Analysis

  • max time kernel
    151s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/06/2024, 07:17

General

  • Target
    2024-06-01_2f38b7b8792c76ae25adfc951654b11c_virlock.exe
  • Size 650KB
  • Sample240601-h4mfpsee23
  • SHA256 c594e8cba854f2c38308ec56e0cee68c56f797147ce8757fd56ecd7dd5a9dea8
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
  • UAC bypass 3 TTPs 1 IoCs
  • Renames multiple (72) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry key 1 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-01_2f38b7b8792c76ae25adfc951654b11c_virlock.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-01_2f38b7b8792c76ae25adfc951654b11c_virlock.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3140
    • C:\Users\Admin\cQUoYEgg\OIkQMcks.exe
      "C:\Users\Admin\cQUoYEgg\OIkQMcks.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of FindShellTrayWindow
      PID:1824
    • C:\ProgramData\hgsEUUEo\UGcIcoMk.exe
      "C:\ProgramData\hgsEUUEo\UGcIcoMk.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      PID:4536
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\Setup.exe
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:712
      • C:\Users\Admin\AppData\Local\Temp\Setup.exe
        C:\Users\Admin\AppData\Local\Temp\Setup.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1428
    • C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies registry key
      PID:1424
    • C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
      2⤵
      • Modifies registry key
      PID:3600
    • C:\Windows\SysWOW64\reg.exe
      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
      2⤵
      • UAC bypass
      • Modifies registry key
      PID:3740
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3852 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:2036

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          setup.exe

          • Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
          • Size 643KB
          • SHA256 6eec45b0cda842a1a32c5897772edea355b662f5a67693717476d29084f58099
          • MD5 SHA1 SHA512 SSDEEP

          device.png.exe

          • Path C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png.exe
          • Size 242KB
          • SHA256 2bd913ed0fcb304aa0ec41c7e8572941fa5362b4e90239723378a6e17280046d
          • MD5 SHA1 SHA512 SSDEEP

          overlay.png.exe

          • Path C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png.exe
          • Size 218KB
          • SHA256 ea2842f0cb8a4444cc6a9e6d214d69567fd13db21d2f9621bb7149b49b973d65
          • MD5 SHA1 SHA512 SSDEEP

          overlay.png.exe

          • Path C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png.exe
          • Size 218KB
          • SHA256 0f866450f7d2038e6ec88d71d48922f1d459a41bc772108dba05bf3aac329155
          • MD5 SHA1 SHA512 SSDEEP

          superbar.png.exe

          • Path C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png.exe
          • Size 237KB
          • SHA256 9f106a558a2fa4012198ad90fc2059f53d7d27956fb15c8cc48b49597d19e9df
          • MD5 SHA1 SHA512 SSDEEP

          user.bmp.exe

          • Path C:\ProgramData\Microsoft\User Account Pictures\user.bmp.exe
          • Size 779KB
          • SHA256 901476ff09e41a515ca34c65c5e0e1d4412ebd9b1336d26df5d62f365e25f89d
          • MD5 SHA1 SHA512 SSDEEP

          VC_redist.x86.exe

          • Path C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
          • Size 833KB
          • SHA256 163d588fe92010785550504c643fffefb3a09702006b59262471d11ef6308163
          • MD5 SHA1 SHA512 SSDEEP

          vcredist_x86.exe

          • Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
          • Size 649KB
          • SHA256 99a74f47147e934af985bd73fb660c1d548b4e7ff191b5dc0bd13cd3080f6404
          • MD5 SHA1 SHA512 SSDEEP

          UGcIcoMk.exe

          • Path C:\ProgramData\hgsEUUEo\UGcIcoMk.exe
          • Size 201KB
          • SHA256 0a94c642d411d9d78a2bd62d44a41a591f9a54f73a59e7e30b2bca9782a5e8eb
          • MD5 SHA1 SHA512 SSDEEP

          UGcIcoMk.inf

          • Path C:\ProgramData\hgsEUUEo\UGcIcoMk.inf
          • Size 4B
          • SHA256 94b640ebc0d1f35657a4726e5231dc4d84467b9af6209074c1363f26bfc0b909
          • MD5 SHA1 SHA512

          UGcIcoMk.inf

          • Path C:\ProgramData\hgsEUUEo\UGcIcoMk.inf
          • Size 4B
          • SHA256 45be70e0033c1e0f528574cf6547fe5d9be713d9a5e4bd2072480cda4e8a8648
          • MD5 SHA1 SHA512

          UGcIcoMk.inf

          • Path C:\ProgramData\hgsEUUEo\UGcIcoMk.inf
          • Size 4B
          • SHA256 49e8a256a8d36047c15e227a2f50161f46f94eb188a916849c47c624e8dcfd6d
          • MD5 SHA1 SHA512

          UGcIcoMk.inf

          • Path C:\ProgramData\hgsEUUEo\UGcIcoMk.inf
          • Size 4B
          • SHA256 5f4158ebcf325ec80c6e71c2ed2a146dbfcd9c157a756c9d5595f686f88e2faa
          • MD5 SHA1 SHA512

          UGcIcoMk.inf

          • Path C:\ProgramData\hgsEUUEo\UGcIcoMk.inf
          • Size 4B
          • SHA256 d17e4cdc79c45b0939e5bd1eff9c004e3dfc4bdf40edb9806600c9cf811861ef
          • MD5 SHA1 SHA512

          UGcIcoMk.inf

          • Path C:\ProgramData\hgsEUUEo\UGcIcoMk.inf
          • Size 4B
          • SHA256 f07df31d6073803398b83332341c01a6c65009a81852feca49cd94d8e9a1d86f
          • MD5 SHA1 SHA512

          UGcIcoMk.inf

          • Path C:\ProgramData\hgsEUUEo\UGcIcoMk.inf
          • Size 4B
          • SHA256 6bdf01b5e12d3c49a179b78fe446d4a28c98d061310decaaadc3bcba635bae1d
          • MD5 SHA1 SHA512

          UGcIcoMk.inf

          • Path C:\ProgramData\hgsEUUEo\UGcIcoMk.inf
          • Size 4B
          • SHA256 89ddaca2af12705d74fcf1e9f552359d9c269389f99f212f5b3c0aebef536a6c
          • MD5 SHA1 SHA512

          UGcIcoMk.inf

          • Path C:\ProgramData\hgsEUUEo\UGcIcoMk.inf
          • Size 4B
          • SHA256 895114381c766a9e87a8a36f07b0b87def977416176ed712763ad2f025aa43b0
          • MD5 SHA1 SHA512

          UGcIcoMk.inf

          • Path C:\ProgramData\hgsEUUEo\UGcIcoMk.inf
          • Size 4B
          • SHA256 46d01358295d0af3ff60fd51b85c2bbcd139cc33fcb00056f1acb7c72fe6cd3f
          • MD5 SHA1 SHA512

          128.png.exe

          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\128.png.exe
          • Size 190KB
          • SHA256 be93976883a8ed2bfb2d0b98eada4409e1d3bdd28016a077018f45acfd0ed1b3
          • MD5 SHA1 SHA512 SSDEEP

          192.png.exe

          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\192.png.exe
          • Size 189KB
          • SHA256 bddf554386a83fa1bbe6f4e645d5b2b9bc6d9186cb59de8c2b37a7de6ee5ed92
          • MD5 SHA1 SHA512 SSDEEP

          256.png.exe

          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\256.png.exe
          • Size 214KB
          • SHA256 a879b8d1af295f19692d87351da159dead1d3100b1bc057b82223c60f3887ed9
          • MD5 SHA1 SHA512 SSDEEP

          48.png.exe

          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\48.png.exe
          • Size 188KB
          • SHA256 8e0ff8f7ae14eb311b43697c2702a902ba1c9833d02b186db07f0d0d5fb21f04
          • MD5 SHA1 SHA512 SSDEEP

          64.png.exe

          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\64.png.exe
          • Size 193KB
          • SHA256 08bb9a8cd28cf3e6ca8cc71d708766cf64362f3a86612a80d449e63240d85980
          • MD5 SHA1 SHA512 SSDEEP

          96.png.exe

          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\96.png.exe
          • Size 200KB
          • SHA256 d1591ff38e8e151c77004cb9d29744bb4de264bf16ad2f867efe277bc6d98cce
          • MD5 SHA1 SHA512 SSDEEP

          64.png.exe

          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\64.png.exe
          • Size 195KB
          • SHA256 1b03027427601b5ec89a38c9244f12b127c2d4373053c7e979d3945b561fc584
          • MD5 SHA1 SHA512 SSDEEP

          96.png.exe

          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\96.png.exe
          • Size 207KB
          • SHA256 0155b881da01b49d2caab47bd5c2efdf78c6252511edb9add9322f2b3d325c6b
          • MD5 SHA1 SHA512 SSDEEP

          128.png.exe

          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\128.png.exe
          • Size 183KB
          • SHA256 d3556c86c46471a16fa51a5779759dcb3af488f2829dbf690285456aede9e536
          • MD5 SHA1 SHA512 SSDEEP

          96.png.exe

          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\96.png.exe
          • Size 186KB
          • SHA256 d7218e9ceb8bfbece3f86e344566829818d0c4416deaef8b10b30a343fa3368c
          • MD5 SHA1 SHA512 SSDEEP

          128.png.exe

          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\128.png.exe
          • Size 208KB
          • SHA256 13a84e4a1b18012d580442a5aad09bc10b41d3a53865115fa1622689bc3d7558
          • MD5 SHA1 SHA512 SSDEEP

          256.png.exe

          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\256.png.exe
          • Size 194KB
          • SHA256 919732c9d665e7df599d269366bf821fed12f1c29ae58604b46f00628eaa6e42
          • MD5 SHA1 SHA512 SSDEEP

          48.png.exe

          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\48.png.exe
          • Size 180KB
          • SHA256 ebf56ac4dd98f14e3e57ec121ec1268f24a97bbdb658afd35d01987ee13768f8
          • MD5 SHA1 SHA512 SSDEEP

          64.png.exe

          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\64.png.exe
          • Size 191KB
          • SHA256 494a36bd724e04f8a30fab312b128f1bdc1ca05a565b82236dbdb1772cf4a5a2
          • MD5 SHA1 SHA512 SSDEEP

          96.png.exe

          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\96.png.exe
          • Size 201KB
          • SHA256 ff4ee66049f59757b74d0e575c5507f1f2a6f78101af9d6667d893baa644ec72
          • MD5 SHA1 SHA512 SSDEEP

          128.png.exe

          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\128.png.exe
          • Size 190KB
          • SHA256 9a2512145d24509e4303a2338eebad57f6e3fed05f1bfbf0248a6bd6c0a6ef7e
          • MD5 SHA1 SHA512 SSDEEP

          256.png.exe

          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\256.png.exe
          • Size 202KB
          • SHA256 09b267e17667989a65007e3c9d40bf3df886a02b243bdd66e89113f6d8370fb2
          • MD5 SHA1 SHA512 SSDEEP

          256.png.exe

          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\256.png.exe
          • Size 189KB
          • SHA256 f13164eea6a1c728a345750fb2a5ee1cda728c3be3a5d9f0ae689247115c0dc1
          • MD5 SHA1 SHA512 SSDEEP

          AppBlue.png.exe

          • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppBlue.png.exe
          • Size 185KB
          • SHA256 da16e5ae06f5a9c18c6b0915792e6fe6b1b49d2d8a4b264d95160cfc42068387
          • MD5 SHA1 SHA512 SSDEEP

          AppErrorBlue.png.exe

          • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppErrorBlue.png.exe
          • Size 200KB
          • SHA256 cea20dd892309053314e7b630a217ca673903d928fb6457cafad8cc94c071856
          • MD5 SHA1 SHA512 SSDEEP

          AppErrorWhite.png.exe

          • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppErrorWhite.png.exe
          • Size 190KB
          • SHA256 3827aa8af8c9df4a1729819ca5e31c72d4286c81554d56e78b49681d36123e95
          • MD5 SHA1 SHA512 SSDEEP

          AutoPlayOptIn.png.exe

          • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AutoPlayOptIn.png.exe
          • Size 201KB
          • SHA256 a12e6b36de920d4e83fd45e37281adb74b5c30d1985a82490482705b0aaa7cc1
          • MD5 SHA1 SHA512 SSDEEP

          ElevatedAppBlue.png.exe

          • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ElevatedAppBlue.png.exe
          • Size 189KB
          • SHA256 a08d71121cee89184f5d8b5185b390603f6fd005c1cc2b1530966a2447dab946
          • MD5 SHA1 SHA512 SSDEEP

          KFMHeroToast.png.exe

          • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMHeroToast.png.exe
          • Size 196KB
          • SHA256 89606d73a3b093607b9f835979990cb577a3d40b21d7eb2b8567f9855e06add8
          • MD5 SHA1 SHA512 SSDEEP

          KFMLockedFileToast.png.exe

          • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMLockedFileToast.png.exe
          • Size 192KB
          • SHA256 c9d72862783c5ebae7282aa13cf25f7677515dc5458ef5da2ebb250796873b9a
          • MD5 SHA1 SHA512 SSDEEP

          OneDriveLogo.png.exe

          • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveLogo.png.exe
          • Size 188KB
          • SHA256 49985089e2cc876eafd9c8ec02251730dc74c4c84e18d25e652a66eceb75a489
          • MD5 SHA1 SHA512 SSDEEP

          QuotaCritical.png.exe

          • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\QuotaCritical.png.exe
          • Size 201KB
          • SHA256 dd383fea06495e7c637614ba1bb0816907eed9d18b0fdafaac5ba4ff96fb61c1
          • MD5 SHA1 SHA512 SSDEEP

          QuotaError.png.exe

          • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\QuotaError.png.exe
          • Size 196KB
          • SHA256 0d503b25e7992ab641f18dfd11f4a0de34b971716e097d0c613dc6d6abe2e4a5
          • MD5 SHA1 SHA512 SSDEEP

          QuotaNearing.png.exe

          • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\QuotaNearing.png.exe
          • Size 191KB
          • SHA256 c517b1f4db960172c5effbf11e179bb569c00c072f6f7fc600ee9cc73c916ad1
          • MD5 SHA1 SHA512 SSDEEP

          ScreenshotOptIn.gif.exe

          • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ScreenshotOptIn.gif.exe
          • Size 439KB
          • SHA256 1820e5d35c766b88ecdad374c52f52a9b4216ea04bca468cc90b62592358861a
          • MD5 SHA1 SHA512 SSDEEP

          Warning.png.exe

          • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Warning.png.exe
          • Size 181KB
          • SHA256 f00e69fb320a442882e0455b3c3c364c5b9988bc91cd3763b1244c995dace6c8
          • MD5 SHA1 SHA512 SSDEEP

          OneDriveMedTile.contrast-black_scale-400.png.exe

          • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-400.png.exe
          • Size 205KB
          • SHA256 52baa538e2eb0060fc9a3c6771cd92737f987d0be9f8ea249a5b5a52bc93d414
          • MD5 SHA1 SHA512 SSDEEP

          OneDriveMedTile.scale-400.png.exe

          • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-400.png.exe
          • Size 184KB
          • SHA256 f88473470cf7effb3b58e224279dfeb768f8dc21d744d044cb12f6d5e06d54b8
          • MD5 SHA1 SHA512 SSDEEP

          OneDriveSmallTile.scale-400.png.exe

          • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-400.png.exe
          • Size 202KB
          • SHA256 9dd77462ddb74210a41953c77546fc95d609e26375c2e67856b808ed40b8c646
          • MD5 SHA1 SHA512 SSDEEP

          squaretile.png.exe

          • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\26310719480\squaretile.png.exe
          • Size 198KB
          • SHA256 28617d52e8ced98cd510a850c9c10ae745159fad922f234fb2f52d76f1f100a0
          • MD5 SHA1 SHA512 SSDEEP

          squaretile.png.exe

          • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\38975140460\squaretile.png.exe
          • Size 202KB
          • SHA256 67716e271cdc3a8ce75d0a775c96a99e189a3846fdfec961e5a8eb960f82ada6
          • MD5 SHA1 SHA512 SSDEEP

          tinytile.png.exe

          • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\38975140460\tinytile.png.exe
          • Size 187KB
          • SHA256 0de96958804115b77148581db3196bbf11155a4e7116dff86a6419b14cfcd15b
          • MD5 SHA1 SHA512 SSDEEP

          squaretile.png.exe

          • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\6501008900\squaretile.png.exe
          • Size 196KB
          • SHA256 df80babcdc81e79605920948da0765da2be39ff552fd5efe22d2e06f59b2feef
          • MD5 SHA1 SHA512 SSDEEP

          BEcM.exe

          • Path C:\Users\Admin\AppData\Local\Temp\BEcM.exe
          • Size 199KB
          • SHA256 91161f0f9c56dbffa8150d0aeafff44aff39a20801d1ef8da0c24dc8e77b5e3a
          • MD5 SHA1 SHA512 SSDEEP

          DcEy.exe

          • Path C:\Users\Admin\AppData\Local\Temp\DcEy.exe
          • Size 188KB
          • SHA256 97d64b03cdf6549ddb3a34aebd54ff714b4ecee3e4a9e5982e80366b870a0336
          • MD5 SHA1 SHA512 SSDEEP

          DocA.exe

          • Path C:\Users\Admin\AppData\Local\Temp\DocA.exe
          • Size 195KB
          • SHA256 197d2dcdc6526fb0f3acbc39a2c213dae06f5e13d55853bfd177017e0ac94016
          • MD5 SHA1 SHA512 SSDEEP

          Focq.exe

          • Path C:\Users\Admin\AppData\Local\Temp\Focq.exe
          • Size 562KB
          • SHA256 dc2d9b83b1c31b979a93bde472b26d061ffd394da91d4edd862bad3100b1b6ca
          • MD5 SHA1 SHA512 SSDEEP

          IcwG.exe

          • Path C:\Users\Admin\AppData\Local\Temp\IcwG.exe
          • Size 205KB
          • SHA256 0fc061cb36cea0477ce88a1384c0ba127fd2bb63ee07e3034b53f9b383c8f264
          • MD5 SHA1 SHA512 SSDEEP

          IwUM.exe

          • Path C:\Users\Admin\AppData\Local\Temp\IwUM.exe
          • Size 218KB
          • SHA256 15f84ba34a7aae34f57273e2464c2a1aedae46d290f14e0075474b94df938cb2
          • MD5 SHA1 SHA512 SSDEEP

          Kwcu.exe

          • Path C:\Users\Admin\AppData\Local\Temp\Kwcu.exe
          • Size 336KB
          • SHA256 c63a4b8702b050322f270ce671e7293590753cf5cfd40bd18cf94a54ceae4278
          • MD5 SHA1 SHA512 SSDEEP

          LQEE.exe

          • Path C:\Users\Admin\AppData\Local\Temp\LQEE.exe
          • Size 196KB
          • SHA256 38e2e8be02157dcd70513dbd92f4e4012ca71d07932adf44be52037b5501c4b2
          • MD5 SHA1 SHA512 SSDEEP

          LgkC.exe

          • Path C:\Users\Admin\AppData\Local\Temp\LgkC.exe
          • Size 803KB
          • SHA256 23c34a01de4ce507252fa94c3a57aa5e5e39250c954da43b7f6d45270f7dd868
          • MD5 SHA1 SHA512 SSDEEP

          MkYA.exe

          • Path C:\Users\Admin\AppData\Local\Temp\MkYA.exe
          • Size 798KB
          • SHA256 6ec451a1628a12cb6099749a0853ce2190933ed9fb2cfcf1597c11e07de641a7
          • MD5 SHA1 SHA512 SSDEEP

          OcUo.exe

          • Path C:\Users\Admin\AppData\Local\Temp\OcUo.exe
          • Size 204KB
          • SHA256 2031f5db34befa3456aed3f82202d69d297fc1436d144e2f53bf385cfeac89f2
          • MD5 SHA1 SHA512 SSDEEP

          OkIO.exe

          • Path C:\Users\Admin\AppData\Local\Temp\OkIO.exe
          • Size 320KB
          • SHA256 5787eb1093b5015fe33fbc188f022b376be5e7958c31ea3cdabfe044d7746be0
          • MD5 SHA1 SHA512 SSDEEP

          PIUS.exe

          • Path C:\Users\Admin\AppData\Local\Temp\PIUS.exe
          • Size 216KB
          • SHA256 1a5131a81de771cfbe39d9c511558252dbe1cb619ddfed81eadee7e608bd37b8
          • MD5 SHA1 SHA512 SSDEEP

          QMgA.exe

          • Path C:\Users\Admin\AppData\Local\Temp\QMgA.exe
          • Size 1.7MB
          • SHA256 549f8f43b3ec8ab3af86c9ca457e6486113c2d952c915c65820f9e8cb64a9370
          • MD5 SHA1 SHA512 SSDEEP

          QgUo.exe

          • Path C:\Users\Admin\AppData\Local\Temp\QgUo.exe
          • Size 789KB
          • SHA256 952f2a90d5a9c004c82e1036f4c7d529ba17d9221efd99454e74d53f776db658
          • MD5 SHA1 SHA512 SSDEEP

          QoMS.ico

          • Path C:\Users\Admin\AppData\Local\Temp\QoMS.ico
          • Size 4KB
          • SHA256 701a17a9ee5c9340bae4f0810f103d1f0ca5c03141e0da826139d5b7397a6fb3
          • MD5 SHA1 SHA512 SSDEEP

          QwAw.exe

          • Path C:\Users\Admin\AppData\Local\Temp\QwAw.exe
          • Size 227KB
          • SHA256 fd06b20fa2674cc327675eabecff87d92a306912b9967ff8968c3f100120019b
          • MD5 SHA1 SHA512 SSDEEP

          Setup.exe

          • Path C:\Users\Admin\AppData\Local\Temp\Setup.exe
          • Size 453KB
          • SHA256 d2893c55259772b554cb887d3e2e1f9c67f5cd5abac2ab9f4720dec507cdd290
          • MD5 SHA1 SHA512 SSDEEP

          ToEo.exe

          • Path C:\Users\Admin\AppData\Local\Temp\ToEo.exe
          • Size 328KB
          • SHA256 1cef0a156fc38a87b40bfe17f442a22112f0dfd1c8644a63884fc8ab1a8422b7
          • MD5 SHA1 SHA512 SSDEEP

          UAwc.exe

          • Path C:\Users\Admin\AppData\Local\Temp\UAwc.exe
          • Size 626KB
          • SHA256 98836955270eb2d95e9c59e16581aa11e3783d3bf1f1e1c7275ef112d49d43b1
          • MD5 SHA1 SHA512 SSDEEP

          UoQM.exe

          • Path C:\Users\Admin\AppData\Local\Temp\UoQM.exe
          • Size 198KB
          • SHA256 c72d3b5da6c6c754caea3638e73e1fc18a1236164e5ec799157e18f6be778596
          • MD5 SHA1 SHA512 SSDEEP

          VAcW.exe

          • Path C:\Users\Admin\AppData\Local\Temp\VAcW.exe
          • Size 199KB
          • SHA256 f269a532b613fed41c471dbf5ac7ea395438debe5382276d41c33f169243efbe
          • MD5 SHA1 SHA512 SSDEEP

          VoMs.exe

          • Path C:\Users\Admin\AppData\Local\Temp\VoMs.exe
          • Size 213KB
          • SHA256 37a606ecb27f358bf5be47ab8a0b9d295842132e1ac44907f24833ee6c55e1e8
          • MD5 SHA1 SHA512 SSDEEP

          WIUg.exe

          • Path C:\Users\Admin\AppData\Local\Temp\WIUg.exe
          • Size 544KB
          • SHA256 644575cd0973cccb8916fbb38c3dfd15e75d676cf7e0ab1e7520e8d26f0037f5
          • MD5 SHA1 SHA512 SSDEEP

          Wwcy.exe

          • Path C:\Users\Admin\AppData\Local\Temp\Wwcy.exe
          • Size 835KB
          • SHA256 d15d8e2762d500406e9f94e884b9ecaab4010c9b0bf87c14ea6aacc5d690258b
          • MD5 SHA1 SHA512 SSDEEP

          YYwI.exe

          • Path C:\Users\Admin\AppData\Local\Temp\YYwI.exe
          • Size 197KB
          • SHA256 14991847f852cb150575ff1250033b573bd7945dc8a8cdac8dee2476900f52cc
          • MD5 SHA1 SHA512 SSDEEP

          ZsYQ.ico

          • Path C:\Users\Admin\AppData\Local\Temp\ZsYQ.ico
          • Size 4KB
          • SHA256 0b945cd858463198a2319799f721202efb88f1b7273bc3726206f0bb272802f7
          • MD5 SHA1 SHA512 SSDEEP

          akUG.exe

          • Path C:\Users\Admin\AppData\Local\Temp\akUG.exe
          • Size 1.2MB
          • SHA256 9863fc611323fc674fb5780c9367171c433963a92e2134e9080d1d18d734669d
          • MD5 SHA1 SHA512 SSDEEP

          asoY.exe

          • Path C:\Users\Admin\AppData\Local\Temp\asoY.exe
          • Size 215KB
          • SHA256 0127b818ab14214dc66b2801b24a4a6ce901d244ff6172a9b0e30ca233f2ce00
          • MD5 SHA1 SHA512 SSDEEP

          bAAo.ico

          • Path C:\Users\Admin\AppData\Local\Temp\bAAo.ico
          • Size 4KB
          • SHA256 684e75b6fdb9a7203e03c630a66a3710ace32aa78581311ba38e3f26737feae6
          • MD5 SHA1 SHA512 SSDEEP

          dUoQ.exe

          • Path C:\Users\Admin\AppData\Local\Temp\dUoQ.exe
          • Size 192KB
          • SHA256 f8e26b938a188ff06288828a480593b8fddac7dc1393f78150f14c02b25eebaf
          • MD5 SHA1 SHA512 SSDEEP

          doIc.exe

          • Path C:\Users\Admin\AppData\Local\Temp\doIc.exe
          • Size 561KB
          • SHA256 22422bf0801795bb82a8a03d52b7d1f6debafc5e8600d66e4874c93288822db2
          • MD5 SHA1 SHA512 SSDEEP

          eMIg.exe

          • Path C:\Users\Admin\AppData\Local\Temp\eMIg.exe
          • Size 198KB
          • SHA256 2c8926ea5d2c5f2cf55ea4d5367598398c9358eac64e90669fcf1eb619c11488
          • MD5 SHA1 SHA512 SSDEEP

          gkEc.exe

          • Path C:\Users\Admin\AppData\Local\Temp\gkEc.exe
          • Size 183KB
          • SHA256 bec95d7b2ad81f057d3ee83b1f3c2c0f92fa9b2a29ac767fc7d1818150705ab2
          • MD5 SHA1 SHA512 SSDEEP

          hIAu.exe

          • Path C:\Users\Admin\AppData\Local\Temp\hIAu.exe
          • Size 186KB
          • SHA256 edd123bae51c75cdd4ffe941a60924e72ba1a0e1932d194ae8b530915097eb15
          • MD5 SHA1 SHA512 SSDEEP

          icIi.exe

          • Path C:\Users\Admin\AppData\Local\Temp\icIi.exe
          • Size 225KB
          • SHA256 2b92fa0610f58f6ff2eb4b3757b25a94562aa89ae2e41554dd4c45b626b2bb34
          • MD5 SHA1 SHA512 SSDEEP

          kIYk.exe

          • Path C:\Users\Admin\AppData\Local\Temp\kIYk.exe
          • Size 484KB
          • SHA256 5613f14508b233259d3e13c1911bf98f82219975af801ab093c0034da2b4f1d2
          • MD5 SHA1 SHA512 SSDEEP

          lMoW.exe

          • Path C:\Users\Admin\AppData\Local\Temp\lMoW.exe
          • Size 185KB
          • SHA256 5995ec2294cdd16b7a1b65c8b58baa195e061651c251c4a2b98b972cde5e592c
          • MD5 SHA1 SHA512 SSDEEP

          lUQw.exe

          • Path C:\Users\Admin\AppData\Local\Temp\lUQw.exe
          • Size 638KB
          • SHA256 b430b89eea116b2dda5ac4d513db3a2b3b743f8002f37d0c15e2f693bb049575
          • MD5 SHA1 SHA512 SSDEEP

          nwgo.exe

          • Path C:\Users\Admin\AppData\Local\Temp\nwgo.exe
          • Size 200KB
          • SHA256 1c5bd200a3b273fb54fa7cbec736a1a4134d7463061d00658d6584431396a5b9
          • MD5 SHA1 SHA512 SSDEEP

          ocIm.exe

          • Path C:\Users\Admin\AppData\Local\Temp\ocIm.exe
          • Size 200KB
          • SHA256 55e69442c8b9de15944560528e4092ab19c458de3c942cc5a638b443d365ee57
          • MD5 SHA1 SHA512 SSDEEP

          ocsm.exe

          • Path C:\Users\Admin\AppData\Local\Temp\ocsm.exe
          • Size 312KB
          • SHA256 933c54ea742d73a338e055da6c73436323fc749514006ca57be39d4446b1f1ac
          • MD5 SHA1 SHA512 SSDEEP

          pIsO.exe

          • Path C:\Users\Admin\AppData\Local\Temp\pIsO.exe
          • Size 184KB
          • SHA256 422ffc7a4bec38aa4dca349c9592d08740bbaecf18c7bee07b3302564b08e93f
          • MD5 SHA1 SHA512 SSDEEP

          pogk.exe

          • Path C:\Users\Admin\AppData\Local\Temp\pogk.exe
          • Size 634KB
          • SHA256 352c901d90ce866fe828efa1b02197d732f2aa22db2956edd5de1c2b50340c42
          • MD5 SHA1 SHA512 SSDEEP

          qYkS.exe

          • Path C:\Users\Admin\AppData\Local\Temp\qYkS.exe
          • Size 1.0MB
          • SHA256 5371fe7a533b03ba843b8ecf0c187953a6c7594d9eede721ea1ed08684c42367
          • MD5 SHA1 SHA512 SSDEEP

          sYgK.exe

          • Path C:\Users\Admin\AppData\Local\Temp\sYgK.exe
          • Size 215KB
          • SHA256 8c97bfc166f04124d4bfd99a873e17efcdab2673f2668c7ad84ab77538d3fa88
          • MD5 SHA1 SHA512 SSDEEP

          wgQW.exe

          • Path C:\Users\Admin\AppData\Local\Temp\wgQW.exe
          • Size 189KB
          • SHA256 43fc107d790822a3c2d3b56948fa0c87f6482bd4e365fc02fee9682a417af674
          • MD5 SHA1 SHA512 SSDEEP

          ykQg.ico

          • Path C:\Users\Admin\AppData\Local\Temp\ykQg.ico
          • Size 4KB
          • SHA256 57e72b9591e318a17feb74efa1262e9222814ad872437094734295700f669563
          • MD5 SHA1 SHA512 SSDEEP

          UndoLimit.gif.exe

          • Path C:\Users\Admin\AppData\Roaming\UndoLimit.gif.exe
          • Size 1.7MB
          • SHA256 a1a3e059575c5bd479cbb51df2e5b4829e4c228165622b994278edf5177378ce
          • MD5 SHA1 SHA512 SSDEEP

          MountTest.bmp.exe

          • Path C:\Users\Admin\Downloads\MountTest.bmp.exe
          • Size 721KB
          • SHA256 8f421a6d749f53ede6a4df003295d413d25f41517242ef4c50d6b7c6b4b162fb
          • MD5 SHA1 SHA512 SSDEEP

          MoveRegister.exe

          • Path C:\Users\Admin\Music\MoveRegister.exe
          • Size 514KB
          • SHA256 a31959ad5035bb6e0d351030be9d7bc4da352cb6c6ecc0254e9af3ad15c0a739
          • MD5 SHA1 SHA512 SSDEEP

          ConfirmConvertFrom.jpg.exe

          • Path C:\Users\Admin\Pictures\ConfirmConvertFrom.jpg.exe
          • Size 803KB
          • SHA256 9701a9bb926fbd3876308ead2b94a3bf9bf06710161a143deb9f084528cf423b
          • MD5 SHA1 SHA512 SSDEEP

          CopyPop.gif.exe

          • Path C:\Users\Admin\Pictures\CopyPop.gif.exe
          • Size 1.2MB
          • SHA256 bb46c8cbef4319e9993c6b0f169cbc287afacd82c50718460f98f1f547091017
          • MD5 SHA1 SHA512 SSDEEP

          My Wallpaper.jpg.exe

          • Path C:\Users\Admin\Pictures\My Wallpaper.jpg.exe
          • Size 213KB
          • SHA256 856f5bcb37d39b1053404b4512f0a4ada5f0beced7d786a68ecb59406c5a6aef
          • MD5 SHA1 SHA512 SSDEEP

          OIkQMcks.exe

          • Path C:\Users\Admin\cQUoYEgg\OIkQMcks.exe
          • Size 195KB
          • SHA256 0383b84bb5d43b5160e907a20f4e541248beabadecac5ff761f53f57a55087bc
          • MD5 SHA1 SHA512 SSDEEP

          OIkQMcks.inf

          • Path C:\Users\Admin\cQUoYEgg\OIkQMcks.inf
          • Size 4B
          • SHA256 6a50ad9e7689234a33d63ee87085b201fd235addd7057cbe97c166e40b34a75d
          • MD5 SHA1 SHA512

          OIkQMcks.inf

          • Path C:\Users\Admin\cQUoYEgg\OIkQMcks.inf
          • Size 4B
          • SHA256 f600b216f94e6b208e63b0e0f3df685579dd4b7e7c538a10bb51966b82e9a347
          • MD5 SHA1 SHA512

          OIkQMcks.inf

          • Path C:\Users\Admin\cQUoYEgg\OIkQMcks.inf
          • Size 4B
          • SHA256 ca82698d8576b58bbb04a35c923a615df3283d55dc55843385a98b54c429c72e
          • MD5 SHA1 SHA512

          OIkQMcks.inf

          • Path C:\Users\Admin\cQUoYEgg\OIkQMcks.inf
          • Size 4B
          • SHA256 bb3aea7f8ba630964e5bf9c29ff0a7fcf8c47d21700b3dab5519f41a99eb053e
          • MD5 SHA1 SHA512

          OIkQMcks.inf

          • Path C:\Users\Admin\cQUoYEgg\OIkQMcks.inf
          • Size 4B
          • SHA256 6a5144b3ff89928ab07fdd59487d6186d1154405f6518d5cd7ffcb2dbaf3d9d1
          • MD5 SHA1 SHA512

          OIkQMcks.inf

          • Path C:\Users\Admin\cQUoYEgg\OIkQMcks.inf
          • Size 4B
          • SHA256 79d5b7b7b087ee1f4e4191002916915245391e9b49100f68ba2a2a04d1e16bad
          • MD5 SHA1 SHA512

          OIkQMcks.inf

          • Path C:\Users\Admin\cQUoYEgg\OIkQMcks.inf
          • Size 4B
          • SHA256 8987272d2ae45852e1553213f533f93e78465a046ebe365e89760b9da376e36c
          • MD5 SHA1 SHA512

          OIkQMcks.inf

          • Path C:\Users\Admin\cQUoYEgg\OIkQMcks.inf
          • Size 4B
          • SHA256 c2d398b7b7730b38a8a2d235ad9d198cfbfff24f61a861c89c7ebd65294f9ea9
          • MD5 SHA1 SHA512

          OIkQMcks.inf

          • Path C:\Users\Admin\cQUoYEgg\OIkQMcks.inf
          • Size 4B
          • SHA256 91c9c767a562d86a5a4b4aa161483e55cb6f319964ec475e934a8c15b77faadb
          • MD5 SHA1 SHA512

          OIkQMcks.inf

          • Path C:\Users\Admin\cQUoYEgg\OIkQMcks.inf
          • Size 4B
          • SHA256 c5c25c23b233dcd529b6a4d1fdc8c8660273e242046354a91a6e23044ded263f
          • MD5 SHA1 SHA512

          OIkQMcks.inf

          • Path C:\Users\Admin\cQUoYEgg\OIkQMcks.inf
          • Size 4B
          • SHA256 c0d1076ac5bcda52befe4e39045248bc38a53bea47aa7466cbd6aab10522feff
          • MD5 SHA1 SHA512

          OIkQMcks.inf

          • Path C:\Users\Admin\cQUoYEgg\OIkQMcks.inf
          • Size 4B
          • SHA256 9ce76765c545a5516af9c197a39055d9116df78f0cefb286bb22965875dfaaca
          • MD5 SHA1 SHA512

          OIkQMcks.inf

          • Path C:\Users\Admin\cQUoYEgg\OIkQMcks.inf
          • Size 4B
          • SHA256 2f09b3add75466a63215c475a46b0a98140bca3ca58833b4067640054e34c339
          • MD5 SHA1 SHA512

          OIkQMcks.inf

          • Path C:\Users\Admin\cQUoYEgg\OIkQMcks.inf
          • Size 4B
          • SHA256 0c35bdb9ac27303c8120c3275d3727de2e89bde62853ad2679c1b5407e9ea2fa
          • MD5 SHA1 SHA512

          OIkQMcks.inf

          • Path C:\Users\Admin\cQUoYEgg\OIkQMcks.inf
          • Size 4B
          • SHA256 403175f079c90989b6e0d88b3f18883628a51b1a293edb1ce141645b67df6ba6
          • MD5 SHA1 SHA512

          OIkQMcks.inf

          • Path C:\Users\Admin\cQUoYEgg\OIkQMcks.inf
          • Size 4B
          • SHA256 fef644016afc9536ea10d0155a52f7503e59557c58efafe702047ee3ceda7fce
          • MD5 SHA1 SHA512

          OIkQMcks.inf

          • Path C:\Users\Admin\cQUoYEgg\OIkQMcks.inf
          • Size 4B
          • SHA256 646aa66762f6b66dec41687458e48e84a0d6363178bed2b91c8a18d707bc481f
          • MD5 SHA1 SHA512

          OIkQMcks.inf

          • Path C:\Users\Admin\cQUoYEgg\OIkQMcks.inf
          • Size 4B
          • SHA256 9fde7d344b1cc15e152813dac7df9f1e0e93d394d325b79c40099b4621798457
          • MD5 SHA1 SHA512

          OIkQMcks.inf

          • Path C:\Users\Admin\cQUoYEgg\OIkQMcks.inf
          • Size 4B
          • SHA256 73e61002530b6a039a2c614a912a9091f1d36d6bcf62a70b509d3878c05ec6e0
          • MD5 SHA1 SHA512

          OIkQMcks.inf

          • Path C:\Users\Admin\cQUoYEgg\OIkQMcks.inf
          • Size 4B
          • SHA256 89fe0b56cfb7e6cd1174848cd81198f78539548ef3c3f7f4dd8c8594698c582b
          • MD5 SHA1 SHA512

          office2016setup.exe

          • Path C:\odt\office2016setup.exe
          • Size 5.3MB
          • SHA256 7169c283dbb9158d3262f97c9ef50165a859ead2e050e9cc80b8898bcd281236
          • MD5 SHA1 SHA512 SSDEEP

          memory/1824-8-0x0000000000400000-0x0000000000432000-memory.dmp

          memory/3140-18-0x0000000000400000-0x00000000004A5000-memory.dmp

          memory/3140-0-0x0000000000400000-0x00000000004A5000-memory.dmp

          memory/4536-13-0x0000000000400000-0x0000000000434000-memory.dmp