hijackloader | 0f4c88692e3ecd28faed2dc9ee55b89025812290013c589630724a2d10b08491

Resubmissions

02/10/2026, 18:02

261002-wmj6xafd9410

02/10/2026, 17:59

261002-wksehawxcw10

02/10/2026, 17:52

261002-wfs58stbmb10

02/10/2026, 17:49

261002-wd9p7stame10

Analysis

user interaction
yes
max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 17:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
formulario_agendamiento_citas.msi
Size 3.4MB
Sample261002-wfs58stbmb
SHA256 0f4c88692e3ecd28faed2dc9ee55b89025812290013c589630724a2d10b08491
MD5 abad2602405c70128600272b963f8684
SHA1 1b03084432417dcb52cb941f44d045422f28461e
SHA512 31196e270395edd5006513f4526f5d216d3ea5e141940e763e89aac4868f664c7e33f712bb4908a2b4bfe510489c0b9fb2dcb9dbaa716fb90889d1f195209c97
SSDEEP 98304:Ji8Pm7HFGqc7n1tj0Pr9fD2zPUKRHSAq2d/VoSf6:88Pm7sqcLjgpDMRyb2dhf6
TLSH
T1ABF5338F3E245B89C4CED136959F837486D0CC9B5B9FA7427809352318F67A4B0E52BA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

septiembre 30 alquiler 02 defense_evasion discovery hijackloader remcos loader persistence privilege_escalation ransomware rat

Malware Config

Extracted

Family

hijackloader

Attributes

directory
%APPDATA%\NODECmd
inject_dll
%windir%\SysWOW64\input.dll

xor.hex

Extracted

Family

remcos

Botnet

SEPTIEMBRE 30 ALQUILER 02

vertanisgr.vertanisgr.com:2206

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
Acobatlg.exe
copy_folder
edqelofh
delete_file
false
hide_file
true
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
true
keylog_file
logs.dat
keylog_flag
false
keylog_folder
costeog
mouse_option
false
mutex
Rmc-UPTMQ7
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Extracted

Family

remcos

Version

7.3.1 Pro

Botnet

SEPTIEMBRE 30 ALQUILER 02

vertanisgr.vertanisgr.com:2206

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
Acobatlg.exe
copy_folder
edqelofh
delete_file
false
hide_file
true
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
true
keylog_file
logs.dat
keylog_flag
false
keylog_folder
costeog
mouse_option
false
mutex
Rmc-UPTMQ7
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Family: HijackLoader, IDAT loader, Ghostulse,
HijackLoader is a multi-stage loader, first seen in 2023.
loader hijackloader
Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Detects HijackLoader (aka IDAT Loader) 1 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c610-39.dat	family_hijackloader

Executes dropped EXE 3 IoCs

pid	Process
5384	Monitor_Vorte.exe
2028	Monitor_Vorte.exe
1152	Monitor_Vorte.exe

Loads dropped DLL 14 IoCs

pid	Process
5384	Monitor_Vorte.exe
5384	Monitor_Vorte.exe
5384	Monitor_Vorte.exe
5384	Monitor_Vorte.exe
2028	Monitor_Vorte.exe
2028	Monitor_Vorte.exe
2028	Monitor_Vorte.exe
2028	Monitor_Vorte.exe
4544	CacheHandl128.exe
5592	Spec.exe
1152	Monitor_Vorte.exe
1152	Monitor_Vorte.exe
1152	Monitor_Vorte.exe
1152	Monitor_Vorte.exe

Enumerates connected drives 3 TTPs 47 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
	\??\F:\	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2028 set thread context of 4544	2028	Monitor_Vorte.exe	100
PID 2028 set thread context of 5592	2028	Monitor_Vorte.exe	101
PID 1152 set thread context of 6012	1152	Monitor_Vorte.exe	104

Drops file in Windows directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSID20C.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF04C9AEC64AA4E629.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF39FA50B1615F2A0A.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{76FDB0E2-B267-4CB8-B110-A1B0D92E3D4D}	msiexec.exe
File created	C:\Windows\Installer\e59cc41.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFCE86FC58D0B403A3.TMP	msiexec.exe
File created	C:\Windows\Installer\e59cc3f.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e59cc3f.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF9BE7423942EC05DF.TMP	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
3512	msiexec.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	CacheHandl128.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	CacheHandl128.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Monitor_Vorte.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Monitor_Vorte.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CacheHandl128.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Spec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Monitor_Vorte.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000094b15be3c89983180000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380194b15be30000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410194b15be3000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e394b15be300000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e694b15be300000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
4140	msiexec.exe
4140	msiexec.exe
5384	Monitor_Vorte.exe
2028	Monitor_Vorte.exe
2028	Monitor_Vorte.exe
2028	Monitor_Vorte.exe
2028	Monitor_Vorte.exe
5592	Spec.exe
5592	Spec.exe
5592	Spec.exe
5592	Spec.exe
5592	Spec.exe
5592	Spec.exe
5592	Spec.exe
5592	Spec.exe
1152	Monitor_Vorte.exe
1152	Monitor_Vorte.exe
1152	Monitor_Vorte.exe
1152	Monitor_Vorte.exe

Suspicious behavior: MapViewOfSection 1 TTPs 3 IoCs

defense_evasion privilege_escalation

Process Injection

T1055

pid	Process
2028	Monitor_Vorte.exe
2028	Monitor_Vorte.exe
1152	Monitor_Vorte.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3512	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3512	msiexec.exe
Token: SeSecurityPrivilege	4140	msiexec.exe
Token: SeCreateTokenPrivilege	3512	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3512	msiexec.exe
Token: SeLockMemoryPrivilege	3512	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3512	msiexec.exe
Token: SeMachineAccountPrivilege	3512	msiexec.exe
Token: SeTcbPrivilege	3512	msiexec.exe
Token: SeSecurityPrivilege	3512	msiexec.exe
Token: SeTakeOwnershipPrivilege	3512	msiexec.exe
Token: SeLoadDriverPrivilege	3512	msiexec.exe
Token: SeSystemProfilePrivilege	3512	msiexec.exe
Token: SeSystemtimePrivilege	3512	msiexec.exe
Token: SeProfSingleProcessPrivilege	3512	msiexec.exe
Token: SeIncBasePriorityPrivilege	3512	msiexec.exe
Token: SeCreatePagefilePrivilege	3512	msiexec.exe
Token: SeCreatePermanentPrivilege	3512	msiexec.exe
Token: SeBackupPrivilege	3512	msiexec.exe
Token: SeRestorePrivilege	3512	msiexec.exe
Token: SeShutdownPrivilege	3512	msiexec.exe
Token: SeDebugPrivilege	3512	msiexec.exe
Token: SeAuditPrivilege	3512	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3512	msiexec.exe
Token: SeChangeNotifyPrivilege	3512	msiexec.exe
Token: SeRemoteShutdownPrivilege	3512	msiexec.exe
Token: SeUndockPrivilege	3512	msiexec.exe
Token: SeSyncAgentPrivilege	3512	msiexec.exe
Token: SeEnableDelegationPrivilege	3512	msiexec.exe
Token: SeManageVolumePrivilege	3512	msiexec.exe
Token: SeImpersonatePrivilege	3512	msiexec.exe
Token: SeCreateGlobalPrivilege	3512	msiexec.exe
Token: SeBackupPrivilege	1980	vssvc.exe
Token: SeRestorePrivilege	1980	vssvc.exe
Token: SeAuditPrivilege	1980	vssvc.exe
Token: SeBackupPrivilege	4140	msiexec.exe
Token: SeRestorePrivilege	4140	msiexec.exe
Token: SeRestorePrivilege	4140	msiexec.exe
Token: SeTakeOwnershipPrivilege	4140	msiexec.exe
Token: SeRestorePrivilege	4140	msiexec.exe
Token: SeTakeOwnershipPrivilege	4140	msiexec.exe
Token: SeRestorePrivilege	4140	msiexec.exe
Token: SeTakeOwnershipPrivilege	4140	msiexec.exe
Token: SeRestorePrivilege	4140	msiexec.exe
Token: SeTakeOwnershipPrivilege	4140	msiexec.exe
Token: SeRestorePrivilege	4140	msiexec.exe
Token: SeTakeOwnershipPrivilege	4140	msiexec.exe
Token: SeRestorePrivilege	4140	msiexec.exe
Token: SeTakeOwnershipPrivilege	4140	msiexec.exe
Token: SeRestorePrivilege	4140	msiexec.exe
Token: SeTakeOwnershipPrivilege	4140	msiexec.exe
Token: SeRestorePrivilege	4140	msiexec.exe
Token: SeTakeOwnershipPrivilege	4140	msiexec.exe
Token: SeRestorePrivilege	4140	msiexec.exe
Token: SeTakeOwnershipPrivilege	4140	msiexec.exe
Token: SeRestorePrivilege	4140	msiexec.exe
Token: SeTakeOwnershipPrivilege	4140	msiexec.exe
Token: SeRestorePrivilege	4140	msiexec.exe
Token: SeTakeOwnershipPrivilege	4140	msiexec.exe
Token: SeRestorePrivilege	4140	msiexec.exe
Token: SeTakeOwnershipPrivilege	4140	msiexec.exe
Token: SeRestorePrivilege	4140	msiexec.exe
Token: SeTakeOwnershipPrivilege	4140	msiexec.exe
Token: SeRestorePrivilege	4140	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3512	msiexec.exe
3512	msiexec.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3512	msiexec.exe
4140	msiexec.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4140 wrote to memory of 4756	4140	msiexec.exe	95
PID 4140 wrote to memory of 5384	4140	msiexec.exe	97
PID 5384 wrote to memory of 2028	5384	Monitor_Vorte.exe	99
PID 2028 wrote to memory of 4544	2028	Monitor_Vorte.exe	100
PID 2028 wrote to memory of 4544	2028	Monitor_Vorte.exe	100
PID 2028 wrote to memory of 5592	2028	Monitor_Vorte.exe	101
PID 2028 wrote to memory of 5592	2028	Monitor_Vorte.exe	101
PID 1152 wrote to memory of 6012	1152	Monitor_Vorte.exe	104
PID 1152 wrote to memory of 6012	1152	Monitor_Vorte.exe	104

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\formulario_agendamiento_citas.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3512

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4140
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4756
- C:\Users\Admin\AppData\Local\Procuratorship\Monitor_Vorte.exe
  "C:\Users\Admin\AppData\Local\Procuratorship\Monitor_Vorte.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5384
- - C:\ProgramData\NODECmd\Monitor_Vorte.exe
    C:\ProgramData\NODECmd\Monitor_Vorte.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:2028
  - - C:\Users\Admin\AppData\Local\CacheHandl128.exe
      C:\Users\Admin\AppData\Local\CacheHandl128.exe
      4⤵
      Loads dropped DLL
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      PID:4544
  - - C:\Users\Admin\AppData\Roaming\NODECmd\Spec.exe
      C:\Users\Admin\AppData\Roaming\NODECmd\Spec.exe
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:5592

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1980

C:\ProgramData\NODECmd\Monitor_Vorte.exe
C:\ProgramData\NODECmd\Monitor_Vorte.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Users\Admin\AppData\Local\CacheHandl128.exe
  C:\Users\Admin\AppData\Local\CacheHandl128.exe
  2⤵
  PID:6012

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Process Injection

T1055

Defense Evasion

Process Injection

T1055

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59cc40.rbs

Path C:\Config.Msi\e59cc40.rbs
Size 9KB
SHA256 42179ce1ae24db02260bd397eb7e7fdf22e16ede0decb0565142ce5276a584b4
MD5 be1dcfed127179d7f65e8de86f80c833
SHA1 7efc055a286958b618b861feeb8059d2939d29fa
SHA512 d19d170b8c30ac2f07418282f2ea564dbe176c6545921c49276e739f4c911afc593e5afda42eae7ad6f8cd41fa15c007212ef5ce596bcdbe144c3fcb5c9cd129
SSDEEP 96:WtDQuMjPnsZwgAUdtOl9iCJ/9hUS3PcCsThqdUS3PcC6jruYAThq8HDWO1ZSpOBy:WVQljoCLaCzIDCz3ZLqhIpI
TLSH
T17F123D80A550C2E2EC5E2B3287263768B3B2D2FDEB11230B056DC45C5F47B986F9D8D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CacheHandl128.exe

Path C:\Users\Admin\AppData\Local\CacheHandl128.exe
Size 243KB
SHA256 4d4416d4d139cf8d6d55e6393e9b007b415cbf8b52cf6c0306987c461e515c37
MD5 d9325ea7008d71a5c6c096936f9dc611
SHA1 1062789ad7320d24559287549b874c3b82056c14
SHA512 f4068146a945e50a94951ca4f0dcf69e060d501a64ae06626c39aaf8405b79a41d46d28b100b65fdeace38ae8d384dabe3f536c6fe17688335728e857d6e456f
SSDEEP 6144:DEUX/rTDeCXFkvOTMUN3qzURe0pkk73ESCjYDnI:DEgrvjXFkvOTTN3qSlpkk737s
TLSH
T13B34F14567D4C033E0F14EB16A72AB510EB6FD1548B8850F9341EE8E7E31782DA2EB5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MFC42.DLL

Path C:\Users\Admin\AppData\Local\Procuratorship\MFC42.DLL
Size 972KB
SHA256 aa8c615c8bbcd8ad4a9b624addb512e0702223eb5f266ce8f6a9a005f718a483
MD5 28f2911af34f73259a9c5dffcbf71a00
SHA1 ab00aa78540eced023d8a8484cdcdb7132c4fbed
SHA512 f58b47e485411c21d96afda97cc08d51ebb3c05e060411f6be98db309a485d71e35de7ffd5a413800934dfac3b8101b123b7e1d35c0c1108caea9b36eb8d7d11
SSDEEP 12288:ZDuuMGWwg2zR5wrbY8pH21TQYfuSuyKixQTUUAex9mSCQiF7Jm7VynzY09hctGa:8uP3cbY8tGvF3KiDU3PvZHUn6n
TLSH
T135258B0337E4D675D2A755344F296BACE6FAF9A05D31BA0737A01AAC2D34E024727372
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSVCP60.dll

Path C:\Users\Admin\AppData\Local\Procuratorship\MSVCP60.dll
Size 392KB
SHA256 2b6b93c2d66969eb00258e2b5ad6172decebada096e3b1b077a3380c80e4a072
MD5 6050bcc1b23f3df7a1876cbdcbac8232
SHA1 8770ec0910b7cc9a0461a40dfb495ee7f5b4267b
SHA512 84bd1695304c3098bb82bdf06cc5a756f3e7c4e6c7a22e9dd266d49619a34ba7baa833b167d49954d3aaa1860adac195d9b19f1252f09cc9657eccbecc5934f9
SSDEEP 6144:gqUZYxtIwVzqzV5pr28De/zG4H6fydNQ3fq3OoxHkCmv6f1lH:Jlxt1Vzqf128a/1H6K+fq3OoxHkCJfr
TLSH
T126841913334746F2D59363F42BC503139BB9BC684A64B313E6DBF1651F6A28992B3E60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Monitor_Vorte.exe

Path C:\Users\Admin\AppData\Local\Procuratorship\Monitor_Vorte.exe
Size 1.7MB
SHA256 25e01c9e67f77c400ac7d922afba7750eb155ccb57f60f77f9c27acee991e96c
MD5 ceffcec7b39e43c4913f1de061851b08
SHA1 90a8e862405c6c9b24db158a26dae003f3482659
SHA512 2008a25a4bcac5fe8727cddba2d37be0f2779213bf613917af51ff5aa0ca25c06a7d8e0c2bf3641110b7a5988dacae1176fb18172f591272cdfaf5c19d1d97b4
SSDEEP 24576:PVUZ+xyupu8qFkvtjXyhcQuG2U0ffH+4QEqZknfKBtTxCA//ZYtTagjEpuG:PVUZ+WVJb//ZyTrEpL
TLSH
T17E852A02E2CAC255F7873334981CA679E520953A9934EDF73769EE34E7321436C39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

covrun32.dll

Path C:\Users\Admin\AppData\Local\Procuratorship\covrun32.dll
Size 1.2MB
SHA256 73f15af15db32bff2986e63bdf15fc8284bc091584a8f3c28acb3569c7b4daad
MD5 7ca5828b1a6e101954680e4a048ac3fd
SHA1 9e29210e55f2aab38b05a3a5206b98907c4ec0f8
SHA512 bba4f31625db5e55dfe2d352bf53f82a762a262f45bf17d8946f420febc0d73e3ca52f731c1221b3f471f8a2f1140889c77bfe6893be901d0c0b99124d977841
SSDEEP 24576:DvgVx+HPP+iqF9RXI/Nco6Y8XqyVHNotKhuR79jdt7OEawJAYe3wzpBLnm2Wnj/n:TzHuiqF9R4FcYyqyVHNotKsvjdhOyJAr
TLSH
T1544539113295F025ED7D3E71183BEAAB5EFDBA613B7080FB53846A5B58206C1DE30E16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

entity_reg.dump

Path C:\Users\Admin\AppData\Local\Procuratorship\entity_reg.dump
Size 1.4MB
SHA256 85cf0fb55a672c757d9c04f48f4a7de5ebc8d68d0aa76ab93423fb6f5a041944
MD5 ba8f6c42379c6d1b6b9c68450064d993
SHA1 71b2f981f875551ad26de6dd4f74eea4b814b6f2
SHA512 1a5cc492df7748cb97332fcca81db3b56e573ad97c93583b57e4085898efe7c3ba812b2c2886274635b3c2d0b4411603afcc88bd6012d4a2b578f67ae1a976c0
SSDEEP 24576:aDMHRBNxxovF6t7yNOgLX4XgvEfDexDltLsRHdRBlqYwhTf2ALozRIgCATI/DWch:aQHRBNbLtuN78bYLsxdRBlxwhD2sozeN
TLSH
T19765336EABFC6522C7298B398A65700AFDDC112E1C5913A7F3B7AD4706140BA4C4DFD2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp_win.dll

Path C:\Users\Admin\AppData\Local\Procuratorship\msvcp_win.dll
Size 493KB
SHA256 7a3d3b2dd5dbc304a1b0536ef0f9a41922e9ce06a25e9914a36d3160ba1f3d40
MD5 a91d604885dfb689678bc1cb5ae1d764
SHA1 3cf32b2eefbaf9bd49b278d8b11840db7cc70b5e
SHA512 d1387d768ff8c78a049880e4b16f57b98a3297048ccc5de3196889f2598e1bb265844f51e293a35c8190aea1b055bbda04e2e97528598a37398a7cdcaf6cf342
SSDEEP 12288:HeMcMmVRYcFERWKn9g82vWirmzbAhUgiW6QR7t5s03Ooc8dHkC2esJ2Sq3a:HeMKYXQKn9g82vtubf03Ooc8dHkC2ecH
TLSH
T1BAB44B332A4109F1E48A23B4618D936283FDED650361A3C357EEF9AD6F6D2C06A771C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

runtime-agent.yaml

Path C:\Users\Admin\AppData\Local\Procuratorship\runtime-agent.yaml
Size 14KB
SHA256 2265b896d440f420946696e0c16e0c2a22506f968b7d0303a9a0c3064adddb0a
MD5 16c308154d8c188e72fb0ccd15ce92a0
SHA1 877619d76fa12ab74fee9501e73df666035edca1
SHA512 433823c8f306fc186c666204538016e2610e271f6e3a57feefe90c02030b3d5e66ae0f535cc02d77fc3ea83872e42df4cc5ed58db9bd03ada24eeff8fdf2a3f0
SSDEEP 384:1DmxLxihUi0P4Q494qmRw/7smap7KkFwGImalHHpt:1DmLxpiI4Q494qcFmapDS+alX
TLSH
T1DF627CA35D0D36152F06A77CA61DB8D68A90E457600F30BE21DD0427F85399EDE27F93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlapi.dll

Path C:\Users\Admin\AppData\Local\Procuratorship\sqlapi.dll
Size 564KB
SHA256 a17a194ea885c21c20247e1006e02d903f9f3d0c99b57995381fcc0e9fd3670a
MD5 595e779c4e3b9c41346acfd7d4472c15
SHA1 2dd2595aa12458d4350f76446f6957751cd31e93
SHA512 f6df580eb143a73f4d7893a4089df027f98dd88f7cd8c607a17932ea764267f58e40b881f7d58df4874ba9eb6d2e1e140a94c339aabc575dab4e709e194bec52
SSDEEP 12288:NOH4NUqySOpaq2PFXTWb9CJD1GOxzof8K3Ay:NOH4NrBOsxFXTWb9CJD1Lz+73Ay
TLSH
T18CC47B1276B641B2DA4D233405686F39C87D9FD843378BC36268EE7945B32D2793F21A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Procuratorship\ucrtbase.dll
Size 1.1MB
SHA256 b59c1f7e457b144a211b74b31492a68a7844232121c4046c7538b0d2ab3cfc31
MD5 6c6c82d1efb4a4f1663b274eb9c33938
SHA1 37ac5fc535269de784ee7a452e5a9bc6ea57798e
SHA512 933d9d109d6dcae8e69b634721a29b963d64330943fddadfd889bbbbd63690fe6beaf35f5d150dd2e29cff89b6379d187cf6a87d8b731c5b68bacdc749859fa2
SSDEEP 24576:/QeCoON4h/4z/G1YknUkY3Ub6lymQmcvIZPoy4yuhp1Rz+:YeCoONs42nUv3Ubftp11+
TLSH
T196358C107895C2A4CCAD30F51A8EFA36466DB5904F24A8C377D41BFFCC690D0A9F769A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

B52A26B.tmp

Path C:\Users\Admin\AppData\Local\Temp\B52A26B.tmp
Size 1.6MB
SHA256 eb322c2eadf40959fba8af3d13746701a862ec1acecd32afe90b28f3ca765a9b
MD5 78f2a899b97ac58904a22083f12382a8
SHA1 5759422cceb05855bbc0c9c94cfe74cd3dc44359
SHA512 688bb66ae3aa4dfacb9a01e390cb106584e4d0258ea805da73333fb0959ce7a352c95a24ca9243d98649bd42e4511e906edcea16f05d721e4c37fec9d1a8e144
SSDEEP 49152:PrWN3jhOYER0GGV9nt4yNdfJFv78FvLTpY7LqUb:jA4dR0GSnHJFIFzpy
TLSH
T1B0753310438D90AFFCCCA091536CFB286255BD5224A04F448AB1EB9FFF7D69E5926F90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

B52A26B.tmp

Path C:\Users\Admin\AppData\Local\Temp\B52A26B.tmp
Size 1.6MB
SHA256 2ed6e62b080267de6eb4245c0d685280c4bf8bd9d2ef8199c0d1e5efe0388014
MD5 45f850abe4b8e9fe8f69ef074b34a648
SHA1 bbdd76b4b1a8692432bed62210e16e01ffd5f528
SHA512 96119924894f780cd76ab9ff79f1e95d7f800bb94fe32967c7faad770837eca0213e32e8fb033f59059ddc79d97b33b68ec068ee8753a7820dafd5fb8d3ca496
SSDEEP 49152:1rWN3jhOYER0GJV9nt4yNdfJFv78FvLTpY7LqUb:5A4dR0GhnHJFIFzpy
TLSH
T17F753310438D90ABFCCCA091536CFB286255BD5224A04F448AB1EB9FFF7D69E5926F90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EA7C557.tmp

Path C:\Users\Admin\AppData\Local\Temp\EA7C557.tmp
Size 40B
SHA256 eb97ad4e0330d33e34b8227ec3f07fb8de158ae907342401f833b54a676c38fa
MD5 5f90c607e9dee1a67bad09425e585e44
SHA1 272556cb43074d22b8b5e104a932bb261024f9ed
SHA512 4098e22bfceac36c2a79c759b03f076ebe5793d99d368a75a6dd036e0f24d05a03359c7ff38b275e16e237d5eb3cc648d014ae9e9e1f48b645a70c775a3a5375
MD5 SHA1 SHA512

Submit Download

Spec.exe

Path C:\Users\Admin\AppData\Roaming\NODECmd\Spec.exe
Size 144KB
SHA256 f99c12933c36ac9b9d33340145434a7d68f1688a7805ca325379a4b927521c99
MD5 7aa9b25a26dea6c18eb6f12bd12fb3b0
SHA1 c733f9e98bed9bde335bb36efedfb2010132e050
SHA512 cadff10f1e31103e443102ff950df5cb586372933899de6e50b83033ae55407f41ed9169c819b7cbcd71190fb960d3d916002312e5836594eadfa54dd84b36c2
SSDEEP 3072:zxxPGrlqO+NDWQ+WMqoQpFWzqSlxmW6PrbFSr:FUrrQ+WMMFWzqSnsXFa
TLSH
T1EBE3D08127703805DE524E31A4E4DB383A3C7D45AF0089BB325BF78F9B73781B95A269
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59cc41.msi

Path C:\Windows\Installer\e59cc41.msi
Size 3.4MB
SHA256 0f4c88692e3ecd28faed2dc9ee55b89025812290013c589630724a2d10b08491
MD5 abad2602405c70128600272b963f8684
SHA1 1b03084432417dcb52cb941f44d045422f28461e
SHA512 31196e270395edd5006513f4526f5d216d3ea5e141940e763e89aac4868f664c7e33f712bb4908a2b4bfe510489c0b9fb2dcb9dbaa716fb90889d1f195209c97
SSDEEP 98304:Ji8Pm7HFGqc7n1tj0Pr9fD2zPUKRHSAq2d/VoSf6:88Pm7sqcLjgpDMRyb2dhf6
TLSH
T1ABF5338F3E245B89C4CED136959F837486D0CC9B5B9FA7427809352318F67A4B0E52BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 405114c613b928c6bfe583cd6188041b5c83551249d1290fef837762af0375cc
MD5 d89c1141def8d64a5dc547f2a4331e0c
SHA1 4dac6206d3d193389da394463915a1513b4ef987
SHA512 057bba9191fa6f96bd290599f751a066373025da31fd5afa4bf619a64024633617c53bd0c645b1a7f126dac097cf496fb4094eb66579c350d0292ae2a3d24d0f
SSDEEP 24576:0Fo3DMPtdoO/vvTL/SwddCFgfr+XG7a+kQ7vtwTVLYzK5qcN8Yh2dEns5O5:4HM
TLSH
T11157A22436F92120E7B79E3CB8F06A63493D7D5BAC15DE8D45411B4E0822B71E872F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{8c169812-583e-48f4-8d6e-a8bda47264e7}_OnDiskSnapshotProp

Path \??\Volume{e35bb194-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{8c169812-583e-48f4-8d6e-a8bda47264e7}_OnDiskSnapshotProp
Size 6KB
SHA256 7e293272750da9e8220fcef994d10e4083b59a25e0a0c52fa4f4f9fe731fd24f
MD5 054599535be681117a361c55359eef7b
SHA1 fc1f84b319f9350fd869e4430755a705d4da7833
SHA512 3f1cd774182ad0c7b67d03236c21969acb443133ed197a1c536ea089853746b08ea210f5f0298335ccfe17c3b8175f068e94aa9f885e3155c61b64c0959a031b
SSDEEP 96:F7tLHiUvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpuN:ttLrb++uVmN
TLSH
T12BD188181AF54311E2B3AB7128F14557A877B811EF33CB8E0198238E6670910F976F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1152-101-0x0000000075130000-0x0000000075182000-memory.dmp

Download

memory/1152-97-0x0000000075130000-0x0000000075182000-memory.dmp

Download

memory/1152-95-0x00007FFB6D300000-0x00007FFB6D563000-memory.dmp

Download

memory/1152-94-0x0000000075130000-0x0000000075182000-memory.dmp

Download

memory/2028-53-0x00007FFB6D300000-0x00007FFB6D563000-memory.dmp

Download

memory/2028-55-0x0000000075130000-0x0000000075182000-memory.dmp

Download

memory/2028-60-0x0000000075130000-0x0000000075182000-memory.dmp

Download

memory/2028-52-0x0000000075130000-0x0000000075182000-memory.dmp

Download

memory/4544-64-0x00000000005D0000-0x000000000066A000-memory.dmp

Download

memory/4544-73-0x0000000000400000-0x00000000005D0000-memory.dmp

Download

memory/4544-72-0x00000000005D0000-0x000000000066A000-memory.dmp

Download

memory/4544-88-0x00000000005D0000-0x000000000066A000-memory.dmp

Download

memory/4544-90-0x00000000005D0000-0x000000000066A000-memory.dmp

Download

memory/4544-92-0x00000000005D0000-0x000000000066A000-memory.dmp

Download

memory/4544-69-0x00007FFB6D300000-0x00007FFB6D563000-memory.dmp

Download

memory/4544-62-0x00000000005D0000-0x000000000066A000-memory.dmp

Download

memory/5384-40-0x0000000075130000-0x0000000075182000-memory.dmp

Download

memory/5384-41-0x00007FFB6D300000-0x00007FFB6D563000-memory.dmp

Download

memory/5592-78-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/5592-79-0x00007FFB6D300000-0x00007FFB6D563000-memory.dmp

Download

memory/5592-81-0x0000000075130000-0x0000000075182000-memory.dmp

Download