hijackloader | 68ff3ce1de760e7c481902c645f21eb683c386df14cc29b4365931eed481e26b

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/06/2026, 04:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
68ff3ce1de760e7c481902c645f21eb683c386df14cc29b4365931eed481e26b.exe
Size 9.6MB
Sample260630-eqwwfaet2w
SHA256 68ff3ce1de760e7c481902c645f21eb683c386df14cc29b4365931eed481e26b
MD5 583d7d6c8da981fcf94486b9fb358be7
SHA1 987a7e784fdaebea107092917c4664eb3983030e
SHA512 0361dbd44c4f10970a4ca62f5be306ff2c6f5d9a2a7ca07b61f46fa049028d4b4894bbae0904cf8023c95b88649d7e49e745b1bae6f7a75fa7f37423c660229d
SSDEEP 196608:+pnMSTe5ZT+X1XzWeSX/jyw8uWaZHDJ+QGA5Z9Co5+cXtX50VN96J:+pnMS6KXhzW1XD8uNqMQoIItXYW
TLSH
T130A633803F41DDF8C82A4932AF5EEB468432EB9A2A405F57D2769F790FE3654470B1D8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

remot&exe discovery hijackloader remcos loader rat

Malware Config

Extracted

Family

hijackloader

Attributes

directory
%LOCALAPPDATA%\apptooljlcv1
inject_dll
%windir%\SysWOW64\pla.dll

xor.hex

Extracted

Family

remcos

Botnet

Remot&EXE

procesosnew07.mysynology.net:2404

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-DKIPW2
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Extracted

Family

remcos

Version

7.0.0 Pro

Botnet

Remot&EXE

procesosnew07.mysynology.net:2404

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-DKIPW2
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Family: HijackLoader, IDAT loader, Ghostulse,
HijackLoader is a multi-stage loader, first seen in 2023.
loader hijackloader
Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Detects HijackLoader (aka IDAT Loader) 1 IoCs

resource	yara_rule
behavioral2/files/0x000500000001b6e5-74.dat	family_hijackloader

Executes dropped EXE 3 IoCs

pid	Process
2648	Cluster_Runn.exe
6052	Cluster_Runn.exe
5944	Cluster_Runn.exe

Loads dropped DLL 48 IoCs

pid	Process
2648	Cluster_Runn.exe
2648	Cluster_Runn.exe
2648	Cluster_Runn.exe
2648	Cluster_Runn.exe
2648	Cluster_Runn.exe
2648	Cluster_Runn.exe
2648	Cluster_Runn.exe
2648	Cluster_Runn.exe
2648	Cluster_Runn.exe
2648	Cluster_Runn.exe
2648	Cluster_Runn.exe
2648	Cluster_Runn.exe
2648	Cluster_Runn.exe
2648	Cluster_Runn.exe
2648	Cluster_Runn.exe
2648	Cluster_Runn.exe
6052	Cluster_Runn.exe
6052	Cluster_Runn.exe
6052	Cluster_Runn.exe
6052	Cluster_Runn.exe
6052	Cluster_Runn.exe
6052	Cluster_Runn.exe
6052	Cluster_Runn.exe
6052	Cluster_Runn.exe
6052	Cluster_Runn.exe
6052	Cluster_Runn.exe
6052	Cluster_Runn.exe
6052	Cluster_Runn.exe
6052	Cluster_Runn.exe
6052	Cluster_Runn.exe
6052	Cluster_Runn.exe
6052	Cluster_Runn.exe
3828	OmFabric.exe
5832	XPFix.exe
5944	Cluster_Runn.exe
5944	Cluster_Runn.exe
5944	Cluster_Runn.exe
5944	Cluster_Runn.exe
5944	Cluster_Runn.exe
5944	Cluster_Runn.exe
5944	Cluster_Runn.exe
5944	Cluster_Runn.exe
5944	Cluster_Runn.exe
5944	Cluster_Runn.exe
5944	Cluster_Runn.exe
5944	Cluster_Runn.exe
5944	Cluster_Runn.exe
5944	Cluster_Runn.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 6052 set thread context of 3828	6052	Cluster_Runn.exe	89
PID 6052 set thread context of 5832	6052	Cluster_Runn.exe	90

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\SHcloud_x64.job	XPFix.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	68ff3ce1de760e7c481902c645f21eb683c386df14cc29b4365931eed481e26b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OmFabric.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XPFix.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2648	Cluster_Runn.exe
6052	Cluster_Runn.exe
6052	Cluster_Runn.exe
6052	Cluster_Runn.exe
6052	Cluster_Runn.exe
5832	XPFix.exe
5832	XPFix.exe
5944	Cluster_Runn.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
6052	Cluster_Runn.exe
6052	Cluster_Runn.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3828	OmFabric.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4180 wrote to memory of 2648	4180	68ff3ce1de760e7c481902c645f21eb683c386df14cc29b4365931eed481e26b.exe	87
PID 2648 wrote to memory of 6052	2648	Cluster_Runn.exe	88
PID 6052 wrote to memory of 3828	6052	Cluster_Runn.exe	89
PID 6052 wrote to memory of 3828	6052	Cluster_Runn.exe	89
PID 6052 wrote to memory of 3828	6052	Cluster_Runn.exe	89
PID 6052 wrote to memory of 5832	6052	Cluster_Runn.exe	90
PID 6052 wrote to memory of 5832	6052	Cluster_Runn.exe	90

C:\Users\Admin\AppData\Local\Temp\68ff3ce1de760e7c481902c645f21eb683c386df14cc29b4365931eed481e26b.exe
"C:\Users\Admin\AppData\Local\Temp\68ff3ce1de760e7c481902c645f21eb683c386df14cc29b4365931eed481e26b.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4180
- C:\Users\Admin\AppData\Local\Temp\Cluster_Runn.exe
  "C:\Users\Admin\AppData\Local\Temp\Cluster_Runn.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2648
- - C:\ProgramData\apptooljlcv1\Cluster_Runn.exe
    C:\ProgramData\apptooljlcv1\Cluster_Runn.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:6052
  - - C:\ProgramData\OmFabric.exe
      C:\ProgramData\OmFabric.exe
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3828
  - - C:\Users\Admin\AppData\Local\apptooljlcv1\XPFix.exe
      "C:\Users\Admin\AppData\Local\apptooljlcv1\XPFix.exe" "C:\Users\Admin\AppData\Local\apptooljlcv1\XPFix.exe" /u
      4⤵
      Loads dropped DLL
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:5832

C:\ProgramData\apptooljlcv1\Cluster_Runn.exe
C:\ProgramData\apptooljlcv1\Cluster_Runn.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:5944

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

OmFabric.exe

Path C:\ProgramData\OmFabric.exe
Size 1.6MB
SHA256 c8a1ec1b919f9e760a1a434e4c8e3db33f8c541739c94860132902a509dd0f6a
MD5 45003027576f06537d64cc11fe118049
SHA1 5829e85f27cc493136ea13845462ab19414044ea
SHA512 05a41310c4b2635106bddfa7d5e80c521efa83a92ee2f329aa364d405ba300cc459d6b3305043cedbf2dcace30402a25a1581c9a8c5560691a6c29f765665e6c
SSDEEP 24576:oUolrU/JboM0lOglm2nNPYs/9Wuy5gCkIurDsD7eXGzLervxqA9b:Kl4/BvOFm2nhL/9lyGDsD7SGzLezUG
TLSH
T16C756D01F742D13EE9A315BACAFE566D9768AA60130860C3E3C81D6E5F71AE37D34217
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FileEdit.dll

Path C:\ProgramData\apptooljlcv1\FileEdit.dll
Size 128KB
SHA256 3e3fc240c4bf12ff58ff9d6279a5c5c6af320a1bd4132de55862d5cbcaef5133
MD5 40cc0a929f2b681c22a8806a2fcc986d
SHA1 d0ad76b4a005fb6005d7768e10b5a6be2e48ee0a
SHA512 b05ce40320a3f12853e6fc0925d287f4743a34b81bb1612a70a86e849f539a43c5d92c1c49f646a33c5729e70677b1f313469af2b43a696230cc606e4569e72a
SSDEEP 3072:Mb6nV+x+Zzs9Z/Zk0KTuV0zoucc8+uTCOlkJIae:Ms+xp/ZLKW08ucKuTCOlkua
TLSH
T1D3D34A96B63690E9E1A7C138C243EB1AFBB2B1514B1217CB53110BAE1F33BD58C3A751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Xml.dll

Path C:\ProgramData\apptooljlcv1\Qt5Xml.dll
Size 190KB
SHA256 d2671c21741db0de0904f8e6be3fd543d002efb8651ed7e4db3925b9c4531732
MD5 a824b1e182b0d61b9aa2dfab7bcb0172
SHA1 0708935cb060ff7314b5ab4becbffe01f165a67a
SHA512 fff461e9d7b6bc55424b7739d23c5825d2d6a635be6063d47736ef16de95f58bf47aa357dffd54bcdb8a3eb0463e68413b6a7b4038c65a74d516fc9dc5d3b90a
SSDEEP 3072:EmZvFhrJ43X1uSvigBrrbQ18bFzkgG7Z3uHD:Em7hGX1uSKgy18bm7Z3u
TLSH
T110144B9B372A4596D03BC138CD59881BE6B3785017628BDF82949B762F37ED1B83E350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\ProgramData\apptooljlcv1\VCRUNTIME140.dll
Size 121KB
SHA256 60b813f8b87ff4fa344f081c163c1a2234b5e3e41f748721c28fbdecbcfecb8a
MD5 ec0117040bd1e880088753d9b8467234
SHA1 ccadc48b2df78c1622073200aaf1d4f1624c8f84
SHA512 fb169c2395438d5ae491ea8b0fde1e6ff94616c19dd427566feb6cece678a0a990514dbc208ed6fc0010068b342eaab89756baf266daaa4abf776db84fe0b0c5
SSDEEP 1536:rbmQhxfqEu7IrHwOsEDzvvGfWJhEMjaecbWIG9lM5zM6dgzHv:r+EFrHw43GfWJhE8aecbWIG8UL
TLSH
T188C36B42B2B802FBD12BC174C2A2DA23FBB5B4454B605BDF07AA9A640F53BD06D3D745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\ProgramData\apptooljlcv1\vcruntime140_1.dll
Size 48KB
SHA256 e30b3f4979b63b50438d061858c9cde962f4494e585c627a11c98b6c5b7b2592
MD5 851760a3cc87354e057985e42e69f425
SHA1 9ad109ef885e5a07c59c010ca006cfcd06a00f30
SHA512 598450a96c5db0958cbaf84a35104ad52dcce1786dca5943294bc5cb50f68202ea9717e8fb96e46a826efede25515db9374ea86f2e89db74419178ae27f36de3
SSDEEP 768:/J1E6sCUocm8zuAMFAz3SPZMsJGJ+x9z1Vjk6bK9z6:/UjU+KesgJuzU6az6
TLSH
T1DB236BD197A84042D4AB9970C1E7EE27BD3CF7A61B50968B07E5E24C0E537D0EB3931A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logs.dat

Path C:\ProgramData\remcos\logs.dat
Size 102B
SHA256 2e1213be18644a477e63367a813d57465973e12b98be89b0c1fa7da45049ab89
MD5 b71743680222e2ffd3849a5ad74c1d1d
SHA1 6756c565a247474fdb749a45d289a34422332fe5
SHA512 50c4af18603966892ad2131a5cb6699fe3df93dfe62ed0a6193543535f077e6dc3ed3ab627c88465712642eb48374aaee1192defcfc769f6073535c021bedd06
TLSH
T11AB0125427D1145674A5A26A94F30017787079511038C80C6191034C34B1B0150C0747
MD5 SHA1 SHA512 TLSH

Submit Download

8263167.tmp

Path C:\Users\Admin\AppData\Local\Temp\8263167.tmp
Size 2.8MB
SHA256 df2bd0d583e5de6512cb26c59d6bd239feb0fe0f4e60e3f6394353334094a1be
MD5 cb6847d2c99300b2ba77480ebbab34b5
SHA1 f0a60a0232349d66bc9c89cb0206a63f57b0e102
SHA512 3e3c8a41ad1271777de2458d42ce2dd3e69dc55b365c0efbcdc1a710498a0af65d8c3f4780c3521d1a685d4c436ea2660ab7eaa4679fcd9e5213c25384e61554
SSDEEP 49152:XSkiKKzSiSu9NYUV7JKm7xStOtleTE9RJqo1FB4uLF7hokje6I4sYgrZWsRG:XkbzHlNYUNxcWwTE9V1PLFXjQYgr2
TLSH
T1B4D5333E63BF6627027816351E48EBB38620DEDAD2191524829F4CFC5FDE2CD49B2578
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8263167.tmp

Path C:\Users\Admin\AppData\Local\Temp\8263167.tmp
Size 2.8MB
SHA256 0a3be0543f4a696a113803882746ca917baa9ff8e26b1fa6c7cef6ec06ee4b75
MD5 41b3b8806bb85a8c646b595438f6fc0c
SHA1 81f2a17c76ed72e9fca811aaacbdb3a6de5a2bcd
SHA512 250f76132730c3959a9629814fccbdcf37ca15ab9238c22a55e7bbcf6fa5bf7adedf98b2adf435dca98db825826e29990350a1cb48e476f74105f99aaeba0493
SSDEEP 49152:VSkiKKzgiSu9NYUV7JKm7xStOtleTE9RJqo1FB4uLF7hokje6I4sYgrZWsRG:VkbzRlNYUNxcWwTE9V1PLFXjQYgr2
TLSH
T14CD5333E63BF6627027816355E48EBB38620DEDAD2191524829F4CFC5FDE2CD49B2178
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AudioRender.dll

Path C:\Users\Admin\AppData\Local\Temp\AudioRender.dll
Size 155KB
SHA256 1a99980f25df00b1f49ae33cf715a22f533a33faa90bed9760a3592ddaecb809
MD5 f374a91711bffc0fb69d184e2dad5bc2
SHA1 b965b915580f733ec163ded4f0380d68a1151fad
SHA512 f5735a0cca7118c1ea300524922fef50ad2fb49e872901e9a187f015b19cdf91383c9274fa0f5f42f1c6f64a2d16dcdc7996ca6f4fbeffac9cd716eabe338b96
SSDEEP 3072:u3Cw2apIyF60M9/8u1eK6L3/IiYaGwuhzh6SNsfvsruP:+Iap/ZMB8u1ePL3/SaGxnJO1
TLSH
T18AF34A56B3B580FAD4AAC139C993365AF7B2782A476443CB1614873A6F337F0693E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cluster_Runn.exe

Path C:\Users\Admin\AppData\Local\Temp\Cluster_Runn.exe
Size 629KB
SHA256 1cfcaece2f55694494ac549de8c5e9058a0a4bd2f3daf57de4ac18ab125897a2
MD5 f3332be5e348f547e016227ffd98a4ba
SHA1 955cdfe9370b168ec1f9c3eddcb34a68b49dbb7c
SHA512 983be219cd41377b867c46fbb945bf5aeac42a8b78ea4460c2036237b87096eea6e7d93015d6d507213e95b41f92a0258e8c728bd05cd065c5151fb861694161
SSDEEP 12288:x0iotCrWo69odflhn8xLQI6rxNJRqGIsNBxKU:DotCrWo69odflhn8xLQIGxNJZI8BxKU
TLSH
T111D4E95BEF2953D8D066C43C86525D3EA8307C9A8B1016CB9559FF791F263D0AEBE302
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DEF6E14.tmp

Path C:\Users\Admin\AppData\Local\Temp\DEF6E14.tmp
Size 40B
SHA256 ad329d9f68b000745a8f2224854972d4227b1551875e4d8f676e51969dbbe6c8
MD5 88509d0e236d1a147da9bce6973a0a3c
SHA1 2c95f8db416718defe0735a840c5c054a0f28f00
SHA512 3f6d51768b58120b9949cb10119cd60fb2ca8ed1d788c17f576737dc765a3cfab9cddcc7ab354a661d13bbbfcda6ec4aec85105e7d2ccb47d5a1690e121680d9
MD5 SHA1 SHA512

Submit Download

FileAnalyzer.dll

Path C:\Users\Admin\AppData\Local\Temp\FileAnalyzer.dll
Size 254KB
SHA256 03607630a992c96d1d17bcf3c327619c27ee24d054a0946831f1e3708f5613c6
MD5 08b1ce3ef9cdd0829f1599e0d793a8f0
SHA1 9998ffc6d6ad23b83005b16a63df19dadd3b14f4
SHA512 a746c54f2a075ecf7d61af32f6981ba8a58db7350a4690c6f222dc13b3cded6f0d527b0d7bad0b37f396178eaa137e85c1962ee8dab8d631762034d8c769f8f1
SSDEEP 3072:4u87LIsND5X/iqyq8zuf3rdNIAUCZw6NdSdt9Ndzpbgn1krBdeHP0ZiLPOl8:4dLIsNDNiqyqmuPrMAUCZep10LPOl
TLSH
T1AA444A55B3769CA8F193C17D8243DB1AD5B279100707DBCB679047AEAE23BD7083AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Grood.wh

Path C:\Users\Admin\AppData\Local\Temp\Grood.wh
Size 35KB
SHA256 44388298b826b44234ec1dedda9b55c547055ca2663700f6140d595ef871c151
MD5 ff9f94d7e1de3096795771f44c477c00
SHA1 4a22ef20dc48593e6acfcd069d7790b678826f17
SHA512 b76a37924f9f202bd5375d0cda9b412d66e3d577b9c79b7eddf76ffc9062c06cbe9884f23495313ab44c6553871233c1d808a5a219a43bf209103ff8293605cd
SSDEEP 768:gI4jJFcu4uIsarw7H0nbUQL3xDzi2EwduAIjk5Cp:gIM03uxH07LhDzh4/jSq
TLSH
T198F2F97553DE1A0AF4327D3E9D90B466DE45B975273DC094A6830B4B80BECD8CE60B63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSVCP140.dll

Path C:\Users\Admin\AppData\Local\Temp\MSVCP140.dll
Size 544KB
SHA256 1e2e2bcb916931f0ee6d0a567212511244e7442da574757c331c1b91087f2a0f
MD5 b08063e2d0bb587538575af2babac0b2
SHA1 82a72fad0b6935880fa9909db183b54d09285b39
SHA512 f1345e0ed02c5f4208766458b68792995b37a103e8951286d9b97dcb02d52d1905f63a395a03459643518e5b51817744548bfbce8d5835fdc1c4e828e29acde7
SSDEEP 12288:ihSlSEiVO3dam7VDIsZEXES1gfQEKZm+jWodEEV4Ks:ihWiVO3dNIsZTS4QEKZm+jWodEEOf
TLSH
T152C41A27F74906F0E195E3B8A1838702D7F1BC4A8322A3C792EB955D2F573D0A67B650
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSVCR90.dll

Path C:\Users\Admin\AppData\Local\Temp\MSVCR90.dll
Size 629KB
SHA256 e88299ea1a140ff758163dfff179fff3bc5e90e7cfbbd178d0c886dbad184012
MD5 552cf56353af11ce8e0d10ee12fdcd85
SHA1 6ab062b709f851a9576685fe0410ff9f1a4af670
SHA512 122f389e7047b728b27f3c964d34b9c8bcae7c36177122e6aa997a6edadad20b14552879f60667a084d34727cb2c85dd5534b6fa7a451f0ab33555b315335457
SSDEEP 12288:BD6NCL00fQwUX9iOv2ME0cbejlzKaswsmqy7oh41oZ:l2CLFffUNiK20yejFsZmqy7ohOW
TLSH
T1F6D48C65F3AA06B6D427C13DCED251A6F6727819432457EB02918F685B27BF09B3B303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PlayCtrl.dll

Path C:\Users\Admin\AppData\Local\Temp\PlayCtrl.dll
Size 6.0MB
SHA256 1ca7ff2effe871fb43caaad033d7251944d1633b959aee790e96a599a7cda526
MD5 bfad63aee7d50a77f345bf679a1b4231
SHA1 3e6c8a55cd40be719e60109ebbbeb70eafa48c5c
SHA512 1a91cc5d6538b6e7f308e4227e7890996e31d37b39378629a0d069db371fdd0ad38dcd59b757c4de488dc6d4064b00ffc808b2c1ced5af00f5d84e7be8dd7807
SSDEEP 98304:R6G5coJEWmWgFQ4AowYgIQ4AowW+s8rNJb4uKZxYpxJ:kFQ4AowYgIQ4Aow
TLSH
T121566C56F7B691E8D1B7C0348267732BF9713C5D832047D797819A26AB32BE09A3E740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Core.dll

Path C:\Users\Admin\AppData\Local\Temp\Qt5Core.dll
Size 5.5MB
SHA256 42c38f21cdfa40094e550a33ad8731b1fe3bc3678adfe9a803cc831dd98adbe3
MD5 48a8b00efcf2521d379b45dbb6c27835
SHA1 bcf24fa4d929a0de8fc0ed31b744f79ff84903de
SHA512 30bbebc351ff961d2e1949a5f31ba5104c2602abfcdaba9e743c7e405e99efea5ec2b508b4294de12f487a0a8e0a1f6b1bf0155a76c43ca75d0578766863e65a
SSDEEP 98304:4H0KUs/WbrVnJsv6tWKFdu9Cpzct74Z7Hf3W:4HXUhbrxJsv6tWKFdu9Cpzy7w7Hf3
TLSH
T11E468D677BA54161D177C23989E7820AF5B3B8020F32ABCF5269631D1E33AF05A3E355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Gui.dll

Path C:\Users\Admin\AppData\Local\Temp\Qt5Gui.dll
Size 5.8MB
SHA256 a060cf77b854adc637f0f8eef5302ac4d430ba12a0b51420509b6338340f951a
MD5 dbc7a83d9599db20b5c9b08924b7e026
SHA1 7c7b9859211dc879192630960ccca6bf8d7f76e8
SHA512 cd7c01af014e733e2a1a472f6cd70e457947d4498c8418a83cb7b17750bad77d4291b4e27dc9d81402746654d8497fc7f0f5de075ce77fec29e5c33acc2b345d
SSDEEP 49152:19X7c1rSKiXOtARLf0ul/mtvb8dGmpFItfjClsoNR5QpCYUHZg96OlQlEP2aCbI7:1ASKiXOtAJkbJRoN0sY5l7k5xb4n
TLSH
T1D05619C6625A6252C977E27E874F052EE1F37852C3428BC748159B480F637EA1B7FE06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Widgets.dll

Path C:\Users\Admin\AppData\Local\Temp\Qt5Widgets.dll
Size 5.3MB
SHA256 3fda703b35869fadc53e444ee4e69928e7eba84593e54bfbc275214ea3a60046
MD5 79df964ff9b0fb0cb216e620536575c9
SHA1 349e4de1e179be3b94a35dc690480077a6b8b59e
SHA512 229a91bd343308d9e2adc3c03fb6ee8a55e1bfc2a38e7593765d19f8a858f7ecab52155739a91668aeaa300dd02eca2445b80e8e1d3fb33aeba70136fb79e818
SSDEEP 49152:KeNyjyp6zck9XuNqscUpOG1OJSITePktk0MaAm2HbToE5omICR9h8BdPqY5Fc:FNZUOlh12zk0MaAm2Hb7P
TLSH
T135466C87B36501C1C26BC238CE8A8617D67270454B638BDF16EACF592F736E21A7E750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tob.gaby

Path C:\Users\Admin\AppData\Local\Temp\Tob.gaby
Size 2.1MB
SHA256 ee376286fffcac9fc46b01ffc74b3e75dfe44cec56e7e3f1c826485ec86a8072
MD5 1fa157b6a7aff5fff1e81053d50a5951
SHA1 24dbb5ae7f2756a3c93eb294893c2ddb1d708ebd
SHA512 944125ba88e95537a587b1070836134b76d63fceb13150780569faec945ce90254f9d8e75d3c1dea5ee474b442f3f45e3c0c9cae12a91d2c4c5f038f6617937e
SSDEEP 24576:D5Vgf/OBSlZDDsq0Wxz7DcWjPng7FPESDSeKeRcrHXePpdSb0XRMkZjjj38C9crx:D3emWd/dr/SDlAr0BhZwCOrTKGe7nRYd
TLSH
T12BA533E199EC9040E4FD88BA0834CCC519D4BD8F92737399141997C1A61CB6DAE7BBEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UIComponents.dll

Path C:\Users\Admin\AppData\Local\Temp\UIComponents.dll
Size 647KB
SHA256 450c2015d5c2eac8d9459bca6305b8f3ef56c2f26a51662e0dea1bb7a049a3fc
MD5 4809b3d5ba4e86e7a829dcc0c92a3ddc
SHA1 b9cd7b7c638f5fe05c901dec1380857712125434
SHA512 f08b961829a67a8172d8d430198fdfef28f3bf6ccb260ddaa8ea516a001796f669fc50aae2c853722f3c5fbc1fdc4c3bd66219896a0955e806238859fe1c9e9d
SSDEEP 12288:9W+rF0FUy2SKUl0ZsCBQO5sT7eEM3GH9OJk:E+rF0FUzo2EM3e9OJk
TLSH
T11FE4FA4BFBB682D2C079C13E9443562AFAB2B4A187218BC39546971F1F237D4AE3D744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPFix.exe

Path C:\Users\Admin\AppData\Local\apptooljlcv1\XPFix.exe
Size 286KB
SHA256 5ec174af8a18a5516b8a6e11d8a27481d70df14d1edb67c48b5458ff44df9146
MD5 810d42177538ad5ca18d4dd597c00658
SHA1 7374bbe63c44de9536c22cdc111894c6d4929eb3
SHA512 233cdbaa1658719e9e44869930aef8ed09a17bd1e227c43785ce1b4298fd9f767818b75888db9cb5184a134a0babedd32cc0788059c251a1dff3f6aa27ebd30d
SSDEEP 6144:WEDFuBN6zANskE9qgfyMEvt93L2kx3W71+KL:WiuB4fyzvtFt3WFL
TLSH
T164547E00B651C136F5F318768AFE9B79993DBD312B1551C363C40EAEBE22BE1793121A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2648-69-0x0000024AA6820000-0x0000024AA6F15000-memory.dmp

Download

memory/2648-75-0x00007FFBBA540000-0x00007FFBBA6CE000-memory.dmp

Download

memory/2648-66-0x0000024AA67C0000-0x0000024AA680B000-memory.dmp

Download

memory/2648-62-0x0000000057730000-0x0000000057C7E000-memory.dmp

Download

memory/3828-107-0x0000000000B00000-0x0000000000B8C000-memory.dmp

Download

memory/3828-150-0x0000000000B00000-0x0000000000B8C000-memory.dmp

Download

memory/3828-109-0x0000000000B00000-0x0000000000B8C000-memory.dmp

Download

memory/3828-174-0x0000000000B00000-0x0000000000B8C000-memory.dmp

Download

memory/3828-171-0x0000000000B00000-0x0000000000B8C000-memory.dmp

Download

memory/3828-114-0x00007FFBD1D40000-0x00007FFBD1FA3000-memory.dmp

Download

memory/3828-115-0x0000000000B00000-0x0000000000B8C000-memory.dmp

Download

memory/3828-116-0x0000000000B00000-0x0000000000B8C000-memory.dmp

Download

memory/3828-119-0x0000000000B00000-0x0000000000B8C000-memory.dmp

Download

memory/3828-168-0x0000000000B00000-0x0000000000B8C000-memory.dmp

Download

memory/3828-165-0x0000000000B00000-0x0000000000B8C000-memory.dmp

Download

memory/3828-128-0x0000000000B00000-0x0000000000B8C000-memory.dmp

Download

memory/3828-162-0x0000000000B00000-0x0000000000B8C000-memory.dmp

Download

memory/3828-159-0x0000000000B00000-0x0000000000B8C000-memory.dmp

Download

memory/3828-156-0x0000000000B00000-0x0000000000B8C000-memory.dmp

Download

memory/3828-153-0x0000000000B00000-0x0000000000B8C000-memory.dmp

Download

memory/5832-130-0x0000000074660000-0x00000000747E8000-memory.dmp

Download

memory/5832-129-0x00007FFBD1D40000-0x00007FFBD1FA3000-memory.dmp

Download

memory/5944-144-0x000001D8FE070000-0x000001D8FE765000-memory.dmp

Download

memory/5944-143-0x0000000057730000-0x0000000057C7E000-memory.dmp

Download

memory/5944-148-0x00007FFBBA600000-0x00007FFBBA78E000-memory.dmp

Download

memory/5944-146-0x000001D8FE780000-0x000001D8FE7CB000-memory.dmp

Download

memory/6052-105-0x00007FFBBA540000-0x00007FFBBA6CE000-memory.dmp

Download

memory/6052-96-0x000001B62FE50000-0x000001B630545000-memory.dmp

Download

memory/6052-99-0x00007FFBBA540000-0x00007FFBBA6CE000-memory.dmp

Download

memory/6052-101-0x00007FFBBA540000-0x00007FFBBA6CE000-memory.dmp

Download

memory/6052-93-0x000001B62FDF0000-0x000001B62FE3B000-memory.dmp

Download

memory/6052-89-0x0000000057730000-0x0000000057C7E000-memory.dmp

Download