hijackloader | c23f672216fc75e637c1b6dd66ee9753996d9d5dc123da23151fb99ba9814011

Resubmissions

20/07/2026, 19:52

260720-ylrwgaft4t10

05/06/2026, 19:35

260605-ya3htsc19y10

Analysis

max time kernel
149s
max time network
142s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
05/06/2026, 19:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ZKMTXIFS.msi
Size 4.0MB
Sample260605-ya3htsc19y
SHA256 c23f672216fc75e637c1b6dd66ee9753996d9d5dc123da23151fb99ba9814011
MD5 6883baf1144e27dd12e93a4aa0ff490e
SHA1 2255e4c02cdd8fbf0767182ec142026b3dcba460
SHA512 8092970b1ee3430943d04edaa009af0175c940f02d7020a8462a74fc20d99c66ea61e0d80ba24242a45bb415d95384979115e193a93ca6b6eb7af878e7fa6fa2
SSDEEP 98304:eiNRFiGoGV8gQ/vnk2/DEG3hrvzvfO4mWJiGGZt:eiNaGigQ/n/DEGRPHmWJ1
TLSH
T18F163341BFDCFE30D8E7B7342B046A794D8CECA6075A0497619B7B35443BB9862CA1E1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery hijackloader loader persistence privilege_escalation ransomware spyware stealer

Malware Config

Extracted

Family

hijackloader

Attributes

directory
%APPDATA%\srvqueue
inject_dll
%windir%\SysWOW64\input.dll

xor.hex

Signatures

Family: HijackLoader, IDAT loader, Ghostulse,
HijackLoader is a multi-stage loader, first seen in 2023.
loader hijackloader

Detects HijackLoader (aka IDAT Loader) 1 IoCs

resource	yara_rule
behavioral2/files/0x001900000002b519-39.dat	family_hijackloader

Executes dropped EXE 2 IoCs

pid	Process
1740	UnitPor.exe
6108	UnitPor.exe

Loads dropped DLL 7 IoCs

pid	Process
1740	UnitPor.exe
1740	UnitPor.exe
1740	UnitPor.exe
6108	UnitPor.exe
6108	UnitPor.exe
6108	UnitPor.exe
2256	DyRegistry.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 6108 set thread context of 2256	6108	UnitPor.exe	88

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\~DF298C1BB43DA21259.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFB12FE900BE60A01C.TMP	msiexec.exe
File created	C:\Windows\Installer\e581a3a.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e581a3a.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{E73C61CF-01FA-4A01-B3D5-8E2F91AA2CEF}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF40B49D51881F0767.TMP	msiexec.exe
File created	C:\Windows\Installer\e581a3c.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF03107E11F60C0064.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1B53.tmp	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
1760	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UnitPor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UnitPor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DyRegistry.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ab511af7d208ca820000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000ab511af70000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900ab511af7000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1aab511af7000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dab511af7000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
3132	msiexec.exe
3132	msiexec.exe
1740	UnitPor.exe
6108	UnitPor.exe
6108	UnitPor.exe
6108	UnitPor.exe
6108	UnitPor.exe
2256	DyRegistry.exe
2256	DyRegistry.exe
2256	DyRegistry.exe
2256	DyRegistry.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
6108	UnitPor.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1760	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1760	msiexec.exe
Token: SeSecurityPrivilege	3132	msiexec.exe
Token: SeCreateTokenPrivilege	1760	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1760	msiexec.exe
Token: SeLockMemoryPrivilege	1760	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1760	msiexec.exe
Token: SeMachineAccountPrivilege	1760	msiexec.exe
Token: SeTcbPrivilege	1760	msiexec.exe
Token: SeSecurityPrivilege	1760	msiexec.exe
Token: SeTakeOwnershipPrivilege	1760	msiexec.exe
Token: SeLoadDriverPrivilege	1760	msiexec.exe
Token: SeSystemProfilePrivilege	1760	msiexec.exe
Token: SeSystemtimePrivilege	1760	msiexec.exe
Token: SeProfSingleProcessPrivilege	1760	msiexec.exe
Token: SeIncBasePriorityPrivilege	1760	msiexec.exe
Token: SeCreatePagefilePrivilege	1760	msiexec.exe
Token: SeCreatePermanentPrivilege	1760	msiexec.exe
Token: SeBackupPrivilege	1760	msiexec.exe
Token: SeRestorePrivilege	1760	msiexec.exe
Token: SeShutdownPrivilege	1760	msiexec.exe
Token: SeDebugPrivilege	1760	msiexec.exe
Token: SeAuditPrivilege	1760	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1760	msiexec.exe
Token: SeChangeNotifyPrivilege	1760	msiexec.exe
Token: SeRemoteShutdownPrivilege	1760	msiexec.exe
Token: SeUndockPrivilege	1760	msiexec.exe
Token: SeSyncAgentPrivilege	1760	msiexec.exe
Token: SeEnableDelegationPrivilege	1760	msiexec.exe
Token: SeManageVolumePrivilege	1760	msiexec.exe
Token: SeImpersonatePrivilege	1760	msiexec.exe
Token: SeCreateGlobalPrivilege	1760	msiexec.exe
Token: SeBackupPrivilege	5428	vssvc.exe
Token: SeRestorePrivilege	5428	vssvc.exe
Token: SeAuditPrivilege	5428	vssvc.exe
Token: SeBackupPrivilege	3132	msiexec.exe
Token: SeRestorePrivilege	3132	msiexec.exe
Token: SeRestorePrivilege	3132	msiexec.exe
Token: SeTakeOwnershipPrivilege	3132	msiexec.exe
Token: SeRestorePrivilege	3132	msiexec.exe
Token: SeTakeOwnershipPrivilege	3132	msiexec.exe
Token: SeRestorePrivilege	3132	msiexec.exe
Token: SeTakeOwnershipPrivilege	3132	msiexec.exe
Token: SeRestorePrivilege	3132	msiexec.exe
Token: SeTakeOwnershipPrivilege	3132	msiexec.exe
Token: SeRestorePrivilege	3132	msiexec.exe
Token: SeTakeOwnershipPrivilege	3132	msiexec.exe
Token: SeRestorePrivilege	3132	msiexec.exe
Token: SeTakeOwnershipPrivilege	3132	msiexec.exe
Token: SeRestorePrivilege	3132	msiexec.exe
Token: SeTakeOwnershipPrivilege	3132	msiexec.exe
Token: SeRestorePrivilege	3132	msiexec.exe
Token: SeTakeOwnershipPrivilege	3132	msiexec.exe
Token: SeRestorePrivilege	3132	msiexec.exe
Token: SeTakeOwnershipPrivilege	3132	msiexec.exe
Token: SeRestorePrivilege	3132	msiexec.exe
Token: SeTakeOwnershipPrivilege	3132	msiexec.exe
Token: SeRestorePrivilege	3132	msiexec.exe
Token: SeTakeOwnershipPrivilege	3132	msiexec.exe
Token: SeRestorePrivilege	3132	msiexec.exe
Token: SeTakeOwnershipPrivilege	3132	msiexec.exe
Token: SeRestorePrivilege	3132	msiexec.exe
Token: SeTakeOwnershipPrivilege	3132	msiexec.exe
Token: SeRestorePrivilege	3132	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1760	msiexec.exe
1760	msiexec.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3132 wrote to memory of 2924	3132	msiexec.exe	84
PID 3132 wrote to memory of 1740	3132	msiexec.exe	86
PID 1740 wrote to memory of 6108	1740	UnitPor.exe	87
PID 6108 wrote to memory of 2256	6108	UnitPor.exe	88
PID 6108 wrote to memory of 2256	6108	UnitPor.exe	88
PID 6108 wrote to memory of 2788	6108	UnitPor.exe	89

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\ZKMTXIFS.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1760

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3132
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:2924
- C:\Users\Admin\AppData\Local\Umbrella\UnitPor.exe
  "C:\Users\Admin\AppData\Local\Umbrella\UnitPor.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1740
- - C:\ProgramData\srvqueue\UnitPor.exe
    C:\ProgramData\srvqueue\UnitPor.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:6108
  - - C:\Users\Admin\AppData\Local\Temp\DyRegistry.exe
      C:\Users\Admin\AppData\Local\Temp\DyRegistry.exe
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:2256
  - - C:\Users\Admin\AppData\Roaming\srvqueue\XPFix.exe
      "C:\Users\Admin\AppData\Roaming\srvqueue\XPFix.exe" "C:\Users\Admin\AppData\Roaming\srvqueue\XPFix.exe" /u
      4⤵
      PID:2788

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:5428

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e581a3b.rbs

Path C:\Config.Msi\e581a3b.rbs
Size 10KB
SHA256 90c6b7fa5803f9127eb1abd252592d98a9f03e5af86ac5128ae407c132089de2
MD5 22bebd2913a35bf9e64027453325888c
SHA1 f40b1a451356a80cccfc9466623bd4ca09f5f7f1
SHA512 3f5ec08134dd4b0037dc9b3a0678c916e05c96a53f92c16527bd16ff0d1453b665e165ed354b8dbdf897238ab803700bb160015934043fc276a26de1319cc336
SSDEEP 192:PM/vGy/+EreCTtK/q4iCOidl0r8YwINK0r8YwwZ1NQlTLPD28IU80lpbYu31UvYv:Pui3L/L+ZMlTLPD28IMYu31UvYOK
TLSH
T18A2264027980C9F6F8EC173193532B95B7A3D2A88636776B418D58280F432EC9FDA1D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2D45E09.tmp

Path C:\Users\Admin\AppData\Local\Temp\2D45E09.tmp
Size 1.7MB
SHA256 b92aa845076098716e2b7a504ee9681da0a8590e6386291573c7c9dfe8c7849e
MD5 221bcdd2f9a1b4bf0f8553ceb30eb83b
SHA1 58250cca8a691bd2733161394b35adeac9f8f83b
SHA512 e56a8b0d9507a13e41746796ff7c218b7afd8e5427730e96e216a489e8fa5dd020d16b3c49f28ccf594056c0e927879b8c5c4f452f0610164ebed85413da29c9
SSDEEP 49152:K5tYeaSV6DNCVkye1vlKIvdG0ddbPx+ULO5Ih3YaDXOCehy:E+eaSVyNCi9/bPMULO5Ih35Ey
TLSH
T1458533593529F60D32A5E89479FF032B32BA16070276227D289FB0DC7777A65A4E43F0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

63F81DF.tmp

Path C:\Users\Admin\AppData\Local\Temp\63F81DF.tmp
Size 40B
SHA256 9d53d334caac7b95a450775f97fd63fa867b4cf457162c3f761fd7a2b80f08a0
MD5 cd0245b631ec2910efdf1fb67ed58a12
SHA1 1549a252803fd820a94d8cdbeac51b3a60c8051e
SHA512 75b4129e35894672a963439902237f8b7854c4f11db88da4325336a8c4e07cc11824634eb5ed7e75c2e24f2f89c161c1543e641cca3ee424ec5281dcef6e5034
MD5 SHA1 SHA512

Submit Download

DyRegistry.exe

Path C:\Users\Admin\AppData\Local\Temp\DyRegistry.exe
Size 94KB
SHA256 b5379a43dbdd7231f7cafb912c1405e4d34f7c1f746db54ef03a3e024a6ee9c3
MD5 32e7be1220df639334f7035c44d1db05
SHA1 e21707e1be4337869d40fd1741372585a80bb2fe
SHA512 0cc76d126cc5c0246f6971449e710a5afd0a13babeaa8cc3a54d994b3a1b32b97e5b2e4b46c7c5ea3d569efe09f49b4f337dc45a5b421c1865f417de87e41ecb
SSDEEP 1536:JflPJ8nDqPZw6hoMnOmrYN4bAW9T9888888888888W88888888888BvqZK:JflPJ8nDTNPmcN4btR9888888888888B
TLSH
T11E93E603B3C30436F9699A38C4B6D014BD273DFC15D260252DB5EB8E49B93D26CBAD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PFU.PaperStream.SimpleScan.Overview.exe.config

Path C:\Users\Admin\AppData\Local\Umbrella\PFU.PaperStream.SimpleScan.Overview.exe.config
Size 186B
SHA256 139a5ed4ca21dd2560abeedce8f2019fae3452490fd825ca6c4ece87232888db
MD5 2884aa204310616a6b30873cbbc413e8
SHA1 f3372128e64461adfd48aab8c490daa46f675e2b
SHA512 839740f8e79859e4a22bd88905f7829b06758601af09b744de2862787aa56c53c26189316491e0146cc9bac1c7b0af835d7cedb82e628255329c253eb9d36dd4
TLSH
T175C08C5944A8BE279D338F239355CD22FFB032A3A024140CF02FAB670B7115D465737A
MD5 SHA1 SHA512 TLSH

Submit Download

PFU.PaperStream.SimpleScan.ScanProc.exe.config

Path C:\Users\Admin\AppData\Local\Umbrella\PFU.PaperStream.SimpleScan.ScanProc.exe.config
Size 189B
SHA256 7f3c414abe39b6e9ab37c48d5962f421ea91971a21f3eb1a9ff1789fafc6649e
MD5 0d242abaaac47f571a6abbcc03382c9e
SHA1 e0b86d1642e1e09e1ecf0343699201235f044e79
SHA512 86d68a4e5e05aac4fe4483870a1aa2edb6b15f376ddd2af05195bc1bd62d034a60b3f1b0f1cc9e6eea89da006cda47bfee80b3514f5f8be684d06d83591c91e0
TLSH
T14DC080554454BD274D335B1357528529EFB073A36524140CF02FE5560F7154D4657377
MD5 SHA1 SHA512 TLSH

Submit Download

PFU.PaperStream.SimpleScan.exe.config

Path C:\Users\Admin\AppData\Local\Umbrella\PFU.PaperStream.SimpleScan.exe.config
Size 674B
SHA256 c9702b241c87b66382627e6db5f7997fee804f5447be315474beeb7527aee206
MD5 91a8d0d6a31970628c06ff6b9782ba4d
SHA1 3dc8c766d880b95a3d464aa55a9279358efb3960
SHA512 28f992433c5bbb1dff7545a99c6686232130ee02b7c52e343ea820179004c462358db627d8290ed222c443336c49e77a1dddc872584fbf87ef400f050148954a
TLSH
T106017D2054C4AE268F7207A7B6268814CFBC13B72448045CF0BE56574F329C94153372
MD5 SHA1 SHA512 TLSH

Submit Download

ProfileData.dll

Path C:\Users\Admin\AppData\Local\Umbrella\ProfileData.dll
Size 91KB
SHA256 3e6db69d8bf0f606e23e27543bd39cd68c5384da6fba1f91ac493762d45d28e8
MD5 d45d8479b23e16b2ad1d07098f7b1420
SHA1 ea54047f6fe0fa3faf71e471e547a3eea2de9592
SHA512 2f96ead4dfd23a11ff9e31e94a060633eea6add83d7f99a12944a8ddf8afc8b4670ce63723fdb645dbb9624e33f0d03d900b4cb687b50776737af8da71d3cb8b
SSDEEP 1536:hhgFVKij3DYqMjR90P5jEMhzRTd2vCxa5EKrmH50EuQvY0sWppcdRnx0aU1dl7x:SVKY3EqMT0PpESzJd2vCxandQgS4RnxE
TLSH
T1D0936A51B5D0C071E5FE593C0878D6614B3F7921DEA1DE6B335812BA8F301C1AE3AE6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnitPor.exe

Path C:\Users\Admin\AppData\Local\Umbrella\UnitPor.exe
Size 62KB
SHA256 0ebbf66e8dcbd8b6a6ab755744ea29f8b4b3e59de62206b67dd1c498adf5aea9
MD5 64dd491af704e2a9316dc168e503f2a9
SHA1 c7af336b805a8c86927aa82b425687748782c83a
SHA512 653ebe46e8c67421f79bb02cf1b7c3cfffae69d6904ce8c0a7f54dd09dedaa0f69889a5f29f89decaa5344dab47602694f981efa413cfa99b01bf0a7eb7de71e
SSDEEP 768:stJwzcWYfG+2tjDpouSSBp072IqTVA3pbyA36Qy0siFCvJ4V7wmdUm1a8kabKJDk:sPwzX8h25Dpc+07KuzKMFCvJgZP1aWFV
TLSH
T10F536B1EA7A04853DC299530747AE6397433BF545F60C1A79660FA1E2DB6382AC34F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Umbrella\VCRUNTIME140.dll
Size 89KB
SHA256 a9d7732a3c3de09f0601a7fa2555093dcb49f08e2fc62a86091461f0f38393ed
MD5 4bea1ba68690620b78c7502ac968f0ba
SHA1 acdc523fa28632fcecede3eeaf62c6bce26527b4
SHA512 d451625494b54b96a481d34f5b42b9c631810558267e8b37b182fe09583422f1c1171a922c9abfe4227ee91f430f3579e8ab8173234264a435fdcfa6a16ce57e
SSDEEP 1536:WJJFW1PcUMCdLiNWNrjO+MT+S0OeneLDA50Xsd2zkkBGCGVbBBTkfeecb6RWSwgZ:I3W1P/MCdnQ+8EWXsd2ARNBPecb60Swo
TLSH
T10C937E9375F881B2D99E05B0D9BBFB161D3DE6410FF06BD71B949844DEA2BC09B3021A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memoryctx30.tmp

Path C:\Users\Admin\AppData\Local\Umbrella\memoryctx30.tmp
Size 31KB
SHA256 7e18aa2ba32d3e6082b61e8cc1c49137bd443642aeb2f7dfe6747ee7b11835b6
MD5 912ca44f2e02d0c74a0ebe72e2672ae3
SHA1 6203eceb11d8eb76deac3a236d716f5c5fa2ed92
SHA512 e7d9e7c4d292037686b04dd43c4ab6ce0650df99ca10a0628db7c1edbc7da4c1ca87c1debd824f44739f6ff493d77b3dedb3ae0fdbc9821d7e8d0eabc0b50fed
SSDEEP 384:i1Gg0lu2ST7qXdzzjgpzVJ1ifS9STujyOcrLRnUcMVYwd9VVNesZLWRbAjLL7q2p:i4Vu82J1iSSTgM3G+09VVNjZ6q7q2p
TLSH
T171E2BFB6AE723A61381679265E38F083DB89E8F13F0F11637DE5040BB036696C575E93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mfc140u.dll

Path C:\Users\Admin\AppData\Local\Umbrella\mfc140u.dll
Size 4.7MB
SHA256 e285775ad4238fe1f2117ad890b748a818aab0cdc0b94b813f6a774263a8e6c4
MD5 212c11755f1411e94db3c3216a9bf00a
SHA1 117388930c8e1de62861a41fdf53ff70a1f2960b
SHA512 f2e83e83485c53c565c806fd31c06e1729b40dc813fb2e62e99fe3c34cd7cefec0b97674d813885d41db5bfb54c3b64c2af7de2be96aa2b6f47b4cd7ad567edf
SSDEEP 98304:SdTFKG4kbBFenwowZ5/IPwgnFLOAkGkzdnEVomFHKnPo:CnbBc85/IPwgnFLOyomFHKnPo
TLSH
T15536AF113E4810B5E55F197186ACADFDF26EAC6017B901C3E252B71AE931BC23E39793
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp_win.dll

Path C:\Users\Admin\AppData\Local\Umbrella\msvcp_win.dll
Size 493KB
SHA256 7a3d3b2dd5dbc304a1b0536ef0f9a41922e9ce06a25e9914a36d3160ba1f3d40
MD5 a91d604885dfb689678bc1cb5ae1d764
SHA1 3cf32b2eefbaf9bd49b278d8b11840db7cc70b5e
SHA512 d1387d768ff8c78a049880e4b16f57b98a3297048ccc5de3196889f2598e1bb265844f51e293a35c8190aea1b055bbda04e2e97528598a37398a7cdcaf6cf342
SSDEEP 12288:HeMcMmVRYcFERWKn9g82vWirmzbAhUgiW6QR7t5s03Ooc8dHkC2esJ2Sq3a:HeMKYXQKn9g82vtubf03Ooc8dHkC2ecH
TLSH
T1BAB44B332A4109F1E48A23B4618D936283FDED650361A3C357EEF9AD6F6D2C06A771C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scanner.json

Path C:\Users\Admin\AppData\Local\Umbrella\scanner.json
Size 1.5MB
SHA256 7e0164175ed7b9950fd6f9024a0182eb537ab850bd3f2c49d2b0b6928a78dd4b
MD5 3e2aae714140fef4a56eede6841a2a4c
SHA1 6794d8424bb7c7de19ae7fe9c1538245fc9d53ae
SHA512 1c7e4fb3de3d4cf8c2e48b4054581519c492f22cf687734b3b79c699a008f618b6bf53adcbf02cbd81780b82e702bcc0ab1b3c7058a550e9d3c713ba8aecea11
SSDEEP 49152:upk1nyuTgqCCqeBHyy1efQNXGnevcGjc+:GkTnCBgnYnevccc+
TLSH
T1027523F52EC9923CE8DE1E73D697D86450C076F892BE19E827079A84C15EACCE1D4B34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Umbrella\ucrtbase.dll
Size 1.1MB
SHA256 b59c1f7e457b144a211b74b31492a68a7844232121c4046c7538b0d2ab3cfc31
MD5 6c6c82d1efb4a4f1663b274eb9c33938
SHA1 37ac5fc535269de784ee7a452e5a9bc6ea57798e
SHA512 933d9d109d6dcae8e69b634721a29b963d64330943fddadfd889bbbbd63690fe6beaf35f5d150dd2e29cff89b6379d187cf6a87d8b731c5b68bacdc749859fa2
SSDEEP 24576:/QeCoON4h/4z/G1YknUkY3Ub6lymQmcvIZPoy4yuhp1Rz+:YeCoONs42nUv3Ubftp11+
TLSH
T196358C107895C2A4CCAD30F51A8EFA36466DB5904F24A8C377D41BFFCC690D0A9F769A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e581a3a.msi

Path C:\Windows\Installer\e581a3a.msi
Size 4.0MB
SHA256 c23f672216fc75e637c1b6dd66ee9753996d9d5dc123da23151fb99ba9814011
MD5 6883baf1144e27dd12e93a4aa0ff490e
SHA1 2255e4c02cdd8fbf0767182ec142026b3dcba460
SHA512 8092970b1ee3430943d04edaa009af0175c940f02d7020a8462a74fc20d99c66ea61e0d80ba24242a45bb415d95384979115e193a93ca6b6eb7af878e7fa6fa2
SSDEEP 98304:eiNRFiGoGV8gQ/vnk2/DEG3hrvzvfO4mWJiGGZt:eiNaGigQ/n/DEGRPHmWJ1
TLSH
T18F163341BFDCFE30D8E7B7342B046A794D8CECA6075A0497619B7B35443BB9862CA1E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.6MB
SHA256 de4db0dbec43cf82c3d862398f046f4329a25cd1264fedfa547a4235a4137100
MD5 e1bdb8074ec4fbe6aabab4537f3f188c
SHA1 7b6d517a3cf1e74142bf7f31f2509efc765d6558
SHA512 17db329e2edaba3423498829c17c99342142cdbe56bd803ff0af876a4cada3d12c1c9e491fc3c69efa32be672630de85cd68f4d95a093ae567f5da36d5bda1d5
SSDEEP 24576:l2gmSp1ddoO/vvTLjWouhknavK5jQI8iGmrtX50ohTa40UM9oDJfrFyvR:p
TLSH
T12F47E32432F92210E7F79E3C68F06A67493E7D5B9C15DE8D05421F4E0A61BB0E872F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{cb8f0f71-fe65-4dc3-939b-48ceedbd748d}_OnDiskSnapshotProp

Path \??\Volume{f71a51ab-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{cb8f0f71-fe65-4dc3-939b-48ceedbd748d}_OnDiskSnapshotProp
Size 6KB
SHA256 b2af3ded4400bdc62ae5057bbf01134a61be95f826432706605971c40eedbaa4
MD5 ef2c6463932be8180087c9458674cc1d
SHA1 3ea2f2b9cd21276be04f5f11d1ab106fea345863
SHA512 542dec281d0b8e380611a71091e32634286001e7326b8dbf6fa68afe7c433b7bf876ce2c4273ed458b7b384bba5079098038acd6985d751c512f4468d45636c2
SSDEEP 96:FaYs0vc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:4sb++ZVmN
TLSH
T14CD187085AF54311E2B3AB3229F18557A877B911EF33CB8E0198638E6670910F875F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1740-41-0x00007FF8BCEE0000-0x00007FF8BD0E9000-memory.dmp

Download

memory/1740-40-0x0000000074C40000-0x0000000074C8F000-memory.dmp

Download

memory/2256-179-0x0000000005890000-0x0000000005966000-memory.dmp

Download

memory/2256-155-0x0000000005890000-0x0000000005966000-memory.dmp

Download

memory/2256-1991-0x0000000006C20000-0x00000000071C6000-memory.dmp

Download

memory/2256-1990-0x0000000006B80000-0x0000000006C12000-memory.dmp

Download

memory/2256-1987-0x0000000005A20000-0x0000000005A86000-memory.dmp

Download

memory/2256-89-0x00007FF8BCEE0000-0x00007FF8BD0E9000-memory.dmp

Download

memory/2256-90-0x0000000000AB0000-0x0000000000B82000-memory.dmp

Download

memory/2256-1985-0x00000000059D0000-0x00000000059D6000-memory.dmp

Download

memory/2256-93-0x00000000055D0000-0x000000000567E000-memory.dmp

Download

memory/2256-94-0x0000000005520000-0x0000000005584000-memory.dmp

Download

memory/2256-95-0x0000000005890000-0x000000000596C000-memory.dmp

Download

memory/2256-99-0x0000000005890000-0x0000000005966000-memory.dmp

Download

memory/2256-111-0x0000000005890000-0x0000000005966000-memory.dmp

Download

memory/2256-200-0x0000000005890000-0x0000000005966000-memory.dmp

Download

memory/2256-201-0x0000000005890000-0x0000000005966000-memory.dmp

Download

memory/2256-198-0x0000000005890000-0x0000000005966000-memory.dmp

Download

memory/2256-195-0x0000000005890000-0x0000000005966000-memory.dmp

Download

memory/2256-191-0x0000000005890000-0x0000000005966000-memory.dmp

Download

memory/2256-189-0x0000000005890000-0x0000000005966000-memory.dmp

Download

memory/2256-187-0x0000000005890000-0x0000000005966000-memory.dmp

Download

memory/2256-185-0x0000000005890000-0x0000000005966000-memory.dmp

Download

memory/2256-193-0x0000000005890000-0x0000000005966000-memory.dmp

Download

memory/2256-183-0x0000000005890000-0x0000000005966000-memory.dmp

Download

memory/2256-181-0x0000000005890000-0x0000000005966000-memory.dmp

Download

memory/2256-96-0x0000000005890000-0x0000000005966000-memory.dmp

Download

memory/2256-177-0x0000000005890000-0x0000000005966000-memory.dmp

Download

memory/2256-175-0x0000000005890000-0x0000000005966000-memory.dmp

Download

memory/2256-173-0x0000000005890000-0x0000000005966000-memory.dmp

Download

memory/2256-171-0x0000000005890000-0x0000000005966000-memory.dmp

Download

memory/2256-167-0x0000000005890000-0x0000000005966000-memory.dmp

Download

memory/2256-165-0x0000000005890000-0x0000000005966000-memory.dmp

Download

memory/2256-163-0x0000000005890000-0x0000000005966000-memory.dmp

Download

memory/2256-161-0x0000000005890000-0x0000000005966000-memory.dmp

Download

memory/2256-159-0x0000000005890000-0x0000000005966000-memory.dmp

Download

memory/2256-157-0x0000000005890000-0x0000000005966000-memory.dmp

Download

memory/2256-84-0x0000000000AB0000-0x0000000000B82000-memory.dmp

Download

memory/2256-153-0x0000000005890000-0x0000000005966000-memory.dmp

Download

memory/2256-151-0x0000000005890000-0x0000000005966000-memory.dmp

Download

memory/2256-147-0x0000000005890000-0x0000000005966000-memory.dmp

Download

memory/2256-145-0x0000000005890000-0x0000000005966000-memory.dmp

Download

memory/2256-143-0x0000000005890000-0x0000000005966000-memory.dmp

Download

memory/2256-141-0x0000000005890000-0x0000000005966000-memory.dmp

Download

memory/2256-137-0x0000000005890000-0x0000000005966000-memory.dmp

Download

memory/2256-135-0x0000000005890000-0x0000000005966000-memory.dmp

Download

memory/2256-133-0x0000000005890000-0x0000000005966000-memory.dmp

Download

memory/2256-131-0x0000000005890000-0x0000000005966000-memory.dmp

Download

memory/2256-129-0x0000000005890000-0x0000000005966000-memory.dmp

Download

memory/2256-127-0x0000000005890000-0x0000000005966000-memory.dmp

Download

memory/2256-125-0x0000000005890000-0x0000000005966000-memory.dmp

Download

memory/2256-123-0x0000000005890000-0x0000000005966000-memory.dmp

Download

memory/2256-119-0x0000000005890000-0x0000000005966000-memory.dmp

Download

memory/2256-117-0x0000000005890000-0x0000000005966000-memory.dmp

Download

memory/2256-115-0x0000000005890000-0x0000000005966000-memory.dmp

Download

memory/2256-113-0x0000000005890000-0x0000000005966000-memory.dmp

Download

memory/2256-109-0x0000000005890000-0x0000000005966000-memory.dmp

Download

memory/2256-108-0x0000000005890000-0x0000000005966000-memory.dmp

Download

memory/2256-105-0x0000000005890000-0x0000000005966000-memory.dmp

Download

memory/2256-106-0x0000000005890000-0x0000000005966000-memory.dmp

Download

memory/2256-103-0x0000000005890000-0x0000000005966000-memory.dmp

Download

memory/2256-101-0x0000000005890000-0x0000000005966000-memory.dmp

Download

memory/2256-169-0x0000000005890000-0x0000000005966000-memory.dmp

Download

memory/2256-149-0x0000000005890000-0x0000000005966000-memory.dmp

Download

memory/2256-139-0x0000000005890000-0x0000000005966000-memory.dmp

Download

memory/2256-97-0x0000000005890000-0x0000000005966000-memory.dmp

Download

memory/2256-121-0x0000000005890000-0x0000000005966000-memory.dmp

Download

memory/6108-75-0x0000000074C40000-0x0000000074C8F000-memory.dmp

Download

memory/6108-92-0x0000000000770000-0x0000000000882000-memory.dmp

Download

memory/6108-76-0x00007FF8BCEE0000-0x00007FF8BD0E9000-memory.dmp

Download

memory/6108-78-0x0000000074C40000-0x0000000074C8F000-memory.dmp

Download

memory/6108-82-0x0000000074C40000-0x0000000074C8F000-memory.dmp

Download