hijackloader | c23f672216fc75e637c1b6dd66ee9753996d9d5dc123da23151fb99ba9814011

Resubmissions

20/07/2026, 19:52

260720-ylrwgaft4t10

05/06/2026, 19:35

260605-ya3htsc19y10

Analysis

max time kernel
150s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/06/2026, 19:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ZKMTXIFS.msi
Size 4.0MB
Sample260605-ya3htsc19y
SHA256 c23f672216fc75e637c1b6dd66ee9753996d9d5dc123da23151fb99ba9814011
MD5 6883baf1144e27dd12e93a4aa0ff490e
SHA1 2255e4c02cdd8fbf0767182ec142026b3dcba460
SHA512 8092970b1ee3430943d04edaa009af0175c940f02d7020a8462a74fc20d99c66ea61e0d80ba24242a45bb415d95384979115e193a93ca6b6eb7af878e7fa6fa2
SSDEEP 98304:eiNRFiGoGV8gQ/vnk2/DEG3hrvzvfO4mWJiGGZt:eiNaGigQ/n/DEGRPHmWJ1
TLSH
T18F163341BFDCFE30D8E7B7342B046A794D8CECA6075A0497619B7B35443BB9862CA1E1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery hijackloader loader persistence privilege_escalation ransomware spyware stealer

Malware Config

Extracted

Family

hijackloader

Attributes

directory
%APPDATA%\srvqueue
inject_dll
%windir%\SysWOW64\input.dll

xor.hex

Signatures

Family: HijackLoader, IDAT loader, Ghostulse,
HijackLoader is a multi-stage loader, first seen in 2023.
loader hijackloader

Detects HijackLoader (aka IDAT Loader) 1 IoCs

resource	yara_rule
behavioral1/files/0x0003000000022c78-41.dat	family_hijackloader

Executes dropped EXE 2 IoCs

pid	Process
4404	UnitPor.exe
2460	UnitPor.exe

Loads dropped DLL 7 IoCs

pid	Process
4404	UnitPor.exe
4404	UnitPor.exe
4404	UnitPor.exe
2460	UnitPor.exe
2460	UnitPor.exe
2460	UnitPor.exe
1740	DyRegistry.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2460 set thread context of 1740	2460	UnitPor.exe	111

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSIB476.tmp	msiexec.exe
File created	C:\Windows\Installer\e58b3ab.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{E73C61CF-01FA-4A01-B3D5-8E2F91AA2CEF}	msiexec.exe
File created	C:\Windows\Installer\e58b3ad.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e58b3ab.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
2552	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UnitPor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UnitPor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DyRegistry.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000f94cc820840d1c590000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000f94cc8200000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900f94cc820000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1af94cc820000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1df94cc820000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
4840	msiexec.exe
4840	msiexec.exe
4404	UnitPor.exe
2460	UnitPor.exe
2460	UnitPor.exe
2460	UnitPor.exe
2460	UnitPor.exe
1740	DyRegistry.exe
1740	DyRegistry.exe
1740	DyRegistry.exe
1740	DyRegistry.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2460	UnitPor.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2552	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2552	msiexec.exe
Token: SeSecurityPrivilege	4840	msiexec.exe
Token: SeCreateTokenPrivilege	2552	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2552	msiexec.exe
Token: SeLockMemoryPrivilege	2552	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2552	msiexec.exe
Token: SeMachineAccountPrivilege	2552	msiexec.exe
Token: SeTcbPrivilege	2552	msiexec.exe
Token: SeSecurityPrivilege	2552	msiexec.exe
Token: SeTakeOwnershipPrivilege	2552	msiexec.exe
Token: SeLoadDriverPrivilege	2552	msiexec.exe
Token: SeSystemProfilePrivilege	2552	msiexec.exe
Token: SeSystemtimePrivilege	2552	msiexec.exe
Token: SeProfSingleProcessPrivilege	2552	msiexec.exe
Token: SeIncBasePriorityPrivilege	2552	msiexec.exe
Token: SeCreatePagefilePrivilege	2552	msiexec.exe
Token: SeCreatePermanentPrivilege	2552	msiexec.exe
Token: SeBackupPrivilege	2552	msiexec.exe
Token: SeRestorePrivilege	2552	msiexec.exe
Token: SeShutdownPrivilege	2552	msiexec.exe
Token: SeDebugPrivilege	2552	msiexec.exe
Token: SeAuditPrivilege	2552	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2552	msiexec.exe
Token: SeChangeNotifyPrivilege	2552	msiexec.exe
Token: SeRemoteShutdownPrivilege	2552	msiexec.exe
Token: SeUndockPrivilege	2552	msiexec.exe
Token: SeSyncAgentPrivilege	2552	msiexec.exe
Token: SeEnableDelegationPrivilege	2552	msiexec.exe
Token: SeManageVolumePrivilege	2552	msiexec.exe
Token: SeImpersonatePrivilege	2552	msiexec.exe
Token: SeCreateGlobalPrivilege	2552	msiexec.exe
Token: SeBackupPrivilege	4724	vssvc.exe
Token: SeRestorePrivilege	4724	vssvc.exe
Token: SeAuditPrivilege	4724	vssvc.exe
Token: SeBackupPrivilege	4840	msiexec.exe
Token: SeRestorePrivilege	4840	msiexec.exe
Token: SeRestorePrivilege	4840	msiexec.exe
Token: SeTakeOwnershipPrivilege	4840	msiexec.exe
Token: SeRestorePrivilege	4840	msiexec.exe
Token: SeTakeOwnershipPrivilege	4840	msiexec.exe
Token: SeRestorePrivilege	4840	msiexec.exe
Token: SeTakeOwnershipPrivilege	4840	msiexec.exe
Token: SeRestorePrivilege	4840	msiexec.exe
Token: SeTakeOwnershipPrivilege	4840	msiexec.exe
Token: SeRestorePrivilege	4840	msiexec.exe
Token: SeTakeOwnershipPrivilege	4840	msiexec.exe
Token: SeRestorePrivilege	4840	msiexec.exe
Token: SeTakeOwnershipPrivilege	4840	msiexec.exe
Token: SeRestorePrivilege	4840	msiexec.exe
Token: SeTakeOwnershipPrivilege	4840	msiexec.exe
Token: SeRestorePrivilege	4840	msiexec.exe
Token: SeTakeOwnershipPrivilege	4840	msiexec.exe
Token: SeRestorePrivilege	4840	msiexec.exe
Token: SeTakeOwnershipPrivilege	4840	msiexec.exe
Token: SeRestorePrivilege	4840	msiexec.exe
Token: SeTakeOwnershipPrivilege	4840	msiexec.exe
Token: SeRestorePrivilege	4840	msiexec.exe
Token: SeTakeOwnershipPrivilege	4840	msiexec.exe
Token: SeRestorePrivilege	4840	msiexec.exe
Token: SeTakeOwnershipPrivilege	4840	msiexec.exe
Token: SeRestorePrivilege	4840	msiexec.exe
Token: SeTakeOwnershipPrivilege	4840	msiexec.exe
Token: SeRestorePrivilege	4840	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2552	msiexec.exe
2552	msiexec.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4840 wrote to memory of 3916	4840	msiexec.exe	96
PID 4840 wrote to memory of 4404	4840	msiexec.exe	98
PID 4404 wrote to memory of 2460	4404	UnitPor.exe	101
PID 2460 wrote to memory of 1740	2460	UnitPor.exe	111
PID 2460 wrote to memory of 1740	2460	UnitPor.exe	111
PID 2460 wrote to memory of 3272	2460	UnitPor.exe	112

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\ZKMTXIFS.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2552

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4840
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:3916
- C:\Users\Admin\AppData\Local\Umbrella\UnitPor.exe
  "C:\Users\Admin\AppData\Local\Umbrella\UnitPor.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4404
- - C:\ProgramData\srvqueue\UnitPor.exe
    C:\ProgramData\srvqueue\UnitPor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:2460
  - - C:\Users\Admin\AppData\Local\Temp\DyRegistry.exe
      C:\Users\Admin\AppData\Local\Temp\DyRegistry.exe
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:1740
  - - C:\Users\Admin\AppData\Roaming\srvqueue\XPFix.exe
      "C:\Users\Admin\AppData\Roaming\srvqueue\XPFix.exe" "C:\Users\Admin\AppData\Roaming\srvqueue\XPFix.exe" /u
      4⤵
      PID:3272

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4724

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e58b3ac.rbs

Path C:\Config.Msi\e58b3ac.rbs
Size 10KB
SHA256 c8fb1e1a903756d6d6f3953de2e9556112d76d8aaa776b77914c52b40fcdf0d7
MD5 4b245c480418cef9db5c687aac578596
SHA1 06ba34a42379aee6514da62104e8f023ea5dd787
SHA512 cd7077f94ae0841164a85e3497d44728de967a6e7c23c810169ecb26d13b9b522c55f15a98823a7047e37880c59171080ee84af7a7f830023071ab1689962370
SSDEEP 192:kM5yvGy/+EreCTtK/qmbeel0r8YwINK0r8YwqNGLi80lpW:ksL/LpLH
TLSH
T18B22770279408DFBF8DE1B73835B2769B763C2944616762F428D59200F437DC9F9A1DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

43046B.tmp

Path C:\Users\Admin\AppData\Local\Temp\43046B.tmp
Size 1.7MB
SHA256 c9f06ea58b5e66feec2258699bd8206b3f57b229ec8d790d10cfa82b3901c46d
MD5 d8ecaaecb694630e94b82e8a2767d8fa
SHA1 c11991f673b9b7a693a86fd188e63e5985c68baf
SHA512 c2646c385449a0a806909755dec05518904722f4cf87ddb23777755824127d9030eb57557246dd1b0c4cb70f15e14f7b5a178fffb534cf8d2a12a580e05c4794
SSDEEP 49152:h447CxkeT/1zc83tSXaULCqR8EjFzuo2aw5XcCNu9:KxxNz1zBMqUt8iSo6XcCNu9
TLSH
T17B85333DE83EE7BE0D8BAF5857A04A4C851494AFF07219B60E588B67242FFB56760170
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

85B3011.tmp

Path C:\Users\Admin\AppData\Local\Temp\85B3011.tmp
Size 40B
SHA256 84c2a75a932cacc8ee12a7ce115e7cdb5303c22a7d9633bae1ff1c429283247a
MD5 024d03c254dffda25151e42c6468a0a2
SHA1 9bedc1781baf6a6e36694967814692d3f36b9775
SHA512 d8eaef3a00bdce1ae701c34b0a2ea7a5b08757ad3b9a1f673e332fe68ef195e41b1a9f0cae6d76a05234c4c00f3726334709d8080d9aacc620be79e19470fee6
MD5 SHA1 SHA512

Submit Download

DyRegistry.exe

Path C:\Users\Admin\AppData\Local\Temp\DyRegistry.exe
Size 94KB
SHA256 b5379a43dbdd7231f7cafb912c1405e4d34f7c1f746db54ef03a3e024a6ee9c3
MD5 32e7be1220df639334f7035c44d1db05
SHA1 e21707e1be4337869d40fd1741372585a80bb2fe
SHA512 0cc76d126cc5c0246f6971449e710a5afd0a13babeaa8cc3a54d994b3a1b32b97e5b2e4b46c7c5ea3d569efe09f49b4f337dc45a5b421c1865f417de87e41ecb
SSDEEP 1536:JflPJ8nDqPZw6hoMnOmrYN4bAW9T9888888888888W88888888888BvqZK:JflPJ8nDTNPmcN4btR9888888888888B
TLSH
T11E93E603B3C30436F9699A38C4B6D014BD273DFC15D260252DB5EB8E49B93D26CBAD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PFU.PaperStream.SimpleScan.Overview.exe.config

Path C:\Users\Admin\AppData\Local\Umbrella\PFU.PaperStream.SimpleScan.Overview.exe.config
Size 186B
SHA256 139a5ed4ca21dd2560abeedce8f2019fae3452490fd825ca6c4ece87232888db
MD5 2884aa204310616a6b30873cbbc413e8
SHA1 f3372128e64461adfd48aab8c490daa46f675e2b
SHA512 839740f8e79859e4a22bd88905f7829b06758601af09b744de2862787aa56c53c26189316491e0146cc9bac1c7b0af835d7cedb82e628255329c253eb9d36dd4
TLSH
T175C08C5944A8BE279D338F239355CD22FFB032A3A024140CF02FAB670B7115D465737A
MD5 SHA1 SHA512 TLSH

Submit Download

PFU.PaperStream.SimpleScan.ScanProc.exe.config

Path C:\Users\Admin\AppData\Local\Umbrella\PFU.PaperStream.SimpleScan.ScanProc.exe.config
Size 189B
SHA256 7f3c414abe39b6e9ab37c48d5962f421ea91971a21f3eb1a9ff1789fafc6649e
MD5 0d242abaaac47f571a6abbcc03382c9e
SHA1 e0b86d1642e1e09e1ecf0343699201235f044e79
SHA512 86d68a4e5e05aac4fe4483870a1aa2edb6b15f376ddd2af05195bc1bd62d034a60b3f1b0f1cc9e6eea89da006cda47bfee80b3514f5f8be684d06d83591c91e0
TLSH
T14DC080554454BD274D335B1357528529EFB073A36524140CF02FE5560F7154D4657377
MD5 SHA1 SHA512 TLSH

Submit Download

PFU.PaperStream.SimpleScan.exe.config

Path C:\Users\Admin\AppData\Local\Umbrella\PFU.PaperStream.SimpleScan.exe.config
Size 674B
SHA256 c9702b241c87b66382627e6db5f7997fee804f5447be315474beeb7527aee206
MD5 91a8d0d6a31970628c06ff6b9782ba4d
SHA1 3dc8c766d880b95a3d464aa55a9279358efb3960
SHA512 28f992433c5bbb1dff7545a99c6686232130ee02b7c52e343ea820179004c462358db627d8290ed222c443336c49e77a1dddc872584fbf87ef400f050148954a
TLSH
T106017D2054C4AE268F7207A7B6268814CFBC13B72448045CF0BE56574F329C94153372
MD5 SHA1 SHA512 TLSH

Submit Download

ProfileData.dll

Path C:\Users\Admin\AppData\Local\Umbrella\ProfileData.dll
Size 91KB
SHA256 3e6db69d8bf0f606e23e27543bd39cd68c5384da6fba1f91ac493762d45d28e8
MD5 d45d8479b23e16b2ad1d07098f7b1420
SHA1 ea54047f6fe0fa3faf71e471e547a3eea2de9592
SHA512 2f96ead4dfd23a11ff9e31e94a060633eea6add83d7f99a12944a8ddf8afc8b4670ce63723fdb645dbb9624e33f0d03d900b4cb687b50776737af8da71d3cb8b
SSDEEP 1536:hhgFVKij3DYqMjR90P5jEMhzRTd2vCxa5EKrmH50EuQvY0sWppcdRnx0aU1dl7x:SVKY3EqMT0PpESzJd2vCxandQgS4RnxE
TLSH
T1D0936A51B5D0C071E5FE593C0878D6614B3F7921DEA1DE6B335812BA8F301C1AE3AE6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnitPor.exe

Path C:\Users\Admin\AppData\Local\Umbrella\UnitPor.exe
Size 62KB
SHA256 0ebbf66e8dcbd8b6a6ab755744ea29f8b4b3e59de62206b67dd1c498adf5aea9
MD5 64dd491af704e2a9316dc168e503f2a9
SHA1 c7af336b805a8c86927aa82b425687748782c83a
SHA512 653ebe46e8c67421f79bb02cf1b7c3cfffae69d6904ce8c0a7f54dd09dedaa0f69889a5f29f89decaa5344dab47602694f981efa413cfa99b01bf0a7eb7de71e
SSDEEP 768:stJwzcWYfG+2tjDpouSSBp072IqTVA3pbyA36Qy0siFCvJ4V7wmdUm1a8kabKJDk:sPwzX8h25Dpc+07KuzKMFCvJgZP1aWFV
TLSH
T10F536B1EA7A04853DC299530747AE6397433BF545F60C1A79660FA1E2DB6382AC34F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memoryctx30.tmp

Path C:\Users\Admin\AppData\Local\Umbrella\memoryctx30.tmp
Size 31KB
SHA256 7e18aa2ba32d3e6082b61e8cc1c49137bd443642aeb2f7dfe6747ee7b11835b6
MD5 912ca44f2e02d0c74a0ebe72e2672ae3
SHA1 6203eceb11d8eb76deac3a236d716f5c5fa2ed92
SHA512 e7d9e7c4d292037686b04dd43c4ab6ce0650df99ca10a0628db7c1edbc7da4c1ca87c1debd824f44739f6ff493d77b3dedb3ae0fdbc9821d7e8d0eabc0b50fed
SSDEEP 384:i1Gg0lu2ST7qXdzzjgpzVJ1ifS9STujyOcrLRnUcMVYwd9VVNesZLWRbAjLL7q2p:i4Vu82J1iSSTgM3G+09VVNjZ6q7q2p
TLSH
T171E2BFB6AE723A61381679265E38F083DB89E8F13F0F11637DE5040BB036696C575E93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mfc140u.dll

Path C:\Users\Admin\AppData\Local\Umbrella\mfc140u.dll
Size 4.7MB
SHA256 e285775ad4238fe1f2117ad890b748a818aab0cdc0b94b813f6a774263a8e6c4
MD5 212c11755f1411e94db3c3216a9bf00a
SHA1 117388930c8e1de62861a41fdf53ff70a1f2960b
SHA512 f2e83e83485c53c565c806fd31c06e1729b40dc813fb2e62e99fe3c34cd7cefec0b97674d813885d41db5bfb54c3b64c2af7de2be96aa2b6f47b4cd7ad567edf
SSDEEP 98304:SdTFKG4kbBFenwowZ5/IPwgnFLOAkGkzdnEVomFHKnPo:CnbBc85/IPwgnFLOyomFHKnPo
TLSH
T15536AF113E4810B5E55F197186ACADFDF26EAC6017B901C3E252B71AE931BC23E39793
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp_win.dll

Path C:\Users\Admin\AppData\Local\Umbrella\msvcp_win.dll
Size 493KB
SHA256 7a3d3b2dd5dbc304a1b0536ef0f9a41922e9ce06a25e9914a36d3160ba1f3d40
MD5 a91d604885dfb689678bc1cb5ae1d764
SHA1 3cf32b2eefbaf9bd49b278d8b11840db7cc70b5e
SHA512 d1387d768ff8c78a049880e4b16f57b98a3297048ccc5de3196889f2598e1bb265844f51e293a35c8190aea1b055bbda04e2e97528598a37398a7cdcaf6cf342
SSDEEP 12288:HeMcMmVRYcFERWKn9g82vWirmzbAhUgiW6QR7t5s03Ooc8dHkC2esJ2Sq3a:HeMKYXQKn9g82vtubf03Ooc8dHkC2ecH
TLSH
T1BAB44B332A4109F1E48A23B4618D936283FDED650361A3C357EEF9AD6F6D2C06A771C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scanner.json

Path C:\Users\Admin\AppData\Local\Umbrella\scanner.json
Size 1.5MB
SHA256 7e0164175ed7b9950fd6f9024a0182eb537ab850bd3f2c49d2b0b6928a78dd4b
MD5 3e2aae714140fef4a56eede6841a2a4c
SHA1 6794d8424bb7c7de19ae7fe9c1538245fc9d53ae
SHA512 1c7e4fb3de3d4cf8c2e48b4054581519c492f22cf687734b3b79c699a008f618b6bf53adcbf02cbd81780b82e702bcc0ab1b3c7058a550e9d3c713ba8aecea11
SSDEEP 49152:upk1nyuTgqCCqeBHyy1efQNXGnevcGjc+:GkTnCBgnYnevccc+
TLSH
T1027523F52EC9923CE8DE1E73D697D86450C076F892BE19E827079A84C15EACCE1D4B34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Umbrella\ucrtbase.dll
Size 1.1MB
SHA256 b59c1f7e457b144a211b74b31492a68a7844232121c4046c7538b0d2ab3cfc31
MD5 6c6c82d1efb4a4f1663b274eb9c33938
SHA1 37ac5fc535269de784ee7a452e5a9bc6ea57798e
SHA512 933d9d109d6dcae8e69b634721a29b963d64330943fddadfd889bbbbd63690fe6beaf35f5d150dd2e29cff89b6379d187cf6a87d8b731c5b68bacdc749859fa2
SSDEEP 24576:/QeCoON4h/4z/G1YknUkY3Ub6lymQmcvIZPoy4yuhp1Rz+:YeCoONs42nUv3Ubftp11+
TLSH
T196358C107895C2A4CCAD30F51A8EFA36466DB5904F24A8C377D41BFFCC690D0A9F769A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Local\Umbrella\vcruntime140.dll
Size 89KB
SHA256 a9d7732a3c3de09f0601a7fa2555093dcb49f08e2fc62a86091461f0f38393ed
MD5 4bea1ba68690620b78c7502ac968f0ba
SHA1 acdc523fa28632fcecede3eeaf62c6bce26527b4
SHA512 d451625494b54b96a481d34f5b42b9c631810558267e8b37b182fe09583422f1c1171a922c9abfe4227ee91f430f3579e8ab8173234264a435fdcfa6a16ce57e
SSDEEP 1536:WJJFW1PcUMCdLiNWNrjO+MT+S0OeneLDA50Xsd2zkkBGCGVbBBTkfeecb6RWSwgZ:I3W1P/MCdnQ+8EWXsd2ARNBPecb60Swo
TLSH
T10C937E9375F881B2D99E05B0D9BBFB161D3DE6410FF06BD71B949844DEA2BC09B3021A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58b3ab.msi

Path C:\Windows\Installer\e58b3ab.msi
Size 4.0MB
SHA256 c23f672216fc75e637c1b6dd66ee9753996d9d5dc123da23151fb99ba9814011
MD5 6883baf1144e27dd12e93a4aa0ff490e
SHA1 2255e4c02cdd8fbf0767182ec142026b3dcba460
SHA512 8092970b1ee3430943d04edaa009af0175c940f02d7020a8462a74fc20d99c66ea61e0d80ba24242a45bb415d95384979115e193a93ca6b6eb7af878e7fa6fa2
SSDEEP 98304:eiNRFiGoGV8gQ/vnk2/DEG3hrvzvfO4mWJiGGZt:eiNaGigQ/n/DEGRPHmWJ1
TLSH
T18F163341BFDCFE30D8E7B7342B046A794D8CECA6075A0497619B7B35443BB9862CA1E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 0dd700726307f71623f3b13a9a849eca86e8e21b6ee757c27b964dd8f5147554
MD5 5c822189a1d1609d414e06c64f94eb81
SHA1 ea087a9893dd31110667c9ae67bcdbea8e1d0d89
SHA512 3614952f4dd874f5df799b97fa536e7ae3ab3242c14e35a475251de360b561a0387ab5c32ecc5af5667fdf430bd1c7205dfe4f0df1945bb33643b67b6d726d2a
SSDEEP 24576:3u8m+1zAdoO/vvTLrWceJG64dl0zEVMiwKmNeTtlU06tuLlBovVFk6XRp:E
TLSH
T16047E42436F92110E7F79E3CA8F16A234D3A7D5B8C159E8D05411B4E0962FB1E872F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{6da03609-0d41-4e3b-b90e-764e43155180}_OnDiskSnapshotProp

Path \??\Volume{20c84cf9-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{6da03609-0d41-4e3b-b90e-764e43155180}_OnDiskSnapshotProp
Size 6KB
SHA256 7e98e363fd90e8cd89121c5901f51b3826a9fbd8bad0de0a4ca37aea6e932609
MD5 3a66e4632ea3d423fece2918bb120806
SHA1 c222db9698e8870e64af8b55dd5deb20385e8228
SHA512 7082a19ce7eb5bb6a91f0a4fe7fa2d916d3d2c68afdae1772bc32df24c3984cda4f92e0ec8cd833b0af052d006c41eee15a50e73ab1ca52e47302e3dd1f80e2a
SSDEEP 96:FSx3YcAqvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:sx3pb++ZVmN
TLSH
T130D1890C5AF54711E2B3AB7129F18557A877B911EF33CB8E0298238E2671910F936F5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1740-200-0x0000000005860000-0x0000000005936000-memory.dmp

Download

memory/1740-168-0x0000000005860000-0x0000000005936000-memory.dmp

Download

memory/1740-1990-0x0000000006660000-0x0000000006C04000-memory.dmp

Download

memory/1740-84-0x0000000000420000-0x00000000004F2000-memory.dmp

Download

memory/1740-1989-0x00000000065C0000-0x0000000006652000-memory.dmp

Download

memory/1740-1988-0x0000000005A80000-0x0000000005AE6000-memory.dmp

Download

memory/1740-1987-0x0000000005840000-0x0000000005846000-memory.dmp

Download

memory/1740-89-0x00007FFFA6E30000-0x00007FFFA7025000-memory.dmp

Download

memory/1740-90-0x0000000000420000-0x00000000004F2000-memory.dmp

Download

memory/1740-128-0x0000000005860000-0x0000000005936000-memory.dmp

Download

memory/1740-96-0x0000000005490000-0x000000000553E000-memory.dmp

Download

memory/1740-97-0x0000000005640000-0x00000000056A4000-memory.dmp

Download

memory/1740-98-0x0000000005860000-0x000000000593C000-memory.dmp

Download

memory/1740-99-0x0000000005860000-0x0000000005936000-memory.dmp

Download

memory/1740-122-0x0000000005860000-0x0000000005936000-memory.dmp

Download

memory/1740-160-0x0000000005860000-0x0000000005936000-memory.dmp

Download

memory/1740-184-0x0000000005860000-0x0000000005936000-memory.dmp

Download

memory/1740-182-0x0000000005860000-0x0000000005936000-memory.dmp

Download

memory/1740-180-0x0000000005860000-0x0000000005936000-memory.dmp

Download

memory/1740-178-0x0000000005860000-0x0000000005936000-memory.dmp

Download

memory/1740-176-0x0000000005860000-0x0000000005936000-memory.dmp

Download

memory/1740-174-0x0000000005860000-0x0000000005936000-memory.dmp

Download

memory/1740-172-0x0000000005860000-0x0000000005936000-memory.dmp

Download

memory/1740-206-0x0000000005860000-0x0000000005936000-memory.dmp

Download

memory/1740-204-0x0000000005860000-0x0000000005936000-memory.dmp

Download

memory/1740-202-0x0000000005860000-0x0000000005936000-memory.dmp

Download

memory/1740-134-0x0000000005860000-0x0000000005936000-memory.dmp

Download

memory/1740-198-0x0000000005860000-0x0000000005936000-memory.dmp

Download

memory/1740-196-0x0000000005860000-0x0000000005936000-memory.dmp

Download

memory/1740-194-0x0000000005860000-0x0000000005936000-memory.dmp

Download

memory/1740-192-0x0000000005860000-0x0000000005936000-memory.dmp

Download

memory/1740-190-0x0000000005860000-0x0000000005936000-memory.dmp

Download

memory/1740-188-0x0000000005860000-0x0000000005936000-memory.dmp

Download

memory/1740-186-0x0000000005860000-0x0000000005936000-memory.dmp

Download

memory/1740-170-0x0000000005860000-0x0000000005936000-memory.dmp

Download

memory/1740-100-0x0000000005860000-0x0000000005936000-memory.dmp

Download

memory/1740-166-0x0000000005860000-0x0000000005936000-memory.dmp

Download

memory/1740-164-0x0000000005860000-0x0000000005936000-memory.dmp

Download

memory/1740-162-0x0000000005860000-0x0000000005936000-memory.dmp

Download

memory/1740-158-0x0000000005860000-0x0000000005936000-memory.dmp

Download

memory/1740-156-0x0000000005860000-0x0000000005936000-memory.dmp

Download

memory/1740-152-0x0000000005860000-0x0000000005936000-memory.dmp

Download

memory/1740-150-0x0000000005860000-0x0000000005936000-memory.dmp

Download

memory/1740-148-0x0000000005860000-0x0000000005936000-memory.dmp

Download

memory/1740-146-0x0000000005860000-0x0000000005936000-memory.dmp

Download

memory/1740-144-0x0000000005860000-0x0000000005936000-memory.dmp

Download

memory/1740-142-0x0000000005860000-0x0000000005936000-memory.dmp

Download

memory/1740-140-0x0000000005860000-0x0000000005936000-memory.dmp

Download

memory/1740-138-0x0000000005860000-0x0000000005936000-memory.dmp

Download

memory/1740-154-0x0000000005860000-0x0000000005936000-memory.dmp

Download

memory/1740-136-0x0000000005860000-0x0000000005936000-memory.dmp

Download

memory/1740-132-0x0000000005860000-0x0000000005936000-memory.dmp

Download

memory/1740-130-0x0000000005860000-0x0000000005936000-memory.dmp

Download

memory/1740-126-0x0000000005860000-0x0000000005936000-memory.dmp

Download

memory/1740-124-0x0000000005860000-0x0000000005936000-memory.dmp

Download

memory/1740-120-0x0000000005860000-0x0000000005936000-memory.dmp

Download

memory/1740-118-0x0000000005860000-0x0000000005936000-memory.dmp

Download

memory/1740-116-0x0000000005860000-0x0000000005936000-memory.dmp

Download

memory/1740-114-0x0000000005860000-0x0000000005936000-memory.dmp

Download

memory/1740-112-0x0000000005860000-0x0000000005936000-memory.dmp

Download

memory/1740-110-0x0000000005860000-0x0000000005936000-memory.dmp

Download

memory/1740-108-0x0000000005860000-0x0000000005936000-memory.dmp

Download

memory/1740-106-0x0000000005860000-0x0000000005936000-memory.dmp

Download

memory/1740-104-0x0000000005860000-0x0000000005936000-memory.dmp

Download

memory/1740-102-0x0000000005860000-0x0000000005936000-memory.dmp

Download

memory/2460-78-0x0000000074AB0000-0x0000000074AFF000-memory.dmp

Download

memory/2460-92-0x0000000000A70000-0x0000000000B82000-memory.dmp

Download

memory/2460-75-0x0000000074AB0000-0x0000000074AFF000-memory.dmp

Download

memory/2460-76-0x00007FFFA6E30000-0x00007FFFA7025000-memory.dmp

Download

memory/2460-82-0x0000000074AB0000-0x0000000074AFF000-memory.dmp

Download

memory/4404-42-0x0000000074AB0000-0x0000000074AFF000-memory.dmp

Download

memory/4404-43-0x00007FFFA6E30000-0x00007FFFA7025000-memory.dmp

Download