Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
08/08/2026, 07:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
GoogleMeets-agent-x86.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
18 signatures
150 seconds
Behavioral task
behavioral2
Sample
GoogleMeets-agent-x86.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
19 signatures
150 seconds
General
- Target GoogleMeets-agent-x86.msi
- Size 5.7MB
- Sample260808-h2fkdawscy
- SHA256 0614cca495539cfe5c281a638060f1d9c990b6be0eda7c3bdbb363bd4f18206c
- MD5 37358924913be0711498ffcd131069b4
- SHA1 e0b742907e5e3b684303e9f0dd6b0b283a138357
- SHA512 ba680b33c36baf72f9c6f942f096a6dd1114d5f4986ebc4e54f77083865aa4a7ff9e02dd36ba094c587d3a0ff9be0886806083f417059e516dedd2eb0db21113
- SSDEEP 98304:jUYRsz36Of0o5GIb5nN3ImCWZd5BBVJd1ub+FrBpXrWaF+bmSB9bfG:jd0j/YC5numCoLP1mqrRFjSne
- TLSH T16756337C3A932B4AD19A3734076ADA7743ADFCD85AADC5038914B5256B303A0D0B3FE5
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
hijackloader
Attributes
-
directory
%ALLUSERSPROFILE%\com_int_tool
-
inject_dll
%windir%\SysWOW64\input.dll
xor.hex
Signatures
- Family: HijackLoader, IDAT loader, Ghostulse,
HijackLoader is a multi-stage loader, first seen in 2023.
- Detects HijackLoader (aka IDAT Loader) 1 IoCs
resource yara_rule behavioral1/files/0x000700000002426f-34.dat family_hijackloader - Executes dropped EXE 2 IoCs
pid Process 2424 Station-Logic.exe 5008 Station-Logic.exe - Loads dropped DLL 6 IoCs
pid Process 2424 Station-Logic.exe 2424 Station-Logic.exe 5008 Station-Logic.exe 5008 Station-Logic.exe 3836 SpectraEmu.exe 3752 Chime.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 5008 set thread context of 3836 5008 Station-Logic.exe 105 PID 5008 set thread context of 3752 5008 Station-Logic.exe 106 - Drops file in Windows directory 9 IoCs
description ioc Process File created C:\Windows\Installer\e58a9b8.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSIAA74.tmp msiexec.exe File created C:\Windows\Installer\e58a9ba.msi msiexec.exe File opened for modification C:\Windows\Installer\e58a9b8.msi msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{BC3B2EF7-D6CC-4BCF-BB6E-8BF6CBEB21A9} msiexec.exe File created C:\Windows\Tasks\prodata.job Chime.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 5060 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SpectraEmu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Chime.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Station-Logic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Station-Logic.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000524fef632b0bf5150000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000524fef630000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900524fef63000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a524fef63000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d524fef63000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 3836 SpectraEmu.exe - Suspicious behavior: EnumeratesProcesses 17 IoCs
pid Process 3900 msiexec.exe 3900 msiexec.exe 2424 Station-Logic.exe 5008 Station-Logic.exe 5008 Station-Logic.exe 5008 Station-Logic.exe 5008 Station-Logic.exe 3836 SpectraEmu.exe 3836 SpectraEmu.exe 3752 Chime.exe 3752 Chime.exe 3752 Chime.exe 3752 Chime.exe 3752 Chime.exe 3752 Chime.exe 3752 Chime.exe 3752 Chime.exe - Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 5008 Station-Logic.exe 5008 Station-Logic.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 5060 msiexec.exe Token: SeIncreaseQuotaPrivilege 5060 msiexec.exe Token: SeSecurityPrivilege 3900 msiexec.exe Token: SeCreateTokenPrivilege 5060 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 5060 msiexec.exe Token: SeLockMemoryPrivilege 5060 msiexec.exe Token: SeIncreaseQuotaPrivilege 5060 msiexec.exe Token: SeMachineAccountPrivilege 5060 msiexec.exe Token: SeTcbPrivilege 5060 msiexec.exe Token: SeSecurityPrivilege 5060 msiexec.exe Token: SeTakeOwnershipPrivilege 5060 msiexec.exe Token: SeLoadDriverPrivilege 5060 msiexec.exe Token: SeSystemProfilePrivilege 5060 msiexec.exe Token: SeSystemtimePrivilege 5060 msiexec.exe Token: SeProfSingleProcessPrivilege 5060 msiexec.exe Token: SeIncBasePriorityPrivilege 5060 msiexec.exe Token: SeCreatePagefilePrivilege 5060 msiexec.exe Token: SeCreatePermanentPrivilege 5060 msiexec.exe Token: SeBackupPrivilege 5060 msiexec.exe Token: SeRestorePrivilege 5060 msiexec.exe Token: SeShutdownPrivilege 5060 msiexec.exe Token: SeDebugPrivilege 5060 msiexec.exe Token: SeAuditPrivilege 5060 msiexec.exe Token: SeSystemEnvironmentPrivilege 5060 msiexec.exe Token: SeChangeNotifyPrivilege 5060 msiexec.exe Token: SeRemoteShutdownPrivilege 5060 msiexec.exe Token: SeUndockPrivilege 5060 msiexec.exe Token: SeSyncAgentPrivilege 5060 msiexec.exe Token: SeEnableDelegationPrivilege 5060 msiexec.exe Token: SeManageVolumePrivilege 5060 msiexec.exe Token: SeImpersonatePrivilege 5060 msiexec.exe Token: SeCreateGlobalPrivilege 5060 msiexec.exe Token: SeBackupPrivilege 4908 vssvc.exe Token: SeRestorePrivilege 4908 vssvc.exe Token: SeAuditPrivilege 4908 vssvc.exe Token: SeBackupPrivilege 3900 msiexec.exe Token: SeRestorePrivilege 3900 msiexec.exe Token: SeRestorePrivilege 3900 msiexec.exe Token: SeTakeOwnershipPrivilege 3900 msiexec.exe Token: SeRestorePrivilege 3900 msiexec.exe Token: SeTakeOwnershipPrivilege 3900 msiexec.exe Token: SeRestorePrivilege 3900 msiexec.exe Token: SeTakeOwnershipPrivilege 3900 msiexec.exe Token: SeRestorePrivilege 3900 msiexec.exe Token: SeTakeOwnershipPrivilege 3900 msiexec.exe Token: SeRestorePrivilege 3900 msiexec.exe Token: SeTakeOwnershipPrivilege 3900 msiexec.exe Token: SeRestorePrivilege 3900 msiexec.exe Token: SeTakeOwnershipPrivilege 3900 msiexec.exe Token: SeRestorePrivilege 3900 msiexec.exe Token: SeTakeOwnershipPrivilege 3900 msiexec.exe Token: SeRestorePrivilege 3900 msiexec.exe Token: SeTakeOwnershipPrivilege 3900 msiexec.exe Token: SeRestorePrivilege 3900 msiexec.exe Token: SeTakeOwnershipPrivilege 3900 msiexec.exe Token: SeRestorePrivilege 3900 msiexec.exe Token: SeTakeOwnershipPrivilege 3900 msiexec.exe Token: SeRestorePrivilege 3900 msiexec.exe Token: SeTakeOwnershipPrivilege 3900 msiexec.exe Token: SeRestorePrivilege 3900 msiexec.exe Token: SeTakeOwnershipPrivilege 3900 msiexec.exe Token: SeRestorePrivilege 3900 msiexec.exe Token: SeTakeOwnershipPrivilege 3900 msiexec.exe Token: SeRestorePrivilege 3900 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 5060 msiexec.exe 5060 msiexec.exe - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 3900 wrote to memory of 1004 3900 msiexec.exe 98 PID 3900 wrote to memory of 2424 3900 msiexec.exe 100 PID 2424 wrote to memory of 5008 2424 Station-Logic.exe 102 PID 5008 wrote to memory of 3836 5008 Station-Logic.exe 105 PID 5008 wrote to memory of 3836 5008 Station-Logic.exe 105 PID 5008 wrote to memory of 3752 5008 Station-Logic.exe 106 PID 5008 wrote to memory of 3752 5008 Station-Logic.exe 106 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\GoogleMeets-agent-x86.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5060
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3900 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:1004
-
-
C:\Users\Admin\AppData\Local\Temp\Autography\Station-Logic.exe"C:\Users\Admin\AppData\Local\Temp\Autography\Station-Logic.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\ProgramData\com_int_tool\Station-Logic.exeC:\ProgramData\com_int_tool\Station-Logic.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\ProgramData\SpectraEmu.exeC:\ProgramData\SpectraEmu.exe4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
PID:3836
-
-
C:\ProgramData\com_int_tool\Chime.exeC:\ProgramData\com_int_tool\Chime.exe4⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3752
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4908
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e58a9b9.rbs
- Size 9KB
- SHA256 de836231a3b566e29f1e8ebd77010eedcf1f40c92374c952dbc9ed07d9a382ff
- MD5 d8c49df33d513c713a50a24c653505b3
- SHA1 b09bf9cb4cea24d84da990e8d5e25a5e35087db4
- SHA512 bc469e74a73f85f2d749271d0791c5aa3aa2a7efc40b1321f1d543450cd8d432606fc8c4192b4f8d3cad8dd2720b674c4f4030c1449fc3c384b011cfe35200d6
- SSDEEP 96:Ely8dE02792MKGqFYbA22e1mDmN8UrrWpwbCsThqeUrrWpwbC6jwomTmIgThqCHx:EtlrefbrkwmIArkwmn+BmXU3pcw
- TLSH T152120E40F24585E2E8112BBA9F631B7433B2C3DDD6513B8F0D9E91304F5279CAE4A28A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\SpectraEmu.exe
- Size 2.0MB
- SHA256 f8e409319baa062bbba8bb4114889d7e3dfc5774780aefc57a46f19ff407c18b
- MD5 09d7f980ab256ee6f8d1a54109ff4749
- SHA1 6a6cf9e5d630346bbfef72fb6b4356bfe33ff589
- SHA512 b7a5154f962703de87f9de3e4a3f1742c4f00cb9ccd621142d3d9a343c4f8551dddd0e0ddbe2f18ab48903f8631252517aadad67b0d0169e83d8d187730ba743
- SSDEEP 24576:J2PlcPsHsG4YRzktmJu6y72/WQ8ycZ4EM4w8zzoSsCyuiseEwCsDFDYBIP:oRmmJuZ72eQ5cZ4Eu8zXvwbEDQDYBIP
- TLSH T1BDA57D02FF81C877C0260731D89747F967B5FE502F65A69B32943F183E37B909A28666
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\com_int_tool\Chime.exe
- Size 619KB
- SHA256 adb8347dfa1b1df1ca2211fe4d7e82f27ced939f1bf3d52548e52bc9e23fc52c
- MD5 dd65b976d1865ba6c2368fcf9c9eb223
- SHA1 db933b1ff0dc73c2e4f230aa3bd47646632d5714
- SHA512 5ff91cc29744416a32789f277f2494bbe60bd1f2eb53ea48e538075e8d735420c0256b7798e8f99b9286bf8c3b0dcf5f1a1539b8f2792991fb7d5754ec6fa0df
- SSDEEP 6144:+Zzvhs2Z4n1E7g34XtVYAOfTdH8zjQSYoLdnU4q:+J+2Z4nShVY5CjQxoLdnU4q
- TLSH T1DAD4BF33BD9E80E2CD6205B005A49D75FF6BAB300A758A7F22B5723AFBA01435D73552
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\43F538.tmp
- Size 40B
- SHA256 cd76f9ac676719767a74c62ca82b581dcaf6ce07a797b5bb00ff40e339c371b7
- MD5 b06898d51bc5398b6990b4cd4f385aea
- SHA1 066752a00a75432b558833a468fbef1c715b86f5
- SHA512 1fe6a85e0179d9648c62ce3b890c2c617b3c9b1dfa905e1643366064c4e094fb59e3ab3974d9462495c896ace2c9f1203993a048ee531f05b3de7eb7bec33863
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\Autography\K7TSHelp.dll
- Size 118KB
- SHA256 c8f7d8d9eef2476399e70a0859daecb0f2dde82a2dd06b89feedcd006e0cc4cd
- MD5 8653e25713316a848fa8e6ba0ae30254
- SHA1 dda883c3bf27cae34afff7517e998e7a983b1086
- SHA512 502ae5a63afce71411aaddb0dbf9fdc6adf0fbec726abe5abbdd0c3a16382c5d8d071eff6d3fe2fd4e9460af21594466edd003b9decafb023499b03b3ec8dd9c
- SSDEEP 1536:wk6Q65bINSsVTP32Ilk4kp9KvjOlMx6yAk72ZFnx4kzR7Wb5ctHRi7dHN:X6QI8N9jrkuOcB2kkzR7Wb5CRi75N
- TLSH T1F6C39E223495C0B7D0AA143E8456C2B64F777D209DAD5D8B3FD836EDAF342938B2534A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Autography\K7UI.dll
- Size 582KB
- SHA256 cb5f23db25beb1488652c6284e233c3bed51b14c645fcf4dbc5451294cb36251
- MD5 e89d20c0bb10ef05e683ceb4d61776a9
- SHA1 acd323148b25abc827f0a3df5a11bb35bf888b41
- SHA512 b9b8f75a15017061ae4aabf390b9fb5ba4e72b809f8d3ed02e9f657fecb30dd8f486eab3cc65dd1fe667e9228d4001d43ddfb0cd3acbe02ac4950d6535ee8c22
- SSDEEP 12288:HT3pDJ1ZWAmGDk4UFMOJzeAdTxq+IL0NezoZL9BfftkO4qMwhZ2007VzbT3:ztJ1ZW0jSj7hZ2007Vzbz
- TLSH T193C49E13BD80D033D9B7243146B8EAF5497C79301B68A6CBA3581B759E344D2BB3972B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Autography\Microsoft.VC90.CRT.manifest
- Size 599B
- SHA256 960711837e9893fa161fd9349ec4a5cbb41a4c77175d0960586336bc09b0cb2e
- MD5 647f5101ebc822a1fff4ac39ca22b27e
- SHA1 8af059c590aa1679892857dc21a951555785c2e5
- SHA512 76843dc5925e33ea1c1b23214e113e3f3a2f5672c0e06ff3816d24fe8f53b49b63d85ca02a2cc0e842917d225598977cc9212a8269e131e0e0a6775ae45f69a9
- TLSH T13EF0E190D188BD7E530232E0DF23E809994803230D9D436894FE7E2F3E1381445A70B3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Autography\Station-Logic.exe
- Size 592KB
- SHA256 e7e5e7086870d785c55cde559c34d61552fe7ba2cffea32a436b66c21b1f79d2
- MD5 7f80c268a2ba5f15c87260198c5154c4
- SHA1 25feb78f8df3c814d6ee5d99ea662758033882bf
- SHA512 44d4f6dcc98bc09285818d23b47d5895690150fa4f50d971eb26806472e9cb85809c39640b8896c443d09fb22f88447a60eb06d2a0eb9eae841abba722e27454
- SSDEEP 12288:EjIOTtZInMJF5o9H+NFQ+Bv2s+XGZuigrEWs/bCMyUJwtG:EjI+tZ3o9eHIisLs/bCMyUR
- TLSH T19FD47C21FA808036C5B734714BBED5B21DBD68311B2549CB63889AB95F341F1BF3962B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Autography\broker.lib
- Size 5.4MB
- SHA256 f44dc45f71ac594117fd2729fc3b9f52e9bbd56ffbac17fb628701899a0a4668
- MD5 fd2edd9b623426b6e013e73b3c320a74
- SHA1 a890ecd30eb4675c7252fd46e58d6cb5eb2889db
- SHA512 3fb8c89ed6082fa0125e5a409eccf9acfae1a88fa4bf9d6758a5f54ff5c53d94d54d9b0bc2cf56a59b40225266535a61b4d16e824d073756e7b8942cc571059a
- SSDEEP 98304:KRYJi4idXI68dXCxbRrPb4E4tsrQdXEr0MFXRgM/8uN2WYD5g0d:MXXcdyZFPb4E4s0EgMxRg7NNZd
- TLSH T1BA462381D49D6F3AD007773F0015DBFA23626F123A16BD9B710942AA83C6B5E5709FAC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Autography\msvcp_win.dll
- Size 485KB
- SHA256 55043a5dbe9b4bfe50e2e6be0bdf77a69a075becc520700dcaffb1d9f7686138
- MD5 bbc3c4543a00bc1e2130921ddc3ed3ca
- SHA1 f7fe6df7187c3e11da67bc7f089113d61935364c
- SHA512 2c8f44308a7344730423a8cf956d234ee46c9818c8ad13e19ba9019a99f9905aa5e326a2203ba462521ad626f015808abf9c34a3cfe3b660b6f321de540a95ab
- SSDEEP 12288:3m8MyfWVRsPsxy60whuhFbCu8hUgiW6QR7t5s03Ooc8dHkC2es/oLG:yy+sPsxy60euPbn03Ooc8dHkC2eyoLG
- TLSH T1F8B43A3377410EB1E59A63B0218E973593F9ECA64761E3C393DAF1A96F243C29533681
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Autography\signalspec.lib
- Size 19KB
- SHA256 de13761793b3e153e778c11f55aa2ed5090e5d0a972cdcfa2253b1425d67518d
- MD5 d79f8c74ea00df2b3fbe5ce52aeb1d0d
- SHA1 5818277ed5bdff792bc21cc4c5c516162402adf0
- SHA512 125aefd0bef74c5ed62b109bad18102bde2a162deba75186515a9a5c0fc02636b08efbe53f2352959ff5eba92c01823cbe47d271b4e925d66059c22a9eaf5b34
- SSDEEP 384:Ox/ra/E5GpTzhwcGHysvtOmgqa72siHr5DCzfxt5TxVyxvyEVEeYz:Ox/OEGpTycemmgqHkVy8Tz
- TLSH T189928E79852E2717A4012C79481090F7D29439BF732F1463B797AC97B01B19AD7C6C37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Autography\ucrtbase.dll
- Size 1.1MB
- SHA256 71358d729b01bdf38dbe5440705ea68ea9225f93c834f45c5687b0ea2b417c4e
- MD5 d4cf3fd5e8ee95431cfea69fa84ae57d
- SHA1 80f5188570001e4fd5fdad9cbf38479dd4edd255
- SHA512 a30488c43ca41ed36ee2917fe8e7a5280e0565859f719a1f709b13c18c3398f323c8ef24608e8f696214d9fe882c32b1a8686800490ca781196810220b30d43b
- SSDEEP 24576:YWisOihSAdUDRdwE0OpuE4N7qWkGA+g7lyD6ZQtpmcvIZPoy4cncF4dN:zisOihSlDZuNN7qLZyD6yt6nccN
- TLSH T1B6453A093585E0AEDC6D3679136BB522346C76924BA8ECC373840BE98E305D17736EDB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\D01E124.tmp
- Size 6.4MB
- SHA256 0fab4ccf8ccd5179ddb435f3c2011deda59731724c386e445fec45854033148f
- MD5 5db88fd6c8e1ecec9246568a4a198bc3
- SHA1 da2d6326ca8a29df7fbda44f11225880dcf06a78
- SHA512 64de43fd808ba6f1f9ff9ba07807564dde08a2a3838e60fe72478680659d851e1c4147744e328fa72ca16a1e7d656052610ed8c7ab22882fe507e7ba806a1924
- SSDEEP 196608:w4Fh7SWEfTxrpAYjBUi0Dh/v6vL1S63UL1QzuUl:FFpELxyUKVln4LcjJQb
- TLSH T1AE66334CC356BF478B488CB333AD0F89DDA4D24D50B26B2662ED8D944D3D4BE87989E4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\D01E124.tmp
- Size 6.4MB
- SHA256 a961d8c4718f2654e3689b6e8f9b6d33ac2c5041c2b4e61a90d3c4c0b7d39e86
- MD5 1514b2658a035ccb4015082d2c31f276
- SHA1 1dd20d91b0a023a40e23867423f197ff51663d9a
- SHA512 e91b54fb3de5ad0f670b0cc743cf722f1e909afbb938b344d0ea94f0385b26189c37b64adeb3472f022d18bdb3c60e58bd33d4a25ce1fca62c765afa458f212b
- SSDEEP 196608:y4yh7SWEfTxrpAYjBUi0Dh/v6vL1S63UL1QzuUl:HypELxyUKVln4LcjJQb
- TLSH T14A66334CC356BF478B488CB333AD0F89DDA4D24D50B26B2662ED8D944D3D4BE87989E4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e58a9b8.msi
- Size 5.7MB
- SHA256 0614cca495539cfe5c281a638060f1d9c990b6be0eda7c3bdbb363bd4f18206c
- MD5 37358924913be0711498ffcd131069b4
- SHA1 e0b742907e5e3b684303e9f0dd6b0b283a138357
- SHA512 ba680b33c36baf72f9c6f942f096a6dd1114d5f4986ebc4e54f77083865aa4a7ff9e02dd36ba094c587d3a0ff9be0886806083f417059e516dedd2eb0db21113
- SSDEEP 98304:jUYRsz36Of0o5GIb5nN3ImCWZd5BBVJd1ub+FrBpXrWaF+bmSB9bfG:jd0j/YC5numCoLP1mqrRFjSne
- TLSH T16756337C3A932B4AD19A3734076ADA7743ADFCD85AADC5038914B5256B303A0D0B3FE5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.1MB
- SHA256 177957b265f5646781ff3d7ca659b6b88e14c5087342f1b95c4c17b04da36ebe
- MD5 ae9173b795f3888a3c740facc76a002a
- SHA1 9331b12613e9b787ae111140afc4a57f87c35ffb
- SHA512 1de3a7ad6bb346fe79665dc346b0a3a94e392da193692bed06b8e52076d6a5ecb4887d48a30fb2369008d387bf8f265e423d067b38a4882ade49ad1a19c453b1
- SSDEEP 24576:Du8m+1zWdoO/vvTLrW2ez2qCHvkTel2y6AGt0JXVuUKX+R/r4vFvuw9Bz:O
- TLSH T14C47A42436F92140E7F79F3C68F06A23493A7D6B9C19DE8D45811B4E0921FB1E872F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{63ef4f52-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{9161f6b3-0e30-4ae7-b47b-d920c2d9fcdc}_OnDiskSnapshotProp
- Size 6KB
- SHA256 d9ff3fe846bc34ecaeffefc94d105d36839b4959d09c746e6375a80e9cfb2316
- MD5 659327f738cd241f643fdb907960372f
- SHA1 f6c3d8a98949a7049e73e2ba80cb2af0d8f6bf1b
- SHA512 da803eb3608f9e820772c9526928c7a812c9e91081df0f69d455db5d36f848119608ff9e0993e6f72e887191355c343d8c7c1e15d1fb0e00ffecf0aa45948d4d
- SSDEEP 96:Fxm7Mfvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:3mkb++ZVmN
- TLSH T175D178085AF54711E2B3AB7129F14557A877B911EF33CB8E0298238E6670A10F876F5F
- MD5 SHA1 SHA512 SSDEEP TLSH