94e092b96e1673bb1efe3ec6bbfe810b02b7ca90ee3fa4df56dce4cc685874bb

Analysis

user interaction
yes
max time kernel
600s
max time network
583s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
16/08/2026, 16:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
new_Hellogpt_take119_Setup_win.exe
Size 141.8MB
Sample260816-tha2bsdr7v
SHA256 94e092b96e1673bb1efe3ec6bbfe810b02b7ca90ee3fa4df56dce4cc685874bb
MD5 256083ae516faed43bd09a17e78a314f
SHA1 ebbda5e131a651535ed97959c10dc51177df40b3
SHA512 a240e64184b15b9f6f21d52daf49fb64dab7df519ae1327d29b1b404df5c4acd1c246428e20c7097e207c6c38f555b05efbec0de2e86af2b85627f56297e2022
SSDEEP 3145728:LZthIyPhiAkvn6v3gk4qcHp5TC0nKtxSDWJU3EDfHhvR9Xrg6W:1I1FvqCqcHx3Cq4fHh7XM1
TLSH
T14D6833A284A18D4ACDEA793195A6F9B991937D2BC7C7CB03FDE57D8B373B9401E04102
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution ransomware

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4236	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
3860	ev2f79.exe
948	ev2c34.exe

Loads dropped DLL 4 IoCs

pid	Process
3144	new_Hellogpt_take119_Setup_win.exe
3144	new_Hellogpt_take119_Setup_win.exe
3144	new_Hellogpt_take119_Setup_win.exe
3144	new_Hellogpt_take119_Setup_win.exe

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
4652	tasklist.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Community\Hello-GPT_1.3.15_x64.exe	new_Hellogpt_take119_Setup_win.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5240	cmd.exe
3796	cmd.exe
964	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ev2c34.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	new_Hellogpt_take119_Setup_win.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ev2f79.exe

Modifies data under HKEY_USERS 46 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	vssvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	vssvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	vssvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	vssvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	vssvc.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4236	powershell.exe
4236	powershell.exe
3860	ev2f79.exe
3860	ev2f79.exe
3860	ev2f79.exe
3860	ev2f79.exe
3860	ev2f79.exe
3860	ev2f79.exe
5124	vssvc.exe
948	ev2c34.exe
948	ev2c34.exe
948	ev2c34.exe
948	ev2c34.exe
948	ev2c34.exe
948	ev2c34.exe
948	ev2c34.exe
948	ev2c34.exe
948	ev2c34.exe
948	ev2c34.exe
2772	UserAccountBroker.exe
2772	UserAccountBroker.exe
1008	edpnotify.exe
1008	edpnotify.exe
1008	edpnotify.exe
1008	edpnotify.exe
1008	edpnotify.exe
1008	edpnotify.exe
1008	edpnotify.exe
1008	edpnotify.exe
1008	edpnotify.exe
1008	edpnotify.exe
1008	edpnotify.exe
1008	edpnotify.exe
1008	edpnotify.exe
1008	edpnotify.exe
1008	edpnotify.exe
1008	edpnotify.exe
1008	edpnotify.exe
1008	edpnotify.exe
1008	edpnotify.exe
1008	edpnotify.exe
1008	edpnotify.exe
1008	edpnotify.exe
1008	edpnotify.exe
1008	edpnotify.exe
1008	edpnotify.exe
1008	edpnotify.exe
1008	edpnotify.exe
1008	edpnotify.exe
1008	edpnotify.exe
1008	edpnotify.exe
1008	edpnotify.exe
1008	edpnotify.exe
1008	edpnotify.exe
1008	edpnotify.exe
1008	edpnotify.exe
1008	edpnotify.exe
1008	edpnotify.exe
1008	edpnotify.exe
1008	edpnotify.exe
1008	edpnotify.exe
1008	edpnotify.exe
1008	edpnotify.exe
1008	edpnotify.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2772	UserAccountBroker.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
3860	ev2f79.exe
948	ev2c34.exe
948	ev2c34.exe
948	ev2c34.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4652	tasklist.exe
Token: SeDebugPrivilege	4236	powershell.exe
Token: SeDebugPrivilege	3860	ev2f79.exe
Token: SeBackupPrivilege	5124	vssvc.exe
Token: SeRestorePrivilege	5124	vssvc.exe
Token: SeAuditPrivilege	5124	vssvc.exe
Token: SeDebugPrivilege	5124	vssvc.exe
Token: SeAssignPrimaryTokenPrivilege	5124	vssvc.exe
Token: SeIncreaseQuotaPrivilege	5124	vssvc.exe
Token: SeSecurityPrivilege	5124	vssvc.exe
Token: SeTakeOwnershipPrivilege	5124	vssvc.exe
Token: SeLoadDriverPrivilege	5124	vssvc.exe
Token: SeSystemtimePrivilege	5124	vssvc.exe
Token: SeBackupPrivilege	5124	vssvc.exe
Token: SeRestorePrivilege	5124	vssvc.exe
Token: SeShutdownPrivilege	5124	vssvc.exe
Token: SeSystemEnvironmentPrivilege	5124	vssvc.exe
Token: SeUndockPrivilege	5124	vssvc.exe
Token: SeManageVolumePrivilege	5124	vssvc.exe
Token: SeAssignPrimaryTokenPrivilege	5124	vssvc.exe
Token: SeIncreaseQuotaPrivilege	5124	vssvc.exe
Token: SeSecurityPrivilege	5124	vssvc.exe
Token: SeTakeOwnershipPrivilege	5124	vssvc.exe
Token: SeLoadDriverPrivilege	5124	vssvc.exe
Token: SeSystemtimePrivilege	5124	vssvc.exe
Token: SeBackupPrivilege	5124	vssvc.exe
Token: SeRestorePrivilege	5124	vssvc.exe
Token: SeShutdownPrivilege	5124	vssvc.exe
Token: SeSystemEnvironmentPrivilege	5124	vssvc.exe
Token: SeUndockPrivilege	5124	vssvc.exe
Token: SeManageVolumePrivilege	5124	vssvc.exe
Token: SeAssignPrimaryTokenPrivilege	5124	vssvc.exe
Token: SeIncreaseQuotaPrivilege	5124	vssvc.exe
Token: SeSecurityPrivilege	5124	vssvc.exe
Token: SeTakeOwnershipPrivilege	5124	vssvc.exe
Token: SeLoadDriverPrivilege	5124	vssvc.exe
Token: SeSystemtimePrivilege	5124	vssvc.exe
Token: SeBackupPrivilege	5124	vssvc.exe
Token: SeRestorePrivilege	5124	vssvc.exe
Token: SeShutdownPrivilege	5124	vssvc.exe
Token: SeSystemEnvironmentPrivilege	5124	vssvc.exe
Token: SeUndockPrivilege	5124	vssvc.exe
Token: SeManageVolumePrivilege	5124	vssvc.exe
Token: SeAssignPrimaryTokenPrivilege	5124	vssvc.exe
Token: SeIncreaseQuotaPrivilege	5124	vssvc.exe
Token: SeSecurityPrivilege	5124	vssvc.exe
Token: SeTakeOwnershipPrivilege	5124	vssvc.exe
Token: SeLoadDriverPrivilege	5124	vssvc.exe
Token: SeSystemtimePrivilege	5124	vssvc.exe
Token: SeBackupPrivilege	5124	vssvc.exe
Token: SeRestorePrivilege	5124	vssvc.exe
Token: SeShutdownPrivilege	5124	vssvc.exe
Token: SeSystemEnvironmentPrivilege	5124	vssvc.exe
Token: SeUndockPrivilege	5124	vssvc.exe
Token: SeManageVolumePrivilege	5124	vssvc.exe
Token: SeAssignPrimaryTokenPrivilege	5124	vssvc.exe
Token: SeIncreaseQuotaPrivilege	5124	vssvc.exe
Token: SeSecurityPrivilege	5124	vssvc.exe
Token: SeTakeOwnershipPrivilege	5124	vssvc.exe
Token: SeLoadDriverPrivilege	5124	vssvc.exe
Token: SeSystemtimePrivilege	5124	vssvc.exe
Token: SeBackupPrivilege	5124	vssvc.exe
Token: SeRestorePrivilege	5124	vssvc.exe
Token: SeShutdownPrivilege	5124	vssvc.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3144 wrote to memory of 5240	3144	new_Hellogpt_take119_Setup_win.exe	79
PID 5240 wrote to memory of 4652	5240	cmd.exe	81
PID 5240 wrote to memory of 3328	5240	cmd.exe	82
PID 3144 wrote to memory of 3796	3144	new_Hellogpt_take119_Setup_win.exe	84
PID 3796 wrote to memory of 964	3796	cmd.exe	86
PID 964 wrote to memory of 4236	964	cmd.exe	87
PID 3144 wrote to memory of 3860	3144	new_Hellogpt_take119_Setup_win.exe	88
PID 3144 wrote to memory of 948	3144	new_Hellogpt_take119_Setup_win.exe	90

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\new_Hellogpt_take119_Setup_win.exe
"C:\Users\Admin\AppData\Local\Temp\new_Hellogpt_take119_Setup_win.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3144
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C tasklist | findstr /I /C:"360tray.exe" /C:"HipsTray.exe"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5240
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4652
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I /C:"360tray.exe" /C:"HipsTray.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3328
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C start "" /B cmd.exe /C "powershell Add-MpPreference -ExclusionPath C:\,D:\,F:\"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3796
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /C "powershell Add-MpPreference -ExclusionPath C:\,D:\,F:\"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:964
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell Add-MpPreference -ExclusionPath C:\,D:\,F:\
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4236
- C:\Users\Admin\AppData\Roaming\comain_ev2f79\ev2f79.exe
  "C:\Users\Admin\AppData\Roaming\comain_ev2f79\ev2f79.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  PID:3860
- C:\Users\Admin\AppData\Roaming\comain_ev2c34\ev2c34.exe
  "C:\Users\Admin\AppData\Roaming\comain_ev2c34\ev2c34.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:948

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5124

C:\Windows\System32\UserAccountBroker.exe
C:\Windows\System32\UserAccountBroker.exe
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:2772

C:\Windows\System32\edpnotify.exe
C:\Windows\System32\edpnotify.exe
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1008

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_uqtrmtgs.vec.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uqtrmtgs.vec.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

InstallOptions.dll

Path C:\Users\Admin\AppData\Local\Temp\nsv637.tmp\InstallOptions.dll
Size 14KB
SHA256 31944b93e44301974d9c6f810d2da792e34a53dcacd619a08cb0385ac59e513d
MD5 5f35212d7e90ee622b10be39b09bd270
SHA1 c4bc9593902adf6daaef37e456dc6100d50d0925
SHA512 7514810367f56d994c6d5703b56ac16124fab5dfdcfbe337d4413274c1ff9037a2ee623e49ab2fb6227412ab29fcc49a3ada1391910d44c2b5de0adeb3e7c2f0
SSDEEP 192:E4n3T5aK+dHCMR1aQR9RuZl3WWmU7WYZsw1JpVGnrjaK72dwF7dBOne:tn3T5KdHCMRD/R1cOnrja+BO
TLSH
T187622B55738488F3DBE2003E785237079B995565B4929ED2CA275FC6687B08D7EB2303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsv637.tmp\System.dll
Size 11KB
SHA256 6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e
MD5 fccff8cb7a1067e23fd2e2b63971a8e1
SHA1 30e2a9e137c1223a78a0f7b0bf96a1c361976d91
SHA512 f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c
SSDEEP 192:xPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4v:g7VpNo8gmOyRsVc4
TLSH
T116326D5503504AF3E996863C00263B7FAF796A2095F14D53CFA394C0FE2E5C9AD38352
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsv637.tmp\ioSpecial.ini
Size 526B
SHA256 75c1272bea61b1e7d6107a68774d5af392ea0f1aec0968dd20e88e59812409db
MD5 ed11879f19e0f684c7447b554c1e195e
SHA1 b0834ef862834d33726005ccdb5b07c38b2063d5
SHA512 9a3cd5ee51f0bd887e5d4ed7ee12583868a9165cb93c2efbff6c90a4afda0fc4279afb4139e6075c3d3ce1f288127245db3af69b8be1d1de7d061e58af6ffa4a
TLSH
T14AF05988802DC3A444A4595359BA375537D02E3097297AF5F2228CC76B8CDD598CC682
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsv637.tmp\ioSpecial.ini
Size 611B
SHA256 ed5548c8e1740399dfd1bb47bece66bfdf7fb714d0c174e0cba9912641debde7
MD5 6cf23355a7c50e863ed4632b692b46df
SHA1 29a76ed702b45337a8f8cc288074186efd41cde6
SHA512 87624808c267ebb5613888b291a12d7955082c5cf6f503e405d46f6a61da759bf44942a6556b7421b8ce595c98eaa3cc0b76954da35b793928328201eb85fbbb
TLSH
T118F0AC85440E832944305413866B3A5513F42F200B0C3AF1F1319C837F4DDD598CD983
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsv637.tmp\ioSpecial.ini
Size 637B
SHA256 dc44fafc883bd81c0b0b873dd0fdbf782a6ad36eec047a1b789059fb5b1248f8
MD5 65cecdbb5f22bfffed9415a6ad464889
SHA1 8e1539f132f4f46c8c84347b1c8874325578ead5
SHA512 059d56f2cca98c1c0cf866fb5196d37331296a237032f425713f84b6fa163461769b5dfcacbe345b5970c04754734489c6e8b4736bb273b3e2164da45392050e
TLSH
T163F07889850E836944709453966B3A9527F42F305B1C7AF1F23298837B4DDD5A8CD983
MD5 SHA1 SHA512 TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsv637.tmp\nsExec.dll
Size 6KB
SHA256 114c6941a8b489416c84563e94fd266ea5cad2b518db45cd977f1f9761e00cb1
MD5 09c2e27c626d6f33018b8a34d3d98cb6
SHA1 8d6bf50218c8f201f06ecf98ca73b74752a2e453
SHA512 883454bef7b6de86d53af790755ae624f756b48b23970f865558ba03a5aecfa8d15f14700e92b3c51546e738c93e53dc50b8a45f79ef3f00aa84382853440954
SSDEEP 96:pBNUBGfVwhcAlhPRJAixx+3eDEsgcBbcB/NFyVOHd0+uisX4:qBGfV5AlJJfFgcBbcB/N8Ved0P
TLSH
T136D1D63B6AD029F3D0498930286779368BF988360F614210EFAB19E535E5DEBDA20647
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ap.asin

Path C:\Users\Admin\AppData\Roaming\comain_ev2c34\ap.asin
Size 260B
SHA256 c563981cd3b62dded0c0f01cc14a08a90dc4c1061220c6f115f6193e73f6b71c
MD5 315032b5827a9f3307156ad6f23b04dd
SHA1 2bc6cada4c3a67e1469530f5685cc329365719c1
SHA512 df13e74d7c9e7843de0a4b4d5f03e7ca2490a0d9955d807f178f7243023d79c2a535959fcda0ed66413bd685ebdc873001457d076092fcf5e5da336856c9d0b4
TLSH
T1CAD09521C314D773756A2F6C092C647ACD11FFE17717494B1C554950F231258E4C715C
MD5 SHA1 SHA512 TLSH

Submit Download

bnymir.ou

Path C:\Users\Admin\AppData\Roaming\comain_ev2c34\bnymir.ou
Size 532KB
SHA256 80ea61aa50e8fc47f3db2b37eca7350b21a3aa8f957c7cf9490bb7c3757379e1
MD5 815067a5e4249ee4eb85623e98cb2342
SHA1 39280f0e0d48f70f52f937c2cdfe818d955a60f5
SHA512 903671e91e3a59bc5b4f38f4e0b42d2782e38f184b7353aab2a2597c9dcad66cd69b1bf4000452b2bb2ad90909f37e95b6705986a3fb6b00fa44fb3ea87d645c
SSDEEP 6144:gRGgKEU4IG7q/0lbvmNoUvV9tUzLILgQNTEmTbx0uXQs4SS02Gb257n0vMI52a4y:8GT4ZW/0mNo+kLIUMNYnNBi80JIa4jG
TLSH
T103C49D2A193E1ED925B897E3B88D208778F7334097DED530C19A9F34DAD121AC7B9187
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bteuns.pt

Path C:\Users\Admin\AppData\Roaming\comain_ev2c34\bteuns.pt
Size 540KB
SHA256 29fbb5abc68c1c3f912500670f2ceb41b4ba3a9bf6af9c9a681aedfa7eb8e279
MD5 d16ffb40d809b472c0ac0e00de344603
SHA1 d01ea21a4cb5fa064bcf2189178eac67e65cb8fb
SHA512 7cc8d34ee3879887dee17cd66bc60d94d3f16a2ce60d8109e9e61caa815e8e1c847e25abb658a4b14222319a996774fb1bb72f91273879c29636c51c3a81d91e
SSDEEP 6144:htCQfGiUkFPSvVQGmsbCBHrv3jG9+0pj7jUoam34u9V86HRp3fIWuLN04U4PFnov:7CQakxACBHrQ33dIWoWGdsBUdFyV8xC
TLSH
T16AC49D570D3D7E2D26D05293B44C4AD33DF223809BEDC031939D9E6816D6A2AB9F52E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cmrsk.ce

Path C:\Users\Admin\AppData\Roaming\comain_ev2c34\cmrsk.ce
Size 192KB
SHA256 2f592516e42bdf4b48eb92eced833db8c43681d00874257ee6e53395104d0142
MD5 c29ce1444d383e214229ea790d7f8d08
SHA1 42fdcca1407be41c3e81caf99c9713a338860c2b
SHA512 41719e4dbb1bd2afcf5ecb00064c4e5b8e10f913bcab7222f745addd792d73f5c6cd11f6c1c027a08493e53a82956b6114d9aa4be8c514ed494d9292bf8a3e57
SSDEEP 3072:QGKsStsAj22SSRX4TgA2nRb4nLjPIn0knDVnBPALhH8Ly/6gZfY3ea:QGDLADoMXWPI0kDVV74A3ea
TLSH
T199148DA7195CAFB879644AD338CC14875CB72350F7EE953282AF8F710AA216663F4317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ev2c34.exe

Path C:\Users\Admin\AppData\Roaming\comain_ev2c34\ev2c34.exe
Size 1.6MB
SHA256 6bb5549bab36ffbf99faf17b18ea9c105d51a49533bc0340e3be3e2c76db77d4
MD5 2e54d19476a1f56121c5d7cedd34074a
SHA1 243ccda32d88609542ee216291ea6f4c4ed97c47
SHA512 b17935e43269f57c750205d3df9124a71633319d7830aaa1ce932aad51a6004b742bb8a6518f2a24b779a3e70dbe45c3965f1f17e9c52ef2484a645154a39093
SSDEEP 49152:YriGr3rq7cO9m3Djn0ixmSbaR2ZoSgn2KiakR:Yi1t9mTj04h2H8akR
TLSH
T18E75221032E04435F0722A3099F499761E7EFC716BB1989F13446E2D1E71AD2EB397AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fhkan.oi

Path C:\Users\Admin\AppData\Roaming\comain_ev2c34\fhkan.oi
Size 183KB
SHA256 d50b4753fd94a5d80e3931356fb483ceee749e7421e61dd5aa698805a2d6ff3b
MD5 18a66d07214b9a2032b84b933ff9643f
SHA1 d52c8c6c83c99e8144b5928cad49c50aff0e4005
SHA512 b09e0b0f863aaef54e15dd15b48e65c640ab06e9f76c0d4adefd51a56bf192834ad3d853e1de5346a3a07264e452604e2f358ccf517bc332c3ee198c259adfe2
SSDEEP 3072:civQVf3oHjTDC89SrDvwC8NsgG8a9tqFua+GLJHo3idqJZTRbD:BEoHvD17Ha9gblLJHo3iIbD
TLSH
T18D04BE54061B9E34AC1D09D3B53429E962E630CCF1ED2664AB5F9E2351D85BF23F8363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxyvnb.ti

Path C:\Users\Admin\AppData\Roaming\comain_ev2f79\dxyvnb.ti
Size 45KB
SHA256 700f323400cebc41c77236144b8ed387acb93bfbef64a40af4faf12df8ce2cff
MD5 9f5ba8ae6992938c424ec9d3fd600328
SHA1 c4617c56db6b629648f40809bdc429bb6cab5e42
SHA512 366ac33d1e46d746b6a7708f184581d1bed221353662a3111103fd04adc084227af193af2919cfd65b5455fe7cc94b6235403c4f0743d92f7148d998d9e50884
SSDEEP 768:yHAV+4PFUW7/7yCIQD7w7h6BQszODjRv/9bHQ3fw+glPhvRpb4f:yHAV5PFPR3D7w7hbIODjRn9cw+gPRu
TLSH
T1CE23D14001E66796B248C05379AD8C4B68ED9F856F8EB06D13D4BE591CDCFBAC2F9063
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ev2f79.exe

Path C:\Users\Admin\AppData\Roaming\comain_ev2f79\ev2f79.exe
Size 1.6MB
SHA256 e0f1b40d6f0b4ecb8c0005a7bfc68e6fe8d7365255d6414d6a3c436eb2eb4512
MD5 c98811ca383dfd731b5b90ee45a4ebb0
SHA1 4ba9ce486e7f6b8c2e5214ad58a434dddc11c86a
SHA512 e44e4b44308210cb28f8af9f929ab4b7630096083ac954b04266ac6d29a4963ad03b28e32955e351c8877a1c6109effb30419890b08c52f7c8b0d2e394b9f5b9
SSDEEP 49152:YoiGr3rq7cO9m3Djn0ixmSbaR2ZoSgn2KiakR:Di1t9mTj04h2H8akR
TLSH
T1E675221032E04435F0722A3099F499761E7EFC716BB1989F13446E2D1E719D2EB397AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

otrm.oi

Path C:\Users\Admin\AppData\Roaming\comain_ev2f79\otrm.oi
Size 187KB
SHA256 cad3a6119836f449186774952891d78502213c894904eb3b2892fd3d0545a191
MD5 b9e777d1b8188b741060a419d6e31b79
SHA1 1490a4305145265afa1698a3cbd86bba86d72c51
SHA512 098682bd57f327780a3680fa9da58507b6b9af78c9dd372ad59982bb2c3fa3c2e27633e2f64fc651945b23e213dd55d69c0e95bc05e1f3230f01a9847b3d7aaa
SSDEEP 3072:MV5/DaVUb0Qs0po+mCuc9ejn47RFJ3PVL1JaehS3/EFSK7mjB:w0UbuE/nucJr1JaQa+X7mjB
TLSH
T114148D95839B5F3499AE44E3B5148AEA98893055FADD13C8FF4E8F5300D16FA91F8383
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/948-223-0x0000000010000000-0x0000000010032000-memory.dmp

Download

memory/948-225-0x0000000010000000-0x0000000010032000-memory.dmp

Download

memory/948-226-0x0000000010000000-0x0000000010032000-memory.dmp

Download

memory/948-356-0x0000000010000000-0x0000000010032000-memory.dmp

Download

memory/948-217-0x0000000010000000-0x0000000010032000-memory.dmp

Download

memory/948-224-0x0000000010000000-0x0000000010032000-memory.dmp

Download

memory/1008-342-0x0000000180000000-0x000000018008E000-memory.dmp

Download

memory/2772-358-0x0000021571180000-0x0000021571250000-memory.dmp

Download

memory/2772-327-0x0000000180000000-0x000000018008A000-memory.dmp

Download

memory/2772-361-0x0000021571180000-0x0000021571250000-memory.dmp

Download

memory/2772-362-0x0000021571180000-0x0000021571250000-memory.dmp

Download

memory/2772-363-0x0000021571180000-0x0000021571250000-memory.dmp

Download

memory/2772-360-0x0000021571180000-0x0000021571250000-memory.dmp

Download

memory/2772-359-0x0000021571180000-0x0000021571250000-memory.dmp

Download

memory/2772-357-0x0000021571180000-0x0000021571250000-memory.dmp

Download

memory/3860-160-0x0000000010000000-0x0000000010033000-memory.dmp

Download

memory/3860-166-0x0000000010000000-0x0000000010033000-memory.dmp

Download

memory/3860-162-0x0000000010000000-0x0000000010033000-memory.dmp

Download

memory/3860-159-0x0000000010000000-0x0000000010033000-memory.dmp

Download

memory/3860-153-0x0000000010000000-0x0000000010033000-memory.dmp

Download

memory/3860-161-0x0000000010000000-0x0000000010033000-memory.dmp

Download

memory/4236-97-0x0000000005770000-0x0000000005AC7000-memory.dmp

Download

memory/4236-108-0x0000000006E10000-0x0000000006E2E000-memory.dmp

Download

memory/4236-84-0x0000000004A20000-0x0000000004A30000-memory.dmp

Download

memory/4236-85-0x0000000002410000-0x0000000002446000-memory.dmp

Download

memory/4236-86-0x0000000004A20000-0x0000000004A30000-memory.dmp

Download

memory/4236-87-0x0000000005060000-0x000000000568A000-memory.dmp

Download

memory/4236-88-0x0000000004D70000-0x0000000004D92000-memory.dmp

Download

memory/4236-117-0x00000000072A0000-0x00000000072BA000-memory.dmp

Download

memory/4236-116-0x00000000071B0000-0x00000000071C5000-memory.dmp

Download

memory/4236-115-0x00000000071A0000-0x00000000071AE000-memory.dmp

Download

memory/4236-114-0x0000000007160000-0x0000000007171000-memory.dmp

Download

memory/4236-113-0x0000000007200000-0x0000000007296000-memory.dmp

Download

memory/4236-112-0x0000000006FC0000-0x0000000006FCA000-memory.dmp

Download

memory/4236-110-0x00000000075A0000-0x0000000007C1A000-memory.dmp

Download

memory/4236-111-0x0000000006F50000-0x0000000006F6A000-memory.dmp

Download

memory/4236-109-0x0000000006E30000-0x0000000006ED4000-memory.dmp

Download

memory/4236-101-0x000000006FFF0000-0x000000007003C000-memory.dmp

Download

memory/4236-89-0x0000000005690000-0x00000000056F6000-memory.dmp

Download

memory/4236-90-0x0000000005700000-0x0000000005766000-memory.dmp

Download

memory/4236-100-0x00000000061D0000-0x0000000006204000-memory.dmp

Download

memory/4236-99-0x0000000005C50000-0x0000000005C9C000-memory.dmp

Download

memory/4236-98-0x0000000005C00000-0x0000000005C1E000-memory.dmp

Download

memory/4236-118-0x00000000071F0000-0x00000000071F8000-memory.dmp

Download

memory/5124-326-0x00000264F2C50000-0x00000264F3712000-memory.dmp

Download

memory/5124-164-0x00000264F2BF0000-0x00000264F2BFC000-memory.dmp

Download

memory/5124-183-0x00000264F5250000-0x00000264F526C000-memory.dmp

Download

memory/5124-182-0x00000264F5140000-0x00000264F514A000-memory.dmp

Download

memory/5124-181-0x00000264F5170000-0x00000264F5223000-memory.dmp

Download

memory/5124-180-0x00000264F5150000-0x00000264F516C000-memory.dmp

Download

memory/5124-173-0x00000264F4DA0000-0x00000264F4DC2000-memory.dmp

Download

memory/5124-364-0x00000264F2C50000-0x00000264F3712000-memory.dmp

Download

memory/5124-365-0x00000264F2C50000-0x00000264F3712000-memory.dmp

Download

memory/5124-385-0x00000264F2C50000-0x00000264F3712000-memory.dmp

Download