Analysis

  • max time kernel
    150s
  • max time network
    93s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    20/04/2026, 01:20

General

  • Target
    2026-04-20_e5b57435257103188f0d7dd1a20c7414_elex_virlock.exe
  • Size 625KB
  • Sample260420-bp95wsbs2t
  • SHA256 3ca8636db120dc058c45a4f30969c73fb3beda4e845f94d75e541899c03bf9a9
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Family: Nabucur

    Nabucur is a ransomware first seen in 2015.

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
  • UAC bypass 3 TTPs 1 IoCs
  • Renames multiple (138) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry key 1 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of FindShellTrayWindow 19 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-04-20_e5b57435257103188f0d7dd1a20c7414_elex_virlock.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-04-20_e5b57435257103188f0d7dd1a20c7414_elex_virlock.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1108
    • C:\Users\Admin\zskgIQks\NokQowwo.exe
      "C:\Users\Admin\zskgIQks\NokQowwo.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of FindShellTrayWindow
      PID:2932
    • C:\ProgramData\waAwMsAM\ymYUggUI.exe
      "C:\ProgramData\waAwMsAM\ymYUggUI.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      PID:420
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vcredist_x86.exe
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3976
      • C:\Users\Admin\AppData\Local\Temp\vcredist_x86.exe
        C:\Users\Admin\AppData\Local\Temp\vcredist_x86.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4492
        • C:\Users\Admin\AppData\Local\Temp\vcredist_x86.exe
          "C:\Users\Admin\AppData\Local\Temp\vcredist_x86.exe" -burn.unelevated BurnPipe.{75D36D66-1C4D-4A84-BEEE-26498E024A07} {1D554D07-9F6B-4282-B1C3-E4A727FF8EBF} 4492
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:4316
    • C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
      2⤵
      • Modifies visibility of file extensions in Explorer
      • System Location Discovery: System Language Discovery
      • Modifies registry key
      PID:3568
    • C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies registry key
      PID:1032
    • C:\Windows\SysWOW64\reg.exe
      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
      2⤵
      • UAC bypass
      • System Location Discovery: System Language Discovery
      • Modifies registry key
      PID:3600
  • C:\ProgramData\waAwMsAM\ymYUggUI.exe
    C:\ProgramData\waAwMsAM\ymYUggUI.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    PID:1488
  • C:\Users\Admin\zskgIQks\NokQowwo.exe
    C:\Users\Admin\zskgIQks\NokQowwo.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    PID:4276

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        overlay.png.exe

        • Path C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png.exe
        • Size 228KB
        • SHA256 fdf51e9ebc10f3ae6d92d77e6834920d2a1226cf9cea3f8e66017527371ce052
        • MD5 SHA1 SHA512 SSDEEP TLSH

        background.png.exe

        • Path C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png.exe
        • Size 318KB
        • SHA256 363bfbbc8f97b0776b64f4c98445212bef57b1006f62f7ed3b4bdfd23c94fa4c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        watermark.png.exe

        • Path C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png.exe
        • Size 212KB
        • SHA256 893cbfa21cf874240456315f02dfd21e808b5f02eff5de0192ccfeb9747114a2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        guest.bmp.exe

        • Path C:\ProgramData\Microsoft\User Account Pictures\guest.bmp.exe
        • Size 784KB
        • SHA256 406e5e1c8c400d8a8ff45fc5c1cdd33ce843c0c65a66e7eb5e2454eaff2192d2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        guest.png.exe

        • Path C:\ProgramData\Microsoft\User Account Pictures\guest.png.exe
        • Size 190KB
        • SHA256 7e1a90d90c246d9a6d5877aa9efb2eeb564a1a0bc2c8a4aa99edcb14671fccbe
        • MD5 SHA1 SHA512 SSDEEP TLSH

        user-192.png.exe

        • Path C:\ProgramData\Microsoft\User Account Pictures\user-192.png.exe
        • Size 190KB
        • SHA256 3cad7f41d81b444b7dc833a6e3dd0c80cfa6f9e88ff0865b4b26847c7d18e9c0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        user.bmp.exe

        • Path C:\ProgramData\Microsoft\User Account Pictures\user.bmp.exe
        • Size 778KB
        • SHA256 2b75aaea8c7aba56df39805aab3a4884eaffeff5ad1d3ebb34343830333432a0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        user.png.exe

        • Path C:\ProgramData\Microsoft\User Account Pictures\user.png.exe
        • Size 203KB
        • SHA256 b177ee6ebba3de27ec15bcbd91fb830f4353b6e73d44237e5d2085610fd9dd34
        • MD5 SHA1 SHA512 SSDEEP TLSH

        vcredist_x86.exe

        • Path C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
        • Size 632KB
        • SHA256 31f07d415ce5204d60bff09737a3308c879f65c59f274ba60a9ad8cedd81915b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        windowsdesktop-runtime-8.0.15-win-x64.exe

        • Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
        • Size 793KB
        • SHA256 67438818f222401e317202fd0e634d3ad72beeb40e921a807cf40714043e28e2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        VC_redist.x64.exe

        • Path C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        • Size 827KB
        • SHA256 0fe7d90c12fbd07536fb55fee9e745e891691e6934c0c9ee0900f60434140b5c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        vcredist_x86.exe

        • Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
        • Size 646KB
        • SHA256 93ecf359c55f4a7c0098be938bf7bb17057dc0ee8c88e5b19413a4d215b2400b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        vcredist_x64.exe

        • Path C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
        • Size 642KB
        • SHA256 e346c3daf5a5dbd72fb549a41cdd4d20e56ba87d869ab1ea9cb11d83ceb8294a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        windowsdesktop-runtime-6.0.27-win-x64.exe

        • Path C:\ProgramData\Package Cache\{d87ae0f4-64a6-4b94-859a-530b9c313c27}\windowsdesktop-runtime-6.0.27-win-x64.exe
        • Size 805KB
        • SHA256 fc253020adffe4148bc4dfa0978b32fde4cab18d257beaa568ff7d8be025c571
        • MD5 SHA1 SHA512 SSDEEP TLSH

        windowsdesktop-runtime-7.0.16-win-x64.exe

        • Path C:\ProgramData\Package Cache\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\windowsdesktop-runtime-7.0.16-win-x64.exe
        • Size 801KB
        • SHA256 8f2ecee50f961acf4cdd48b73112cc94dd4c00b73fdbf9740a48aeafab6b3ede
        • MD5 SHA1 SHA512 SSDEEP TLSH

        vcredist_x64.exe

        • Path C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe
        • Size 648KB
        • SHA256 decc3a90a968a02f65b6002703091f6d9beb2fcef68f40c4b1b594ab53b361bd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ymYUggUI.exe

        • Path C:\ProgramData\waAwMsAM\ymYUggUI.exe
        • Size 188KB
        • SHA256 0e1cf7bfb94b0191391171e644447d773482d3ae91d3c3c586c91fd6403194d0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ymYUggUI.inf

        • Path C:\ProgramData\waAwMsAM\ymYUggUI.inf
        • Size 4B
        • SHA256 7c97b2f2cbc46027786f9a058aa805bbcb8071dfb07b1855406766e7a138a0bc
        • MD5 SHA1 SHA512

        ymYUggUI.inf

        • Path C:\ProgramData\waAwMsAM\ymYUggUI.inf
        • Size 4B
        • SHA256 fe11148f5f9a62cedd0b4f9247f33a1f8905d2b777da830554bb5a19354c205a
        • MD5 SHA1 SHA512

        ymYUggUI.inf

        • Path C:\ProgramData\waAwMsAM\ymYUggUI.inf
        • Size 4B
        • SHA256 634bed107a14c1a7cf9c5ec0599aee5515ee5690b8d581107910f360d47ecd83
        • MD5 SHA1 SHA512

        ymYUggUI.inf

        • Path C:\ProgramData\waAwMsAM\ymYUggUI.inf
        • Size 4B
        • SHA256 8e5a1f86a88e10e7c29806e094d9873f9fcd47ba1d91d926f3f89c9fb5e23445
        • MD5 SHA1 SHA512

        ymYUggUI.inf

        • Path C:\ProgramData\waAwMsAM\ymYUggUI.inf
        • Size 4B
        • SHA256 2027e210550e2014271ce3a46c4d5ec093fbb242991658207f1410999bf8524c
        • MD5 SHA1 SHA512

        ymYUggUI.inf

        • Path C:\ProgramData\waAwMsAM\ymYUggUI.inf
        • Size 4B
        • SHA256 b64637844e1d8f972e5146895df479df5061f5a97875daa4fd05a64adf1a32cf
        • MD5 SHA1 SHA512

        ymYUggUI.inf

        • Path C:\ProgramData\waAwMsAM\ymYUggUI.inf
        • Size 4B
        • SHA256 56840f40e546afd50fc33d0ec052fc2f23e567efa05a32473dfcb9d2ee79a8e8
        • MD5 SHA1 SHA512

        ymYUggUI.inf

        • Path C:\ProgramData\waAwMsAM\ymYUggUI.inf
        • Size 4B
        • SHA256 cf21c2eeb54a5ed759d4c5e553e7651dac7dd8dc0e94a12f611452f6ebb6abc3
        • MD5 SHA1 SHA512

        ymYUggUI.inf

        • Path C:\ProgramData\waAwMsAM\ymYUggUI.inf
        • Size 4B
        • SHA256 de203d99bb6f4366a4fd37f10b1c53ed104e945628c9257c1436e28cb481d331
        • MD5 SHA1 SHA512

        128.png.exe

        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\128.png.exe
        • Size 203KB
        • SHA256 7be11958c1aee6fb4d1bbe9542f309b0b16d050dcd8e23f47e097e0e6ac3d70b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        192.png.exe

        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\192.png.exe
        • Size 206KB
        • SHA256 e4f64f584e4a952ce0fa341e12422a3f6e20a70f3f73df42451cc4405fdde8f5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        256.png.exe

        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\256.png.exe
        • Size 223KB
        • SHA256 7c3a7325a2ed20b05a77ed8cf2c7c1cf243da53ec515f47e68cc9d1d1671fa67
        • MD5 SHA1 SHA512 SSDEEP TLSH

        48.png.exe

        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\48.png.exe
        • Size 207KB
        • SHA256 68f994e9d6ff9bd3d26223a90ff6ac285c895f0365504de7f2cb476c26f32857
        • MD5 SHA1 SHA512 SSDEEP TLSH

        64.png.exe

        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\64.png.exe
        • Size 181KB
        • SHA256 06423223d5447c86f6c9cfb1aca529492927d3f3157a3fdfc57feb116d484d7c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        96.png.exe

        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\96.png.exe
        • Size 191KB
        • SHA256 01a5286f8d5009a927ac0ddad20621ae2274e9e99c8a8102418a18ef12b49556
        • MD5 SHA1 SHA512 SSDEEP TLSH

        128.png.exe

        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\128.png.exe
        • Size 198KB
        • SHA256 6e58aed5705031f9e2e5ac552f4b51943466b6bb42fc372f1fcc54c9d43a43dc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        192.png.exe

        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\192.png.exe
        • Size 210KB
        • SHA256 39402e21b7a741f371ef6545b2c4e8533e7db2ef3df8e08c0e169c7838632b06
        • MD5 SHA1 SHA512 SSDEEP TLSH

        256.png.exe

        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\256.png.exe
        • Size 211KB
        • SHA256 3febd5b1b9b58c0f485366a9e8b85ddbdbe38b426a2fc13481789abdba8c6b2e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        32.png.exe

        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\32.png.exe
        • Size 195KB
        • SHA256 ae0f3de02b697387ddcee4693cbdebff7aa07474caa19414972c6f2aa533e7ca
        • MD5 SHA1 SHA512 SSDEEP TLSH

        48.png.exe

        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\48.png.exe
        • Size 185KB
        • SHA256 b2371c0859c5d2ad8c72c2ff5d2a5ed3b956bcb3de5717c8775faa2114902105
        • MD5 SHA1 SHA512 SSDEEP TLSH

        64.png.exe

        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\64.png.exe
        • Size 200KB
        • SHA256 7582230ddd86d791ba3d76f6303882b010eda658e089bae6e177cae273433678
        • MD5 SHA1 SHA512 SSDEEP TLSH

        96.png.exe

        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\96.png.exe
        • Size 192KB
        • SHA256 94d5f16a46ea12afefdfdff254ebdea169b516a6277ae8497f0b45666b9bc203
        • MD5 SHA1 SHA512 SSDEEP TLSH

        128.png.exe

        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\128.png.exe
        • Size 186KB
        • SHA256 9e9c4154823dd0f6fb4aa3a3fff64b4c900822498b58ac34ce713b1023b44866
        • MD5 SHA1 SHA512 SSDEEP TLSH

        256.png.exe

        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\256.png.exe
        • Size 191KB
        • SHA256 8f342f32e69b1efb17674c26c1b1859953b296994b751508ba560551993a1c42
        • MD5 SHA1 SHA512 SSDEEP TLSH

        96.png.exe

        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\96.png.exe
        • Size 205KB
        • SHA256 28c8e8dea933936c15b385a5a67ea769ecb66a8236aec5d101e044041c1b7ce8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        192.png.exe

        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\192.png.exe
        • Size 181KB
        • SHA256 3800cb8431b0857a6792b3e63ccbc122a1a1f7777d8fc535a33c1c8d2c9753dd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        48.png.exe

        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\48.png.exe
        • Size 188KB
        • SHA256 d827691133c498df5d3c4f83ae7a17f9fef02e0664c18436d93532ecfc952fea
        • MD5 SHA1 SHA512 SSDEEP TLSH

        64.png.exe

        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\64.png.exe
        • Size 189KB
        • SHA256 660b58a81c5debf646e486e201020ac2866727832d06988def2162ac6a0db101
        • MD5 SHA1 SHA512 SSDEEP TLSH

        96.png.exe

        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\96.png.exe
        • Size 188KB
        • SHA256 21249aea322ac687d25b0ad8c15a2de67e8330cec306ba87ecdca51fb1b254b1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        128.png.exe

        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mdpkiolbdkhdjpekfbkbmhigcaggjagi\Icons\128.png.exe
        • Size 199KB
        • SHA256 bb7cfe83e65626b62223c47a93ea4d3306dd9a0ec4f5b7e273b86a9415398806
        • MD5 SHA1 SHA512 SSDEEP TLSH

        192.png.exe

        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mdpkiolbdkhdjpekfbkbmhigcaggjagi\Icons\192.png.exe
        • Size 195KB
        • SHA256 a4f22743cf837469f1546da820f1a258d8bb7c8d2fecbbe5f5d48da0bc1f551c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        256.png.exe

        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mdpkiolbdkhdjpekfbkbmhigcaggjagi\Icons\256.png.exe
        • Size 207KB
        • SHA256 a53206f9b2c7d6bfe8a6702f8cba4341f7d0e2ec216293b9fc62a799ea788cbc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        48.png.exe

        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mdpkiolbdkhdjpekfbkbmhigcaggjagi\Icons\48.png.exe
        • Size 196KB
        • SHA256 9c418582a5c0f1f1b297b61d481be24b49c344ef0fd3f1282272f0ba0507c544
        • MD5 SHA1 SHA512 SSDEEP TLSH

        96.png.exe

        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mdpkiolbdkhdjpekfbkbmhigcaggjagi\Icons\96.png.exe
        • Size 201KB
        • SHA256 f6b7e9fb3ba0bbd6181002379d6d7f4ba97acc0ad5f9cf6e15a9e26d572f0501
        • MD5 SHA1 SHA512 SSDEEP TLSH

        256.png.exe

        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\256.png.exe
        • Size 196KB
        • SHA256 3ddd5cbb477f8e0658d15356705c18caf815b25b143c75daf8e1c04674c7a669
        • MD5 SHA1 SHA512 SSDEEP TLSH

        128.png.exe

        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.100.1_0\128.png.exe
        • Size 201KB
        • SHA256 6bc9a0dd240a5d4fa88fc91ca2e3994ba9869bbd94f129d1f21f35ae8498987b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        128.png.exe

        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.100.1_1\128.png.exe
        • Size 201KB
        • SHA256 a9bcb052c120702c22ed69178ba600d00ede891a6f71de440df7f1d17df89bbf
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AppBlue.png.exe

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppBlue.png.exe
        • Size 197KB
        • SHA256 0d69b2ca2aa0d902df3a91e4ef04e944c814bbf636ab2039ab362526d173e5b7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AppErrorBlue.png.exe

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppErrorBlue.png.exe
        • Size 198KB
        • SHA256 2ab9ecc7bf06fa697adbd6784b845f99da80f3d7001d155befc13642fddd0efe
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AppWhite.png.exe

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppWhite.png.exe
        • Size 200KB
        • SHA256 e6756309b847135051b1a06b5d8aaa802ac4b8e0ab63c4385a6df98a23d88e12
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AutoPlayOptIn.gif.exe

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AutoPlayOptIn.gif.exe
        • Size 580KB
        • SHA256 5f691acde450c63acceb2a6500e2d4150182f8c9b84183e903cd31a1e57a4e92
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AutoPlayOptIn.png.exe

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AutoPlayOptIn.png.exe
        • Size 191KB
        • SHA256 d540d72015fdd2d919a3e6a5efaf3d418bdeb6d08064ce41c427eab3d5bcc19e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ElevatedAppBlue.png.exe

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ElevatedAppBlue.png.exe
        • Size 195KB
        • SHA256 106c396f7c4c2d79f4fac23016b8b43125186d4c31ad709c9ec645ce3b10235d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ElevatedAppWhite.png.exe

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ElevatedAppWhite.png.exe
        • Size 184KB
        • SHA256 8c3ee3d82ddbdbd36c0b916a617ffd41e8fd31d3e47084065b9df540fb12f23b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Error.png.exe

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Error.png.exe
        • Size 195KB
        • SHA256 ccbe6f7e30f9ca781496e6755dd5de316c4f2921b04d3c5da5b1c48987ab9c0d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        KFMHeroToast.png.exe

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMHeroToast.png.exe
        • Size 192KB
        • SHA256 c980a5405d94ddb3d561203cd8e79767f602a9534cb1d9180eaf828320c8945a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        KFMScanExclusionToast.png.exe

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMScanExclusionToast.png.exe
        • Size 212KB
        • SHA256 e3d4724ac06caa07fe2dbd85900c30cb23bcee677cb89ac81ba6eac4c80b776c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        QuotaCritical.png.exe

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\QuotaCritical.png.exe
        • Size 197KB
        • SHA256 72647134ea5937fb72354fb5a88c95977624355624ab00887b6c0d2b6df928d4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        QuotaError.png.exe

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\QuotaError.png.exe
        • Size 200KB
        • SHA256 ff17127e8887b46555acb666e1a73927dde12f7cfdd726aa0dab32747b0a269e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ScreenshotOptIn.gif.exe

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ScreenshotOptIn.gif.exe
        • Size 422KB
        • SHA256 f636a14bdeadf3a3150f3456d12ac252e890f4ee0c35aa957ba7f9bca7e6630c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Warning.png.exe

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Warning.png.exe
        • Size 200KB
        • SHA256 a7006f28cc606dc5050a54fb93717550bdab2cb68765c71f2b63110f1bb1e3b4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OneDriveMedTile.contrast-black_scale-400.png.exe

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-400.png.exe
        • Size 198KB
        • SHA256 b544fca6ecf933d1f69d85e1d6fdef1ef29e59d467b8c170033d5f96a49897af
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OneDriveMedTile.scale-400.png.exe

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-400.png.exe
        • Size 184KB
        • SHA256 9cd85e40ba1d2d4ea5292428669e0c428ddb2ecb5cd153ca57d2ae6e944774c4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OneDriveSmallTile.scale-400.png.exe

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-400.png.exe
        • Size 202KB
        • SHA256 802350f52f42000e96528a5473bf9ef61fbef90644d3bd120c527cf265a8238a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OneDrive.exe

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
        • Size 1.8MB
        • SHA256 2074802b983ddf74c1fcd15997f9a32c1be1811abf92955c8a581c5d5610d274
        • MD5 SHA1 SHA512 SSDEEP TLSH

        tinytile.png.exe

        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\26310719480\tinytile.png.exe
        • Size 181KB
        • SHA256 e6eb80d9a7188f5dfa3f0e764f77835602f019c4ea5402d4fa3508ab7fcc0ca9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        squaretile.png.exe

        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\6501008900\squaretile.png.exe
        • Size 184KB
        • SHA256 7797f8eb6cd94a543211713cf54e5c3d11a0f9c570d03c2e3b0506f6303c1bea
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AAse.ico

        • Path C:\Users\Admin\AppData\Local\Temp\AAse.ico
        • Size 4KB
        • SHA256 9a233711400b52fc399d16bb7e3937772c44d7841a24a685467e19dfa57769d5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AUYo.exe

        • Path C:\Users\Admin\AppData\Local\Temp\AUYo.exe
        • Size 1.6MB
        • SHA256 572cad859c9f299e4e0c35b57178585574716748bc4bd1b907ecd4f5c0fb3f05
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AYwI.exe

        • Path C:\Users\Admin\AppData\Local\Temp\AYwI.exe
        • Size 867KB
        • SHA256 0dd868c4d449b91d40ba6c8df14d53c38b48e8f874484c538bc21a7b78f645c6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AcEC.exe

        • Path C:\Users\Admin\AppData\Local\Temp\AcEC.exe
        • Size 204KB
        • SHA256 05e2785a469d68c09b00adb0a883bfa35fca16e1e5fefb31c41c03fafefcd6da
        • MD5 SHA1 SHA512 SSDEEP TLSH

        CAgk.exe

        • Path C:\Users\Admin\AppData\Local\Temp\CAgk.exe
        • Size 323KB
        • SHA256 5b7ae62238b7b6176ad00da7a1806c1febd1604eebcb076a1d51fb827898cc93
        • MD5 SHA1 SHA512 SSDEEP TLSH

        CsUO.exe

        • Path C:\Users\Admin\AppData\Local\Temp\CsUO.exe
        • Size 1.8MB
        • SHA256 2f20fbfeb3900eb369a84e7a862e686818f0da9802c19ea00b902a87cd4fd178
        • MD5 SHA1 SHA512 SSDEEP TLSH

        EEMy.exe

        • Path C:\Users\Admin\AppData\Local\Temp\EEMy.exe
        • Size 300KB
        • SHA256 641986a0d66091a4a8cfd62c847fd81ae0c8d0bb1e2fe1c808abbc61f4096f8a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        EEUI.exe

        • Path C:\Users\Admin\AppData\Local\Temp\EEUI.exe
        • Size 204KB
        • SHA256 e1e28bb0a25fa05f59be82ab89b1629e09e2d7fcbcec4634c1758e403ddcd94e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Esgu.exe

        • Path C:\Users\Admin\AppData\Local\Temp\Esgu.exe
        • Size 1.4MB
        • SHA256 3a660802903571afc7e55fe0a2c3ccad467b9908a6a46266b1eb56531cec85c0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        EwsU.exe

        • Path C:\Users\Admin\AppData\Local\Temp\EwsU.exe
        • Size 880KB
        • SHA256 3953edeb37b872a476fb96b1acccd1b8064c819ed3cedf1e3952059ae19f212b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Gcci.exe

        • Path C:\Users\Admin\AppData\Local\Temp\Gcci.exe
        • Size 192KB
        • SHA256 0afb3749b341922fb85e464389fb19c53eabb5facd51aa74496c399ae501b1c3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        GcsM.exe

        • Path C:\Users\Admin\AppData\Local\Temp\GcsM.exe
        • Size 2.0MB
        • SHA256 336c68c2edb82be0241b7f6a0c4fbf4e23affb3def09111e05f6ddd00fbd6acf
        • MD5 SHA1 SHA512 SSDEEP TLSH

        IAQE.exe

        • Path C:\Users\Admin\AppData\Local\Temp\IAQE.exe
        • Size 1.9MB
        • SHA256 fdc36a726ec3f210dad59ac638bd2201f11139a895667edebc63c28671f25966
        • MD5 SHA1 SHA512 SSDEEP TLSH

        IQoY.exe

        • Path C:\Users\Admin\AppData\Local\Temp\IQoY.exe
        • Size 430KB
        • SHA256 00d1dc819de4b275a7b803e9190b69aca4cf6d3369c4dc2628f426d22f78c2ab
        • MD5 SHA1 SHA512 SSDEEP TLSH

        IogM.exe

        • Path C:\Users\Admin\AppData\Local\Temp\IogM.exe
        • Size 239KB
        • SHA256 38cbff69d3c74a3e3bed4c6601c10d22b71eeca661a55ea7dc2e6afed3b983c3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        KAMM.ico

        • Path C:\Users\Admin\AppData\Local\Temp\KAMM.ico
        • Size 4KB
        • SHA256 e5798e3d8c1af62d997a27bc2fb7333639a4f20e9753cf7a5b0639cd93f96448
        • MD5 SHA1 SHA512 SSDEEP TLSH

        KEUq.exe

        • Path C:\Users\Admin\AppData\Local\Temp\KEUq.exe
        • Size 185KB
        • SHA256 a416a6232b2434cd211d580b6cb3092dec3ab4b3bb90d709abebf65aecb81221
        • MD5 SHA1 SHA512 SSDEEP TLSH

        KYsu.exe

        • Path C:\Users\Admin\AppData\Local\Temp\KYsu.exe
        • Size 207KB
        • SHA256 d0b4fea79f0f5db05da895a4dfc39e2698cbbd7560be269cf07646bfd956f6f1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        KgYq.exe

        • Path C:\Users\Admin\AppData\Local\Temp\KgYq.exe
        • Size 627KB
        • SHA256 3ac2d1e727d63010c0c260a545e2963d18d7dfc877cf252251c8d8e2a7a06e36
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Kogu.exe

        • Path C:\Users\Admin\AppData\Local\Temp\Kogu.exe
        • Size 761KB
        • SHA256 a5959380efe1ad65056e790df527438850b24008c9f9f7835b5f7587f0c341c6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MIMs.exe

        • Path C:\Users\Admin\AppData\Local\Temp\MIMs.exe
        • Size 824KB
        • SHA256 c93458b96e23c1932075dad78a02285d5c5d06278a7d5866e604d82965092c0d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MMYA.exe

        • Path C:\Users\Admin\AppData\Local\Temp\MMYA.exe
        • Size 500KB
        • SHA256 368fd772c3334139af92a81c67b772275ee21a27c5de6ab003c86cc905197998
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MMcg.exe

        • Path C:\Users\Admin\AppData\Local\Temp\MMcg.exe
        • Size 704KB
        • SHA256 7adb97057abe1da20c53a1cfaae673605a693102729c2718f6715ef512b79708
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MUki.exe

        • Path C:\Users\Admin\AppData\Local\Temp\MUki.exe
        • Size 473KB
        • SHA256 ad91602bb0960a33a9fd7d0fce4387b360eee4c63fff7062b45c3bb4f9155252
        • MD5 SHA1 SHA512 SSDEEP TLSH

        McEg.ico

        • Path C:\Users\Admin\AppData\Local\Temp\McEg.ico
        • Size 4KB
        • SHA256 bcb253ea3735a0cf0a8c6ee06c14c884937c64ddeacedb17240e40d403577620
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MsIu.exe

        • Path C:\Users\Admin\AppData\Local\Temp\MsIu.exe
        • Size 204KB
        • SHA256 10040f479ba53a8fe0d9d03a3dcf63885a0139ea09de12a7ca54ef4e19c2becd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OEUq.exe

        • Path C:\Users\Admin\AppData\Local\Temp\OEUq.exe
        • Size 210KB
        • SHA256 df20fed9ebd81bb50f17bf33d9f659ffaf3aa722cb93ab2bde32e1d227809d1c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OIYq.ico

        • Path C:\Users\Admin\AppData\Local\Temp\OIYq.ico
        • Size 4KB
        • SHA256 71254090503179540435a1283d04301f3d5ba48855ae8c361d4ac86e3abd2865
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OQsO.exe

        • Path C:\Users\Admin\AppData\Local\Temp\OQsO.exe
        • Size 743KB
        • SHA256 69533ad7b502a5fce999d6a915f3b139342e4283f7f9d5fbc5d2c621ffb8c51c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OsgQ.exe

        • Path C:\Users\Admin\AppData\Local\Temp\OsgQ.exe
        • Size 197KB
        • SHA256 db0de64dbfdb5abf362ad52c6f2b5d4d2735191ef4183d2ebaea21b42eb1487e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        QEcY.exe

        • Path C:\Users\Admin\AppData\Local\Temp\QEcY.exe
        • Size 408KB
        • SHA256 00eba387810edbd95bc03db07365b148ef880038973a9f554c148c5b467f522d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        QwEO.exe

        • Path C:\Users\Admin\AppData\Local\Temp\QwEO.exe
        • Size 459KB
        • SHA256 9691f8df94b2a2620bdf569c510c735f75947bf05bcf14a125daad9d55287a0e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        SMUo.exe

        • Path C:\Users\Admin\AppData\Local\Temp\SMUo.exe
        • Size 205KB
        • SHA256 7fcb5bb89f0efa5fedb1c85a9e4ca49855f41282b0a5610df9aa5cb4e53768b3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        SgUG.exe

        • Path C:\Users\Admin\AppData\Local\Temp\SgUG.exe
        • Size 188KB
        • SHA256 279a9727a90f763176873664865aca7394767a051fc474005ad6a553a5600b0e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        UAYw.ico

        • Path C:\Users\Admin\AppData\Local\Temp\UAYw.ico
        • Size 4KB
        • SHA256 c3d81c0590da8903a57fb655949bf75919e678a2ef9e373105737cf2c6819e62
        • MD5 SHA1 SHA512 SSDEEP TLSH

        UMwK.exe

        • Path C:\Users\Admin\AppData\Local\Temp\UMwK.exe
        • Size 1.2MB
        • SHA256 2e9dde12497760656937bea5fbe3f8096270ebd6f16003c1f911903c84699cba
        • MD5 SHA1 SHA512 SSDEEP TLSH

        UggO.exe

        • Path C:\Users\Admin\AppData\Local\Temp\UggO.exe
        • Size 573KB
        • SHA256 23c8b827cc692fad35ea11349bf8349045333abfa2c7aa0efe47723d3678e186
        • MD5 SHA1 SHA512 SSDEEP TLSH

        UooW.exe

        • Path C:\Users\Admin\AppData\Local\Temp\UooW.exe
        • Size 1.0MB
        • SHA256 5a57952685cb4f970b6aad5a8dfdf750834e416a47cc5dc88826521d93bab1bd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        UsQg.exe

        • Path C:\Users\Admin\AppData\Local\Temp\UsQg.exe
        • Size 185KB
        • SHA256 d8d6ca6eba8cb23f4dade5dc61f0df905af47781ac3d26e2d5e3f9e0f7fcad4c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        WIEQ.exe

        • Path C:\Users\Admin\AppData\Local\Temp\WIEQ.exe
        • Size 331KB
        • SHA256 dac4950f0e73eedfeca7b1d25a7015cd46701f93cf7cc496c292da3cb4db16c3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        WgYU.exe

        • Path C:\Users\Admin\AppData\Local\Temp\WgYU.exe
        • Size 1.4MB
        • SHA256 d8ef0ae500c754682076c02c227fd45f876a163b61b66514600215f7ec619816
        • MD5 SHA1 SHA512 SSDEEP TLSH

        YIwa.exe

        • Path C:\Users\Admin\AppData\Local\Temp\YIwa.exe
        • Size 198KB
        • SHA256 2b55a8f05c2844085313181cc1dc9809d5a8504e9c4e793d37dd02d9a48c7b1a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Ycoc.exe

        • Path C:\Users\Admin\AppData\Local\Temp\Ycoc.exe
        • Size 1.2MB
        • SHA256 969dd9584c5a1b4c318b91c220bfa7c5f114651cf805291395c2dd5207e46588
        • MD5 SHA1 SHA512 SSDEEP TLSH

        YwQW.exe

        • Path C:\Users\Admin\AppData\Local\Temp\YwQW.exe
        • Size 651KB
        • SHA256 a439fc95b924eded557ee5e4d80a32de8eefa6a3c541479d622aa497d68e40a9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        aEYO.exe

        • Path C:\Users\Admin\AppData\Local\Temp\aEYO.exe
        • Size 517KB
        • SHA256 835ecd0d3eba610bf6ed55b4173d2d92ebbbe70405f77a22bdf24de976165cb1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        aYIa.exe

        • Path C:\Users\Admin\AppData\Local\Temp\aYIa.exe
        • Size 200KB
        • SHA256 b55db8d7847243f3ae4f8cc5646c5510f051b4f7962c421d7adb3a8355833dc4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        akgk.exe

        • Path C:\Users\Admin\AppData\Local\Temp\akgk.exe
        • Size 206KB
        • SHA256 29ab4f472fdb1ffc051769240bd419da745d9942e58e0d2e686a500c34641731
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cEQk.ico

        • Path C:\Users\Admin\AppData\Local\Temp\cEQk.ico
        • Size 4KB
        • SHA256 0b945cd858463198a2319799f721202efb88f1b7273bc3726206f0bb272802f7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cIAa.exe

        • Path C:\Users\Admin\AppData\Local\Temp\cIAa.exe
        • Size 640KB
        • SHA256 4f972860927a7e221b17b4b15fb7303b68f64ffa6baa6b3f45c3697452aeb4dd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ccEM.exe

        • Path C:\Users\Admin\AppData\Local\Temp\ccEM.exe
        • Size 1.1MB
        • SHA256 ceaaf151cff335243ae72817e03133002e9ab3be44616888a9a155b2daf772a2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cgUA.exe

        • Path C:\Users\Admin\AppData\Local\Temp\cgUA.exe
        • Size 264KB
        • SHA256 c4d5115cff775f0a4ea2ef3e1bcff79a678ab45176b87bc02de284dc050745f7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cwYQ.exe

        • Path C:\Users\Admin\AppData\Local\Temp\cwYQ.exe
        • Size 384KB
        • SHA256 4491581ea7daef76ebb83011a37b35c944150afa248214b64d023713c8e4f0d6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        eEog.exe

        • Path C:\Users\Admin\AppData\Local\Temp\eEog.exe
        • Size 500KB
        • SHA256 b0328bc5a7e66b533af3ccaeb6dab5700323fee923623712213782ce83638c0b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        egAa.exe

        • Path C:\Users\Admin\AppData\Local\Temp\egAa.exe
        • Size 1.6MB
        • SHA256 daf4f76255e2ca64f6ac571bb87471811bf7a3a6bb3c46bbefefb66928bed9f4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ewIg.exe

        • Path C:\Users\Admin\AppData\Local\Temp\ewIg.exe
        • Size 222KB
        • SHA256 253a6a78eb5abfae0a10ec6720a1895042aefbe028e79df10d644d90c8bf0748
        • MD5 SHA1 SHA512 SSDEEP TLSH

        gAEI.exe

        • Path C:\Users\Admin\AppData\Local\Temp\gAEI.exe
        • Size 636KB
        • SHA256 35baa20bd7d9ea5ba7c53022bb92c65221bf2b2046bda32e01818614a05a36f9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        gAUm.exe

        • Path C:\Users\Admin\AppData\Local\Temp\gAUm.exe
        • Size 193KB
        • SHA256 47be0624e0c8454da492151f0b3d3ea328533b5352629eaab26051641cca5eb1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        gAwK.exe

        • Path C:\Users\Admin\AppData\Local\Temp\gAwK.exe
        • Size 844KB
        • SHA256 a63dbd92de0ae3f338ed2816a7dd56593c5315daf34f729cb5405aeea66be7f8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        gMUC.exe

        • Path C:\Users\Admin\AppData\Local\Temp\gMUC.exe
        • Size 1.3MB
        • SHA256 74872b617320eaf10a17c9f9dd08d13de579ee4132faccae31e83328db73824a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        gsAs.exe

        • Path C:\Users\Admin\AppData\Local\Temp\gsAs.exe
        • Size 219KB
        • SHA256 293d5470e0467b6ed962eab01e4dca6e1d04d1abff5ffe69a7a11efaf275a06e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iksW.exe

        • Path C:\Users\Admin\AppData\Local\Temp\iksW.exe
        • Size 200KB
        • SHA256 68b7f996745f1fa9da3074c84a47109731e8920318d1933533e1cc363edba4d3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ikwm.exe

        • Path C:\Users\Admin\AppData\Local\Temp\ikwm.exe
        • Size 2.8MB
        • SHA256 936466826b2c0780386f224834de177f363d03d461c852d315ba0c4bb932e8a9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        isII.exe

        • Path C:\Users\Admin\AppData\Local\Temp\isII.exe
        • Size 187KB
        • SHA256 4be477ba808b03ac20caf3f9c47b5e5d5de021ac5a7398268ea82ee97714ea7b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        isYC.exe

        • Path C:\Users\Admin\AppData\Local\Temp\isYC.exe
        • Size 241KB
        • SHA256 0461617eea7c4a04a55698f5ca853ed9795705794d70598c60740002d8fb51ec
        • MD5 SHA1 SHA512 SSDEEP TLSH

        kEoA.ico

        • Path C:\Users\Admin\AppData\Local\Temp\kEoA.ico
        • Size 4KB
        • SHA256 f8e8be11d1062a945187b65fc5e5b1500bce03cbdbf6f4af9404b649aacc2aa3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        kMUe.exe

        • Path C:\Users\Admin\AppData\Local\Temp\kMUe.exe
        • Size 198KB
        • SHA256 5c15c457970de286c3231f529760f03afc042b5c1d59c72ec4356af3f59aba67
        • MD5 SHA1 SHA512 SSDEEP TLSH

        mAAy.exe

        • Path C:\Users\Admin\AppData\Local\Temp\mAAy.exe
        • Size 202KB
        • SHA256 a5ff23ad6626befd8b6e1a61c02a2e81d6f82f1483874d0b9213b8d9cb78f870
        • MD5 SHA1 SHA512 SSDEEP TLSH

        mscI.exe

        • Path C:\Users\Admin\AppData\Local\Temp\mscI.exe
        • Size 412KB
        • SHA256 3156c106b897445e5fa0c8f2c7acff6718ddc9bb6ab0200bf8c78b25976daeac
        • MD5 SHA1 SHA512 SSDEEP TLSH

        oAIE.exe

        • Path C:\Users\Admin\AppData\Local\Temp\oAIE.exe
        • Size 200KB
        • SHA256 d4ccf720ae60ca159411ce99dcd98d218b8c2b95bc2da1967362a4539f89e775
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ocog.exe

        • Path C:\Users\Admin\AppData\Local\Temp\ocog.exe
        • Size 236KB
        • SHA256 8e96549f06a46d4897b5c688bfe2fe7587cf5e8eaa650a699bcc52e801385517
        • MD5 SHA1 SHA512 SSDEEP TLSH

        okkU.exe

        • Path C:\Users\Admin\AppData\Local\Temp\okkU.exe
        • Size 181KB
        • SHA256 c642f4ba8431f97e3133c56942e20bd00ee5ad6c60fb362d42cbdcbb34ce026b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        osEO.exe

        • Path C:\Users\Admin\AppData\Local\Temp\osEO.exe
        • Size 841KB
        • SHA256 3072edff972e7864a465bce1c3b96b9936455c30f3f7eecba53ab698720447dc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        qUEI.exe

        • Path C:\Users\Admin\AppData\Local\Temp\qUEI.exe
        • Size 680KB
        • SHA256 42aa0ab8462eba0a90aec0cce44fae54a042d4c41477157888638d12c0dd9f33
        • MD5 SHA1 SHA512 SSDEEP TLSH

        qwQs.exe

        • Path C:\Users\Admin\AppData\Local\Temp\qwQs.exe
        • Size 189KB
        • SHA256 6a79e4c245834b99b6ca1c52307f511fd1851fc935b5f5e1d097522dce1086ad
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sIIs.exe

        • Path C:\Users\Admin\AppData\Local\Temp\sIIs.exe
        • Size 945KB
        • SHA256 8d988a072eb321b4925fe285b9275d318678b0c21b57deec60794a928eb30db1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sYgY.exe

        • Path C:\Users\Admin\AppData\Local\Temp\sYgY.exe
        • Size 310KB
        • SHA256 958810958dc48ba4c2b9175d9cbdbba7bdd4e5df2aea9d7598282c2ff13d5019
        • MD5 SHA1 SHA512 SSDEEP TLSH

        socm.exe

        • Path C:\Users\Admin\AppData\Local\Temp\socm.exe
        • Size 1.4MB
        • SHA256 3a3ad1090105a41dfb80cadfe83c3cff91badcd93b36cf741a04cb86780df5e4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sowS.ico

        • Path C:\Users\Admin\AppData\Local\Temp\sowS.ico
        • Size 4KB
        • SHA256 955ad377b15d14e80d8eb194375f26e0e9e339b1cfc1e4047e16ae0e0f90fe24
        • MD5 SHA1 SHA512 SSDEEP TLSH

        vcredist_x86.exe

        • Path C:\Users\Admin\AppData\Local\Temp\vcredist_x86.exe
        • Size 445KB
        • SHA256 4670e1ecb4b136d81148401cd71737ccf1376c772fa513a3e176b8ce8b8f982d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        wMAC.ico

        • Path C:\Users\Admin\AppData\Local\Temp\wMAC.ico
        • Size 4KB
        • SHA256 701a17a9ee5c9340bae4f0810f103d1f0ca5c03141e0da826139d5b7397a6fb3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        yYAG.exe

        • Path C:\Users\Admin\AppData\Local\Temp\yYAG.exe
        • Size 790KB
        • SHA256 155f8ba84522bb284eda22dbbcb4c33e2bcbef9f1cbaedb2de5d243d62ef23e6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        logo.png

        • Path C:\Users\Admin\AppData\Local\Temp\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\.ba1\logo.png
        • Size 1KB
        • SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
        • MD5 SHA1 SHA512 TLSH

        wixstdba.dll

        • Path C:\Users\Admin\AppData\Local\Temp\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\.ba1\wixstdba.dll
        • Size 126KB
        • SHA256 7f5f8fcfd84132579f07e395e65b44e1b031fe01a299bce0e3dd590131c5cb93
        • MD5 SHA1 SHA512 SSDEEP TLSH

        CopyWatch.wma.exe

        • Path C:\Users\Admin\AppData\Roaming\CompleteSearch\CopyWatch.wma.exe
        • Size 799KB
        • SHA256 5281ff8fdee19ba48fd88739260a2e4ab50039ff0438518f12e3f1523fbb3fcf
        • MD5 SHA1 SHA512 SSDEEP TLSH

        DenyFind.ppt.exe

        • Path C:\Users\Admin\AppData\Roaming\ConnectInstall\DenyFind.ppt.exe
        • Size 539KB
        • SHA256 8e805d2003faf68a9303757829f9a31702c2275636a7d4e05754208c4e89e5e2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        DenyStep.mpg.exe

        • Path C:\Users\Admin\AppData\Roaming\ConnectInstall\DenyStep.mpg.exe
        • Size 1.2MB
        • SHA256 d90beb81a4a6ee7e04d415be18fc46b10c4c3f922a42da9f0eb77f83518564ef
        • MD5 SHA1 SHA512 SSDEEP TLSH

        DisableHide.wma.exe

        • Path C:\Users\Admin\AppData\Roaming\ConvertToExit\DisableHide.wma.exe
        • Size 960KB
        • SHA256 2c4310445eeb23c79817795226ab41c46560371d2dff5ec73f644d020a01eecb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        JoinSave.xls.exe

        • Path C:\Users\Admin\AppData\Roaming\ConvertToExit\JoinSave.xls.exe
        • Size 843KB
        • SHA256 d85f06e41982622763c363f2ba5189bb9c6e9cdef096effece3c0176336bce75
        • MD5 SHA1 SHA512 SSDEEP TLSH

        RegisterApprove.wma.exe

        • Path C:\Users\Admin\AppData\Roaming\ConvertToExit\RegisterApprove.wma.exe
        • Size 638KB
        • SHA256 cee6cc45b34cd4cf9d665d2eb094eb5cef5f42890e247722dcabef4cdafe706f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ResetMerge.zip.exe

        • Path C:\Users\Admin\AppData\Roaming\ConvertToExit\ResetMerge.zip.exe
        • Size 633KB
        • SHA256 9cd9a0d36a6d8637ed59ac5b8190a314de845f5eeab8217337c3580e3b054385
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ConvertToOptimize.pdf.exe

        • Path C:\Users\Admin\AppData\Roaming\ConvertToOptimize.pdf.exe
        • Size 692KB
        • SHA256 d7db426e5c49022bdc7a0b7789ea772ab0a23655b7475623e5733aec0e6a9c4b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        DebugDisable.doc.exe

        • Path C:\Users\Admin\AppData\Roaming\DebugDisable.doc.exe
        • Size 562KB
        • SHA256 07c3825d9c9cb478f87c6a5a1eb129f3c2f66b37de05def4739713af56a806ce
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ExpandEdit.mpg.exe

        • Path C:\Users\Admin\AppData\Roaming\ExpandEdit.mpg.exe
        • Size 516KB
        • SHA256 3a7e94097d416c2ffd3c6258eec4e6a554acae0f7d475c59bf64861951ea46a3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        RequestResolve.gif.exe

        • Path C:\Users\Admin\AppData\Roaming\InstallInitialize\RequestResolve.gif.exe
        • Size 720KB
        • SHA256 652cea80205a8eb6306c07ae0fa256dc2e9b228898b477b32db1e1517d248558
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MoveInstall.pdf.exe

        • Path C:\Users\Admin\AppData\Roaming\InstallRestore\MoveInstall.pdf.exe
        • Size 356KB
        • SHA256 4861165ad024533ed399bb3910f7ab5fe32a163e117d5468ae41616c97b87c10
        • MD5 SHA1 SHA512 SSDEEP TLSH

        NewSave.mp3.exe

        • Path C:\Users\Admin\AppData\Roaming\InstallRestore\NewSave.mp3.exe
        • Size 302KB
        • SHA256 68811b3f4bff82cf2c6dc360b0b66542489026e707f7a18d91571f55eb221818
        • MD5 SHA1 SHA512 SSDEEP TLSH

        CompressStep.bmp.exe

        • Path C:\Users\Admin\AppData\Roaming\RemoveRedo\CompressStep.bmp.exe
        • Size 740KB
        • SHA256 40a111e63f5a77036f788351b947b7d9a3c15f0915bdb81278cbd26e7c5d83a3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        EnterUninstall.xls.exe

        • Path C:\Users\Admin\AppData\Roaming\RemoveRedo\EnterUninstall.xls.exe
        • Size 823KB
        • SHA256 19a10ce4d54b846fd12a76fe1ade43b82ac11883bad8d55889cd1a293588bb6b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        CopyRestore.gif.exe

        • Path C:\Users\Admin\AppData\Roaming\RepairSearch\CopyRestore.gif.exe
        • Size 934KB
        • SHA256 059c41761398ad571dd18746b78f9eb08df58a375bf581b4cadcd056644acf46
        • MD5 SHA1 SHA512 SSDEEP TLSH

        DismountDisable.wma.exe

        • Path C:\Users\Admin\AppData\Roaming\SaveMount\DismountDisable.wma.exe
        • Size 958KB
        • SHA256 db73ee54fb68874b41a9e34cf441d2ea593a4acff2954ebfaac8bf5e12c61809
        • MD5 SHA1 SHA512 SSDEEP TLSH

        StepRemove.ppt.exe

        • Path C:\Users\Admin\AppData\Roaming\SaveMount\StepRemove.ppt.exe
        • Size 503KB
        • SHA256 7c8b1b1e5150cc2de29b63858b713ac8fbbb4367660518a79af607e6564b82e8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        SyncLimit.xls.exe

        • Path C:\Users\Admin\AppData\Roaming\SwitchUninstall\SyncLimit.xls.exe
        • Size 2.0MB
        • SHA256 434025086e849c2c84b9a2c60c5675c39e8133508e2007b727753f8f7468d192
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AssertExpand.jpg.exe

        • Path C:\Users\Admin\Desktop\AssertExpand.jpg.exe
        • Size 767KB
        • SHA256 068d952e7c61a39ed85f2fe3a8548928761c53654f08d1daeefa85a2bdec8edc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        HideReset.wma.exe

        • Path C:\Users\Admin\Desktop\HideReset.wma.exe
        • Size 515KB
        • SHA256 7923ecaa6523a8aee2a354613b2eaaf77d04578932c13b622bb2b32b6a56646d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MountDisconnect.mpg.exe

        • Path C:\Users\Admin\Desktop\MountDisconnect.mpg.exe
        • Size 505KB
        • SHA256 84bb571a55510288ce221d026d3335d2e9c82e027190525be1944cd0d95d1811
        • MD5 SHA1 SHA512 SSDEEP TLSH

        StepUndo.jpg.exe

        • Path C:\Users\Admin\Desktop\StepUndo.jpg.exe
        • Size 594KB
        • SHA256 00a5a46124980bf95697bbad0db2cd0afbbc78c7292e84556cd883f4c85d9554
        • MD5 SHA1 SHA512 SSDEEP TLSH

        CompressOut.jpg.exe

        • Path C:\Users\Admin\Pictures\CompressOut.jpg.exe
        • Size 490KB
        • SHA256 d5db16b73fd74e0b6a5a4878df387f0eef46b3aaa62f34640f4da117d3fd3de4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        FindGrant.png.exe

        • Path C:\Users\Admin\Pictures\FindGrant.png.exe
        • Size 769KB
        • SHA256 d4cd69ddf0b7de1771783a46b98f518752825ee455475032905af0fc9fde5a4c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ReceiveProtect.png.exe

        • Path C:\Users\Admin\Pictures\ReceiveProtect.png.exe
        • Size 522KB
        • SHA256 7d3f13cd8363a7b98da272270902707ce7405561fd10aa616404fb8c490f8da6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        dkdqf.jpg.exe

        • Path C:\Users\Admin\Pictures\dkdqf.jpg.exe
        • Size 217KB
        • SHA256 6ea39f8d4029b1f74238414ee5f5ea87c24489dd0506a5ac7ac8fdeae26abe5f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        NokQowwo.exe

        • Path C:\Users\Admin\zskgIQks\NokQowwo.exe
        • Size 192KB
        • SHA256 0c45ff9dbb93ecca99126ca95b477dcde5d8d4d13ca058f129b6cda2890f3475
        • MD5 SHA1 SHA512 SSDEEP TLSH

        NokQowwo.inf

        • Path C:\Users\Admin\zskgIQks\NokQowwo.inf
        • Size 4B
        • SHA256 3f28a17588c65951bc49290f92bc2efd2352590a7bb4f96f4543e98fae0803ba
        • MD5 SHA1 SHA512

        NokQowwo.inf

        • Path C:\Users\Admin\zskgIQks\NokQowwo.inf
        • Size 4B
        • SHA256 2e302a4a24a209f362e7fba5022eeeedc87f88b440c174d06790e54debaf8704
        • MD5 SHA1 SHA512

        NokQowwo.inf

        • Path C:\Users\Admin\zskgIQks\NokQowwo.inf
        • Size 4B
        • SHA256 a9940339db41295cfe112424402a5f384d8712530f096bf3ca6d05a961722383
        • MD5 SHA1 SHA512

        NokQowwo.inf

        • Path C:\Users\Admin\zskgIQks\NokQowwo.inf
        • Size 4B
        • SHA256 b5796046c093a4e09d593414ba876405133574645ab249f117b70989ba2b1520
        • MD5 SHA1 SHA512

        NokQowwo.inf

        • Path C:\Users\Admin\zskgIQks\NokQowwo.inf
        • Size 4B
        • SHA256 408a288c2f4398a1d1a101acc53de78c34d36766531efbe31afeb8221d0e72ac
        • MD5 SHA1 SHA512

        memory/420-11-0x0000000000400000-0x0000000000430000-memory.dmp

        memory/420-2257-0x0000000000400000-0x0000000000430000-memory.dmp

        memory/1108-0-0x0000000000400000-0x000000000049F000-memory.dmp

        memory/1108-19-0x0000000000400000-0x000000000049F000-memory.dmp

        memory/1488-2262-0x0000000000400000-0x0000000000430000-memory.dmp

        memory/2932-8-0x0000000000400000-0x0000000000431000-memory.dmp

        memory/2932-2252-0x0000000000400000-0x0000000000431000-memory.dmp

        memory/4276-41-0x0000000000400000-0x0000000000431000-memory.dmp

        memory/4276-2267-0x0000000000400000-0x0000000000431000-memory.dmp

        memory/4316-123-0x0000000002970000-0x0000000002A2F000-memory.dmp