hijackloader | e8e9e5a2b793f043ed422e9b3d5906d887919c37218e24cc28eec3e086f5db4e

Analysis

max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/07/2026, 11:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
EWPZBSBT.msi
Size 5.0MB
Sample260726-nb99ysfl4t
SHA256 e8e9e5a2b793f043ed422e9b3d5906d887919c37218e24cc28eec3e086f5db4e
MD5 ad0828b0a53cc41bf2edde1d0689356f
SHA1 9642cc0027221b1c7ba1b9b3a39f66fabec670d3
SHA512 d5077adae28cdf03600a3b619848e5137355de8d0fc5fed31a7923653145a2a70724a5d931299599c20781a30d597ffae461c04df08c0ea7ad6b48451f5f0a9e
SSDEEP 98304:eEU99eE9Pov1x+FTW0EJZI5KkqgepBSe9atp/tDBy7cJapnIhfY8oiLnDZT:eEU9oE1ov1gW0v5Xk2D/toyapnioqn
TLSH
T1503633F5F4F297DBF53BD2714202A9F1DD0AAE559AB240F3482E793191B3BD12B94220
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery hijackloader lumma loader persistence privilege_escalation ransomware stealer

Malware Config

Extracted

Family

hijackloader

Attributes

directory
%APPDATA%\JDManager
inject_dll
%windir%\SysWOW64\input.dll

xor.hex

Extracted

Family

lumma

https://mastojh.cyou
https://decrnoj.club/xxx
https://pomflgf.vu/help
https://carytui.vu/caccc
https://mushxhb.best/info
https://genugsq.best/main
https://ulmudhw.shop/create
https://strikql.shop/owner
https://longmbx.click/manifest

Attributes

build_id
696d37230a78138cfcce54ff29deb67cca38cb4fa201

Signatures

Family: HijackLoader, IDAT loader, Ghostulse,
HijackLoader is a multi-stage loader, first seen in 2023.
loader hijackloader
Family: Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma

Detects HijackLoader (aka IDAT Loader) 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c568-41.dat	family_hijackloader

Executes dropped EXE 2 IoCs

pid	Process
5644	AdvancedSwitch.exe
2576	AdvancedSwitch.exe

Loads dropped DLL 14 IoCs

pid	Process
5644	AdvancedSwitch.exe
5644	AdvancedSwitch.exe
5644	AdvancedSwitch.exe
5644	AdvancedSwitch.exe
5644	AdvancedSwitch.exe
5644	AdvancedSwitch.exe
2576	AdvancedSwitch.exe
2576	AdvancedSwitch.exe
2576	AdvancedSwitch.exe
2576	AdvancedSwitch.exe
2576	AdvancedSwitch.exe
2576	AdvancedSwitch.exe
5064	MicroMa64.exe
5716	Crisp.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2576 set thread context of 5064	2576	AdvancedSwitch.exe	99
PID 2576 set thread context of 5716	2576	AdvancedSwitch.exe	100

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e59f90c.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF4D57A5253C197328.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF2C89B853B613D14C.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFEC9.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF691B6AD05AC8C413.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e59f90c.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{B80E4C08-E9C5-41EF-A63C-8B20448D915A}	msiexec.exe
File created	C:\Windows\Installer\e59f90e.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF6492A60F1C6D3487.TMP	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
4992	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicroMa64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Crisp.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ad3b1fc6af0fc0350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801ad3b1fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101ad3b1fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3ad3b1fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6ad3b1fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
5772	msiexec.exe
5772	msiexec.exe
5644	AdvancedSwitch.exe
2576	AdvancedSwitch.exe
2576	AdvancedSwitch.exe
2576	AdvancedSwitch.exe
2576	AdvancedSwitch.exe
2576	AdvancedSwitch.exe
2576	AdvancedSwitch.exe
5716	Crisp.exe
5716	Crisp.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2576	AdvancedSwitch.exe
2576	AdvancedSwitch.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4992	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4992	msiexec.exe
Token: SeSecurityPrivilege	5772	msiexec.exe
Token: SeCreateTokenPrivilege	4992	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4992	msiexec.exe
Token: SeLockMemoryPrivilege	4992	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4992	msiexec.exe
Token: SeMachineAccountPrivilege	4992	msiexec.exe
Token: SeTcbPrivilege	4992	msiexec.exe
Token: SeSecurityPrivilege	4992	msiexec.exe
Token: SeTakeOwnershipPrivilege	4992	msiexec.exe
Token: SeLoadDriverPrivilege	4992	msiexec.exe
Token: SeSystemProfilePrivilege	4992	msiexec.exe
Token: SeSystemtimePrivilege	4992	msiexec.exe
Token: SeProfSingleProcessPrivilege	4992	msiexec.exe
Token: SeIncBasePriorityPrivilege	4992	msiexec.exe
Token: SeCreatePagefilePrivilege	4992	msiexec.exe
Token: SeCreatePermanentPrivilege	4992	msiexec.exe
Token: SeBackupPrivilege	4992	msiexec.exe
Token: SeRestorePrivilege	4992	msiexec.exe
Token: SeShutdownPrivilege	4992	msiexec.exe
Token: SeDebugPrivilege	4992	msiexec.exe
Token: SeAuditPrivilege	4992	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4992	msiexec.exe
Token: SeChangeNotifyPrivilege	4992	msiexec.exe
Token: SeRemoteShutdownPrivilege	4992	msiexec.exe
Token: SeUndockPrivilege	4992	msiexec.exe
Token: SeSyncAgentPrivilege	4992	msiexec.exe
Token: SeEnableDelegationPrivilege	4992	msiexec.exe
Token: SeManageVolumePrivilege	4992	msiexec.exe
Token: SeImpersonatePrivilege	4992	msiexec.exe
Token: SeCreateGlobalPrivilege	4992	msiexec.exe
Token: SeBackupPrivilege	2928	vssvc.exe
Token: SeRestorePrivilege	2928	vssvc.exe
Token: SeAuditPrivilege	2928	vssvc.exe
Token: SeBackupPrivilege	5772	msiexec.exe
Token: SeRestorePrivilege	5772	msiexec.exe
Token: SeRestorePrivilege	5772	msiexec.exe
Token: SeTakeOwnershipPrivilege	5772	msiexec.exe
Token: SeRestorePrivilege	5772	msiexec.exe
Token: SeTakeOwnershipPrivilege	5772	msiexec.exe
Token: SeRestorePrivilege	5772	msiexec.exe
Token: SeTakeOwnershipPrivilege	5772	msiexec.exe
Token: SeRestorePrivilege	5772	msiexec.exe
Token: SeTakeOwnershipPrivilege	5772	msiexec.exe
Token: SeRestorePrivilege	5772	msiexec.exe
Token: SeTakeOwnershipPrivilege	5772	msiexec.exe
Token: SeRestorePrivilege	5772	msiexec.exe
Token: SeTakeOwnershipPrivilege	5772	msiexec.exe
Token: SeRestorePrivilege	5772	msiexec.exe
Token: SeTakeOwnershipPrivilege	5772	msiexec.exe
Token: SeRestorePrivilege	5772	msiexec.exe
Token: SeTakeOwnershipPrivilege	5772	msiexec.exe
Token: SeRestorePrivilege	5772	msiexec.exe
Token: SeTakeOwnershipPrivilege	5772	msiexec.exe
Token: SeRestorePrivilege	5772	msiexec.exe
Token: SeTakeOwnershipPrivilege	5772	msiexec.exe
Token: SeRestorePrivilege	5772	msiexec.exe
Token: SeTakeOwnershipPrivilege	5772	msiexec.exe
Token: SeRestorePrivilege	5772	msiexec.exe
Token: SeTakeOwnershipPrivilege	5772	msiexec.exe
Token: SeRestorePrivilege	5772	msiexec.exe
Token: SeTakeOwnershipPrivilege	5772	msiexec.exe
Token: SeRestorePrivilege	5772	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4992	msiexec.exe
4992	msiexec.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4992	msiexec.exe
5772	msiexec.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5772 wrote to memory of 2680	5772	msiexec.exe	94
PID 5772 wrote to memory of 5644	5772	msiexec.exe	96
PID 5644 wrote to memory of 2576	5644	AdvancedSwitch.exe	97
PID 2576 wrote to memory of 5064	2576	AdvancedSwitch.exe	99
PID 2576 wrote to memory of 5064	2576	AdvancedSwitch.exe	99
PID 2576 wrote to memory of 5064	2576	AdvancedSwitch.exe	99
PID 2576 wrote to memory of 5716	2576	AdvancedSwitch.exe	100
PID 2576 wrote to memory of 5716	2576	AdvancedSwitch.exe	100

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\EWPZBSBT.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4992

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5772
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:2680
- C:\Users\Admin\AppData\Local\Squiredom\AdvancedSwitch.exe
  "C:\Users\Admin\AppData\Local\Squiredom\AdvancedSwitch.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5644
- - C:\ProgramData\JDManager\AdvancedSwitch.exe
    C:\ProgramData\JDManager\AdvancedSwitch.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:2576
  - - C:\Users\Admin\MicroMa64.exe
      C:\Users\Admin\MicroMa64.exe
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:5064
  - - C:\Users\Admin\AppData\Roaming\JDManager\Crisp.exe
      C:\Users\Admin\AppData\Roaming\JDManager\Crisp.exe
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:5716

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2928

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59f90d.rbs

Path C:\Config.Msi\e59f90d.rbs
Size 9KB
SHA256 7e85e7079eece9b3b42deef19c345b336af43105690f5a226e6e30c8e3df8d48
MD5 ecc38ef5f3ad550d3920b991a94e19c0
SHA1 d27cb93d7c78ad042ab2ce7933c5edf49d49aea8
SHA512 08e6bfe9ef4986a6e38d82ea9887fcfdbc30ed7351f67b7f412fd8bd24713b58f48e7c8c325352915c14a6448e8b56f366851b8fcf27d6023fef10522ed29381
SSDEEP 192:1CejjUBWepe5e4e9eVe2eJeJXC0ZPZrCqedDerxLITegqedDerxLn7ZSkTe/BhbJ:1CsjFEQFkYPcqvRuqCO0LqCO7S+qfz4A
TLSH
T1D3123145B12D85E5E6912F3687232B947BB3E2FAC3513B17948B80346F43F889ED6492
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdvancedSwitch.exe

Path C:\Users\Admin\AppData\Local\Squiredom\AdvancedSwitch.exe
Size 1.8MB
SHA256 e8cc702e17ee91f84b4552abdf8cce85e486e2c48e99cce9648997d74613ad9f
MD5 d648abec249827ea963263b77ad0bceb
SHA1 c20ac065212537cacb548bb5bb2f9b9de1cb33bc
SHA512 eaa68988104fddd45c2a4993ccbb4565180fd040e51e3d347fd24b853c62c7a239b5e1d08f80dd03fa2bbd808a0b8f3c86b620566ba33029c8594b9d4f4efd03
SSDEEP 49152:ojFgFvSX+HYZFKQpaMEuglAMlBQ3hHqDvi/:Y4LU4/FlAMlBQ3hHqDvi
TLSH
T1D5858D66379891DAE17BC27DC8879B4AE6B170054B319BCF019443EE2F27AE44D3B721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BugSplat64.dll

Path C:\Users\Admin\AppData\Local\Squiredom\BugSplat64.dll
Size 545KB
SHA256 8fe9be5391cef47155ba98879ec86747b9e5e31c5d1f18079fd389c52901b4b9
MD5 e41209afb442b87d598f845eb549c387
SHA1 a93ef180220d3bb5bdb79d29135ce07741e97be9
SHA512 62f34df38e61486deae524c2985f365342905d185548716f0c18a09b40f66f5cfc4179b154dffadc2f6c50ae0eb4b0fc0991803e6e8893666be8c03eb0e083cc
SSDEEP 6144:3U5CmQqvsnVIq3RtzVnmtQbisNmQkF6Sx4Vr8C:35mQqvcRrz1FisNOhC
TLSH
T1EEC47C1677A407BAE17BD238CA538B46EAB278451721E74F03E853BA1F23361593F721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FreeImage.dll

Path C:\Users\Admin\AppData\Local\Squiredom\FreeImage.dll
Size 6.6MB
SHA256 60cf5967b65ca9048450fc35e4bccf38a20a7a58f1db3ba9be2c4316936c50b1
MD5 77a7847bab5806f4259045b7f9413ea7
SHA1 907812320f5f060c36583ca3b96ac52df28bd276
SHA512 21b60e233693b40fd7520b71cee709cebbe12d3c534b48b4ff14dac241d25c2a12b81670c238be4d17102cde253d82f231ca793671f89115077f65a20c337529
SSDEEP 49152:CvclRe57jSm1oJoTv0z2o+TjmkM+Eh1+MJfG61vDYIEvXmy/4utaARB8QtIHRbmm:2cfvol9JtIHl0NcWeymq3slKmf
TLSH
T14C667D12F7A20DE6C863C07485B76B23DAB6BC740B2047E747618A1E7E677D0097B789
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TSLogSDK.dll

Path C:\Users\Admin\AppData\Local\Squiredom\TSLogSDK.dll
Size 835KB
SHA256 ad2933bde1c9fc096cbd7d519e8f2234a3094fa20975de6b2014a5c3a1f72e2f
MD5 0f61ec1794edafa62a4c737d7995f92a
SHA1 cf55fa9c85c5fa7d595016cdd4a4d5a9a1388eb0
SHA512 ec9bb71247d6f051b02e0b89665f90a8de6e425b6b0cfc26adcb3e76dc93b80c8be4908554db05e55a89bb33cc5db0b73cf211fa772a573977e9348d1e7cca7d
SSDEEP 12288:z/Qj7Jw7bPvx+6XD416SNrG2gRxQsO8GFzTUhy6odITXmVnOZ:zUJw7bPvVzytrzgxQsO8GNT6SBOZ
TLSH
T127055B1ABBA840B5E077D13988979646E7F2B4061B3197CF03A1436E2F677E15E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCOMP140.DLL

Path C:\Users\Admin\AppData\Local\Squiredom\VCOMP140.DLL
Size 184KB
SHA256 ae4cf023350fd8af83f756dcb5bc59743b71c9dd95fea5d100e8c05fb8368420
MD5 a31119a03ac1c63b2a8a8beeca8ebdae
SHA1 2a9dd3adffa3e64cd6a635fcb8fb718b5e11b683
SHA512 2b0551c6d179bedb7b925dc496b15fbc0df6a60c383c540b32a1b1a0a0b97d8fcedd058dc89ddfc32d25ca60e1901caf136d35fac9bdd4d2f705c78db761499e
SSDEEP 3072:lPr3X7MYpAiR3LQpxELm3uFX1TfgZhPqCDwRsZUza/LW9DFdn7:lznAoAiO+m3uFFOIAO2/6j
TLSH
T13E047D4672E9007BF8779234C963191BE773B85107609BDF025443BA9F2B7C1AE3AB25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lib_TSCommunication_sdk.dll

Path C:\Users\Admin\AppData\Local\Squiredom\lib_TSCommunication_sdk.dll
Size 1.1MB
SHA256 9e08e9c16bb2b5f02bf7c9122f0460eed720827bae8e9c826dc6463c98ae4ca9
MD5 baca87b0b1135ee07f1cd7a7fa06671e
SHA1 e854fc6f45bf03a3d873633787d33219b6011fd7
SHA512 1c31c594668370cd4a955f1033866c205ffec6ba5d2c965c6a0ccf3f3b92d0f6aac5c1277a962ab977c07bf09bf5e66134b10f6f189393888adcbcd7723676b4
SSDEEP 12288:UeTs/zN2eJkjBQIMV5IDECsNaMjc3B1bS/AXkvtNZ0GhPkslwc/iAo7GrwJX/pCG:UeTpQpo7GrqXB0h8TlZEwCQ
TLSH
T194357C5A339C8255E17BA17CC9C74B0AD6B2744603229BCF45A446AE1F27BF42E3F760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

network256.conf

Path C:\Users\Admin\AppData\Local\Squiredom\network256.conf
Size 28KB
SHA256 91e83d66e856b26ad098df944ef61502f397eda3bfe1e6f19097187ed0dc1860
MD5 0739cdd77ffe5e7857288f6e8f834814
SHA1 31da7d818d744494a1e1c59636af49f6f8051c85
SHA512 5d1187ecc89d7af131c25b1373b8b5a7e1676084ab691325ec388df5bc7e5f95f06a2b459af9a291ef404b0ad50b00ae3eafdabac9c0213d68fa3cc9cc64e9e2
SSDEEP 768:+OHElt0BqV5ghb87r3sogWVwFcDPdn5SXPNMfpCA8zl2Zcony2Ql8:+MEf0oV5r3sQVwFAuCfp58h2aom8
TLSH
T154D28DA14FA63B116C09A81FDA34A461F845B5F33C0F1FB1E9DE28DA743A2A5D251CD3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

storagesvc42.bak

Path C:\Users\Admin\AppData\Local\Squiredom\storagesvc42.bak
Size 1.7MB
SHA256 ff1a2dcfdca25561b587bfa06214d70c85bcb802c5e5e7397dc977e1c5c20815
MD5 7bfd240e3ebb0bb61a0bbea30842a666
SHA1 a25635127d52fc22ae6b12f06da01b01aa40c136
SHA512 54c6cab445ac6354fefcc9c83e73b0291a5ffb0b1345621e1e0edf16ecd732db4d6bb9a52d5d459ec3ff93c51727c76a37ea10038f975bf3e03ef2b666c94b12
SSDEEP 24576:BOhTT1/wILu55WblpIhFcWQ7FHE1P5hsKoqYwq/wOyAvVb8ziXa2OTwdq3pK6Cdt:BM2IC5g5WFcWQ1YxDopqSdYFiVSTC
TLSH
T184852360B1FB0595D84F8132A11D6D3EA5B0FB7CA25911A3215BFC873AF7012DB2EE52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8921195.tmp

Path C:\Users\Admin\AppData\Local\Temp\8921195.tmp
Size 2.2MB
SHA256 ad2f7d5a4f7c5b53c05ca4011175c2c9a7ef43e293bc8c01d6d227c368a58539
MD5 983bd5f4b5c3e25fa795571031cd84c5
SHA1 9cab2239ba9f1d86e36cb286f2be6d5ba245746b
SHA512 41165aef03ce84362ec625fe633cf0baaad18b5e00f90d3378369815bd3947baf2866d0e52662d336312bc11305d99718883e204343da8f10b61b5cb43ac9c88
SSDEEP 49152:4pBJV7QNSsbo4IjKsR5+r4QywnTV7mW3S9UaqmV09x0vgl:4pBL7e84Ijv3+kQJT3S9hqGWxsW
TLSH
T10CB5332B37E625EC5FDC474FEFFA4A26C891BA1A126CA3015C8DC3149016D9FB351B92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8921195.tmp

Path C:\Users\Admin\AppData\Local\Temp\8921195.tmp
Size 2.2MB
SHA256 b9dd3dc357be6a97b219370696aed7379885a4cd682911e48cc79022196669d7
MD5 737296e080322a5419a2e726ded40cc2
SHA1 83194fece4688499ffa46f9db4872b289b91137c
SHA512 c6d91efe7fe1282673dba1586c418779527ea8a4480d5773e09f7e1883b3d83287dbab3d022c2f9eefa27fdc85a79ebb4b7b207c90ab3066867d20f51895e05e
SSDEEP 49152:qpBJV6QNSsbo4IjKsR5+r4QywnTV7mW3S9UaqmV09x0vgl:qpBL6e84Ijv3+kQJT3S9hqGWxsW
TLSH
T12BB5332B37E625EC5FDC474FEFFA4A26C891BA1A126CA3015C8DC3149016D9FB351B92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CB33CDD.tmp

Path C:\Users\Admin\AppData\Local\Temp\CB33CDD.tmp
Size 40B
SHA256 79547577969ce74342487c57c9bd9f83bfb1d104d8049d470539e11a1def3849
MD5 1255b49f64d1123632eb802f49091609
SHA1 3d3930496317cb0e71fc7e8be982eb3a6592e68c
SHA512 55ed3978e66cffbc2b47090ec5e569698715d1c0a77fcc9ed4b664e97d0e4b1532bb284b9a0b83f694e036acf5b205955dca34371c9c21e02a9716a1cb4c534e
MD5 SHA1 SHA512

Submit Download

Crisp.exe

Path C:\Users\Admin\AppData\Roaming\JDManager\Crisp.exe
Size 334KB
SHA256 c2e62475768c9546efe1da92a55f3bb2a55350eed83241139917aabd1ad25f8a
MD5 5f9f88c9a16b62dc38504549e93d3667
SHA1 587d56031b39e34102bc67b5f7d0338ee41b5328
SHA512 edbb7a8cd75e056d2c47b8af6fbee63726cb3d5f000d5f8bc000f4b16366619c8532e628585cc943f474d2509c63802179d0d22a1d32dd690fb25e00d262af83
SSDEEP 6144:7c2XFRJ3DNuzAOS9FuxIRtiiuhKPTqX4Y42:dFvYzU9kutRuhKPTqo32
TLSH
T125749E11B9D1C4B2C4B2053009E8EBB5697DFD714F61863B33D8772E1F742C1A662AA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicroMa64.exe

Path C:\Users\Admin\MicroMa64.exe
Size 1.0MB
SHA256 bc5e9ceb7fd09b6c4b945bc8d4ada428f2cf5d9311180bfdac7afd7ad480e7b4
MD5 61d9783b5a1e4b01a737d4a2e4e4c776
SHA1 cb63dfa6abef40352b6172e410ced514de648669
SHA512 16ed069651197c3523e2c9e1275fae1473fc9303446c64dff533afa5461bdb9dea09d3cf08b7a5c12f3275da2a73f414008df9af0e7ac8cb0d7880684b58b6f2
SSDEEP 12288:UZTETjuQkaRUHEMuDZ+Haby+/RjnbpEw1P4YZgepD/H27+Bl2e5bjYcqn6MgWw6G:vjukpdpEaAYbpD/27Ul2afYc+6Mgyc9V
TLSH
T18F257C607BE8813BE6A30672D9BCA76F643ABE611B24D4C763C40B1D4D305D26E3A717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59f90c.msi

Path C:\Windows\Installer\e59f90c.msi
Size 5.0MB
SHA256 e8e9e5a2b793f043ed422e9b3d5906d887919c37218e24cc28eec3e086f5db4e
MD5 ad0828b0a53cc41bf2edde1d0689356f
SHA1 9642cc0027221b1c7ba1b9b3a39f66fabec670d3
SHA512 d5077adae28cdf03600a3b619848e5137355de8d0fc5fed31a7923653145a2a70724a5d931299599c20781a30d597ffae461c04df08c0ea7ad6b48451f5f0a9e
SSDEEP 98304:eEU99eE9Pov1x+FTW0EJZI5KkqgepBSe9atp/tDBy7cJapnIhfY8oiLnDZT:eEU9oE1ov1gW0v5Xk2D/toyapnioqn
TLSH
T1503633F5F4F297DBF53BD2714202A9F1DD0AAE559AB240F3482E793191B3BD12B94220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 2fc4176b0a6229443c1a25adf7061689194b582a3e0774e47684d1b5d53a5c36
MD5 fc3c637bf17349f60d668ae71051d9ad
SHA1 7f9b9caaaea138f6f4619c45edb598f5e3023a70
SHA512 f80ba649286e8c2844bd5b603909ffb36039aef6f22f7676be1c003d5b168bce08e48948673f6da28fd550af79623a49e5817d1e8c51a8b411c9a605b839f3b2
SSDEEP 24576:pFo3DMPBdoO/vvTL/Sg88iFQvrumHb7P0BKudxSUKpyKpb9cMoRWclmd4+q:1Hc
TLSH
T11157B42436F92200E7F79E3DA8F06A234D397D5BAC15DE8D45511B4E0822F71E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{79b755ff-5474-401a-815b-d970d10bf46c}_OnDiskSnapshotProp

Path \??\Volume{c61f3bad-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{79b755ff-5474-401a-815b-d970d10bf46c}_OnDiskSnapshotProp
Size 6KB
SHA256 0cffccf3edd73e69086e72f9f31fa64bd100e2eb811cb357f39e5327e9765116
MD5 45aaa60879909198309f2483eebd6938
SHA1 945f48c9549081e027297c75d4dd7643654f9cfb
SHA512 2bc7a8d36f140b6151d2d438fcee6d60ffcb4edc7207e761ab1ce3920c70ffd2724323b718bdc52186d9ae95bc2e7147d82e4c8304f4bcf0d6f27d33c3f29241
SSDEEP 96:Fuj074Cvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpuN:E7eb++uVmN
TLSH
T112D189085AE54711E2B3AB7129F14557A877B811FF33CB8E0198238E2631A10F976F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2576-49-0x000001E7DFB60000-0x000001E7E01FD000-memory.dmp

Download

memory/2576-52-0x00007FFCFEA00000-0x00007FFCFEA63000-memory.dmp

Download

memory/2576-54-0x00007FFCFEA00000-0x00007FFCFEA63000-memory.dmp

Download

memory/2576-60-0x00007FFCFEA00000-0x00007FFCFEA63000-memory.dmp

Download

memory/5064-70-0x0000000000E40000-0x0000000000EA9000-memory.dmp

Download

memory/5064-67-0x00007FFD18400000-0x00007FFD18663000-memory.dmp

Download

memory/5064-68-0x0000000000E40000-0x0000000000EA9000-memory.dmp

Download

memory/5064-62-0x0000000000E40000-0x0000000000EA9000-memory.dmp

Download

memory/5064-74-0x0000000000E40000-0x0000000000EA9000-memory.dmp

Download

memory/5064-80-0x0000000000E40000-0x0000000000EA9000-memory.dmp

Download

memory/5064-83-0x0000000000E40000-0x0000000000EA9000-memory.dmp

Download

memory/5064-85-0x0000000000E40000-0x0000000000EA9000-memory.dmp

Download

memory/5644-42-0x00007FFCFCAE0000-0x00007FFCFCB43000-memory.dmp

Download

memory/5644-38-0x0000018ADB1B0000-0x0000018ADB23E000-memory.dmp

Download

memory/5716-81-0x00007FFD18400000-0x00007FFD18663000-memory.dmp

Download