hijackloader | 16628054549d3e1f10ea645ab7e34be6ee10934ea483951489c6ce32eef7921e

Analysis

max time kernel
299s
max time network
288s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/08/2026, 13:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PQLGBHSD.msi
Size 6.7MB
Sample260802-qpascsteka
SHA256 16628054549d3e1f10ea645ab7e34be6ee10934ea483951489c6ce32eef7921e
MD5 1f2972abda045d02a5c7266180dbcc30
SHA1 078dd51ea09a9d7e841c00378eeb1fb2226b5ffa
SHA512 3b43e22a38aedf28808e218570944e17a0483534efce250d77ca270d00b6ddbb6380edbcfe51835009b7b87485ea797746da0e7c42d1b621c1719b79a731ea93
SSDEEP 196608:bdz/6ety7BYWr27nWfwx9qO7EkJPAWqpq3n7nT:pz/65F2LgOXqbpqv
TLSH
T1216633E3D5782522F32756F488376A8994104D0443F39AE76699F8AD1EFA26CEC704CF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access discovery hijackloader loader persistence privilege_escalation ransomware spyware stealer

Malware Config

Extracted

Family

hijackloader

Attributes

directory
%APPDATA%\CitiumDataset
inject_dll
%windir%\SysWOW64\rasapi32.dll

xor.hex

Signatures

Family: HijackLoader, IDAT loader, Ghostulse,
HijackLoader is a multi-stage loader, first seen in 2023.
loader hijackloader

Detects HijackLoader (aka IDAT Loader) 1 IoCs

resource	yara_rule
behavioral1/files/0x000700000002471d-86.dat	family_hijackloader

Executes dropped EXE 10 IoCs

pid	Process
2292	S_Fusion.exe
4176	S_Fusion.exe
1532	Boost Note.exe
4800	Boost Note.exe
896	Boost Note.exe
5584	Boost Note.exe
1056	Boost Note.exe
5708	Boost Note.exe
4480	Boost Note.exe
4408	Boost Note.exe

Loads dropped DLL 31 IoCs

pid	Process
2292	S_Fusion.exe
2292	S_Fusion.exe
2292	S_Fusion.exe
2292	S_Fusion.exe
2292	S_Fusion.exe
2292	S_Fusion.exe
2292	S_Fusion.exe
2292	S_Fusion.exe
4176	S_Fusion.exe
4176	S_Fusion.exe
4176	S_Fusion.exe
4176	S_Fusion.exe
4176	S_Fusion.exe
4176	S_Fusion.exe
4176	S_Fusion.exe
4176	S_Fusion.exe
4176	S_Fusion.exe
1532	Boost Note.exe
4800	Boost Note.exe
4800	Boost Note.exe
4800	Boost Note.exe
4800	Boost Note.exe
896	Boost Note.exe
5584	Boost Note.exe
1056	Boost Note.exe
1056	Boost Note.exe
1056	Boost Note.exe
1056	Boost Note.exe
5708	Boost Note.exe
4480	Boost Note.exe
4408	Boost Note.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\electron.app.Boost Note = "C:\\Users\\Admin\\AppData\\Local\\MegaSuitelyTechMaxx\\Boost Note.exe"	Boost Note.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\electron.app.Boost Note = "C:\\Users\\Admin\\AppData\\Local\\MegaSuitelyTechMaxx\\Boost Note.exe"	Boost Note.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 4176 set thread context of 5324	4176	S_Fusion.exe	110
PID 4176 set thread context of 5536	4176	S_Fusion.exe	123
PID 4176 set thread context of 5324	4176	S_Fusion.exe	110
PID 4176 set thread context of 4104	4176	S_Fusion.exe	139

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\pt-br.txt	S_Fusion.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime2019_eula.txt	S_Fusion.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Configuration\card_expiration_terms_dict.txt	S_Fusion.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Configuration\card_security_terms_dict.txt	S_Fusion.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\ThirdPartyNotices.txt	S_Fusion.exe
File opened for modification	C:\Program Files\Java\jre-1.8\README.txt	S_Fusion.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_should.help.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\es.txt	S_Fusion.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\README.txt	S_Fusion.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\AugLoop\third-party-notices.txt	S_Fusion.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientVolumeLicense2019_eula.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\et.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fa.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz.txt	S_Fusion.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime_eula.txt	S_Fusion.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\README.txt	S_Fusion.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\_Resources\index.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\co.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fr.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hy.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\io.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kk.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pl.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\va.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\vi.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bg.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nn.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-tw.txt	S_Fusion.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\server\Xusage.txt	S_Fusion.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt	S_Fusion.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientOSub2019_eula.txt	S_Fusion.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\ExcelMessageDismissal.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ast.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ja.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hi.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\id.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kab.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ru.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\yo.txt	S_Fusion.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\jvm.hprof.txt	S_Fusion.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack2019_eula.txt	S_Fusion.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\SkypeForBusinessVDI2019_eula.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\af.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fur.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\is.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nl.txt	S_Fusion.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub_eula.txt	S_Fusion.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Configuration\ssn_high_group_info.txt	S_Fusion.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ThirdPartyNotices.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\da.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\si.txt	S_Fusion.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jvisualvm.txt	S_Fusion.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientARMRefer2019_eula.txt	S_Fusion.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\SkypeForBusinessBasic2019_eula.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tt.txt	S_Fusion.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ThirdPartyNotices.MSHWLatin.txt	S_Fusion.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\WacLangPack2019Eula.txt	S_Fusion.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\_Resources\index.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mk.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\History.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\be.txt	S_Fusion.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jmc.txt	S_Fusion.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientVolumeLicense_eula.txt	S_Fusion.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\AppCore\Location\Shifter\Relicensing Statement.txt	S_Fusion.exe

Drops file in Windows directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI484F.tmp	msiexec.exe
File created	C:\Windows\Tasks\AIImage.job	S_Fusion.exe
File created	C:\Windows\Installer\e5846db.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6600.tmp	msiexec.exe
File created	C:\Windows\Installer\e5846df.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5846d8.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\e5846da.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5846db.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{FFB98429-A8F9-4371-A79E-522A72B1D19A}	msiexec.exe
File created	C:\Windows\Installer\e5846d8.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\SourceHash{C1DD30EA-5531-47E7-AE22-33D5D3A54E9E}	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
3184	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	S_Fusion.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	S_Fusion.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5900	chrome.exe
2704	chrome.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000020c8f0fe5d92f37a0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000020c8f0fe0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff00000000070001000068090020c8f0fe000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a20c8f0fe000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d20c8f0fe000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134301514988560096"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4176	S_Fusion.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5240	msiexec.exe
5240	msiexec.exe
2292	S_Fusion.exe
4176	S_Fusion.exe
4176	S_Fusion.exe
4176	S_Fusion.exe
4176	S_Fusion.exe
4176	S_Fusion.exe
4176	S_Fusion.exe
4176	S_Fusion.exe
4176	S_Fusion.exe
4176	S_Fusion.exe
4176	S_Fusion.exe
4176	S_Fusion.exe
4176	S_Fusion.exe
4176	S_Fusion.exe
4176	S_Fusion.exe
4176	S_Fusion.exe
5324	chrome.exe
5324	chrome.exe
4176	S_Fusion.exe
4176	S_Fusion.exe
5240	msiexec.exe
5240	msiexec.exe
4176	S_Fusion.exe
4176	S_Fusion.exe
4176	S_Fusion.exe
4176	S_Fusion.exe
4176	S_Fusion.exe
4176	S_Fusion.exe
4176	S_Fusion.exe
4176	S_Fusion.exe
4176	S_Fusion.exe
4176	S_Fusion.exe
4176	S_Fusion.exe
4176	S_Fusion.exe
4176	S_Fusion.exe
4176	S_Fusion.exe
896	Boost Note.exe
896	Boost Note.exe
5708	Boost Note.exe
5708	Boost Note.exe
4176	S_Fusion.exe
4176	S_Fusion.exe
4176	S_Fusion.exe
4176	S_Fusion.exe
4176	S_Fusion.exe
4176	S_Fusion.exe
4176	S_Fusion.exe
4176	S_Fusion.exe
4176	S_Fusion.exe
4176	S_Fusion.exe
4176	S_Fusion.exe
4176	S_Fusion.exe
4176	S_Fusion.exe
4176	S_Fusion.exe
4176	S_Fusion.exe
4176	S_Fusion.exe
4176	S_Fusion.exe
4176	S_Fusion.exe
4176	S_Fusion.exe
4176	S_Fusion.exe
5324	chrome.exe
5324	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4176	S_Fusion.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3184	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3184	msiexec.exe
Token: SeSecurityPrivilege	5240	msiexec.exe
Token: SeCreateTokenPrivilege	3184	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3184	msiexec.exe
Token: SeLockMemoryPrivilege	3184	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3184	msiexec.exe
Token: SeMachineAccountPrivilege	3184	msiexec.exe
Token: SeTcbPrivilege	3184	msiexec.exe
Token: SeSecurityPrivilege	3184	msiexec.exe
Token: SeTakeOwnershipPrivilege	3184	msiexec.exe
Token: SeLoadDriverPrivilege	3184	msiexec.exe
Token: SeSystemProfilePrivilege	3184	msiexec.exe
Token: SeSystemtimePrivilege	3184	msiexec.exe
Token: SeProfSingleProcessPrivilege	3184	msiexec.exe
Token: SeIncBasePriorityPrivilege	3184	msiexec.exe
Token: SeCreatePagefilePrivilege	3184	msiexec.exe
Token: SeCreatePermanentPrivilege	3184	msiexec.exe
Token: SeBackupPrivilege	3184	msiexec.exe
Token: SeRestorePrivilege	3184	msiexec.exe
Token: SeShutdownPrivilege	3184	msiexec.exe
Token: SeDebugPrivilege	3184	msiexec.exe
Token: SeAuditPrivilege	3184	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3184	msiexec.exe
Token: SeChangeNotifyPrivilege	3184	msiexec.exe
Token: SeRemoteShutdownPrivilege	3184	msiexec.exe
Token: SeUndockPrivilege	3184	msiexec.exe
Token: SeSyncAgentPrivilege	3184	msiexec.exe
Token: SeEnableDelegationPrivilege	3184	msiexec.exe
Token: SeManageVolumePrivilege	3184	msiexec.exe
Token: SeImpersonatePrivilege	3184	msiexec.exe
Token: SeCreateGlobalPrivilege	3184	msiexec.exe
Token: SeBackupPrivilege	5396	vssvc.exe
Token: SeRestorePrivilege	5396	vssvc.exe
Token: SeAuditPrivilege	5396	vssvc.exe
Token: SeBackupPrivilege	5240	msiexec.exe
Token: SeRestorePrivilege	5240	msiexec.exe
Token: SeRestorePrivilege	5240	msiexec.exe
Token: SeTakeOwnershipPrivilege	5240	msiexec.exe
Token: SeRestorePrivilege	5240	msiexec.exe
Token: SeTakeOwnershipPrivilege	5240	msiexec.exe
Token: SeBackupPrivilege	4372	srtasks.exe
Token: SeRestorePrivilege	4372	srtasks.exe
Token: SeSecurityPrivilege	4372	srtasks.exe
Token: SeTakeOwnershipPrivilege	4372	srtasks.exe
Token: SeBackupPrivilege	4372	srtasks.exe
Token: SeRestorePrivilege	4372	srtasks.exe
Token: SeSecurityPrivilege	4372	srtasks.exe
Token: SeTakeOwnershipPrivilege	4372	srtasks.exe
Token: SeRestorePrivilege	5240	msiexec.exe
Token: SeTakeOwnershipPrivilege	5240	msiexec.exe
Token: SeRestorePrivilege	5240	msiexec.exe
Token: SeTakeOwnershipPrivilege	5240	msiexec.exe
Token: SeRestorePrivilege	5240	msiexec.exe
Token: SeTakeOwnershipPrivilege	5240	msiexec.exe
Token: SeRestorePrivilege	5240	msiexec.exe
Token: SeTakeOwnershipPrivilege	5240	msiexec.exe
Token: SeRestorePrivilege	5240	msiexec.exe
Token: SeTakeOwnershipPrivilege	5240	msiexec.exe
Token: SeRestorePrivilege	5240	msiexec.exe
Token: SeTakeOwnershipPrivilege	5240	msiexec.exe
Token: SeRestorePrivilege	5240	msiexec.exe
Token: SeTakeOwnershipPrivilege	5240	msiexec.exe
Token: SeRestorePrivilege	5240	msiexec.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
3184	msiexec.exe
3184	msiexec.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe
5324	chrome.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 5240 wrote to memory of 4372	5240	msiexec.exe	91
PID 5240 wrote to memory of 2292	5240	msiexec.exe	93
PID 2292 wrote to memory of 4176	2292	S_Fusion.exe	102
PID 4176 wrote to memory of 456	4176	S_Fusion.exe	108
PID 5324 wrote to memory of 964	5324	chrome.exe	111
PID 5324 wrote to memory of 4956	5324	chrome.exe	112
PID 5324 wrote to memory of 4956	5324	chrome.exe	112
PID 5324 wrote to memory of 5900	5324	chrome.exe	113
PID 5324 wrote to memory of 5904	5324	chrome.exe	114
PID 5324 wrote to memory of 5904	5324	chrome.exe	114
PID 5324 wrote to memory of 2632	5324	chrome.exe	115
PID 5324 wrote to memory of 1708	5324	chrome.exe	116
PID 5324 wrote to memory of 2632	5324	chrome.exe	115
PID 5324 wrote to memory of 1708	5324	chrome.exe	116
PID 5324 wrote to memory of 972	5324	chrome.exe	117
PID 5324 wrote to memory of 972	5324	chrome.exe	117
PID 5324 wrote to memory of 3716	5324	chrome.exe	119
PID 5324 wrote to memory of 3716	5324	chrome.exe	119
PID 4176 wrote to memory of 5324	4176	S_Fusion.exe	110
PID 4176 wrote to memory of 5324	4176	S_Fusion.exe	110
PID 4176 wrote to memory of 5324	4176	S_Fusion.exe	110
PID 4176 wrote to memory of 5324	4176	S_Fusion.exe	110
PID 4176 wrote to memory of 5324	4176	S_Fusion.exe	110
PID 5324 wrote to memory of 1168	5324	chrome.exe	121
PID 4176 wrote to memory of 5536	4176	S_Fusion.exe	123
PID 4176 wrote to memory of 5536	4176	S_Fusion.exe	123
PID 4176 wrote to memory of 5536	4176	S_Fusion.exe	123
PID 4176 wrote to memory of 5536	4176	S_Fusion.exe	123
PID 4176 wrote to memory of 5536	4176	S_Fusion.exe	123
PID 4176 wrote to memory of 5536	4176	S_Fusion.exe	123
PID 5240 wrote to memory of 1532	5240	msiexec.exe	126
PID 1532 wrote to memory of 4800	1532	Boost Note.exe	127
PID 1532 wrote to memory of 896	1532	Boost Note.exe	129
PID 5584 wrote to memory of 1056	5584	Boost Note.exe	132
PID 5584 wrote to memory of 5708	5584	Boost Note.exe	133
PID 4176 wrote to memory of 5324	4176	S_Fusion.exe	110
PID 4176 wrote to memory of 5324	4176	S_Fusion.exe	110
PID 4176 wrote to memory of 5324	4176	S_Fusion.exe	110
PID 4176 wrote to memory of 5324	4176	S_Fusion.exe	110
PID 4176 wrote to memory of 5324	4176	S_Fusion.exe	110
PID 5324 wrote to memory of 5792	5324	chrome.exe	135
PID 5324 wrote to memory of 5844	5324	chrome.exe	136
PID 5324 wrote to memory of 3752	5324	chrome.exe	137
PID 4176 wrote to memory of 4104	4176	S_Fusion.exe	139
PID 4176 wrote to memory of 4104	4176	S_Fusion.exe	139
PID 4176 wrote to memory of 4104	4176	S_Fusion.exe	139
PID 4176 wrote to memory of 4104	4176	S_Fusion.exe	139
PID 4176 wrote to memory of 4104	4176	S_Fusion.exe	139
PID 4176 wrote to memory of 4104	4176	S_Fusion.exe	139
PID 5324 wrote to memory of 2704	5324	chrome.exe	141
PID 5324 wrote to memory of 5068	5324	chrome.exe	142
PID 1532 wrote to memory of 4480	1532	Boost Note.exe	143
PID 5584 wrote to memory of 4408	5584	Boost Note.exe	144

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\PQLGBHSD.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3184

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5240
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4372
- C:\Users\Admin\AppData\Roaming\Alligator\S_Fusion.exe
  "C:\Users\Admin\AppData\Roaming\Alligator\S_Fusion.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2292
- - C:\ProgramData\CitiumDataset\S_Fusion.exe
    C:\ProgramData\CitiumDataset\S_Fusion.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of WriteProcessMemory
    PID:4176
  - - C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\H2zr6\EasySuiteSetup.msi" /qn
      4⤵
      System Location Discovery: System Language Discovery
      PID:456
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:5536
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:4104
- C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\Boost Note.exe
  "C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\Boost Note.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1532
- - C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\Boost Note.exe
    "C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\Boost Note.exe" --type=gpu-process --field-trial-handle=1724,8115967732489060364,5413619917814313116,131072 --enable-features=WebComponentsV0Enabled --disable-features=CertVerifierService,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1736 /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4800
- - C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\Boost Note.exe
    "C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\Boost Note.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1724,8115967732489060364,5413619917814313116,131072 --enable-features=WebComponentsV0Enabled --disable-features=CertVerifierService,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2064 /prefetch:8
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:896
- - C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\Boost Note.exe
    "C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\Boost Note.exe" --type=gpu-process --field-trial-handle=1724,8115967732489060364,5413619917814313116,131072 --enable-features=WebComponentsV0Enabled --disable-features=CertVerifierService,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1648 /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4480

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:5396

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c08afd90-f2a1-11d1-8455-00a0c91f3880} -Embedding
1⤵
PID:5556

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4840

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffb2fe5c728,0x7ffb2fe5c734,0x7ffb2fe5c740
  2⤵
  PID:964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1700,i,17302839114379198723,1123149283609067784,262144 --field-trial-handle=2024,i,16566325035079024107,4927908056879548880,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2020 /prefetch:2
  2⤵
  PID:4956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1592,i,2565638011544510380,2376829495165174117,524288 --field-trial-handle=2024,i,16566325035079024107,4927908056879548880,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2388,i,5567407383862791483,13236461943873549932,524288 --field-trial-handle=2024,i,16566325035079024107,4927908056879548880,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2360 /prefetch:8
  2⤵
  PID:5904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3232,i,13962157297151795524,16966860923569074496,2097152 --field-trial-handle=2024,i,16566325035079024107,4927908056879548880,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:2632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3272,i,16497804186948442131,8910020058807385947,2097152 --field-trial-handle=2024,i,16566325035079024107,4927908056879548880,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:1708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4428,i,17290318102224925324,12224267039283273693,2097152 --field-trial-handle=2024,i,16566325035079024107,4927908056879548880,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4448 /prefetch:2
  2⤵
  PID:972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4588,i,7294503950754930940,6915729326080365591,2097152 --field-trial-handle=2024,i,16566325035079024107,4927908056879548880,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4664 /prefetch:1
  2⤵
  PID:3716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5780,i,17540560880853599600,9546785773808488201,524288 --field-trial-handle=2024,i,16566325035079024107,4927908056879548880,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5800 /prefetch:8
  2⤵
  PID:1168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5548,i,830447089401983836,13658172062917923918,524288 --field-trial-handle=2024,i,16566325035079024107,4927908056879548880,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5536 /prefetch:8
  2⤵
  PID:5792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5604,i,15719979349804410445,15106875811252665055,524288 --field-trial-handle=2024,i,16566325035079024107,4927908056879548880,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6004 /prefetch:8
  2⤵
  PID:5844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5540,i,4473996822988822921,15545128398388540974,524288 --field-trial-handle=2024,i,16566325035079024107,4927908056879548880,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5508 /prefetch:8
  2⤵
  PID:3752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5732,i,8187672133110941974,3959853509292992818,524288 --field-trial-handle=2024,i,16566325035079024107,4927908056879548880,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3840,i,12115568435199464694,16238679238248524122,262144 --field-trial-handle=2024,i,16566325035079024107,4927908056879548880,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4476 /prefetch:8
  2⤵
  PID:5068

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5604

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5432

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:372

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6004

C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\Boost Note.exe
"C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\Boost Note.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5584
- C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\Boost Note.exe
  "C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\Boost Note.exe" --type=gpu-process --field-trial-handle=1824,14945383291278975442,904405844203324394,131072 --enable-features=WebComponentsV0Enabled --disable-features=CertVerifierService,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1832 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1056
- C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\Boost Note.exe
  "C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\Boost Note.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1824,14945383291278975442,904405844203324394,131072 --enable-features=WebComponentsV0Enabled --disable-features=CertVerifierService,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2088 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:5708
- C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\Boost Note.exe
  "C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\Boost Note.exe" --type=gpu-process --field-trial-handle=1824,14945383291278975442,904405844203324394,131072 --enable-features=WebComponentsV0Enabled --disable-features=CertVerifierService,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4408

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5484

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3280

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5846d9.rbs

Path C:\Config.Msi\e5846d9.rbs
Size 9KB
SHA256 16d4f18dda8243f0d9a18ed489c09b085beb6af0b5c081c3178bcf012cd1ad41
MD5 949e0a48d44116ac19990c148f93c3d8
SHA1 da54c9ce89c97055b0ccbc7e37280355828659cc
SHA512 a1d2bfa67ae9c0ec4fbf6e341eb3b7c7d4707b1e7d7c812720c3f6083026b894dc7332b04c5a5591b4219a5864c31f95705796a2f4b522442fb33aace85317fb
SSDEEP 192:NJH0QPeB77TfbIQfbSnlhGd+Rz2jgs54pi0NWN2NZNgNFmN+Np:Nd/C7/fjf+nlUd+Rz2jg60YU7+rm0L
TLSH
T1D8222582B550D2D2EC916774C3635B187369E3F59B207B5F0EAC85248F937CCAE452D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5846de.rbs

Path C:\Config.Msi\e5846de.rbs
Size 144KB
SHA256 8df64f4f511a2b6c2c143d40723780e04a1f53dd7da588fd3e5d6d7a017f48b5
MD5 35fe29a1b5b47ea5665c4d2dd0afe533
SHA1 8ac1aadfb0fba000e02bf4ba9648798f9b8bc8d2
SHA512 19ebfa8de9deb67453349ee9560ae11e4ad29ed9b7f8b63e914e2d25b282926e7373b33e20c3fe9eec6c0a43db38b412471dc0829f6919f9cf97a7aed9d47d37
SSDEEP 1536:Jh7vGI7BNvGVKytG7cWyxFh8SEid7OT46la:f5UG7wH3
TLSH
T15EE3E0B752F5B7778D28457B72E3F43C85A40DAACA1D2B091138443F25D26EB7EC6A08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 d801b3286486fae178bb87f8aa5f43ac46e926bc2799808489b3db9b76571e01
MD5 9a3cc9ea58b60a18749824bfdf88f454
SHA1 dfc8837f181842b8ffc925a21565287603f85e07
SHA512 1a44223370c1fa5dde5324fef9894427462cd08bb95aaccf6bf49a45e70b021f55adcae34a6ec2f680e4ee7fed9fc1f69d0107fd9a31c245988da4c099ea1541
TLSH
T171E02BB9C920AD2B08FD071A24590746E755232B2B40856B3A3CE209CFBA63B098AC1C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 4fc203050b2217ee75bb8dd95869efc5196c103dfab77da8116a902a38adef56
MD5 1f1adc9c2476caed0e2f1220e4c4a4f1
SHA1 b08a41a3961a9e21afe815d89ed2255bf2638683
SHA512 a32b0d33ea1e7038f37639c9f755c0087c841e8024cde947068276e6e7ba0f7104a79b036fa8dfa31afdc226ba71b17eb1406fc2eafb0a478ddbd3acd733994e
TLSH
T1E051AEF7D3E8867D851152F4EB106E2FCE3A0A14031D3C66C8D4AE1B43E2872D20138E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 1d3715b157e317d880af65f17d00113fc3d2dcf0c61e91db9e7a2014d7cced86
MD5 99855d15cf2f95460479ac27b221b299
SHA1 687b367cdfc39c55f04397745745b4b307e80501
SHA512 6043c8b61ecff33eb72fdbd1ec6209ae7004a48e42550a1354423f0a5a9566de054721ffc77fca6d735a500a3eb9b35dcccfe13fdac6ae955859b9602f48cadc
SSDEEP 192:FR3SGh2QrgFBv72ympAPRp2/95Hsb+WNnF70S62WLvkwtAVyIsnAUgtaJ:FR3S3jQUXo7wB0V2WTy8
TLSH
T13642C72EAA20653B9CDBD219FD127753D7F5103225942E84EAFC9B2C19E75CC322B41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 27d0ce6d045249986c6f25e5f552537833180c749b382e59d40fb18e1a575f64
MD5 ecdd3a04f3217f87327d92f91255938e
SHA1 004bda1d61b450a145b72c86e43bc8f7d32dfd2e
SHA512 7c786b2c661566316b771d85519fd8662d2fd42de2a69d8e99601b0dde71f03c85ee21e792edf042f920a54576acb81245194dbcd6d5ec36a3218dfbf3be4351
SSDEEP 192:FR3SZh2QrgFBv72ymp3HPRpya/95Hsb+WNnF70e62WLvkwt1VyIsnAUgraJ:FR3SWjQFvXys7wB0p2WTle
TLSH
T1AA52D82EB910653B9CDBD219F9127B63D7F5203225941E84EAFC8B2C19E75CC322B41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 16KB
SHA256 96680526396d5bb7bc2be329ccea09ff157074d6cba833bf6ceae5e8dd589816
MD5 70ea5148a6f2007729e80f154ba2e623
SHA1 d1de2910372638b5ec3adef2577e37fda30ce5ef
SHA512 0fa07f5977992226463cab761b4da45afa187dd815f36063aa37228d74bc740b2cbc80810b18c0fb72f6a56a0dde0e1e983f67de62ef9bac8ea0a7b55d8d8f1f
SSDEEP 384:Q+jM77KxkXqKf/pUZNCgVLH2HfgslAG7pLuLcMW3XODM3+ErU3oPHGqkkcLt9:QOM77KxkXqKf/pUZNCgVLH2HfgsSG7p2
TLSH
T19B720967684C9E370F94CACCD817BB4FACB5025B56ED886492FA5C2503D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 8879c110def0897f68e04cde895861d69bb35527414a78c5f143a75b5e1e829b
MD5 013ebf4d7df7cb1d1c379461713042a1
SHA1 401a22356c6397a0e2ebc7a5a4166a2c35ee3cb6
SHA512 9a2a386ec72c2fb78839985b81c07cd68f89b537777e71423c4b1743e0e269c68fe2da7324b6146fbf376e349dbc12953f028298ef6ad3e1f467df0a3ceac8c0
TLSH
T1E5B0124184056211C09202F41156149871185F24A60B2B0543E46D66C8261B18414150
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5aee0b.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5aee0b.TMP
Size 96B
SHA256 3c8fb8287595ba1ce30f87be693ea16065d3f5c28c7f39e5c138ae2cc878ce47
MD5 c889779e78b84d8ad5ca1e5a8bd093ee
SHA1 402568f8ec6c3f1276dc66a0efed6b9d79b1e34d
SHA512 e9b75fb1d4cdeded662fcc91676c8797123aae334c4a130b6ec4ef63d064c1d46cc1d50fcdb9ede512a21b46f5bdc18e862270c1e49009d2a27e39237613a371
TLSH
T116B02202C003A222C08383F82AA2F0E83020CF20C2030203A2E02A23CC30A302820020
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 980de48c1f98c39b0f4b7d777aa0734ed8b866c4d0ce8db8fe24deabe68cea30
MD5 7ef9fbe8efbd446f70f9599b48fb2cd4
SHA1 9b913793f956ff8b50cc8a9103a807eb980f0f47
SHA512 b420c4abccbaa6e93e3a619225f6a7a1c3e9d010fd29415db971638ec0f5a5240c6ef30331ffd256446de3178445e6746f60daf64811a85aeb340a657d65b9fb
SSDEEP 1536:LexKyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbu:M4qfd7NtZL8cHQRZEQ6SpsJ
TLSH
T162C30237ABC61E335ED2CB70B9130ED797B544A99034D305AABD37FB6C83895648289C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 8c95808259c960fa9f4deebad551208a9f60b668fd2ca01a5d7b8ad47f6ca5bb
MD5 ad1370b61dbb7c376af67acdfe42c5aa
SHA1 af692994c8b93bfe978166c42a5e4248cb877fb3
SHA512 5ec685022fe48460adb9611acdbe111ab4e2658a27e8141853640617d5b015eb637e25cebb9bd78ceecbf07d2d7be91e2b4064f3102fc92230e0ebcb846a968b
SSDEEP 3072:xldLTq/HYb50P4w9J4aDvC3QXhbx+WIzZ2l+1hbApqfd7NtZL8cHQRZEQ6Spsp:xl8i0Aw9NDv+qw5ZtApqZ/ZLW3Exp
TLSH
T149342237AF034D338FC69E7468135B8F5BF4A82AD034C786B99C37AF99078A52817418
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 ea8cd2d91e260560188f816783aae6a27dc27bfe1d7d5e49d2c1813eddb4d635
MD5 07b001ae1337043bebae8b1a669d676e
SHA1 7c877eb16cd90bbefd899fb7f509aacbcde61525
SHA512 1d0de639db194da33fa91acfd7803a0c440f8918bb4a9baf7f0e5a514fe3f6f0f3b9d9628311f059855722f9ba3bc9c3f4d96eed6b2da5f28f176bf61509a234
SSDEEP 1536:TbQyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjf:yqfd7NtZL8cHQRZEQ6Spsk
TLSH
T151C30237DBC21F339D92CB64B9530FD697F644A99034D301AAAD77BF6C83891684289C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 c8c0cf489a758ffcded83b6290a10becf77079e6719f72435265cbdc33778b34
MD5 da070a14b54086b669b468f0daa71730
SHA1 00fd4f2658c77cfc9bb8b4c72b8271c33fb629ea
SHA512 1e1263284ee51ee4ca1058e0632b7f7c9700d259fd1d72073918ce5279ca678548675b489211748ad31b21ebbf50461a23c19b630c3f4382132b1f9dfb4460b9
SSDEEP 3072:rydLTq/HYb50P4w9J4aDvC3QXhbx+WIzZ2l+1hbApqfd7NtZL8cHQRZEQ6Spsp:ry8i0Aw9NDv+qw5ZtApqZ/ZLW3Exp
TLSH
T10E342237AF434D378FC69A7078278F8F57F4A829D074C386AA9877BF59438A62417418
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\chrome_100_percent.pak
Size 123KB
SHA256 f1a935db8236203cbc1dcbb9672d98e0bd2fa514429a3f2f82a26e0eb23a4ff9
MD5 a59ea69d64bf4f748401dc5a46a65854
SHA1 111c4cc792991faf947a33386a5862e3205b0cff
SHA512 12a1d953df00b6464ecc132a6e5b9ec3b301c7b3cefe12cbcad27a496d2d218f89e2087dd01d293d37f29391937fcbad937f7d5cf2a6f303539883e2afe3dacd
SSDEEP 3072:YerKzw9bpxlr+bEfF2DGb0+VvfGGY304F2DExm/KLQ2I:YeKzw9Vh90Gb0OveGe04mExhLY
TLSH
T187C3D0D373F0ED7DCF6756B7A52A41B1ECB302391A92034A469AD8356A27348DDC8393
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\chrome_200_percent.pak
Size 183KB
SHA256 7f9ded50d81c50f9c6ed89591fa621fabbd45cef150c8aabcceb3b7a9de5603b
MD5 1985b8fc603db4d83df72cfaeeac7c50
SHA1 5b02363de1c193827062bfa628261b1ec16bd8cf
SHA512 27e90dd18cbce0e27c70b395895ef60a8d2f2f3c3f2ca38f48b7ecf6b0d5e6fefbe88df7e7c98224222b34ff0fbd60268fdec17440f1055535a79002044c955b
SSDEEP 3072:yDfDQYaEM+9bslr+bEfEfRIGMR+F8fQnYw9pGbXGYoDd+qHqRxmeK/rIM0:6DQYaF+9bMhCWGMRe8InVXYopym74
TLSH
T12E04D1D7A3F49D3CDAB30A77553A01F1ECB6127516A3424A42DBAC347A5678C4CC9293
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\ffmpeg.dll
Size 2.7MB
SHA256 8653b57b37618f11e358c93aad9dc9ef0193f0288f7e59147194e42b0842b50e
MD5 b34d74a152e1788532b0acfa8cfbdf1e
SHA1 e99e5a26d8b695b57cb1a1bb0d2c032d822d0461
SHA512 06f8def21101d8c899c321b3a445e6838f824d6d6305d569b49fb7ad14a197a57c601a8965c50057e7af1d5414b74dd2c79e2f27a58eedab31b3b36202947dd9
SSDEEP 49152:nSFoiJBtTcoQ9mjUBA6vXH4VjB0kxryYTK8gJ2EDE+oM0iloSa08UHdiVqAy6cTC:ijUBA656ryEpEdiVq4
TLSH
T1DFD59D0BF2A645DDC029C53083AFA233F934394A4725A6EF16A156252F3FFD0667EB05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\icudtl.dat
Size 9.9MB
SHA256 02db39ba465fc8b7a4cd280732760f29911edde87b331bf7cea7677e94d483e0
MD5 70499b58dc18e7ee1d7452a1d7a8bc6e
SHA1 41c5382f08c6a88670ce73a20c0dcdb3822f19e9
SHA512 a80939e9809bb7d20f00ad685c94d5c182fa729616c975e605abf09afb58376be73a49fefa35b75ed1a284eccf208af7656c8df44c5959df7eaf51367d232dc6
SSDEEP 196608:uUGwSv9AAQnt6liXUxR0rHa93WhlU6t7CLhl:uoKlQnAliXUxR0rHa93WhlU6t+Ln
TLSH
T131A63947A2FB4DC2F9FBAF30D8F452679467BD496E32805A11042F3B5C373A096617A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\locales\en-US.pak
Size 85KB
SHA256 ac1cdb4fb4d9fb27a908ed0e24cc9cc2bd885bc3ffba7e08b0b907fd4d1a8c4b
MD5 6bbeeb72daebc3b0cbd9c39e820c87a9
SHA1 bd9ebec2d3fc03a2b27f128cf2660b33a3344f43
SHA512 66944fb1abcc2a7e08e5fd8a2cee53eb9da57653d7880aea226f25879e26379f7d745ebf62a3518378fa503f3a31b3ea3716f49fe4c7db4f4af0228b81b53a10
SSDEEP 1536:MzBh0wu6Y90fYSKD0R4RlQ2trhWMJ5dBxgMSO0JedMVrBHhQYVfD3ggl+C/fpkwG:6hp1YSwhBxgrvQY3ggl+CGwG
TLSH
T1BB835E1BE3C41266099243227F06E3B6AB26D079936311663C6CC16C3777FA982777E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\resources.pak
Size 4.9MB
SHA256 367467609a389b67600628760c26732fc1a25f563f73263bc2c4bf6eec9033df
MD5 5507bc28022b806ea7a3c3bc65a1c256
SHA1 9f8d3a56fef7374c46cd3557f73855d585692b54
SHA512 ae698d4feacc3e908981ee44df3a9d76e42a39bf083eaf099442ace2b863f882b43232e26e2c18051ca7aec81dccef5742acc7b82fb0cda2e14086b14d5a9a26
SSDEEP 98304:1jMQZikLH2tMPwSGBNumogFJlFlh1wTJntwyqWBsCiLeD8crwrb:tMqimHmGfgfhyTh8YsCi6Qckrb
TLSH
T1FB362302F2E4283BC6DB31766C6BA161B73444471068BD2E7A9D52DCAF5492802FEFF5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\resources\app\index.js
Size 240KB
SHA256 176f28d4929e80b0039851d31297cc3db98cfc2813216ecda880d7dc63668618
MD5 54e9cc07b1bf0158f749a741a23921fa
SHA1 d811807a19ae6d733b9cd902e700f7d836862b77
SHA512 26204d6fe601cf916d30cf3f984a8ab272a422f3b5bc99c65fee7bc56a8302e0e45a98dcfa9165ef19286c3ea8cd89a377b250726dea3ab2e56b430b13f325d9
SSDEEP 3072:/hprLsKuviSpbMECceMtJmCC4j9X1aQllVO1V:/hprLs7viShChMtVC4j9FU7
TLSH
T1303495843BCAA0D2421935F1063F3615B56E4D627A0CCA88D7FAB49EFDB930594B7E34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

license

Path C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\resources\app\node_modules\file-type\license
Size 1KB
SHA256 5c932d88256b4ab958f64a856fa48e8bd1f55bc1d96b8149c65689e0c61789d3
MD5 d5f2a6dd0192dcc7c833e50bb9017337
SHA1 80674912e3033be358331910ba27d5812369c2fc
SHA512 d1f336ff272bc6b96dc9a04a7d0ef8f02936dd594f514060340478ee575fe01d55fc7a174df5814a4faf72c8462b012998eca7bb898e3f9a3e87205fb9135af2
TLSH
T18221931E7254136318BA13A0696A6CC4B32BB11F7DAF6B8418ADF244233B46CD4FB840
MD5 SHA1 SHA512 TLSH

Submit Download

license

Path C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\resources\app\node_modules\normalize-url\license
Size 1KB
SHA256 48da2f39e100d4085767e94966b43f4fa95ff6a0698fba57ed460914e35f94a0
MD5 915042b5df33c31a6db2b37eadaa00e3
SHA1 5aaf48196ddd4d007a3067aa7f30303ca8e4b29c
SHA512 9c8b2def76ae5ffe4d636166bf9635d7abd69cdac4bf819a2145f7969646d39ae95c96364bc117f9fa544b98518c294233455d4f665af430c75d70798dd4ab13
TLSH
T1EC11931D7254136318BA13A069696CC4B32BB11F79AF6B8418AEF244233B46CD4FB840
MD5 SHA1 SHA512 TLSH

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\resources\app\package.json
Size 326B
SHA256 ed559a3a3027667ce6302f1debaed9aef5bef1c6d4236ec4da01199b398f78b2
MD5 48f234e36eba960bf0f66519a219e17e
SHA1 988d574c95e613f177e81417c590540f77ed9845
SHA512 08ac57c789dd209ceebdc73d5ee709ee141811f0955b982454c3459eeac9353eec08aac68646d18c55a181a1f5f64f56fcbebe203597dabef54f2deb40e5e276
TLSH
T128E08C18DC499E23129B888A3068014728612C079959F80DB79E930C1E5C96FB2FCAAD
MD5 SHA1 SHA512 TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\v8_context_snapshot.bin
Size 160KB
SHA256 31c3aa5645b5487bf484fd910379003786523f3063e946ef9b50d257d0ee5790
MD5 b64c1fc7d75234994012c86dc5af10a6
SHA1 d0d562b5735d28381d59d0d86078ff6b493a678e
SHA512 6218fcb74ef715030a2dd718c87b32f41e976dd4ce459c54a45341ee0f5ca5c927ad507d3afcffe7298b989e969885ed7fb72030ea59387609e8bd5c4b8eb60a
SSDEEP 3072:pBgpuz1xV9mRTUAnPH5lZw15qCy0CmiRNiA0hTBAzZs7q/JBXTPv:p4O1xoTPyqIRhTBAzZs7kJ1TPv
TLSH
T1F2F3121427D0829096ED4094A25B06E7C5D26C6D1E2CFF0A3BB5FD4C0AA3DCE55FE1B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b46c-463d-5b55-efb1.tmp

Path C:\Users\Admin\AppData\Local\Temp\b46c-463d-5b55-efb1.tmp
Size 18KB
SHA256 121e6725e686fb1d9537acb6f91b6060176fbb51d6b9958ff2278ffc3537a8c1
MD5 516e2f7a1b43974b03485d0e9bbb251d
SHA1 67dfbcdb0ef9483c33fd2215a1cca9efc1283d47
SHA512 73e71fe5232fd546b81c5ba9e640b82903b90e39bde963f27f03fc70f46a415f5d7fe3364bd2cd3de6f63f2abe8a996074c6f76e021681a4920ee69605ac14d4
SSDEEP 384:Lo4qH4+iBc5TxczgIZkDEGAQaxdzyaMjqm67HOmPtOg0yWGOVzZ6rVDZ22w9yN8V:Ljuc8TxsgIZkgGAFntMVYrIg0wOHKD8z
TLSH
T1B782E0AA92020C4FB5DE56609A7E1606E7ED7D338727891A11D36DC08DE93310C73B19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

S_Fusion.exe

Path C:\Users\Admin\AppData\Roaming\Alligator\S_Fusion.exe
Size 1.8MB
SHA256 c82d2de495350be0453d25cc9939eb0ab7dd51b10f1db290c709f224465f70c1
MD5 767566fa3f21edfc0d8aac6a0fce249d
SHA1 1ebdfded1293415a125514363ba6ce2895c31433
SHA512 acc3869df411722f9e1afa425506b8cdd4dd87ff8b405e1236410ffa5f34dda252d7de9f2b0ddffe14027084315b4f09a9d7113f2e90ba5414ea70eaf8d8e483
SSDEEP 49152:/s2vpgWmekdGTl9Fg5k1nje7MQLCT/JSC6O:/xc7il9Fg5QnKH4JSC6
TLSH
T17F857C21A385C823D1632E769D2FDAD4A425BE301F38854B3FE92E0C5F79B41B929357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

clustersec.cfg

Path C:\Users\Admin\AppData\Roaming\Alligator\clustersec.cfg
Size 8KB
SHA256 37b84449458e3bf7b8a65c6f8f278d08358c55a74ac3dc92c9eb0bf03c7ab992
MD5 b5528af873719e411d44d9e50adf8a00
SHA1 a63f0b897080f5224c083082946a2605c1a57db6
SHA512 fe5ecc69908b796b5b9955eff7cb330d0cbbf8470d07aa41380ddb68589ff44f9cccb48daeab286bc3fa79d4c7a49ed920ffbe675f680e87e31289a8fbd48c81
SSDEEP 192:WpU4+RZ+qPYG3AlT6CBHMdb5HJwBn6SPOnFFUncqAdDU/VG5CfUAPFyI7gLns08J:8ioq50T6CBHMdb5pYn6SPiLUncqAdDUR
TLSH
T177023A2862472249A402FD17A724E752C347AA3AF61F400A6EC3E8458DDF76BEDCD54F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

datastate.dll

Path C:\Users\Admin\AppData\Roaming\Alligator\datastate.dll
Size 78KB
SHA256 7623436ebbed5c00bc08683bb24978562f7452f24f35af314dbf950782f64eed
MD5 64f53254054885752c22cfb17321fd71
SHA1 50c00e5c886bc15bc977147164a5fead563d2175
SHA512 9f074c5134fa38104d3e7c4d1a4ab2cf2b33fd35f1438e2cc5ce8bf01809d5a4bd173507d65a50601534789dfe0b59bb1a2cb8b40296112aa2aa77cbb5dd94c7
SSDEEP 1536:S+XrMzPCiE6BorrJIXJpCRMaR8p4kwbioQ+zXAwbtQ+8iAs:S+SE6ChIXJpCRMaR8eNtXtyDs
TLSH
T1DF738C113A50D073C95B29309495CBB2ADB97961AFF0404B3FBA077E6F613D2A73921B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dispatch16.so

Path C:\Users\Admin\AppData\Roaming\Alligator\dispatch16.so
Size 4.4MB
SHA256 18e2f2c66522f2e88b96ee862d9382e2453380566da8c8ec660f1ec89e481025
MD5 272689bdba950eac9ab08422bba79fca
SHA1 a8ea5d057b5615152986a121f9fbdf85c9f66b90
SHA512 c119e875244aaf71928e04d78e0b0f7f402684fe286ac272ce82fcbcf7237e61e4086d48d0a37db8729c2ad3ac003b10d75d0da5e7ae42a51e92b4f3fc360fe1
SSDEEP 98304:DjoDlCDrr5AwYUdLrhree90++a71IxG9M1u6/lHT7yZ/hIw6R+PZ4XW:D5XGtirhaeppIB8oHTM/j5hp
TLSH
T1702623CDC6CD8DF3F6259C770A156A48A0CBF9F402279655980BEEE4FA0D04184F6B9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

madBasic_.bpl

Path C:\Users\Admin\AppData\Roaming\Alligator\madBasic_.bpl
Size 212KB
SHA256 4926203fdd4fd70b55409e84728faf927d71274fb368193205d44e4f04a605f8
MD5 73bc46c0170de5d72d1e5e0df51ee68f
SHA1 bc92d0c16258b2a42ad9774fa7b6006bc32607ed
SHA512 642b19235bc62c26610092a865a1cabb7421296ac1885d1a50e99affe92a732347723fd028f71ff3d641a8ac7ec1567a97c8423369f28c806da9dbe00cd09e9b
SSDEEP 6144:lN/kSQxE6qeM/k4qTl5L5e5+53WCG1CbF/FrfkXK:GqeM/k4qR5L5e5+53WulZkXK
TLSH
T10F247E36A1008C33C2A3797BCCBFB950A96479640A3644DF7DEC4E84AB5A2D5772D387
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maddisAsm_.bpl

Path C:\Users\Admin\AppData\Roaming\Alligator\maddisAsm_.bpl
Size 64KB
SHA256 20ddd0bdf076a91d9d82c8e447e1dbf6dba52fe6613cfe1e5373aeac7f889b62
MD5 f1d430eacd5aac17c5de78f0de3cf774
SHA1 b1c410ea2659d2d7a44b8458ffd98e14ef6ddb8d
SHA512 bcbf4b4c7b02ddefd78d03f1d6d047aa5729a4e8ae673ca6d72488ca7d3fc6a03893d9a6b446e6bb629927352535d85745b882c80b5913c726d5674efaf2339e
SSDEEP 1536:SNy3eqMne0sXB0IWtCLwEJhY0w1kwbioQ+RawTQ+8iAg:mqMnfIB04LwEJhY0w1N3sDg
TLSH
T18A537CB35644E037D85375728CAAE6F2A9B07A211D3050EB3CEC0B98EF567842F1965B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

madexcept_.bpl

Path C:\Users\Admin\AppData\Roaming\Alligator\madexcept_.bpl
Size 438KB
SHA256 655c2a4b484ce587c8c99cbc17f7cada640e79fc8f92b4de2d68882d79c0c815
MD5 9ff9e6b33bee8e297bbdb47e8ac9b60f
SHA1 b49d037a12c43958ab24b3869359e6ddbe8cc551
SHA512 7552139146d3cc913cb0c20ac612e194cdca01f202abb668e3451c343d8e4b5e967a3c90420817cea400a20c215b4cb4956a80896d6bb10c4f5ad720b9667109
SSDEEP 6144:FlAz49EKhEV30F8sl88nTjQ4Q50gEcW/jd+o72niVUNMa4Yn2S4fb:FlG4ut30F8slzYlQcW/jd++2nJ6u2S4T
TLSH
T104944D31D288C077D062263BCC2AD6C461B975341A34A95F7DE80F4CAF77A91AF26397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp_win.dll

Path C:\Users\Admin\AppData\Roaming\Alligator\msvcp_win.dll
Size 489KB
SHA256 a6ddbc4954687b359c4b1bc7105647828ed9c6c34fba89c395806ea2420dbb2f
MD5 1f132c76a07adc8a41b6f9859323e0e0
SHA1 85a1bb9b7b719fadcf0ee8d7f63d053f9fcb1bd5
SHA512 1b70b150df2a6fc65329c89d20e101ac94135be145c469ca356a0aa41e04bd2a84652f2675f4eff487b295474185a4db273fe4bf00c82327f3c8a4d861042d7f
SSDEEP 12288:AN9jSIScPnEd4ZiUCujHhUgiW6QR7t5s03Ooc8dHkC2esjEFPYQ:29jSISNd4ZJE03Ooc8dHkC2eOEFPH
TLSH
T135B42A237B4149B1D58A63F021CA936283F9AC6547A0F3C357EAF16DBF293D19633681
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rtl120.bpl

Path C:\Users\Admin\AppData\Roaming\Alligator\rtl120.bpl
Size 1.1MB
SHA256 b3dee68af7b2805f6cf74976b60564dcc7d6d38444078d32cdca99ee1bb5bb22
MD5 4f2040add9f5b541db07a2e866e2c5ca
SHA1 b04da67e7ba7207deb99f56062661edc919f543a
SHA512 4fc2f75a8999e1a463d97bb89ad3cfdef4dd35615df6538f794e01f98de205a19bdae9dee58ceff6e9e3f08b5497c0f62e1b971a859bce711974d5f2e2180914
SSDEEP 24576:yEsEWbADYcUsnkqB8CVxIA99SGcM8sq4eXauOOqNTLjdecRzT:pHgcTLheM
TLSH
T190356C30F34A88BBD2A626BD4519BE14ACB87E10E1A4D599ACF4CD0DB975584373C3CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Roaming\Alligator\sqlite3.dll
Size 908KB
SHA256 bc0c750c98bd413e7975e8b17b1101c346dda53100020161bc5141f77ed98932
MD5 5b5a926a887f4a9f3eecc54598f697db
SHA1 86044be248e9fac25a0d8a3dd3c617da8688b7ea
SHA512 3031b4cf17cd4261d9c36495cfb707c6be10bd1444c8e474d1f117df55cadb32fe1661f239499d6f1ba3d3d96def6f6b4eae7e3fba543c6a5c8b98dedeb91412
SSDEEP 24576:MRxNAQB74x0FwTuis6eCwjH+SW61zf/AF+e:Ma+syis/LjH+S31o
TLSH
T1BF157D46EA17A87BDC5701754607F39B0575DA30A832CB8BEBC91D68DEB3ED2160A343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Roaming\Alligator\ucrtbase.dll
Size 1.1MB
SHA256 50825771d83ed274c814961c7d84e124539821f647f71c8a60b620a3008a1605
MD5 cc3bf1319f2ef9c9718735bdbd2441a9
SHA1 ee1cd03129e6a00ed5aaf31e2c36b7f4356ae0ef
SHA512 4632f285624ba9aa963b0198ed5467dec7e71e683cd324623a255ae71d486eee61cabae135078e5dc1b75e38bf524f9547ecb00248bf93ef6691a2edab5daa5e
SSDEEP 24576:lcjIrXW7AX5t0C6HjqiEwopCJrNlkH2uuYYH5JMmcvIZPoy4TsJ4:qjIrXW0JteEwopCaTYH5JcsJ4
TLSH
T1AA455A11758580AED85C31796359F922247F72B24B7AE8C373C41AE99E305C0773AEEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcl120.bpl

Path C:\Users\Admin\AppData\Roaming\Alligator\vcl120.bpl
Size 1.9MB
SHA256 19e61333b1d1732a0af016c792f633b8f96c0ce8651d991da60e7527c2c6c559
MD5 ee485ba5230f6b7c2d94e9b0a64a510f
SHA1 3ebcd4279932a71acfd85e391ad0f3791fb69a0c
SHA512 d8d70e209814d4ca3a241f78ba8e1c4849470a45831c522a10e690c14bf82565097bed6144419c6a7a0afcfa411a02f43e7d9a177ecbbd5c6335eea67e7a5a7d
SSDEEP 24576:prKziiTDpqb13me26exdBkCWgB/S8H4PM+Hs+W0mN6WZA53lKiHLpyz6m3U:Oillexp1SG4P/lma539HLo+j
TLSH
T164957DA0B33D0DF2C5A32B7C159FAE50F925AF106360925BAAF5BC4D5EF06903A1531B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5846d8.msi

Path C:\Windows\Installer\e5846d8.msi
Size 6.7MB
SHA256 16628054549d3e1f10ea645ab7e34be6ee10934ea483951489c6ce32eef7921e
MD5 1f2972abda045d02a5c7266180dbcc30
SHA1 078dd51ea09a9d7e841c00378eeb1fb2226b5ffa
SHA512 3b43e22a38aedf28808e218570944e17a0483534efce250d77ca270d00b6ddbb6380edbcfe51835009b7b87485ea797746da0e7c42d1b621c1719b79a731ea93
SSDEEP 196608:bdz/6ety7BYWr27nWfwx9qO7EkJPAWqpq3n7nT:pz/65F2LgOXqbpqv
TLSH
T1216633E3D5782522F32756F488376A8994104D0443F39AE76699F8AD1EFA26CEC704CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 31bc705b5534fc79754f56cb841f4b44d9c531745d16033fff2626210c16345a
MD5 a44180f4d5d84e5f6aa1b29cb9704c22
SHA1 6506a8cbff36b110a643e8a196af200a02be79a2
SHA512 e6ebaf3db46cd0439ff59a3727f6845c0c66f5399455750867832d00a998ad1f22782ebce519887f83e25461f35f40e9236dc8115012d8c436e68273629f2d1e
SSDEEP 24576:2u8m+1z1doO/vvTL7WBeU26FA4kDJFhitHmNjegl5Uqwe2YMYvlYpXqhU:I
TLSH
T1D547D22432F92510E7F39E3CA8F1AA2389397D579C199E8D05411F4E0961FB1E872F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{d0b78b1a-72f9-4ce7-9428-b44ffa4ce468}_OnDiskSnapshotProp

Path \??\Volume{fef0c820-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{d0b78b1a-72f9-4ce7-9428-b44ffa4ce468}_OnDiskSnapshotProp
Size 6KB
SHA256 3411c7f20cc0ca011d1390f3f869108325a14b0c819952445ea692ee4c0c5c77
MD5 0227e044a834530a112c6f0b530c2cb7
SHA1 5fe45484ab82f55bc3cca1cfe224f4bccb0ba021
SHA512 1df8f2ebdfd878cf8e3e1d0b6532699ca6612195bb478c413eb396d1688f225c6ffffbc4630ad921860a85fcabe37323c4f645364a430bf6b9c0a5417322d579
SSDEEP 96:FaPVM9JlSvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:0GQb++ZVm
TLSH
T1D6D19A185AF54711E2F3AB7228F14557A477B811EF33CB8E0198238E6670A10F976F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1056-955-0x000001C446CF0000-0x000001C44742F000-memory.dmp

Download

memory/2292-74-0x0000000061E00000-0x0000000061ECA000-memory.dmp

Download

memory/2292-50-0x0000000057000000-0x000000005703F000-memory.dmp

Download

memory/2292-47-0x0000000000400000-0x0000000000603000-memory.dmp

Download

memory/2292-53-0x0000000061E00000-0x0000000061ECA000-memory.dmp

Download

memory/2292-52-0x0000000050120000-0x000000005030E000-memory.dmp

Download

memory/2292-51-0x0000000057800000-0x0000000057812000-memory.dmp

Download

memory/2292-49-0x0000000059800000-0x000000005986E000-memory.dmp

Download

memory/2292-48-0x0000000050000000-0x0000000050117000-memory.dmp

Download

memory/2292-68-0x0000000000400000-0x0000000000603000-memory.dmp

Download

memory/2292-87-0x0000000074EC0000-0x0000000074FA3000-memory.dmp

Download

memory/2292-88-0x00007FFB4F3F0000-0x00007FFB4F5E5000-memory.dmp

Download

memory/4176-166-0x0000000074EC0000-0x0000000074FA3000-memory.dmp

Download

memory/4176-912-0x0000000073D20000-0x0000000074642000-memory.dmp

Download

memory/4176-131-0x0000000059800000-0x000000005986E000-memory.dmp

Download

memory/4176-134-0x0000000050120000-0x000000005030E000-memory.dmp

Download

memory/4176-135-0x0000000061E00000-0x0000000061ECA000-memory.dmp

Download

memory/4176-143-0x0000000000400000-0x0000000000603000-memory.dmp

Download

memory/4176-149-0x0000000061E00000-0x0000000061ECA000-memory.dmp

Download

memory/4176-167-0x00007FFB4F3F0000-0x00007FFB4F5E5000-memory.dmp

Download

memory/4176-963-0x0000000073D20000-0x0000000074642000-memory.dmp

Download

memory/4176-1149-0x0000000073D20000-0x0000000074642000-memory.dmp

Download

memory/4176-130-0x0000000050000000-0x0000000050117000-memory.dmp

Download

memory/4176-129-0x0000000000400000-0x0000000000603000-memory.dmp

Download

memory/4176-197-0x0000000073D20000-0x0000000074642000-memory.dmp

Download

memory/4176-169-0x0000000074EC0000-0x0000000074FA3000-memory.dmp

Download

memory/4176-226-0x0000000073D20000-0x0000000074642000-memory.dmp

Download

memory/4176-994-0x0000000073D20000-0x0000000074642000-memory.dmp

Download

memory/4176-173-0x0000000074EC0000-0x0000000074FA3000-memory.dmp

Download

memory/4176-1039-0x0000000073D20000-0x0000000074642000-memory.dmp

Download

memory/4176-181-0x0000000073D20000-0x0000000074642000-memory.dmp

Download

memory/4176-530-0x0000000073D20000-0x0000000074642000-memory.dmp

Download

memory/4176-1116-0x0000000073D20000-0x0000000074642000-memory.dmp

Download

memory/4800-901-0x00007FFB4DAD0000-0x00007FFB4DAD1000-memory.dmp

Download

memory/4800-948-0x000001BC5D1C0000-0x000001BC5D8FF000-memory.dmp

Download