231feeac5fd4
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                MwUM.ico
                                                • Path C:\Users\Admin\AppData\Local\Temp\MwUM.ico
                                                • Size 4KB
                                                • SHA256 9a233711400b52fc399d16bb7e3937772c44d7841a24a685467e19dfa57769d5
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                OCkk.ico
                                                • Path C:\Users\Admin\AppData\Local\Temp\OCkk.ico
                                                • Size 4KB
                                                • SHA256 119061f905398193977c21e4b6787c9c42b3c7d8eb05b8d2ee33394ac5873619
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                OIEM.ico
                                                • Path C:\Users\Admin\AppData\Local\Temp\OIEM.ico
                                                • Size 4KB
                                                • SHA256 701a17a9ee5c9340bae4f0810f103d1f0ca5c03141e0da826139d5b7397a6fb3
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                OUIK.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\OUIK.exe
                                                • Size 1.6MB
                                                • SHA256 678a82d71a8b2e8bcdae2cabb9a658df93e531dd55816b92f282edd4bc1e2bd9
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                OYsE.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\OYsE.exe
                                                • Size 2.5MB
                                                • SHA256 044242bde9db4fdaf49f95f57b24e43e93271120727f84f3f7d13b085eb92ca4
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                OkUM.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\OkUM.exe
                                                • Size 2.0MB
                                                • SHA256 147458aaa5fdfb0ebf95657f7fe485c2d75b95db31e3dc8159117c8cab1e4bd9
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                Oows.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\Oows.exe
                                                • Size 1.6MB
                                                • SHA256 549d908bb0d0ba82268a08307a138d9b9f42dbedf087bd7e246a1070c4720d6a
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                QUcs.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\QUcs.exe
                                                • Size 1.9MB
                                                • SHA256 39d6ca5e98522eddf3fc4bc543c4697927fed25a77d16690e5d66b48b6363942
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                QcoI.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\QcoI.exe
                                                • Size 3.4MB
                                                • SHA256 8a1d5f0919713ca59d8bdfadd28a6e828ef626aaf92a3f70c247561e41a9657e
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                QqMg.ico
                                                • Path C:\Users\Admin\AppData\Local\Temp\QqMg.ico
                                                • Size 4KB
                                                • SHA256 0e140fda863f8fb77d504391b920972bfc33da1bf087ebc7728bc700d402d0f3
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                Qswa.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\Qswa.exe
                                                • Size 1.6MB
                                                • SHA256 fcc7e7fdc05098970e80a847e7892b3675c62c97deae1eb6b96313e928c75554
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                SMYG.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\SMYG.exe
                                                • Size 2.1MB
                                                • SHA256 9a7605834d6bed96b8058d858c09e7b18a2e0fe2585d1eee0e741d0b75e13d17
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                SQcM.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\SQcM.exe
                                                • Size 2.1MB
                                                • SHA256 edccbb210a08824891ab4cd8341ca6764cd2c0fd6252678b838f278757afa720
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                SYAY.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\SYAY.exe
                                                • Size 1.6MB
                                                • SHA256 4f81258e75d7815ba9c175f1ea676067054cc1c0e7f1692e9ffed9ff88aa67e2
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                SccI.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\SccI.exe
                                                • Size 2.0MB
                                                • SHA256 bc72bc458f987800b2e46a1a39bca31c5886e4446a58e6af1033c502311b0f06
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                UwUS.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\UwUS.exe
                                                • Size 2.2MB
                                                • SHA256 8254f0ebc1bbc550cce9eb2f3ee18bcdd52659f42f2efc09adfc464f49eb2454
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                UwYG.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\UwYG.exe
                                                • Size 3.1MB
                                                • SHA256 8fad2d03637d553eaa3f19e44660a013ea42e8f05f9f51404a06f32f098d4a5e
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                WEAy.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\WEAy.exe
                                                • Size 1.8MB
                                                • SHA256 8d6eba0a088628e7da767d7362a26b52edf108bf314bf905434caadc9c158b4b
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                WcwE.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\WcwE.exe
                                                • Size 2.1MB
                                                • SHA256 48065cd42c51943ef5b739ee9c6aff7090d8ea6abd3e7b887214d90f056e3a5a
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                WwUW.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\WwUW.exe
                                                • Size 1.6MB
                                                • SHA256 b78c4acba1216b42151781545857848b604c5728bb63300649f8a51143d8cd4b
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                YUcK.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\YUcK.exe
                                                • Size 1.6MB
                                                • SHA256 fe37d404cd58f509b5c10afb7ff7d2b1a2b880ca458be2f70be0284d468f0010
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                YYQK.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\YYQK.exe
                                                • Size 1.6MB
                                                • SHA256 3271128e79d1203c7170d485c2ac415c49113d4e69a2e938db60b5ca93c0e380
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                YcQw.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\YcQw.exe
                                                • Size 2.2MB
                                                • SHA256 6e3a57574a1f5f70016bb4407348a349a9d3a4fd87f4a791d74c471f37350e81
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                Yksk.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\Yksk.exe
                                                • Size 1.6MB
                                                • SHA256 50e41540acd829f640364765f87ee6bc022cf6ec7c740e44176b3cd72878b043
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                YssY.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\YssY.exe
                                                • Size 2.0MB
                                                • SHA256 7dca37f3fb94956c81e223960823e0397e9914a2e2fe592bb7ab1b2d29009016
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                aIwi.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\aIwi.exe
                                                • Size 2.1MB
                                                • SHA256 28f86f6b1a05b548cff8b0db7ff48fc4b69797d207c68fbb6d6cecaa6ec6e2d7
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                aUsQ.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\aUsQ.exe
                                                • Size 2.3MB
                                                • SHA256 8c49be8a5dc25214b1d190aec17a3864cd452b3fe8bbb116b89126ad6f7ce866
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                agQY.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\agQY.exe
                                                • Size 2.2MB
                                                • SHA256 8a77c5e3111033c088dde59f536e28ce8451835243dcf742919fe2e9b44e50f8
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                cAoA.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\cAoA.exe
                                                • Size 1.9MB
                                                • SHA256 6c906016237968ad45fb75d63ae4367b3d3a70f6c46421cd8606c2221be0177c
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                cEwE.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\cEwE.exe
                                                • Size 1.7MB
                                                • SHA256 a9cf4485483bc550dbf845c2bf8d91eaf979997f7fdf04efdb27951a01fa9196
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                cMMI.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\cMMI.exe
                                                • Size 1.9MB
                                                • SHA256 ba389e97cd7057b7a57307f03d1da7141b95fa14151c94cbafc36adeaed9a0d3
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                cSgg.ico
                                                • Path C:\Users\Admin\AppData\Local\Temp\cSgg.ico
                                                • Size 4KB
                                                • SHA256 f8e8be11d1062a945187b65fc5e5b1500bce03cbdbf6f4af9404b649aacc2aa3
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                cUcG.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\cUcG.exe
                                                • Size 1.7MB
                                                • SHA256 17bb34210a0348e12847cfd2896ed3692ac865d02b465ed0ba9b22226722663b
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                cksy.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\cksy.exe
                                                • Size 1.7MB
                                                • SHA256 0cf8028042b03a8132dff567a790e786926374cae1bbf733e74ba1fe8ba5a6af
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                coUU.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\coUU.exe
                                                • Size 2.0MB
                                                • SHA256 851e98c090c96088eb9f9066a21f3e3c5c1f10d97390ead9fe2dd690b54b0392
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                csQo.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\csQo.exe
                                                • Size 1.8MB
                                                • SHA256 843c82900efc9fc396235d51cfb423e1d7422c1c10492771ac6ca8073d78712b
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                cwYM.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\cwYM.exe
                                                • Size 2.2MB
                                                • SHA256 bf39dc2a17a274e720fe5938d4be7a2c49077d7b5e864840398b7e943292735a
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                eEUe.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\eEUe.exe
                                                • Size 2.0MB
                                                • SHA256 13b33336bd2dbad0ddd1143a4cc4fdbed40d588e9d4b46fc3b270453085da336
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                eMIgwosM.bat
                                                • Path C:\Users\Admin\AppData\Local\Temp\eMIgwosM.bat
                                                • Size 112B
                                                • SHA256 ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                eoIO.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\eoIO.exe
                                                • Size 2.0MB
                                                • SHA256 30c89125526a0397428ff0294d7cb025e7887fe1aa6606ebad880de0c2c864f2
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                esoA.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\esoA.exe
                                                • Size 1.8MB
                                                • SHA256 c40d23c4171d4b602fe693fe0a091e0b85cb6cc46a7486a1c6a757ea8722ac70
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                file.vbs
                                                • Path C:\Users\Admin\AppData\Local\Temp\file.vbs
                                                • Size 19B
                                                • SHA256 59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                gOoQ.ico
                                                • Path C:\Users\Admin\AppData\Local\Temp\gOoQ.ico
                                                • Size 4KB
                                                • SHA256 e5798e3d8c1af62d997a27bc2fb7333639a4f20e9753cf7a5b0639cd93f96448
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                gYsA.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\gYsA.exe
                                                • Size 1.8MB
                                                • SHA256 6dd4a33a3057125d7daf8c2f02027e6d5d9e4b554b08e03e140b5800a99607a4
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                ggkk.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\ggkk.exe
                                                • Size 1.6MB
                                                • SHA256 fe8fa7a635ef495a9963c577934e73c1cb04e340e259352b85ddd0336464d0db
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                iAog.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\iAog.exe
                                                • Size 1.9MB
                                                • SHA256 a65ab095c722ebf3d8ac7d7402110545f1d64722331b4eb59c05024edc156024
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                iIwm.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\iIwm.exe
                                                • Size 2.1MB
                                                • SHA256 2ee3a7f6f35c4cbe46547483c291db2e7d193f22f8c00a7a3a5a165bf83543de
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                iMMS.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\iMMS.exe
                                                • Size 1.6MB
                                                • SHA256 434c22b0b0b9c5f6204ba9fade153fff7568634ea0de1c07b6a097688fe9b463
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                iMYM.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\iMYM.exe
                                                • Size 2.1MB
                                                • SHA256 286b5abbde30f3863397a7e80260a7886a9ba544b5e744cc5b0a7855a80b58be
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                iQos.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\iQos.exe
                                                • Size 1.7MB
                                                • SHA256 540d4c755daf985a9ed54b470cbe2d30fc87ab86c96865cdf3073033c6488a9d
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                iYAU.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\iYAU.exe
                                                • Size 1.6MB
                                                • SHA256 376420345216df7d506504bf734b99404f952fa5e2bf4c1f15330f3ad85c6ecf
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                iYsk.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\iYsk.exe
                                                • Size 2.2MB
                                                • SHA256 5294b864a4192111af782dd9627ee6a4c55e798a4dc43537e3c729ecbdf23ef0
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                iYwE.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\iYwE.exe
                                                • Size 2.2MB
                                                • SHA256 6e3d37d5845301416a033e45fd1e84a9f2577ccc6559840de07942fdc98f0023
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                iwwQ.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\iwwQ.exe
                                                • Size 2.1MB
                                                • SHA256 5cce6c35f2d4a1b05b7a29968ceb5a8be0ad2f40d36b055d4e2d61c479173412
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                kUMA.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\kUMA.exe
                                                • Size 1.8MB
                                                • SHA256 31c51244f1fe989f8728c8d51d054ac75d85132ce35573fd0b269b109776490d
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                kUYk.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\kUYk.exe
                                                • Size 1.6MB
                                                • SHA256 75e2317f560a66c98bbd74c755a90017e2ac6db260e3d5bd07a7b79b5f67c578
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                kowI.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\kowI.exe
                                                • Size 1.7MB
                                                • SHA256 02f7de87d2fac343038cd8aab0047753a21b840b8478681e7786b949cfcffebd
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                kwoc.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\kwoc.exe
                                                • Size 1.6MB
                                                • SHA256 7ef3a629a7b61b70a45d08950aa2981041adb1d845f29cbc26227ca4e2cc2ff3
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                mEIk.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\mEIk.exe
                                                • Size 1.6MB
                                                • SHA256 afa7c3f7970184e89d1a09d7ccd26159acd11a8f7fb973dd390b8954cd4cfd92
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                mEgK.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\mEgK.exe
                                                • Size 1.6MB
                                                • SHA256 6b04b633b9793875550fd118047769a5d260605f12e7418316eb53a4f68b7039
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                mMAW.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\mMAW.exe
                                                • Size 1.9MB
                                                • SHA256 cd41aaf4a06558a7d5b6f11fa31ba11de1778294ca6ccef1c1bc48988e06a8ff
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                mUQa.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\mUQa.exe
                                                • Size 2.4MB
                                                • SHA256 d8fb9ce8a13bebf24c1f26d8d2c3a8a18fe2e31ae5f0aa1ae62e235d78a84b89
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                mcEM.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\mcEM.exe
                                                • Size 1.9MB
                                                • SHA256 4b747a06470a6640de7f7f549afe5f60a6025f2ba8f6d02537d3564002d9e0ab
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                oYMI.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\oYMI.exe
                                                • Size 2.2MB
                                                • SHA256 b8851aea22007b292f60eae6370a22a4ea2ff48137c5d760594f35ab64813804
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                ooMw.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\ooMw.exe
                                                • Size 1.8MB
                                                • SHA256 ddee883354288bc454802da7abea9b3318202b0064bf068d2f6726faa1049b75
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                qIwi.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\qIwi.exe
                                                • Size 2.1MB
                                                • SHA256 114bfe2636ccc9949a685c87ccec8be642807c6029762370f2adaacd4ac0313d
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                qUcy.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\qUcy.exe
                                                • Size 2.0MB
                                                • SHA256 c0192aa20aee322e569de5805589dd4638d185c26a052f915da9ecbca19477f3
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                qoQQ.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\qoQQ.exe
                                                • Size 1.7MB
                                                • SHA256 9c4c87b3e0019efe7b3495730f81730a78024ff2ad0bfeacc9599dc450aec938
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                sIEK.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\sIEK.exe
                                                • Size 1.9MB
                                                • SHA256 f854adec9444a4de4c0aa66c5a4a55b744eed9397e537b08cbd169eae4f77fef
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                sYck.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\sYck.exe
                                                • Size 2.0MB
                                                • SHA256 8bba3816f5ec10092c162424644e3ded03b38f86b8e21ce1dab9c1ee6869ba4f
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                skAU.ico
                                                • Path C:\Users\Admin\AppData\Local\Temp\skAU.ico
                                                • Size 4KB
                                                • SHA256 5963420fd9ba8c8248e3f50d179dfa21caca8538ad1482a03f260b27cf218043
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                skMM.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\skMM.exe
                                                • Size 2.3MB
                                                • SHA256 09c20d55a526cb97477f65e677e734e225ad2697379a78db454d04e722ebf270
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                skwg.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\skwg.exe
                                                • Size 2.0MB
                                                • SHA256 5cde721a9945bddd1631d8193d49ae0c81bf1a1cc8cb9f78d0ccf282bb32109f
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                smEo.ico
                                                • Path C:\Users\Admin\AppData\Local\Temp\smEo.ico
                                                • Size 4KB
                                                • SHA256 8fca10b6f4873e2116b823c0de6cb3622e02fba68294dafa19c4d65c131b3405
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                sokW.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\sokW.exe
                                                • Size 1.9MB
                                                • SHA256 c35764854e78b1d6bccc42c94c55b6ad71decfeb62399ba879c81a560c4b79e5
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                ssUI.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\ssUI.exe
                                                • Size 1.6MB
                                                • SHA256 94232771ae228e9e591581830020df2c152fe8f943855ee6dbf751b82c6f7442
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                uAsK.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\uAsK.exe
                                                • Size 1.7MB
                                                • SHA256 a3cb14659af7c347e557705484009c581d9f3eb4d785c97e71aba454bbfd7a17
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                uEYy.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\uEYy.exe
                                                • Size 1.6MB
                                                • SHA256 055686e80d2964e6d313890d88aefe430b96059c05d1a3725634e209c11ad76d
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                uMoU.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\uMoU.exe
                                                • Size 1.6MB
                                                • SHA256 348347e804a02a5b02d203e04f82d16af68d9aab7779808c0b0e716efcd34690
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                ukEg.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\ukEg.exe
                                                • Size 2.0MB
                                                • SHA256 0aca064656b68af67175630e655c647e9e93dfde6b426ce74524053b5046ff96
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                wAEe.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\wAEe.exe
                                                • Size 1.6MB
                                                • SHA256 e4a59db57011b05e0eca9ed22a8de67d6e1baf48b548152c47a537358856092d
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                wQQA.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\wQQA.exe
                                                • Size 1.8MB
                                                • SHA256 aad3d3a7f93d53c5a80ab8a5707e61df157bf0bc86aa670f6201c6b455905128
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                wSEA.ico
                                                • Path C:\Users\Admin\AppData\Local\Temp\wSEA.ico
                                                • Size 4KB
                                                • SHA256 4b700d3ddd9647f8b7da5a6d85d969ac492102d6c1053b1977d7bca36c2a324b
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                wUEQ.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\wUEQ.exe
                                                • Size 1.6MB
                                                • SHA256 dba610e283141a1fbe1fefcac94b830a5d5c5b2fba6b56ed93bdcc464241856c
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                wUgu.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\wUgu.exe
                                                • Size 1.6MB
                                                • SHA256 f78633324561a82e2383921ce8c9789bf81535a0514ac1af7b55e7febd975740
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                yQQO.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\yQQO.exe
                                                • Size 2.0MB
                                                • SHA256 e22c6802011ade2e80ba89514f78c2c1fad80d42533e90ab11f5663a6b8924b6
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                yYIY.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\yYIY.exe
                                                • Size 1.6MB
                                                • SHA256 4a67ba7de8c34759a3a7132b6340e2dbcb493d4de52d887bbb2603573854993f
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                yksK.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\yksK.exe
                                                • Size 1.6MB
                                                • SHA256 fcc6f21cd71578e983b3b32be3fb0635ae643fbd8369282c2f541253fe8e9665
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                ywIw.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\ywIw.exe
                                                • Size 2.4MB
                                                • SHA256 d324d09533884591e12cd45fbdc6f02b5dd1d178fae309bba19fe6518943b44a
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                QKUcIIEU.exe
                                                • Path C:\Users\Admin\ZocsgcQo\QKUcIIEU.exe
                                                • Size 1.6MB
                                                • SHA256 58ce1fd61608b620dee518823a349851e0819fff1488510c0c7fcd2875bb6fe5
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                QKUcIIEU.inf
                                                • Path C:\Users\Admin\ZocsgcQo\QKUcIIEU.inf
                                                • Size 4B
                                                • SHA256 1b629bbffa63f715f0abc816feb2b0f5eaf23a611f65ba4d43c2cd5b732d3dc6
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                QKUcIIEU.inf
                                                • Path C:\Users\Admin\ZocsgcQo\QKUcIIEU.inf
                                                • Size 4B
                                                • SHA256 b3aba0752c4fca0bba60321846262bc79418fe45f50e737abe3902b47452f071
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                QKUcIIEU.inf
                                                • Path C:\Users\Admin\ZocsgcQo\QKUcIIEU.inf
                                                • Size 4B
                                                • SHA256 54709bea87812e4311ff50cb8bca3ca66ba1dfb46e20429d8740952cd4cd7680
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                QKUcIIEU.inf
                                                • Path C:\Users\Admin\ZocsgcQo\QKUcIIEU.inf
                                                • Size 4B
                                                • SHA256 b126eda210ff87760539dbed67d5cdc3f06d7ff444d914ebaae0cbbe128a6fb1
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                QKUcIIEU.inf
                                                • Path C:\Users\Admin\ZocsgcQo\QKUcIIEU.inf
                                                • Size 4B
                                                • SHA256 4232ad8aba8382ee15ea4dbf0a78e0f3f2acafce21ab9741ac36551f8355a53b
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                QKUcIIEU.inf
                                                • Path C:\Users\Admin\ZocsgcQo\QKUcIIEU.inf
                                                • Size 4B
                                                • SHA256 a4cbd64f360a089e18636f9cfdeeaeafe95908013e43bc3d701d8cce4508f8b6
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                QKUcIIEU.inf
                                                • Path C:\Users\Admin\ZocsgcQo\QKUcIIEU.inf
                                                • Size 4B
                                                • SHA256 e54bbe0950cb0794988078951414d001f779a21b482d1e5ce4a00dee5176a3b2
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                QKUcIIEU.inf
                                                • Path C:\Users\Admin\ZocsgcQo\QKUcIIEU.inf
                                                • Size 4B
                                                • SHA256 bf204457064bc90ebaaa4e16e12dffa5be0db9a1a28864152d9f23e3e9057412
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                QKUcIIEU.inf
                                                • Path C:\Users\Admin\ZocsgcQo\QKUcIIEU.inf
                                                • Size 4B
                                                • SHA256 63aec2389d79457a68fd70b780fdaf46bf823addc41f71ff82942c1cefdbbb39
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                QKUcIIEU.inf
                                                • Path C:\Users\Admin\ZocsgcQo\QKUcIIEU.inf
                                                • Size 4B
                                                • SHA256 dacc8d5b8e3d7a82c55035ea20e66c71a30f1ffb549f995a62b6b27acf852232
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                QKUcIIEU.inf
                                                • Path C:\Users\Admin\ZocsgcQo\QKUcIIEU.inf
                                                • Size 4B
                                                • SHA256 16c27b6143b022ade92ccc2f84558f7c0cd20ac4e1006ec0ab878407331fa88e
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                QKUcIIEU.inf
                                                • Path C:\Users\Admin\ZocsgcQo\QKUcIIEU.inf
                                                • Size 4B
                                                • SHA256 ff3bf825f0cf2b64092e0e444da87e1df8afbcf75ef1257bc5c667675532fb97
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                QKUcIIEU.inf
                                                • Path C:\Users\Admin\ZocsgcQo\QKUcIIEU.inf
                                                • Size 4B
                                                • SHA256 9f49cb5a60bf5a21cac390e16ecc8b9c8d8782b40673ef33ba61ec8e610d11bb
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                QKUcIIEU.inf
                                                • Path C:\Users\Admin\ZocsgcQo\QKUcIIEU.inf
                                                • Size 4B
                                                • SHA256 b1ae8ca3876372544cd9107a2e2793f0e6a175366af51e254612dae8036f84f6
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                QKUcIIEU.inf
                                                • Path C:\Users\Admin\ZocsgcQo\QKUcIIEU.inf
                                                • Size 4B
                                                • SHA256 c8d73686b792a63e8bac38329c8c5bac9c64be0deea75f3c802d4fe55c680b8b
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                QKUcIIEU.inf
                                                • Path C:\Users\Admin\ZocsgcQo\QKUcIIEU.inf
                                                • Size 4B
                                                • SHA256 ec13205138270271238f8dc1d55fccedbfae2bfdbbf1f22098a3e9809886b8ec
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                QKUcIIEU.inf
                                                • Path C:\Users\Admin\ZocsgcQo\QKUcIIEU.inf
                                                • Size 4B
                                                • SHA256 f28a36a6f8a37b97c39e95654a604b2e45556624ef2324f9449999132aec41af
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                QKUcIIEU.inf
                                                • Path C:\Users\Admin\ZocsgcQo\QKUcIIEU.inf
                                                • Size 4B
                                                • SHA256 8ef7dca0519745bdba5c302f49ed8764da0bdde0de9044a49cc51de71bcedc1f
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                QKUcIIEU.inf
                                                • Path C:\Users\Admin\ZocsgcQo\QKUcIIEU.inf
                                                • Size 4B
                                                • SHA256 b07c30efc179f974a98b86500d541808e6648a349bc3532ae2d821896b91f061
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                AYYs.exe
                                                • Path C:\Windows\AYYs.exe
                                                • Size 2.1MB
                                                • SHA256 93ef4ead73f3c7c3901a99b021b8529c174db606c621177c823b922f824ec304
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                CUUe.exe
                                                • Path C:\Windows\CUUe.exe
                                                • Size 1.9MB
                                                • SHA256 31ea6712d0ae6b4acb5a460d7fd34804ef19fdfe28658e97d3f108a461e44130
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                IkUC.exe
                                                • Path C:\Windows\IkUC.exe
                                                • Size 1.8MB
                                                • SHA256 0551ab7246c30159f708849c06432f273045cefc5032a82632aa0d90d8ea496b
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                IwUy.exe
                                                • Path C:\Windows\IwUy.exe
                                                • Size 1.6MB
                                                • SHA256 98f6a86ede1d2b993ec1587ddf5ccd974ff66df52544816aa141e51dbbdf0760
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                OsAC.exe
                                                • Path C:\Windows\OsAC.exe
                                                • Size 1.6MB
                                                • SHA256 5b85f9eebdea8f372c802ad745211095a9efc1f6c3524e7e7a732874a1360818
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                SEoA.exe
                                                • Path C:\Windows\SEoA.exe
                                                • Size 1.6MB
                                                • SHA256 ab778d65acb65d0d8abfc6b1bd191993215ba57a8e6bb35ab9cdc5b0bd9d430c
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                SgEs.exe
                                                • Path C:\Windows\SgEs.exe
                                                • Size 1.6MB
                                                • SHA256 a08b508dbcf1792c46d95c22342961ec1b21a2253aaa217f00abb2c3a020a76f
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                UUAG.exe
                                                • Path C:\Windows\UUAG.exe
                                                • Size 1.6MB
                                                • SHA256 18726983eb55bd65802ac9d86cc95b8df13d16a3e15dde9fe41efe301833e54f
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                UkoI.exe
                                                • Path C:\Windows\UkoI.exe
                                                • Size 2.1MB
                                                • SHA256 ab2eeb64d093af3e80be37bfc88bf128b8869c2a1d922b840efca978d19ae30f
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                Uswk.exe
                                                • Path C:\Windows\Uswk.exe
                                                • Size 2.0MB
                                                • SHA256 dda0a3fc6fc85714bb174a205b9d6701a2fc5344df2f9cfdee7c94227cd3185d
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                WkEY.exe
                                                • Path C:\Windows\WkEY.exe
                                                • Size 1.8MB
                                                • SHA256 5b936e709a99d37ce4f4aaef3cc5e3f5f02b0c9c6b98073f5973fae14756cfe7
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                WwcU.exe
                                                • Path C:\Windows\WwcU.exe
                                                • Size 2.1MB
                                                • SHA256 f5853815c610aa522242980506f4af0e1e87831119fcbc852d9deca3ff51dfa4
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                YSsw.ico
                                                • Path C:\Windows\YSsw.ico
                                                • Size 4KB
                                                • SHA256 bc4ed7d844af9da0a5d2fe12e8db07fbfdf6e0ecd557223b292bd0e9cb6a64a1
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                Yckg.ico
                                                • Path C:\Windows\Yckg.ico
                                                • Size 4KB
                                                • SHA256 2dd714e9df3921b1194d3d890f6509ca5ee753d81f9fd83dbeec831440d22938
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                YkIc.exe
                                                • Path C:\Windows\YkIc.exe
                                                • Size 1.7MB
                                                • SHA256 a5909f3213a164f0e49eb41dbb898c5ced9080ed9e29321857d9ecbdb467ff0c
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                Yogo.exe
                                                • Path C:\Windows\Yogo.exe
                                                • Size 1.6MB
                                                • SHA256 b9714f126da1a06763039d815c1493803148aeabd596a1307ff0237f1bf41ddc
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                aIMi.exe
                                                • Path C:\Windows\aIMi.exe
                                                • Size 1.6MB
                                                • SHA256 c4cd839dabe37cc9b1f7332e17c14de7a295e50dcd713d8b5f1cd19a68317aa6
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                acks.ico
                                                • Path C:\Windows\acks.ico
                                                • Size 4KB
                                                • SHA256 114dae4c54ca426f78e50998727dac92942261d71ca5b2dbaf413794dcf8ad82
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                cIEi.exe
                                                • Path C:\Windows\cIEi.exe
                                                • Size 1.6MB
                                                • SHA256 ac4754547b3298459c999d7650652c794d7188452b6bbb00c655a718d00b4728
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                coES.exe
                                                • Path C:\Windows\coES.exe
                                                • Size 1.6MB
                                                • SHA256 e7f4ddc28200cf143285b51a6daee9cfb2abfa4268945d4c3aefb3e15076cb01
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                cssi.exe
                                                • Path C:\Windows\cssi.exe
                                                • Size 1.6MB
                                                • SHA256 6bcc5f317b0c1812977066ef14954a5d999c71bd44fd10419a69de9dfb98fd26
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                eUAy.exe
                                                • Path C:\Windows\eUAy.exe
                                                • Size 2.2MB
                                                • SHA256 99b2b4359da5fb459acf08371b98360b114ea1782523d95e493e3f28fb6845e0
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                kAgI.exe
                                                • Path C:\Windows\kAgI.exe
                                                • Size 1.6MB
                                                • SHA256 4574ae0738204dd64b9347bc3cb4b0c54613da3a5adc4f3bbaedbfcb693f646d
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                kIog.exe
                                                • Path C:\Windows\kIog.exe
                                                • Size 2.1MB
                                                • SHA256 d19b6c4dbda932631d54444794109e350e3acfb75b9998bda0d7dc91e15732e0
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                mAEc.exe
                                                • Path C:\Windows\mAEc.exe
                                                • Size 1.7MB
                                                • SHA256 f2b137f81b195d8699a969457b9e37030887eee320dd0e8ef34ec490aaec35e6
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                oAIm.exe
                                                • Path C:\Windows\oAIm.exe
                                                • Size 2.3MB
                                                • SHA256 0d041d0539aa4db1a33c9ce1d65947c23e1756e5ee90c8d66cdde917a89b0a59
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                qwkO.exe
                                                • Path C:\Windows\qwkO.exe
                                                • Size 1.6MB
                                                • SHA256 e7c700b57a2ce38c955452bff7f9985344dc4d607d65219a8b9f399e9e818d09
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                qwkS.exe
                                                • Path C:\Windows\qwkS.exe
                                                • Size 1.9MB
                                                • SHA256 c8fb0f28a7a0c96ed6707273cb142c507f65b60c92f33a35ffffedf0aa51c407
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                wAQE.exe
                                                • Path C:\Windows\wAQE.exe
                                                • Size 2.2MB
                                                • SHA256 99ddde3a4c3418de051d916bab7d82aec6fba17a8f08965af93c5ec72a7726b9
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                yMkG.exe
                                                • Path C:\Windows\yMkG.exe
                                                • Size 1.6MB
                                                • SHA256 30f4bfa50ad7fd06a947a1976a4a10b40a853850bd763faebe47ddd0b46adc8e
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                yUQW.exe
                                                • Path C:\Windows\yUQW.exe
                                                • Size 2.1MB
                                                • SHA256 1179e8e7a0c5b26c112feef58b2559a50a0c38ea448a69cce234a9cb76806b73
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                memory/404-185-0x0000000000400000-0x0000000000593000-memory.dmp
                                                Download

                                                memory/1304-244-0x0000000000400000-0x0000000000593000-memory.dmp
                                                Download

                                                memory/1348-17-0x0000000000400000-0x0000000000590000-memory.dmp
                                                Download

                                                memory/1348-1786-0x0000000000400000-0x0000000000590000-memory.dmp
                                                Download

                                                memory/1948-1798-0x0000000000400000-0x0000000000590000-memory.dmp
                                                Download

                                                memory/2132-109-0x0000000000400000-0x0000000000593000-memory.dmp
                                                Download

                                                memory/2248-138-0x0000000000400000-0x0000000000593000-memory.dmp
                                                Download

                                                memory/2348-354-0x0000000000400000-0x0000000000593000-memory.dmp
                                                Download

                                                memory/2688-97-0x0000000000400000-0x0000000000593000-memory.dmp
                                                Download

                                                memory/2880-81-0x0000000000400000-0x0000000000593000-memory.dmp
                                                Download

                                                memory/2996-309-0x0000000000400000-0x0000000000593000-memory.dmp
                                                Download

                                                memory/3124-197-0x0000000000400000-0x0000000000593000-memory.dmp
                                                Download

                                                memory/3280-235-0x0000000000400000-0x0000000000593000-memory.dmp
                                                Download

                                                memory/3284-214-0x0000000000400000-0x0000000000593000-memory.dmp
                                                Download

                                                memory/3296-262-0x0000000000400000-0x0000000000593000-memory.dmp
                                                Download

                                                memory/3296-276-0x0000000000400000-0x0000000000593000-memory.dmp
                                                Download

                                                memory/3384-287-0x0000000000400000-0x0000000000593000-memory.dmp
                                                Download

                                                memory/3524-267-0x0000000000400000-0x0000000000593000-memory.dmp
                                                Download

                                                memory/3532-10-0x0000000000400000-0x0000000000590000-memory.dmp
                                                Download

                                                memory/3532-1780-0x0000000000400000-0x0000000000590000-memory.dmp
                                                Download

                                                memory/3548-396-0x0000000000400000-0x0000000000593000-memory.dmp
                                                Download

                                                memory/3608-152-0x0000000000400000-0x0000000000593000-memory.dmp
                                                Download

                                                memory/3756-320-0x0000000000400000-0x0000000000593000-memory.dmp
                                                Download

                                                memory/3844-224-0x0000000000400000-0x0000000000593000-memory.dmp
                                                Download

                                                memory/3920-298-0x0000000000400000-0x0000000000593000-memory.dmp
                                                Download

                                                memory/4312-52-0x0000000000400000-0x0000000000593000-memory.dmp
                                                Download

                                                memory/4608-0-0x0000000000400000-0x0000000000593000-memory.dmp
                                                Download

                                                memory/4608-32-0x0000000000400000-0x0000000000593000-memory.dmp
                                                Download

                                                memory/4608-33-0x0000000002200000-0x0000000002220000-memory.dmp
                                                Download

                                                memory/4608-3-0x0000000002200000-0x0000000002220000-memory.dmp
                                                Download

                                                memory/4724-169-0x0000000000400000-0x0000000000593000-memory.dmp
                                                Download

                                                memory/4896-1804-0x0000000000400000-0x0000000000590000-memory.dmp
                                                Download

                                                memory/4928-2271-0x0000000000400000-0x0000000000590000-memory.dmp
                                                Download

                                                memory/5152-64-0x0000000000400000-0x0000000000593000-memory.dmp
                                                Download

                                                memory/5312-20-0x0000000000400000-0x0000000000590000-memory.dmp
                                                Download

                                                memory/5312-1792-0x0000000000400000-0x0000000000590000-memory.dmp
                                                Download

                                                memory/5360-255-0x0000000000400000-0x0000000000593000-memory.dmp
                                                Download

                                                memory/5608-329-0x0000000000400000-0x0000000000593000-memory.dmp
                                                Download

                                                memory/5944-125-0x0000000000400000-0x0000000000593000-memory.dmp
                                                Download