hijackloader | 4350994cb7d895bba32b6ec2c3163df6e6214ade3877d87c6f2dea3e00d48300

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/06/2026, 14:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tmp0jph_fbs.msi
Size 1.7MB
Sample260601-rr253ahs8q
SHA256 4350994cb7d895bba32b6ec2c3163df6e6214ade3877d87c6f2dea3e00d48300
MD5 7b833268dee98259f782a52292fb7e19
SHA1 b9932f874985181ae9b91719e855fb7e34a41d4e
SHA512 645d450ccfa6b7c0d38ca60507b0376baee02fc72d3afd670b937ab40692f8d238f6225c23438e7bb6a5e0b2430bf4fcdce740b0e867051930071eae03d7c52b
SSDEEP 49152:zViAhnMAuCt4Af3tv38J0535m+TvC6D2Vnd:55MOp/f535bTvC6CVd
TLSH
T1628533003AF1D368D78016B47D5F03EB9A1A4D1E4B55D927F1C23B8AA07BEB2909E357
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery hijackloader loader persistence privilege_escalation ransomware

Malware Config

Extracted

Family

hijackloader

Attributes

directory
%APPDATA%\kkvscanv5
inject_dll
%windir%\SysWOW64\pla.dll

xor.hex

Signatures

Family: HijackLoader, IDAT loader, Ghostulse,
HijackLoader is a multi-stage loader, first seen in 2023.
loader hijackloader

Detects HijackLoader (aka IDAT Loader) 1 IoCs

resource	yara_rule
behavioral2/files/0x00070000000243f0-45.dat	family_hijackloader

Executes dropped EXE 2 IoCs

pid	Process
2704	ReSwitch32.exe
4652	ReSwitch32.exe

Loads dropped DLL 8 IoCs

pid	Process
2704	ReSwitch32.exe
2704	ReSwitch32.exe
2704	ReSwitch32.exe
4652	ReSwitch32.exe
4652	ReSwitch32.exe
4652	ReSwitch32.exe
4980	SForge.exe
2244	XPFix.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4652 set thread context of 4980	4652	ReSwitch32.exe	113
PID 4652 set thread context of 2244	4652	ReSwitch32.exe	114

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e584e4a.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e584e4a.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4F05.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{A6C8EAE0-4130-4D64-A86A-CA5CAB2889FF}	msiexec.exe
File created	C:\Windows\Installer\e584e4c.msi	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
3892	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ReSwitch32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ReSwitch32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XPFix.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ee28096e8f31db0b0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000ee28096e0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900ee28096e000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1aee28096e000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dee28096e000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
4440	msiexec.exe
4440	msiexec.exe
2704	ReSwitch32.exe
4652	ReSwitch32.exe
4652	ReSwitch32.exe
4652	ReSwitch32.exe
4652	ReSwitch32.exe
4652	ReSwitch32.exe
4652	ReSwitch32.exe
2244	XPFix.exe
2244	XPFix.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
4652	ReSwitch32.exe
4652	ReSwitch32.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3892	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3892	msiexec.exe
Token: SeSecurityPrivilege	4440	msiexec.exe
Token: SeCreateTokenPrivilege	3892	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3892	msiexec.exe
Token: SeLockMemoryPrivilege	3892	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3892	msiexec.exe
Token: SeMachineAccountPrivilege	3892	msiexec.exe
Token: SeTcbPrivilege	3892	msiexec.exe
Token: SeSecurityPrivilege	3892	msiexec.exe
Token: SeTakeOwnershipPrivilege	3892	msiexec.exe
Token: SeLoadDriverPrivilege	3892	msiexec.exe
Token: SeSystemProfilePrivilege	3892	msiexec.exe
Token: SeSystemtimePrivilege	3892	msiexec.exe
Token: SeProfSingleProcessPrivilege	3892	msiexec.exe
Token: SeIncBasePriorityPrivilege	3892	msiexec.exe
Token: SeCreatePagefilePrivilege	3892	msiexec.exe
Token: SeCreatePermanentPrivilege	3892	msiexec.exe
Token: SeBackupPrivilege	3892	msiexec.exe
Token: SeRestorePrivilege	3892	msiexec.exe
Token: SeShutdownPrivilege	3892	msiexec.exe
Token: SeDebugPrivilege	3892	msiexec.exe
Token: SeAuditPrivilege	3892	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3892	msiexec.exe
Token: SeChangeNotifyPrivilege	3892	msiexec.exe
Token: SeRemoteShutdownPrivilege	3892	msiexec.exe
Token: SeUndockPrivilege	3892	msiexec.exe
Token: SeSyncAgentPrivilege	3892	msiexec.exe
Token: SeEnableDelegationPrivilege	3892	msiexec.exe
Token: SeManageVolumePrivilege	3892	msiexec.exe
Token: SeImpersonatePrivilege	3892	msiexec.exe
Token: SeCreateGlobalPrivilege	3892	msiexec.exe
Token: SeBackupPrivilege	1604	vssvc.exe
Token: SeRestorePrivilege	1604	vssvc.exe
Token: SeAuditPrivilege	1604	vssvc.exe
Token: SeBackupPrivilege	4440	msiexec.exe
Token: SeRestorePrivilege	4440	msiexec.exe
Token: SeRestorePrivilege	4440	msiexec.exe
Token: SeTakeOwnershipPrivilege	4440	msiexec.exe
Token: SeRestorePrivilege	4440	msiexec.exe
Token: SeTakeOwnershipPrivilege	4440	msiexec.exe
Token: SeRestorePrivilege	4440	msiexec.exe
Token: SeTakeOwnershipPrivilege	4440	msiexec.exe
Token: SeRestorePrivilege	4440	msiexec.exe
Token: SeTakeOwnershipPrivilege	4440	msiexec.exe
Token: SeRestorePrivilege	4440	msiexec.exe
Token: SeTakeOwnershipPrivilege	4440	msiexec.exe
Token: SeRestorePrivilege	4440	msiexec.exe
Token: SeTakeOwnershipPrivilege	4440	msiexec.exe
Token: SeRestorePrivilege	4440	msiexec.exe
Token: SeTakeOwnershipPrivilege	4440	msiexec.exe
Token: SeRestorePrivilege	4440	msiexec.exe
Token: SeTakeOwnershipPrivilege	4440	msiexec.exe
Token: SeRestorePrivilege	4440	msiexec.exe
Token: SeTakeOwnershipPrivilege	4440	msiexec.exe
Token: SeRestorePrivilege	4440	msiexec.exe
Token: SeTakeOwnershipPrivilege	4440	msiexec.exe
Token: SeRestorePrivilege	4440	msiexec.exe
Token: SeTakeOwnershipPrivilege	4440	msiexec.exe
Token: SeRestorePrivilege	4440	msiexec.exe
Token: SeTakeOwnershipPrivilege	4440	msiexec.exe
Token: SeRestorePrivilege	4440	msiexec.exe
Token: SeTakeOwnershipPrivilege	4440	msiexec.exe
Token: SeRestorePrivilege	4440	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3892	msiexec.exe
3892	msiexec.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4440 wrote to memory of 4088	4440	msiexec.exe	100
PID 4440 wrote to memory of 2704	4440	msiexec.exe	102
PID 2704 wrote to memory of 4652	2704	ReSwitch32.exe	108
PID 4652 wrote to memory of 4980	4652	ReSwitch32.exe	113
PID 4652 wrote to memory of 4980	4652	ReSwitch32.exe	113
PID 4652 wrote to memory of 2244	4652	ReSwitch32.exe	114
PID 4652 wrote to memory of 2244	4652	ReSwitch32.exe	114

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\tmp0jph_fbs.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3892

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4440
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4088
- C:\Users\Admin\AppData\Local\Odontophore\ReSwitch32.exe
  "C:\Users\Admin\AppData\Local\Odontophore\ReSwitch32.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2704
- - C:\ProgramData\kkvscanv5\ReSwitch32.exe
    C:\ProgramData\kkvscanv5\ReSwitch32.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:4652
  - - C:\Users\Admin\SForge.exe
      C:\Users\Admin\SForge.exe
      4⤵
      Loads dropped DLL
      PID:4980
  - - C:\Users\Admin\AppData\Roaming\kkvscanv5\XPFix.exe
      "C:\Users\Admin\AppData\Roaming\kkvscanv5\XPFix.exe" "C:\Users\Admin\AppData\Roaming\kkvscanv5\XPFix.exe" /u
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:2244

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1604

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e584e4b.rbs

Path C:\Config.Msi\e584e4b.rbs
Size 8KB
SHA256 19a4af1609c07f01a8c956ae969ab2a7129e5fdfcd38774166dcc7e0e71739a3
MD5 00a99251a6ad6ccf82792979e543b461
SHA1 75d16bbc4df732a7743d9d28d70a7b7c572becf5
SHA512 4a4d11a871af020898948d7344b7e70b1a0f5da123a32450a132060dc16747bf669501f71ff311fd03a6a39affd0707b302d4f68f5ea9aebe21f0b6d1cf2d9e0
SSDEEP 96:t7JaJw+Yivm3QeE8ef8s2WUsrzX4CsThqoWUsrzX4C6jRJ8P8frThqaH+qVp80Qe:t7RueiQqXPITqXPQVU8pl
TLSH
T191024540BE20C9D2EBAA1B3593972B24B771E2DED650B34B049D9128CF1269CCF6D5CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

suite_config.bin

Path C:\ProgramData\Chasys Draw IES\suite_config.bin
Size 4KB
SHA256 f03726cd3baaa8e25d89a1fb6de99ca423068c0e67c2af928b46f64c680494e8
MD5 db8c65c3cb35ab1d88576f3bcb49b0c6
SHA1 d982c94544cf4d0ada71d1ccd672e8e9b5beca46
SHA512 ee65527e602282e173db9be23ecf560a42d32f74f514874bc1da28973d0a19643ca153141fa7fb141f455a96085e34551d2111ee866d282f5171d7f3639701eb
TLSH
T186810400477C1471F1C001314330D3C0D740D455555003C351D1F4454C54F043CCD511
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

FD2A86773B717B7A017EC92C6784D7CA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\FD2A86773B717B7A017EC92C6784D7CA
Size 211KB
SHA256 a2530c9120231c7bf868bbcf492bdb214e44ee8030aa6edae475135838652031
MD5 6615812af202dfc333224c33df3ab673
SHA1 cf5d303a09850685f4fc05a6bf6daeadc9f1c371
SHA512 2f2d956867c3ef2fe277e698c45bef4eea27549a312a47d647ca4582259b5047ed6f828dd220b921d6f05a6a2c747af061742e2f308e01982c45254b067fe376
SSDEEP 3072:fB0hLCM/vCU3EwwSt1Sb1t3A8oWHfmzFakcv8vNudZopDVVMfpoJpJ2uWuNC0Zd:50QHUxw7nQ8ocn/vGm8Mpwr27C
TLSH
T15024192C6C77F4639DAA8E524FADE69662E791DA1711030F0E376E502C13A67CB1BC0D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 c91d49aab239c11a881821cb7dddc223a8c4f3212c5207737bc7def531349c79
MD5 c3e479fffabab022464aaea843470a73
SHA1 94a46d72df4ea41d1f98e83250148b4070997053
SHA512 c7bec38c52a05db7daf9f54b6d3a1d52c2dc985a65622ccf63dc641028ebdb577f52439cae43b60370c9aec3eb4d748674ee5f6a2ef18c893a5da65bd8ddf57b
TLSH
T1E5C0801C19910506F1D4437C52C1394357104541E2818F1525F12504C953B552834C29
MD5 SHA1 SHA512 TLSH

Submit Download

FD2A86773B717B7A017EC92C6784D7CA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FD2A86773B717B7A017EC92C6784D7CA
Size 246B
SHA256 b3347e0915482b2f59387ee4a105dc721d21548ddb90606ac573301b01bc7214
MD5 1a3a8bd700876565970c74a922a7f527
SHA1 5a386368b51c08df22b449cd6945aaf5a0901c99
SHA512 642359ca3b2b4910caffa04b9653521c3f0931df4e603bd054c9ca25dced5eace68edf441fe62f05ad679fb71235ae18c6177850602137d01c1c0e54e5c5796a
TLSH
T1A6D08C2C2F61161BF238C37A1464024A3EA01B23B0E38F1214F5024D6C29E613D36F0E
MD5 SHA1 SHA512 TLSH

Submit Download

Nisbrock.oots

Path C:\Users\Admin\AppData\Local\Odontophore\Nisbrock.oots
Size 1.2MB
SHA256 cfd43097cab091ffcbcf2cfff6210234263ac76428c808b71495498896e2e0e0
MD5 a1c81c8a7f1659cb159c2288d5a7d935
SHA1 8f48d0560a898e374a0421e7197d94ee1ad0b065
SHA512 d7f9932b16be535484237c080aad042c4fc485d761604dcc3a8fe09df8eb6ed947c99feeaeaaeae131c147f02c1ec474be649e7ee26394298b96c19cc8cca305
SSDEEP 24576:d6ntJ0q2QR0U6RWCAPBuLfTopIaFNzDfGzNYwwV1+:knLfR0U6RyBuL7SDN/uxYh1+
TLSH
T1084512C64AAB8973C4E2AB78258FD53309B6C8D4F6CD87C3FC14164741CEC6A768EA15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pungnis.ygg

Path C:\Users\Admin\AppData\Local\Odontophore\Pungnis.ygg
Size 81KB
SHA256 638396b08e9637b564c4ac45650b9bb7d6f0f428214d1e3bc3c7354f8e34326a
MD5 ed79ea450544fd53b26c39e1e119d9d1
SHA1 207fbd6a710f894765a1c563d564e9b4f3c1fa6c
SHA512 fba96670c318eed30ab71a78ce323644d24ccb37dd6248b5333416b1b455f5dccdd55ef3232b06f97432a73252c99d07f44e4e58392aaf66855b19ea9fc45f35
SSDEEP 1536:LrhdAqHVoJ0g50CWd+uisjZCeL++nzkJLEJUmXjlRC3po2C:LFGQCqisjZCeL++nYJqUmXxRgU
TLSH
T11083CAB167BD2F5AF523BD3A85C0F5679949B9762626C0D5E9830B1F802DC90CE70B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReSwitch32.exe

Path C:\Users\Admin\AppData\Local\Odontophore\ReSwitch32.exe
Size 335KB
SHA256 0f8fce66dfed696d8a39b985036b2932f1157400075293d60e9d1c9c408f3274
MD5 5137d6601d2e51f3954b1161aa0b35bd
SHA1 975c36ce8a5672f0f4400526d920b469fb4c37dc
SHA512 7df638ef72da4947aa5db505b3d74b09856277354e9c18598c3d24ffc8d199ca81bfe871e159d80ad3dc2f5b2e1badc07c96f55b597095592b953820b0fc3f5d
SSDEEP 6144:n+9mDgcrhARZ5e+HG+nIC53gZM3npTmu09jB79BwNq7O:n+mDKLrHpICuZim39jp9BMq7O
TLSH
T14D748D01BEB0847AE6A6863DD4BAA7630EF9BF510B3045D7A3803D69F83C2D15539727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ies_Core.dll

Path C:\Users\Admin\AppData\Local\Odontophore\ies_Core.dll
Size 1.1MB
SHA256 a1e25a2c47ec4bb00e6f65e98278bd34c1dacf495623a0141cb877ef6f937f45
MD5 f5ffb214783fd403cc6bc2f771a73709
SHA1 ffe90ec2857d3018dbce16926f96eeda4f5c6135
SHA512 962bcd499f588d42d812475bb617fbaea91b754f398cb75f61808182cdcc085f07638d022dd37e5982d234a589cba7335f11d39bcf67d12da58d4d3c9f29b283
SSDEEP 24576:AcFvpHsz+jFmXWrg5S3pB0Lo7ungBXQli/nP19BHM7N:zXHVjFmb5S3pB0U7unOXc+nPO
TLSH
T149456C81BA82A2B1EA6E1DB05125FF97813EBB90D1D4C2F779C40C7A5E03ED643B3651
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ies_Netw.dll

Path C:\Users\Admin\AppData\Local\Odontophore\ies_Netw.dll
Size 150KB
SHA256 19068d94c8314ddc21e15aa7983c3d4703df14c18eb150d4fff2dd3a70bbad89
MD5 8cb02f24f5d21baaa13a1da980dcec68
SHA1 9b5afc4267266533735b5e3356719a0b14759d1b
SHA512 54f33c5a44a03dfa1cd808aedb499f8205b301afb1c5b9c5a82bd739388ae3a2f2556f05ae74fc9d8f6c869a60851559b0e2d4920b9d49929b254744549e32da
SSDEEP 3072:Ol1ffgnLGR0CzPKf1Gxg47sSz4r/9jBciy27QglBJAglMW7K:OnfgyR0CA134r4BdY279BJND7K
TLSH
T1C3E38D207981D0B2E5BE2D3814A5C7A20F3EB960DF745CE763A4116D4E742E16F39B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

32EF874.tmp

Path C:\Users\Admin\AppData\Local\Temp\32EF874.tmp
Size 2.1MB
SHA256 91973a9383a991a62098bad134c8bc7159021e28eb5c3bc9bbe2eee3a0897a46
MD5 3fcbc7da002e65468a7b94667622c86c
SHA1 96398059a78efd93dbd4b6b65076f9a0ce28d91f
SHA512 660a4102e0551945c954d38911086c09c8d2ffef0907c4332efdba5da221e8e76ed9ece7574400b5a45a52d08e2a8ba1addf58384dbdce341346b75377a1e3bb
SSDEEP 49152:kt5nhoiDwnC1CCQSpDOOh7UsXNc1mxQRK2YS72p956+U9mxA:ehhBkMVdOOZU3RgxH6+UX
TLSH
T13EA533571558F2A63744BE7BADAC38642B10B291C7CE7AF2D219AB6F0012FC14DD1397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

32EF874.tmp

Path C:\Users\Admin\AppData\Local\Temp\32EF874.tmp
Size 2.1MB
SHA256 c13574f3a4481fda4452d065d735e93f223afef66ae3bdf8d89a8a46beac0602
MD5 cfd0180ed650a6c63e16b9ed874b7349
SHA1 188dac11a251c455db66e7d9d16ebf4a32081c17
SHA512 104e8844e770d51ff11ee6302cb5cca2ec8ec89241c0cdc33c8eaa2f2d08a2df8a2d07ac3bea224940027456e57c970f79e42952530bd4c5138639484d9c2a56
SSDEEP 49152:4t5nhoLDwnC1CCQSpDOOh7UsXNc1mxQRK2YS72p956+U9mxA:6hhQkMVdOOZU3RgxH6+UX
TLSH
T11EA533571558F2A63744BE7BADAC34642B10B291C7CE7AF2D219AB6F0012FC14ED1397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6C21E00.tmp

Path C:\Users\Admin\AppData\Local\Temp\6C21E00.tmp
Size 40B
SHA256 54de61f3d3207f6eff971ebf886990e684841cc393f0f7cb1f6c4ca16c2fd6c5
MD5 95edf38cf76dd40990a4bb08e1428c6b
SHA1 6509f972ca2b32b0540c8ef5d0bdf9d8991451a5
SHA512 49a132abc5d6a55c8f0b74f79429b08eb016843bfa5495934470e2e86e15a3148afb15fb9616ad4d762bf99415f89ecbd07bfba80f7dcb3359edc70e6cfdbd89
MD5 SHA1 SHA512

Submit Download

old_ver.webp.ies.update.partial

Path C:\Users\Admin\AppData\Local\Temp\old_ver.webp.ies.update.partial
Size 60KB
SHA256 a312cd4cdba489cbb5e557b4c3f5c7896980f96f46e8bf82ff81738aed7e2e33
MD5 7cba11c0e05570a5ee6fb355ffb5e868
SHA1 865df32ba1c69b42ce8e04a9aa3362823ee1a563
SHA512 82afe06acc5ddecab87568821d4086e6695f6add41e430b62585fa086db2337f5e93f6438b7948b062019b2d25910ee3aa97b3773978870d23fe4195c96f4203
SSDEEP 1536:9ZkyBzk0aJKQ0RV9oNIFzika88GFrwxwrUAI:97daAQoQNIFta8Fm
TLSH
T1C95302B966CB800B0CD13A37BBF09DE903E6DACB059681711D65E351CD89EC8D8D6B9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPFix.exe

Path C:\Users\Admin\AppData\Roaming\kkvscanv5\XPFix.exe
Size 286KB
SHA256 5ec174af8a18a5516b8a6e11d8a27481d70df14d1edb67c48b5458ff44df9146
MD5 810d42177538ad5ca18d4dd597c00658
SHA1 7374bbe63c44de9536c22cdc111894c6d4929eb3
SHA512 233cdbaa1658719e9e44869930aef8ed09a17bd1e227c43785ce1b4298fd9f767818b75888db9cb5184a134a0babedd32cc0788059c251a1dff3f6aa27ebd30d
SSDEEP 6144:WEDFuBN6zANskE9qgfyMEvt93L2kx3W71+KL:WiuB4fyzvtFt3WFL
TLSH
T164547E00B651C136F5F318768AFE9B79993DBD312B1551C363C40EAEBE22BE1793121A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SForge.exe

Path C:\Users\Admin\SForge.exe
Size 1.2MB
SHA256 40a204d9f4774ba3c320d4f735248267b5db828414aa5e6778383acf357f9738
MD5 24ac229568fafb8b3b68fb87479e4007
SHA1 772e357c0aab20097d786a56a2431c3f2efc9189
SHA512 6f38e34c110eb43779df38e26c9e742d8ff85c2d43dce34829309943c7763ac836214fbfffa5f8221c9578c32962665d2c1d03c84ba9147a17e99beb52da89f7
SSDEEP 12288:iMgi7oX4YvB9DhW21HiZfu3jGboi6qcKtM8o/4:iMgXIYvPhB1CZfweaKK8o/4
TLSH
T1ED45B307651850B7DB929235CE5AC6336221FCCC2B3195BF1BD9BE2BFB35BB15828610
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e584e4a.msi

Path C:\Windows\Installer\e584e4a.msi
Size 1.7MB
SHA256 4350994cb7d895bba32b6ec2c3163df6e6214ade3877d87c6f2dea3e00d48300
MD5 7b833268dee98259f782a52292fb7e19
SHA1 b9932f874985181ae9b91719e855fb7e34a41d4e
SHA512 645d450ccfa6b7c0d38ca60507b0376baee02fc72d3afd670b937ab40692f8d238f6225c23438e7bb6a5e0b2430bf4fcdce740b0e867051930071eae03d7c52b
SSDEEP 49152:zViAhnMAuCt4Af3tv38J0535m+TvC6D2Vnd:55MOp/f535bTvC6CVd
TLSH
T1628533003AF1D368D78016B47D5F03EB9A1A4D1E4B55D927F1C23B8AA07BEB2909E357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 99e613c01432db8010aa1b1b96fbdc6bd6b885c2c49a2c7c00ef6b764c32438c
MD5 77f4d3c386d662d30e138b0e9b2ef890
SHA1 b92f48e8eac63655a2f88c5a753553c1283ab79a
SHA512 6cb1998909b9e828ee0424cee0b80101be3b18e5dee15d55d9f1db33847528124c6bcb37279031121b76f00f8f1a4af72cce13e405590893f7e75b69e0950bef
SSDEEP 24576:Bu8m+1zXdoO/vvTLrWNOoWaZsEEjF1dSBbGNPic1FUaMeK0wo/lEFb2RY:B
TLSH
T13447F52437F92510E7F39E3DACF06A2349397D9B9C199E8D05811F4E0921BB1E872F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{6bfdc691-beb6-4536-9161-29320081248f}_OnDiskSnapshotProp

Path \??\Volume{6e0928ee-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{6bfdc691-beb6-4536-9161-29320081248f}_OnDiskSnapshotProp
Size 6KB
SHA256 dfd9a72c1f5ff0d51bda2899c414e8b23fe879bcdee44b32e872966da04bc615
MD5 ae82a8c12b750033ba39d3d638244198
SHA1 3e5ab65c0481c00fce71107eb98ee84584e5d0b2
SHA512 dcca6a47ed1b538139f2ca4f7cb0d388cdd3f51f6de20770cb2fb816fa4c4a9a0c51ac94d60b7346d0b1f3ae63bb3a76ce7e37038cd1be4a4c0bc2e4e07badbb
SSDEEP 96:FqpeM8fFKvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:HHqb++ZVmN
TLSH
T180D19B085AF54711E2B3AB3229F14557A477B951EF33CB8E0198238E6670A10F936F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2244-105-0x00007FFC11B50000-0x00007FFC11D45000-memory.dmp

Download

memory/2704-46-0x00000000733F0000-0x000000007356B000-memory.dmp

Download

memory/2704-48-0x00007FFC11B50000-0x00007FFC11D45000-memory.dmp

Download

memory/4652-75-0x00007FFC11B50000-0x00007FFC11D45000-memory.dmp

Download

memory/4652-84-0x0000000073480000-0x00000000735FB000-memory.dmp

Download

memory/4652-77-0x0000000073480000-0x00000000735FB000-memory.dmp

Download

memory/4652-73-0x0000000073480000-0x00000000735FB000-memory.dmp

Download

memory/4980-91-0x00007FF7D7E00000-0x00007FF7D7E21000-memory.dmp

Download

memory/4980-86-0x00007FF7D7E00000-0x00007FF7D7E21000-memory.dmp

Download

memory/4980-98-0x000001CCB5C60000-0x000001CCB5C64000-memory.dmp

Download

memory/4980-99-0x00007FFC11B50000-0x00007FFC11D45000-memory.dmp

Download

memory/4980-101-0x00007FFC106E0000-0x00007FFC1079E000-memory.dmp

Download

memory/4980-103-0x00007FFC0F300000-0x00007FFC0F5C9000-memory.dmp

Download

memory/4980-107-0x00007FF7D7E00000-0x00007FF7D7E21000-memory.dmp

Download