Overview

overview

10

Static

static

3

2026-08-04...ck.exe

windows10-2004-x64

10

2026-08-04...ck.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    04/08/2026, 04:58

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe
  • Size 769KB
  • Sample260804-fl86msgj4y
  • SHA256 ab104a2aac07f8058080cf95c907741ea935eb46a36bc76a6a45a5d39933c640
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryexecutionnabucurpersistenceransomwarespywarestealertrojan

Malware Config

Signatures

  • Family: Nabucur

    Nabucur is a ransomware first seen in 2015.

    ransomwarenabucur
  • Modifies visibility of file extensions in Explorer 2 TTPs 17 IoCs
    defense_evasion
  • UAC bypass 3 TTPs 17 IoCs
    defense_evasiontrojan
  • Renames multiple (115) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 6 IoCs
    persistence
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 17 IoCs
    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 34 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry key 1 TTPs 51 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4476
    • C:\Users\Admin\ZwkMsQIg\MSEAoMUs.exe
      "C:\Users\Admin\ZwkMsQIg\MSEAoMUs.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of FindShellTrayWindow
      PID:4344
    • C:\ProgramData\buUcQUAM\rMQUAEwI.exe
      "C:\ProgramData\buUcQUAM\rMQUAEwI.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      PID:1180
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock"
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3232
      • C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe
        C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4596
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock"
          4⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4752
          • C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe
            C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:3068
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock"
              6⤵
              • Executes a command shell one-liner
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1552
              • C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe
                C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock
                7⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:3892
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock"
                  8⤵
                  • Executes a command shell one-liner
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:3952
                  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe
                    C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock
                    9⤵
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of WriteProcessMemory
                    PID:3812
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock"
                      10⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:4220
                      • C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe
                        C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock
                        11⤵
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of WriteProcessMemory
                        PID:1768
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock"
                          12⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:932
                          • C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe
                            C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock
                            13⤵
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of WriteProcessMemory
                            PID:2840
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock"
                              14⤵
                              • Executes a command shell one-liner
                              • Suspicious use of WriteProcessMemory
                              PID:4092
                              • C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe
                                C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock
                                15⤵
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of WriteProcessMemory
                                PID:4340
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock"
                                  16⤵
                                  • Executes a command shell one-liner
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of WriteProcessMemory
                                  PID:4072
                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe
                                    C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock
                                    17⤵
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of WriteProcessMemory
                                    PID:8
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock"
                                      18⤵
                                      • Executes a command shell one-liner
                                      • Suspicious use of WriteProcessMemory
                                      PID:2216
                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe
                                        C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock
                                        19⤵
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:4392
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock"
                                          20⤵
                                          • Executes a command shell one-liner
                                          • System Location Discovery: System Language Discovery
                                          PID:3352
                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe
                                            C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock
                                            21⤵
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:4884
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock"
                                              22⤵
                                              • Executes a command shell one-liner
                                              PID:2584
                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe
                                                C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock
                                                23⤵
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:1888
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock"
                                                  24⤵
                                                  • Executes a command shell one-liner
                                                  PID:4512
                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe
                                                    C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock
                                                    25⤵
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:4912
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock"
                                                      26⤵
                                                      • Executes a command shell one-liner
                                                      PID:3960
                                                      • C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe
                                                        C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock
                                                        27⤵
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:4276
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock"
                                                          28⤵
                                                          • Executes a command shell one-liner
                                                          PID:1692
                                                          • C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe
                                                            C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock
                                                            29⤵
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            PID:4948
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock"
                                                              30⤵
                                                              • Executes a command shell one-liner
                                                              PID:1532
                                                              • C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe
                                                                C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock
                                                                31⤵
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                PID:1528
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock"
                                                                  32⤵
                                                                  • Executes a command shell one-liner
                                                                  PID:2580
                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe
                                                                    C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock
                                                                    33⤵
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:3704
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock"
                                                                      34⤵
                                                                      • Executes a command shell one-liner
                                                                      PID:2292
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                      34⤵
                                                                      • Modifies visibility of file extensions in Explorer
                                                                      • Modifies registry key
                                                                      PID:3840
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                      34⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Modifies registry key
                                                                      PID:804
                                                                      • C:\Windows\System32\Conhost.exe
                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                        35⤵
                                                                          PID:4556
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                        34⤵
                                                                        • UAC bypass
                                                                        • System Location Discovery: System Language Discovery
                                                                        • Modifies registry key
                                                                        PID:2404
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JccAIsEs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe""
                                                                        34⤵
                                                                        • Executes a command shell one-liner
                                                                        PID:1056
                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                          35⤵
                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:3344
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                    32⤵
                                                                    • Modifies visibility of file extensions in Explorer
                                                                    • Modifies registry key
                                                                    PID:4360
                                                                    • C:\Windows\System32\Conhost.exe
                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                      33⤵
                                                                        PID:3680
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                      32⤵
                                                                      • Modifies registry key
                                                                      PID:1012
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                      32⤵
                                                                      • UAC bypass
                                                                      • Modifies registry key
                                                                      PID:3808
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\basIcwoc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe""
                                                                      32⤵
                                                                      • Executes a command shell one-liner
                                                                      PID:1800
                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                        33⤵
                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                        PID:4404
                                                                • C:\Windows\SysWOW64\reg.exe
                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                  30⤵
                                                                  • Modifies visibility of file extensions in Explorer
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Modifies registry key
                                                                  PID:1740
                                                                  • C:\Windows\System32\Conhost.exe
                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                    31⤵
                                                                      PID:4992
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                    30⤵
                                                                    • Modifies registry key
                                                                    PID:1880
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                    30⤵
                                                                    • UAC bypass
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Modifies registry key
                                                                    PID:1960
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XgowAgMQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe""
                                                                    30⤵
                                                                    • Executes a command shell one-liner
                                                                    PID:3328
                                                                    • C:\Windows\System32\Conhost.exe
                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                      31⤵
                                                                        PID:2492
                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                        31⤵
                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:3664
                                                                • C:\Windows\SysWOW64\reg.exe
                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                  28⤵
                                                                  • Modifies visibility of file extensions in Explorer
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Modifies registry key
                                                                  PID:2660
                                                                • C:\Windows\SysWOW64\reg.exe
                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                  28⤵
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Modifies registry key
                                                                  PID:3120
                                                                • C:\Windows\SysWOW64\reg.exe
                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                  28⤵
                                                                  • UAC bypass
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Modifies registry key
                                                                  PID:2380
                                                                  • C:\Windows\System32\Conhost.exe
                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                    29⤵
                                                                      PID:2324
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YqwgUUEU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe""
                                                                    28⤵
                                                                    • Executes a command shell one-liner
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:2200
                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                      29⤵
                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                      PID:3404
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                26⤵
                                                                • Modifies visibility of file extensions in Explorer
                                                                • Modifies registry key
                                                                PID:3840
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                26⤵
                                                                • System Location Discovery: System Language Discovery
                                                                • Modifies registry key
                                                                PID:5076
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                26⤵
                                                                • UAC bypass
                                                                • System Location Discovery: System Language Discovery
                                                                • Modifies registry key
                                                                PID:4556
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iKUUgcIE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe""
                                                                26⤵
                                                                • Executes a command shell one-liner
                                                                • System Location Discovery: System Language Discovery
                                                                PID:3824
                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                  27⤵
                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                  PID:4032
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                            24⤵
                                                            • Modifies visibility of file extensions in Explorer
                                                            • System Location Discovery: System Language Discovery
                                                            • Modifies registry key
                                                            PID:4924
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                            24⤵
                                                            • Modifies registry key
                                                            PID:4360
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                            24⤵
                                                            • UAC bypass
                                                            • Modifies registry key
                                                            PID:3416
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SIkkMAkM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe""
                                                            24⤵
                                                            • Executes a command shell one-liner
                                                            PID:4468
                                                            • C:\Windows\SysWOW64\cscript.exe
                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                              25⤵
                                                              • Executes a VBScript file via the Windows Script Host.
                                                              • System Location Discovery: System Language Discovery
                                                              PID:3704
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                        22⤵
                                                        • Modifies visibility of file extensions in Explorer
                                                        • System Location Discovery: System Language Discovery
                                                        • Modifies registry key
                                                        PID:1960
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                        22⤵
                                                        • Modifies registry key
                                                        PID:2492
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                        22⤵
                                                        • UAC bypass
                                                        • Modifies registry key
                                                        PID:520
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foYAEQUg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe""
                                                        22⤵
                                                        • Executes a command shell one-liner
                                                        PID:2524
                                                        • C:\Windows\SysWOW64\cscript.exe
                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                          23⤵
                                                          • Executes a VBScript file via the Windows Script Host.
                                                          • System Location Discovery: System Language Discovery
                                                          PID:684
                                                  • C:\Windows\SysWOW64\reg.exe
                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                    20⤵
                                                    • Modifies visibility of file extensions in Explorer
                                                    • Modifies registry key
                                                    PID:4264
                                                  • C:\Windows\SysWOW64\reg.exe
                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                    20⤵
                                                    • Modifies registry key
                                                    PID:1756
                                                  • C:\Windows\SysWOW64\reg.exe
                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                    20⤵
                                                    • UAC bypass
                                                    • Modifies registry key
                                                    PID:2324
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hWAMwYsA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe""
                                                    20⤵
                                                    • Executes a command shell one-liner
                                                    • System Location Discovery: System Language Discovery
                                                    PID:3780
                                                    • C:\Windows\SysWOW64\cscript.exe
                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                      21⤵
                                                      • Executes a VBScript file via the Windows Script Host.
                                                      • System Location Discovery: System Language Discovery
                                                      PID:3248
                                              • C:\Windows\SysWOW64\reg.exe
                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                18⤵
                                                • Modifies visibility of file extensions in Explorer
                                                • Modifies registry key
                                                PID:4556
                                              • C:\Windows\SysWOW64\reg.exe
                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                18⤵
                                                • Modifies registry key
                                                PID:4548
                                              • C:\Windows\SysWOW64\reg.exe
                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                18⤵
                                                • UAC bypass
                                                • Modifies registry key
                                                PID:404
                                              • C:\Windows\SysWOW64\cmd.exe
                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RIgAIMAY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe""
                                                18⤵
                                                • Executes a command shell one-liner
                                                • System Location Discovery: System Language Discovery
                                                PID:4932
                                                • C:\Windows\SysWOW64\cscript.exe
                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                  19⤵
                                                  • Executes a VBScript file via the Windows Script Host.
                                                  • System Location Discovery: System Language Discovery
                                                  PID:3948
                                          • C:\Windows\SysWOW64\reg.exe
                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                            16⤵
                                            • Modifies visibility of file extensions in Explorer
                                            • System Location Discovery: System Language Discovery
                                            • Modifies registry key
                                            PID:220
                                          • C:\Windows\SysWOW64\reg.exe
                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                            16⤵
                                            • System Location Discovery: System Language Discovery
                                            • Modifies registry key
                                            PID:1196
                                          • C:\Windows\SysWOW64\reg.exe
                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                            16⤵
                                            • UAC bypass
                                            • System Location Discovery: System Language Discovery
                                            • Modifies registry key
                                            PID:3680
                                          • C:\Windows\SysWOW64\cmd.exe
                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eOkoYgsU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe""
                                            16⤵
                                            • Executes a command shell one-liner
                                            • Suspicious use of WriteProcessMemory
                                            PID:2004
                                            • C:\Windows\System32\Conhost.exe
                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                              17⤵
                                                PID:1804
                                              • C:\Windows\SysWOW64\cscript.exe
                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                17⤵
                                                • Executes a VBScript file via the Windows Script Host.
                                                • System Location Discovery: System Language Discovery
                                                PID:4152
                                        • C:\Windows\SysWOW64\reg.exe
                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                          14⤵
                                          • Modifies visibility of file extensions in Explorer
                                          • System Location Discovery: System Language Discovery
                                          • Modifies registry key
                                          PID:5032
                                        • C:\Windows\SysWOW64\reg.exe
                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                          14⤵
                                          • Modifies registry key
                                          PID:3664
                                        • C:\Windows\SysWOW64\reg.exe
                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                          14⤵
                                          • UAC bypass
                                          • System Location Discovery: System Language Discovery
                                          • Modifies registry key
                                          PID:2780
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\aoYYwoAE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe""
                                          14⤵
                                          • Executes a command shell one-liner
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious use of WriteProcessMemory
                                          PID:2412
                                          • C:\Windows\SysWOW64\cscript.exe
                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                            15⤵
                                            • Executes a VBScript file via the Windows Script Host.
                                            PID:536
                                    • C:\Windows\SysWOW64\reg.exe
                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                      12⤵
                                      • Modifies visibility of file extensions in Explorer
                                      • System Location Discovery: System Language Discovery
                                      • Modifies registry key
                                      PID:4020
                                    • C:\Windows\SysWOW64\reg.exe
                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                      12⤵
                                      • Modifies registry key
                                      PID:556
                                    • C:\Windows\SysWOW64\reg.exe
                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                      12⤵
                                      • UAC bypass
                                      • Modifies registry key
                                      PID:4764
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IgYkMAAA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe""
                                      12⤵
                                      • Executes a command shell one-liner
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of WriteProcessMemory
                                      PID:4844
                                      • C:\Windows\SysWOW64\cscript.exe
                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                        13⤵
                                        • Executes a VBScript file via the Windows Script Host.
                                        PID:4992
                                • C:\Windows\SysWOW64\reg.exe
                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                  10⤵
                                  • Modifies visibility of file extensions in Explorer
                                  • System Location Discovery: System Language Discovery
                                  • Modifies registry key
                                  PID:3780
                                • C:\Windows\SysWOW64\reg.exe
                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                  10⤵
                                  • Modifies registry key
                                  PID:4404
                                • C:\Windows\SysWOW64\reg.exe
                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                  10⤵
                                  • UAC bypass
                                  • System Location Discovery: System Language Discovery
                                  • Modifies registry key
                                  PID:3404
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lAgIcYwU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe""
                                  10⤵
                                  • Executes a command shell one-liner
                                  • Suspicious use of WriteProcessMemory
                                  PID:5012
                                  • C:\Windows\SysWOW64\cscript.exe
                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                    11⤵
                                    • Executes a VBScript file via the Windows Script Host.
                                    • System Location Discovery: System Language Discovery
                                    PID:1456
                            • C:\Windows\SysWOW64\reg.exe
                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                              8⤵
                              • Modifies visibility of file extensions in Explorer
                              • System Location Discovery: System Language Discovery
                              • Modifies registry key
                              PID:2012
                            • C:\Windows\SysWOW64\reg.exe
                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                              8⤵
                              • Modifies registry key
                              PID:3976
                            • C:\Windows\SysWOW64\reg.exe
                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                              8⤵
                              • UAC bypass
                              • System Location Discovery: System Language Discovery
                              • Modifies registry key
                              PID:1684
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\biAMUMgY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe""
                              8⤵
                              • Executes a command shell one-liner
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of WriteProcessMemory
                              PID:2860
                              • C:\Windows\SysWOW64\cscript.exe
                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                9⤵
                                • Executes a VBScript file via the Windows Script Host.
                                PID:5016
                        • C:\Windows\SysWOW64\reg.exe
                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                          6⤵
                          • Modifies visibility of file extensions in Explorer
                          • System Location Discovery: System Language Discovery
                          • Modifies registry key
                          PID:204
                        • C:\Windows\SysWOW64\reg.exe
                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                          6⤵
                          • System Location Discovery: System Language Discovery
                          • Modifies registry key
                          PID:1696
                        • C:\Windows\SysWOW64\reg.exe
                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                          6⤵
                          • UAC bypass
                          • System Location Discovery: System Language Discovery
                          • Modifies registry key
                          PID:1804
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mMcgIYgI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe""
                          6⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:1416
                          • C:\Windows\SysWOW64\cscript.exe
                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                            7⤵
                            • Executes a VBScript file via the Windows Script Host.
                            PID:1928
                    • C:\Windows\SysWOW64\reg.exe
                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                      4⤵
                      • Modifies visibility of file extensions in Explorer
                      • System Location Discovery: System Language Discovery
                      • Modifies registry key
                      PID:4400
                    • C:\Windows\SysWOW64\reg.exe
                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                      4⤵
                      • Modifies registry key
                      PID:2292
                    • C:\Windows\SysWOW64\reg.exe
                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                      4⤵
                      • UAC bypass
                      • System Location Discovery: System Language Discovery
                      • Modifies registry key
                      PID:2580
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IgAggwUM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe""
                      4⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:1952
                      • C:\Windows\SysWOW64\cscript.exe
                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                        5⤵
                        • Executes a VBScript file via the Windows Script Host.
                        • System Location Discovery: System Language Discovery
                        PID:3984
                • C:\Windows\SysWOW64\reg.exe
                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                  2⤵
                  • Modifies visibility of file extensions in Explorer
                  • System Location Discovery: System Language Discovery
                  • Modifies registry key
                  PID:4868
                • C:\Windows\SysWOW64\reg.exe
                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                  2⤵
                  • System Location Discovery: System Language Discovery
                  • Modifies registry key
                  PID:2416
                • C:\Windows\SysWOW64\reg.exe
                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                  2⤵
                  • UAC bypass
                  • Modifies registry key
                  PID:1336
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HwwUokMw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock.exe""
                  2⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:780
                  • C:\Windows\SysWOW64\cscript.exe
                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                    3⤵
                    • Executes a VBScript file via the Windows Script Host.
                    • System Location Discovery: System Language Discovery
                    PID:1824
              • C:\Users\Admin\ZwkMsQIg\MSEAoMUs.exe
                C:\Users\Admin\ZwkMsQIg\MSEAoMUs.exe
                1⤵
                • Executes dropped EXE
                • Adds Run key to start application
                • System Location Discovery: System Language Discovery
                PID:2768
              • C:\ProgramData\buUcQUAM\rMQUAEwI.exe
                C:\ProgramData\buUcQUAM\rMQUAEwI.exe
                1⤵
                • Executes dropped EXE
                • Adds Run key to start application
                • System Location Discovery: System Language Discovery
                PID:4540
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
                1⤵
                  PID:2380

                Network

                      MITRE ATT&CK Enterprise v16

                      Reconnaissance

                      Resource Development

                      Initial Access

                      Execution

                      Command and Scripting Interpreter

                      2
                      T1059

                      Visual Basic

                      1
                      T1059.005

                      Windows Command Shell

                      1
                      T1059.003

                      Persistence

                      Boot or Logon Autostart Execution

                      1
                      T1547

                      Registry Run Keys / Startup Folder

                      1
                      T1547.001

                      Privilege Escalation

                      Abuse Elevation Control Mechanism

                      1
                      T1548

                      Bypass User Account Control

                      1
                      T1548.002

                      Boot or Logon Autostart Execution

                      1
                      T1547

                      Registry Run Keys / Startup Folder

                      1
                      T1547.001

                      Defense Evasion

                      Abuse Elevation Control Mechanism

                      1
                      T1548

                      Bypass User Account Control

                      1
                      T1548.002

                      Hide Artifacts

                      1
                      T1564

                      Hidden Files and Directories

                      1
                      T1564.001

                      Impair Defenses

                      1
                      T1562

                      Disable or Modify Tools

                      1
                      T1562.001

                      Modify Registry

                      4
                      T1112

                      Credential Access

                      Credentials from Password Stores

                      1
                      T1555

                      Credentials from Web Browsers

                      1
                      T1555.003

                      Unsecured Credentials

                      1
                      T1552

                      Credentials In Files

                      1
                      T1552.001

                      Discovery

                      Query Registry

                      1
                      T1012

                      System Information Discovery

                      2
                      T1082

                      System Location Discovery

                      1
                      T1614

                      System Language Discovery

                      1
                      T1614.001

                      Lateral Movement

                      Collection

                      Data from Local System

                      1
                      T1005

                      Command and Control

                      Exfiltration

                      Impact

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      guest.bmp.exe
                      • Path C:\ProgramData\Microsoft\User Account Pictures\guest.bmp.exe
                      • Size 770KB
                      • SHA256 59fed4d5c79b4e8b506f897eb23134fd0f1e4a7fa1268640adc060a4e6aaaa9a
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      guest.png.exe
                      • Path C:\ProgramData\Microsoft\User Account Pictures\guest.png.exe
                      • Size 209KB
                      • SHA256 7a7a4f15f3e1f29e7068ef3facba04ede98f8bd108aa4a4d8ff97a0f026c9c51
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      user-192.png.exe
                      • Path C:\ProgramData\Microsoft\User Account Pictures\user-192.png.exe
                      • Size 183KB
                      • SHA256 abc3c38883d4c576d4b52fb3d4cedaaa02fd36f9e13420b2d750f37815a5dc1d
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      user.bmp.exe
                      • Path C:\ProgramData\Microsoft\User Account Pictures\user.bmp.exe
                      • Size 785KB
                      • SHA256 94b08a6b7f01e841ff5b23e9bfffada77aaaa5860a68e137aae3f20e4f928b3c
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      vcredist_x86.exe
                      • Path C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                      • Size 644KB
                      • SHA256 b2bbd80270b688791a2989b6af66057758f11ecd68a1d8883150d120adcf14d2
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      VC_redist.x64.exe
                      • Path C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                      • Size 826KB
                      • SHA256 d91a520307329a12880b59fbf6a5263b6d34729747d277be01b42d5efb7af4a5
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      vcredist_x64.exe
                      • Path C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                      • Size 631KB
                      • SHA256 a89f34e8cc00cd0eb2d22592987f7eb0f8a5018ab50618911e9e1e9e31e8a8a4
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      rMQUAEwI.exe
                      • Path C:\ProgramData\buUcQUAM\rMQUAEwI.exe
                      • Size 185KB
                      • SHA256 2f51b9d603884e81e034ace4305e39723f5d36107ef50bb031c016253379363b
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      rMQUAEwI.inf
                      • Path C:\ProgramData\buUcQUAM\rMQUAEwI.inf
                      • Size 4B
                      • SHA256 348a1b08d33335c4788a9f15fd645f17f883ac68e823fef552e5f1be6b4be348
                      • MD5 SHA1 SHA512
                      Submit Download

                      rMQUAEwI.inf
                      • Path C:\ProgramData\buUcQUAM\rMQUAEwI.inf
                      • Size 4B
                      • SHA256 87a890f560173f161cef96c8b87e0fc4d855c53e35732d97e370130fb7449d0f
                      • MD5 SHA1 SHA512
                      Submit Download

                      rMQUAEwI.inf
                      • Path C:\ProgramData\buUcQUAM\rMQUAEwI.inf
                      • Size 4B
                      • SHA256 1ff741e277f0ec0a6ced85317e677cc030618964861f4372a10ef340137722c2
                      • MD5 SHA1 SHA512
                      Submit Download

                      flapper.gif.exe
                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\flapper.gif.exe
                      • Size 266KB
                      • SHA256 48ae4469a044ef700696d2a1c039210c070bd3ba072a6dbe35ee84507d748c83
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      192.png.exe
                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\192.png.exe
                      • Size 185KB
                      • SHA256 b078aea3380170c9d385574ec097471dd736764bcbf04875258111c93777c9cb
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      32.png.exe
                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\32.png.exe
                      • Size 204KB
                      • SHA256 58cc5419061e9457687f6cb467e11a5d8dcccbed978c5db33937544cc3c035f9
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      48.png.exe
                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\48.png.exe
                      • Size 186KB
                      • SHA256 25d38dad0fe01541b544f35237e954248767b61d4b91a09110e4862424be0568
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      64.png.exe
                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\64.png.exe
                      • Size 187KB
                      • SHA256 6e12b22d849baa09418d1689d3e8d729b1eace450e4c3f27e499c02055e6c19e
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      96.png.exe
                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\96.png.exe
                      • Size 192KB
                      • SHA256 c4e767ac13741ca24f17c4177300e986827c46837e0f7f7d2be1ff7a78538c71
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      128.png.exe
                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\128.png.exe
                      • Size 203KB
                      • SHA256 72b19b8f3fa0c2d58ecb7fdfca74048e3b98340446ece51f9ff457c314243a65
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      192.png.exe
                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\192.png.exe
                      • Size 189KB
                      • SHA256 d0951b4ad09315972c4a5d48dc71dff4e0071874b3f2d3fc59b733a93cb2da73
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      48.png.exe
                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\48.png.exe
                      • Size 181KB
                      • SHA256 79fbca5fa2815f6759ef51199d121334172834f368db4b5a23587f2bc25e604f
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      128.png.exe
                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\128.png.exe
                      • Size 190KB
                      • SHA256 c7ca59e7e0e56738150aeff636da41a94390c98eff86c9cad646b77a47fd93cc
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      96.png.exe
                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\96.png.exe
                      • Size 202KB
                      • SHA256 fbc0774132777e1a70aa8d6dda0d3af33b35316aae86834026747c94f0f8d681
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      32.png.exe
                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\32.png.exe
                      • Size 198KB
                      • SHA256 74c6d744dd8945a053c02de411e7939ccbd9e97619817fcbbdf3060fd8c1dbe5
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      96.png.exe
                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\96.png.exe
                      • Size 206KB
                      • SHA256 eee6efc4dd603bea5a85f2a10de41ed3c11a4523b9872ef26666dd200f9cbcec
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      96.png.exe
                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mdpkiolbdkhdjpekfbkbmhigcaggjagi\Icons\96.png.exe
                      • Size 194KB
                      • SHA256 20566c68a8f328d58df43a0a12a3cd31019b73ec193ea111ad20a7da269de8de
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      128.png.exe
                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\128.png.exe
                      • Size 188KB
                      • SHA256 941d41e63d2b03012ebff45ec20133778cecf208bee0320702422e5ae79d5c48
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      256.png.exe
                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\256.png.exe
                      • Size 189KB
                      • SHA256 e84bb7834afed7405c68a920d5271e033c5b158832b99132d5863a503cdd8e07
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      AppWhite.png.exe
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppWhite.png.exe
                      • Size 197KB
                      • SHA256 54adaad7b8e366abde52837c0935b5656c91d49280e12f2d639e71571d26443c
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      KFMLockedFileToast.png.exe
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMLockedFileToast.png.exe
                      • Size 208KB
                      • SHA256 ee2715281e106ce33040aed30e11b731a3210801cfd0d7d6f5045397f77d5729
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      OneDriveLogo.png.exe
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveLogo.png.exe
                      • Size 204KB
                      • SHA256 12b37556b893729a0bb619da2cb2cf3bc09496652f5bc2f3f05db6611bffab38
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      QuotaError.png.exe
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\QuotaError.png.exe
                      • Size 195KB
                      • SHA256 ea808df89577840301dbc878b8f3bfcd07e0c08bf1ccd074e03ddd60d6c1ac24
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      QuotaNearing.png.exe
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\QuotaNearing.png.exe
                      • Size 187KB
                      • SHA256 fc8574dba9fed6fdda721a248a8701429b5b0abbfe6e1d13d3ae7f336ab43b67
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      ScreenshotOptIn.gif.exe
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ScreenshotOptIn.gif.exe
                      • Size 419KB
                      • SHA256 af058f36dab21cb0d5e67b21399b31fe02f49216a40027fd6ab6d5d874a72356
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      Warning.png.exe
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Warning.png.exe
                      • Size 185KB
                      • SHA256 ca7d55ef2f522cb64cec46c87000bbd8e1ba6f0c2e04eb152785819dc842b571
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      OneDriveMedTile.contrast-white_scale-400.png.exe
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-400.png.exe
                      • Size 182KB
                      • SHA256 d368dcf38162ac9a71f82c6de0e2464456fdd4632d7014fd236d1794c3d3b8ec
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      OneDriveMedTile.scale-400.png.exe
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-400.png.exe
                      • Size 194KB
                      • SHA256 5f9ba20387b7323bab129123545fcd1690c581f974c63f7fb2fa557146a2aeee
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      OneDrive.exe
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
                      • Size 1.7MB
                      • SHA256 ce7d38100e7e058cfbca662cbc590d62309a6779a83bdedc2d4a2283bba08e4c
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      squaretile.png.exe
                      • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\38975140460\squaretile.png.exe
                      • Size 188KB
                      • SHA256 029840c36f808ed7d59d1435c7f2c18317d74ce8ed28aed5625ead731c3cc3a4
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      tinytile.png.exe
                      • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\38975140460\tinytile.png.exe
                      • Size 198KB
                      • SHA256 db3a4bb0b718d206eaaa5b513de786ad6aa4431f01f0f7545626c11761b7be4f
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock
                      • Path C:\Users\Admin\AppData\Local\Temp\2026-08-04_edfc91dfd9f13bbeef23cb3fdc134b19_elex_virlock
                      • Size 588KB
                      • SHA256 60ff5131dba68a8ffe7ba0475bf3e192b432e1969e5ac52d7f217f6935f4035d
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      AAos.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\AAos.exe
                      • Size 508KB
                      • SHA256 7d40a1db8ed79a119d0aa6ff9c5289ab1b775fc81fbb82886122a1ac94cdcec9
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      AEIM.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\AEIM.exe
                      • Size 504KB
                      • SHA256 f9476d907233ca8dad7bd3eeb958cd2374c7cd29657d73207bd9caf28adf92bd
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      AIwu.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\AIwu.exe
                      • Size 454KB
                      • SHA256 7fcaeef6ab130333422e405de6080e2e1d311717ca0432504174e29f8959686e
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      AMwK.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\AMwK.exe
                      • Size 222KB
                      • SHA256 e5f830e8772540d6322035912d789c2a10e75b6c3aaa36370d13eb63a7613b49
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      AoQS.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\AoQS.exe
                      • Size 416KB
                      • SHA256 81c806aa939f071acf5027c98cf751128d82af8319df35681c1f27b2bf7bd879
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      Aswk.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\Aswk.exe
                      • Size 485KB
                      • SHA256 50f5d5410248ed2f04761eb1d529c2870f0deee29f6066af6a57e8ef89d3ef8e
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      CEEY.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\CEEY.exe
                      • Size 407KB
                      • SHA256 f4272ab614c41f9597acc698478039d67c1eb5d99940e944a8203869098de0b8
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      CIUK.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\CIUK.exe
                      • Size 292KB
                      • SHA256 4930fc0af4cbd7ee41f81b7126d96bb3a1e05cc5c669b19abc34886d81b6087c
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      CIow.ico
                      • Path C:\Users\Admin\AppData\Local\Temp\CIow.ico
                      • Size 4KB
                      • SHA256 701a17a9ee5c9340bae4f0810f103d1f0ca5c03141e0da826139d5b7397a6fb3
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      CYsy.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\CYsy.exe
                      • Size 205KB
                      • SHA256 ced6ace4fd20d7f896cf30a392bc106c69418d13fa41374e1e5a241016b86f6d
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      Ckcu.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\Ckcu.exe
                      • Size 462KB
                      • SHA256 c622f2f4942836a59b86210bd3cc5ca782476f64c0d4ab0ebf9863d2334f02b6
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      CsoG.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\CsoG.exe
                      • Size 186KB
                      • SHA256 1a8067984af79dbb3335871a07282dd924052430e41d5f80f878bd807bad6bd9
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      EoYS.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\EoYS.exe
                      • Size 393KB
                      • SHA256 bbcaae010a2c22a5ed76ec24c5976eaa484a19bc896ee70668e6199e34aa46b8
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      GIQA.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\GIQA.exe
                      • Size 301KB
                      • SHA256 8b601e5eab6c0ed67ceac2c041d0e18416e83eab747bfe3b7f478a8bccbac350
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      GUQI.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\GUQI.exe
                      • Size 316KB
                      • SHA256 beb23b3abcf5e34e8386293fb50b337e38130a1c68379b6778741a906f57c770
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      GgEq.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\GgEq.exe
                      • Size 241KB
                      • SHA256 bf933b67e18c46c742f2ed6543424f7e538260239aa990053a218af6173522c7
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      GwEC.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\GwEC.exe
                      • Size 416KB
                      • SHA256 87f3a263094b12d11179be9ca2582827fe5f9a0dbf57040322e360e35b70c241
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      HwwUokMw.bat
                      • Path C:\Users\Admin\AppData\Local\Temp\HwwUokMw.bat
                      • Size 112B
                      • SHA256 ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      IAwO.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\IAwO.exe
                      • Size 195KB
                      • SHA256 7bacc936816711519aecac735887ace6a88a2c253eb51d542de0cbbf5563589b
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      IQQu.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\IQQu.exe
                      • Size 192KB
                      • SHA256 2d71d056b427968ad1ef4077583812fa78817fcc0e7f60d2c5834db7435693af
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      Iocg.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\Iocg.exe
                      • Size 340KB
                      • SHA256 046e18f78dab9688ca5bbee8d3fff820278a56a830694b8af3968251699a0aa8
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      IsMe.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\IsMe.exe
                      • Size 323KB
                      • SHA256 fa8c74d573f2f18452689bef494b94a0dcfa3ff0178f6fd629ff59323870b54a
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      KAks.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\KAks.exe
                      • Size 639KB
                      • SHA256 3d3c76079c5fabc8d7d261985a911b2ea7ff31b3774b1b5ca1a4f1a724d4d769
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      KoIu.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\KoIu.exe
                      • Size 221KB
                      • SHA256 471544f7f1dbafdcf70142ea11a720ea27ff087bc0af754a4e59b4802cf32686
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      MskM.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\MskM.exe
                      • Size 384KB
                      • SHA256 636d06295e1ab6afaf465983f04035d376391a614912f227a0deaed3572270d7
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      OAwc.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\OAwc.exe
                      • Size 565KB
                      • SHA256 41bee62d3aaf21c47045c84917f460bcd8ffdc3d4c64b9e70cc64ef444389219
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      OYAE.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\OYAE.exe
                      • Size 212KB
                      • SHA256 cc6494755550b2c6a71f3a6e5a0f0e49e838fc2b1b58d1917a13bbde40633455
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      OgIK.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\OgIK.exe
                      • Size 493KB
                      • SHA256 8f0bea81ffbaa8507059f74e02c7d548c8872c562ee1793019bde20f56f7306d
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      Owci.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\Owci.exe
                      • Size 1.3MB
                      • SHA256 34bb0e00928fbdf2c073095f197e56237c275770b3c0e902be76d338a23f359f
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      QoIS.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\QoIS.exe
                      • Size 206KB
                      • SHA256 5c1b181b71097d71ff308e838b1d2003e68f852fc2ae3e2f72725aa12eb5359c
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      QssA.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\QssA.exe
                      • Size 187KB
                      • SHA256 54e926063d76d87b2d2735a8f80e4802d9e356960e91784fa9d3d784775a4639
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      SUgo.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\SUgo.exe
                      • Size 1.2MB
                      • SHA256 75b15619fed6ee9b7346248b16e78f477882b94b32954de721e2e238f1a4c934
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      SYEA.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\SYEA.exe
                      • Size 441KB
                      • SHA256 0c4cb4215c9b790bbf35f7a7ffbf2553f97e8640b5ee4d2323ceb9d7b4056397
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      SgMS.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\SgMS.exe
                      • Size 205KB
                      • SHA256 2fdce727bd9b88a128bf9c1bcaee2cfe72c35a2b9ec6aef9b2de39a2c0ac9079
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      SkIW.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\SkIW.exe
                      • Size 207KB
                      • SHA256 c693356eedee31b9a9955943952aeadc2fc6123fc800fcec47e8ce4bc667147d
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      SwEi.ico
                      • Path C:\Users\Admin\AppData\Local\Temp\SwEi.ico
                      • Size 4KB
                      • SHA256 be3e79875f3e84bab8ed51f6028b198f5e8472c60dcedf757af2e1bdf2aa5742
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      UEwa.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\UEwa.exe
                      • Size 189KB
                      • SHA256 61dd9e343a8dddb0f32d2a6de07f39cede810dd002a080f6c2439d2d5d21970e
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      WAEw.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\WAEw.exe
                      • Size 208KB
                      • SHA256 4e5ccb819a912a37fd01268509e057b37084ddf252e3108461380de9ccbf2dd6
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      WAMG.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\WAMG.exe
                      • Size 205KB
                      • SHA256 b404b13d2ed9d13b2741b10fa6c033400a1ed8df6518e959ad5d0f10d57ecec0
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      WEMa.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\WEMa.exe
                      • Size 197KB
                      • SHA256 1a356a6c8fee031d0842e5ac7b84952551fddd333b4fd6f6ceef22b9db8cfd12
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      WIwM.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\WIwM.exe
                      • Size 196KB
                      • SHA256 f91a830a461f6807ed47ac7eecc3ab20349fc1cb91337cb1b23b440948504c92
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      Wsom.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\Wsom.exe
                      • Size 208KB
                      • SHA256 4390c032e37b2aa97c8625f59279ac177af267944fbbab055fb01f4be648c287
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      YQgi.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\YQgi.exe
                      • Size 204KB
                      • SHA256 d0c58a45d72f2860a60439354f02f9693fe93b33d738663335d4cd53ff1126a1
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      YUsU.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\YUsU.exe
                      • Size 193KB
                      • SHA256 3e925f74959edf26cb5112f63ec8b27745fade9591bc52957bab42c76a358124
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      YcMk.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\YcMk.exe
                      • Size 206KB
                      • SHA256 73b84fb3992be781c34415b966bbb450ab5292c58e4fa33495d8861ff9dc3919
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      aAIC.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\aAIC.exe
                      • Size 202KB
                      • SHA256 d0b223069dd1aa3e66efedbdbb6fac58c3dd7ada496c423a0a4bc95aacec7255
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      aYkc.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\aYkc.exe
                      • Size 797KB
                      • SHA256 46ee5f109ebf96b7ab7ed9d241c61d2931a4a15135553089efe50c8ea6161fe0
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      cMEk.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\cMEk.exe
                      • Size 407KB
                      • SHA256 eee1d8960728dde70e30cf964aa6632d14e4b8d859f57de8ab69841154c02d1f
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      cgYU.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\cgYU.exe
                      • Size 206KB
                      • SHA256 efc36da344c60c22dffec2569bf5b04f04353ce6ceccc00edfe8305ae22493cf
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      csYk.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\csYk.exe
                      • Size 205KB
                      • SHA256 9814202039b5334d2dc05d4ea87fdd3ccd52b8f9f6ef0cf6eaeeb5bcd76a11fc
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      cswU.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\cswU.exe
                      • Size 211KB
                      • SHA256 25fe1f86425905d749cec5bb9569342949057f8bbc3eecf4744e2e0b8a81cc7d
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      eQsw.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\eQsw.exe
                      • Size 195KB
                      • SHA256 cd494701fdc42e803993bb74cc92cd6e9831ecc1e5548c27605622a3334f3a9a
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      eYwe.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\eYwe.exe
                      • Size 211KB
                      • SHA256 7ee1ad97c494651f87cae100cb0711e663111e06ac36ab264061b7c38ffc8ce8
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      file.vbs
                      • Path C:\Users\Admin\AppData\Local\Temp\file.vbs
                      • Size 19B
                      • SHA256 59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
                      • MD5 SHA1 SHA512
                      Submit Download

                      gIgy.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\gIgy.exe
                      • Size 193KB
                      • SHA256 66e5cd5109d1dfbc6afc46a4f33ce5b3f4f7868ec3b139eeddc06dfe1fc761bf
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      gIsc.ico
                      • Path C:\Users\Admin\AppData\Local\Temp\gIsc.ico
                      • Size 4KB
                      • SHA256 0b945cd858463198a2319799f721202efb88f1b7273bc3726206f0bb272802f7
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      gQEU.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\gQEU.exe
                      • Size 503KB
                      • SHA256 020f00eac6409b6ddb1e90bd3a888964c2d5224fd29c15a7dd11cf8adfbf6b1e
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      gwEY.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\gwEY.exe
                      • Size 582KB
                      • SHA256 cbe75e27cccb96f100bd7ea612cb68856b14cd5f3229d37426bce60b892c3683
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      iEsa.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\iEsa.exe
                      • Size 653KB
                      • SHA256 4c2d749f6912f84d531ba68eaa0704347b9456a235a54ff0e6b515fc58d092e6
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      iIco.ico
                      • Path C:\Users\Admin\AppData\Local\Temp\iIco.ico
                      • Size 4KB
                      • SHA256 f8e8be11d1062a945187b65fc5e5b1500bce03cbdbf6f4af9404b649aacc2aa3
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      iMUU.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\iMUU.exe
                      • Size 212KB
                      • SHA256 ffc51ecdeeb1ddc4f12fc8d9117deb841d44c7736087f8c441a79f38332ef756
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      iMsI.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\iMsI.exe
                      • Size 830KB
                      • SHA256 519e7c2cda761a463181bf93247f0f4f19b3d405b784ee53cfc2afea3838040c
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      iggM.ico
                      • Path C:\Users\Admin\AppData\Local\Temp\iggM.ico
                      • Size 4KB
                      • SHA256 684e75b6fdb9a7203e03c630a66a3710ace32aa78581311ba38e3f26737feae6
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      kIci.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\kIci.exe
                      • Size 227KB
                      • SHA256 852f8f68cbf342faddefba15d04180ece9305ab1c57edc8a8e3d6d2bed9e4015
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      kQYy.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\kQYy.exe
                      • Size 181KB
                      • SHA256 9772d50f2d65fae53d33d88b96109c215c76825a55c7b35992cc226f7b5399a4
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      kYss.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\kYss.exe
                      • Size 206KB
                      • SHA256 c484bd6d7ee33ec75604ff1f28eed6ce8283fbad12743a55e43ab2ea9f5b3762
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      kgwo.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\kgwo.exe
                      • Size 543KB
                      • SHA256 a8df289950a637b7faf4254c120c2b1b4e679028f206ca9a072ab1907eb49045
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      koIA.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\koIA.exe
                      • Size 560KB
                      • SHA256 5b5747b2de10626ae866ae9c6351d59e14593112fd13212f32893accf6c3e577
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      ksUC.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\ksUC.exe
                      • Size 206KB
                      • SHA256 8fbff36deecab1690958c0330f8ffd2573c1b47c55a15ac55103fd9ea65fe00f
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      mEUY.ico
                      • Path C:\Users\Admin\AppData\Local\Temp\mEUY.ico
                      • Size 4KB
                      • SHA256 71254090503179540435a1283d04301f3d5ba48855ae8c361d4ac86e3abd2865
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      mUoE.ico
                      • Path C:\Users\Admin\AppData\Local\Temp\mUoE.ico
                      • Size 4KB
                      • SHA256 57e72b9591e318a17feb74efa1262e9222814ad872437094734295700f669563
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      moIu.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\moIu.exe
                      • Size 215KB
                      • SHA256 e6293a53e570e6f1f9a1b47e880a3ad5367b06c81c93901fe9f10770d6c38801
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      oEsW.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\oEsW.exe
                      • Size 191KB
                      • SHA256 9c53f60c9a1bdf91f23612e6db073b17c05da920b8f1c50ffad827597ab897d4
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      oIMc.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\oIMc.exe
                      • Size 573KB
                      • SHA256 7ddcc0ca76c428ad38151ff1aade5702d6924139c577baff38a0099be2737014
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      oMEK.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\oMEK.exe
                      • Size 188KB
                      • SHA256 34bdef1721dac300f3cf93e504ab1b4adefeb3ec1e1e78924e9b22c08cdf6f8d
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      oYck.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\oYck.exe
                      • Size 653KB
                      • SHA256 0ad21f5550b4023a8560560910524dc53625be5172ede6300552205ff204cd80
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      qAMe.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\qAMe.exe
                      • Size 468KB
                      • SHA256 9030eae37938a7f7ac70ac7205712407c082c6f24377d7b7ab616c2048488c44
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      qYIg.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\qYIg.exe
                      • Size 749KB
                      • SHA256 cc00e07aac60101f050d3d8ac901da994920bb7157dd986a37d774aba728d57e
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      qYsy.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\qYsy.exe
                      • Size 552KB
                      • SHA256 db148865746053196831ee29ef87d9ad649db8998c723168532f1ff43598bc3f
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      qowm.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\qowm.exe
                      • Size 425KB
                      • SHA256 2724a842b646d88b96f49c8d6a9983b76867fa7882beb9d38b12581c7727b412
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      qwQM.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\qwQM.exe
                      • Size 229KB
                      • SHA256 b4b1f7464d1e089806aab0476e186a95851316d42681ec62a6b735a86e189c93
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      sMky.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\sMky.exe
                      • Size 185KB
                      • SHA256 4dae32071e805c07747439722cb2d1d4d2966bcb9a5558c9ebfbca0958d23e0a
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      sQsk.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\sQsk.exe
                      • Size 322KB
                      • SHA256 9accae51b67c89685a3e3dd68ebea1987ab8ea134e6e3938aa73142a3b91a526
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      sUEU.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\sUEU.exe
                      • Size 185KB
                      • SHA256 7a27bc7b1635dcf81cd26afaa2d52685c152bc4d7991bd6df17c631872d4a2f7
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      scMU.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\scMU.exe
                      • Size 643KB
                      • SHA256 ebcddac9ed0ff932837a788528e98bc2cae662d7dfd0fac35a40ad8603618b40
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      ssIy.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\ssIy.exe
                      • Size 206KB
                      • SHA256 3f15905401c71e72d98afd2970b68af2c7085171e9a8fbcc461e8a5402278430
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      uEks.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\uEks.exe
                      • Size 199KB
                      • SHA256 40a852f14400b538dafb08aed472c58c3b16d1b086a7166b1048de73fd29a41e
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      uMoG.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\uMoG.exe
                      • Size 202KB
                      • SHA256 14dc92e0bfc47f1091180b38f27f8ab570a1594fed0cec17800c9b1667ef4c6c
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      uQEu.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\uQEu.exe
                      • Size 189KB
                      • SHA256 0ea00a409e9707e4a44629423973f50dee2c380577568206b21cbed8de6f5519
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      uUEo.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\uUEo.exe
                      • Size 202KB
                      • SHA256 91521027692dc6c2f0b28783ef851c51c19771c0e4b5a65b6eb4e70b18ae19e4
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      usMI.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\usMI.exe
                      • Size 202KB
                      • SHA256 7fc905ad638a74a052546622159e342af98f34ffe71c49c8d2c939f3ec74ebf0
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      uwQG.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\uwQG.exe
                      • Size 798KB
                      • SHA256 cf6b550a34a2dab159188587b3bdb499d986414997b78e429550004ab0d00233
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      wAYq.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\wAYq.exe
                      • Size 798KB
                      • SHA256 8e339a93b13c6988ff2331885ee3d562f362fc60fad8d238eeda68b03b0ffa8b
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      wEIg.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\wEIg.exe
                      • Size 193KB
                      • SHA256 cad1fc425d5ffd92939a62fe2312049543639b35e2c56c4fc0d4cce1a94b909b
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      wMMA.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\wMMA.exe
                      • Size 308KB
                      • SHA256 91b72296997126ed46df863700bd94b4a692216d97ebf1c9d14075e43fbf8210
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      wsgC.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\wsgC.exe
                      • Size 242KB
                      • SHA256 153ccbe00578a6524b159cd2168183b770734be14796378d0ec2e8a36c768780
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      yckW.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\yckW.exe
                      • Size 196KB
                      • SHA256 38d6f6b66332aef9c4580953975d3ef52c0436476d43278014eb30e4d4e3374a
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      CopyGroup.xls.exe
                      • Path C:\Users\Admin\AppData\Roaming\ConvertExit\CopyGroup.xls.exe
                      • Size 392KB
                      • SHA256 b3460353ea6cd0e7ad0f03c74140c39de293f1b59116567517f978736fc06460
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      ReceiveAssert.png.exe
                      • Path C:\Users\Admin\AppData\Roaming\ConvertExit\ReceiveAssert.png.exe
                      • Size 295KB
                      • SHA256 c13f033d77800f028e42e47d2bb97ac5d2bc148d74d70d4e2dd130ac46d2f5a4
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      EditRename.png.exe
                      • Path C:\Users\Admin\AppData\Roaming\DenyGroup\EditRename.png.exe
                      • Size 476KB
                      • SHA256 dd98b7738556b9f75357e73b31213ab87322b2cf7a706282901d9adacd3f72bf
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      RevokePop.pdf.exe
                      • Path C:\Users\Admin\AppData\Roaming\GetSet\RevokePop.pdf.exe
                      • Size 641KB
                      • SHA256 68e13ee5d2db6eacc2ef38612850b4ccbd40d83befc6e986ee79613e2efb1a3d
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      ImportRead.doc.exe
                      • Path C:\Users\Admin\AppData\Roaming\MeasureInstall\ImportRead.doc.exe
                      • Size 635KB
                      • SHA256 d997ce9efbf4933305b0b959b20aa1b94462b2523c2037abdba035bf5c534946
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      UnpublishRemove.gif.exe
                      • Path C:\Users\Admin\AppData\Roaming\MeasureInstall\UnpublishRemove.gif.exe
                      • Size 665KB
                      • SHA256 6a0fba851997f341750783718a484d639a6ebb8633de3f15a2fd6c432ff875a8
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      DebugShow.wma.exe
                      • Path C:\Users\Admin\AppData\Roaming\ResetMerge\DebugShow.wma.exe
                      • Size 1.2MB
                      • SHA256 d0eb271a1b96513968d402f2f6bf255d434f4931bf5fbc69bbe3f40714b07760
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      RequestHide.gif.exe
                      • Path C:\Users\Admin\AppData\Roaming\ResetMerge\RequestHide.gif.exe
                      • Size 807KB
                      • SHA256 7503b8a0ee00483c5119291966df809f22938096eb0cbd958dbdce40e55540e1
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      PingConvert.wma.exe
                      • Path C:\Users\Admin\AppData\Roaming\ResetTrace\PingConvert.wma.exe
                      • Size 368KB
                      • SHA256 25552967a97f0b36c91c53ca054355b309ea64f5089003d41f53b459eb1dc004
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      TraceRename.mp3.exe
                      • Path C:\Users\Admin\AppData\Roaming\ResetTrace\TraceRename.mp3.exe
                      • Size 511KB
                      • SHA256 46329920957fb3905ed5367c0cf9cc8e1f29e447cddde5143412976158c5f688
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      ExportHide.mp3.exe
                      • Path C:\Users\Admin\AppData\Roaming\UninstallPing\ExportHide.mp3.exe
                      • Size 527KB
                      • SHA256 1fddb103323329aa0c88644b5d359478ff87ecb8779b358ef0a438cbbc870de2
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      StepStop.wma.exe
                      • Path C:\Users\Admin\AppData\Roaming\UninstallPing\StepStop.wma.exe
                      • Size 551KB
                      • SHA256 05c7ea0f1c5bc5980c868a09ae7b14a9d41d92be37833d391600a09a6fd7cc96
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      BlockLimit.xls.exe
                      • Path C:\Users\Admin\Downloads\BlockLimit.xls.exe
                      • Size 727KB
                      • SHA256 8ef1477b44580c435a9d2451be0c2b10f9bb06f8037e830db92ef0d15faa1537
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      OutSync.bmp.exe
                      • Path C:\Users\Admin\Music\OutSync.bmp.exe
                      • Size 815KB
                      • SHA256 49ea356373641fcbc8d73555bf3c842d930268e5fc2ecd77704dbf9402ca65d6
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      SendRemove.bmp.exe
                      • Path C:\Users\Admin\Pictures\SendRemove.bmp.exe
                      • Size 1.2MB
                      • SHA256 de91e91dfc93652352015178ae039c84239c56a248c48b58d8d2819764f79667
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      SyncClose.jpg.exe
                      • Path C:\Users\Admin\Pictures\SyncClose.jpg.exe
                      • Size 825KB
                      • SHA256 4cf159d0b89b0346db4863b29942e4fee2b72c3758f155bd3c1f8a813ed4f3a8
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      tNOiRVO.jpg.exe
                      • Path C:\Users\Admin\Pictures\tNOiRVO.jpg.exe
                      • Size 214KB
                      • SHA256 8c85a1a8d17959f605d761e3d04b32301fb44d27cb1f8f066fa5bdad5d7b7acd
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      MSEAoMUs.exe
                      • Path C:\Users\Admin\ZwkMsQIg\MSEAoMUs.exe
                      • Size 196KB
                      • SHA256 e2fa29a7c0a541f9319302578e0345d317822950c0188c54112f2e4d7c5da326
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      MSEAoMUs.inf
                      • Path C:\Users\Admin\ZwkMsQIg\MSEAoMUs.inf
                      • Size 4B
                      • SHA256 bdd77bdc974f8a1f0c23f37fa8497736c03e5daf3d2b91364e2b7234442c17e7
                      • MD5 SHA1 SHA512
                      Submit Download

                      MSEAoMUs.inf
                      • Path C:\Users\Admin\ZwkMsQIg\MSEAoMUs.inf
                      • Size 4B
                      • SHA256 099b3f5d7ce8907b08584f3b8b082f4742d223278620169b2c82c3e1171ac292
                      • MD5 SHA1 SHA512
                      Submit Download

                      MSEAoMUs.inf
                      • Path C:\Users\Admin\ZwkMsQIg\MSEAoMUs.inf
                      • Size 4B
                      • SHA256 7169113b35fa81c22e05bd75da7024c6bc5d2379a41fb272880cbf7354c29acd
                      • MD5 SHA1 SHA512
                      Submit Download

                      memory/8-118-0x0000000000400000-0x00000000004C2000-memory.dmp
                      Download

                      memory/8-133-0x0000000000400000-0x00000000004C2000-memory.dmp
                      Download

                      memory/1180-14-0x0000000000400000-0x0000000000430000-memory.dmp
                      Download

                      memory/1180-2081-0x0000000000400000-0x0000000000430000-memory.dmp
                      Download

                      memory/1528-213-0x0000000000400000-0x00000000004C2000-memory.dmp
                      Download

                      memory/1528-221-0x0000000000400000-0x00000000004C2000-memory.dmp
                      Download

                      memory/1768-77-0x0000000000400000-0x00000000004C2000-memory.dmp
                      Download

                      memory/1768-93-0x0000000000400000-0x00000000004C2000-memory.dmp
                      Download

                      memory/1888-173-0x0000000000400000-0x00000000004C2000-memory.dmp
                      Download

                      memory/1888-158-0x0000000000400000-0x00000000004C2000-memory.dmp
                      Download

                      memory/2768-36-0x0000000000400000-0x0000000000432000-memory.dmp
                      Download

                      memory/2768-2091-0x0000000000400000-0x0000000000432000-memory.dmp
                      Download

                      memory/2840-94-0x0000000000400000-0x00000000004C2000-memory.dmp
                      Download

                      memory/2840-103-0x0000000000400000-0x00000000004C2000-memory.dmp
                      Download

                      memory/3068-48-0x0000000000400000-0x00000000004C2000-memory.dmp
                      Download

                      memory/3068-33-0x0000000000400000-0x00000000004C2000-memory.dmp
                      Download

                      memory/3704-222-0x0000000000400000-0x00000000004C2000-memory.dmp
                      Download

                      memory/3704-230-0x0000000000400000-0x00000000004C2000-memory.dmp
                      Download

                      memory/3812-65-0x0000000000400000-0x00000000004C2000-memory.dmp
                      Download

                      memory/3812-74-0x0000000000400000-0x00000000004C2000-memory.dmp
                      Download

                      memory/3892-43-0x0000000000400000-0x00000000004C2000-memory.dmp
                      Download

                      memory/3892-62-0x0000000000400000-0x00000000004C2000-memory.dmp
                      Download

                      memory/4276-185-0x0000000000400000-0x00000000004C2000-memory.dmp
                      Download

                      memory/4276-198-0x0000000000400000-0x00000000004C2000-memory.dmp
                      Download

                      memory/4340-117-0x0000000000400000-0x00000000004C2000-memory.dmp
                      Download

                      memory/4340-105-0x0000000000400000-0x00000000004C2000-memory.dmp
                      Download

                      memory/4344-2076-0x0000000000400000-0x0000000000432000-memory.dmp
                      Download

                      memory/4344-5-0x0000000000400000-0x0000000000432000-memory.dmp
                      Download

                      memory/4392-134-0x0000000000400000-0x00000000004C2000-memory.dmp
                      Download

                      memory/4392-144-0x0000000000400000-0x00000000004C2000-memory.dmp
                      Download

                      memory/4476-18-0x0000000000400000-0x00000000004C2000-memory.dmp
                      Download

                      memory/4476-0-0x0000000000400000-0x00000000004C2000-memory.dmp
                      Download

                      memory/4540-42-0x0000000000400000-0x0000000000430000-memory.dmp
                      Download

                      memory/4540-2096-0x0000000000400000-0x0000000000430000-memory.dmp
                      Download

                      memory/4596-30-0x0000000000400000-0x00000000004C2000-memory.dmp
                      Download

                      memory/4884-157-0x0000000000400000-0x00000000004C2000-memory.dmp
                      Download

                      memory/4884-147-0x0000000000400000-0x00000000004C2000-memory.dmp
                      Download

                      memory/4912-184-0x0000000000400000-0x00000000004C2000-memory.dmp
                      Download

                      memory/4912-174-0x0000000000400000-0x00000000004C2000-memory.dmp
                      Download

                      memory/4948-202-0x0000000000400000-0x00000000004C2000-memory.dmp
                      Download

                      memory/4948-214-0x0000000000400000-0x00000000004C2000-memory.dmp
                      Download