cdad0c56640713326eb48e36085e972022009a0f535dab9d3b5259f486cca926

Analysis

max time kernel
149s
max time network
127s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
28/04/2026, 21:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Clash.Verge_2.4.2_x64-6715.msi
Size 45.4MB
Sample260428-1a5pasav5j
SHA256 cdad0c56640713326eb48e36085e972022009a0f535dab9d3b5259f486cca926
MD5 37b7f2eb2fdb538829621f136e217b06
SHA1 7f495882a53cf86c26ef669df16b4da665b6b2e7
SHA512 ff8aeead425c7db2f19359f370c1da9184fbdc3769769d05ba7b097973a33b0e5ae16380db25ce636a5e61a276f801adabe23e98e7e3f054206fca5ca7a7718a
SSDEEP 786432:2cvODZNKMPV23dILYhUx3fDGXvHsxQfu9w/VQ7Yux182pJGlC6LWyZfxK4JMj:2cvq2MPudIkMUvHHfu9w/K7YuskJuDLC
TLSH
T102A73331B68BC635D42C003ADD29FE1E0579AEA3073505E3E3E9BD6E85B48D29374B85
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation ransomware

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3764	powershell.exe

Executes dropped EXE 6 IoCs

pid	Process
2408	MSIE322.tmp
644	MSIE323.tmp
3280	VC_radist.x64.scr
3204	Clash.Verge_2.4.2_x64.exe
4284	ev2f79.exe
4492	ev2c34.exe

Loads dropped DLL 23 IoCs

pid	Process
2232	MsiExec.exe
2232	MsiExec.exe
2232	MsiExec.exe
2232	MsiExec.exe
2232	MsiExec.exe
3280	VC_radist.x64.scr
3204	Clash.Verge_2.4.2_x64.exe
3280	VC_radist.x64.scr
3280	VC_radist.x64.scr
3280	VC_radist.x64.scr
3280	VC_radist.x64.scr
3280	VC_radist.x64.scr
3280	VC_radist.x64.scr
3280	VC_radist.x64.scr
3280	VC_radist.x64.scr
3280	VC_radist.x64.scr
3280	VC_radist.x64.scr
3280	VC_radist.x64.scr
3280	VC_radist.x64.scr
3204	Clash.Verge_2.4.2_x64.exe
3204	Clash.Verge_2.4.2_x64.exe
3280	VC_radist.x64.scr
3204	Clash.Verge_2.4.2_x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\vss_tmp.txt	vssvc.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
2084	tasklist.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Community\All-in-One Messenger Hub Installer.exe	VC_radist.x64.scr

Drops file in Windows directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE208.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE322.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e57df15.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{4XF15BQO-ZYJ1-RUQ1-TAWJ-9E6GH2EULRDL}	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE00F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE0DB.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE10B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE11C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE323.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFDBECF8E99E157C06.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF4067747487C1FE3B.TMP	msiexec.exe
File created	C:\Windows\Installer\e57df15.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE13C.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFE1FE2404DE53C024.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF74CE9C85E47DB686.TMP	msiexec.exe

Access Token Manipulation: Create Process with Token 1 TTPs 2 IoCs

defense_evasion privilege_escalation

Create Process with Token

T1134.002

pid	Process
644	MSIE323.tmp
2408	MSIE322.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
3672	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ev2c34.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Clash.Verge_2.4.2_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ev2f79.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSIE322.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSIE323.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_radist.x64.scr

Modifies data under HKEY_USERS 46 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	vssvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	vssvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	vssvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	vssvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	vssvc.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3312	msiexec.exe
3312	msiexec.exe
3764	powershell.exe
3764	powershell.exe
4284	ev2f79.exe
4284	ev2f79.exe
236	vssvc.exe
236	vssvc.exe
4284	ev2f79.exe
4284	ev2f79.exe
236	vssvc.exe
4492	ev2c34.exe
4492	ev2c34.exe
4492	ev2c34.exe
4492	ev2c34.exe
4492	ev2c34.exe
4492	ev2c34.exe
4492	ev2c34.exe
4492	ev2c34.exe
4492	ev2c34.exe
4492	ev2c34.exe
5096	UserAccountBroker.exe
5096	UserAccountBroker.exe
3804	edpnotify.exe
3804	edpnotify.exe
3804	edpnotify.exe
3804	edpnotify.exe
3804	edpnotify.exe
3804	edpnotify.exe
3804	edpnotify.exe
3804	edpnotify.exe
3804	edpnotify.exe
3804	edpnotify.exe
3804	edpnotify.exe
3804	edpnotify.exe
3804	edpnotify.exe
3804	edpnotify.exe
3804	edpnotify.exe
3804	edpnotify.exe
3804	edpnotify.exe
3804	edpnotify.exe
3804	edpnotify.exe
3804	edpnotify.exe
3804	edpnotify.exe
3804	edpnotify.exe
3804	edpnotify.exe
3804	edpnotify.exe
3804	edpnotify.exe
3804	edpnotify.exe
3804	edpnotify.exe
3804	edpnotify.exe
3804	edpnotify.exe
3804	edpnotify.exe
3804	edpnotify.exe
3804	edpnotify.exe
3804	edpnotify.exe
3804	edpnotify.exe
3804	edpnotify.exe
3804	edpnotify.exe
3804	edpnotify.exe
3804	edpnotify.exe
3804	edpnotify.exe
3804	edpnotify.exe
3804	edpnotify.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5096	UserAccountBroker.exe

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
4284	ev2f79.exe
236	vssvc.exe
4284	ev2f79.exe
4492	ev2c34.exe
4492	ev2c34.exe
4492	ev2c34.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3672	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3672	msiexec.exe
Token: SeSecurityPrivilege	3312	msiexec.exe
Token: SeCreateTokenPrivilege	3672	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3672	msiexec.exe
Token: SeLockMemoryPrivilege	3672	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3672	msiexec.exe
Token: SeMachineAccountPrivilege	3672	msiexec.exe
Token: SeTcbPrivilege	3672	msiexec.exe
Token: SeSecurityPrivilege	3672	msiexec.exe
Token: SeTakeOwnershipPrivilege	3672	msiexec.exe
Token: SeLoadDriverPrivilege	3672	msiexec.exe
Token: SeSystemProfilePrivilege	3672	msiexec.exe
Token: SeSystemtimePrivilege	3672	msiexec.exe
Token: SeProfSingleProcessPrivilege	3672	msiexec.exe
Token: SeIncBasePriorityPrivilege	3672	msiexec.exe
Token: SeCreatePagefilePrivilege	3672	msiexec.exe
Token: SeCreatePermanentPrivilege	3672	msiexec.exe
Token: SeBackupPrivilege	3672	msiexec.exe
Token: SeRestorePrivilege	3672	msiexec.exe
Token: SeShutdownPrivilege	3672	msiexec.exe
Token: SeDebugPrivilege	3672	msiexec.exe
Token: SeAuditPrivilege	3672	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3672	msiexec.exe
Token: SeChangeNotifyPrivilege	3672	msiexec.exe
Token: SeRemoteShutdownPrivilege	3672	msiexec.exe
Token: SeUndockPrivilege	3672	msiexec.exe
Token: SeSyncAgentPrivilege	3672	msiexec.exe
Token: SeEnableDelegationPrivilege	3672	msiexec.exe
Token: SeManageVolumePrivilege	3672	msiexec.exe
Token: SeImpersonatePrivilege	3672	msiexec.exe
Token: SeCreateGlobalPrivilege	3672	msiexec.exe
Token: SeRestorePrivilege	3312	msiexec.exe
Token: SeTakeOwnershipPrivilege	3312	msiexec.exe
Token: SeRestorePrivilege	3312	msiexec.exe
Token: SeTakeOwnershipPrivilege	3312	msiexec.exe
Token: SeRestorePrivilege	3312	msiexec.exe
Token: SeTakeOwnershipPrivilege	3312	msiexec.exe
Token: SeRestorePrivilege	3312	msiexec.exe
Token: SeTakeOwnershipPrivilege	3312	msiexec.exe
Token: SeRestorePrivilege	3312	msiexec.exe
Token: SeTakeOwnershipPrivilege	3312	msiexec.exe
Token: SeRestorePrivilege	3312	msiexec.exe
Token: SeTakeOwnershipPrivilege	3312	msiexec.exe
Token: SeRestorePrivilege	3312	msiexec.exe
Token: SeTakeOwnershipPrivilege	3312	msiexec.exe
Token: SeRestorePrivilege	3312	msiexec.exe
Token: SeTakeOwnershipPrivilege	3312	msiexec.exe
Token: SeRestorePrivilege	3312	msiexec.exe
Token: SeTakeOwnershipPrivilege	3312	msiexec.exe
Token: SeRestorePrivilege	3312	msiexec.exe
Token: SeTakeOwnershipPrivilege	3312	msiexec.exe
Token: SeRestorePrivilege	3312	msiexec.exe
Token: SeTakeOwnershipPrivilege	3312	msiexec.exe
Token: SeDebugPrivilege	2084	tasklist.exe
Token: SeDebugPrivilege	3764	powershell.exe
Token: SeDebugPrivilege	4284	ev2f79.exe
Token: SeBackupPrivilege	236	vssvc.exe
Token: SeRestorePrivilege	236	vssvc.exe
Token: SeAuditPrivilege	236	vssvc.exe
Token: SeDebugPrivilege	236	vssvc.exe
Token: SeDebugPrivilege	236	vssvc.exe
Token: SeAssignPrimaryTokenPrivilege	236	vssvc.exe
Token: SeIncreaseQuotaPrivilege	236	vssvc.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3672	msiexec.exe
3672	msiexec.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3312 wrote to memory of 2232	3312	msiexec.exe	80
PID 3312 wrote to memory of 2408	3312	msiexec.exe	81
PID 3312 wrote to memory of 644	3312	msiexec.exe	82
PID 3280 wrote to memory of 4984	3280	VC_radist.x64.scr	85
PID 4984 wrote to memory of 2084	4984	cmd.exe	87
PID 4984 wrote to memory of 4436	4984	cmd.exe	88
PID 3280 wrote to memory of 1632	3280	VC_radist.x64.scr	90
PID 1632 wrote to memory of 1328	1632	cmd.exe	92
PID 1328 wrote to memory of 3764	1328	cmd.exe	93
PID 3280 wrote to memory of 4284	3280	VC_radist.x64.scr	94
PID 3280 wrote to memory of 4492	3280	VC_radist.x64.scr	96

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Clash.Verge_2.4.2_x64-6715.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3672

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3312
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 4BAE7A3D3CB0260661529B7E9642CD1C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2232
- C:\Windows\Installer\MSIE322.tmp
  "C:\Windows\Installer\MSIE322.tmp" /EnforcedRunAsAdmin /DontWait "C:\Users\Admin\AppData\Roaming\Clash.Verge\Clash.Verge_2.4.2_x64\Clash.Verge_2.4.2_x64.exe"
  2⤵
  - Executes dropped EXE
  - Access Token Manipulation: Create Process with Token
  - System Location Discovery: System Language Discovery
  PID:2408
- C:\Windows\Installer\MSIE323.tmp
  "C:\Windows\Installer\MSIE323.tmp" /EnforcedRunAsAdmin /DontWait "C:\ProgramData\6sxK3v\VC_radist.x64.scr"
  2⤵
  - Executes dropped EXE
  - Access Token Manipulation: Create Process with Token
  - System Location Discovery: System Language Discovery
  PID:644

C:\ProgramData\6sxK3v\VC_radist.x64.scr
"C:\ProgramData\6sxK3v\VC_radist.x64.scr" /S
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3280
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C tasklist | findstr /I /C:"360tray.exe" /C:"HipsTray.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4984
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2084
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I /C:"360tray.exe" /C:"HipsTray.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4436
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C start "" /B cmd.exe /C "powershell Add-MpPreference -ExclusionPath C:\,D:\,F:\"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1632
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /C "powershell Add-MpPreference -ExclusionPath C:\,D:\,F:\"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1328
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell Add-MpPreference -ExclusionPath C:\,D:\,F:\
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3764
- C:\Users\Admin\AppData\Roaming\comain_ev2f79\ev2f79.exe
  "C:\Users\Admin\AppData\Roaming\comain_ev2f79\ev2f79.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  PID:4284
- C:\Users\Admin\AppData\Roaming\comain_ev2c34\ev2c34.exe
  "C:\Users\Admin\AppData\Roaming\comain_ev2c34\ev2c34.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:4492

C:\Users\Admin\AppData\Roaming\Clash.Verge\Clash.Verge_2.4.2_x64\Clash.Verge_2.4.2_x64.exe
"C:\Users\Admin\AppData\Roaming\Clash.Verge\Clash.Verge_2.4.2_x64\Clash.Verge_2.4.2_x64.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3204

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:236

C:\Windows\System32\UserAccountBroker.exe
C:\Windows\System32\UserAccountBroker.exe
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:5096

C:\Windows\System32\edpnotify.exe
C:\Windows\System32\edpnotify.exe
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3804

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Access Token Manipulation

T1134

Create Process with Token

T1134.002

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Access Token Manipulation

T1134

Create Process with Token

T1134.002

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e57df18.rbs

Path C:\Config.Msi\e57df18.rbs
Size 840KB
SHA256 0a2dfd236a6088770d8fe2ce182b5a735255357309ab84c446ec22c81ddb10e9
MD5 10c1ac3ccae52598a6fe598b859674dc
SHA1 cc6c4df529ebe30a001b1f495f9d82e8fba15735
SHA512 dc13a5a1e4f96871811b61c3ef223d921753f219540eb196b907e98fe9a07ab678f4975bf9f73fd4364dfb361340d78f8edfff19486576f40b657889cc9383cf
SSDEEP 24576:QSlEKSDB8pDESD30TidMgWZ5H1W5SlEKSDB8pDESD30TidMgWZ5H1Wc:QZDB8pDESD30TimgS5VW5ZDB8pDESD3E
TLSH
T145059D223AD2D433D8B211701F69EBB5567DE9700B6209CFA3E46E6E1E74AC15732B13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VC_radist.x64.scr

Path C:\ProgramData\6sxK3v\VC_radist.x64.scr
Size 10.4MB
SHA256 fc7f0a1c4c9a75dc10f98eb4c582482204185bc7656c2d3bbaeb034a334a63ec
MD5 73a17975225e45482af7fdb49223415b
SHA1 45939d1f59a122b120a92b752ac76daf54bfd4de
SHA512 65e464a2be09d09124f43f9a3c9675b7f19c8b1d521f54824e3fd75fb796fe2c11c5caa8a8aa9e36c2a3b51cb5498bb584f252c3fc48320df12bea03cf83ae5c
SSDEEP 196608:07KSi4SQMgQGo8A85zu5U2dcHh7LKpLZPKnpPaojbSW5nOdsUPm9LCF:0+VQfu8AEsGmL+pPdjbSZdPm9LE
TLSH
T150B633518141B280D8743275C87FE45A83D9C74E1AFFE9F4CA2BD6849EF40668192BFB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_wixlho4q.jnc.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wixlho4q.jnc.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

cache.dat

Path C:\Users\Admin\AppData\Local\Temp\cache.dat
Size 260B
SHA256 04871b2a9962fd00c86f1a78b4339ec1a3cfda66f2cd466d51bffbac7a0167c3
MD5 1cdc29bab5e0d7729767df4efcd88296
SHA1 71856bf41c8bc058faaecb537f6efc004fd32eb3
SHA512 f5f6db88409cc7b0fa79bae43726cf2a38357f8511c93ee7ae081212a6f64d4e3948005910cee1ec78d0d0d79f05beed3d6a4adcd9b6dfe20f3cc21ad8227096
TLSH
T192D02BE447A0B3DF16B201A3D11E7D3E26158050605728209ED9753026F8887492702E
MD5 SHA1 SHA512 TLSH

Submit Download

LangDLL.dll

Path C:\Users\Admin\AppData\Local\Temp\nsnE5FD.tmp\LangDLL.dll
Size 5KB
SHA256 18e8b40ba22c7a1687bd16e8d585380bc2773fff5002d7d67e9485fcc0c51026
MD5 68b287f4067ba013e34a1339afdb1ea8
SHA1 45ad585b3cc8e5a6af7b68f5d8269c97992130b3
SHA512 06c38bbb07fb55256f3cdc24e77b3c8f3214f25bfd140b521a39d167113bf307a7e8d24e445d510bc5e4e41d33c9173bb14e3f2a38bc29a0e3d08c1f0dca4bdb
SSDEEP 48:S46+/nTKYKxbWsptIpBtWZ0iV8jAWiAJCvxft2O2B8mFofjLl:zFuPbOBtWZBV8jAWiAJCdv2Cm0L
TLSH
T16BC19474B3C248B9C491513768AB33D36612EE746784500F9F6711AA38209F7AD3EBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartMenu.dll

Path C:\Users\Admin\AppData\Local\Temp\nsnE5FD.tmp\StartMenu.dll
Size 7KB
SHA256 42dd4dda3249a94e32e20f76eaffae784a5475ed00c60ef0197c8a2c1ccd2fb7
MD5 d070f3275df715bf3708beff2c6c307d
SHA1 93d3725801e07303e9727c4369e19fd139e69023
SHA512 fcaf625dac4684dad33d12e3a942b38489ecc90649eee885d823a932e70db63c1edb8614b9fa8904d1710e9b820e82c5a37aeb8403cf21cf1e3692f76438664d
SSDEEP 96:h8dPIKJhMuhik+CfoEwknt6io8zv+qy5/utta/H3lkCTcaqHCI:yZIKXgk+cx6QYFkAXlncviI
TLSH
T1CCF1C7B6F3D10673F9AB427428232F221B1AF5215765C1AB450316CE7661CE3FD34B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsnE5FD.tmp\System.dll
Size 12KB
SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
MD5 cff85c549d536f651d4fb8387f1976f2
SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
TLSH
T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsnE5FD.tmp\nsDialogs.dll
Size 9KB
SHA256 56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
MD5 6c3f8c94d0727894d706940a8a980543
SHA1 0d1bcad901be377f38d579aafc0c41c0ef8dcefd
SHA512 2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355
SSDEEP 96:o0svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YcNqkzfS:o0svWyNO81b8pCHFcM0PuAgkOyuIFc
TLSH
T17012F992E6A450B3C5D6533B35AA2F2DCBBD5325B0926C00C7738E4D39395B66E38353
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DcryptDll.dll

Path C:\Users\Admin\AppData\Local\Temp\nssE4E4.tmp\DcryptDll.dll
Size 20KB
SHA256 0acb047f854771e2d5f5e7a3a2c8e261c86223988b2b6b00036fe64df994b537
MD5 dae9510ff635d69e6f841335f659ab7b
SHA1 1a78168b8fde21b8c7abb1021a7cc1e6a8815ff5
SHA512 5abcc0e7f414284ccd02da6c0ca302d1bfd00824c9e062b3b89c683cf856ab7a9f81a3f087cf4e4718ef37a8228bfe3e075ed751d8e340433732ede6eb3210b3
SSDEEP 384:KXu/2dddTTSUPMVDFkVHEC7NyGwYO6MhCLXXC033:UuediDF07NyGwThCLXS0
TLSH
T160920A00C6D10410D0BA6275BAF959228CB93E312476111FFFF64A6BADB4AD76B37732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nssE4E4.tmp\nsExec.dll
Size 7KB
SHA256 3a101fa91d4e8831dfb748a1e345ab74fd4a551e64254710bdf53972ba9b473c
MD5 c953dd0aab774f1446fcd63fa7c5f613
SHA1 6b7e1ef30b3ce2b353d310a8c99111c01e1f752e
SHA512 7fdfc451ada1789ad44a33fee7a97acf9f482ae58b5207564ce8ac90fbc8b0fc891bc02d8c1d9a1d0d3fb77954106115582080e129bb93634a2cb16777201e14
SSDEEP 96:JbzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHwDQ:JEQHDb2vSuOc41ZfUNQZGdHo
TLSH
T15EE1093571C02DF7D08D897438167D2F83F4D52627BA05A046771AD579D0AF6EE28B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uk_tmp.txt

Path C:\Users\Admin\AppData\Local\Temp\uk_tmp.txt
Size 1B
SHA256 2d711642b726b04401627ca9fbac32f5c8530fb1903cc4db02258717921a4881
MD5 9dd4e461268c8034f5c8564e155c67a6
SHA1 11f6ad8ec52a2984abaafd7c3b516503785c2072
SHA512 a4abd4448c49562d828115d13a1fccea927f52b4d5459297f8b43e42da89238bc13626e43dcb38ddb082488927ec904fb42057443983e88585179d50551afe62
MD5 SHA1 SHA512

Submit Download

Clash.Verge_2.4.2_x64.exe

Path C:\Users\Admin\AppData\Roaming\Clash.Verge\Clash.Verge_2.4.2_x64\Clash.Verge_2.4.2_x64.exe
Size 33.2MB
SHA256 217b1eac4f56ce9f599db727aae1f915ceb456f1094bf15cf635ce237024e8a5
MD5 cb2fcf4948c9a9b87a07d0476a96e903
SHA1 896184076c61bf3ef2a4f5fc79f93156dc42f18f
SHA512 5f06ea09aaefda071fef785a72b479833a1c42c4b2ab021daa9984033ee710d7bed81c74bb4ea3033ef9526e65107bc4e58a60578cad7bebf75aa7dd565edf95
SSDEEP 786432:q6tLA1IQqEcpHtNMaTiw45/iO0xwHcREdNtT0wdGNHEH7TTty:q6tLswEc7NMq1ZxwSEdNtTjdGNYXT4
TLSH
T12A77336CA98C0A3CD82E48786B3D7C664FBD4A4761DE0FA5C296CC05D31E974A358DDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ap.asin

Path C:\Users\Admin\AppData\Roaming\comain_ev2c34\ap.asin
Size 260B
SHA256 7fda8b778ec420a0a12339b22172b03006be5cf1c719e60f47a462c00e58b3cc
MD5 e049b5f3e2105ff3a87536da8d58c2f5
SHA1 bc8c23f8de9dcc0c93cf75a4e58cf915d387ad8c
SHA512 1dd0cda1545e1f24ec1abbed8cc7610eab9b1c21506a632895e8120d00557e54339bd176f09a0d6b859436f5500184802364e84a96200576f9ca172754088a1d
TLSH
T110D02B26D354F773B16A2F1C0818503A1851F691221745071C164861F331250F496528
MD5 SHA1 SHA512 TLSH

Submit Download

bnymir.ou

Path C:\Users\Admin\AppData\Roaming\comain_ev2c34\bnymir.ou
Size 403KB
SHA256 311f644a8cc871e9fde0dbf9126189f11cf14534d8aadd824954595b56dbe5d8
MD5 665dc9cb1017f75370dead01c35e5342
SHA1 92be12e735b77849181d94779fec0efcf26342b5
SHA512 072bc616feb46a3f297671bbef8c2cf7a15416b95d3cacb2bc87ba0db6269d02c95d3dd6c51dd941398d367b4aca8a948e3f5e73f276d52ba150d8fff2c002e9
SSDEEP 12288:h47eobnoU0GOxiz2QQIl8yrjroV9ueRvu:G7hUT3xiz+uLrfoV9ueRvu
TLSH
T12494BF6A2C3FAE681ABC41A7F94C11577DF21FD8ABEDC132C24DCD1917D10899AB8193
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bteuns.pt

Path C:\Users\Admin\AppData\Roaming\comain_ev2c34\bteuns.pt
Size 533KB
SHA256 c56bba6fd6236e30d9b5bb7ffea33079a143819fe1f08db346ff7b96acc9cf00
MD5 202faa607d44d8350d8d5ab435a8e81e
SHA1 244389e040acd9798f1960135b4b37e7711356fc
SHA512 31fe7f1baf7ab2964ca468a686a00e724f5466daf949df5173e4bf3ed575c3651447f990e72f2c0465c8762d258f1238f80ee6948f09bf6d979bee62b66757af
SSDEEP 12288:hU43LGMwhDLctEYGzqIx+Tsj/KKKKXE49ckVd:K43LXwm38VEEckVd
TLSH
T1FFC47D57193E7D0D26E05293B81C49D37DF223809AEDD031D39D9E6816C6A2EA9F12F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cmrsk.ce

Path C:\Users\Admin\AppData\Roaming\comain_ev2c34\cmrsk.ce
Size 166KB
SHA256 32c1efcf15430df8e87207bde1916c807378edf6bd9552f02aeb6d50ac56f752
MD5 5b0756dc69ec9ed4b6dc5f4948d00c91
SHA1 e6938bbe27ba077f95b925c92c8c5e71875c76cb
SHA512 a16cfbbfec0311cded46376ca2d04bffbeb36c3f80e84ae2052671bf2bc6a8370d293a8df606b2f311914f90513cdbe393c99533284f5a6c4532b49b4bfb0c1d
SSDEEP 3072:hhIKRyikUOIya0rhMcnSfTSFqeSy4In48H0gFuHNJbmeqdyYV5gY:hh+ta09McS72+vI4dgOxigY
TLSH
T1D4F39EA7297D6FB839684183344C04975F651360AFEECD32C39ECF1409A66A726F817B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ev2c34.exe

Path C:\Users\Admin\AppData\Roaming\comain_ev2c34\ev2c34.exe
Size 1.1MB
SHA256 a15576aa6727182e18cbb91512d593767eec42d3bc9496a766c329694fbdc441
MD5 4a1940c7228bb6ef0b34d48b3e13b05f
SHA1 4fe78ee3d076854f145cc4e9c086a39d499e8f5e
SHA512 0af8a58756240fc18fe2db769165f7cdf7a12595eb67559d59e7a0e7971c7d33dbe59167a24028a27dc7f179b50822616c12286436ffaa6bebe3851febca4c30
SSDEEP 24576:6vpH41Cl36RgrO/+6WdKHsJYrrg0H+2UbDC:gmVpOY3gH2UbD
TLSH
T15745DF41BBF2C1B7D7C241B108A6871E0633ADD2279E9EC7F7D43D599D702D92A3A280
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fhkan.oi

Path C:\Users\Admin\AppData\Roaming\comain_ev2c34\fhkan.oi
Size 180KB
SHA256 4846e03250931965df77d4fb897fb3d100d451b72a7910a2840630195cfe1246
MD5 30806c3b99d158af70ad6448bfdd7716
SHA1 d557aac16144b0ff77759b7562aeef6c346ab110
SHA512 04e1e86c842870f02401cd42668095a81bb6c1b3e8c47bebf7d333453453a6ce65442339ff5ce1f51317b471c0f31e0afa7d877aaa861535273c8f944bd4aac9
SSDEEP 3072:Xhhg05n4/1J42BVXU9w9x32R68wJZzjz+Ifwaa65LjI2ccF6SarDEFzjqF3:Rhge4tJ4UEG9xZfIaaAjI29narDEY3
TLSH
T1B104BEA4434BEF34AD5E41E3B0611D9AA3E9308CF2DC6354AB9B8D2104D857F67F9293
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxyvnb.ti

Path C:\Users\Admin\AppData\Roaming\comain_ev2f79\dxyvnb.ti
Size 56KB
SHA256 2ede6fc732c291281f5e51563a4239e38bc9cc57c42719836d51690edf46c525
MD5 02fd4fd8807ff36f506029f6d161c6ea
SHA1 725066f05fb2dcdb6d50b398beb5556ce817cf70
SHA512 71714a3696a1e4ddfa55fbadee60727efcf246a53c6ac2f2fc112e14d562f61b231dca120cc67bc665d510bee2d136df1937ba7c76da9dc7bebbb67c6ffc5ae8
SSDEEP 1536:+2xNv/qrXz0t8NADTop9ObO7BqTfHw+gPRRwZB1p04:+2xNSgt8N7wb4qT3gMNpB
TLSH
T19143CF440289AFA2F154C3737E59D98706D89F802FAA7537A3D8BD252C58F7B75F8022
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ev2f79.exe

Path C:\Users\Admin\AppData\Roaming\comain_ev2f79\ev2f79.exe
Size 790KB
SHA256 8f282cb612dba43f0807065b46f3410305ba83a466bfb838d2e8a1d03a55807d
MD5 32d35494c42b3b4702c7703d4a0012b1
SHA1 9d5ed2321f866cc2050a5cf9135f5ec4dcd2ae6a
SHA512 5f9a29447588c7ebcecab4d3d1bef417496efcde19a06237c31ed5abca8c0819d440abf699947ccee877254fe62b99450587ccf9111fd30522837d91f9b64d8b
SSDEEP 12288:Ss1yfEcpPzdv+t4cRIy3ze3SUN0PXGTjiqRy2p3kwzjGHTkV:3wfLrvi4cRIyDe3SUNaXy+WypoGHgV
TLSH
T1F105F10020D5CC73E4EB32B3843586746EBA7E912F0A285B7FC476AEE673176DA71215
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntrin.er

Path C:\Users\Admin\AppData\Roaming\comain_ev2f79\ntrin.er
Size 168KB
SHA256 0250643af857245804b1836a240104cd8122c995d1e63f45c6ab6cb4d1065532
MD5 423ea290beb120f487d6831083dd1f87
SHA1 beec3f71d604ebbeef52bd03407b1fa52e68c2d9
SHA512 082915fe636a6bf88dee3eba9153b75542b049d82878b510cce7dd633b83b53cc8b81db513ed5a47f3d67b715f7e45c5c4182ffc14fcf36b89552e149721f553
SSDEEP 3072:kS4Cu9rV+QT6ZfRiflr3PQ1InKMzjVFPumXrA29hJ6QSxHPmbrF8vodrQOs+:keFRi7kIKMz7Bhs+
TLSH
T1BBF38DA32C6C9F78B9689183384C45930F641760AFEE9D33839ECF6505E65A762F412F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

otrm.oi

Path C:\Users\Admin\AppData\Roaming\comain_ev2f79\otrm.oi
Size 141KB
SHA256 75100bebbc67795bdcec4e17ef4401fe00a14cbcff6857cbad251d1e103e6568
MD5 4f34e7b095fcf44d33a32678ae2bf4ed
SHA1 710bd2b928195313b93f344731cdb170526b8450
SHA512 d486cc8141741e8573bde5095a9a65961248ba68b23b6eb83e9509f1461305c8dbe20a9a9deefc7000982c17aff21bdb7c5671158969ee18d5e832c43f8f0da8
SSDEEP 3072:VPnjsfA/w3bauehUsF5P0TBdyDAsJqspCMa4qS9GBDrFs:VgfA/w3baJhUsHPLaMa499iDe
TLSH
T10DE37B58470A6F74ED6E81F3F9106EE8A6D82040F28D6797BF1ECD9108A413B46F6793
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yinma.vc

Path C:\Users\Admin\AppData\Roaming\comain_ev2f79\yinma.vc
Size 478KB
SHA256 cc734def371a00e17d744833b7a61f030051d0149712fba9d63bb7400271b12a
MD5 cb2c7240e7b48f49f0f140a0ab5fcc51
SHA1 5732767b46198f321d73fb4a9395fb44de3803b3
SHA512 476651d071cdad81fc10ed4d23857b47cccb0a7d686fe94e8deee220d78d81d02532291f8c044c4965cec5d90734cfe9bfd35da61f961e316fec70d0a4d37b81
SSDEEP 12288:HCsJxcMXlPRu2/Awl6kdd2a+Ih9CTnRdzpo8:HCsJSMlJu2/Awl6kddf+ysRdzpo8
TLSH
T100A40919149AAF398180484F7A1DD121A977DB48D22FE23198A9EC1A7DE4F21DFFC1C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIE00F.tmp

Path C:\Windows\Installer\MSIE00F.tmp
Size 587KB
SHA256 e140990b509dd6884a5742bde64f2cdaa10012d472b0b32de43ebecbc83242b6
MD5 c7fbd5ee98e32a77edf1156db3fca622
SHA1 3e534fc55882e9fb940c9ae81e6f8a92a07125a0
SHA512 8691ac8b214cc1e4f34a3ab2bbc0c2391f7f11ebbe5db0dc82825195b5fe5a05310ed1e14d253a9b74a64050d2f2a6623dd2fcd912f80fef51e51845ef1e3a1a
SSDEEP 6144:LSf3W3yLp5AT43trDB8ioyF29qG/NZHLM53PPAOliBU55vjwfM2s3FJT1:LSuyb+4xB49qGl0X2G5pjwfM2s3Fj
TLSH
T104D44921369AC036D56D05B02DA8DBAB516EBE764B7658DBA3D81E3F85F08C25330F13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIE323.tmp

Path C:\Windows\Installer\MSIE323.tmp
Size 419KB
SHA256 f1dd0dd1e83b28ffa2ed30f46f98e94a4919ec1f4e9d33720354288b77153774
MD5 cac0eaeb267d81cf3fa968ee23a6af9d
SHA1 cf6ae8e44fb4949d5f0b01b110eaba49d39270a2
SHA512 8edf9f733dda9000a6e2b70da61912dbc15f74c836d738391ceddcdff20f5b420a678450523cf331aa9bce90217aa92ac6e73d1880ae15c9842ccc7d3296f95b
SSDEEP 12288:vSEwEKSDBIvpDESD3u8aTiAepHqgWv+l65331lQ:vSlEKSDB8pDESD30TidMgWZ5H1W
TLSH
T169949D223AD2D433D8B211701F69EBB5567DE9700B6209DFA3E42E6E1E74AC15732B13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/236-162-0x000001618C4A0000-0x000001618C4C2000-memory.dmp

Download

memory/236-457-0x000001618C220000-0x000001618C22C000-memory.dmp

Download

memory/236-183-0x00000161A4E40000-0x00000161A4E4A000-memory.dmp

Download

memory/236-181-0x00000161A4D60000-0x00000161A4D7C000-memory.dmp

Download

memory/236-182-0x00000161A4D80000-0x00000161A4E33000-memory.dmp

Download

memory/236-134-0x0000000180000000-0x000000018007D000-memory.dmp

Download

memory/236-459-0x000001618BE10000-0x000001618BE18000-memory.dmp

Download

memory/236-152-0x000001618C240000-0x000001618C24C000-memory.dmp

Download

memory/236-458-0x000001618C280000-0x000001618C292000-memory.dmp

Download

memory/236-185-0x00000161A4E70000-0x00000161A4E8C000-memory.dmp

Download

memory/644-50-0x0000000000C50000-0x0000000000D9D000-memory.dmp

Download

memory/2232-45-0x0000000002590000-0x00000000026DD000-memory.dmp

Download

memory/2408-49-0x00000000016E0000-0x000000000182D000-memory.dmp

Download

memory/3204-452-0x00000000008C0000-0x0000000000A0D000-memory.dmp

Download

memory/3280-451-0x0000000000890000-0x00000000009DD000-memory.dmp

Download

memory/3312-538-0x000001AE73A20000-0x000001AE73D98000-memory.dmp

Download

memory/3312-242-0x000001AE73A20000-0x000001AE73D98000-memory.dmp

Download

memory/3312-580-0x000001AE73A20000-0x000001AE73D98000-memory.dmp

Download

memory/3312-587-0x000001AE73A20000-0x000001AE73D98000-memory.dmp

Download

memory/3672-46-0x000001F57DC90000-0x000001F57E008000-memory.dmp

Download

memory/3764-184-0x00000000081B0000-0x0000000008246000-memory.dmp

Download

memory/3764-161-0x0000000007190000-0x00000000071C4000-memory.dmp

Download

memory/3764-186-0x0000000008120000-0x0000000008131000-memory.dmp

Download

memory/3764-187-0x0000000008160000-0x000000000816E000-memory.dmp

Download

memory/3764-188-0x0000000008170000-0x0000000008185000-memory.dmp

Download

memory/3764-189-0x0000000008270000-0x000000000828A000-memory.dmp

Download

memory/3764-190-0x0000000008250000-0x0000000008258000-memory.dmp

Download

memory/3764-193-0x0000000001180000-0x000000000132C000-memory.dmp

Download

memory/3764-194-0x0000000005E70000-0x0000000006512000-memory.dmp

Download

memory/3764-195-0x00000000055E0000-0x00000000055E6000-memory.dmp

Download

memory/3764-173-0x0000000007F10000-0x0000000007F2A000-memory.dmp

Download

memory/3764-172-0x0000000008550000-0x0000000008BCA000-memory.dmp

Download

memory/3764-171-0x0000000007DD0000-0x0000000007E74000-memory.dmp

Download

memory/3764-174-0x0000000007F80000-0x0000000007F8A000-memory.dmp

Download

memory/3764-163-0x0000000070B90000-0x0000000070BDC000-memory.dmp

Download

memory/3764-70-0x0000000002D10000-0x0000000002D46000-memory.dmp

Download

memory/3764-170-0x0000000007DB0000-0x0000000007DCE000-memory.dmp

Download

memory/3764-95-0x0000000005840000-0x0000000005E6A000-memory.dmp

Download

memory/3764-106-0x0000000005760000-0x0000000005782000-memory.dmp

Download

memory/3764-107-0x0000000006610000-0x0000000006676000-memory.dmp

Download

memory/3764-119-0x0000000006BF0000-0x0000000006C3C000-memory.dmp

Download

memory/3764-108-0x0000000006680000-0x00000000066E6000-memory.dmp

Download

memory/3764-115-0x00000000066F0000-0x0000000006A47000-memory.dmp

Download

memory/3764-116-0x0000000006BC0000-0x0000000006BDE000-memory.dmp

Download

memory/3804-475-0x0000000180000000-0x000000018008C000-memory.dmp

Download

memory/4284-129-0x0000000010000000-0x0000000010027000-memory.dmp

Download

memory/4284-151-0x0000000010000000-0x0000000010027000-memory.dmp

Download

memory/4284-128-0x0000000010000000-0x0000000010027000-memory.dmp

Download

memory/4284-127-0x0000000010000000-0x0000000010027000-memory.dmp

Download

memory/4284-130-0x0000000010000000-0x0000000010027000-memory.dmp

Download

memory/4284-122-0x0000000010000000-0x0000000010027000-memory.dmp

Download

memory/4492-267-0x0000000010000000-0x0000000010031000-memory.dmp

Download

memory/4492-261-0x0000000010000000-0x0000000010031000-memory.dmp

Download

memory/4492-489-0x0000000010000000-0x0000000010031000-memory.dmp

Download

memory/4492-490-0x00000000008A0000-0x00000000009ED000-memory.dmp

Download

memory/4492-268-0x0000000010000000-0x0000000010031000-memory.dmp

Download

memory/4492-270-0x0000000010000000-0x0000000010031000-memory.dmp

Download

memory/4492-269-0x0000000010000000-0x0000000010031000-memory.dmp

Download

memory/5096-497-0x0000021E00500000-0x0000021E005D0000-memory.dmp

Download

memory/5096-492-0x0000021E00500000-0x0000021E005D0000-memory.dmp

Download

memory/5096-493-0x0000021E00500000-0x0000021E005D0000-memory.dmp

Download

memory/5096-496-0x0000021E00500000-0x0000021E005D0000-memory.dmp

Download

memory/5096-500-0x0000021E00020000-0x0000021E0002C000-memory.dmp

Download

memory/5096-499-0x0000021E7E3B0000-0x0000021E7E728000-memory.dmp

Download

memory/5096-460-0x0000000180000000-0x000000018006B000-memory.dmp

Download

memory/5096-495-0x0000021E00500000-0x0000021E005D0000-memory.dmp

Download

memory/5096-547-0x0000021E7E3B0000-0x0000021E7E728000-memory.dmp

Download

memory/5096-494-0x0000021E00500000-0x0000021E005D0000-memory.dmp

Download

memory/5096-491-0x0000021E00500000-0x0000021E005D0000-memory.dmp

Download

memory/5096-588-0x0000021E7E3B0000-0x0000021E7E728000-memory.dmp

Download