7c50bbc21ffb2e4781deab225b07d3579afe7abd7a18f23cae51b4843c96574e

Analysis

max time kernel
148s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/10/2026, 00:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
EV.Key-setup.exe
Size 1.2MB
Sample261030-afwepsvs2r
SHA256 7c50bbc21ffb2e4781deab225b07d3579afe7abd7a18f23cae51b4843c96574e
MD5 c98f5ac194126b2054247c56bf064343
SHA1 b1baffb8c69fd77564de8f06903757dd5dada468
SHA512 079c6debdd9c99d1e1b80fd00f04720fa11e655998bdcfc8054d9b3371ffd8c77012bbb2381938611e2a502ea2694660f000cd63470abbcb3aa7befde2d92f04
SSDEEP 24576:mBWYw2EMTkFZ8+BQGHBwwlebRy+8rRGKO93uPcu2Vi5L55fRebvfYUU:TgdkF26vHqwQVBHRuLL576XVU
TLSH
T1C4451243B7C30472F8318E7885658020AEAB7EB914F5502A2F7CF60D5F756D29C75BA2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution installer persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Control Panel\International\Geo\Nation	EV.Key-setup.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Control Panel\International\Geo\Nation = "251"	EV.Key-setup.tmp

Executes dropped EXE 3 IoCs

pid	Process
1620	EV.Key-setup.tmp
5788	EVKey64.exe
3480	EVKey64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\EVKey\is-GRFCE.tmp	EV.Key-setup.tmp
File opened for modification	C:\Program Files (x86)\EVKey\unins000.dat	EV.Key-setup.tmp
File opened for modification	C:\Program Files (x86)\EVKey\EVKey64.exe	EV.Key-setup.tmp
File created	C:\Program Files (x86)\EVKey\unins000.dat	EV.Key-setup.tmp
File created	C:\Program Files (x86)\EVKey\is-2MLAM.tmp	EV.Key-setup.tmp
File created	C:\Program Files (x86)\EVKey\is-46R0B.tmp	EV.Key-setup.tmp
File created	C:\Program Files (x86)\EVKey\is-SLB95.tmp	EV.Key-setup.tmp
File opened for modification	C:\Program Files (x86)\EVKey\EVKey32.exe	EV.Key-setup.tmp
File created	C:\Program Files (x86)\EVKey\is-UTNU6.tmp	EV.Key-setup.tmp
File created	C:\Program Files (x86)\EVKey\is-IOT0U.tmp	EV.Key-setup.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EV.Key-setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EV.Key-setup.tmp

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/4280-0-0x0000000000400000-0x0000000000437000-memory.dmp	innosetup
behavioral2/memory/4280-43-0x0000000000400000-0x0000000000437000-memory.dmp	innosetup
behavioral2/memory/4280-56-0x0000000000400000-0x0000000000437000-memory.dmp	innosetup

Modifies Control Panel 12 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Control Panel\International\sDecimal = "."	EV.Key-setup.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Control Panel\International\iCountry = "1"	EV.Key-setup.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Control Panel\International\sShortDate = "dd/MM/yyyy"	EV.Key-setup.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Control Panel\International\sNegativeSign = "-"	EV.Key-setup.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Control Panel\International\LocaleName = "en-US"	EV.Key-setup.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Control Panel\International\sDate = "/"	EV.Key-setup.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Control Panel\International\sList = ","	EV.Key-setup.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Control Panel\International\sThousand = ","	EV.Key-setup.tmp
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Control Panel\International\Geo	EV.Key-setup.tmp
Key created	\REGISTRY\USER\S-1-5-21-419988665-3975678735-3887946154-1001\Control Panel\International	EV.Key-setup.tmp
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Control Panel\International	EV.Key-setup.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Control Panel\International\Locale = "00000409"	EV.Key-setup.tmp

Modifies data under HKEY_USERS 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Control Panel\International	EV.Key-setup.tmp
Key created	\REGISTRY\USER\S-1-5-20\Control Panel\International	EV.Key-setup.tmp
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\International	EV.Key-setup.tmp
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\International\sDate = "/"	EV.Key-setup.tmp
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\International\sDecimal = "."	EV.Key-setup.tmp
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\International\sList = ","	EV.Key-setup.tmp
Set value (str)	\REGISTRY\USER\S-1-5-19\Control Panel\International\sShortDate = "dd/MM/yyyy"	EV.Key-setup.tmp
Set value (str)	\REGISTRY\USER\S-1-5-20\Control Panel\International\sShortDate = "dd/MM/yyyy"	EV.Key-setup.tmp
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\International\sShortDate = "dd/MM/yyyy"	EV.Key-setup.tmp
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\International\sNegativeSign = "-"	EV.Key-setup.tmp
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\International\sThousand = ","	EV.Key-setup.tmp

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4720	schtasks.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
5048	WMIC.exe
5048	WMIC.exe
5048	WMIC.exe
5048	WMIC.exe
1660	WMIC.exe
1660	WMIC.exe
1660	WMIC.exe
1660	WMIC.exe
5344	WMIC.exe
5344	WMIC.exe
5344	WMIC.exe
5344	WMIC.exe
1620	EV.Key-setup.tmp
1620	EV.Key-setup.tmp

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	5048	WMIC.exe
Token: SeSecurityPrivilege	5048	WMIC.exe
Token: SeTakeOwnershipPrivilege	5048	WMIC.exe
Token: SeLoadDriverPrivilege	5048	WMIC.exe
Token: SeSystemProfilePrivilege	5048	WMIC.exe
Token: SeSystemtimePrivilege	5048	WMIC.exe
Token: SeProfSingleProcessPrivilege	5048	WMIC.exe
Token: SeIncBasePriorityPrivilege	5048	WMIC.exe
Token: SeCreatePagefilePrivilege	5048	WMIC.exe
Token: SeBackupPrivilege	5048	WMIC.exe
Token: SeRestorePrivilege	5048	WMIC.exe
Token: SeShutdownPrivilege	5048	WMIC.exe
Token: SeDebugPrivilege	5048	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5048	WMIC.exe
Token: SeRemoteShutdownPrivilege	5048	WMIC.exe
Token: SeUndockPrivilege	5048	WMIC.exe
Token: SeManageVolumePrivilege	5048	WMIC.exe
Token: 33	5048	WMIC.exe
Token: 34	5048	WMIC.exe
Token: 35	5048	WMIC.exe
Token: 36	5048	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5344	WMIC.exe
Token: SeSecurityPrivilege	5344	WMIC.exe
Token: SeTakeOwnershipPrivilege	5344	WMIC.exe
Token: SeLoadDriverPrivilege	5344	WMIC.exe
Token: SeSystemProfilePrivilege	5344	WMIC.exe
Token: SeSystemtimePrivilege	5344	WMIC.exe
Token: SeProfSingleProcessPrivilege	5344	WMIC.exe
Token: SeIncBasePriorityPrivilege	5344	WMIC.exe
Token: SeCreatePagefilePrivilege	5344	WMIC.exe
Token: SeBackupPrivilege	5344	WMIC.exe
Token: SeRestorePrivilege	5344	WMIC.exe
Token: SeShutdownPrivilege	5344	WMIC.exe
Token: SeDebugPrivilege	5344	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5344	WMIC.exe
Token: SeRemoteShutdownPrivilege	5344	WMIC.exe
Token: SeUndockPrivilege	5344	WMIC.exe
Token: SeManageVolumePrivilege	5344	WMIC.exe
Token: 33	5344	WMIC.exe
Token: 34	5344	WMIC.exe
Token: 35	5344	WMIC.exe
Token: 36	5344	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1660	WMIC.exe
Token: SeSecurityPrivilege	1660	WMIC.exe
Token: SeTakeOwnershipPrivilege	1660	WMIC.exe
Token: SeLoadDriverPrivilege	1660	WMIC.exe
Token: SeSystemProfilePrivilege	1660	WMIC.exe
Token: SeSystemtimePrivilege	1660	WMIC.exe
Token: SeProfSingleProcessPrivilege	1660	WMIC.exe
Token: SeIncBasePriorityPrivilege	1660	WMIC.exe
Token: SeCreatePagefilePrivilege	1660	WMIC.exe
Token: SeBackupPrivilege	1660	WMIC.exe
Token: SeRestorePrivilege	1660	WMIC.exe
Token: SeShutdownPrivilege	1660	WMIC.exe
Token: SeDebugPrivilege	1660	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1660	WMIC.exe
Token: SeRemoteShutdownPrivilege	1660	WMIC.exe
Token: SeUndockPrivilege	1660	WMIC.exe
Token: SeManageVolumePrivilege	1660	WMIC.exe
Token: 33	1660	WMIC.exe
Token: 34	1660	WMIC.exe
Token: 35	1660	WMIC.exe
Token: 36	1660	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5344	WMIC.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
1620	EV.Key-setup.tmp
5788	EVKey64.exe
5788	EVKey64.exe
5788	EVKey64.exe
3480	EVKey64.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
5788	EVKey64.exe
5788	EVKey64.exe
3480	EVKey64.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5788	EVKey64.exe
3480	EVKey64.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4280 wrote to memory of 1620	4280	EV.Key-setup.exe	88
PID 1620 wrote to memory of 5048	1620	EV.Key-setup.tmp	89
PID 1620 wrote to memory of 1660	1620	EV.Key-setup.tmp	90
PID 1620 wrote to memory of 5344	1620	EV.Key-setup.tmp	92
PID 1620 wrote to memory of 3384	1620	EV.Key-setup.tmp	96
PID 1620 wrote to memory of 3732	1620	EV.Key-setup.tmp	98
PID 1620 wrote to memory of 908	1620	EV.Key-setup.tmp	101
PID 1620 wrote to memory of 5632	1620	EV.Key-setup.tmp	103
PID 1620 wrote to memory of 1460	1620	EV.Key-setup.tmp	105
PID 1620 wrote to memory of 5788	1620	EV.Key-setup.tmp	107
PID 1620 wrote to memory of 4720	1620	EV.Key-setup.tmp	108

System policy modification 1 TTPs 3 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "225"	EV.Key-setup.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	EV.Key-setup.tmp
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HonorAutorunSetting = "1"	EV.Key-setup.tmp

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\EV.Key-setup.exe
"C:\Users\Admin\AppData\Local\Temp\EV.Key-setup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4280
- C:\Users\Admin\AppData\Local\Temp\is-TSGG8.tmp\EV.Key-setup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-TSGG8.tmp\EV.Key-setup.tmp" /SL5="$5028C,777066,185344,C:\Users\Admin\AppData\Local\Temp\EV.Key-setup.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies Control Panel
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1620
- - C:\Windows\SysWOW64\wbem\WMIC.exe
    "C:\Windows\System32\wbem\WMIC.exe" process where "name like '%evk%'" delete
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5048
- - C:\Windows\SysWOW64\wbem\WMIC.exe
    "C:\Windows\System32\wbem\WMIC.exe" process where "name like '%nike%'" delete
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1660
- - C:\Windows\SysWOW64\wbem\WMIC.exe
    "C:\Windows\System32\wbem\WMIC.exe" process where "name like '%gotieng%'" delete
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5344
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /Delete /TN "Unikey 4.3" /F
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3384
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /Delete /TN "EVKey - Vietnamese Keyboard" /F
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3732
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /Delete /TN "UK 4.3 RC5" /F
    3⤵
    - System Location Discovery: System Language Discovery
    PID:908
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /Delete /TN "Unikey 4.3 RC5" /F
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5632
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /Delete /TN "Unikey 4.3" /F
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1460
- - C:\Program Files (x86)\EVKey\EVKey64.exe
    "C:\Program Files (x86)\EVKey\EVKey64.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:5788
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /Create /F /RL highest //RU administrators /SC onlogon /TR "C:\Program Files (x86)\EVKey\EVKey64.exe" /TN "EVKey - Vietnamese Keyboard"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4720

C:\Program Files (x86)\EVKey\EVKey64.exe
"C:\Program Files (x86)\EVKey\EVKey64.exe"
1⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3480

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

EVKey32.exe

Path C:\Program Files (x86)\EVKey\EVKey32.exe
Size 691KB
SHA256 44e8522570b33337479cfa8d51d7186d73765879161240ebcd059ed2639aaaf4
MD5 63151b03b19e2f50e15a86b03f4919a2
SHA1 09e79972c4aa2e640511f6f5e06a43b46323da55
SHA512 32131bb4b32af752201e7590528650a8234c6c3ba35e62be59aa47e025dd5f50d1a8a056e489dc9ebe5ba309711bb24552c673a3da5fda32645af89f89a51e25
SSDEEP 12288:xZN67PLDmB/i3DIpFCjapSVHrIM+k08i6cgnhYNqBAYrZY3A5:936rIM+l36HCCNrZY3A5
TLSH
T17DE46C10B6A6C132E4B2427149B9A7595839FC600F3696DFB3D83A6D4E71AC16F32733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EVKey64.exe

Path C:\Program Files (x86)\EVKey\EVKey64.exe
Size 815KB
SHA256 f5220f32c69b9e8437f2ec56836383c579e77db6f9c418e782bd36fac054e35d
MD5 a5796dbce84afefda851a70a07388f32
SHA1 d998221b63c312989f3142dcf83c729478f49381
SHA512 19ef7a04b4a5323b66db1aac9bf4f4b5f2166365c0f4a3af8b4e1ed67a124e983147ebb2ffbe2708d58f006b3216b67068a7a90cbf61c1afd293969b3377bda6
SSDEEP 12288:2ucHxo1G8VRdRWKAZNUF3PeP0I2MozJ87OpLUi4ospdCqBAYrIA9:2uKxZ8VxWKAZNUF3P+iMod87mLWNNrIs
TLSH
T119056C15B7A945E5E0B3923A89628251EBB2BC111B31D7DF4264B31F1F33AD44F3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

evkmacro.txt

Path C:\Program Files (x86)\EVKey\evkmacro.txt
Size 315B
SHA256 fa7983371ba87fb0a322c02b99f2fc451827417f9c36601dde9117271567a571
MD5 2517cb208ee217b416cb8366744e4058
SHA1 6e1063cd128b6be17108711aa849a770e48f19b9
SHA512 46b6dae7bf082c903ceafe856c677028f75f350403d3f9d2b5af654644660a1d83609718b3e71afa861c8f59edf6f8fac97d6f2769a7fbc9c5fa1a5d15da8467
TLSH
T11FE02B414005A2EA86BD558C194B7027CFDC951A47C20AB5EEAC1CEA3F4EFEDC8352B0
MD5 SHA1 SHA512 TLSH

Submit Download

iconxml.ico

Path C:\Program Files (x86)\EVKey\iconxml.ico
Size 96KB
SHA256 3e36e0acb516eca27cbdb2f9222f69519dbc50b43501c282eb5c41ceb69e46b0
MD5 5f27238226e824d5ae6cca0ed2114499
SHA1 7fdf60267c14d525f985021d75b875e7cc36dbfd
SHA512 c33c141a592a5a19e5090b6a42185377854f345fe8175915cf1ba35129182d04b35a5460d18b3cf35b2c891e84629da0397d7b32fb894bd111047467e045478e
SSDEEP 1536:XBaqi1FpfycdoS2EOpj6bUMAMw7iGJE7ODhExQz9+kx2aEqo:ti1DrYeUdHF+2o
TLSH
T1BCA3AFA2BD8441A9C85C1F72D4226D72747FAD1E7D30A5F4AA71BB3877739C284B102E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setting.ini

Path C:\Program Files (x86)\EVKey\setting.ini
Size 632B
SHA256 338e59048c48b9300f3eee20b88ab49470d8afbae72d5ac79cabe3d22364425d
MD5 b14be5e050d9865227e3939096991c07
SHA1 ef12ac62f151fe01d076d61188ec86e3f1628de5
SHA512 3c04c1a0eb25c9437b5ff8e72e5ed3d8d5fe39be7af78cbb5a68ea32c1f7b884a5e017f3d93394c0dd95e9d5c158f70118aa645d2dbb08c9df689e6e5d59fc83
TLSH
T111F028234E0C811D112233B42CF2856451FAE4416470444C7F6A78C3AFAC55707793EF
MD5 SHA1 SHA512 TLSH

Submit Download

EV.Key-setup.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-TSGG8.tmp\EV.Key-setup.tmp
Size 1.2MB
SHA256 59f5e555cd044a1828de1c096ecb4cc7f3f86acfcc5d6e0263fd87b40e0b534e
MD5 50d215f720a3c803371760efe30a4878
SHA1 4258968d21d02e01845006037cabde27026a2d20
SHA512 420a19106e3b048975c77ca5406bffd39af889438b5d92853db75355ba75b1d421359c846590a1e81727b6bf2e06db74c8601605ec18f91407d4df4a5bfda1da
SSDEEP 24576:vtdAm9DUi/CR3wCkCiRgoG7hBaHkbEXXeG/jFt55Tx9qx:FqTytRFk6ek1/a
TLSH
T1CA454B22A3D24433D5732F759C6BC2946C367E202EA4E54A7EF99E0C1E39B41BD35392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1620-6-0x0000000002220000-0x0000000002221000-memory.dmp

Download

memory/1620-45-0x0000000002220000-0x0000000002221000-memory.dmp

Download

memory/1620-44-0x0000000000400000-0x000000000053C000-memory.dmp

Download

memory/1620-55-0x0000000000400000-0x000000000053C000-memory.dmp

Download

memory/4280-0-0x0000000000400000-0x0000000000437000-memory.dmp

Download

memory/4280-43-0x0000000000400000-0x0000000000437000-memory.dmp

Download

memory/4280-56-0x0000000000400000-0x0000000000437000-memory.dmp

Download