hijackloader | 16628054549d3e1f10ea645ab7e34be6ee10934ea483951489c6ce32eef7921e

Analysis

max time kernel
299s
max time network
298s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
02/08/2026, 13:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PQLGBHSD.msi
Size 6.7MB
Sample260802-qpascsteka
SHA256 16628054549d3e1f10ea645ab7e34be6ee10934ea483951489c6ce32eef7921e
MD5 1f2972abda045d02a5c7266180dbcc30
SHA1 078dd51ea09a9d7e841c00378eeb1fb2226b5ffa
SHA512 3b43e22a38aedf28808e218570944e17a0483534efce250d77ca270d00b6ddbb6380edbcfe51835009b7b87485ea797746da0e7c42d1b621c1719b79a731ea93
SSDEEP 196608:bdz/6ety7BYWr27nWfwx9qO7EkJPAWqpq3n7nT:pz/65F2LgOXqbpqv
TLSH
T1216633E3D5782522F32756F488376A8994104D0443F39AE76699F8AD1EFA26CEC704CF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access discovery hijackloader loader persistence privilege_escalation ransomware spyware stealer

Malware Config

Extracted

Family

hijackloader

Attributes

directory
%APPDATA%\CitiumDataset
inject_dll
%windir%\SysWOW64\rasapi32.dll

xor.hex

Signatures

Family: HijackLoader, IDAT loader, Ghostulse,
HijackLoader is a multi-stage loader, first seen in 2023.
loader hijackloader

Detects HijackLoader (aka IDAT Loader) 1 IoCs

resource	yara_rule
behavioral2/files/0x0007000000028693-86.dat	family_hijackloader

Executes dropped EXE 10 IoCs

pid	Process
4908	S_Fusion.exe
5180	S_Fusion.exe
5932	Boost Note.exe
2788	Boost Note.exe
2992	Boost Note.exe
772	Boost Note.exe
2084	Boost Note.exe
4712	Boost Note.exe
6232	Boost Note.exe
1156	Boost Note.exe

Loads dropped DLL 29 IoCs

pid	Process
4908	S_Fusion.exe
4908	S_Fusion.exe
4908	S_Fusion.exe
4908	S_Fusion.exe
4908	S_Fusion.exe
4908	S_Fusion.exe
4908	S_Fusion.exe
4908	S_Fusion.exe
5180	S_Fusion.exe
5180	S_Fusion.exe
5180	S_Fusion.exe
5180	S_Fusion.exe
5180	S_Fusion.exe
5180	S_Fusion.exe
5180	S_Fusion.exe
5932	Boost Note.exe
2788	Boost Note.exe
2788	Boost Note.exe
2788	Boost Note.exe
2788	Boost Note.exe
2992	Boost Note.exe
772	Boost Note.exe
2084	Boost Note.exe
2084	Boost Note.exe
2084	Boost Note.exe
2084	Boost Note.exe
4712	Boost Note.exe
6232	Boost Note.exe
1156	Boost Note.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1131776342-1023621610-2767477260-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\electron.app.Boost Note = "C:\\Users\\Admin\\AppData\\Local\\MegaSuitelyTechMaxx\\Boost Note.exe"	Boost Note.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1131776342-1023621610-2767477260-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\electron.app.Boost Note = "C:\\Users\\Admin\\AppData\\Local\\MegaSuitelyTechMaxx\\Boost Note.exe"	Boost Note.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 5180 set thread context of 1612	5180	S_Fusion.exe	105
PID 5180 set thread context of 1956	5180	S_Fusion.exe	120
PID 5180 set thread context of 1612	5180	S_Fusion.exe	105
PID 5180 set thread context of 2204	5180	S_Fusion.exe	135
PID 5180 set thread context of 6624	5180	S_Fusion.exe	148

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\kaa.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mk.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mr.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sa.txt	S_Fusion.exe
File opened for modification	C:\Program Files\Windows Defender\ThirdPartyNotices.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bg.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ga.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gu.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ja.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ne.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sl.txt	S_Fusion.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt	S_Fusion.exe
File opened for modification	C:\Program Files\Java\jre-1.8\README.txt	S_Fusion.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientARMRefer_eula.txt	S_Fusion.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\WacLangPack2019Eula.txt	S_Fusion.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Configuration\card_terms_dict.txt	S_Fusion.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\THANKS.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\el.txt	S_Fusion.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\WacLangPackEula.txt	S_Fusion.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\requests\README.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\af.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\id.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lij.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mn.txt	S_Fusion.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\AugLoop\third-party-notices.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cs.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fi.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ka.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nl.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tg.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\readme.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fa.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fur.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kk.txt	S_Fusion.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime2019_eula.txt	S_Fusion.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\SkypeForBusinessVDI2019_eula.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\de.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ms.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ps.txt	S_Fusion.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\THIRDPARTYLICENSEREADME.txt	S_Fusion.exe
File opened for modification	C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bn.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pl.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spl.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-tw.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\da.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eu.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\va.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\yo.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\es.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\si.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-cn.txt	S_Fusion.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt	S_Fusion.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\SkypeForBusinessBasic2019_eula.txt	S_Fusion.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Configuration\card_expiration_terms_dict.txt	S_Fusion.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\COPYING.txt	S_Fusion.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_Mocking.help.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\az.txt	S_Fusion.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack2019_eula.txt	S_Fusion.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_BeforeEach_AfterEach.help.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fy.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ko.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sw.txt	S_Fusion.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\e587acc.msi	msiexec.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_2064_59012305\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2064_1510619188\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2064_1510619188\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2064_1510619188\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2064_1510619188\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2064_1510619188\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2064_1510619188\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2064_1510619188\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2064_1510619188\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2064_1510619188\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2064_1510619188\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2064_1510619188\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2064_1510619188\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2064_1200358147\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\Installer\e587ad0.msi	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2064_1510619188\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2064_1510619188\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2064_1510619188\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2064_1510619188\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2064_1510619188\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2064_1200358147\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2064_1510619188\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2064_1510619188\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2064_1510619188\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2064_1510619188\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2064_489595002\protocols.json	msedge.exe
File created	C:\Windows\Installer\e587ac9.msi	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2064_1510619188\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2064_1510619188\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2064_1510619188\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2064_1510619188\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2064_1510619188\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2064_1510619188\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2064_1510619188\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\Installer\SourceHash{C1DD30EA-5531-47E7-AE22-33D5D3A54E9E}	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2064_1510619188\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2064_1510619188\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2064_1510619188\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2064_1510619188\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2064_1510619188\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2064_489595002\manifest.json	msedge.exe
File opened for modification	C:\Windows\Installer\e587ac9.msi	msiexec.exe
File created	C:\Windows\Installer\e587acc.msi	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2064_1510619188\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2064_1510619188\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2064_1510619188\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2064_1510619188\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2064_1510619188\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2064_1510619188\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\Installer\SourceHash{FFB98429-A8F9-4371-A79E-522A72B1D19A}	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2064_1510619188\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2064_1510619188\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2064_1510619188\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2064_1510619188\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2064_1510619188\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2064_1297428566\manifest.json	msedge.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2064_1510619188\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2064_1510619188\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2064_1510619188\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2064_1510619188\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2064_1510619188\_locales\my\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
4676	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	S_Fusion.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	S_Fusion.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe

System Time Discovery 1 TTPs 4 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4576	chrome.exe
2424	msedge.exe
6224	chrome.exe
6756	msedge.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000009f4cc38cfb5b1d5f0000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c01200000000ffffffff0000000027010100008838019f4cc38c0000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d083020000000000c050dc000000ffffffff000000000700010000e841019f4cc38c000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090d4de0000000000000005000000ffffffff000000000700010000486a6f9f4cc38c00000000000090d4de000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090d4e30000000000000005000000ffffffff00000000070001000048ea719f4cc38c00000000000090d4e300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134301514891941758"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1131776342-1023621610-2767477260-1000\{A186DD55-D4FA-4154-98EF-2773F8B68A9E}	msedge.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5180	S_Fusion.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4532	msiexec.exe
4532	msiexec.exe
4908	S_Fusion.exe
5180	S_Fusion.exe
5180	S_Fusion.exe
5180	S_Fusion.exe
5180	S_Fusion.exe
5180	S_Fusion.exe
5180	S_Fusion.exe
5180	S_Fusion.exe
5180	S_Fusion.exe
5180	S_Fusion.exe
5180	S_Fusion.exe
5180	S_Fusion.exe
5180	S_Fusion.exe
5180	S_Fusion.exe
1612	chrome.exe
1612	chrome.exe
5180	S_Fusion.exe
5180	S_Fusion.exe
5180	S_Fusion.exe
5180	S_Fusion.exe
5180	S_Fusion.exe
5180	S_Fusion.exe
4532	msiexec.exe
4532	msiexec.exe
5180	S_Fusion.exe
5180	S_Fusion.exe
5180	S_Fusion.exe
5180	S_Fusion.exe
5180	S_Fusion.exe
5180	S_Fusion.exe
5180	S_Fusion.exe
5180	S_Fusion.exe
5180	S_Fusion.exe
5180	S_Fusion.exe
5180	S_Fusion.exe
5180	S_Fusion.exe
2992	Boost Note.exe
2992	Boost Note.exe
4712	Boost Note.exe
4712	Boost Note.exe
5180	S_Fusion.exe
5180	S_Fusion.exe
5180	S_Fusion.exe
5180	S_Fusion.exe
5180	S_Fusion.exe
5180	S_Fusion.exe
5180	S_Fusion.exe
5180	S_Fusion.exe
5180	S_Fusion.exe
5180	S_Fusion.exe
5180	S_Fusion.exe
5180	S_Fusion.exe
5180	S_Fusion.exe
5180	S_Fusion.exe
5180	S_Fusion.exe
5180	S_Fusion.exe
5180	S_Fusion.exe
5180	S_Fusion.exe
5180	S_Fusion.exe
5180	S_Fusion.exe
5180	S_Fusion.exe
5180	S_Fusion.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5180	S_Fusion.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4676	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4676	msiexec.exe
Token: SeSecurityPrivilege	4532	msiexec.exe
Token: SeCreateTokenPrivilege	4676	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4676	msiexec.exe
Token: SeLockMemoryPrivilege	4676	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4676	msiexec.exe
Token: SeMachineAccountPrivilege	4676	msiexec.exe
Token: SeTcbPrivilege	4676	msiexec.exe
Token: SeSecurityPrivilege	4676	msiexec.exe
Token: SeTakeOwnershipPrivilege	4676	msiexec.exe
Token: SeLoadDriverPrivilege	4676	msiexec.exe
Token: SeSystemProfilePrivilege	4676	msiexec.exe
Token: SeSystemtimePrivilege	4676	msiexec.exe
Token: SeProfSingleProcessPrivilege	4676	msiexec.exe
Token: SeIncBasePriorityPrivilege	4676	msiexec.exe
Token: SeCreatePagefilePrivilege	4676	msiexec.exe
Token: SeCreatePermanentPrivilege	4676	msiexec.exe
Token: SeBackupPrivilege	4676	msiexec.exe
Token: SeRestorePrivilege	4676	msiexec.exe
Token: SeShutdownPrivilege	4676	msiexec.exe
Token: SeDebugPrivilege	4676	msiexec.exe
Token: SeAuditPrivilege	4676	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4676	msiexec.exe
Token: SeChangeNotifyPrivilege	4676	msiexec.exe
Token: SeRemoteShutdownPrivilege	4676	msiexec.exe
Token: SeUndockPrivilege	4676	msiexec.exe
Token: SeSyncAgentPrivilege	4676	msiexec.exe
Token: SeEnableDelegationPrivilege	4676	msiexec.exe
Token: SeManageVolumePrivilege	4676	msiexec.exe
Token: SeImpersonatePrivilege	4676	msiexec.exe
Token: SeCreateGlobalPrivilege	4676	msiexec.exe
Token: SeBackupPrivilege	4936	vssvc.exe
Token: SeRestorePrivilege	4936	vssvc.exe
Token: SeAuditPrivilege	4936	vssvc.exe
Token: SeBackupPrivilege	4532	msiexec.exe
Token: SeRestorePrivilege	4532	msiexec.exe
Token: SeRestorePrivilege	4532	msiexec.exe
Token: SeTakeOwnershipPrivilege	4532	msiexec.exe
Token: SeRestorePrivilege	4532	msiexec.exe
Token: SeTakeOwnershipPrivilege	4532	msiexec.exe
Token: SeRestorePrivilege	4532	msiexec.exe
Token: SeTakeOwnershipPrivilege	4532	msiexec.exe
Token: SeRestorePrivilege	4532	msiexec.exe
Token: SeTakeOwnershipPrivilege	4532	msiexec.exe
Token: SeRestorePrivilege	4532	msiexec.exe
Token: SeTakeOwnershipPrivilege	4532	msiexec.exe
Token: SeRestorePrivilege	4532	msiexec.exe
Token: SeTakeOwnershipPrivilege	4532	msiexec.exe
Token: SeRestorePrivilege	4532	msiexec.exe
Token: SeTakeOwnershipPrivilege	4532	msiexec.exe
Token: SeRestorePrivilege	4532	msiexec.exe
Token: SeTakeOwnershipPrivilege	4532	msiexec.exe
Token: SeRestorePrivilege	4532	msiexec.exe
Token: SeTakeOwnershipPrivilege	4532	msiexec.exe
Token: SeRestorePrivilege	4532	msiexec.exe
Token: SeTakeOwnershipPrivilege	4532	msiexec.exe
Token: SeRestorePrivilege	4532	msiexec.exe
Token: SeTakeOwnershipPrivilege	4532	msiexec.exe
Token: SeRestorePrivilege	4532	msiexec.exe
Token: SeTakeOwnershipPrivilege	4532	msiexec.exe
Token: SeRestorePrivilege	4532	msiexec.exe
Token: SeTakeOwnershipPrivilege	4532	msiexec.exe
Token: SeRestorePrivilege	4532	msiexec.exe

Suspicious use of FindShellTrayWindow 37 IoCs

pid	Process
4676	msiexec.exe
4676	msiexec.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
2064	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe
1612	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4532 wrote to memory of 5172	4532	msiexec.exe	94
PID 4532 wrote to memory of 4908	4532	msiexec.exe	97
PID 4908 wrote to memory of 5180	4908	S_Fusion.exe	99
PID 5180 wrote to memory of 1576	5180	S_Fusion.exe	103
PID 1612 wrote to memory of 4616	1612	chrome.exe	106
PID 1612 wrote to memory of 4576	1612	chrome.exe	107
PID 1612 wrote to memory of 5288	1612	chrome.exe	108
PID 1612 wrote to memory of 4012	1612	chrome.exe	109
PID 1612 wrote to memory of 5288	1612	chrome.exe	108
PID 1612 wrote to memory of 4012	1612	chrome.exe	109
PID 1612 wrote to memory of 1172	1612	chrome.exe	111
PID 1612 wrote to memory of 1888	1612	chrome.exe	112
PID 1612 wrote to memory of 1172	1612	chrome.exe	111
PID 1612 wrote to memory of 1888	1612	chrome.exe	112
PID 1612 wrote to memory of 4836	1612	chrome.exe	113
PID 1612 wrote to memory of 4836	1612	chrome.exe	113
PID 1612 wrote to memory of 3432	1612	chrome.exe	114
PID 1612 wrote to memory of 3432	1612	chrome.exe	114
PID 5180 wrote to memory of 1612	5180	S_Fusion.exe	105
PID 5180 wrote to memory of 1612	5180	S_Fusion.exe	105
PID 5180 wrote to memory of 1612	5180	S_Fusion.exe	105
PID 5180 wrote to memory of 1612	5180	S_Fusion.exe	105
PID 5180 wrote to memory of 1612	5180	S_Fusion.exe	105
PID 1612 wrote to memory of 5912	1612	chrome.exe	116
PID 5180 wrote to memory of 1956	5180	S_Fusion.exe	120
PID 5180 wrote to memory of 1956	5180	S_Fusion.exe	120
PID 5180 wrote to memory of 1956	5180	S_Fusion.exe	120
PID 5180 wrote to memory of 1956	5180	S_Fusion.exe	120
PID 5180 wrote to memory of 1956	5180	S_Fusion.exe	120
PID 5180 wrote to memory of 1956	5180	S_Fusion.exe	120
PID 4532 wrote to memory of 5932	4532	msiexec.exe	122
PID 5932 wrote to memory of 2788	5932	Boost Note.exe	123
PID 5932 wrote to memory of 2992	5932	Boost Note.exe	124
PID 772 wrote to memory of 2084	772	Boost Note.exe	128
PID 772 wrote to memory of 4712	772	Boost Note.exe	129
PID 5180 wrote to memory of 1612	5180	S_Fusion.exe	105
PID 5180 wrote to memory of 1612	5180	S_Fusion.exe	105
PID 5180 wrote to memory of 1612	5180	S_Fusion.exe	105
PID 5180 wrote to memory of 1612	5180	S_Fusion.exe	105
PID 5180 wrote to memory of 1612	5180	S_Fusion.exe	105
PID 1612 wrote to memory of 1696	1612	chrome.exe	131
PID 1612 wrote to memory of 1032	1612	chrome.exe	132
PID 1612 wrote to memory of 696	1612	chrome.exe	133
PID 5180 wrote to memory of 2204	5180	S_Fusion.exe	135
PID 5180 wrote to memory of 2204	5180	S_Fusion.exe	135
PID 5180 wrote to memory of 2204	5180	S_Fusion.exe	135
PID 5180 wrote to memory of 2204	5180	S_Fusion.exe	135
PID 5180 wrote to memory of 2204	5180	S_Fusion.exe	135
PID 5180 wrote to memory of 2204	5180	S_Fusion.exe	135
PID 5168 wrote to memory of 2064	5168	msedge.exe	138
PID 2064 wrote to memory of 2972	2064	msedge.exe	139
PID 2064 wrote to memory of 2424	2064	msedge.exe	140
PID 2064 wrote to memory of 4460	2064	msedge.exe	141
PID 2064 wrote to memory of 4460	2064	msedge.exe	141
PID 2064 wrote to memory of 4460	2064	msedge.exe	141
PID 2064 wrote to memory of 3356	2064	msedge.exe	143
PID 2064 wrote to memory of 3356	2064	msedge.exe	143
PID 2064 wrote to memory of 6004	2064	msedge.exe	144
PID 2064 wrote to memory of 6004	2064	msedge.exe	144
PID 2064 wrote to memory of 5232	2064	msedge.exe	145
PID 2064 wrote to memory of 6004	2064	msedge.exe	144
PID 2064 wrote to memory of 5232	2064	msedge.exe	145
PID 2064 wrote to memory of 5232	2064	msedge.exe	145
PID 5180 wrote to memory of 6624	5180	S_Fusion.exe	148

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\PQLGBHSD.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4676

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4532
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:5172
- C:\Users\Admin\AppData\Roaming\Alligator\S_Fusion.exe
  "C:\Users\Admin\AppData\Roaming\Alligator\S_Fusion.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4908
- - C:\ProgramData\CitiumDataset\S_Fusion.exe
    C:\ProgramData\CitiumDataset\S_Fusion.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of WriteProcessMemory
    PID:5180
  - - C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\ZVMqH\EasySuiteSetup.msi" /qn
      4⤵
      System Location Discovery: System Language Discovery
      PID:1576
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:1956
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:2204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:6624
- C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\Boost Note.exe
  "C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\Boost Note.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:5932
- - C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\Boost Note.exe
    "C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\Boost Note.exe" --type=gpu-process --field-trial-handle=1772,1153725083916062939,8018212570631488619,131072 --enable-features=WebComponentsV0Enabled --disable-features=CertVerifierService,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1780 /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2788
- - C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\Boost Note.exe
    "C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\Boost Note.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1772,1153725083916062939,8018212570631488619,131072 --enable-features=WebComponentsV0Enabled --disable-features=CertVerifierService,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2076 /prefetch:8
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:2992
- - C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\Boost Note.exe
    "C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\Boost Note.exe" --type=gpu-process --field-trial-handle=1772,1153725083916062939,8018212570631488619,131072 --enable-features=WebComponentsV0Enabled --disable-features=CertVerifierService,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1644 /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:6232

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4936

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c08afd90-f2a1-11d1-8455-00a0c91f3880} -Embedding
1⤵
PID:5820

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3864

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff858bdc728,0x7ff858bdc734,0x7ff858bdc740
  2⤵
  PID:4616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2152,i,18202584864727622460,9955911490837831605,524288 --field-trial-handle=2016,i,8700595597927348909,7618704589457992104,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=2660 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1732,i,12158523589593747451,13433276792666724578,262144 --field-trial-handle=2016,i,8700595597927348909,7618704589457992104,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=2012 /prefetch:2
  2⤵
  PID:5288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2264,i,5248831148176978837,12306648503115871791,524288 --field-trial-handle=2016,i,8700595597927348909,7618704589457992104,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=2688 /prefetch:8
  2⤵
  PID:4012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3196,i,9581673194447523201,10654848540680655366,2097152 --field-trial-handle=2016,i,8700595597927348909,7618704589457992104,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:1172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3228,i,2027346756802842044,232294896200806659,2097152 --field-trial-handle=2016,i,8700595597927348909,7618704589457992104,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:1888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4444,i,15308135087511621764,14352127326646336468,2097152 --field-trial-handle=2016,i,8700595597927348909,7618704589457992104,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4448 /prefetch:2
  2⤵
  PID:4836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4660,i,16811615140327441502,773095335457726159,2097152 --field-trial-handle=2016,i,8700595597927348909,7618704589457992104,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3180 /prefetch:1
  2⤵
  PID:3432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5712,i,14363081822342966653,5743127556809925484,524288 --field-trial-handle=2016,i,8700595597927348909,7618704589457992104,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4420 /prefetch:8
  2⤵
  PID:5912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6000,i,13390127972220804432,15201072203330829048,524288 --field-trial-handle=2016,i,8700595597927348909,7618704589457992104,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=6056 /prefetch:8
  2⤵
  PID:1696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6036,i,2479655074783590541,13079044816606388055,524288 --field-trial-handle=2016,i,8700595597927348909,7618704589457992104,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5548 /prefetch:8
  2⤵
  PID:1032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6032,i,3984582496025334045,5408018467916007757,524288 --field-trial-handle=2016,i,8700595597927348909,7618704589457992104,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=6024 /prefetch:8
  2⤵
  PID:696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2152,i,6525098542542983549,4627416995965519505,524288 --field-trial-handle=2016,i,8700595597927348909,7618704589457992104,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=2644 /prefetch:3
  2⤵
  - System Time Discovery
  PID:6224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5944,i,14097558446737668341,7998313841527501624,262144 --field-trial-handle=2016,i,8700595597927348909,7618704589457992104,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3848 /prefetch:8
  2⤵
  PID:6688

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3088

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1696

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5256

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4368

C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\Boost Note.exe
"C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\Boost Note.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:772
- C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\Boost Note.exe
  "C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\Boost Note.exe" --type=gpu-process --field-trial-handle=1820,10087168349777035358,15301890541016029784,131072 --enable-features=WebComponentsV0Enabled --disable-features=CertVerifierService,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1828 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2084
- C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\Boost Note.exe
  "C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\Boost Note.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1820,10087168349777035358,15301890541016029784,131072 --enable-features=WebComponentsV0Enabled --disable-features=CertVerifierService,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2144 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:4712
- C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\Boost Note.exe
  "C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\Boost Note.exe" --type=gpu-process --field-trial-handle=1820,10087168349777035358,15301890541016029784,131072 --enable-features=WebComponentsV0Enabled --disable-features=CertVerifierService,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2208 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1156

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1812

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1720

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch
  2⤵
  - Drops file in Windows directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x25c,0x260,0x264,0x230,0x26c,0x7ff8413fc188,0x7ff8413fc194,0x7ff8413fc1a0
    3⤵
    PID:2972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1936,i,1697368475413674671,11074308940302969346,524288 --field-trial-handle=2240,i,17250097338678773636,13220338197704862151,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:3
    3⤵
    - System Time Discovery
    PID:2424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1672,i,6879910193615806169,14617416723543199321,262144 --field-trial-handle=2240,i,17250097338678773636,13220338197704862151,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:2
    3⤵
    PID:4460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2576,i,8936187475919753501,12905913770772204653,524288 --field-trial-handle=2240,i,17250097338678773636,13220338197704862151,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:8
    3⤵
    PID:3356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3392,i,6176557868749904548,14595537989323022309,2097152 --field-trial-handle=2240,i,17250097338678773636,13220338197704862151,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:1
    3⤵
    PID:6004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3396,i,10896550719261622293,11609645564976943580,2097152 --field-trial-handle=2240,i,17250097338678773636,13220338197704862151,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
    3⤵
    PID:5232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5196,i,13710013183191657005,5281963789998016839,524288 --field-trial-handle=2240,i,17250097338678773636,13220338197704862151,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:8
    3⤵
    PID:5216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5172,i,17240015498055621263,5075650971372433193,524288 --field-trial-handle=2240,i,17250097338678773636,13220338197704862151,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:8
    3⤵
    PID:2436
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,2636215596952027443,7428732779235673229,524288 --field-trial-handle=2240,i,17250097338678773636,13220338197704862151,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:8
    3⤵
    PID:6388
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,2636215596952027443,7428732779235673229,524288 --field-trial-handle=2240,i,17250097338678773636,13220338197704862151,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:8
    3⤵
    PID:6404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,4571548386685236116,7245241537177213879,524288 --field-trial-handle=2240,i,17250097338678773636,13220338197704862151,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:8
    3⤵
    PID:4852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5076,i,3192308787736477571,16502464409329490713,524288 --field-trial-handle=2240,i,17250097338678773636,13220338197704862151,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:8
    3⤵
    PID:892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5036,i,4959843049844301700,18080857083687911199,524288 --field-trial-handle=2240,i,17250097338678773636,13220338197704862151,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:8
    3⤵
    PID:6152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,4225062558708056210,16936441468113324159,524288 --field-trial-handle=2240,i,17250097338678773636,13220338197704862151,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:8
    3⤵
    PID:6324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6156,i,15188820209406359784,13483751024534456659,524288 --field-trial-handle=2240,i,17250097338678773636,13220338197704862151,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:8
    3⤵
    PID:6656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2816,i,6384350053419704459,15468422362679530398,524288 --field-trial-handle=2240,i,17250097338678773636,13220338197704862151,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:8
    3⤵
    PID:6612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5248,i,8661837312657991338,2886040394525985903,524288 --field-trial-handle=2240,i,17250097338678773636,13220338197704862151,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:8
    3⤵
    PID:6828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1936,i,8347401180617562003,11425865400945959366,524288 --field-trial-handle=2240,i,17250097338678773636,13220338197704862151,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:3
    3⤵
    - System Time Discovery
    PID:6756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,3455527426273094134,16961801658118732814,524288 --field-trial-handle=2240,i,17250097338678773636,13220338197704862151,262144 --variations-seed-version --mojo-platform-channel-handle=4112 /prefetch:8
    3⤵
    PID:5248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6376,i,1459847640072725557,9227134370041326166,524288 --field-trial-handle=2240,i,17250097338678773636,13220338197704862151,262144 --variations-seed-version --mojo-platform-channel-handle=4120 /prefetch:8
    3⤵
    PID:3048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=780,i,7797992955296650649,16174362741582825638,524288 --field-trial-handle=2240,i,17250097338678773636,13220338197704862151,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:8
    3⤵
    PID:5108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5228,i,3985765281301225838,7353423973127204571,524288 --field-trial-handle=2240,i,17250097338678773636,13220338197704862151,262144 --variations-seed-version --mojo-platform-channel-handle=2164 /prefetch:8
    3⤵
    PID:6316

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4960

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6688

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6684

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e587aca.rbs

Path C:\Config.Msi\e587aca.rbs
Size 9KB
SHA256 44d22a29ff04a71e5a4f6b50904303ef4e978e1ae12ec5ad6070788049341355
MD5 77f87880147d67d5d2ab62815b9b0205
SHA1 a93c33622bb6e11c827585b0513eb17e14846029
SHA512 c3a9089e60cd87ebb3ea16bbf2c871b1d2de74520cf9f56fa88152f976505529e949a459e9e1d6926f0f8f0e2ab555e05dfd77c1450560aa60c4b4258ba59e1b
SSDEEP 192:zJH0QPeTq5q7TfbIQfbSVqXqhaGPq+TqBq2q0ZnZs54pzfDZN1ZNVZNaZNnZNOZV:zd/Sq5q/fjf+VqXqsGPq+TqBq2q0ZnZX
TLSH
T17B224481B944D3C1FCB62774837B971873AEA3E5DB207B0F0A9D45648E927CCAB491E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e587acf.rbs

Path C:\Config.Msi\e587acf.rbs
Size 144KB
SHA256 26212fdddee502364f8751ab95776168d34061492ae9b7debd9aa3b376338804
MD5 4e3e993b2ece1f1e876cb0ecadda00ed
SHA1 076c922dfa7f91ae0a612619b2db68b2afba5b1a
SHA512 17fff0ea5ca5f96d48d86d309c79ada883e3fe3e5fa195432d5502351a897e0aff5911c467b0270ef22ec748d21c95cffaa32c3abacdace10db85bb03cc0bc55
SSDEEP 1536:3h7vGI7BNvGVKytG7cWyxFh8SEid7Y029R5/T46lnrQes0+S6+YxMJY:55UG7wFX
TLSH
T1D4E3E0B752F5B7778D28457B72E3F43C85A40DAACA1D2B091138443F25D26EB7EC6A08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 cf346e6f9977693c39eba0c7b3e565fab5d9b86733e986ed57e96875ae12942e
MD5 54d600171f7b491bb99429d970c34d37
SHA1 6094065670a7030a6cfbf5acd268b3bc7ba96d77
SHA512 3d6599eff3d1836535d4300fac3559c54bcc4f4dc21724ada2ae4fb929106cf08819286ff03dfaad06bf6b7744bf173852802e5f253173513e48da92804824b4
TLSH
T164E02BE9C922EC3718FD071954944B07E74523075660995F3B3CE10DCFF163A4249C1C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 97ac94db49f75cdf2e2dd5104d7224c86d51b775c044438153001854a3b4f0ef
MD5 82854187a5d0ed34c249f85a7fcc5143
SHA1 4e5916f91a93e10244c71c685faa33bec692854c
SHA512 ee543acf20fc82f9ef663a0e66841adaf1c681527ceb51a36033bdaf32363115eb6083b2c0ac2506bd9641d3aabf2b6194d59fa81a7e5a4e62fb421c9f17c282
TLSH
T101519DF7D3E89A7D851592F4EB216E1FDE2D0A24121D3D62C8D4AE1B43E2872D20138E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 347e587cd6fad8d9b5933c7708cd9ab9bbe83ea63efa5f9b89c0f1249f55c665
MD5 9b070883e0b291cb55f8828d9f0eeb71
SHA1 252c1ea630a007b7550a834f9a21d1acfae538ad
SHA512 79c65af0c78cc092674821b541e56bd1efc70a7eb02d19f0c181f040c7e38a5f3eacc55a3da5c3a4dcd5c626ccfcff5b56132f18ab96292a1ca0b6ab4a1ab17f
SSDEEP 192:fRzQGRyH2sEhXv7SIpAPRp279jHsb+WNnoI40hQ+2+ursvkwkamfVyIsnAUgtaJ:fRzQ2yHy/OIUX4xw80J2+u+Eai8
TLSH
T1EB42B72EE910653B6CDBC21EF9127B63D7FA102131992E88E6FC896C15E75CD2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 16KB
SHA256 8e5179699c2a278f1d2a616134b76a1bc4c632150c35427e2e460e54868f006b
MD5 d0810a491692cd094e7884b78a36f6b4
SHA1 5bb9570ee1661d2ec000ba77864e725643e50069
SHA512 1c55c6fef0d5e1d3ef1df2701f0485c2a26a1c1f50c9d561d03684c26cf28b39714dc78dcee055a7fab50357f3ad10ab9b1143664963860d428a3cfc4fdf0bf4
SSDEEP 384:97j3e7KxkXqKf/pUZNCgVLH2Hfgsl3z7pLuLcMJ0XOD3a+ErU3klHGuDp2gAn:933e7KxkXqKf/pUZNCgVLH2Hfgs9z7p2
TLSH
T15872E8677C4C9A770F94C9CCD8267B4FADB6014B65EDC86883FA982503D5BCB01461EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 d77325e1df12533577c792db8502c09a1511c92f5213c3cbdb8b45127972a983
MD5 607510717d62b5a50e375eadd191fc33
SHA1 dd0731ff2f4bd6c73c8014a2a6ad6a2fedb9f5f1
SHA512 a3a39f31d2459335b713956892110b6a3b1153de0b46094b58e8547e49129d878f65441e21e708c697eab1eac3047e0673fb095d50cf2b4279b9d8683eda2aa3
TLSH
T18EB01280C0016101C50203F81252348C71249F10970E170143E069268A355508014150
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5af619.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5af619.TMP
Size 96B
SHA256 f7f0ee8d0067244148a2e3faf2bd700f8cb614ae0fee8718ef312bfd7de04969
MD5 9fd7c59843c10d423382188f5c464313
SHA1 b34fb4f59cf9fde4bc2984859f5e8ddf417791f5
SHA512 c0b706fe293930195bc4b429dd86f030ac2987a7fb4a029cfbfad0fac54f48ea61d215c4619b4928f8f86835d27e282bcefebf995e6dae35ab1e7eb96d826f66
TLSH
T1DAB0025DC243A223C54383B0299595E87570EF25C6035A16D3E21E76DD296744625661
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 390ab7984d4e01206ffb90e7ab6bdf2732852765dafb82548c892e5357f6d825
MD5 1073945aa62345bd1f19d84872936fc2
SHA1 72c3fe53af8c60631b98433d026de02a966432a2
SHA512 3e1da3b18899755da004230f11eed64b984fea6701184393ba85de801801d810612c1bdbb9debc031f3c7e52f195d626313d82c71a5376606a22033af8172270
SSDEEP 1536:XTwZlAmf1mWUYZchNBoXUF1F8Mh9azKCW3iw9xODQ7B6wQtLPyedtK0XMBg/Qu+y:Dw3LffUnBKU/F8enCW3iyVEXGey0cB1i
TLSH
T1BFB31331E596FE6BA369563AB40F93181CE249FB44E1B788447C3F19F0C6288EF59C54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 d2856c2820a7302aeaa6198ce4e092e8e0f950cdca48323e72fc335f68225a47
MD5 5c4e8968a7eaf06a0ea166d91ef688d2
SHA1 058317d44492645eaaa1204fc187e255741354fa
SHA512 640ae0bd035009b0841865b6ac8fd8cb018799a4789516e7ab7e8abc38db99e27bb503a5a1eea638a501c48352e51659f63fd21265e1b3d781f435f4bdc6d78a
SSDEEP 6144:zJ8i0Aw9NDv+qw5ZtAX3LfqBZqenbyyVEd1cB1o:1eNO5Zt6LCVDueno
TLSH
T139341231AE12DD6B83D9593AB40F930D1DD0AD7FC5D5EAC8686C3F69918E198AD2E800
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 58c6f6d59e9fbb787e1582aeb4a347ea8d98b05646861059fcde88c438248611
MD5 03f655330209f5a1df90e76f436bc08e
SHA1 f1051944b08191fdd1c6e920632867a9995d487c
SHA512 fa47773bcb6412519f06f0a9248b6e3ac353f8e86e681ee24404c60225954c3f3e65bfa150916bdbeed1339309a9c902e524dc9e0d1ba27dbd9fdd8f78c54bfb
SSDEEP 6144:u8i0Aw9NDv+qw5ZtAX3LfqBZqenbyyVEd1cB1o:ueNO5Zt6LCVDueno
TLSH
T12F342231AF13DD6B93D9157BB80FC70D5DC0AC7F84D1EBD954683F2E918A298AD2A804
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 7d8573152fb4ba04d66446aa3858451a2bd6672b63cfe0c15a031598a9391ddd
MD5 eeaf8d4b50ce189a8da281a3db500b79
SHA1 c270de69da986655c2ad35e27cfb10f86d70fca9
SHA512 df6b82aec84e3ff36ab95def6894d46e61422811f5433bb8db6c0c8a49d76fd3e4999e79e92d90bf9598a72e5944e17d79dcb3d66968f07c3be06d8d5f1434ba
SSDEEP 1536:BswZlAmf1mWUYZchNBoXUF1F8Mh9azKCW3iw9xODQ7B6wQtLPyedtK0XMBg/Qu+P:Cw3LffUnBKU/F8enCW3iyVEXGey0cB1/
TLSH
T1B2C31331F4AAFE6B93A9563BB40B93191CD144FF44E1A788447C3F19A0C6288FF99C44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\chrome_100_percent.pak
Size 123KB
SHA256 f1a935db8236203cbc1dcbb9672d98e0bd2fa514429a3f2f82a26e0eb23a4ff9
MD5 a59ea69d64bf4f748401dc5a46a65854
SHA1 111c4cc792991faf947a33386a5862e3205b0cff
SHA512 12a1d953df00b6464ecc132a6e5b9ec3b301c7b3cefe12cbcad27a496d2d218f89e2087dd01d293d37f29391937fcbad937f7d5cf2a6f303539883e2afe3dacd
SSDEEP 3072:YerKzw9bpxlr+bEfF2DGb0+VvfGGY304F2DExm/KLQ2I:YeKzw9Vh90Gb0OveGe04mExhLY
TLSH
T187C3D0D373F0ED7DCF6756B7A52A41B1ECB302391A92034A469AD8356A27348DDC8393
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\chrome_200_percent.pak
Size 183KB
SHA256 7f9ded50d81c50f9c6ed89591fa621fabbd45cef150c8aabcceb3b7a9de5603b
MD5 1985b8fc603db4d83df72cfaeeac7c50
SHA1 5b02363de1c193827062bfa628261b1ec16bd8cf
SHA512 27e90dd18cbce0e27c70b395895ef60a8d2f2f3c3f2ca38f48b7ecf6b0d5e6fefbe88df7e7c98224222b34ff0fbd60268fdec17440f1055535a79002044c955b
SSDEEP 3072:yDfDQYaEM+9bslr+bEfEfRIGMR+F8fQnYw9pGbXGYoDd+qHqRxmeK/rIM0:6DQYaF+9bMhCWGMRe8InVXYopym74
TLSH
T12E04D1D7A3F49D3CDAB30A77553A01F1ECB6127516A3424A42DBAC347A5678C4CC9293
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\d3dcompiler_47.dll
Size 4.3MB
SHA256 44422e6936dc72b7ac5ed16bb8bcae164b7554513e52efb66a3e942cec328a47
MD5 7641e39b7da4077084d2afe7c31032e0
SHA1 2256644f69435ff2fee76deb04d918083960d1eb
SHA512 8010e1cb17fa18bbf72d8344e1d63ded7cef7be6e7c13434fa6d8e22ce1d58a4d426959bdcb031502d4b145e29cb111af929fcbc66001111fbc6d7a19e8800a5
SSDEEP 49152:aYlc/220PPiMLKam+VMrLi21f4i3jn5ZO3XUDmOZQwVd2uQpN3WsGVUWd55i/jrs:a6KD2Mrdaix4NQnLt
TLSH
T16F267D5677A840A9C27BC178CA574313EBB1781403349BEF55A0C665EF33BD26E3A728
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\ffmpeg.dll
Size 2.7MB
SHA256 8653b57b37618f11e358c93aad9dc9ef0193f0288f7e59147194e42b0842b50e
MD5 b34d74a152e1788532b0acfa8cfbdf1e
SHA1 e99e5a26d8b695b57cb1a1bb0d2c032d822d0461
SHA512 06f8def21101d8c899c321b3a445e6838f824d6d6305d569b49fb7ad14a197a57c601a8965c50057e7af1d5414b74dd2c79e2f27a58eedab31b3b36202947dd9
SSDEEP 49152:nSFoiJBtTcoQ9mjUBA6vXH4VjB0kxryYTK8gJ2EDE+oM0iloSa08UHdiVqAy6cTC:ijUBA656ryEpEdiVq4
TLSH
T1DFD59D0BF2A645DDC029C53083AFA233F934394A4725A6EF16A156252F3FFD0667EB05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\icudtl.dat
Size 9.9MB
SHA256 02db39ba465fc8b7a4cd280732760f29911edde87b331bf7cea7677e94d483e0
MD5 70499b58dc18e7ee1d7452a1d7a8bc6e
SHA1 41c5382f08c6a88670ce73a20c0dcdb3822f19e9
SHA512 a80939e9809bb7d20f00ad685c94d5c182fa729616c975e605abf09afb58376be73a49fefa35b75ed1a284eccf208af7656c8df44c5959df7eaf51367d232dc6
SSDEEP 196608:uUGwSv9AAQnt6liXUxR0rHa93WhlU6t7CLhl:uoKlQnAliXUxR0rHa93WhlU6t+Ln
TLSH
T131A63947A2FB4DC2F9FBAF30D8F452679467BD496E32805A11042F3B5C373A096617A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\locales\en-US.pak
Size 85KB
SHA256 ac1cdb4fb4d9fb27a908ed0e24cc9cc2bd885bc3ffba7e08b0b907fd4d1a8c4b
MD5 6bbeeb72daebc3b0cbd9c39e820c87a9
SHA1 bd9ebec2d3fc03a2b27f128cf2660b33a3344f43
SHA512 66944fb1abcc2a7e08e5fd8a2cee53eb9da57653d7880aea226f25879e26379f7d745ebf62a3518378fa503f3a31b3ea3716f49fe4c7db4f4af0228b81b53a10
SSDEEP 1536:MzBh0wu6Y90fYSKD0R4RlQ2trhWMJ5dBxgMSO0JedMVrBHhQYVfD3ggl+C/fpkwG:6hp1YSwhBxgrvQY3ggl+CGwG
TLSH
T1BB835E1BE3C41266099243227F06E3B6AB26D079936311663C6CC16C3777FA982777E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\resources.pak
Size 4.9MB
SHA256 367467609a389b67600628760c26732fc1a25f563f73263bc2c4bf6eec9033df
MD5 5507bc28022b806ea7a3c3bc65a1c256
SHA1 9f8d3a56fef7374c46cd3557f73855d585692b54
SHA512 ae698d4feacc3e908981ee44df3a9d76e42a39bf083eaf099442ace2b863f882b43232e26e2c18051ca7aec81dccef5742acc7b82fb0cda2e14086b14d5a9a26
SSDEEP 98304:1jMQZikLH2tMPwSGBNumogFJlFlh1wTJntwyqWBsCiLeD8crwrb:tMqimHmGfgfhyTh8YsCi6Qckrb
TLSH
T1FB362302F2E4283BC6DB31766C6BA161B73444471068BD2E7A9D52DCAF5492802FEFF5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\resources\app\index.js
Size 240KB
SHA256 176f28d4929e80b0039851d31297cc3db98cfc2813216ecda880d7dc63668618
MD5 54e9cc07b1bf0158f749a741a23921fa
SHA1 d811807a19ae6d733b9cd902e700f7d836862b77
SHA512 26204d6fe601cf916d30cf3f984a8ab272a422f3b5bc99c65fee7bc56a8302e0e45a98dcfa9165ef19286c3ea8cd89a377b250726dea3ab2e56b430b13f325d9
SSDEEP 3072:/hprLsKuviSpbMECceMtJmCC4j9X1aQllVO1V:/hprLs7viShChMtVC4j9FU7
TLSH
T1303495843BCAA0D2421935F1063F3615B56E4D627A0CCA88D7FAB49EFDB930594B7E34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

license

Path C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\resources\app\node_modules\file-type\license
Size 1KB
SHA256 5c932d88256b4ab958f64a856fa48e8bd1f55bc1d96b8149c65689e0c61789d3
MD5 d5f2a6dd0192dcc7c833e50bb9017337
SHA1 80674912e3033be358331910ba27d5812369c2fc
SHA512 d1f336ff272bc6b96dc9a04a7d0ef8f02936dd594f514060340478ee575fe01d55fc7a174df5814a4faf72c8462b012998eca7bb898e3f9a3e87205fb9135af2
TLSH
T18221931E7254136318BA13A0696A6CC4B32BB11F7DAF6B8418ADF244233B46CD4FB840
MD5 SHA1 SHA512 TLSH

Submit Download

license

Path C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\resources\app\node_modules\normalize-url\license
Size 1KB
SHA256 48da2f39e100d4085767e94966b43f4fa95ff6a0698fba57ed460914e35f94a0
MD5 915042b5df33c31a6db2b37eadaa00e3
SHA1 5aaf48196ddd4d007a3067aa7f30303ca8e4b29c
SHA512 9c8b2def76ae5ffe4d636166bf9635d7abd69cdac4bf819a2145f7969646d39ae95c96364bc117f9fa544b98518c294233455d4f665af430c75d70798dd4ab13
TLSH
T1EC11931D7254136318BA13A069696CC4B32BB11F79AF6B8418AEF244233B46CD4FB840
MD5 SHA1 SHA512 TLSH

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\resources\app\package.json
Size 326B
SHA256 ed559a3a3027667ce6302f1debaed9aef5bef1c6d4236ec4da01199b398f78b2
MD5 48f234e36eba960bf0f66519a219e17e
SHA1 988d574c95e613f177e81417c590540f77ed9845
SHA512 08ac57c789dd209ceebdc73d5ee709ee141811f0955b982454c3459eeac9353eec08aac68646d18c55a181a1f5f64f56fcbebe203597dabef54f2deb40e5e276
TLSH
T128E08C18DC499E23129B888A3068014728612C079959F80DB79E930C1E5C96FB2FCAAD
MD5 SHA1 SHA512 TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\swiftshader\libEGL.dll
Size 458KB
SHA256 bfd1d3fb9e50a3d9a58d9c62663fbf46bedcac24744020b801c9bb4cdc55f977
MD5 21a07ee229edc5d8de61de97f1a65210
SHA1 a60f93adbad349e25cca0eca5a81c78fbf24f133
SHA512 6375d8bda8cc187f79f6ea0cfd8358ac0d85508327f44d0bbcca641a934fa2b690933eb1ab588821a2f63f6615b1926aa433bc759b787015170aff11e633d0e4
SSDEEP 6144:e6txlbRay7iVeTIM4gkZ8A9YfCmpmXZvrpeK8MbhGG+gwLuggcAgAeG4:ePZ4IM4u7BmXZXGuTcAD
TLSH
T13CA47C16B7A504A9D036C4348A574A43DA71B8DA0F74EBEF0294A27D2F7B7E05F39324
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\swiftshader\libGLESv2.dll
Size 3.1MB
SHA256 54b6e787450bfcebed843ad1dafb31ca0904a908131d1005b567513ee8e2db46
MD5 07a0f70d8e06fcb7e9063f39c0ab8c68
SHA1 896f3401b019c31ab1de2a376a66829daceccadb
SHA512 f58e4b23eca4aa4eef435288fc4d3740ea700debe82e083167a68df709c383f8bb7393ee74558acae8804ed105536ac86c5657912a98d284a1fc57dcf25586ff
SSDEEP 49152:cgnhCIFndJN3alVO7hUADGoJJ5AtyPzaaujA84dvCilHS4E0JhHHRBHpJbftopLw:TYIFnXoLfauC1DeFR
TLSH
T1EFE55A43E08880D9E05DD5BC874BA62EE132BC856B7272DF12946B222E77BF0573DB54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\v8_context_snapshot.bin
Size 160KB
SHA256 31c3aa5645b5487bf484fd910379003786523f3063e946ef9b50d257d0ee5790
MD5 b64c1fc7d75234994012c86dc5af10a6
SHA1 d0d562b5735d28381d59d0d86078ff6b493a678e
SHA512 6218fcb74ef715030a2dd718c87b32f41e976dd4ce459c54a45341ee0f5ca5c927ad507d3afcffe7298b989e969885ed7fb72030ea59387609e8bd5c4b8eb60a
SSDEEP 3072:pBgpuz1xV9mRTUAnPH5lZw15qCy0CmiRNiA0hTBAzZs7q/JBXTPv:p4O1xoTPyqIRhTBAzZs7kJ1TPv
TLSH
T1F2F3121427D0829096ED4094A25B06E7C5D26C6D1E2CFF0A3BB5FD4C0AA3DCE55FE1B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8365d8597d396643eb3cb27ae8751c52f3b1ae3e25576cd2bd50becbaaae5ffd
MD5 b16e94a14013394e81faaffb1edb0866
SHA1 095be96d92aca0f788caa8c464e88fe0093428bb
SHA512 d08bfded37a6166d23fc97a47902156684e9e48ea9630c13d74b30f201e0b1cbdefd310a06a35543c33ad6c261585c043ccdbbaf6a515ba32c8540521104e42a
TLSH
T12CD022223B4AB000E2AB4132E2228740236908A128824604A218C86C4EA00C022C22C6
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 357B
SHA256 021412f30e9c1dab4099bf127081036fa822516c63dde57c1da790cb89d4565e
MD5 755f2465d1a166a9b6b4072b6bf155c0
SHA1 7f9b33b2f6d6376f3fb240b4fa7330a63bc2a643
SHA512 c175a010ae050f1c56b734b292b7e49a643a975888aecb6c43bd2d6ce4058ba2ea8eb29b71931b7940d2ccfb916970263cb8f91b9f378b59a4804955d32c5c6c
TLSH
T104E0D8A54292CD950943E64FE06EB31CA8E1700FEBCCF8993A07ECC4288510556579A1
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 268B
SHA256 ae99fdfc3fbac7deff206af98556f3993f1c3f40fe1176939f3effc93833bc8d
MD5 9683ee0effa2bfca240118d3a9a92e68
SHA1 7f5846f3cd2adc8fd0788f67733e1a66a9a4502d
SHA512 063dd8a1a4838b395fcd50939ca3e5b24ac72a8407ffd4463838b0b2ee5bb8d41938609e4216ead91f6f1a45a694113987c815ba88fb7d83f6eb6cc2fa33d737
TLSH
T194D02B9AFDEC9E5ED7E41ABD5BA5B4000A4802A2840B9B1300747EC03495AF01E25030
MD5 SHA1 SHA512 TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 c912e898b2aea9e7c74e92909ac193e33034cb5dc6ad5ad8aa0f63481bd28167
MD5 47cb9a39aed91086bb487792898f1059
SHA1 a85252d8d3aeeb2dca59625ee21be1cb24a6105e
SHA512 8d395d1bb6a8358e1c9b2edcfa2ca1d097800434cc88082e28520822dbb3b35bbb2b76974f6f58102a162ce8b2b96c1e4d417200a4f0ad89f5dd6f07a31bc2cb
TLSH
T1C0E02BBAC931BC2B08FA0B6810900B06EA5123172790851BBA3D96098FB433B02C68EC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 6f648cc51337b8aa3e9f3142d6ea61743ff0dcfb8adb40bf6ca09512568a96f0
MD5 bdfe22e6c61370445d161d4c2bea7603
SHA1 eae1a8a6eb523f044bc006e11188024e808ef5aa
SHA512 fd4bf108ac8d6ae05441d7bee5be7f5d497b5630cb5ddf5e48608575aae884586a9b7acf2f0e32bec9b9822eb528415c81594452ef66bb47eee60cbf394ce0b2
SSDEEP 96:RlPdaqqAqIEqcV/gX2FzqdqwIfzbqm5H06quktqqBeEOqO8NT3lv/qDzqQ/jqHqj:hVqAEt5H8lXfQR
TLSH
T1B2C11953D4D92894DB120032AEFBC9483F73A296B50B4F6BD16A4C6C390F7EC6E75620
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 8b707b711f2846ec52bfa22a3d0dfa6f0896145599a638bb751c187953c90e7c
MD5 002b8ceb353e41d5f311516167b96298
SHA1 fdef2bf144cb0f306f35234eab95f800b3abca1c
SHA512 021911ab6d77d12e728e7b0e5d4e034427d34521a84a5b6d1f6c77e5bd902d0a83ed52d117444d066b3f38c232ed1ce5f3d299cd8de693b51154dbaa5d880014
SSDEEP 192:sxZaQUnDRyyMqZjK1Ml8M30/fsXsmx0CZtJ8bWLoodp4wHW6+WNBaJ/YqoyrfIgF:sxZMnDT/0/fOsmx0EtJ/LtFHbC/JjZ
TLSH
T1AC820816AA34593B8CE7D219F9067F63E7F8157395808E5495FC8A0C08E7BED2213C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 3263f528cd347b1ec178701b978cc74972d04ea777e7e37a5c1fddce0ba206c3
MD5 0be87126f896faa87c90546fe49d30bf
SHA1 d34ab11bfabfe846b0292702792a69138fc3f54b
SHA512 cb0d8a5a57524961bdbce0602e78fbf3a142d853e60f7ed8795a57fdcf32cfdd86e0396043d420a36bf191fedd7f80ee564e86f46f0b78d3b1c4a789b10ad36d
SSDEEP 768:+IM2tRw7pLuLnF5WvF32/8F1+UoAYDCx9Tuqh0VfUC9xbog/OVFf1sLl2cNV9ros:+IM2tR8EnF5WvF32/u1ja8f1sLUcV2ly
TLSH
T1C6F20B3B6C0CCB7A4F844E9CDD2A6E8A6DE8018FA6D8895487F9484C03C66EF11175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\3b15da60-2b0a-45cd-8620-f9f71b059842\index-dir\the-real-index
Size 2KB
SHA256 fda8eb4ecd0973e242329118bbfaf026d533b78b142f013f0c3f8545d318ba38
MD5 216ee3937169ec965b8a2487bbd8a6cc
SHA1 0471954253eafd1ceb5f21a28419099fe2102384
SHA512 21058e236b76037b49fe3ae86c45ba2729cf58ca8f92b94bdc4d62eff8e5aee8b0c4781a22ca9b299311109aedc3d1fc21d0eb4622784e9df24be5fbb98403dc
TLSH
T1A341949E4D45566AD9A848B314B224A437F0C9DC6754CA1368FD2236B883B9D1E1B39C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\3b15da60-2b0a-45cd-8620-f9f71b059842\index-dir\the-real-index
Size 3KB
SHA256 aef0cf5050320cffe1028e32febe5b0d819e468086159997d9438569176e1f8c
MD5 2a85b944c81b908dfd581a58f5870924
SHA1 89748ebc9eacf4ab3c238201a459e47d60f93e5b
SHA512 9d22620706d1675942a8dcc162fccd7782b54ef9835b450a61da5a480a7857c2e51c569093e878201999c0c96ae1d094b60251118eef6ec184fb3f1c63ae5b67
TLSH
T1E951D80E4D462A6ADDBC11B32CF714D837B2A4DE9648DE1B749CB030BCC77291E2E216
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5b3c4a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\3b15da60-2b0a-45cd-8620-f9f71b059842\index-dir\the-real-index~RFe5b3c4a.TMP
Size 2KB
SHA256 b7c3549e6b8b65822c5bd58497d9d50c6542b3fb8af47302ffc8bb0b0a9a5af6
MD5 2c0b988e05a95b678f46c8d17550fbae
SHA1 4006d45d5204a4d1877e191b973fc42bec80b330
SHA512 1805d510cb019fe2a834fed7729b344fae1f57127e242c8e5521df6dfeda16b872b3cce4874922422ba2c15f31c7fa70df72df2f22f6e3a555ebe836b06a9378
TLSH
T1AB41BA8E4D42462EDC9440B309D264B43339990087557F4774FC96367CE13AD3D5E2D4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d2eb43c7-daf1-4278-a520-20f79a71b9b1\index-dir\the-real-index
Size 72B
SHA256 f26c4e638b017b593629b85f7bb79f99bd9f682f1ffba3b8b43e3aee1a36199b
MD5 496b7950a1b4b5af6f5d2332f7e58b2e
SHA1 3624f515ecce3af769a0fa24f3271eadc9e58fc0
SHA512 f9621b28f40201dbc69cca24b24324668b91b25013882d0f28055d5cb274b93825c6dc9198115da654938d8dbb21ee1dcdf072bbb824ca99da30df3bf1a7352b
TLSH
T14EA0021117C4100DCC1712F55AEA12451304CA146110930740D20458DC664C54E4200C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d2eb43c7-daf1-4278-a520-20f79a71b9b1\index-dir\the-real-index
Size 72B
SHA256 cb296ad17c71e6cd1156c05ffd20d6d15a3f61d6aa281467243afc8826ddf0a3
MD5 70e9be79407613f8c016701f81045b38
SHA1 fe05f189f60fbe815464dc913504debe47e35e90
SHA512 3558278bf866337e46a2feb2b7a12d19bbe796477a5fe3e8d604acbab922859c7b6e689618f63aaa6da10d5c98d93afa8e2bc7827c67da313e1df261c2a45e55
TLSH
T1E2A0021542C0405BC04612F035D682B123105E10A601170595910AA4C8985E5554700C
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 717583bc86c73835be41acd961408030ecc1e41dc6d1a79564eb9e8da78e0433
MD5 cf1de6e412587a7c8284c5e6f4499173
SHA1 340ce2d6d3db9ae68d8eca4566f42cf5daa05435
SHA512 a0cbe3b98e89499b67bff15bc7f4d4afc9fdb15f286f12b3c674a47c2286b3513eec8d480113980a9caebbf6a397776c24aa013ceb53098dc3727d8b5662da26
TLSH
T1AFE0D8FB3DF72820ED2FC3D5283145A4424578F4C855BC4E6819AEE720B23153456C62
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 5c47f654cc9389d2cf5db2b8ad1031a69526673033aee5ac8d60e95cbca2d32f
MD5 65c528cada7bf2cf7a5817fce7badef0
SHA1 7511203f0c5a62161b25819b9eba8af65646ef36
SHA512 6bf5f5f3b19978103eb5a29c77ac4b1fb5acd52eb08d68e437f03623ff938972f88fae8a62d120503fb63a8f135c274cefca1baba2de046030030d6f53a93094
TLSH
T188A00261CA49A095C4060A717B7591407BD05CBB02051302DAD8A0B88DEA18056C6111
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5b9324.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5b9324.TMP
Size 48B
SHA256 76df7e8b6a90bdb53cbd64c6a9eebb5fa72041be9876b4d2f6969b4958274dce
MD5 caa0cbc19dab8ef79c8f2377e245b60a
SHA1 7e5db6c74a51a5da3f4a6b66bfc9ea7f132a9c40
SHA512 ed7234747dee3b450aeb73a42f4c412ff4f3bd43f70e996b21e48c42e10221263e1602d8df0ff1a7bfe666583dd9d74145958a8d143d6ccfb833d2ce689c769a
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 eba4dfd988af0fe49f34c4b3ccba98815628054e1c044033e56d5dc38fc8e625
MD5 793f6015520b732c9193d042af420a06
SHA1 c14949b33b228ae4e47c5f15c17cc444a3eff74d
SHA512 6689192f457d0bdeda4f28422274d04081833ef5ac0a9277ebf8040faece8c36cb6bf790634bb5a4a70998728037b69bb72aacac871df6e8330f85d3f598facb
SSDEEP 96:KMkAKd6OezWKEADWcKHqy6UgKhCK7+Ko8iq68K3qYKAKjai6oIKp+SaUKXquWJSi:KrFjPXY9/gfrWThFLh/DNTVl37v2
TLSH
T1B0B24E16703B12027CBD2908A7A6D577DD8231B33119E66F7BA804A64E67E225DFCCCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 550b46f40b0479f0c60de51de4d1bd0ba1d6d2910f4c6cb842b1b6ff1063f0fd
MD5 cc87b4b67524372088aedd5e92414171
SHA1 d0963b3a8a48722117a2ef051256f759a9d98b6c
SHA512 e1fb05c4c1ef135ed9b1f26d616081ee0429b1beec4f5386a2ade93d041bbd9ceb0be202d26a7a6c3225a9b1ced49a02c2da994636aa2b0058d21253195de6dc
SSDEEP 384:nJiF9CcmyWCs3sNK8TUNTUlImkrn7fWmdmiBf+UGfyFJboYvoRe4KV8p0/Lpty/0:gFccps3Bwg3FGfiERI8p0/LL
TLSH
T152B25B36EC98CAB7EDE74F99B74A7603EEE0116786D899E4DAD81D0D00971DD030B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 e9366f5d737be0b938376f7150b7d90ed62522c8a7c1e3d9eeb63477b9dc0f20
MD5 24af82aa45277f7f0f56652bcc0892ce
SHA1 30fa930a6be56610d6bff6e3edc7ce8ebf22d3b2
SHA512 414c014c91b472da951296606fcfc2540714a63a50d8da9a3e25055eb20bcc44995613ebc502965bfb633e608ac1d1b4dafa33ce330d854e86c54b9de460aa3b
SSDEEP 384:nYiFiZcIZ3sNI8TUNTUlI4kXTa7fWHGJiBf+UGfyFJboYvt1rDonTKwBODNZOC+Q:jFQZ3zwgCEGfi7DonewBKZOV6
TLSH
T1A1D26B72EC68C9B7EDE79A89B74A7603DEE04163D5CC9AE8D6DC6D1C009719D030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 19c7a018eb0eea2179e38e4cdaeb004b9091939d5b9077f2b6d016c1b39deb1d
MD5 d7c3a278fea1f1703ef8983e9d4ac938
SHA1 14fbb0bf56e6f6ec1632a1038e7c3d3ec259fa6f
SHA512 de51179da4d823b0ecc717e390d119b86d2d34e06da7bbc34c1d2625aac358a2cd6dc6addf55f1ac445c11fd7ec57dd41e9fa733a97aacff79972f2ae9fa8b03
SSDEEP 384:nxiFiZcIZ3sNI8TUNTUlI4kXTa7fW8PJiBf+UGfyFJboYvt1rDonTKwBODNZOC+Q:YFQZ3zwguEGfi7DonewBKZOV6
TLSH
T1E2D26B72EC68CAB7ECE79A89B74A7603DEE04163D5CC9AE8D6DC6D1C009719D030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 3fde963b7f2d17fc076785f348d1f09ef9ff7362501847d02bd96f6f5a40666a
MD5 0117036f67dadc42bfa9abdbba604f35
SHA1 9968606bb8f55e92811174194bb0aaffe5fd1d23
SHA512 2f1bd8ba7e63687f8faa95b4fccf9e37f41bbcf3de3976291dd9dcbe437475ffe82c6cf109cf02487ccc7aabb6625114a824c92278264e8f96e94b5ef284f87c
SSDEEP 384:nFiF9CcmyWCs3sNs8TUNTUlImkrn7fWElaiBf+UGfyFJboYvt1rBoe4KV8p0/LpB:MFccps3DwgNpGfi7BoI8p0/LL
TLSH
T187C24C36EC54CAB7ECE74B99B74A3603DEE05167C68C9AE4DADC1D4D009B19D430B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 3ac125cc73eb396cef6ef5619b7adbc8d51575a847525658e64dfee7343f078e
MD5 8215082e9ca8f745156d16231f3fe192
SHA1 db010749fcaf3a8f077d2f784b1bd54242c4e1a3
SHA512 e72e1e932bfa28b34ccf7e8dfd68568f7431449a8eb432a6aa5dca963f61915aee0ebe91ba86c088bc471daad463525d768ee5caf14e2e3a8ea6849b26684026
SSDEEP 384:naiFiZcIH/3sNI8TUNTUlI4kXTa7fW8PJizf+UGfyFJboYvt1rAponTKwBODNZOE:RFQf3zwguYGfi7AponewBKZOV6
TLSH
T18DD26B72EC68D9B7ECE79A89B74A7603DEE04163D5CC9AE4D6DC6D1C009729D030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 0fd11dd35aad1bd4ba18942c421d88d5ec0a04f716de48e2d3379b5a17e086d6
MD5 dac0a896a942ee34ea2c4967f72c83dd
SHA1 2c86e3107591f7507f2d7d4103e85b78be3bb5ba
SHA512 16afdf019439a3e52f75a30112455acbe10eb881e1126bbf1c7a3e833f8314553b10a55620aace8b362dbccc412f83176361580f0e2d5592e433ff1cb14cc923
TLSH
T1093182E0483C2AD1D4BD09AF345B34FC95D8C736F5A8303C6894E9A9067E14D758483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 946356855dc261d343d13f40d1f8219dd987c5fb7be91dcf0821046690c73548
MD5 d50cc1ddc1e35e96815ddd2c164fefb1
SHA1 8e00d8417416240177ff7971e07b9e39dbb79c7f
SHA512 0cf8f3b523586bea74426bf264c6e38ea81d0ba12ae601b512f22005531e8788094b7498ef41bae59ff0f4af99354241ddc453b2948d8c03209b8a2fe652e1ad
TLSH
T1A6315DE088381AD2D4BD09AF345B38FC95E8D736F1A434386898E9A8067A15D718483F
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 95f99312a3dd7841cc596624841eeffb16a91e8bed500307ccb6a64faa44555c
MD5 68c7033681f65cef77d10372ae89f64d
SHA1 730e72cf9c354325ac025596abc72f70fe230c63
SHA512 43a769b6e183f481add3eb1897f453f257d1105810fe19bbc0afd9fe928218b9164f7b2aa360ffe35cec1bacaa8f8ce49e0ec49c58b6e31a133f41a4f7cf3b13
TLSH
T184411A98BAFA1108B3B77F5A5BF2A86D447FB9372E0AD45D10110D8F0A62B40C871B37
MD5 SHA1 SHA512 TLSH

Submit Download

biIX.7z

Path C:\Users\Admin\AppData\Local\Temp\biIX.7z
Size 18KB
SHA256 14011623319733458bcf2f75b148c630f55168f6068192e33186d9be1ae1a4a8
MD5 4ace24a570100981ed9e7c8b936cf6e6
SHA1 8b1e811bd3de99af02f5db65182d2d6162a0ea9f
SHA512 b13897f63a581f6b3bbd1aff18d41ed42f4352cc80dc3e22c95241b45e2cc42dd542758fa6e447cee63964738b5f7eede16589a4b78892db59119e2f5f0a920b
SSDEEP 384:jB4or+1gH6BYxcHg1UMA2g7znLWXJlujUfl4dTcMwmDWdxyL:KoigbOHg1Uj2g7uujUfl45cMwWWdxyL
TLSH
T14E82D01AE59CEC14D7FD8D90896C100EC626F5C34D00BE8F5B5A09FE9BF1642B02D5EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

S_Fusion.exe

Path C:\Users\Admin\AppData\Roaming\Alligator\S_Fusion.exe
Size 1.8MB
SHA256 c82d2de495350be0453d25cc9939eb0ab7dd51b10f1db290c709f224465f70c1
MD5 767566fa3f21edfc0d8aac6a0fce249d
SHA1 1ebdfded1293415a125514363ba6ce2895c31433
SHA512 acc3869df411722f9e1afa425506b8cdd4dd87ff8b405e1236410ffa5f34dda252d7de9f2b0ddffe14027084315b4f09a9d7113f2e90ba5414ea70eaf8d8e483
SSDEEP 49152:/s2vpgWmekdGTl9Fg5k1nje7MQLCT/JSC6O:/xc7il9Fg5QnKH4JSC6
TLSH
T17F857C21A385C823D1632E769D2FDAD4A425BE301F38854B3FE92E0C5F79B41B929357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

clustersec.cfg

Path C:\Users\Admin\AppData\Roaming\Alligator\clustersec.cfg
Size 8KB
SHA256 37b84449458e3bf7b8a65c6f8f278d08358c55a74ac3dc92c9eb0bf03c7ab992
MD5 b5528af873719e411d44d9e50adf8a00
SHA1 a63f0b897080f5224c083082946a2605c1a57db6
SHA512 fe5ecc69908b796b5b9955eff7cb330d0cbbf8470d07aa41380ddb68589ff44f9cccb48daeab286bc3fa79d4c7a49ed920ffbe675f680e87e31289a8fbd48c81
SSDEEP 192:WpU4+RZ+qPYG3AlT6CBHMdb5HJwBn6SPOnFFUncqAdDU/VG5CfUAPFyI7gLns08J:8ioq50T6CBHMdb5pYn6SPiLUncqAdDUR
TLSH
T177023A2862472249A402FD17A724E752C347AA3AF61F400A6EC3E8458DDF76BEDCD54F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

datastate.dll

Path C:\Users\Admin\AppData\Roaming\Alligator\datastate.dll
Size 78KB
SHA256 7623436ebbed5c00bc08683bb24978562f7452f24f35af314dbf950782f64eed
MD5 64f53254054885752c22cfb17321fd71
SHA1 50c00e5c886bc15bc977147164a5fead563d2175
SHA512 9f074c5134fa38104d3e7c4d1a4ab2cf2b33fd35f1438e2cc5ce8bf01809d5a4bd173507d65a50601534789dfe0b59bb1a2cb8b40296112aa2aa77cbb5dd94c7
SSDEEP 1536:S+XrMzPCiE6BorrJIXJpCRMaR8p4kwbioQ+zXAwbtQ+8iAs:S+SE6ChIXJpCRMaR8eNtXtyDs
TLSH
T1DF738C113A50D073C95B29309495CBB2ADB97961AFF0404B3FBA077E6F613D2A73921B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dispatch16.so

Path C:\Users\Admin\AppData\Roaming\Alligator\dispatch16.so
Size 4.4MB
SHA256 18e2f2c66522f2e88b96ee862d9382e2453380566da8c8ec660f1ec89e481025
MD5 272689bdba950eac9ab08422bba79fca
SHA1 a8ea5d057b5615152986a121f9fbdf85c9f66b90
SHA512 c119e875244aaf71928e04d78e0b0f7f402684fe286ac272ce82fcbcf7237e61e4086d48d0a37db8729c2ad3ac003b10d75d0da5e7ae42a51e92b4f3fc360fe1
SSDEEP 98304:DjoDlCDrr5AwYUdLrhree90++a71IxG9M1u6/lHT7yZ/hIw6R+PZ4XW:D5XGtirhaeppIB8oHTM/j5hp
TLSH
T1702623CDC6CD8DF3F6259C770A156A48A0CBF9F402279655980BEEE4FA0D04184F6B9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

madbasic_.bpl

Path C:\Users\Admin\AppData\Roaming\Alligator\madbasic_.bpl
Size 212KB
SHA256 4926203fdd4fd70b55409e84728faf927d71274fb368193205d44e4f04a605f8
MD5 73bc46c0170de5d72d1e5e0df51ee68f
SHA1 bc92d0c16258b2a42ad9774fa7b6006bc32607ed
SHA512 642b19235bc62c26610092a865a1cabb7421296ac1885d1a50e99affe92a732347723fd028f71ff3d641a8ac7ec1567a97c8423369f28c806da9dbe00cd09e9b
SSDEEP 6144:lN/kSQxE6qeM/k4qTl5L5e5+53WCG1CbF/FrfkXK:GqeM/k4qR5L5e5+53WulZkXK
TLSH
T10F247E36A1008C33C2A3797BCCBFB950A96479640A3644DF7DEC4E84AB5A2D5772D387
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maddisAsm_.bpl

Path C:\Users\Admin\AppData\Roaming\Alligator\maddisAsm_.bpl
Size 64KB
SHA256 20ddd0bdf076a91d9d82c8e447e1dbf6dba52fe6613cfe1e5373aeac7f889b62
MD5 f1d430eacd5aac17c5de78f0de3cf774
SHA1 b1c410ea2659d2d7a44b8458ffd98e14ef6ddb8d
SHA512 bcbf4b4c7b02ddefd78d03f1d6d047aa5729a4e8ae673ca6d72488ca7d3fc6a03893d9a6b446e6bb629927352535d85745b882c80b5913c726d5674efaf2339e
SSDEEP 1536:SNy3eqMne0sXB0IWtCLwEJhY0w1kwbioQ+RawTQ+8iAg:mqMnfIB04LwEJhY0w1N3sDg
TLSH
T18A537CB35644E037D85375728CAAE6F2A9B07A211D3050EB3CEC0B98EF567842F1965B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

madexcept_.bpl

Path C:\Users\Admin\AppData\Roaming\Alligator\madexcept_.bpl
Size 438KB
SHA256 655c2a4b484ce587c8c99cbc17f7cada640e79fc8f92b4de2d68882d79c0c815
MD5 9ff9e6b33bee8e297bbdb47e8ac9b60f
SHA1 b49d037a12c43958ab24b3869359e6ddbe8cc551
SHA512 7552139146d3cc913cb0c20ac612e194cdca01f202abb668e3451c343d8e4b5e967a3c90420817cea400a20c215b4cb4956a80896d6bb10c4f5ad720b9667109
SSDEEP 6144:FlAz49EKhEV30F8sl88nTjQ4Q50gEcW/jd+o72niVUNMa4Yn2S4fb:FlG4ut30F8slzYlQcW/jd++2nJ6u2S4T
TLSH
T104944D31D288C077D062263BCC2AD6C461B975341A34A95F7DE80F4CAF77A91AF26397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp_win.dll

Path C:\Users\Admin\AppData\Roaming\Alligator\msvcp_win.dll
Size 489KB
SHA256 a6ddbc4954687b359c4b1bc7105647828ed9c6c34fba89c395806ea2420dbb2f
MD5 1f132c76a07adc8a41b6f9859323e0e0
SHA1 85a1bb9b7b719fadcf0ee8d7f63d053f9fcb1bd5
SHA512 1b70b150df2a6fc65329c89d20e101ac94135be145c469ca356a0aa41e04bd2a84652f2675f4eff487b295474185a4db273fe4bf00c82327f3c8a4d861042d7f
SSDEEP 12288:AN9jSIScPnEd4ZiUCujHhUgiW6QR7t5s03Ooc8dHkC2esjEFPYQ:29jSISNd4ZJE03Ooc8dHkC2eOEFPH
TLSH
T135B42A237B4149B1D58A63F021CA936283F9AC6547A0F3C357EAF16DBF293D19633681
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rtl120.bpl

Path C:\Users\Admin\AppData\Roaming\Alligator\rtl120.bpl
Size 1.1MB
SHA256 b3dee68af7b2805f6cf74976b60564dcc7d6d38444078d32cdca99ee1bb5bb22
MD5 4f2040add9f5b541db07a2e866e2c5ca
SHA1 b04da67e7ba7207deb99f56062661edc919f543a
SHA512 4fc2f75a8999e1a463d97bb89ad3cfdef4dd35615df6538f794e01f98de205a19bdae9dee58ceff6e9e3f08b5497c0f62e1b971a859bce711974d5f2e2180914
SSDEEP 24576:yEsEWbADYcUsnkqB8CVxIA99SGcM8sq4eXauOOqNTLjdecRzT:pHgcTLheM
TLSH
T190356C30F34A88BBD2A626BD4519BE14ACB87E10E1A4D599ACF4CD0DB975584373C3CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Roaming\Alligator\sqlite3.dll
Size 908KB
SHA256 bc0c750c98bd413e7975e8b17b1101c346dda53100020161bc5141f77ed98932
MD5 5b5a926a887f4a9f3eecc54598f697db
SHA1 86044be248e9fac25a0d8a3dd3c617da8688b7ea
SHA512 3031b4cf17cd4261d9c36495cfb707c6be10bd1444c8e474d1f117df55cadb32fe1661f239499d6f1ba3d3d96def6f6b4eae7e3fba543c6a5c8b98dedeb91412
SSDEEP 24576:MRxNAQB74x0FwTuis6eCwjH+SW61zf/AF+e:Ma+syis/LjH+S31o
TLSH
T1BF157D46EA17A87BDC5701754607F39B0575DA30A832CB8BEBC91D68DEB3ED2160A343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Roaming\Alligator\ucrtbase.dll
Size 1.1MB
SHA256 50825771d83ed274c814961c7d84e124539821f647f71c8a60b620a3008a1605
MD5 cc3bf1319f2ef9c9718735bdbd2441a9
SHA1 ee1cd03129e6a00ed5aaf31e2c36b7f4356ae0ef
SHA512 4632f285624ba9aa963b0198ed5467dec7e71e683cd324623a255ae71d486eee61cabae135078e5dc1b75e38bf524f9547ecb00248bf93ef6691a2edab5daa5e
SSDEEP 24576:lcjIrXW7AX5t0C6HjqiEwopCJrNlkH2uuYYH5JMmcvIZPoy4TsJ4:qjIrXW0JteEwopCaTYH5JcsJ4
TLSH
T1AA455A11758580AED85C31796359F922247F72B24B7AE8C373C41AE99E305C0773AEEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcl120.bpl

Path C:\Users\Admin\AppData\Roaming\Alligator\vcl120.bpl
Size 1.9MB
SHA256 19e61333b1d1732a0af016c792f633b8f96c0ce8651d991da60e7527c2c6c559
MD5 ee485ba5230f6b7c2d94e9b0a64a510f
SHA1 3ebcd4279932a71acfd85e391ad0f3791fb69a0c
SHA512 d8d70e209814d4ca3a241f78ba8e1c4849470a45831c522a10e690c14bf82565097bed6144419c6a7a0afcfa411a02f43e7d9a177ecbbd5c6335eea67e7a5a7d
SSDEEP 24576:prKziiTDpqb13me26exdBkCWgB/S8H4PM+Hs+W0mN6WZA53lKiHLpyz6m3U:Oillexp1SG4P/lma539HLo+j
TLSH
T164957DA0B33D0DF2C5A32B7C159FAE50F925AF106360925BAAF5BC4D5EF06903A1531B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e587ac9.msi

Path C:\Windows\Installer\e587ac9.msi
Size 6.7MB
SHA256 16628054549d3e1f10ea645ab7e34be6ee10934ea483951489c6ce32eef7921e
MD5 1f2972abda045d02a5c7266180dbcc30
SHA1 078dd51ea09a9d7e841c00378eeb1fb2226b5ffa
SHA512 3b43e22a38aedf28808e218570944e17a0483534efce250d77ca270d00b6ddbb6380edbcfe51835009b7b87485ea797746da0e7c42d1b621c1719b79a731ea93
SSDEEP 196608:bdz/6ety7BYWr27nWfwx9qO7EkJPAWqpq3n7nT:pz/65F2LgOXqbpqv
TLSH
T1216633E3D5782522F32756F488376A8994104D0443F39AE76699F8AD1EFA26CEC704CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.0MB
SHA256 0e1d2bddfe06b1d66e0721fbca9318061489090423081b493937a22fbf13fc4e
MD5 ee85c6755cec87164b1811f24fb0addf
SHA1 86dcff66c59095ad6ad4706551dd012d14ebffdd
SHA512 e01f4f3cc5ddf9907f46c9d823b6ef1c91e4ec1cef4c29a5679f61a793a291b9062187145dd8c23ecb0497bb1ec4a71e4f15bbc217a00206f806ee1a3db8da04
SSDEEP 24576:VEpmg3MPdoO/vvTLz1netZm5vcbBaPoRbnothTr18y6DrWJX4ikGC7R8jA:Rg
TLSH
T16547B12476F92210E7B79E3CA8F16A234D3A7D5B9C15DE8D05411B8E0822F71EC72F66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{e5c59ef1-97f7-4c38-b16b-15581eb27435}_OnDiskSnapshotProp

Path \??\Volume{8cc34c9f-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{e5c59ef1-97f7-4c38-b16b-15581eb27435}_OnDiskSnapshotProp
Size 6KB
SHA256 abe7f9de992a34a8d2b1a8850be338a1d5fef9694332c5f5b5f28e65cf4d7ac0
MD5 2362c0ae05fafed6f40c182aa5834822
SHA1 194c8f13cf8b1a716bb9045770bd625ce411f997
SHA512 7627c097f2063bc55146c12db8534137c2eacdd80ea04031d155e3239a9b9f5cc86ea347d5ff14b107859a17fac2d508ff3e1e451b376ad25bf58aaabc37e09e
SSDEEP 96:FvjVNevc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:h0b++ZVm
TLSH
T12AD199085AF54311E2B3AB3129F14557A877B811EF33CB8E0298638E2671A10F935F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2788-870-0x00007FF8757D0000-0x00007FF8757D1000-memory.dmp

Download

memory/4908-76-0x0000000061E00000-0x0000000061ECA000-memory.dmp

Download

memory/4908-53-0x0000000061E00000-0x0000000061ECA000-memory.dmp

Download

memory/4908-70-0x0000000000400000-0x0000000000603000-memory.dmp

Download

memory/4908-88-0x00007FF8758D0000-0x00007FF875AC8000-memory.dmp

Download

memory/4908-50-0x0000000057000000-0x000000005703F000-memory.dmp

Download

memory/4908-47-0x0000000000400000-0x0000000000603000-memory.dmp

Download

memory/4908-87-0x0000000075160000-0x0000000075240000-memory.dmp

Download

memory/4908-48-0x0000000059800000-0x000000005986E000-memory.dmp

Download

memory/4908-49-0x0000000050000000-0x0000000050117000-memory.dmp

Download

memory/4908-51-0x0000000057800000-0x0000000057812000-memory.dmp

Download

memory/4908-52-0x0000000050120000-0x000000005030E000-memory.dmp

Download

memory/5180-107-0x0000000000400000-0x0000000000603000-memory.dmp

Download

memory/5180-108-0x0000000050000000-0x0000000050117000-memory.dmp

Download

memory/5180-957-0x0000000073FB0000-0x00000000748D1000-memory.dmp

Download

memory/5180-1807-0x0000000073FB0000-0x00000000748D1000-memory.dmp

Download

memory/5180-894-0x0000000073FB0000-0x00000000748D1000-memory.dmp

Download

memory/5180-187-0x0000000073FB0000-0x00000000748D1000-memory.dmp

Download

memory/5180-1032-0x0000000073FB0000-0x00000000748D1000-memory.dmp

Download

memory/5180-113-0x0000000061E00000-0x0000000061ECA000-memory.dmp

Download

memory/5180-112-0x0000000050120000-0x000000005030E000-memory.dmp

Download

memory/5180-110-0x0000000057000000-0x000000005703F000-memory.dmp

Download

memory/5180-109-0x0000000059800000-0x000000005986E000-memory.dmp

Download

memory/5180-923-0x0000000073FB0000-0x00000000748D1000-memory.dmp

Download

memory/5180-121-0x0000000000400000-0x0000000000603000-memory.dmp

Download

memory/5180-127-0x0000000061E00000-0x0000000061ECA000-memory.dmp

Download

memory/5180-142-0x0000000075160000-0x0000000075240000-memory.dmp

Download

memory/5180-143-0x00007FF8758D0000-0x00007FF875AC8000-memory.dmp

Download

memory/5180-2180-0x0000000073FB0000-0x00000000748D1000-memory.dmp

Download

memory/5180-2196-0x0000000073FB0000-0x00000000748D1000-memory.dmp

Download

memory/5180-145-0x0000000075160000-0x0000000075240000-memory.dmp

Download

memory/5180-2228-0x0000000073FB0000-0x00000000748D1000-memory.dmp

Download

memory/5180-148-0x0000000075160000-0x0000000075240000-memory.dmp

Download

memory/5180-149-0x0000000073FB0000-0x00000000748D1000-memory.dmp

Download

memory/5180-241-0x0000000073FB0000-0x00000000748D1000-memory.dmp

Download

memory/5180-163-0x0000000073FB0000-0x00000000748D1000-memory.dmp

Download