ed838d996c985bbd3f091e33ea2242a9e217c3032828f92e44030932ece4b2d9

Analysis

user interaction
yes
max time kernel
152s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 06:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SodaMusic-v3.2.exe
Size 155.5MB
Sample260629-hayxmsgz2p
SHA256 ed838d996c985bbd3f091e33ea2242a9e217c3032828f92e44030932ece4b2d9
MD5 87f07358b7ed705080514d532f8a4e35
SHA1 3c29d768d7ceae5065da4a06e0899c087750a0b0
SHA512 19d2cc2244cd436a4ad06702db90e298bdbdb784273e0d11389510538005c96b0a32b5b4a4506510b1df3bb859e656fa0ca8b8f54784a98f6c24779acd81efdc
SSDEEP 3145728:h0FlQWBz4z0wyYZThz8h66B9+QnrGZZjxocJVZpkgffGdaZ8kmPQWxtiz4kDsEhh:OVMzmY/C6sabjmcTZpkg3GdPjPvtIsEX
TLSH
T18E7833C80E96EB45D4B942B37484E2B9FD4E6608505E9C885FE19CBEF142DE34E3943B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution ransomware

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4456	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
1296	ev2f79.exe
6228	ev2c34.exe

Loads dropped DLL 17 IoCs

pid	Process
6844	SodaMusic-v3.2.exe
6844	SodaMusic-v3.2.exe
6844	SodaMusic-v3.2.exe
6844	SodaMusic-v3.2.exe
6844	SodaMusic-v3.2.exe
6844	SodaMusic-v3.2.exe
6844	SodaMusic-v3.2.exe
6844	SodaMusic-v3.2.exe
6844	SodaMusic-v3.2.exe
6844	SodaMusic-v3.2.exe
6844	SodaMusic-v3.2.exe
6844	SodaMusic-v3.2.exe
6844	SodaMusic-v3.2.exe
6844	SodaMusic-v3.2.exe
6844	SodaMusic-v3.2.exe
6844	SodaMusic-v3.2.exe
6844	SodaMusic-v3.2.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\vss_tmp.txt	vssvc.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
2740	tasklist.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Community\SodaMusic-v3.2.1-official-win32_x64.exe	SodaMusic-v3.2.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_trdtwnns.1cl.ps1	vssvc.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_d4s1s1h5.ekx.psm1	vssvc.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_2xoasu3j.yq4.ps1	vssvc.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_xivgc0oe.okv.psm1	vssvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ev2c34.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ev2f79.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SodaMusic-v3.2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies data under HKEY_USERS 46 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	vssvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	vssvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	vssvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	vssvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	vssvc.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
4456	powershell.exe
4456	powershell.exe
1296	ev2f79.exe
1296	ev2f79.exe
3672	vssvc.exe
3672	vssvc.exe
1296	ev2f79.exe
1296	ev2f79.exe
3672	vssvc.exe
6228	ev2c34.exe
6228	ev2c34.exe
6228	ev2c34.exe
6228	ev2c34.exe
6228	ev2c34.exe
6228	ev2c34.exe
6228	ev2c34.exe
6228	ev2c34.exe
6228	ev2c34.exe
6228	ev2c34.exe
1080	UserAccountBroker.exe
1080	UserAccountBroker.exe
6392	edpnotify.exe
6392	edpnotify.exe
6392	edpnotify.exe
6392	edpnotify.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1080	UserAccountBroker.exe

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
1296	ev2f79.exe
3672	vssvc.exe
1296	ev2f79.exe
6228	ev2c34.exe
6228	ev2c34.exe
6228	ev2c34.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2740	tasklist.exe
Token: SeDebugPrivilege	4456	powershell.exe
Token: SeIncreaseQuotaPrivilege	4456	powershell.exe
Token: SeSecurityPrivilege	4456	powershell.exe
Token: SeTakeOwnershipPrivilege	4456	powershell.exe
Token: SeLoadDriverPrivilege	4456	powershell.exe
Token: SeSystemProfilePrivilege	4456	powershell.exe
Token: SeSystemtimePrivilege	4456	powershell.exe
Token: SeProfSingleProcessPrivilege	4456	powershell.exe
Token: SeIncBasePriorityPrivilege	4456	powershell.exe
Token: SeCreatePagefilePrivilege	4456	powershell.exe
Token: SeBackupPrivilege	4456	powershell.exe
Token: SeRestorePrivilege	4456	powershell.exe
Token: SeShutdownPrivilege	4456	powershell.exe
Token: SeDebugPrivilege	4456	powershell.exe
Token: SeSystemEnvironmentPrivilege	4456	powershell.exe
Token: SeRemoteShutdownPrivilege	4456	powershell.exe
Token: SeUndockPrivilege	4456	powershell.exe
Token: SeManageVolumePrivilege	4456	powershell.exe
Token: 33	4456	powershell.exe
Token: 34	4456	powershell.exe
Token: 35	4456	powershell.exe
Token: 36	4456	powershell.exe
Token: SeDebugPrivilege	1296	ev2f79.exe
Token: SeBackupPrivilege	3672	vssvc.exe
Token: SeRestorePrivilege	3672	vssvc.exe
Token: SeAuditPrivilege	3672	vssvc.exe
Token: SeDebugPrivilege	3672	vssvc.exe
Token: SeDebugPrivilege	3672	vssvc.exe
Token: SeAssignPrimaryTokenPrivilege	3672	vssvc.exe
Token: SeIncreaseQuotaPrivilege	3672	vssvc.exe
Token: SeSecurityPrivilege	3672	vssvc.exe
Token: SeTakeOwnershipPrivilege	3672	vssvc.exe
Token: SeLoadDriverPrivilege	3672	vssvc.exe
Token: SeSystemtimePrivilege	3672	vssvc.exe
Token: SeBackupPrivilege	3672	vssvc.exe
Token: SeRestorePrivilege	3672	vssvc.exe
Token: SeShutdownPrivilege	3672	vssvc.exe
Token: SeSystemEnvironmentPrivilege	3672	vssvc.exe
Token: SeUndockPrivilege	3672	vssvc.exe
Token: SeManageVolumePrivilege	3672	vssvc.exe
Token: SeAssignPrimaryTokenPrivilege	3672	vssvc.exe
Token: SeIncreaseQuotaPrivilege	3672	vssvc.exe
Token: SeSecurityPrivilege	3672	vssvc.exe
Token: SeTakeOwnershipPrivilege	3672	vssvc.exe
Token: SeLoadDriverPrivilege	3672	vssvc.exe
Token: SeSystemtimePrivilege	3672	vssvc.exe
Token: SeBackupPrivilege	3672	vssvc.exe
Token: SeRestorePrivilege	3672	vssvc.exe
Token: SeShutdownPrivilege	3672	vssvc.exe
Token: SeSystemEnvironmentPrivilege	3672	vssvc.exe
Token: SeUndockPrivilege	3672	vssvc.exe
Token: SeManageVolumePrivilege	3672	vssvc.exe
Token: SeAssignPrimaryTokenPrivilege	3672	vssvc.exe
Token: SeIncreaseQuotaPrivilege	3672	vssvc.exe
Token: SeSecurityPrivilege	3672	vssvc.exe
Token: SeTakeOwnershipPrivilege	3672	vssvc.exe
Token: SeLoadDriverPrivilege	3672	vssvc.exe
Token: SeSystemtimePrivilege	3672	vssvc.exe
Token: SeBackupPrivilege	3672	vssvc.exe
Token: SeRestorePrivilege	3672	vssvc.exe
Token: SeShutdownPrivilege	3672	vssvc.exe
Token: SeSystemEnvironmentPrivilege	3672	vssvc.exe
Token: SeUndockPrivilege	3672	vssvc.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 6844 wrote to memory of 5776	6844	SodaMusic-v3.2.exe	91
PID 5776 wrote to memory of 2740	5776	cmd.exe	93
PID 5776 wrote to memory of 1680	5776	cmd.exe	94
PID 6844 wrote to memory of 5224	6844	SodaMusic-v3.2.exe	96
PID 5224 wrote to memory of 2056	5224	cmd.exe	98
PID 2056 wrote to memory of 4456	2056	cmd.exe	99
PID 6844 wrote to memory of 1296	6844	SodaMusic-v3.2.exe	101
PID 6844 wrote to memory of 6228	6844	SodaMusic-v3.2.exe	103

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\SodaMusic-v3.2.exe
"C:\Users\Admin\AppData\Local\Temp\SodaMusic-v3.2.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6844
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C tasklist | findstr /I /C:"360tray.exe" /C:"HipsTray.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5776
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2740
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I /C:"360tray.exe" /C:"HipsTray.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1680
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C start "" /B cmd.exe /C "powershell Add-MpPreference -ExclusionPath C:\,D:\,F:\"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5224
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /C "powershell Add-MpPreference -ExclusionPath C:\,D:\,F:\"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2056
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell Add-MpPreference -ExclusionPath C:\,D:\,F:\
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4456
- C:\Users\Admin\AppData\Roaming\comain_ev2f79\ev2f79.exe
  "C:\Users\Admin\AppData\Roaming\comain_ev2f79\ev2f79.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  PID:1296
- C:\Users\Admin\AppData\Roaming\comain_ev2c34\ev2c34.exe
  "C:\Users\Admin\AppData\Roaming\comain_ev2c34\ev2c34.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:6228

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3672

C:\Windows\System32\UserAccountBroker.exe
C:\Windows\System32\UserAccountBroker.exe
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:1080

C:\Windows\System32\edpnotify.exe
C:\Windows\System32\edpnotify.exe
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:6392

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:6020

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_fhxlmiid.5mn.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fhxlmiid.5mn.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

DcryptDll.dll

Path C:\Users\Admin\AppData\Local\Temp\nsgAC6A.tmp\DcryptDll.dll
Size 18KB
SHA256 92f89f2de4fc04f8c2702b34241a83cf16db32ebf1abb17f2850c4962af2f41a
MD5 f1eeabe27bc130c8ac224749c133c99a
SHA1 43fb139e13d3ec4d2335c2231668990e59065b2a
SHA512 0d71b57636ae821469bcf3062398719137d2963520a5e6a47c41723926166b02f535a4fce961b32e1c81bedcf57e07e875a2c80522ca643add3ea9f448801490
SSDEEP 384:zOU2E25y4n862yBmVq6nmWRJTpCLXXCCQMWfyq:zOUzz4n8ZyBmVVVpCLXSCQMWR
TLSH
T183820B01C9E0447CF2B1333976B6A916DCBD7D711476C20FFE99059F0A74A472A4A772
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InstallOptions.dll

Path C:\Users\Admin\AppData\Local\Temp\nsgAC6A.tmp\InstallOptions.dll
Size 14KB
SHA256 44c822afaa4cc7cb95390eaa0ada076d280d3455870569f0cde03637257d9899
MD5 0285eac59530ff5cc91fe2634b4ed78e
SHA1 241c12aefca0740e776362f30aa1edffd66d6bdc
SHA512 1007fbfb82d4e6c04bd5fefb32cd81f4406022ceef4d409eda0f0ddeb8b1f124a2baec86498bc119778e0c241fc41b0c2440d8a8f6731a63ede936be94f81297
SSDEEP 192:8nK6d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+MTgK72dwF7dBEnbok:8K6UdHXcIiY535zBtMTg+BEnbo
TLSH
T172622A11778888F3DB92013EB4533707AF9D5126B4929ED2CA271FCA6D2B19D3EB1306
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsgAC6A.tmp\ioSpecial.ini
Size 529B
SHA256 f83251614cf4220616e879867520507822edebdd2ef60f05f72536ffbb8bfec4
MD5 1127a82db66e82d18b121144b50fec92
SHA1 3199286e444b57de34af6a190d8ed6288cbe8fcb
SHA512 5762d73d3f5a6998682f200a880b1c2ac62a995de9bd7863ea5e2f41a49528dc97d4c82e73a917f5cfc393a5fb9d2eae48b9e5314a8718b081d944cbde2e8169
TLSH
T137F05989805A53D50660A18299B63B9237D01D20871979F5F031AC876B8CCF6ACECA86
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsgAC6A.tmp\ioSpecial.ini
Size 529B
SHA256 908bb9eb77d01bede4cb932ce5e8da4fae0ebb7704103fefeb4db5947455b378
MD5 418671f881bb948b2dd05df60d07dfeb
SHA1 8b0517b80aa5c24cbb2cbe11eea89d80c302c62e
SHA512 b1695fd7765fc91d61fbf58cfb661133adf0b619e2da46a4e5a0bfb9479c640ac4cbb21bda315dadaed5e5c1ab87c70f3b99f1ccc261d4c104c401b4a5650f0f
TLSH
T153F05988805E53D50520A18299B63B9237D01D30975A79F4F135AC87AB4CCE59CECA83
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsgAC6A.tmp\ioSpecial.ini
Size 646B
SHA256 abdcf1ceff3cc8b6ea0da5064214d6ae22bed2a093e103925a67a72153800dd5
MD5 fb326c524dffb8848993e8ac5e53f9c7
SHA1 1b3e9c88b5013665d3a95ed923b93306ed162b44
SHA512 9e170b5c8d7ce51514da8ec43e7baa778e94df34c69a0adcfe43b1a07850a821abc4ffcf8463c5bc1a433fab0dc4c5cc3323433caa9b089ee9e776312097d8d9
TLSH
T1B1F0DD49004E52590660B1439A7A7B9A27F11D50870C39F0E5316C875B8DCF5DCCCD83
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsgAC6A.tmp\ioSpecial.ini
Size 607B
SHA256 e94d40a49ed1caa0869a0d903e7bdc7a032f17175ce054b644fff94a2d499793
MD5 54f961b7cc7a2f07b947ecdeef4e24c1
SHA1 12d9acd1cd4d08bb1741425d5a91dd87fac1ae63
SHA512 76efee79ddcc37c56091701eea87e0f73118bd5e24d8b94384da97695789d5ce539a1075239166bcaac992974cf9ba21bd2c0c842f6866663d0f7288baecf869
TLSH
T146F0AC4D504E521D4570B1039ABA7B9A17F12D20470939F5A5326C879B8DCF5CCDCDC3
MD5 SHA1 SHA512 TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsgAC6A.tmp\nsExec.dll
Size 6KB
SHA256 ad42bf2210a6856c8903745b6d6f23f730a7aaca4e621e3b7d182ff3536e854f
MD5 a773979ae108641e5e39236467cfcba3
SHA1 c48c77054b6016122924e976480f0f63661e2527
SHA512 6972c0430d1b80696379de7b2ea26f6053f9578592b3cfdb0c9f748554c920e8ab91697d11812596f97722a59026555d83f43a9b1c7f51631d83463236886a81
SSDEEP 96:I7GUb+YNfwgcr8zyKwZ5S4JxN8BS0ef9/3trCUTMxVXS32E:yKgfwgcr8zylsB49lrCUTMxVXN
TLSH
T18DD10A3DA6C33DB3D54ACE763C65292F1B78C9260BA40210AB5716C274D5AE3FD29382
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uk_tmp.txt

Path C:\Users\Admin\AppData\Local\Temp\uk_tmp.txt
Size 1B
SHA256 2d711642b726b04401627ca9fbac32f5c8530fb1903cc4db02258717921a4881
MD5 9dd4e461268c8034f5c8564e155c67a6
SHA1 11f6ad8ec52a2984abaafd7c3b516503785c2072
SHA512 a4abd4448c49562d828115d13a1fccea927f52b4d5459297f8b43e42da89238bc13626e43dcb38ddb082488927ec904fb42057443983e88585179d50551afe62
MD5 SHA1 SHA512

Submit Download

ap.asin

Path C:\Users\Admin\AppData\Roaming\comain_ev2c34\ap.asin
Size 260B
SHA256 1fe58ff1b51588691448abfd76265ffe1c223d85540c050a20c45bd27bc30494
MD5 4ac7b83dab7196ef9b64489f62359231
SHA1 e3052c00d1b59ccb6ac109797cdcd7360424efb3
SHA512 b183f48114573aeb1ea166818f4e9630d05dcc312285dceb67468106ae3cab8afa3edc5c06eaf407f972a4526729218013a4e62d65ddd67875e6899625962487
TLSH
T1B9D02B36D614EB73726A2E1C4D68603B1850BA91261745075C1A4961F331260F096528
MD5 SHA1 SHA512 TLSH

Submit Download

bnymir.ou

Path C:\Users\Admin\AppData\Roaming\comain_ev2c34\bnymir.ou
Size 403KB
SHA256 311f644a8cc871e9fde0dbf9126189f11cf14534d8aadd824954595b56dbe5d8
MD5 665dc9cb1017f75370dead01c35e5342
SHA1 92be12e735b77849181d94779fec0efcf26342b5
SHA512 072bc616feb46a3f297671bbef8c2cf7a15416b95d3cacb2bc87ba0db6269d02c95d3dd6c51dd941398d367b4aca8a948e3f5e73f276d52ba150d8fff2c002e9
SSDEEP 12288:h47eobnoU0GOxiz2QQIl8yrjroV9ueRvu:G7hUT3xiz+uLrfoV9ueRvu
TLSH
T12494BF6A2C3FAE681ABC41A7F94C11577DF21FD8ABEDC132C24DCD1917D10899AB8193
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bteuns.pt

Path C:\Users\Admin\AppData\Roaming\comain_ev2c34\bteuns.pt
Size 533KB
SHA256 c56bba6fd6236e30d9b5bb7ffea33079a143819fe1f08db346ff7b96acc9cf00
MD5 202faa607d44d8350d8d5ab435a8e81e
SHA1 244389e040acd9798f1960135b4b37e7711356fc
SHA512 31fe7f1baf7ab2964ca468a686a00e724f5466daf949df5173e4bf3ed575c3651447f990e72f2c0465c8762d258f1238f80ee6948f09bf6d979bee62b66757af
SSDEEP 12288:hU43LGMwhDLctEYGzqIx+Tsj/KKKKXE49ckVd:K43LXwm38VEEckVd
TLSH
T1FFC47D57193E7D0D26E05293B81C49D37DF223809AEDD031D39D9E6816C6A2EA9F12F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cmrsk.ce

Path C:\Users\Admin\AppData\Roaming\comain_ev2c34\cmrsk.ce
Size 166KB
SHA256 32c1efcf15430df8e87207bde1916c807378edf6bd9552f02aeb6d50ac56f752
MD5 5b0756dc69ec9ed4b6dc5f4948d00c91
SHA1 e6938bbe27ba077f95b925c92c8c5e71875c76cb
SHA512 a16cfbbfec0311cded46376ca2d04bffbeb36c3f80e84ae2052671bf2bc6a8370d293a8df606b2f311914f90513cdbe393c99533284f5a6c4532b49b4bfb0c1d
SSDEEP 3072:hhIKRyikUOIya0rhMcnSfTSFqeSy4In48H0gFuHNJbmeqdyYV5gY:hh+ta09McS72+vI4dgOxigY
TLSH
T1D4F39EA7297D6FB839684183344C04975F651360AFEECD32C39ECF1409A66A726F817B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ev2c34.exe

Path C:\Users\Admin\AppData\Roaming\comain_ev2c34\ev2c34.exe
Size 1.6MB
SHA256 43cfcb0b863b91a3af3ec11dd72f829aea9c85ec05d8879506b1939718e3e182
MD5 1255321230cb4a471419d0e611d7f7a6
SHA1 14873bfa0a317ffc181a357029375cae5fa1376d
SHA512 c3c36124ca90a36e426b690cdbcd073df1f7db506e1dda91940dc291864700bcdfa95896cbf4644c13db45f42dfcc15aced8e322d2ec455342829a45a308f2e3
SSDEEP 49152:ociGA3wSy+p38nAWeWggO53Dx2Cdw9LJK5KMS+xt:Xim8p3yggORx2d9Luhxt
TLSH
T1BD75222175D88031F5B32B3056F8AAB10A7DBD712BB15ACF17506E281F30AD1DA39B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fhkan.oi

Path C:\Users\Admin\AppData\Roaming\comain_ev2c34\fhkan.oi
Size 180KB
SHA256 4846e03250931965df77d4fb897fb3d100d451b72a7910a2840630195cfe1246
MD5 30806c3b99d158af70ad6448bfdd7716
SHA1 d557aac16144b0ff77759b7562aeef6c346ab110
SHA512 04e1e86c842870f02401cd42668095a81bb6c1b3e8c47bebf7d333453453a6ce65442339ff5ce1f51317b471c0f31e0afa7d877aaa861535273c8f944bd4aac9
SSDEEP 3072:Xhhg05n4/1J42BVXU9w9x32R68wJZzjz+Ifwaa65LjI2ccF6SarDEFzjqF3:Rhge4tJ4UEG9xZfIaaAjI29narDEY3
TLSH
T1B104BEA4434BEF34AD5E41E3B0611D9AA3E9308CF2DC6354AB9B8D2104D857F67F9293
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxyvnb.ti

Path C:\Users\Admin\AppData\Roaming\comain_ev2f79\dxyvnb.ti
Size 56KB
SHA256 2ede6fc732c291281f5e51563a4239e38bc9cc57c42719836d51690edf46c525
MD5 02fd4fd8807ff36f506029f6d161c6ea
SHA1 725066f05fb2dcdb6d50b398beb5556ce817cf70
SHA512 71714a3696a1e4ddfa55fbadee60727efcf246a53c6ac2f2fc112e14d562f61b231dca120cc67bc665d510bee2d136df1937ba7c76da9dc7bebbb67c6ffc5ae8
SSDEEP 1536:+2xNv/qrXz0t8NADTop9ObO7BqTfHw+gPRRwZB1p04:+2xNSgt8N7wb4qT3gMNpB
TLSH
T19143CF440289AFA2F154C3737E59D98706D89F802FAA7537A3D8BD252C58F7B75F8022
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ev2f79.exe

Path C:\Users\Admin\AppData\Roaming\comain_ev2f79\ev2f79.exe
Size 1.6MB
SHA256 45cb2eee9fe9f6f3f245eac846454435db19b36490243c6e2c321de225d11cb4
MD5 cfae7a4d058f79683af455bdacd428f4
SHA1 9ce303c2fd7ff86495d3b236a3f82f70d082b4cc
SHA512 f8add2890380c4c66de774f0756cc7f5fde36081be3f45c53d1d5024f11a7348de69e372501e11439795dd79040ef5e2c819b51cf2535bc1f28f6e360a3c7e31
SSDEEP 49152:osiGA3wSy+p38nAWeWggO53Dx2Cdw9LJK5KMS+xt:jim8p3yggORx2d9Luhxt
TLSH
T17A75222175D88031F5B32B305AF8AAB10A7DBD712BB15ACF17506E281F306D1DA39B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntrin.er

Path C:\Users\Admin\AppData\Roaming\comain_ev2f79\ntrin.er
Size 168KB
SHA256 0250643af857245804b1836a240104cd8122c995d1e63f45c6ab6cb4d1065532
MD5 423ea290beb120f487d6831083dd1f87
SHA1 beec3f71d604ebbeef52bd03407b1fa52e68c2d9
SHA512 082915fe636a6bf88dee3eba9153b75542b049d82878b510cce7dd633b83b53cc8b81db513ed5a47f3d67b715f7e45c5c4182ffc14fcf36b89552e149721f553
SSDEEP 3072:kS4Cu9rV+QT6ZfRiflr3PQ1InKMzjVFPumXrA29hJ6QSxHPmbrF8vodrQOs+:keFRi7kIKMz7Bhs+
TLSH
T1BBF38DA32C6C9F78B9689183384C45930F641760AFEE9D33839ECF6505E65A762F412F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

otrm.oi

Path C:\Users\Admin\AppData\Roaming\comain_ev2f79\otrm.oi
Size 163KB
SHA256 23b5d84ad8a53b77dbda0960d8423e558bcac4ed3fd6221b60370fc94452495c
MD5 bdfa1e1ac89f99fdcfa761182d745bd0
SHA1 536c22b1e037456b55ca27bb9ac87a0f664e3de6
SHA512 579ca037a0ed37f052011300f812469ce49d5c7111340ff33a2c4717e9ebd324b2ff468552da99f7755a6a49bab7d913bc1c577b95474386cb5ebd92a97f979a
SSDEEP 3072:qtH9dODPB564nXjtFCH0gVqsxCua4DwJ47PreIV6V2Cpbnhdd:k9dOrBU4nqWua40J47zeIVYpLZ
TLSH
T1A4F3AD4C421AAE74ED6E81F3F9600AE593D53140F2DEA3967F2AED5104A423F52F8793
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yinma.vc

Path C:\Users\Admin\AppData\Roaming\comain_ev2f79\yinma.vc
Size 478KB
SHA256 cc734def371a00e17d744833b7a61f030051d0149712fba9d63bb7400271b12a
MD5 cb2c7240e7b48f49f0f140a0ab5fcc51
SHA1 5732767b46198f321d73fb4a9395fb44de3803b3
SHA512 476651d071cdad81fc10ed4d23857b47cccb0a7d686fe94e8deee220d78d81d02532291f8c044c4965cec5d90734cfe9bfd35da61f961e316fec70d0a4d37b81
SSDEEP 12288:HCsJxcMXlPRu2/Awl6kdd2a+Ih9CTnRdzpo8:HCsJSMlJu2/Awl6kddf+ysRdzpo8
TLSH
T100A40919149AAF398180484F7A1DD121A977DB48D22FE23198A9EC1A7DE4F21DFFC1C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1080-301-0x0000000180000000-0x000000018006B000-memory.dmp

Download

memory/1080-336-0x0000022FC7520000-0x0000022FC75F0000-memory.dmp

Download

memory/1080-335-0x0000022FC7520000-0x0000022FC75F0000-memory.dmp

Download

memory/1080-330-0x0000022FC7520000-0x0000022FC75F0000-memory.dmp

Download

memory/1080-334-0x0000022FC7520000-0x0000022FC75F0000-memory.dmp

Download

memory/1080-333-0x0000022FC7520000-0x0000022FC75F0000-memory.dmp

Download

memory/1080-332-0x0000022FC7520000-0x0000022FC75F0000-memory.dmp

Download

memory/1080-331-0x0000022FC7520000-0x0000022FC75F0000-memory.dmp

Download

memory/1296-180-0x0000000010000000-0x000000001002D000-memory.dmp

Download

memory/1296-181-0x0000000010000000-0x000000001002D000-memory.dmp

Download

memory/1296-179-0x0000000010000000-0x000000001002D000-memory.dmp

Download

memory/1296-173-0x0000000010000000-0x000000001002D000-memory.dmp

Download

memory/1296-182-0x0000000010000000-0x000000001002D000-memory.dmp

Download

memory/1296-202-0x0000000010000000-0x000000001002D000-memory.dmp

Download

memory/3672-219-0x0000024E4E4B0000-0x0000024E4E562000-memory.dmp

Download

memory/3672-221-0x0000024E4E050000-0x0000024E4E06E000-memory.dmp

Download

memory/3672-185-0x0000000180000000-0x000000018007D000-memory.dmp

Download

memory/3672-220-0x0000024E4E020000-0x0000024E4E02A000-memory.dmp

Download

memory/3672-200-0x0000024E35990000-0x0000024E3599C000-memory.dmp

Download

memory/3672-211-0x0000024E35A60000-0x0000024E35A82000-memory.dmp

Download

memory/3672-218-0x0000024E4E000000-0x0000024E4E01E000-memory.dmp

Download

memory/4456-105-0x00000000061E0000-0x000000000653B000-memory.dmp

Download

memory/4456-116-0x00000000078E0000-0x0000000007900000-memory.dmp

Download

memory/4456-107-0x0000000006720000-0x000000000676C000-memory.dmp

Download

memory/4456-118-0x0000000008090000-0x000000000870C000-memory.dmp

Download

memory/4456-91-0x0000000073362000-0x0000000073363000-memory.dmp

Download

memory/4456-98-0x0000000006170000-0x00000000061D6000-memory.dmp

Download

memory/4456-92-0x0000000002EB0000-0x0000000002EE6000-memory.dmp

Download

memory/4456-119-0x0000000007A50000-0x0000000007A6A000-memory.dmp

Download

memory/4456-120-0x0000000007AC0000-0x0000000007ACA000-memory.dmp

Download

memory/4456-121-0x0000000007CC0000-0x0000000007D56000-memory.dmp

Download

memory/4456-97-0x0000000006100000-0x0000000006166000-memory.dmp

Download

memory/4456-96-0x0000000006060000-0x0000000006082000-memory.dmp

Download

memory/4456-95-0x0000000073350000-0x0000000073B0C000-memory.dmp

Download

memory/4456-108-0x00000000078A0000-0x00000000078D6000-memory.dmp

Download

memory/4456-94-0x00000000059A0000-0x0000000005FEA000-memory.dmp

Download

memory/4456-93-0x0000000073350000-0x0000000073B0C000-memory.dmp

Download

memory/4456-123-0x0000000073350000-0x0000000073B0C000-memory.dmp

Download

memory/4456-117-0x0000000007910000-0x00000000079B3000-memory.dmp

Download

memory/4456-109-0x000000006FC30000-0x000000006FC7C000-memory.dmp

Download

memory/4456-106-0x00000000066D0000-0x00000000066EE000-memory.dmp

Download

memory/6228-329-0x0000000010000000-0x0000000010031000-memory.dmp

Download

memory/6228-280-0x0000000010000000-0x0000000010031000-memory.dmp

Download

memory/6228-286-0x0000000010000000-0x0000000010031000-memory.dmp

Download

memory/6228-287-0x0000000010000000-0x0000000010031000-memory.dmp

Download

memory/6228-288-0x0000000010000000-0x0000000010031000-memory.dmp

Download

memory/6228-289-0x0000000010000000-0x0000000010031000-memory.dmp

Download

memory/6392-315-0x0000000180000000-0x000000018008C000-memory.dmp

Download