hijackloader | 0614cca495539cfe5c281a638060f1d9c990b6be0eda7c3bdbb363bd4f18206c

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 07:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
GoogleMeets-agent-x86.msi
Size 5.7MB
Sample260808-h2fkdawscy
SHA256 0614cca495539cfe5c281a638060f1d9c990b6be0eda7c3bdbb363bd4f18206c
MD5 37358924913be0711498ffcd131069b4
SHA1 e0b742907e5e3b684303e9f0dd6b0b283a138357
SHA512 ba680b33c36baf72f9c6f942f096a6dd1114d5f4986ebc4e54f77083865aa4a7ff9e02dd36ba094c587d3a0ff9be0886806083f417059e516dedd2eb0db21113
SSDEEP 98304:jUYRsz36Of0o5GIb5nN3ImCWZd5BBVJd1ub+FrBpXrWaF+bmSB9bfG:jd0j/YC5numCoLP1mqrRFjSne
TLSH
T16756337C3A932B4AD19A3734076ADA7743ADFCD85AADC5038914B5256B303A0D0B3FE5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery hijackloader loader persistence privilege_escalation ransomware

Malware Config

Extracted

Family

hijackloader

Attributes

directory
%ALLUSERSPROFILE%\com_int_tool
inject_dll
%windir%\SysWOW64\input.dll

xor.hex

Signatures

Family: HijackLoader, IDAT loader, Ghostulse,
HijackLoader is a multi-stage loader, first seen in 2023.
loader hijackloader

Detects HijackLoader (aka IDAT Loader) 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c4d4-32.dat	family_hijackloader

Executes dropped EXE 2 IoCs

pid	Process
6044	Station-Logic.exe
1980	Station-Logic.exe

Loads dropped DLL 6 IoCs

pid	Process
6044	Station-Logic.exe
6044	Station-Logic.exe
1980	Station-Logic.exe
1980	Station-Logic.exe
5136	SpectraEmu.exe
2324	Chime.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1980 set thread context of 5136	1980	Station-Logic.exe	99
PID 1980 set thread context of 2324	1980	Station-Logic.exe	100

Drops file in Windows directory 13 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\~DFCE92757ED2743C91.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI981F.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFC9C53D0B5BC84D87.TMP	msiexec.exe
File created	C:\Windows\Installer\e599215.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e599215.msi	msiexec.exe
File created	C:\Windows\Installer\e599217.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFBB23DADE71B20A78.TMP	msiexec.exe
File created	C:\Windows\Tasks\prodata.job	Chime.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFE72636BF3709463E.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{BC3B2EF7-D6CC-4BCF-BB6E-8BF6CBEB21A9}	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
5536	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Station-Logic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SpectraEmu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chime.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Station-Logic.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ad3b1fc6af0fc0350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801ad3b1fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101ad3b1fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3ad3b1fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6ad3b1fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5136	SpectraEmu.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4760	msiexec.exe
4760	msiexec.exe
6044	Station-Logic.exe
1980	Station-Logic.exe
1980	Station-Logic.exe
1980	Station-Logic.exe
1980	Station-Logic.exe
1980	Station-Logic.exe
1980	Station-Logic.exe
5136	SpectraEmu.exe
5136	SpectraEmu.exe
2324	Chime.exe
2324	Chime.exe
2324	Chime.exe
2324	Chime.exe
2324	Chime.exe
2324	Chime.exe
2324	Chime.exe
2324	Chime.exe
2324	Chime.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
1980	Station-Logic.exe
1980	Station-Logic.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5536	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5536	msiexec.exe
Token: SeSecurityPrivilege	4760	msiexec.exe
Token: SeCreateTokenPrivilege	5536	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5536	msiexec.exe
Token: SeLockMemoryPrivilege	5536	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5536	msiexec.exe
Token: SeMachineAccountPrivilege	5536	msiexec.exe
Token: SeTcbPrivilege	5536	msiexec.exe
Token: SeSecurityPrivilege	5536	msiexec.exe
Token: SeTakeOwnershipPrivilege	5536	msiexec.exe
Token: SeLoadDriverPrivilege	5536	msiexec.exe
Token: SeSystemProfilePrivilege	5536	msiexec.exe
Token: SeSystemtimePrivilege	5536	msiexec.exe
Token: SeProfSingleProcessPrivilege	5536	msiexec.exe
Token: SeIncBasePriorityPrivilege	5536	msiexec.exe
Token: SeCreatePagefilePrivilege	5536	msiexec.exe
Token: SeCreatePermanentPrivilege	5536	msiexec.exe
Token: SeBackupPrivilege	5536	msiexec.exe
Token: SeRestorePrivilege	5536	msiexec.exe
Token: SeShutdownPrivilege	5536	msiexec.exe
Token: SeDebugPrivilege	5536	msiexec.exe
Token: SeAuditPrivilege	5536	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5536	msiexec.exe
Token: SeChangeNotifyPrivilege	5536	msiexec.exe
Token: SeRemoteShutdownPrivilege	5536	msiexec.exe
Token: SeUndockPrivilege	5536	msiexec.exe
Token: SeSyncAgentPrivilege	5536	msiexec.exe
Token: SeEnableDelegationPrivilege	5536	msiexec.exe
Token: SeManageVolumePrivilege	5536	msiexec.exe
Token: SeImpersonatePrivilege	5536	msiexec.exe
Token: SeCreateGlobalPrivilege	5536	msiexec.exe
Token: SeBackupPrivilege	1680	vssvc.exe
Token: SeRestorePrivilege	1680	vssvc.exe
Token: SeAuditPrivilege	1680	vssvc.exe
Token: SeBackupPrivilege	4760	msiexec.exe
Token: SeRestorePrivilege	4760	msiexec.exe
Token: SeRestorePrivilege	4760	msiexec.exe
Token: SeTakeOwnershipPrivilege	4760	msiexec.exe
Token: SeRestorePrivilege	4760	msiexec.exe
Token: SeTakeOwnershipPrivilege	4760	msiexec.exe
Token: SeRestorePrivilege	4760	msiexec.exe
Token: SeTakeOwnershipPrivilege	4760	msiexec.exe
Token: SeRestorePrivilege	4760	msiexec.exe
Token: SeTakeOwnershipPrivilege	4760	msiexec.exe
Token: SeRestorePrivilege	4760	msiexec.exe
Token: SeTakeOwnershipPrivilege	4760	msiexec.exe
Token: SeRestorePrivilege	4760	msiexec.exe
Token: SeTakeOwnershipPrivilege	4760	msiexec.exe
Token: SeRestorePrivilege	4760	msiexec.exe
Token: SeTakeOwnershipPrivilege	4760	msiexec.exe
Token: SeRestorePrivilege	4760	msiexec.exe
Token: SeTakeOwnershipPrivilege	4760	msiexec.exe
Token: SeRestorePrivilege	4760	msiexec.exe
Token: SeTakeOwnershipPrivilege	4760	msiexec.exe
Token: SeRestorePrivilege	4760	msiexec.exe
Token: SeTakeOwnershipPrivilege	4760	msiexec.exe
Token: SeRestorePrivilege	4760	msiexec.exe
Token: SeTakeOwnershipPrivilege	4760	msiexec.exe
Token: SeRestorePrivilege	4760	msiexec.exe
Token: SeTakeOwnershipPrivilege	4760	msiexec.exe
Token: SeRestorePrivilege	4760	msiexec.exe
Token: SeTakeOwnershipPrivilege	4760	msiexec.exe
Token: SeRestorePrivilege	4760	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5536	msiexec.exe
5536	msiexec.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5536	msiexec.exe
4760	msiexec.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4760 wrote to memory of 1964	4760	msiexec.exe	94
PID 4760 wrote to memory of 6044	4760	msiexec.exe	96
PID 6044 wrote to memory of 1980	6044	Station-Logic.exe	97
PID 1980 wrote to memory of 5136	1980	Station-Logic.exe	99
PID 1980 wrote to memory of 5136	1980	Station-Logic.exe	99
PID 1980 wrote to memory of 2324	1980	Station-Logic.exe	100
PID 1980 wrote to memory of 2324	1980	Station-Logic.exe	100

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\GoogleMeets-agent-x86.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:5536

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4760
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:1964
- C:\Users\Admin\AppData\Local\Temp\Autography\Station-Logic.exe
  "C:\Users\Admin\AppData\Local\Temp\Autography\Station-Logic.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:6044
- - C:\ProgramData\com_int_tool\Station-Logic.exe
    C:\ProgramData\com_int_tool\Station-Logic.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:1980
  - - C:\ProgramData\SpectraEmu.exe
      C:\ProgramData\SpectraEmu.exe
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: AddClipboardFormatListener
      Suspicious behavior: EnumeratesProcesses
      PID:5136
  - - C:\ProgramData\com_int_tool\Chime.exe
      C:\ProgramData\com_int_tool\Chime.exe
      4⤵
      Loads dropped DLL
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:2324

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1680

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e599216.rbs

Path C:\Config.Msi\e599216.rbs
Size 9KB
SHA256 8cd99a740fda3e6176db46f1b4eff6ca280783fa109aab234ead92ee5f22c1af
MD5 e733a3a5884a30176452ad1905008ebc
SHA1 ab84337cbc8ace122fade92c73ddcbdd11b291a6
SHA512 ece740e0861aecc82ba3ba5961f927924ffa9892aa06cdd1a7ac2df702482763b167486872557b5185a360567ffec78aa491d6a1145e872cd6ac2e2eb196567b
SSDEEP 192:ZAHlyCM2nbrkwmIArkwmnc970HKml36IU5U3pFDkS8hYLUuw:ZAHltrkwWrkws2mlXU
TLSH
T1FA124180B256C5E5E4502FBA97530B6477F2D3EFC381279B4C9E81345FA2B9C9E4A0C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SpectraEmu.exe

Path C:\ProgramData\SpectraEmu.exe
Size 2.0MB
SHA256 f8e409319baa062bbba8bb4114889d7e3dfc5774780aefc57a46f19ff407c18b
MD5 09d7f980ab256ee6f8d1a54109ff4749
SHA1 6a6cf9e5d630346bbfef72fb6b4356bfe33ff589
SHA512 b7a5154f962703de87f9de3e4a3f1742c4f00cb9ccd621142d3d9a343c4f8551dddd0e0ddbe2f18ab48903f8631252517aadad67b0d0169e83d8d187730ba743
SSDEEP 24576:J2PlcPsHsG4YRzktmJu6y72/WQ8ycZ4EM4w8zzoSsCyuiseEwCsDFDYBIP:oRmmJuZ72eQ5cZ4Eu8zXvwbEDQDYBIP
TLSH
T1BDA57D02FF81C877C0260731D89747F967B5FE502F65A69B32943F183E37B909A28666
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Chime.exe

Path C:\ProgramData\com_int_tool\Chime.exe
Size 619KB
SHA256 adb8347dfa1b1df1ca2211fe4d7e82f27ced939f1bf3d52548e52bc9e23fc52c
MD5 dd65b976d1865ba6c2368fcf9c9eb223
SHA1 db933b1ff0dc73c2e4f230aa3bd47646632d5714
SHA512 5ff91cc29744416a32789f277f2494bbe60bd1f2eb53ea48e538075e8d735420c0256b7798e8f99b9286bf8c3b0dcf5f1a1539b8f2792991fb7d5754ec6fa0df
SSDEEP 6144:+Zzvhs2Z4n1E7g34XtVYAOfTdH8zjQSYoLdnU4q:+J+2Z4nShVY5CjQxoLdnU4q
TLSH
T1DAD4BF33BD9E80E2CD6205B005A49D75FF6BAB300A758A7F22B5723AFBA01435D73552
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8A9D901.tmp

Path C:\Users\Admin\AppData\Local\Temp\8A9D901.tmp
Size 6.4MB
SHA256 bb9b2f97be2565cd1c8da1c39e4a5be8d8c18e56f289ed8061dadd7d2e779c93
MD5 9809fde5f479917fb7a0a66b322be193
SHA1 f34663d4ae8d57a7919e4d91c7015d63d33fa5e4
SHA512 8e6386face403d80cf22c49e292e0e48584bc9cd586113f18ef4594afd557ef439b0cbee9ded827c233e2ec023f811b4fc775419af4c9cc6f36fe33d976db202
SSDEEP 196608:qMT7W+6uLCd0nVeKR8+vR/dDMiSzlx8hHp+ItaTB:X9LQ0VeKG+/MiSzT89aTB
TLSH
T1E966338240F13FA922E7C7C4E7B0CA1E68577B8514937A2C7263FD2F61D724794346AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8A9D901.tmp

Path C:\Users\Admin\AppData\Local\Temp\8A9D901.tmp
Size 6.4MB
SHA256 bb9c2b1723fd0931bf827a04b1cf5c2dceb22775f3dc0bd82e005831fc0592d0
MD5 65cb382222e18d5e5208306cadaa673b
SHA1 2304e9d3f192b3b3fdc06e3f0f604f570f09deb5
SHA512 ab0e0648b33bcc65df33094a7dab7dfd4df5f98ac246b4cb1c54c284e12f42f25a1f997b80d7ef661c88cf71356aaeb7ace8ac530d9cc3543f5f9ef5c5528350
SSDEEP 196608:WMT7W+6uLCd0nVeKR8+vR/dDMiSzlx8hHp+ItaTB:z9LQ0VeKG+/MiSzT89aTB
TLSH
T17866338240F13FA922E7C7C4E7B0CA1E68577B8514937A2C7263FD2F61D724794346AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

K7TSHelp.DLL

Path C:\Users\Admin\AppData\Local\Temp\Autography\K7TSHelp.DLL
Size 118KB
SHA256 c8f7d8d9eef2476399e70a0859daecb0f2dde82a2dd06b89feedcd006e0cc4cd
MD5 8653e25713316a848fa8e6ba0ae30254
SHA1 dda883c3bf27cae34afff7517e998e7a983b1086
SHA512 502ae5a63afce71411aaddb0dbf9fdc6adf0fbec726abe5abbdd0c3a16382c5d8d071eff6d3fe2fd4e9460af21594466edd003b9decafb023499b03b3ec8dd9c
SSDEEP 1536:wk6Q65bINSsVTP32Ilk4kp9KvjOlMx6yAk72ZFnx4kzR7Wb5ctHRi7dHN:X6QI8N9jrkuOcB2kkzR7Wb5CRi75N
TLSH
T1F6C39E223495C0B7D0AA143E8456C2B64F777D209DAD5D8B3FD836EDAF342938B2534A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

K7UI.dll

Path C:\Users\Admin\AppData\Local\Temp\Autography\K7UI.dll
Size 582KB
SHA256 cb5f23db25beb1488652c6284e233c3bed51b14c645fcf4dbc5451294cb36251
MD5 e89d20c0bb10ef05e683ceb4d61776a9
SHA1 acd323148b25abc827f0a3df5a11bb35bf888b41
SHA512 b9b8f75a15017061ae4aabf390b9fb5ba4e72b809f8d3ed02e9f657fecb30dd8f486eab3cc65dd1fe667e9228d4001d43ddfb0cd3acbe02ac4950d6535ee8c22
SSDEEP 12288:HT3pDJ1ZWAmGDk4UFMOJzeAdTxq+IL0NezoZL9BfftkO4qMwhZ2007VzbT3:ztJ1ZW0jSj7hZ2007Vzbz
TLSH
T193C49E13BD80D033D9B7243146B8EAF5497C79301B68A6CBA3581B759E344D2BB3972B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VC90.CRT.manifest

Path C:\Users\Admin\AppData\Local\Temp\Autography\Microsoft.VC90.CRT.manifest
Size 599B
SHA256 960711837e9893fa161fd9349ec4a5cbb41a4c77175d0960586336bc09b0cb2e
MD5 647f5101ebc822a1fff4ac39ca22b27e
SHA1 8af059c590aa1679892857dc21a951555785c2e5
SHA512 76843dc5925e33ea1c1b23214e113e3f3a2f5672c0e06ff3816d24fe8f53b49b63d85ca02a2cc0e842917d225598977cc9212a8269e131e0e0a6775ae45f69a9
TLSH
T13EF0E190D188BD7E530232E0DF23E809994803230D9D436894FE7E2F3E1381445A70B3
MD5 SHA1 SHA512 TLSH

Submit Download

Station-Logic.exe

Path C:\Users\Admin\AppData\Local\Temp\Autography\Station-Logic.exe
Size 592KB
SHA256 e7e5e7086870d785c55cde559c34d61552fe7ba2cffea32a436b66c21b1f79d2
MD5 7f80c268a2ba5f15c87260198c5154c4
SHA1 25feb78f8df3c814d6ee5d99ea662758033882bf
SHA512 44d4f6dcc98bc09285818d23b47d5895690150fa4f50d971eb26806472e9cb85809c39640b8896c443d09fb22f88447a60eb06d2a0eb9eae841abba722e27454
SSDEEP 12288:EjIOTtZInMJF5o9H+NFQ+Bv2s+XGZuigrEWs/bCMyUJwtG:EjI+tZ3o9eHIisLs/bCMyUR
TLSH
T19FD47C21FA808036C5B734714BBED5B21DBD68311B2549CB63889AB95F341F1BF3962B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

broker.lib

Path C:\Users\Admin\AppData\Local\Temp\Autography\broker.lib
Size 5.4MB
SHA256 f44dc45f71ac594117fd2729fc3b9f52e9bbd56ffbac17fb628701899a0a4668
MD5 fd2edd9b623426b6e013e73b3c320a74
SHA1 a890ecd30eb4675c7252fd46e58d6cb5eb2889db
SHA512 3fb8c89ed6082fa0125e5a409eccf9acfae1a88fa4bf9d6758a5f54ff5c53d94d54d9b0bc2cf56a59b40225266535a61b4d16e824d073756e7b8942cc571059a
SSDEEP 98304:KRYJi4idXI68dXCxbRrPb4E4tsrQdXEr0MFXRgM/8uN2WYD5g0d:MXXcdyZFPb4E4s0EgMxRg7NNZd
TLSH
T1BA462381D49D6F3AD007773F0015DBFA23626F123A16BD9B710942AA83C6B5E5709FAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp_win.dll

Path C:\Users\Admin\AppData\Local\Temp\Autography\msvcp_win.dll
Size 485KB
SHA256 55043a5dbe9b4bfe50e2e6be0bdf77a69a075becc520700dcaffb1d9f7686138
MD5 bbc3c4543a00bc1e2130921ddc3ed3ca
SHA1 f7fe6df7187c3e11da67bc7f089113d61935364c
SHA512 2c8f44308a7344730423a8cf956d234ee46c9818c8ad13e19ba9019a99f9905aa5e326a2203ba462521ad626f015808abf9c34a3cfe3b660b6f321de540a95ab
SSDEEP 12288:3m8MyfWVRsPsxy60whuhFbCu8hUgiW6QR7t5s03Ooc8dHkC2es/oLG:yy+sPsxy60euPbn03Ooc8dHkC2eyoLG
TLSH
T1F8B43A3377410EB1E59A63B0218E973593F9ECA64761E3C393DAF1A96F243C29533681
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

signalspec.lib

Path C:\Users\Admin\AppData\Local\Temp\Autography\signalspec.lib
Size 19KB
SHA256 de13761793b3e153e778c11f55aa2ed5090e5d0a972cdcfa2253b1425d67518d
MD5 d79f8c74ea00df2b3fbe5ce52aeb1d0d
SHA1 5818277ed5bdff792bc21cc4c5c516162402adf0
SHA512 125aefd0bef74c5ed62b109bad18102bde2a162deba75186515a9a5c0fc02636b08efbe53f2352959ff5eba92c01823cbe47d271b4e925d66059c22a9eaf5b34
SSDEEP 384:Ox/ra/E5GpTzhwcGHysvtOmgqa72siHr5DCzfxt5TxVyxvyEVEeYz:Ox/OEGpTycemmgqHkVy8Tz
TLSH
T189928E79852E2717A4012C79481090F7D29439BF732F1463B797AC97B01B19AD7C6C37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\Autography\ucrtbase.dll
Size 1.1MB
SHA256 71358d729b01bdf38dbe5440705ea68ea9225f93c834f45c5687b0ea2b417c4e
MD5 d4cf3fd5e8ee95431cfea69fa84ae57d
SHA1 80f5188570001e4fd5fdad9cbf38479dd4edd255
SHA512 a30488c43ca41ed36ee2917fe8e7a5280e0565859f719a1f709b13c18c3398f323c8ef24608e8f696214d9fe882c32b1a8686800490ca781196810220b30d43b
SSDEEP 24576:YWisOihSAdUDRdwE0OpuE4N7qWkGA+g7lyD6ZQtpmcvIZPoy4cncF4dN:zisOihSlDZuNN7qLZyD6yt6nccN
TLSH
T1B6453A093585E0AEDC6D3679136BB522346C76924BA8ECC373840BE98E305D17736EDB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

B5FF564.tmp

Path C:\Users\Admin\AppData\Local\Temp\B5FF564.tmp
Size 40B
SHA256 ac00d9f5db4043d59558e1489cb6596305bdcbd97b920b797473d8bd6c965549
MD5 0584728cdd2a177463940689b3b40b7c
SHA1 e10bc0c0b5adf4c02924be7074060efcbb09906e
SHA512 24002da0952a6e638d0018951891d635ccd686e834cdf75a6a16bf892f406f52c449320715a60154d1261076e6356167df8d9dae7bfd74ed2e6900b1a597828e
MD5 SHA1 SHA512

Submit Download

e599215.msi

Path C:\Windows\Installer\e599215.msi
Size 5.7MB
SHA256 0614cca495539cfe5c281a638060f1d9c990b6be0eda7c3bdbb363bd4f18206c
MD5 37358924913be0711498ffcd131069b4
SHA1 e0b742907e5e3b684303e9f0dd6b0b283a138357
SHA512 ba680b33c36baf72f9c6f942f096a6dd1114d5f4986ebc4e54f77083865aa4a7ff9e02dd36ba094c587d3a0ff9be0886806083f417059e516dedd2eb0db21113
SSDEEP 98304:jUYRsz36Of0o5GIb5nN3ImCWZd5BBVJd1ub+FrBpXrWaF+bmSB9bfG:jd0j/YC5numCoLP1mqrRFjSne
TLSH
T16756337C3A932B4AD19A3734076ADA7743ADFCD85AADC5038914B5256B303A0D0B3FE5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 60c477c91fb1650eaea8d621fc93d0f6f8656713e6a80b4b43a8172d2bea58ec
MD5 ffa52de4fe1e21dfbe814a77793fd0ad
SHA1 a3d62b995ba404a08fd863ca283fdca20e3e97c9
SHA512 a400adfaec48cc6bd045731892aad1429cf2065f46e2d3faa87486718672bd11dcb2a5ed258a7dcba7396609becd0cf4b12bb1c8b93484fe2074b6ac0d59f8c2
SSDEEP 24576:AFo3DMPcdoO/vvTL/Sg88iFQvrumHb7P0BKudxSUKpyKpb9cMoRWclmd4+O:5HA
TLSH
T12E57B42436F92200E7F79E3DA8F06A234D397D5BAC15DE8D45511B4E0822F71E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{5cde8f95-69f7-496b-9389-821a98c96aa7}_OnDiskSnapshotProp

Path \??\Volume{c61f3bad-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{5cde8f95-69f7-496b-9389-821a98c96aa7}_OnDiskSnapshotProp
Size 6KB
SHA256 cc966c308ac5e5b21bef4f39d3cfdeb150b4a38ebe8de1be3fa5ae73b1acd148
MD5 3440bfbb02014cecec4091b1ec081a0e
SHA1 4ff727dff00e6e71f8e53531114c50f8bfb7bf91
SHA512 1875a07b4ac40e3a6a37e17d43c05f142e513ed38ff076b4ee39e442b847073895245502ec5e12571f3f0c08bdfb6b5d1172628983e6b9021bb61b4231e42fd1
SSDEEP 96:FZg7bCvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpuN:3keb++uVmN
TLSH
T1DDD188081AE54711E2B3AB3129F14557A877B911FF33CB8E0298238E2671A10F935F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1980-43-0x0000000074950000-0x00000000749A2000-memory.dmp

Download

memory/1980-44-0x00007FF8DB260000-0x00007FF8DB4C3000-memory.dmp

Download

memory/1980-46-0x0000000074950000-0x00000000749A2000-memory.dmp

Download

memory/1980-51-0x0000000074950000-0x00000000749A2000-memory.dmp

Download

memory/1980-62-0x00000000007E0000-0x0000000000875000-memory.dmp

Download

memory/2324-67-0x00007FF8DB260000-0x00007FF8DB4C3000-memory.dmp

Download

memory/2324-74-0x0000000074950000-0x00000000749A2000-memory.dmp

Download

memory/5136-79-0x00000000006C0000-0x0000000000A59000-memory.dmp

Download

memory/5136-78-0x00000000006C0000-0x0000000000A59000-memory.dmp

Download

memory/5136-85-0x00000000006C0000-0x0000000000A59000-memory.dmp

Download

memory/5136-84-0x00000000006C0000-0x0000000000A59000-memory.dmp

Download

memory/5136-73-0x00000000006C0000-0x0000000000A59000-memory.dmp

Download

memory/5136-58-0x00007FF8DB260000-0x00007FF8DB4C3000-memory.dmp

Download

memory/5136-77-0x00000000006C0000-0x0000000000A59000-memory.dmp

Download

memory/5136-53-0x00000000006C0000-0x0000000000A59000-memory.dmp

Download

memory/5136-59-0x00000000006C0000-0x0000000000A59000-memory.dmp

Download

memory/5136-80-0x00000000006C0000-0x0000000000A59000-memory.dmp

Download

memory/5136-81-0x00000000006C0000-0x0000000000A59000-memory.dmp

Download

memory/5136-83-0x00000000006C0000-0x0000000000A59000-memory.dmp

Download

memory/6044-33-0x0000000074950000-0x00000000749A2000-memory.dmp

Download

memory/6044-34-0x00007FF8DB260000-0x00007FF8DB4C3000-memory.dmp

Download