hijackloader | 16628054549d3e1f10ea645ab7e34be6ee10934ea483951489c6ce32eef7921e

Analysis

max time kernel
300s
max time network
297s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 13:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PQLGBHSD.msi
Size 6.7MB
Sample260802-qpascsteka
SHA256 16628054549d3e1f10ea645ab7e34be6ee10934ea483951489c6ce32eef7921e
MD5 1f2972abda045d02a5c7266180dbcc30
SHA1 078dd51ea09a9d7e841c00378eeb1fb2226b5ffa
SHA512 3b43e22a38aedf28808e218570944e17a0483534efce250d77ca270d00b6ddbb6380edbcfe51835009b7b87485ea797746da0e7c42d1b621c1719b79a731ea93
SSDEEP 196608:bdz/6ety7BYWr27nWfwx9qO7EkJPAWqpq3n7nT:pz/65F2LgOXqbpqv
TLSH
T1216633E3D5782522F32756F488376A8994104D0443F39AE76699F8AD1EFA26CEC704CF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access discovery hijackloader loader persistence privilege_escalation ransomware spyware stealer

Malware Config

Extracted

Family

hijackloader

Attributes

directory
%APPDATA%\CitiumDataset
inject_dll
%windir%\SysWOW64\rasapi32.dll

xor.hex

Signatures

Family: HijackLoader, IDAT loader, Ghostulse,
HijackLoader is a multi-stage loader, first seen in 2023.
loader hijackloader

Detects HijackLoader (aka IDAT Loader) 1 IoCs

resource	yara_rule
behavioral4/files/0x000d00000001c4d2-98.dat	family_hijackloader

Executes dropped EXE 2 IoCs

pid	Process
6108	S_Fusion.exe
3944	S_Fusion.exe

Loads dropped DLL 24 IoCs

pid	Process
6108	S_Fusion.exe
6108	S_Fusion.exe
6108	S_Fusion.exe
6108	S_Fusion.exe
6108	S_Fusion.exe
6108	S_Fusion.exe
6108	S_Fusion.exe
6108	S_Fusion.exe
6108	S_Fusion.exe
6108	S_Fusion.exe
6108	S_Fusion.exe
6108	S_Fusion.exe
6108	S_Fusion.exe
3944	S_Fusion.exe
3944	S_Fusion.exe
3944	S_Fusion.exe
3944	S_Fusion.exe
3944	S_Fusion.exe
3944	S_Fusion.exe
3944	S_Fusion.exe
3944	S_Fusion.exe
3944	S_Fusion.exe
3944	S_Fusion.exe
3944	S_Fusion.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 3944 set thread context of 3004	3944	S_Fusion.exe	103
PID 3944 set thread context of 5700	3944	S_Fusion.exe	128
PID 3944 set thread context of 3004	3944	S_Fusion.exe	103
PID 3944 set thread context of 832	3944	S_Fusion.exe	138

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\sq.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tg.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\yo.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-cn.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt-br.txt	S_Fusion.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\AugLoop\third-party-notices.txt	S_Fusion.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Configuration\ssn_high_group_info.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\es.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fr.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fy.txt	S_Fusion.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\jvm.hprof.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\si.txt	S_Fusion.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientARMRefer2019_eula.txt	S_Fusion.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\LyncBasic_Eula.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mn.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nn.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ug.txt	S_Fusion.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientARMRefer_eula.txt	S_Fusion.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\WacLangPackEula.txt	S_Fusion.exe
File opened for modification	C:\Program Files\Windows NT\TableTextService\TableTextServiceTigrinya.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ko.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ps.txt	S_Fusion.exe
File opened for modification	C:\Program Files\Java\jre-1.8\README.txt	S_Fusion.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientOSub2019_eula.txt	S_Fusion.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientVolumeLicense2019_eula.txt	S_Fusion.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Configuration\card_terms_dict.txt	S_Fusion.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_Pester.help.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\co.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hi.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ky.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ne.txt	S_Fusion.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Configuration\card_expiration_terms_dict.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fa.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hr.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku-ckb.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt.txt	S_Fusion.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME.txt	S_Fusion.exe
File opened for modification	C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt	S_Fusion.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack_eula.txt	S_Fusion.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\SkypeForBusinessVDI2019_eula.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\da.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hu.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lij.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lv.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ba.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cy.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sl.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-tw.txt	S_Fusion.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub_M365_eula.txt	S_Fusion.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\requests\README.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cs.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tr.txt	S_Fusion.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jmc.txt	S_Fusion.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\TPN.txt	S_Fusion.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_should.help.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ar.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mr.txt	S_Fusion.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack2019_eula.txt	S_Fusion.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\AccessMessageDismissal.txt	S_Fusion.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\ExcelMessageDismissal.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eo.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kab.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pl.txt	S_Fusion.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI7C5A.tmp	msiexec.exe
File created	C:\Windows\Installer\e597632.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF475E91BC94EC3787.TMP	msiexec.exe
File created	C:\Windows\Installer\e597630.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e597630.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFAF2E583C76133EB4.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF6DD6B00E477340BD.TMP	msiexec.exe
File created	C:\Windows\Tasks\AIImage.job	S_Fusion.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\~DF0367F5892FB127FD.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{C1DD30EA-5531-47E7-AE22-33D5D3A54E9E}	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
3076	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	S_Fusion.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	S_Fusion.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2796	chrome.exe
2260	chrome.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000005b2aeec40121f1360000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c01200000000000000000000000027010100008838015b2aeec40000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e841015b2aeec4000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e35b2aeec400000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e65b2aeec400000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134301515013368073"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3944	S_Fusion.exe

Suspicious behavior: EnumeratesProcesses 60 IoCs

pid	Process
2132	msiexec.exe
2132	msiexec.exe
6108	S_Fusion.exe
3944	S_Fusion.exe
3944	S_Fusion.exe
3944	S_Fusion.exe
3944	S_Fusion.exe
3944	S_Fusion.exe
3944	S_Fusion.exe
3944	S_Fusion.exe
3944	S_Fusion.exe
3944	S_Fusion.exe
3944	S_Fusion.exe
3944	S_Fusion.exe
3944	S_Fusion.exe
3944	S_Fusion.exe
3004	chrome.exe
3004	chrome.exe
3944	S_Fusion.exe
3944	S_Fusion.exe
3944	S_Fusion.exe
3944	S_Fusion.exe
3944	S_Fusion.exe
3944	S_Fusion.exe
3944	S_Fusion.exe
3944	S_Fusion.exe
3944	S_Fusion.exe
3944	S_Fusion.exe
3944	S_Fusion.exe
3944	S_Fusion.exe
3944	S_Fusion.exe
3944	S_Fusion.exe
3944	S_Fusion.exe
3944	S_Fusion.exe
3944	S_Fusion.exe
3944	S_Fusion.exe
3944	S_Fusion.exe
3944	S_Fusion.exe
3944	S_Fusion.exe
3944	S_Fusion.exe
3944	S_Fusion.exe
3944	S_Fusion.exe
3944	S_Fusion.exe
3944	S_Fusion.exe
3944	S_Fusion.exe
3944	S_Fusion.exe
3944	S_Fusion.exe
3944	S_Fusion.exe
3944	S_Fusion.exe
3944	S_Fusion.exe
3944	S_Fusion.exe
3944	S_Fusion.exe
3944	S_Fusion.exe
3944	S_Fusion.exe
3944	S_Fusion.exe
3944	S_Fusion.exe
3004	chrome.exe
3004	chrome.exe
4024	chrome.exe
4024	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3944	S_Fusion.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3076	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3076	msiexec.exe
Token: SeSecurityPrivilege	2132	msiexec.exe
Token: SeCreateTokenPrivilege	3076	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3076	msiexec.exe
Token: SeLockMemoryPrivilege	3076	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3076	msiexec.exe
Token: SeMachineAccountPrivilege	3076	msiexec.exe
Token: SeTcbPrivilege	3076	msiexec.exe
Token: SeSecurityPrivilege	3076	msiexec.exe
Token: SeTakeOwnershipPrivilege	3076	msiexec.exe
Token: SeLoadDriverPrivilege	3076	msiexec.exe
Token: SeSystemProfilePrivilege	3076	msiexec.exe
Token: SeSystemtimePrivilege	3076	msiexec.exe
Token: SeProfSingleProcessPrivilege	3076	msiexec.exe
Token: SeIncBasePriorityPrivilege	3076	msiexec.exe
Token: SeCreatePagefilePrivilege	3076	msiexec.exe
Token: SeCreatePermanentPrivilege	3076	msiexec.exe
Token: SeBackupPrivilege	3076	msiexec.exe
Token: SeRestorePrivilege	3076	msiexec.exe
Token: SeShutdownPrivilege	3076	msiexec.exe
Token: SeDebugPrivilege	3076	msiexec.exe
Token: SeAuditPrivilege	3076	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3076	msiexec.exe
Token: SeChangeNotifyPrivilege	3076	msiexec.exe
Token: SeRemoteShutdownPrivilege	3076	msiexec.exe
Token: SeUndockPrivilege	3076	msiexec.exe
Token: SeSyncAgentPrivilege	3076	msiexec.exe
Token: SeEnableDelegationPrivilege	3076	msiexec.exe
Token: SeManageVolumePrivilege	3076	msiexec.exe
Token: SeImpersonatePrivilege	3076	msiexec.exe
Token: SeCreateGlobalPrivilege	3076	msiexec.exe
Token: SeBackupPrivilege	3200	vssvc.exe
Token: SeRestorePrivilege	3200	vssvc.exe
Token: SeAuditPrivilege	3200	vssvc.exe
Token: SeBackupPrivilege	2132	msiexec.exe
Token: SeRestorePrivilege	2132	msiexec.exe
Token: SeRestorePrivilege	2132	msiexec.exe
Token: SeTakeOwnershipPrivilege	2132	msiexec.exe
Token: SeRestorePrivilege	2132	msiexec.exe
Token: SeTakeOwnershipPrivilege	2132	msiexec.exe
Token: SeRestorePrivilege	2132	msiexec.exe
Token: SeTakeOwnershipPrivilege	2132	msiexec.exe
Token: SeRestorePrivilege	2132	msiexec.exe
Token: SeTakeOwnershipPrivilege	2132	msiexec.exe
Token: SeRestorePrivilege	2132	msiexec.exe
Token: SeTakeOwnershipPrivilege	2132	msiexec.exe
Token: SeRestorePrivilege	2132	msiexec.exe
Token: SeTakeOwnershipPrivilege	2132	msiexec.exe
Token: SeRestorePrivilege	2132	msiexec.exe
Token: SeTakeOwnershipPrivilege	2132	msiexec.exe
Token: SeRestorePrivilege	2132	msiexec.exe
Token: SeTakeOwnershipPrivilege	2132	msiexec.exe
Token: SeRestorePrivilege	2132	msiexec.exe
Token: SeTakeOwnershipPrivilege	2132	msiexec.exe
Token: SeRestorePrivilege	2132	msiexec.exe
Token: SeTakeOwnershipPrivilege	2132	msiexec.exe
Token: SeRestorePrivilege	2132	msiexec.exe
Token: SeTakeOwnershipPrivilege	2132	msiexec.exe
Token: SeRestorePrivilege	2132	msiexec.exe
Token: SeTakeOwnershipPrivilege	2132	msiexec.exe
Token: SeRestorePrivilege	2132	msiexec.exe
Token: SeTakeOwnershipPrivilege	2132	msiexec.exe
Token: SeRestorePrivilege	2132	msiexec.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
3076	msiexec.exe
3076	msiexec.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3076	msiexec.exe
2132	msiexec.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2132 wrote to memory of 3808	2132	msiexec.exe	94
PID 2132 wrote to memory of 6108	2132	msiexec.exe	96
PID 6108 wrote to memory of 3944	6108	S_Fusion.exe	98
PID 3004 wrote to memory of 4092	3004	chrome.exe	104
PID 3004 wrote to memory of 4568	3004	chrome.exe	105
PID 3004 wrote to memory of 2796	3004	chrome.exe	107
PID 3004 wrote to memory of 4568	3004	chrome.exe	105
PID 3004 wrote to memory of 5640	3004	chrome.exe	108
PID 3004 wrote to memory of 5640	3004	chrome.exe	108
PID 3004 wrote to memory of 1108	3004	chrome.exe	109
PID 3004 wrote to memory of 1108	3004	chrome.exe	109
PID 3004 wrote to memory of 776	3004	chrome.exe	110
PID 3004 wrote to memory of 776	3004	chrome.exe	110
PID 3004 wrote to memory of 5980	3004	chrome.exe	111
PID 3004 wrote to memory of 5980	3004	chrome.exe	111
PID 3004 wrote to memory of 2808	3004	chrome.exe	112
PID 3004 wrote to memory of 2808	3004	chrome.exe	112
PID 3944 wrote to memory of 3004	3944	S_Fusion.exe	103
PID 3944 wrote to memory of 3004	3944	S_Fusion.exe	103
PID 3944 wrote to memory of 3004	3944	S_Fusion.exe	103
PID 3944 wrote to memory of 3004	3944	S_Fusion.exe	103
PID 3944 wrote to memory of 3004	3944	S_Fusion.exe	103
PID 3004 wrote to memory of 1828	3004	chrome.exe	113
PID 3004 wrote to memory of 1100	3004	chrome.exe	115
PID 3004 wrote to memory of 5060	3004	chrome.exe	116
PID 3004 wrote to memory of 1100	3004	chrome.exe	115
PID 3004 wrote to memory of 5060	3004	chrome.exe	116
PID 3004 wrote to memory of 4032	3004	chrome.exe	120
PID 3004 wrote to memory of 4028	3004	chrome.exe	121
PID 3004 wrote to memory of 4032	3004	chrome.exe	120
PID 3004 wrote to memory of 4028	3004	chrome.exe	121
PID 3004 wrote to memory of 2808	3004	chrome.exe	122
PID 3004 wrote to memory of 4388	3004	chrome.exe	123
PID 3004 wrote to memory of 2808	3004	chrome.exe	122
PID 3004 wrote to memory of 2604	3004	chrome.exe	124
PID 3004 wrote to memory of 4388	3004	chrome.exe	123
PID 3004 wrote to memory of 2604	3004	chrome.exe	124
PID 3004 wrote to memory of 5384	3004	chrome.exe	126
PID 3004 wrote to memory of 5992	3004	chrome.exe	125
PID 3004 wrote to memory of 5384	3004	chrome.exe	126
PID 3004 wrote to memory of 3400	3004	chrome.exe	127
PID 3004 wrote to memory of 5992	3004	chrome.exe	125
PID 3004 wrote to memory of 3400	3004	chrome.exe	127
PID 3944 wrote to memory of 5700	3944	S_Fusion.exe	128
PID 3944 wrote to memory of 5700	3944	S_Fusion.exe	128
PID 3944 wrote to memory of 5700	3944	S_Fusion.exe	128
PID 3944 wrote to memory of 5700	3944	S_Fusion.exe	128
PID 3944 wrote to memory of 5700	3944	S_Fusion.exe	128
PID 3944 wrote to memory of 5700	3944	S_Fusion.exe	128
PID 3004 wrote to memory of 1792	3004	chrome.exe	130
PID 3004 wrote to memory of 1792	3004	chrome.exe	130
PID 3004 wrote to memory of 472	3004	chrome.exe	131
PID 3004 wrote to memory of 4044	3004	chrome.exe	132
PID 3004 wrote to memory of 472	3004	chrome.exe	131
PID 3004 wrote to memory of 4044	3004	chrome.exe	132
PID 3944 wrote to memory of 3004	3944	S_Fusion.exe	103
PID 3944 wrote to memory of 3004	3944	S_Fusion.exe	103
PID 3944 wrote to memory of 3004	3944	S_Fusion.exe	103
PID 3944 wrote to memory of 3004	3944	S_Fusion.exe	103
PID 3944 wrote to memory of 3004	3944	S_Fusion.exe	103
PID 3004 wrote to memory of 6032	3004	chrome.exe	135
PID 3004 wrote to memory of 3324	3004	chrome.exe	136
PID 3004 wrote to memory of 3364	3004	chrome.exe	137
PID 3944 wrote to memory of 832	3944	S_Fusion.exe	138

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\PQLGBHSD.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3076

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:3808
- C:\Users\Admin\AppData\Roaming\Alligator\S_Fusion.exe
  "C:\Users\Admin\AppData\Roaming\Alligator\S_Fusion.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:6108
- - C:\ProgramData\CitiumDataset\S_Fusion.exe
    C:\ProgramData\CitiumDataset\S_Fusion.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of WriteProcessMemory
    PID:3944
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:5700
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:832

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3200

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c08afd90-f2a1-11d1-8455-00a0c91f3880} -Embedding
1⤵
PID:3400

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffa345ac728,0x7ffa345ac734,0x7ffa345ac740
  2⤵
  PID:4092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1612,i,12802030251068973250,18386636634053676426,262144 --field-trial-handle=1900,i,6795442408348654076,2025192855116043249,262144 --variations-seed-version --mojo-platform-channel-handle=1896 /prefetch:2
  2⤵
  PID:4568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1984,i,10448359113501051932,3267118374247473644,524288 --field-trial-handle=1900,i,6795442408348654076,2025192855116043249,262144 --variations-seed-version --mojo-platform-channel-handle=2096 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2164,i,8692557951918021062,724787712831783114,524288 --field-trial-handle=1900,i,6795442408348654076,2025192855116043249,262144 --variations-seed-version --mojo-platform-channel-handle=2708 /prefetch:13
  2⤵
  PID:5640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3224,i,4204834347094811843,7400496532082579309,2097152 --field-trial-handle=1900,i,6795442408348654076,2025192855116043249,262144 --variations-seed-version --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:1108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3228,i,15566575608823021995,2537609969733730904,2097152 --field-trial-handle=1900,i,6795442408348654076,2025192855116043249,262144 --variations-seed-version --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4704,i,6530967187103100500,3669565833914637874,2097152 --field-trial-handle=1900,i,6795442408348654076,2025192855116043249,262144 --variations-seed-version --mojo-platform-channel-handle=4716 /prefetch:1
  2⤵
  PID:5980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4860,i,11129428677300560008,4694920497445719082,524288 --field-trial-handle=1900,i,6795442408348654076,2025192855116043249,262144 --variations-seed-version --mojo-platform-channel-handle=4872 /prefetch:14
  2⤵
  PID:2808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5396,i,2587664461104813735,16563685945209069559,524288 --field-trial-handle=1900,i,6795442408348654076,2025192855116043249,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:14
  2⤵
  PID:1828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5512,i,4200640855503724140,15992905858109331936,2097152 --field-trial-handle=1900,i,6795442408348654076,2025192855116043249,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:1100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5488,i,18370357137701125700,8097659986407380440,2097152 --field-trial-handle=1900,i,6795442408348654076,2025192855116043249,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:5060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5832,i,1516255898120064944,11861278015448729235,2097152 --field-trial-handle=1900,i,6795442408348654076,2025192855116043249,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:1
  2⤵
  PID:4032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5704,i,7286974146132976172,17802917441689297912,2097152 --field-trial-handle=1900,i,6795442408348654076,2025192855116043249,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:4028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5836,i,6217117603765750254,1936146632396077585,2097152 --field-trial-handle=1900,i,6795442408348654076,2025192855116043249,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:1
  2⤵
  PID:2808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6368,i,2304556501987148422,13638927187156870098,2097152 --field-trial-handle=1900,i,6795442408348654076,2025192855116043249,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:1
  2⤵
  PID:4388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6252,i,10175882695217468586,12492669235645939455,524288 --field-trial-handle=1900,i,6795442408348654076,2025192855116043249,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:14
  2⤵
  PID:2604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5860,i,10396700802665833763,2775247870907939423,2097152 --field-trial-handle=1900,i,6795442408348654076,2025192855116043249,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:1
  2⤵
  PID:5992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6328,i,7539785678962700833,15656355690941106587,524288 --field-trial-handle=1900,i,6795442408348654076,2025192855116043249,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:14
  2⤵
  PID:5384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5756,i,236368291759624069,13763337479273101564,2097152 --field-trial-handle=1900,i,6795442408348654076,2025192855116043249,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:1
  2⤵
  PID:3400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5708,i,15853337580910446252,15545531585236599547,524288 --field-trial-handle=1900,i,6795442408348654076,2025192855116043249,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:14
  2⤵
  PID:1792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6304,i,5087835341345520075,13473744659704334132,2097152 --field-trial-handle=1900,i,6795442408348654076,2025192855116043249,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=4820,i,7484440615828567671,8482227976111713152,2097152 --field-trial-handle=1900,i,6795442408348654076,2025192855116043249,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:9
  2⤵
  PID:4044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5640,i,5168086596855334599,6837199571770478079,524288 --field-trial-handle=1900,i,6795442408348654076,2025192855116043249,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:14
  2⤵
  PID:6032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5892,i,13999231497982076055,3966844951514647792,524288 --field-trial-handle=1900,i,6795442408348654076,2025192855116043249,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:14
  2⤵
  PID:3324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6492,i,14487357359742285629,3953880074904754599,524288 --field-trial-handle=1900,i,6795442408348654076,2025192855116043249,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:14
  2⤵
  PID:3364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6180,i,11523096642414719182,15312220780119924264,524288 --field-trial-handle=1900,i,6795442408348654076,2025192855116043249,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6268,i,1865136323994362572,12302286504189513622,262144 --field-trial-handle=1900,i,6795442408348654076,2025192855116043249,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4024

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1200

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:4948

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3728

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5896

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1352

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4012

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e597631.rbs

Path C:\Config.Msi\e597631.rbs
Size 9KB
SHA256 15ad3af057572cddd812242390455d6ba8b218be209404d28c4e506d6804fb03
MD5 a9ff2f77ce27e3cff6a234a548222ab2
SHA1 a92a50774663ebdb71b8fb78b1a66f30a866632b
SHA512 733ed05c34db47ea689ad691854b9222d936c505fecc03ea42dfc71dc69ee33146ae3b141080736b4b9112801ef09320f1c13856b7d5e4d65deca4d3fd7d3312
SSDEEP 192:p8H0QGCGx7TfbIQfbSD9h6b+pfUjms54pcEN+NWNDN0N5uNuNp:ps/ox/fjf+D9kb+pfUjmkEAMFa7usL
TLSH
T11D227781BD94D3C1E8A677B583174B043369D3F6AB202B0F0A9D97609F537CCBA492E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 5b0a08c95aed9a67426302b036b0147af0a307b7aada4b2f7758ccc45ea31400
MD5 17fd9349e381d1a15dd1e1409df045f3
SHA1 21effc257772ba9dfeca3c8d1e8a9c121bf2ba8e
SHA512 915cded5ed3dcca9fac01e9d9d20cc34e722f415d8d5a00a51116c6039956165dd9445aea522fd61a921631a06d18ac27627514a1448fbe404ff768c9fac96bc
TLSH
T1E7519CF7C7D89A6D881156F4AB217E2FCD2D0E18521D3C26C8D8AE5F57E2872D21138E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 b5a5a20df553f0249029c5c938b110919d322be97d077af5959ae8b9bfc9eb7e
MD5 35d6826e1af0428b08d4fbd8e3c0c195
SHA1 b48e2509ad1dcffe4ceb0ba0f92e85b05d9d113a
SHA512 0f1e105aeee64465a8b61b1b04ac1080b1539db66b01ca22992980ab393f9c791ab001558c692169503d551d435d7debdf8d39a648905cc30be0215e0182105a
SSDEEP 192:bRsP+xWv7FAPRp279gHsb+WNnSIn0WQU2HecHMVyIsnAUgR:bRsPwiUXcqwh0k2gR
TLSH
T13132942EBD25687B6DCBD21DFA657793D7F6102721A02E84EAFC896C10E75CC2227407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 d28b1c49ddbc465ae067e7feb8886a8f84a1bdb179383e42e9a79d2aa38bbf34
MD5 01626086ca1d7d206a5398bb1e2cf5ba
SHA1 cd05a7a3b512cf87252c1f4d502e7e05f8e46b34
SHA512 7479c909d4195467abe7aaffddedf7fb24666024047ba1e46d3b241b46373889de049612212a24588fb0e684c7b7bf30d304ee3e68209bd9a7b70929c2166f52
SSDEEP 192:bRsP+xWv7FeKPRpI79gHsb+WNnSIn0WwU2HecHnVyIsnAUgE:bRsPwi48X2qwh0O2JE
TLSH
T1E442B42EBD25697B6DCBD21DFA657B93D7F5102721A02E84EAFC896C10E76CC2217007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 832334a8401cd9624dbdfe6c4b9f6ee63fcbd7002713a756951a6a76c718a3c7
MD5 06d438b15cc91fe8776e47070553ae34
SHA1 58941b41e166cabe03e78faacab9eb7c928332e7
SHA512 03d67293c317680d040c665c99286f2da59d0c09283c52d9475351916a8cb57847d7996b3ba47a6e5ffd33e72fbd796159e14ea0a02aca10f967859c2da133b3
SSDEEP 192:eoj4K6jf7KxkXqK4I40pUZNCgVLHrKHfFKslE/QCXzKD/QD+ErUkKN94jIAl53Ip:pjjIf7KxkXqKf/pUZNCgVLH2HfgsllCk
TLSH
T15E32E827A44D9A7B0FD8E45DDC126F8B6DF5419272780D24A2FB9C0803A97CE114A6FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 b8fb45f3d67d0d735b504776adcab0cd1299f8636b58fdc83424d86e5834fdd3
MD5 b8c7d295f505e776a29ecb1c64613076
SHA1 9b57e4b49413d7a33383c414977a34c53db5e2d0
SHA512 363a5fe6cf7a99d2a9e75404d26c19b267e3852d482fc5d31b67b75d622f41f6dd522ecd4f21d8a2ccb5f81ce8cfd6b7ea21f8c585c666b5ef78e1ca8b849eac
TLSH
T1C6A0023541D41B32CD6142B066711A4522695B1A2756930358914444999F3C15111107
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5c2a34.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe5c2a34.TMP
Size 48B
SHA256 1c4ab853caf056f4983ff9c081bee03ca2482c50396b1b0bb6505e2282e12692
MD5 cfdd3b874b5fab3a6d1515a8b4ef5a3d
SHA1 a778e813a96367616026ec2f8e818dce5ff742ef
SHA512 13c8a6e04b5768ea95b0c21e8ce58be134031723e0219ff6d7148c98b0310fe5343a94b4718f9a5458f1261168b72e0296cab815ba82e80de1b765f07b7c437f
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 124KB
SHA256 8ca4dcd06087d6dbe48c207629774ef6f815971eec156543b06085a1501cc287
MD5 011258c9ef892f55f5509bdff35a48f6
SHA1 ab8bfaec0ca1841150a943f839f7c0833b589e20
SHA512 9a570ee14def97e411ff32b612c74ef463d296725c782fa4f76fa270618d3448f36465fa40573e0b60752f287d14a88c8a6bdd15276b1e2e866c58d89df3635e
SSDEEP 3072:iHdLTq/HYb50P4w9J4aDvC3QXhbx+WIzZ2l+1hbAZ:48i0Aw9NDv+qw5ZtAZ
TLSH
T193C312316F12CC678BC55466641FDB4F5EC8BC2ED684DFEA69C4775E421A8EE202B110
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 124KB
SHA256 9d0791dd4b2e24ec3a716162fb30baf4d83167ad2c5341554a8dc603752edcb0
MD5 5510d75c1a5503ad3aa54596de5afc8e
SHA1 7642a43499e55684360a9777aba054681052370a
SHA512 90421aeeb0551a44dfa0963be23a945c8c5e5e8c75bf134a8348c0037adeae0b6fca18cfd42fded26ed5b6e1166702fcd0354d9a8c110063824db2c0dd274cdf
SSDEEP 3072:pHdLTq/HYb50P4w9J4aDvC3QXhbx+WIzZ2l+1hbAZ:N8i0Aw9NDv+qw5ZtAZ
TLSH
T148C312316F12CC678BC95466641FDB4F9EC8FC2ED684DFEA69C4775E421A8DE202B110
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 124KB
SHA256 ffb78217f73405c515e39db77a5765c039fa95cd07b0da3016a236ee95a70002
MD5 2183980d0021bcd7135d24e4d8a861cf
SHA1 598887ca05f000ad9d72fc481b4456274d017c56
SHA512 5763ac78a897ef9f73e15d96c0361389107755b7622a07c991b706d9387a7298faa816987988c048a31a4537a36120d71e91e56cfc35f8ce70efcc02e4837084
SSDEEP 3072:iYdLTq/HYb50P4w9J4aDvC3QXhbx+WIzZ2l+1hbAZ:L8i0Aw9NDv+qw5ZtAZ
TLSH
T1AFC312316F12CC678BC55466641FDB4F9EC8FC2ED684DFEA69C4775E421A8EE202B110
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 c15452cf8b84450508be24e95f0a0e34f46e035e9649c93338c1031cbe7d99b5
MD5 2acd81acb237e4be65c298ff071733cf
SHA1 b45ce96cbfdecb20c5491435c484404f0b14b4fd
SHA512 760008cb2a6af4e588f4338660adb257900cf83efec6f10e9dce67b8e3a19d062520bdd1917ff5d1a95730f82074eba8972bc33b2b5b6c5cf5030ca6ad6f04b7
SSDEEP 96:RC0d+OI4Q2k7i/jfTVZ9kuT5RDotok5G6DpB6gGyvXNQTrbfyYv4a:RC0G4DkG/FZ9kGDUDpvMAQTrbfX
TLSH
T1EDA1F771A86D8EB75976C448F5927A03CEA8A0AFA611AF54DEDC0E0C11FB1ED0342963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 d3f61aa0dab7a2de3b021963edb7035ffb652d49b70995827d90358a02ffcb5f
MD5 5660b901f7f6eee4652b59b1c8523e69
SHA1 b83d153d9ea8a912bb6195f5e38384b357d4c694
SHA512 61a4f17dc63f8970ea13f529b49782a83dc82edb37442b34f283dd4c3651b5eb7c8176ce691f8fe3038702b72f7fd69f63e2d0e9be173b379b89676ab0d99557
SSDEEP 3072:p6dLTq/HYb50P4w9J4aDvC3QXhbx+WIzZ2l+1hbAZ:48i0Aw9NDv+qw5ZtAZ
TLSH
T1F5C312322F12CCAB4BD55895641BDB4F4DC8F82FDA44EFEA68847B5E411A4EE242B510
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Rcj3uj.7z

Path C:\Users\Admin\AppData\Local\Temp\Rcj3uj.7z
Size 17KB
SHA256 09bf2e0888b4a9f6236f35dc43fce1ded923cc07e2aeecad557513433fbd1257
MD5 f1e72e2c28534f560689a7aa52998601
SHA1 0ab20d2d0a4b5603bff9744b4d86025315e452af
SHA512 32b6cde4a06c0feef4f4ae1ef8f536ec81b48d0f5a8d17b53249014cbb9324e5d07009e2473761bc7e57e598587e15b03282246a0d57871593016f50e2f8af73
SSDEEP 384:VfJhnyP+M3N0c56dSDsxxdHaGxBFPZ2vvZwBgl09KJN+ccTo:VxVG7N0c56Wsx3HaGxZlwMKJMTo
TLSH
T1D682D0E2D44823774C1E25E0265DCB30D2E56C5D1E82112E93E32F9ED8B93243DEB192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3004_1520270142\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

S_Fusion.exe

Path C:\Users\Admin\AppData\Roaming\Alligator\S_Fusion.exe
Size 1.8MB
SHA256 c82d2de495350be0453d25cc9939eb0ab7dd51b10f1db290c709f224465f70c1
MD5 767566fa3f21edfc0d8aac6a0fce249d
SHA1 1ebdfded1293415a125514363ba6ce2895c31433
SHA512 acc3869df411722f9e1afa425506b8cdd4dd87ff8b405e1236410ffa5f34dda252d7de9f2b0ddffe14027084315b4f09a9d7113f2e90ba5414ea70eaf8d8e483
SSDEEP 49152:/s2vpgWmekdGTl9Fg5k1nje7MQLCT/JSC6O:/xc7il9Fg5QnKH4JSC6
TLSH
T17F857C21A385C823D1632E769D2FDAD4A425BE301F38854B3FE92E0C5F79B41B929357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

clustersec.cfg

Path C:\Users\Admin\AppData\Roaming\Alligator\clustersec.cfg
Size 8KB
SHA256 37b84449458e3bf7b8a65c6f8f278d08358c55a74ac3dc92c9eb0bf03c7ab992
MD5 b5528af873719e411d44d9e50adf8a00
SHA1 a63f0b897080f5224c083082946a2605c1a57db6
SHA512 fe5ecc69908b796b5b9955eff7cb330d0cbbf8470d07aa41380ddb68589ff44f9cccb48daeab286bc3fa79d4c7a49ed920ffbe675f680e87e31289a8fbd48c81
SSDEEP 192:WpU4+RZ+qPYG3AlT6CBHMdb5HJwBn6SPOnFFUncqAdDU/VG5CfUAPFyI7gLns08J:8ioq50T6CBHMdb5pYn6SPiLUncqAdDUR
TLSH
T177023A2862472249A402FD17A724E752C347AA3AF61F400A6EC3E8458DDF76BEDCD54F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

datastate.dll

Path C:\Users\Admin\AppData\Roaming\Alligator\datastate.dll
Size 78KB
SHA256 7623436ebbed5c00bc08683bb24978562f7452f24f35af314dbf950782f64eed
MD5 64f53254054885752c22cfb17321fd71
SHA1 50c00e5c886bc15bc977147164a5fead563d2175
SHA512 9f074c5134fa38104d3e7c4d1a4ab2cf2b33fd35f1438e2cc5ce8bf01809d5a4bd173507d65a50601534789dfe0b59bb1a2cb8b40296112aa2aa77cbb5dd94c7
SSDEEP 1536:S+XrMzPCiE6BorrJIXJpCRMaR8p4kwbioQ+zXAwbtQ+8iAs:S+SE6ChIXJpCRMaR8eNtXtyDs
TLSH
T1DF738C113A50D073C95B29309495CBB2ADB97961AFF0404B3FBA077E6F613D2A73921B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dispatch16.so

Path C:\Users\Admin\AppData\Roaming\Alligator\dispatch16.so
Size 4.4MB
SHA256 18e2f2c66522f2e88b96ee862d9382e2453380566da8c8ec660f1ec89e481025
MD5 272689bdba950eac9ab08422bba79fca
SHA1 a8ea5d057b5615152986a121f9fbdf85c9f66b90
SHA512 c119e875244aaf71928e04d78e0b0f7f402684fe286ac272ce82fcbcf7237e61e4086d48d0a37db8729c2ad3ac003b10d75d0da5e7ae42a51e92b4f3fc360fe1
SSDEEP 98304:DjoDlCDrr5AwYUdLrhree90++a71IxG9M1u6/lHT7yZ/hIw6R+PZ4XW:D5XGtirhaeppIB8oHTM/j5hp
TLSH
T1702623CDC6CD8DF3F6259C770A156A48A0CBF9F402279655980BEEE4FA0D04184F6B9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

madBasic_.bpl

Path C:\Users\Admin\AppData\Roaming\Alligator\madBasic_.bpl
Size 212KB
SHA256 4926203fdd4fd70b55409e84728faf927d71274fb368193205d44e4f04a605f8
MD5 73bc46c0170de5d72d1e5e0df51ee68f
SHA1 bc92d0c16258b2a42ad9774fa7b6006bc32607ed
SHA512 642b19235bc62c26610092a865a1cabb7421296ac1885d1a50e99affe92a732347723fd028f71ff3d641a8ac7ec1567a97c8423369f28c806da9dbe00cd09e9b
SSDEEP 6144:lN/kSQxE6qeM/k4qTl5L5e5+53WCG1CbF/FrfkXK:GqeM/k4qR5L5e5+53WulZkXK
TLSH
T10F247E36A1008C33C2A3797BCCBFB950A96479640A3644DF7DEC4E84AB5A2D5772D387
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

madExcept_.bpl

Path C:\Users\Admin\AppData\Roaming\Alligator\madExcept_.bpl
Size 438KB
SHA256 655c2a4b484ce587c8c99cbc17f7cada640e79fc8f92b4de2d68882d79c0c815
MD5 9ff9e6b33bee8e297bbdb47e8ac9b60f
SHA1 b49d037a12c43958ab24b3869359e6ddbe8cc551
SHA512 7552139146d3cc913cb0c20ac612e194cdca01f202abb668e3451c343d8e4b5e967a3c90420817cea400a20c215b4cb4956a80896d6bb10c4f5ad720b9667109
SSDEEP 6144:FlAz49EKhEV30F8sl88nTjQ4Q50gEcW/jd+o72niVUNMa4Yn2S4fb:FlG4ut30F8slzYlQcW/jd++2nJ6u2S4T
TLSH
T104944D31D288C077D062263BCC2AD6C461B975341A34A95F7DE80F4CAF77A91AF26397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maddisAsm_.bpl

Path C:\Users\Admin\AppData\Roaming\Alligator\maddisAsm_.bpl
Size 64KB
SHA256 20ddd0bdf076a91d9d82c8e447e1dbf6dba52fe6613cfe1e5373aeac7f889b62
MD5 f1d430eacd5aac17c5de78f0de3cf774
SHA1 b1c410ea2659d2d7a44b8458ffd98e14ef6ddb8d
SHA512 bcbf4b4c7b02ddefd78d03f1d6d047aa5729a4e8ae673ca6d72488ca7d3fc6a03893d9a6b446e6bb629927352535d85745b882c80b5913c726d5674efaf2339e
SSDEEP 1536:SNy3eqMne0sXB0IWtCLwEJhY0w1kwbioQ+RawTQ+8iAg:mqMnfIB04LwEJhY0w1N3sDg
TLSH
T18A537CB35644E037D85375728CAAE6F2A9B07A211D3050EB3CEC0B98EF567842F1965B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp_win.dll

Path C:\Users\Admin\AppData\Roaming\Alligator\msvcp_win.dll
Size 489KB
SHA256 a6ddbc4954687b359c4b1bc7105647828ed9c6c34fba89c395806ea2420dbb2f
MD5 1f132c76a07adc8a41b6f9859323e0e0
SHA1 85a1bb9b7b719fadcf0ee8d7f63d053f9fcb1bd5
SHA512 1b70b150df2a6fc65329c89d20e101ac94135be145c469ca356a0aa41e04bd2a84652f2675f4eff487b295474185a4db273fe4bf00c82327f3c8a4d861042d7f
SSDEEP 12288:AN9jSIScPnEd4ZiUCujHhUgiW6QR7t5s03Ooc8dHkC2esjEFPYQ:29jSISNd4ZJE03Ooc8dHkC2eOEFPH
TLSH
T135B42A237B4149B1D58A63F021CA936283F9AC6547A0F3C357EAF16DBF293D19633681
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rtl120.bpl

Path C:\Users\Admin\AppData\Roaming\Alligator\rtl120.bpl
Size 1.1MB
SHA256 b3dee68af7b2805f6cf74976b60564dcc7d6d38444078d32cdca99ee1bb5bb22
MD5 4f2040add9f5b541db07a2e866e2c5ca
SHA1 b04da67e7ba7207deb99f56062661edc919f543a
SHA512 4fc2f75a8999e1a463d97bb89ad3cfdef4dd35615df6538f794e01f98de205a19bdae9dee58ceff6e9e3f08b5497c0f62e1b971a859bce711974d5f2e2180914
SSDEEP 24576:yEsEWbADYcUsnkqB8CVxIA99SGcM8sq4eXauOOqNTLjdecRzT:pHgcTLheM
TLSH
T190356C30F34A88BBD2A626BD4519BE14ACB87E10E1A4D599ACF4CD0DB975584373C3CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Roaming\Alligator\sqlite3.dll
Size 908KB
SHA256 bc0c750c98bd413e7975e8b17b1101c346dda53100020161bc5141f77ed98932
MD5 5b5a926a887f4a9f3eecc54598f697db
SHA1 86044be248e9fac25a0d8a3dd3c617da8688b7ea
SHA512 3031b4cf17cd4261d9c36495cfb707c6be10bd1444c8e474d1f117df55cadb32fe1661f239499d6f1ba3d3d96def6f6b4eae7e3fba543c6a5c8b98dedeb91412
SSDEEP 24576:MRxNAQB74x0FwTuis6eCwjH+SW61zf/AF+e:Ma+syis/LjH+S31o
TLSH
T1BF157D46EA17A87BDC5701754607F39B0575DA30A832CB8BEBC91D68DEB3ED2160A343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Roaming\Alligator\ucrtbase.dll
Size 1.1MB
SHA256 50825771d83ed274c814961c7d84e124539821f647f71c8a60b620a3008a1605
MD5 cc3bf1319f2ef9c9718735bdbd2441a9
SHA1 ee1cd03129e6a00ed5aaf31e2c36b7f4356ae0ef
SHA512 4632f285624ba9aa963b0198ed5467dec7e71e683cd324623a255ae71d486eee61cabae135078e5dc1b75e38bf524f9547ecb00248bf93ef6691a2edab5daa5e
SSDEEP 24576:lcjIrXW7AX5t0C6HjqiEwopCJrNlkH2uuYYH5JMmcvIZPoy4TsJ4:qjIrXW0JteEwopCaTYH5JcsJ4
TLSH
T1AA455A11758580AED85C31796359F922247F72B24B7AE8C373C41AE99E305C0773AEEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcl120.bpl

Path C:\Users\Admin\AppData\Roaming\Alligator\vcl120.bpl
Size 1.9MB
SHA256 19e61333b1d1732a0af016c792f633b8f96c0ce8651d991da60e7527c2c6c559
MD5 ee485ba5230f6b7c2d94e9b0a64a510f
SHA1 3ebcd4279932a71acfd85e391ad0f3791fb69a0c
SHA512 d8d70e209814d4ca3a241f78ba8e1c4849470a45831c522a10e690c14bf82565097bed6144419c6a7a0afcfa411a02f43e7d9a177ecbbd5c6335eea67e7a5a7d
SSDEEP 24576:prKziiTDpqb13me26exdBkCWgB/S8H4PM+Hs+W0mN6WZA53lKiHLpyz6m3U:Oillexp1SG4P/lma539HLo+j
TLSH
T164957DA0B33D0DF2C5A32B7C159FAE50F925AF106360925BAAF5BC4D5EF06903A1531B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e597630.msi

Path C:\Windows\Installer\e597630.msi
Size 6.7MB
SHA256 16628054549d3e1f10ea645ab7e34be6ee10934ea483951489c6ce32eef7921e
MD5 1f2972abda045d02a5c7266180dbcc30
SHA1 078dd51ea09a9d7e841c00378eeb1fb2226b5ffa
SHA512 3b43e22a38aedf28808e218570944e17a0483534efce250d77ca270d00b6ddbb6380edbcfe51835009b7b87485ea797746da0e7c42d1b621c1719b79a731ea93
SSDEEP 196608:bdz/6ety7BYWr27nWfwx9qO7EkJPAWqpq3n7nT:pz/65F2LgOXqbpqv
TLSH
T1216633E3D5782522F32756F488376A8994104D0443F39AE76699F8AD1EFA26CEC704CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 31e8b33ff87aa8950b550bb40af404132676015b4a0b4c41b15a7b9310f2ee24
MD5 a583d8e15d1580c657caf53e212079e8
SHA1 3b05e31ef416bbd3161f59d364e2d0a4219da534
SHA512 f841381dff22e808b821af460cc3c989e1eb80dd91011fb9dc591ae926a1e4f957791910061358af65f434dd7a2a4f5e31a7e47d8ff3ed7a0f12b4c0d422fdac
SSDEEP 24576:1Fo3DMPxdoO/vvTL/yghRClw/LubKr2iEMHD9MvZHkP6pWQRsYx2RILAVep:BHA
TLSH
T1C057D12436F92210E7B79E7CB8F06A634D3A7D5B9C15DE8D05411B4E0822F71E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{c7359383-8df2-4b27-90e7-55b3e81879b1}_OnDiskSnapshotProp

Path \??\Volume{c4ee2a5b-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{c7359383-8df2-4b27-90e7-55b3e81879b1}_OnDiskSnapshotProp
Size 6KB
SHA256 55c7956296584d476cb27892cb7f96180a10dd95a533ceb2921e4ea15cd9b20f
MD5 2ddb8e4c735c896e40a58d1851b23af2
SHA1 7572b19890b80dca5cd93c3eacd34753b82d2808
SHA512 fabcf48cbfe561930a788a27a7dab74bb87bb222f02ed14b5c9f361bd9312a5498b2fde8f8d90b55f3e75e07fead6a1fedbfa8fef9d397f640757bf54372e88c
SSDEEP 96:FT6+uivc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:Esb++uVm
TLSH
T10DD198085AF54711E2B3AB7229F18557A877B911EF33CB8E0198238E6631910F935F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3944-638-0x0000000073780000-0x000000007409C000-memory.dmp

Download

memory/3944-128-0x0000000050120000-0x000000005030E000-memory.dmp

Download

memory/3944-186-0x0000000073780000-0x000000007409C000-memory.dmp

Download

memory/3944-172-0x0000000073780000-0x000000007409C000-memory.dmp

Download

memory/3944-171-0x00000000749C0000-0x0000000074AB5000-memory.dmp

Download

memory/3944-161-0x00000000749C0000-0x0000000074AB5000-memory.dmp

Download

memory/3944-159-0x00007FFA5AAA0000-0x00007FFA5AD03000-memory.dmp

Download

memory/3944-158-0x00000000749C0000-0x0000000074AB5000-memory.dmp

Download

memory/3944-150-0x0000000061E00000-0x0000000061ECA000-memory.dmp

Download

memory/3944-771-0x0000000073780000-0x000000007409C000-memory.dmp

Download

memory/3944-124-0x0000000050000000-0x0000000050117000-memory.dmp

Download

memory/3944-126-0x0000000059800000-0x000000005986E000-memory.dmp

Download

memory/3944-685-0x0000000073780000-0x000000007409C000-memory.dmp

Download

memory/3944-251-0x0000000073780000-0x000000007409C000-memory.dmp

Download

memory/3944-881-0x0000000073780000-0x000000007409C000-memory.dmp

Download

memory/3944-857-0x0000000073780000-0x000000007409C000-memory.dmp

Download

memory/3944-791-0x0000000073780000-0x000000007409C000-memory.dmp

Download

memory/6108-100-0x00007FFA5AAA0000-0x00007FFA5AD03000-memory.dmp

Download

memory/6108-53-0x0000000057000000-0x000000005703F000-memory.dmp

Download

memory/6108-56-0x0000000057800000-0x0000000057812000-memory.dmp

Download

memory/6108-57-0x0000000050120000-0x000000005030E000-memory.dmp

Download

memory/6108-58-0x0000000061E00000-0x0000000061ECA000-memory.dmp

Download

memory/6108-76-0x0000000000400000-0x0000000000603000-memory.dmp

Download

memory/6108-54-0x0000000050000000-0x0000000050117000-memory.dmp

Download

memory/6108-52-0x0000000000400000-0x0000000000603000-memory.dmp

Download

memory/6108-55-0x0000000059800000-0x000000005986E000-memory.dmp

Download

memory/6108-82-0x0000000061E00000-0x0000000061ECA000-memory.dmp

Download

memory/6108-99-0x00000000749C0000-0x0000000074AB5000-memory.dmp

Download