0d4755125431b2df6a5232950b6c475bb6ae459a35503d64a6bc2c8075f5e2e5

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 18:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Drv_ceo_12.8.1_x64.exe
Size 14.6MB
Sample260808-wxaefsbp41
SHA256 0d4755125431b2df6a5232950b6c475bb6ae459a35503d64a6bc2c8075f5e2e5
MD5 858d6d91e6d04cb26acb51fcb516f9c1
SHA1 6790e1cbf6798382504915d09bbf8b5aacc10dfe
SHA512 9c38f256706683f6780032f06d7b15a34481cb2cb9c65e9cb2e57adbb5e521e2165d49edfc3302b18c249b4afe76c28cd90e35465356a0a9b8cbb5d741b48700
SSDEEP 393216:xxVCkFeObsJGHu9zwkXiJlrWqMudtVzBNdzV3:xxV7FtluRXFxudrzlR
TLSH
T1C2F6334225E634E7F273A3B47C7BA9386A13CC359AA707A00384F5E5BC5574528B72CB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution ransomware

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2588	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
4632	ev2f79.exe
5512	ev2c34.exe

Loads dropped DLL 3 IoCs

pid	Process
5716	Drv_ceo_12.8.1_x64.exe
5716	Drv_ceo_12.8.1_x64.exe
5716	Drv_ceo_12.8.1_x64.exe

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
3536	tasklist.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Community\TikTok Installer.exe	Drv_ceo_12.8.1_x64.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_2h0lfwks.p21.ps1	vssvc.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_jthumzme.5hk.psm1	vssvc.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_vtt4e0ye.fjj.ps1	vssvc.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_zjuzndaj.tmn.psm1	vssvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4336	cmd.exe
4532	cmd.exe
2760	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ev2f79.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ev2c34.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Drv_ceo_12.8.1_x64.exe

Modifies data under HKEY_USERS 46 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	vssvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	vssvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	vssvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	vssvc.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2588	powershell.exe
2588	powershell.exe
4632	ev2f79.exe
4632	ev2f79.exe
4632	ev2f79.exe
4632	ev2f79.exe
4632	ev2f79.exe
4632	ev2f79.exe
5504	vssvc.exe
5512	ev2c34.exe
5512	ev2c34.exe
5512	ev2c34.exe
5512	ev2c34.exe
5512	ev2c34.exe
5512	ev2c34.exe
5512	ev2c34.exe
5512	ev2c34.exe
5512	ev2c34.exe
5512	ev2c34.exe
5096	UserAccountBroker.exe
5096	UserAccountBroker.exe
1760	edpnotify.exe
1760	edpnotify.exe
1760	edpnotify.exe
1760	edpnotify.exe
1760	edpnotify.exe
1760	edpnotify.exe
1760	edpnotify.exe
1760	edpnotify.exe
1760	edpnotify.exe
1760	edpnotify.exe
1760	edpnotify.exe
1760	edpnotify.exe
1760	edpnotify.exe
1760	edpnotify.exe
1760	edpnotify.exe
1760	edpnotify.exe
1760	edpnotify.exe
1760	edpnotify.exe
1760	edpnotify.exe
1760	edpnotify.exe
1760	edpnotify.exe
1760	edpnotify.exe
1760	edpnotify.exe
1760	edpnotify.exe
1760	edpnotify.exe
1760	edpnotify.exe
1760	edpnotify.exe
1760	edpnotify.exe
1760	edpnotify.exe
1760	edpnotify.exe
1760	edpnotify.exe
1760	edpnotify.exe
1760	edpnotify.exe
1760	edpnotify.exe
1760	edpnotify.exe
1760	edpnotify.exe
1760	edpnotify.exe
1760	edpnotify.exe
1760	edpnotify.exe
1760	edpnotify.exe
1760	edpnotify.exe
1760	edpnotify.exe
1760	edpnotify.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5096	UserAccountBroker.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
4632	ev2f79.exe
5512	ev2c34.exe
5512	ev2c34.exe
5512	ev2c34.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3536	tasklist.exe
Token: SeDebugPrivilege	2588	powershell.exe
Token: SeIncreaseQuotaPrivilege	2588	powershell.exe
Token: SeSecurityPrivilege	2588	powershell.exe
Token: SeTakeOwnershipPrivilege	2588	powershell.exe
Token: SeLoadDriverPrivilege	2588	powershell.exe
Token: SeSystemProfilePrivilege	2588	powershell.exe
Token: SeSystemtimePrivilege	2588	powershell.exe
Token: SeProfSingleProcessPrivilege	2588	powershell.exe
Token: SeIncBasePriorityPrivilege	2588	powershell.exe
Token: SeCreatePagefilePrivilege	2588	powershell.exe
Token: SeBackupPrivilege	2588	powershell.exe
Token: SeRestorePrivilege	2588	powershell.exe
Token: SeShutdownPrivilege	2588	powershell.exe
Token: SeDebugPrivilege	2588	powershell.exe
Token: SeSystemEnvironmentPrivilege	2588	powershell.exe
Token: SeRemoteShutdownPrivilege	2588	powershell.exe
Token: SeUndockPrivilege	2588	powershell.exe
Token: SeManageVolumePrivilege	2588	powershell.exe
Token: 33	2588	powershell.exe
Token: 34	2588	powershell.exe
Token: 35	2588	powershell.exe
Token: 36	2588	powershell.exe
Token: SeDebugPrivilege	4632	ev2f79.exe
Token: SeBackupPrivilege	5504	vssvc.exe
Token: SeRestorePrivilege	5504	vssvc.exe
Token: SeAuditPrivilege	5504	vssvc.exe
Token: SeDebugPrivilege	5504	vssvc.exe
Token: SeAssignPrimaryTokenPrivilege	5504	vssvc.exe
Token: SeIncreaseQuotaPrivilege	5504	vssvc.exe
Token: SeSecurityPrivilege	5504	vssvc.exe
Token: SeTakeOwnershipPrivilege	5504	vssvc.exe
Token: SeLoadDriverPrivilege	5504	vssvc.exe
Token: SeSystemtimePrivilege	5504	vssvc.exe
Token: SeBackupPrivilege	5504	vssvc.exe
Token: SeRestorePrivilege	5504	vssvc.exe
Token: SeShutdownPrivilege	5504	vssvc.exe
Token: SeSystemEnvironmentPrivilege	5504	vssvc.exe
Token: SeUndockPrivilege	5504	vssvc.exe
Token: SeManageVolumePrivilege	5504	vssvc.exe
Token: SeAssignPrimaryTokenPrivilege	5504	vssvc.exe
Token: SeIncreaseQuotaPrivilege	5504	vssvc.exe
Token: SeSecurityPrivilege	5504	vssvc.exe
Token: SeTakeOwnershipPrivilege	5504	vssvc.exe
Token: SeLoadDriverPrivilege	5504	vssvc.exe
Token: SeSystemtimePrivilege	5504	vssvc.exe
Token: SeBackupPrivilege	5504	vssvc.exe
Token: SeRestorePrivilege	5504	vssvc.exe
Token: SeShutdownPrivilege	5504	vssvc.exe
Token: SeSystemEnvironmentPrivilege	5504	vssvc.exe
Token: SeUndockPrivilege	5504	vssvc.exe
Token: SeManageVolumePrivilege	5504	vssvc.exe
Token: SeAssignPrimaryTokenPrivilege	5504	vssvc.exe
Token: SeIncreaseQuotaPrivilege	5504	vssvc.exe
Token: SeSecurityPrivilege	5504	vssvc.exe
Token: SeTakeOwnershipPrivilege	5504	vssvc.exe
Token: SeLoadDriverPrivilege	5504	vssvc.exe
Token: SeSystemtimePrivilege	5504	vssvc.exe
Token: SeBackupPrivilege	5504	vssvc.exe
Token: SeRestorePrivilege	5504	vssvc.exe
Token: SeShutdownPrivilege	5504	vssvc.exe
Token: SeSystemEnvironmentPrivilege	5504	vssvc.exe
Token: SeUndockPrivilege	5504	vssvc.exe
Token: SeManageVolumePrivilege	5504	vssvc.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5716 wrote to memory of 2760	5716	Drv_ceo_12.8.1_x64.exe	89
PID 2760 wrote to memory of 3536	2760	cmd.exe	91
PID 2760 wrote to memory of 5144	2760	cmd.exe	92
PID 5716 wrote to memory of 4336	5716	Drv_ceo_12.8.1_x64.exe	94
PID 4336 wrote to memory of 4532	4336	cmd.exe	96
PID 4532 wrote to memory of 2588	4532	cmd.exe	97
PID 5716 wrote to memory of 4632	5716	Drv_ceo_12.8.1_x64.exe	99
PID 5716 wrote to memory of 5512	5716	Drv_ceo_12.8.1_x64.exe	101

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\Drv_ceo_12.8.1_x64.exe
"C:\Users\Admin\AppData\Local\Temp\Drv_ceo_12.8.1_x64.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5716
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C tasklist | findstr /I /C:"360tray.exe" /C:"HipsTray.exe"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2760
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3536
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I /C:"360tray.exe" /C:"HipsTray.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5144
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C start "" /B cmd.exe /C "powershell Add-MpPreference -ExclusionPath C:\,D:\,F:\"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4336
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /C "powershell Add-MpPreference -ExclusionPath C:\,D:\,F:\"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4532
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell Add-MpPreference -ExclusionPath C:\,D:\,F:\
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2588
- C:\Users\Admin\AppData\Roaming\comain_ev2f79\ev2f79.exe
  "C:\Users\Admin\AppData\Roaming\comain_ev2f79\ev2f79.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  PID:4632
- C:\Users\Admin\AppData\Roaming\comain_ev2c34\ev2c34.exe
  "C:\Users\Admin\AppData\Roaming\comain_ev2c34\ev2c34.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:5512

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5504

C:\Windows\System32\UserAccountBroker.exe
C:\Windows\System32\UserAccountBroker.exe
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:5096

C:\Windows\System32\edpnotify.exe
C:\Windows\System32\edpnotify.exe
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1760

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1040

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsk8E9C.tmp\System.dll
Size 11KB
SHA256 a0cac4cf4852895619bc7743ebeb89f9e4927ccdb9e66b1bcd92a4136d0f9c77
MD5 b0c77267f13b2f87c084fd86ef51ccfc
SHA1 f7543f9e9b4f04386dfbf33c38cbed1bf205afb3
SHA512 f2b57a2eea00f52a3c7080f4b5f2bb85a7a9b9f16d12da8f8ff673824556c62a0f742b72be0fd82a2612a4b6dbd7e0fdc27065212da703c2f7e28d199696f66e
SSDEEP 192:4PtkiQJr7jHYT87RfwXQ6YSYtOuVDi7IsFW14Ll8CO:H78TQIgGCDp14LGC
TLSH
T162324A1503904AF3F996C13C14263ABF7F792A218BF14E939FA39481BE2D5D96D39312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsk8E9C.tmp\nsExec.dll
Size 6KB
SHA256 b22c8f676dec58be8d25fbad1a37835ffc4029f29aaf79f4dc0337ca73a38782
MD5 1f49d8af9be9e915d54b2441c4a79adf
SHA1 1ee4f809c693e31f34bc6d8153664a6dc2c3e499
SHA512 c60827e322e3168a79795ffd4beb0b0039842128255100d6b005d261402d2ff570f3866f441f3d3c063097c71d44bc5ae80d177fa91ef4e46fc8c2d97de27aa4
SSDEEP 96:67GUxNkO6GR0t9GKKr1Zd8NHYVVHp4dEeY3kRnHdMqqyVgNo3e:kXhHR0aTQN4gRHdMqJVgNv
TLSH
T17CD1F97675E22EF3D54ACA353C127A2B57F8C8111B9401549B938BD238C5EB3EA29282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ap.asin

Path C:\Users\Admin\AppData\Roaming\comain_ev2c34\ap.asin
Size 260B
SHA256 156fb419996462ba4024e6c60fa36c4e240b3d6bf68a31a99cc636083ee17635
MD5 6f5c6b9996e22dadb932ba02143fdcf4
SHA1 66123e75cb1b1102bb57d7b4a1f29cc1d7ad0a96
SHA512 bbd9beb10dfe370102638988d1f192be57eb846a0e4f8c142c2b76605193b764cd83fe0c3a609fbebccf7b5ebce05dfaf65f369811a85731a08f533bc89d47b6
TLSH
T1ACD09526D324E773717A6F1C191C647B4850F5D0661B470F1C260961F333354F1C6154
MD5 SHA1 SHA512 TLSH

Submit Download

bnymir.ou

Path C:\Users\Admin\AppData\Roaming\comain_ev2c34\bnymir.ou
Size 532KB
SHA256 80ea61aa50e8fc47f3db2b37eca7350b21a3aa8f957c7cf9490bb7c3757379e1
MD5 815067a5e4249ee4eb85623e98cb2342
SHA1 39280f0e0d48f70f52f937c2cdfe818d955a60f5
SHA512 903671e91e3a59bc5b4f38f4e0b42d2782e38f184b7353aab2a2597c9dcad66cd69b1bf4000452b2bb2ad90909f37e95b6705986a3fb6b00fa44fb3ea87d645c
SSDEEP 6144:gRGgKEU4IG7q/0lbvmNoUvV9tUzLILgQNTEmTbx0uXQs4SS02Gb257n0vMI52a4y:8GT4ZW/0mNo+kLIUMNYnNBi80JIa4jG
TLSH
T103C49D2A193E1ED925B897E3B88D208778F7334097DED530C19A9F34DAD121AC7B9187
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bteuns.pt

Path C:\Users\Admin\AppData\Roaming\comain_ev2c34\bteuns.pt
Size 540KB
SHA256 29fbb5abc68c1c3f912500670f2ceb41b4ba3a9bf6af9c9a681aedfa7eb8e279
MD5 d16ffb40d809b472c0ac0e00de344603
SHA1 d01ea21a4cb5fa064bcf2189178eac67e65cb8fb
SHA512 7cc8d34ee3879887dee17cd66bc60d94d3f16a2ce60d8109e9e61caa815e8e1c847e25abb658a4b14222319a996774fb1bb72f91273879c29636c51c3a81d91e
SSDEEP 6144:htCQfGiUkFPSvVQGmsbCBHrv3jG9+0pj7jUoam34u9V86HRp3fIWuLN04U4PFnov:7CQakxACBHrQ33dIWoWGdsBUdFyV8xC
TLSH
T16AC49D570D3D7E2D26D05293B44C4AD33DF223809BEDC031939D9E6816D6A2AB9F52E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cmrsk.ce

Path C:\Users\Admin\AppData\Roaming\comain_ev2c34\cmrsk.ce
Size 192KB
SHA256 2f592516e42bdf4b48eb92eced833db8c43681d00874257ee6e53395104d0142
MD5 c29ce1444d383e214229ea790d7f8d08
SHA1 42fdcca1407be41c3e81caf99c9713a338860c2b
SHA512 41719e4dbb1bd2afcf5ecb00064c4e5b8e10f913bcab7222f745addd792d73f5c6cd11f6c1c027a08493e53a82956b6114d9aa4be8c514ed494d9292bf8a3e57
SSDEEP 3072:QGKsStsAj22SSRX4TgA2nRb4nLjPIn0knDVnBPALhH8Ly/6gZfY3ea:QGDLADoMXWPI0kDVV74A3ea
TLSH
T199148DA7195CAFB879644AD338CC14875CB72350F7EE953282AF8F710AA216663F4317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ev2c34.exe.nhpart_2d004296fcc8

Path C:\Users\Admin\AppData\Roaming\comain_ev2c34\ev2c34.exe.nhpart_2d004296fcc8
Size 1.6MB
SHA256 d80c12abd623a0614e09163687fa73cb327d756749c1d18563cd1e1dd7d7b31d
MD5 4772240f5a3a09c61928b12100db84ef
SHA1 f93532036c08d51bb36978d3692d3258ac300260
SHA512 13236f7994b432304fd050e4ca6dc503a338cc87c6ef4ca0481305213411ddf95a966f4e002ddc18d2fbbc3c687458094c947027b1f78480fb5f670ee75a3285
SSDEEP 49152:mJiGf3A0K4SY7DALL/YCHZ8F5jyLsZrQ3Mh1D9b+ts5:YiyJe3YI8F5eIqe1DBX5
TLSH
T133752211BAE84032E1B3293069F299F20EBDBC715A755A9B03451D6C1F30BD2E73976B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fhkan.oi

Path C:\Users\Admin\AppData\Roaming\comain_ev2c34\fhkan.oi
Size 183KB
SHA256 d50b4753fd94a5d80e3931356fb483ceee749e7421e61dd5aa698805a2d6ff3b
MD5 18a66d07214b9a2032b84b933ff9643f
SHA1 d52c8c6c83c99e8144b5928cad49c50aff0e4005
SHA512 b09e0b0f863aaef54e15dd15b48e65c640ab06e9f76c0d4adefd51a56bf192834ad3d853e1de5346a3a07264e452604e2f358ccf517bc332c3ee198c259adfe2
SSDEEP 3072:civQVf3oHjTDC89SrDvwC8NsgG8a9tqFua+GLJHo3idqJZTRbD:BEoHvD17Ha9gblLJHo3iIbD
TLSH
T18D04BE54061B9E34AC1D09D3B53429E962E630CCF1ED2664AB5F9E2351D85BF23F8363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxyvnb.ti

Path C:\Users\Admin\AppData\Roaming\comain_ev2f79\dxyvnb.ti
Size 45KB
SHA256 700f323400cebc41c77236144b8ed387acb93bfbef64a40af4faf12df8ce2cff
MD5 9f5ba8ae6992938c424ec9d3fd600328
SHA1 c4617c56db6b629648f40809bdc429bb6cab5e42
SHA512 366ac33d1e46d746b6a7708f184581d1bed221353662a3111103fd04adc084227af193af2919cfd65b5455fe7cc94b6235403c4f0743d92f7148d998d9e50884
SSDEEP 768:yHAV+4PFUW7/7yCIQD7w7h6BQszODjRv/9bHQ3fw+glPhvRpb4f:yHAV5PFPR3D7w7hbIODjRn9cw+gPRu
TLSH
T1CE23D14001E66796B248C05379AD8C4B68ED9F856F8EB06D13D4BE591CDCFBAC2F9063
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ev2f79.exe

Path C:\Users\Admin\AppData\Roaming\comain_ev2f79\ev2f79.exe
Size 1.6MB
SHA256 58b5185a7c1c4b22846cc19a2b67ffe62f1dc3e72c0c6d9f1026579a44ad6e97
MD5 8c2f68befd6af97973f761f7c4d09f85
SHA1 0604a419b66f785996cce0135d2a08ff6ef86207
SHA512 e9b8e6c8189bac873fe27609c60a1fe34e4175b761dbb194e36c6a3efa3a273c06fba88e0e4435d3553ea9898cb300fb4d8f98d66d266f396d92cc529146c3ba
SSDEEP 49152:mFiGf3A0K4SY7DALL/YCHZ8F5jyLsZrQ3Mh1D9b+ts5:YiyJe3YI8F5eIqe1DBX5
TLSH
T1FF752211BAE84032E1B3293069F299F20EBDBC715A755A9B03451D6C1F30BD2E73976B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

otrm.oi

Path C:\Users\Admin\AppData\Roaming\comain_ev2f79\otrm.oi
Size 187KB
SHA256 cad3a6119836f449186774952891d78502213c894904eb3b2892fd3d0545a191
MD5 b9e777d1b8188b741060a419d6e31b79
SHA1 1490a4305145265afa1698a3cbd86bba86d72c51
SHA512 098682bd57f327780a3680fa9da58507b6b9af78c9dd372ad59982bb2c3fa3c2e27633e2f64fc651945b23e213dd55d69c0e95bc05e1f3230f01a9847b3d7aaa
SSDEEP 3072:MV5/DaVUb0Qs0po+mCuc9ejn47RFJ3PVL1JaehS3/EFSK7mjB:w0UbuE/nucJr1JaQa+X7mjB
TLSH
T114148D95839B5F3499AE44E3B5148AEA98893055FADD13C8FF4E8F5300D16FA91F8383
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_2h0lfwks.p21.ps1

Path C:\Windows\SystemTemp\__PSScriptPolicyTest_2h0lfwks.p21.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1760-300-0x0000000180000000-0x000000018008E000-memory.dmp

Download

memory/2588-21-0x0000000070960000-0x00000000709AC000-memory.dmp

Download

memory/2588-13-0x0000000005E40000-0x0000000005EA6000-memory.dmp

Download

memory/2588-25-0x00000000075F0000-0x0000000007693000-memory.dmp

Download

memory/2588-27-0x0000000007730000-0x000000000774A000-memory.dmp

Download

memory/2588-26-0x0000000007D70000-0x00000000083EC000-memory.dmp

Download

memory/2588-28-0x00000000077A0000-0x00000000077AA000-memory.dmp

Download

memory/2588-29-0x00000000079A0000-0x0000000007A36000-memory.dmp

Download

memory/2588-31-0x0000000073FC0000-0x000000007477C000-memory.dmp

Download

memory/2588-20-0x0000000007580000-0x00000000075B6000-memory.dmp

Download

memory/2588-19-0x0000000006470000-0x00000000064BC000-memory.dmp

Download

memory/2588-7-0x0000000073FD2000-0x0000000073FD3000-memory.dmp

Download

memory/2588-8-0x0000000004EC0000-0x0000000004EF6000-memory.dmp

Download

memory/2588-24-0x00000000069B0000-0x00000000069D0000-memory.dmp

Download

memory/2588-9-0x0000000005650000-0x0000000005C9A000-memory.dmp

Download

memory/2588-10-0x0000000073FC0000-0x000000007477C000-memory.dmp

Download

memory/2588-18-0x00000000063A0000-0x00000000063BE000-memory.dmp

Download

memory/2588-17-0x0000000005F20000-0x000000000627B000-memory.dmp

Download

memory/2588-11-0x00000000055E0000-0x0000000005602000-memory.dmp

Download

memory/2588-14-0x0000000073FC0000-0x000000007477C000-memory.dmp

Download

memory/2588-12-0x0000000005DD0000-0x0000000005E36000-memory.dmp

Download

memory/4632-72-0x0000000010000000-0x0000000010033000-memory.dmp

Download

memory/4632-77-0x0000000010000000-0x0000000010033000-memory.dmp

Download

memory/4632-74-0x0000000010000000-0x0000000010033000-memory.dmp

Download

memory/4632-73-0x0000000010000000-0x0000000010033000-memory.dmp

Download

memory/4632-65-0x0000000010000000-0x0000000010033000-memory.dmp

Download

memory/4632-71-0x0000000010000000-0x0000000010033000-memory.dmp

Download

memory/5096-316-0x00000272B2E80000-0x00000272B2F50000-memory.dmp

Download

memory/5096-286-0x0000000180000000-0x000000018008A000-memory.dmp

Download

memory/5096-320-0x00000272B2E80000-0x00000272B2F50000-memory.dmp

Download

memory/5096-315-0x00000272B2E80000-0x00000272B2F50000-memory.dmp

Download

memory/5096-318-0x00000272B2E80000-0x00000272B2F50000-memory.dmp

Download

memory/5096-321-0x00000272B2E80000-0x00000272B2F50000-memory.dmp

Download

memory/5096-317-0x00000272B2E80000-0x00000272B2F50000-memory.dmp

Download

memory/5096-319-0x00000272B2E80000-0x00000272B2F50000-memory.dmp

Download

memory/5504-84-0x0000018165F90000-0x0000018165FAE000-memory.dmp

Download

memory/5504-87-0x0000018166090000-0x00000181660AE000-memory.dmp

Download

memory/5504-86-0x000001814D380000-0x000001814D38A000-memory.dmp

Download

memory/5504-85-0x0000018165FB0000-0x0000018166062000-memory.dmp

Download

memory/5504-78-0x000001814D0A0000-0x000001814D0AC000-memory.dmp

Download

memory/5504-81-0x000001814D1B0000-0x000001814D1D2000-memory.dmp

Download

memory/5512-314-0x0000000010000000-0x0000000010032000-memory.dmp

Download

memory/5512-122-0x0000000010000000-0x0000000010032000-memory.dmp

Download

memory/5512-128-0x0000000010000000-0x0000000010032000-memory.dmp

Download

memory/5512-129-0x0000000010000000-0x0000000010032000-memory.dmp

Download

memory/5512-131-0x0000000010000000-0x0000000010032000-memory.dmp

Download

memory/5512-130-0x0000000010000000-0x0000000010032000-memory.dmp

Download