ebe31ad40a9ce206268d9f355e42ca4979847bfd861b3d157c06ed1bd842219c

Analysis

max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 12:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Banndiziip_x64.exe
Size 16.2MB
Sample260804-p24ersbb82
SHA256 ebe31ad40a9ce206268d9f355e42ca4979847bfd861b3d157c06ed1bd842219c
MD5 ac14f6dacdf01b8257412a33709a2891
SHA1 acbead7f0fbc8b7b392f2edb91c1a7ed6f9d96e2
SHA512 5ebf75681b9df15d9f286c884ede04a1b06a960c333ff65ce28a99ab3e16b999eff60a5295de1a09b1ddaf62675cbbced5bcea55f74ad03427fd3839e1687c72
SSDEEP 393216:2MkEDpSeSLpw9LI5VUHbHfsJwB8RAYhUl+LgeL7xrgz:2pEcvpa4VUHwuBonge3xrgz
TLSH
T15E0733BC90D04791DACDADF3ABD997077C354523546EAFCA05826C28860F7B2B2F612D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution ransomware

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5044	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
4148	ev2f79.exe
3016	ev2c34.exe

Loads dropped DLL 3 IoCs

pid	Process
816	Banndiziip_x64.exe
816	Banndiziip_x64.exe
816	Banndiziip_x64.exe

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
3464	tasklist.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Community\TikTok Installer.exe	Banndiziip_x64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3388	cmd.exe
4708	cmd.exe
4512	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ev2f79.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ev2c34.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Banndiziip_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe

Modifies data under HKEY_USERS 46 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	vssvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	vssvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	vssvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	vssvc.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
5044	powershell.exe
5044	powershell.exe
4148	ev2f79.exe
4148	ev2f79.exe
4148	ev2f79.exe
4148	ev2f79.exe
4148	ev2f79.exe
4148	ev2f79.exe
4372	vssvc.exe
3016	ev2c34.exe
3016	ev2c34.exe
3016	ev2c34.exe
3016	ev2c34.exe
3016	ev2c34.exe
3016	ev2c34.exe
3016	ev2c34.exe
3016	ev2c34.exe
3016	ev2c34.exe
3016	ev2c34.exe
748	UserAccountBroker.exe
748	UserAccountBroker.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
748	UserAccountBroker.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
4148	ev2f79.exe
3016	ev2c34.exe
3016	ev2c34.exe
3016	ev2c34.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3464	tasklist.exe
Token: SeDebugPrivilege	5044	powershell.exe
Token: SeDebugPrivilege	4148	ev2f79.exe
Token: SeBackupPrivilege	4372	vssvc.exe
Token: SeRestorePrivilege	4372	vssvc.exe
Token: SeAuditPrivilege	4372	vssvc.exe
Token: SeDebugPrivilege	4372	vssvc.exe
Token: SeAssignPrimaryTokenPrivilege	4372	vssvc.exe
Token: SeIncreaseQuotaPrivilege	4372	vssvc.exe
Token: SeSecurityPrivilege	4372	vssvc.exe
Token: SeTakeOwnershipPrivilege	4372	vssvc.exe
Token: SeLoadDriverPrivilege	4372	vssvc.exe
Token: SeSystemtimePrivilege	4372	vssvc.exe
Token: SeBackupPrivilege	4372	vssvc.exe
Token: SeRestorePrivilege	4372	vssvc.exe
Token: SeShutdownPrivilege	4372	vssvc.exe
Token: SeSystemEnvironmentPrivilege	4372	vssvc.exe
Token: SeUndockPrivilege	4372	vssvc.exe
Token: SeManageVolumePrivilege	4372	vssvc.exe
Token: SeAssignPrimaryTokenPrivilege	4372	vssvc.exe
Token: SeIncreaseQuotaPrivilege	4372	vssvc.exe
Token: SeSecurityPrivilege	4372	vssvc.exe
Token: SeTakeOwnershipPrivilege	4372	vssvc.exe
Token: SeLoadDriverPrivilege	4372	vssvc.exe
Token: SeSystemtimePrivilege	4372	vssvc.exe
Token: SeBackupPrivilege	4372	vssvc.exe
Token: SeRestorePrivilege	4372	vssvc.exe
Token: SeShutdownPrivilege	4372	vssvc.exe
Token: SeSystemEnvironmentPrivilege	4372	vssvc.exe
Token: SeUndockPrivilege	4372	vssvc.exe
Token: SeManageVolumePrivilege	4372	vssvc.exe
Token: SeAssignPrimaryTokenPrivilege	4372	vssvc.exe
Token: SeIncreaseQuotaPrivilege	4372	vssvc.exe
Token: SeSecurityPrivilege	4372	vssvc.exe
Token: SeTakeOwnershipPrivilege	4372	vssvc.exe
Token: SeLoadDriverPrivilege	4372	vssvc.exe
Token: SeSystemtimePrivilege	4372	vssvc.exe
Token: SeBackupPrivilege	4372	vssvc.exe
Token: SeRestorePrivilege	4372	vssvc.exe
Token: SeShutdownPrivilege	4372	vssvc.exe
Token: SeSystemEnvironmentPrivilege	4372	vssvc.exe
Token: SeUndockPrivilege	4372	vssvc.exe
Token: SeManageVolumePrivilege	4372	vssvc.exe
Token: SeAssignPrimaryTokenPrivilege	4372	vssvc.exe
Token: SeIncreaseQuotaPrivilege	4372	vssvc.exe
Token: SeSecurityPrivilege	4372	vssvc.exe
Token: SeTakeOwnershipPrivilege	4372	vssvc.exe
Token: SeLoadDriverPrivilege	4372	vssvc.exe
Token: SeSystemtimePrivilege	4372	vssvc.exe
Token: SeBackupPrivilege	4372	vssvc.exe
Token: SeRestorePrivilege	4372	vssvc.exe
Token: SeShutdownPrivilege	4372	vssvc.exe
Token: SeSystemEnvironmentPrivilege	4372	vssvc.exe
Token: SeUndockPrivilege	4372	vssvc.exe
Token: SeManageVolumePrivilege	4372	vssvc.exe
Token: SeAssignPrimaryTokenPrivilege	4372	vssvc.exe
Token: SeIncreaseQuotaPrivilege	4372	vssvc.exe
Token: SeSecurityPrivilege	4372	vssvc.exe
Token: SeTakeOwnershipPrivilege	4372	vssvc.exe
Token: SeLoadDriverPrivilege	4372	vssvc.exe
Token: SeSystemtimePrivilege	4372	vssvc.exe
Token: SeBackupPrivilege	4372	vssvc.exe
Token: SeRestorePrivilege	4372	vssvc.exe
Token: SeShutdownPrivilege	4372	vssvc.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 816 wrote to memory of 3388	816	Banndiziip_x64.exe	85
PID 3388 wrote to memory of 3464	3388	cmd.exe	87
PID 3388 wrote to memory of 3336	3388	cmd.exe	88
PID 816 wrote to memory of 4708	816	Banndiziip_x64.exe	90
PID 4708 wrote to memory of 4512	4708	cmd.exe	92
PID 4512 wrote to memory of 5044	4512	cmd.exe	93
PID 816 wrote to memory of 4148	816	Banndiziip_x64.exe	95
PID 816 wrote to memory of 3016	816	Banndiziip_x64.exe	97

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\Banndiziip_x64.exe
"C:\Users\Admin\AppData\Local\Temp\Banndiziip_x64.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:816
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C tasklist | findstr /I /C:"360tray.exe" /C:"HipsTray.exe"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3388
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3464
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I /C:"360tray.exe" /C:"HipsTray.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3336
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C start "" /B cmd.exe /C "powershell Add-MpPreference -ExclusionPath C:\,D:\,F:\"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4708
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /C "powershell Add-MpPreference -ExclusionPath C:\,D:\,F:\"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4512
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell Add-MpPreference -ExclusionPath C:\,D:\,F:\
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5044
- C:\Users\Admin\AppData\Roaming\comain_ev2f79\ev2f79.exe
  "C:\Users\Admin\AppData\Roaming\comain_ev2f79\ev2f79.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  PID:4148
- C:\Users\Admin\AppData\Roaming\comain_ev2c34\ev2c34.exe
  "C:\Users\Admin\AppData\Roaming\comain_ev2c34\ev2c34.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:3016

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4372

C:\Windows\System32\UserAccountBroker.exe
C:\Windows\System32\UserAccountBroker.exe
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:748

C:\Windows\System32\edpnotify.exe
C:\Windows\System32\edpnotify.exe
1⤵
PID:4760

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_124pz0k3.4uf.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_124pz0k3.4uf.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsp4FD3.tmp\System.dll
Size 11KB
SHA256 4c86b238e64ecfaabe322a70fd78db229a663ccc209920f3385596a6e3205f78
MD5 375e8a08471dc6f85f3828488b1147b3
SHA1 1941484ac710fc301a7d31d6f1345e32a21546af
SHA512 5ba29db13723ddf27b265a4548606274b850d076ae1f050c64044f8ccd020585ad766c85c3e20003a22f356875f76fb3679c89547b0962580d8e5a42b082b9a8
SSDEEP 192:MPtkumJX7zB22kGwfy0mtVgkCPOs91un:9702k5qpds9Qn
TLSH
T165325D15135046F3E1D2853C542B3AAB6FB869118AF04E43CFB36852EF386C79D79352
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsp4FD3.tmp\nsExec.dll
Size 6KB
SHA256 482536968672d70279a5204060ff84ace25237f24b1bdf3b02e289d50ea5450c
MD5 4bbc9d77ef7f748f8c85750c3a445f0a
SHA1 d57a8304bb44ccdb3163b880b3c1bb213461399d
SHA512 b9430939daab0c8b7e77b96f2f7f85e8e1abd9f43eccbdf94078f77ef05b31a2a31f04ca3a2eff5aa7cc965029ed437af2eb100c197ef51f128ca827ad20e902
SSDEEP 96:z7GUxNkO6GR0t9GKKr1Zd8NHYVVHp4dEeY3kRnHdMqqyVgN63e:fXhHR0aTQN4gRHdMqJVgNp
TLSH
T177D1FA7675E22EB3C54ACE353C52772B57F8C8111B9401549B978BD238C5EB3EA29282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ap.asin

Path C:\Users\Admin\AppData\Roaming\comain_ev2c34\ap.asin
Size 260B
SHA256 3688b11dc424168d3ba9303845da601488a0684469dd51eb234665dd4c452016
MD5 7e314a04ef08028f8c2899484af3785f
SHA1 efe7a3a5d41e2eae84a3453bbf3007aff7e26a10
SHA512 615e8b64b41fbdd1782c1ff2a90d78c7a7ba9ca0bb51d596ea42ca1df1febc9ea5340a9044a9d784c4bd708196bb1453cd846f978862c34d73bfd8861d584aec
TLSH
T1E7D09527D324E773B17B2F1C091C507F4850F5D0671F470B0C260961F332251E1C6118
MD5 SHA1 SHA512 TLSH

Submit Download

bnymir.ou

Path C:\Users\Admin\AppData\Roaming\comain_ev2c34\bnymir.ou
Size 532KB
SHA256 80ea61aa50e8fc47f3db2b37eca7350b21a3aa8f957c7cf9490bb7c3757379e1
MD5 815067a5e4249ee4eb85623e98cb2342
SHA1 39280f0e0d48f70f52f937c2cdfe818d955a60f5
SHA512 903671e91e3a59bc5b4f38f4e0b42d2782e38f184b7353aab2a2597c9dcad66cd69b1bf4000452b2bb2ad90909f37e95b6705986a3fb6b00fa44fb3ea87d645c
SSDEEP 6144:gRGgKEU4IG7q/0lbvmNoUvV9tUzLILgQNTEmTbx0uXQs4SS02Gb257n0vMI52a4y:8GT4ZW/0mNo+kLIUMNYnNBi80JIa4jG
TLSH
T103C49D2A193E1ED925B897E3B88D208778F7334097DED530C19A9F34DAD121AC7B9187
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bteuns.pt

Path C:\Users\Admin\AppData\Roaming\comain_ev2c34\bteuns.pt
Size 524KB
SHA256 0405f8ad33e058b36a6292f004cdd4c791cf1a4081b144de589bbc0d9935423a
MD5 03d1a396bac2ec251a93a71de78d5cf6
SHA1 fff17b93aba39c4fc60d9d6c2c3c5a16970ccd34
SHA512 588328afe0dbe38060e55ccd527315f12274b62d3efc7f82944cf81b40ac23a2dff410ded458631c1af0bfe2294a742997e740b407855c2b2f70860f27c9b4d7
SSDEEP 12288:kRqfppLRZVxLPMBKRbrLw+l1PLEg3/CAJDw:kRGvzXLPMBYrsohLz/xE
TLSH
T13AB4AE88160A1E7067AC5BC3FC089AE929A630A0F5CD1510FB6F0FBAD5F127D85F9197
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cmrsk.ce

Path C:\Users\Admin\AppData\Roaming\comain_ev2c34\cmrsk.ce
Size 192KB
SHA256 2f592516e42bdf4b48eb92eced833db8c43681d00874257ee6e53395104d0142
MD5 c29ce1444d383e214229ea790d7f8d08
SHA1 42fdcca1407be41c3e81caf99c9713a338860c2b
SHA512 41719e4dbb1bd2afcf5ecb00064c4e5b8e10f913bcab7222f745addd792d73f5c6cd11f6c1c027a08493e53a82956b6114d9aa4be8c514ed494d9292bf8a3e57
SSDEEP 3072:QGKsStsAj22SSRX4TgA2nRb4nLjPIn0knDVnBPALhH8Ly/6gZfY3ea:QGDLADoMXWPI0kDVV74A3ea
TLSH
T199148DA7195CAFB879644AD338CC14875CB72350F7EE953282AF8F710AA216663F4317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ev2c34.exe

Path C:\Users\Admin\AppData\Roaming\comain_ev2c34\ev2c34.exe
Size 1.6MB
SHA256 527bd782a598e552901fdf045b0332f0be20670c4b818be5ceda7bcf8663e3a3
MD5 2b436baa5202432df0a8ce4a43aa050f
SHA1 88edbb4d484174b70749417fab2de64b0acbce83
SHA512 707d7e2c61fd57372a6246705bca50ce53bac8dfa54cffd4b98db9913e91ef32650fa3bf28d910294f39250efd03ae94ec58a73daa756c368cb72fcee712db25
SSDEEP 24576:cPiGk63nsDlb3OeGJ5yrkx7gXuahsfAqOKHBRhGuIX6eHhUGotJzYmmX2NbQ:cPiGf3s5iBJ5yrkx7gd8JIKeSfZyQM
TLSH
T11475221075D58432F2F30D3089F199B10F3DBD608F72A99F23861A2E1EB5AE1D636766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fhkan.oi

Path C:\Users\Admin\AppData\Roaming\comain_ev2c34\fhkan.oi
Size 183KB
SHA256 d50b4753fd94a5d80e3931356fb483ceee749e7421e61dd5aa698805a2d6ff3b
MD5 18a66d07214b9a2032b84b933ff9643f
SHA1 d52c8c6c83c99e8144b5928cad49c50aff0e4005
SHA512 b09e0b0f863aaef54e15dd15b48e65c640ab06e9f76c0d4adefd51a56bf192834ad3d853e1de5346a3a07264e452604e2f358ccf517bc332c3ee198c259adfe2
SSDEEP 3072:civQVf3oHjTDC89SrDvwC8NsgG8a9tqFua+GLJHo3idqJZTRbD:BEoHvD17Ha9gblLJHo3iIbD
TLSH
T18D04BE54061B9E34AC1D09D3B53429E962E630CCF1ED2664AB5F9E2351D85BF23F8363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxyvnb.ti

Path C:\Users\Admin\AppData\Roaming\comain_ev2f79\dxyvnb.ti
Size 45KB
SHA256 700f323400cebc41c77236144b8ed387acb93bfbef64a40af4faf12df8ce2cff
MD5 9f5ba8ae6992938c424ec9d3fd600328
SHA1 c4617c56db6b629648f40809bdc429bb6cab5e42
SHA512 366ac33d1e46d746b6a7708f184581d1bed221353662a3111103fd04adc084227af193af2919cfd65b5455fe7cc94b6235403c4f0743d92f7148d998d9e50884
SSDEEP 768:yHAV+4PFUW7/7yCIQD7w7h6BQszODjRv/9bHQ3fw+glPhvRpb4f:yHAV5PFPR3D7w7hbIODjRn9cw+gPRu
TLSH
T1CE23D14001E66796B248C05379AD8C4B68ED9F856F8EB06D13D4BE591CDCFBAC2F9063
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ev2f79.exe

Path C:\Users\Admin\AppData\Roaming\comain_ev2f79\ev2f79.exe
Size 1.6MB
SHA256 8682dff58db7e793e668531766bb8d030edda6e1a95f12c5fef3670d67e1c91b
MD5 21ef7d12a6c6a576eea8985c896705ac
SHA1 da87412de62234124c4c715fd450d01b901edb2c
SHA512 8f3a62c7a9a167c9a64b73b3d0db2d942a42839c93766bb821c0ea3143527f5b992b68d258248a99e6e69e9af7e971597cd06c88acdb93839054fb495d897d02
SSDEEP 24576:cbiGk63nsDlb3OeGJ5yrkx7gXuahsfAqOKHBRhGuIX6eHhUGotJzYmmX2NbQ:cbiGf3s5iBJ5yrkx7gd8JIKeSfZyQM
TLSH
T1B875221075D58432F2F30D3089F199B10F3DBD608F72A99F23861A2E1EB5AE1D636766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

otrm.oi

Path C:\Users\Admin\AppData\Roaming\comain_ev2f79\otrm.oi
Size 187KB
SHA256 cad3a6119836f449186774952891d78502213c894904eb3b2892fd3d0545a191
MD5 b9e777d1b8188b741060a419d6e31b79
SHA1 1490a4305145265afa1698a3cbd86bba86d72c51
SHA512 098682bd57f327780a3680fa9da58507b6b9af78c9dd372ad59982bb2c3fa3c2e27633e2f64fc651945b23e213dd55d69c0e95bc05e1f3230f01a9847b3d7aaa
SSDEEP 3072:MV5/DaVUb0Qs0po+mCuc9ejn47RFJ3PVL1JaehS3/EFSK7mjB:w0UbuE/nucJr1JaQa+X7mjB
TLSH
T114148D95839B5F3499AE44E3B5148AEA98893055FADD13C8FF4E8F5300D16FA91F8383
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/748-294-0x0000018932680000-0x0000018932750000-memory.dmp

Download

memory/748-291-0x0000018932680000-0x0000018932750000-memory.dmp

Download

memory/748-292-0x0000018932680000-0x0000018932750000-memory.dmp

Download

memory/748-293-0x0000018932680000-0x0000018932750000-memory.dmp

Download

memory/748-274-0x0000000180000000-0x000000018008A000-memory.dmp

Download

memory/748-296-0x0000018932680000-0x0000018932750000-memory.dmp

Download

memory/748-297-0x0000018932680000-0x0000018932750000-memory.dmp

Download

memory/748-295-0x0000018932680000-0x0000018932750000-memory.dmp

Download

memory/3016-144-0x0000000010000000-0x0000000010032000-memory.dmp

Download

memory/3016-152-0x0000000010000000-0x0000000010032000-memory.dmp

Download

memory/3016-151-0x0000000010000000-0x0000000010032000-memory.dmp

Download

memory/3016-150-0x0000000010000000-0x0000000010032000-memory.dmp

Download

memory/3016-153-0x0000000010000000-0x0000000010032000-memory.dmp

Download

memory/3016-290-0x0000000010000000-0x0000000010032000-memory.dmp

Download

memory/4148-85-0x0000000010000000-0x0000000010033000-memory.dmp

Download

memory/4148-87-0x0000000010000000-0x0000000010033000-memory.dmp

Download

memory/4148-86-0x0000000010000000-0x0000000010033000-memory.dmp

Download

memory/4148-78-0x0000000010000000-0x0000000010033000-memory.dmp

Download

memory/4148-84-0x0000000010000000-0x0000000010033000-memory.dmp

Download

memory/4148-90-0x0000000010000000-0x0000000010033000-memory.dmp

Download

memory/4372-108-0x000001A9FC900000-0x000001A9FC9B5000-memory.dmp

Download

memory/4372-110-0x000001A9FCA20000-0x000001A9FCA3C000-memory.dmp

Download

memory/4372-109-0x000001A9FC6C0000-0x000001A9FC6CA000-memory.dmp

Download

memory/4372-91-0x000001A9E1720000-0x000001A9E172C000-memory.dmp

Download

memory/4372-99-0x000001A9FA020000-0x000001A9FA042000-memory.dmp

Download

memory/4372-107-0x000001A9FC8E0000-0x000001A9FC8FC000-memory.dmp

Download

memory/5044-38-0x0000000007960000-0x00000000079F6000-memory.dmp

Download

memory/5044-25-0x0000000070220000-0x000000007026C000-memory.dmp

Download

memory/5044-42-0x0000000007A20000-0x0000000007A3A000-memory.dmp

Download

memory/5044-40-0x0000000007900000-0x000000000790E000-memory.dmp

Download

memory/5044-39-0x00000000078D0000-0x00000000078E1000-memory.dmp

Download

memory/5044-43-0x0000000007950000-0x0000000007958000-memory.dmp

Download

memory/5044-37-0x0000000007730000-0x000000000773A000-memory.dmp

Download

memory/5044-36-0x00000000076D0000-0x00000000076EA000-memory.dmp

Download

memory/5044-35-0x0000000007D10000-0x000000000838A000-memory.dmp

Download

memory/5044-34-0x0000000007590000-0x0000000007633000-memory.dmp

Download

memory/5044-33-0x0000000006960000-0x000000000697E000-memory.dmp

Download

memory/5044-41-0x0000000007910000-0x0000000007924000-memory.dmp

Download

memory/5044-24-0x0000000007550000-0x0000000007582000-memory.dmp

Download

memory/5044-23-0x00000000063D0000-0x000000000641C000-memory.dmp

Download

memory/5044-22-0x00000000063A0000-0x00000000063BE000-memory.dmp

Download

memory/5044-21-0x0000000005E30000-0x0000000006184000-memory.dmp

Download

memory/5044-13-0x0000000005CC0000-0x0000000005D26000-memory.dmp

Download

memory/5044-12-0x0000000005490000-0x00000000054F6000-memory.dmp

Download

memory/5044-11-0x00000000053F0000-0x0000000005412000-memory.dmp

Download

memory/5044-10-0x0000000005690000-0x0000000005CB8000-memory.dmp

Download

memory/5044-9-0x0000000005050000-0x0000000005060000-memory.dmp

Download

memory/5044-8-0x0000000002A90000-0x0000000002AC6000-memory.dmp

Download

memory/5044-7-0x0000000005050000-0x0000000005060000-memory.dmp

Download