hijackloader | 16628054549d3e1f10ea645ab7e34be6ee10934ea483951489c6ce32eef7921e

Analysis

max time kernel
300s
max time network
287s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/08/2026, 13:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PQLGBHSD.msi
Size 6.7MB
Sample260802-qpascsteka
SHA256 16628054549d3e1f10ea645ab7e34be6ee10934ea483951489c6ce32eef7921e
MD5 1f2972abda045d02a5c7266180dbcc30
SHA1 078dd51ea09a9d7e841c00378eeb1fb2226b5ffa
SHA512 3b43e22a38aedf28808e218570944e17a0483534efce250d77ca270d00b6ddbb6380edbcfe51835009b7b87485ea797746da0e7c42d1b621c1719b79a731ea93
SSDEEP 196608:bdz/6ety7BYWr27nWfwx9qO7EkJPAWqpq3n7nT:pz/65F2LgOXqbpqv
TLSH
T1216633E3D5782522F32756F488376A8994104D0443F39AE76699F8AD1EFA26CEC704CF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access discovery hijackloader loader persistence privilege_escalation ransomware spyware stealer

Malware Config

Extracted

Family

hijackloader

Attributes

directory
%APPDATA%\CitiumDataset
inject_dll
%windir%\SysWOW64\rasapi32.dll

xor.hex

Signatures

Family: HijackLoader, IDAT loader, Ghostulse,
HijackLoader is a multi-stage loader, first seen in 2023.
loader hijackloader

Detects HijackLoader (aka IDAT Loader) 1 IoCs

resource	yara_rule
behavioral3/files/0x001900000002b494-87.dat	family_hijackloader

Executes dropped EXE 2 IoCs

pid	Process
3900	S_Fusion.exe
4012	S_Fusion.exe

Loads dropped DLL 18 IoCs

pid	Process
3900	S_Fusion.exe
3900	S_Fusion.exe
3900	S_Fusion.exe
3900	S_Fusion.exe
3900	S_Fusion.exe
3900	S_Fusion.exe
3900	S_Fusion.exe
3900	S_Fusion.exe
3900	S_Fusion.exe
4012	S_Fusion.exe
4012	S_Fusion.exe
4012	S_Fusion.exe
4012	S_Fusion.exe
4012	S_Fusion.exe
4012	S_Fusion.exe
4012	S_Fusion.exe
4012	S_Fusion.exe
4012	S_Fusion.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 4012 set thread context of 2972	4012	S_Fusion.exe	91
PID 4012 set thread context of 1344	4012	S_Fusion.exe	106
PID 4012 set thread context of 2972	4012	S_Fusion.exe	91
PID 4012 set thread context of 1916	4012	S_Fusion.exe	112

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\bn.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fi.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ga.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ps.txt	S_Fusion.exe
File opened for modification	C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt	S_Fusion.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientPreview_eula.txt	S_Fusion.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\SkypeForBusinessVDI2019_eula.txt	S_Fusion.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Configuration\card_expiration_terms_dict.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\he.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt-br.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sw.txt	S_Fusion.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\SkypeForBusinessBasic2019_eula.txt	S_Fusion.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Configuration\ssn_high_group_info.txt	S_Fusion.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gl.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spc.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ta.txt	S_Fusion.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientARMRefer2019_eula.txt	S_Fusion.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\AccessMessageDismissal.txt	S_Fusion.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_Mocking.help.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hi.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spl.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tt.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\License.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\az.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\be.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ms.txt	S_Fusion.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\ExcelMessageDismissal.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\af.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fur.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ka.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lij.txt	S_Fusion.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_TestDrive.help.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\History.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ca.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gu.txt	S_Fusion.exe
File opened for modification	C:\Program Files\dotnet\LICENSE.txt	S_Fusion.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\WacLangPackEula.txt	S_Fusion.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\AugLoop\third-party-notices.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku-ckb.txt	S_Fusion.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Configuration\card_terms_dict.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hr.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nb.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cy.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ext.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\io.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sk.txt	S_Fusion.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ThirdPartyNotices.txt	S_Fusion.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\requests\README.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kab.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lv.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mk.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nl.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eo.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz-cyrl.txt	S_Fusion.exe
File opened for modification	C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt	S_Fusion.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\LyncVDI_Eula.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\it.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ja.txt	S_Fusion.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uk.txt	S_Fusion.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ThirdPartyNotices.MSHWLatin.txt	S_Fusion.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack2019_eula.txt	S_Fusion.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\AIImage.job	S_Fusion.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFC8AB2DB188177F5F.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{C1DD30EA-5531-47E7-AE22-33D5D3A54E9E}	msiexec.exe
File created	C:\Windows\SystemTemp\~DFB29988C71735ECB2.TMP	msiexec.exe
File created	C:\Windows\Installer\e589529.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFDA70D39B2440F04E.TMP	msiexec.exe
File created	C:\Windows\Installer\e589527.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e589527.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI96EC.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFFE9F73F7F24BE666.TMP	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
2208	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	S_Fusion.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	S_Fusion.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4336	chrome.exe
1888	chrome.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000007693c80d07c71b6c0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800007693c80d0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff0000000007000100006809007693c80d000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a7693c80d000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d7693c80d000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134301514677781934"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4012	S_Fusion.exe

Suspicious behavior: EnumeratesProcesses 62 IoCs

pid	Process
4636	msiexec.exe
4636	msiexec.exe
3900	S_Fusion.exe
4012	S_Fusion.exe
4012	S_Fusion.exe
4012	S_Fusion.exe
4012	S_Fusion.exe
4012	S_Fusion.exe
4012	S_Fusion.exe
4012	S_Fusion.exe
4012	S_Fusion.exe
4012	S_Fusion.exe
4012	S_Fusion.exe
4012	S_Fusion.exe
4012	S_Fusion.exe
4012	S_Fusion.exe
2972	chrome.exe
2972	chrome.exe
4012	S_Fusion.exe
4012	S_Fusion.exe
4012	S_Fusion.exe
4012	S_Fusion.exe
4012	S_Fusion.exe
4012	S_Fusion.exe
4012	S_Fusion.exe
4012	S_Fusion.exe
4012	S_Fusion.exe
4012	S_Fusion.exe
4012	S_Fusion.exe
4012	S_Fusion.exe
4012	S_Fusion.exe
4012	S_Fusion.exe
4012	S_Fusion.exe
4012	S_Fusion.exe
4012	S_Fusion.exe
4012	S_Fusion.exe
4012	S_Fusion.exe
4012	S_Fusion.exe
4012	S_Fusion.exe
4012	S_Fusion.exe
4012	S_Fusion.exe
4012	S_Fusion.exe
4012	S_Fusion.exe
4012	S_Fusion.exe
4012	S_Fusion.exe
4012	S_Fusion.exe
4012	S_Fusion.exe
4012	S_Fusion.exe
4012	S_Fusion.exe
4012	S_Fusion.exe
4012	S_Fusion.exe
4012	S_Fusion.exe
4012	S_Fusion.exe
4012	S_Fusion.exe
4012	S_Fusion.exe
4012	S_Fusion.exe
4012	S_Fusion.exe
4012	S_Fusion.exe
2972	chrome.exe
2972	chrome.exe
1708	chrome.exe
1708	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4012	S_Fusion.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2208	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2208	msiexec.exe
Token: SeSecurityPrivilege	4636	msiexec.exe
Token: SeCreateTokenPrivilege	2208	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2208	msiexec.exe
Token: SeLockMemoryPrivilege	2208	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2208	msiexec.exe
Token: SeMachineAccountPrivilege	2208	msiexec.exe
Token: SeTcbPrivilege	2208	msiexec.exe
Token: SeSecurityPrivilege	2208	msiexec.exe
Token: SeTakeOwnershipPrivilege	2208	msiexec.exe
Token: SeLoadDriverPrivilege	2208	msiexec.exe
Token: SeSystemProfilePrivilege	2208	msiexec.exe
Token: SeSystemtimePrivilege	2208	msiexec.exe
Token: SeProfSingleProcessPrivilege	2208	msiexec.exe
Token: SeIncBasePriorityPrivilege	2208	msiexec.exe
Token: SeCreatePagefilePrivilege	2208	msiexec.exe
Token: SeCreatePermanentPrivilege	2208	msiexec.exe
Token: SeBackupPrivilege	2208	msiexec.exe
Token: SeRestorePrivilege	2208	msiexec.exe
Token: SeShutdownPrivilege	2208	msiexec.exe
Token: SeDebugPrivilege	2208	msiexec.exe
Token: SeAuditPrivilege	2208	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2208	msiexec.exe
Token: SeChangeNotifyPrivilege	2208	msiexec.exe
Token: SeRemoteShutdownPrivilege	2208	msiexec.exe
Token: SeUndockPrivilege	2208	msiexec.exe
Token: SeSyncAgentPrivilege	2208	msiexec.exe
Token: SeEnableDelegationPrivilege	2208	msiexec.exe
Token: SeManageVolumePrivilege	2208	msiexec.exe
Token: SeImpersonatePrivilege	2208	msiexec.exe
Token: SeCreateGlobalPrivilege	2208	msiexec.exe
Token: SeBackupPrivilege	1760	vssvc.exe
Token: SeRestorePrivilege	1760	vssvc.exe
Token: SeAuditPrivilege	1760	vssvc.exe
Token: SeBackupPrivilege	4636	msiexec.exe
Token: SeRestorePrivilege	4636	msiexec.exe
Token: SeRestorePrivilege	4636	msiexec.exe
Token: SeTakeOwnershipPrivilege	4636	msiexec.exe
Token: SeRestorePrivilege	4636	msiexec.exe
Token: SeTakeOwnershipPrivilege	4636	msiexec.exe
Token: SeRestorePrivilege	4636	msiexec.exe
Token: SeTakeOwnershipPrivilege	4636	msiexec.exe
Token: SeRestorePrivilege	4636	msiexec.exe
Token: SeTakeOwnershipPrivilege	4636	msiexec.exe
Token: SeRestorePrivilege	4636	msiexec.exe
Token: SeTakeOwnershipPrivilege	4636	msiexec.exe
Token: SeRestorePrivilege	4636	msiexec.exe
Token: SeTakeOwnershipPrivilege	4636	msiexec.exe
Token: SeRestorePrivilege	4636	msiexec.exe
Token: SeTakeOwnershipPrivilege	4636	msiexec.exe
Token: SeRestorePrivilege	4636	msiexec.exe
Token: SeTakeOwnershipPrivilege	4636	msiexec.exe
Token: SeRestorePrivilege	4636	msiexec.exe
Token: SeTakeOwnershipPrivilege	4636	msiexec.exe
Token: SeRestorePrivilege	4636	msiexec.exe
Token: SeTakeOwnershipPrivilege	4636	msiexec.exe
Token: SeRestorePrivilege	4636	msiexec.exe
Token: SeTakeOwnershipPrivilege	4636	msiexec.exe
Token: SeRestorePrivilege	4636	msiexec.exe
Token: SeTakeOwnershipPrivilege	4636	msiexec.exe
Token: SeRestorePrivilege	4636	msiexec.exe
Token: SeTakeOwnershipPrivilege	4636	msiexec.exe
Token: SeRestorePrivilege	4636	msiexec.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
2208	msiexec.exe
2208	msiexec.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 4636 wrote to memory of 4464	4636	msiexec.exe	85
PID 4636 wrote to memory of 3900	4636	msiexec.exe	87
PID 3900 wrote to memory of 4012	3900	S_Fusion.exe	88
PID 2972 wrote to memory of 2144	2972	chrome.exe	92
PID 2972 wrote to memory of 980	2972	chrome.exe	93
PID 2972 wrote to memory of 4336	2972	chrome.exe	94
PID 2972 wrote to memory of 980	2972	chrome.exe	93
PID 2972 wrote to memory of 1580	2972	chrome.exe	96
PID 2972 wrote to memory of 1580	2972	chrome.exe	96
PID 2972 wrote to memory of 4056	2972	chrome.exe	98
PID 2972 wrote to memory of 4056	2972	chrome.exe	98
PID 2972 wrote to memory of 2464	2972	chrome.exe	99
PID 2972 wrote to memory of 2464	2972	chrome.exe	99
PID 2972 wrote to memory of 2428	2972	chrome.exe	100
PID 2972 wrote to memory of 2428	2972	chrome.exe	100
PID 2972 wrote to memory of 3024	2972	chrome.exe	101
PID 2972 wrote to memory of 3024	2972	chrome.exe	101
PID 2972 wrote to memory of 4740	2972	chrome.exe	102
PID 4012 wrote to memory of 2972	4012	S_Fusion.exe	91
PID 4012 wrote to memory of 2972	4012	S_Fusion.exe	91
PID 4012 wrote to memory of 2972	4012	S_Fusion.exe	91
PID 4012 wrote to memory of 2972	4012	S_Fusion.exe	91
PID 4012 wrote to memory of 2972	4012	S_Fusion.exe	91
PID 4012 wrote to memory of 1344	4012	S_Fusion.exe	106
PID 4012 wrote to memory of 1344	4012	S_Fusion.exe	106
PID 4012 wrote to memory of 1344	4012	S_Fusion.exe	106
PID 4012 wrote to memory of 1344	4012	S_Fusion.exe	106
PID 4012 wrote to memory of 1344	4012	S_Fusion.exe	106
PID 4012 wrote to memory of 1344	4012	S_Fusion.exe	106
PID 4012 wrote to memory of 2972	4012	S_Fusion.exe	91
PID 4012 wrote to memory of 2972	4012	S_Fusion.exe	91
PID 4012 wrote to memory of 2972	4012	S_Fusion.exe	91
PID 4012 wrote to memory of 2972	4012	S_Fusion.exe	91
PID 4012 wrote to memory of 2972	4012	S_Fusion.exe	91
PID 2972 wrote to memory of 4896	2972	chrome.exe	108
PID 2972 wrote to memory of 4060	2972	chrome.exe	109
PID 2972 wrote to memory of 3668	2972	chrome.exe	110
PID 4012 wrote to memory of 1916	4012	S_Fusion.exe	112
PID 4012 wrote to memory of 1916	4012	S_Fusion.exe	112
PID 4012 wrote to memory of 1916	4012	S_Fusion.exe	112
PID 4012 wrote to memory of 1916	4012	S_Fusion.exe	112
PID 4012 wrote to memory of 1916	4012	S_Fusion.exe	112
PID 4012 wrote to memory of 1916	4012	S_Fusion.exe	112
PID 2972 wrote to memory of 1888	2972	chrome.exe	114
PID 2972 wrote to memory of 1708	2972	chrome.exe	115

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\PQLGBHSD.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2208

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4636
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4464
- C:\Users\Admin\AppData\Roaming\Alligator\S_Fusion.exe
  "C:\Users\Admin\AppData\Roaming\Alligator\S_Fusion.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3900
- - C:\ProgramData\CitiumDataset\S_Fusion.exe
    C:\ProgramData\CitiumDataset\S_Fusion.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of WriteProcessMemory
    PID:4012
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:1344
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:1916

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1760

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c08afd90-f2a1-11d1-8455-00a0c91f3880} -Embedding
1⤵
PID:1888

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0x104,0x108,0xd8,0x10c,0x7ff8052fc728,0x7ff8052fc734,0x7ff8052fc740
  2⤵
  PID:2144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1636,i,10531328100674038925,2772497821784061609,262144 --field-trial-handle=1948,i,1279117181407150847,6232547378154559647,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1944 /prefetch:2
  2⤵
  PID:980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2112,i,5965890312020289024,7763583246638116513,524288 --field-trial-handle=1948,i,1279117181407150847,6232547378154559647,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2116 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2360,i,3608128828908064685,3594286429199501261,524288 --field-trial-handle=1948,i,1279117181407150847,6232547378154559647,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2532 /prefetch:13
  2⤵
  PID:1580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3092,i,16116867793026244881,15260425529142539054,2097152 --field-trial-handle=1948,i,1279117181407150847,6232547378154559647,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3100 /prefetch:1
  2⤵
  PID:4056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3064,i,15353836989451030665,17448518109418400420,2097152 --field-trial-handle=1948,i,1279117181407150847,6232547378154559647,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3060 /prefetch:1
  2⤵
  PID:2464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4304,i,3385911379983035820,7904304080282260119,2097152 --field-trial-handle=1948,i,1279117181407150847,6232547378154559647,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4312 /prefetch:9
  2⤵
  PID:2428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4628,i,4319647491862752192,8111732080722356889,2097152 --field-trial-handle=1948,i,1279117181407150847,6232547378154559647,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4652 /prefetch:1
  2⤵
  PID:3024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5480,i,5459974341095673632,12166977020295158021,524288 --field-trial-handle=1948,i,1279117181407150847,6232547378154559647,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5484 /prefetch:14
  2⤵
  PID:4740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5480,i,10729351226834241797,12013244400892533984,524288 --field-trial-handle=1948,i,1279117181407150847,6232547378154559647,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5508 /prefetch:14
  2⤵
  PID:4896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5640,i,10251847350611848807,3510906855378835837,524288 --field-trial-handle=1948,i,1279117181407150847,6232547378154559647,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5812 /prefetch:14
  2⤵
  PID:4060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4296,i,10808723232956286334,12833952023788478162,524288 --field-trial-handle=1948,i,1279117181407150847,6232547378154559647,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5832 /prefetch:14
  2⤵
  PID:3668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2084,i,4348004595165698266,13088419118456215929,524288 --field-trial-handle=1948,i,1279117181407150847,6232547378154559647,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5508 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4352,i,4920488653619039677,13121932065057438022,262144 --field-trial-handle=1948,i,1279117181407150847,6232547378154559647,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4432 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1708

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:244

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2292

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2208

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3388

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4064

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5004

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e589528.rbs

Path C:\Config.Msi\e589528.rbs
Size 9KB
SHA256 772b8f751d2e37764bbb36851f74c714f753fa7d94d6ab8302556f5be9ac532b
MD5 312e93603cd99b643f68cf00920a626e
SHA1 ce9471a0d5b0f8ac92c4fbfcdfdc6d72bfe08e98
SHA512 beb230c96eabc9f60e6a7856ba6f3eba2b329d3cebff3e4ac7a85ed0dcb559ef76f365e1b0c2077492fef9481ab716dfcbc1821225b1f90b3409d99b1ef495bb
SSDEEP 192:48H0QGCJwEw7TfbIQfbS+w4whfMQw+MwywLwRTITs54psd8TNeTN+TNHTNITNjTV:4s/rwEw/fjf++w4wpMQw+MwywLwRTITK
TLSH
T18F224141BA40D3D6ECB167F5C363AB0477A6E3F59B202B0F465C85A09E52B8CAE491F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma
Size 1024KB
SHA256 67ee11b51cd6f637795e31ab501f135ed595c8459bce885735f08b0418513a17
MD5 34c29bdb9e41b1f47f2d2786762c12ec
SHA1 4075131b18c3487e3e848361e112009c897629c7
SHA512 ca3a978798e77b2ced27b379f38e935ef18beaa7ea23e34270a9af20b37e1b1c5edf9478606311cf1acabd83992766cb3da8444de9394c674d5955bdbc53c0d0
SSDEEP 12:bHCskaXhVMMBKEKSCemJKlkQfIYVhYJ0X:bi0ROMMBS+MkEPYW
TLSH
T151259286B34455BBC54189B188AA17606274F9E89F82179A3B18E60F1E661DC0F51964
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 a552ecb018092ca27ce53fdceae1a71afb393f3d833b801ae9118ab474e3ad50
MD5 e8f9dfe692c1eae48855cfc86fda9388
SHA1 71681fa99521884a6eefb62bff46b9d409390f23
SHA512 2d005a6ea2b7db9ca6ed68a659ee1af46bed9e77b356fa5c0b89e3d691d596e16567a351b1fa70e1c65302958e574401a662398d5f69fd2b7c0208e6affee668
TLSH
T199E02BF5C831EC370CFD071DA054474AE791135B2A80858F363C550C8FB163A45D5D1C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 17a2622de0d4e1f0a765c0314f085bec83dfe3e8d28529f3eb285137e7023146
MD5 893035e84c32be51cd2aed7bc6153e38
SHA1 9047bf9000464c149124190fcfcd0c36ab501f5d
SHA512 83d979924957c9e95b4e8727cfa43c9c68c3ca62b4aadbc69ebfa19100c7b67a193fed73870d2522f7051dec73f8869694ceb7d197aad9c9a9a24803429ddf32
TLSH
T11451ACF7D3E8866D850156F4EA216E2FDE690A24121D3C6688D8AE1B53E2872D21038E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 416468c4abcc9067db899b09eecf65ff375c01c62c79cb0d6444f9e6a19cabac
MD5 58e5e1c5d3140518d6b03bfde1f267f7
SHA1 395fd96373b3be0c592fe80d01d3b8051559c192
SHA512 0b15a2e60056d656c9620a9ad785fb8e669b8fd025d39106c40b809597a996438e749cc1df10d68f6ebfed4933a2a12da603e7ebe58acda6f10fa2183944fc3e
SSDEEP 192:S8R6NvwNJXh1GhJv7H+pKPRp6X9WHsb+WNnr40A4l246euxD+3Ba5OVyIsnAUgrK:JR69IJx4JiGXsUws0L24Gga5Ge
TLSH
T1E552D72EB910697B9CCBD319FA627B53D3F5202175942E80E6FCCA2C15E75DC221742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 9dfa7971ca8a96f4062c0187551afa9df5e2641dcdd8086e278dd3731c8e421b
MD5 bbbe468434c6e5a810b4b32522a1258f
SHA1 5f7785d3fec8bb85e24d6608aac7c740bfb76174
SHA512 e838af3b8a678fcd6630c7178dd72ed51f439a32d76eba69d38ecf11950c7c754f9b24a5dd38eb4a4d36673d23b6d0312dfc272428ba3c1eefa4e617188b307f
SSDEEP 192:S8R6NvGNJXh1GhJv7H+pAPRp2X9WHsb+WNnr4094l246euxD+3BayOVyIsnAUgtK:JR69eJx4JiUXQUws0824GgayG8
TLSH
T17942C52EB910657B9CCBC31AFA627B57D7F9102171942E80EAFCC92C14D75DC221B42B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 a487a90aa586ffb722bc45a76d1e954f5a6f5ff4286551d2445a524e0f1cc25d
MD5 a6b03dd39d632b77a2b691136935ce1e
SHA1 660afa8fb43d4f28bf93dfee7ad6659850a1dd80
SHA512 fd42fd771a90c2ac5460f1c04885199c7f6c1ae3796cb236a749714522d06dac63689becd9a9f638977639774ddf2dbbc07689355940492b636644edffad801d
SSDEEP 384:6kj+F7KxkXqKf/pUZNCgVLH2HfgslzO7pLuLcSjsNXOD+F+ErU3JbHGvYKD0S:6o+F7KxkXqKf/pUZNCgVLH2HfgsJO7pT
TLSH
T15F72F867684C9E370FD4CACCED167A4FADB5024B65E9886443FA582503D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 d325fadc3812e38f9fb1c6c4966698a3f8655ff0c954f15880cc2eb51b324fb9
MD5 4517be2e3f89fcf62901dbadcf309d6d
SHA1 0522a5bfeccc57b5c844b2d575acaa3e8dfb4754
SHA512 cf2370cac4f9347232f21e06ab1da0e21c87a363b5a5a3f9ab18adbf6ae4131b4280e7c10828fe49c1d671a29a9db76fe726042559ec82f605943bb0cdc4736f
TLSH
T186B0120180429101C04702F01142159871185F15A70A270143E06D22C82526180340E0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ac6eb.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5ac6eb.TMP
Size 96B
SHA256 2ab64d1f46e5d3babfe8d5e4c8d12ebd3217f7764ee381a6de83f9f3b4c4f7f9
MD5 610b2a3cc8d5236e7d40e014879cb84a
SHA1 92d528e3ee35ccba9d041e9c2856d1a02667e1d9
SHA512 72c7e89737f2b91e63e54882660b670b0cc96a7200d028d4a528dfc4d5d21692cbe096f98a4a9b4c20f14d22ed17e3a378a95d86889f381e704f696be56fc958
TLSH
T165B02200C20A2202C00303B22880C8ECB020EFA0CF030322E2E00E2BCC20A320C30020
MD5 SHA1 SHA512 TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Browser
Size 106B
SHA256 3615498fbef408a96bf30e01c318dac2d5451b054998119080e7faac5995f590
MD5 de9ef0c5bcc012a3a1131988dee272d8
SHA1 fa9ccbdc969ac9e1474fce773234b28d50951cd8
SHA512 cea946ebeadfe6be65e33edff6c68953a84ec2e2410884e12f406cac1e6c8a0793180433a7ef7ce097b24ea78a1fdbb4e3b3d9cdf1a827ab6ff5605da3691724
TLSH
T1AAB0112033FC0228F3F38200AE333BA00F3FF8230000022CA008228808B38288880FB3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 7df87c8f7906a654487875f89e71ea671bef550c29ef4712437291cb082f0a4a
MD5 c0c2e135548d26830e4331f0aba95d28
SHA1 54979585bf36a7e1848f421939fa1af81e6cd7be
SHA512 3d91ef43879ecf10e2a8ff109f871ff6f460427037d7f2ab2530c31f318aedbed729b1530afb7ef250c481ce6a9934b9b1812fb70d18fa7df2cd6c0e1ab945ac
SSDEEP 6144:T8i0Aw9NDv+qw5ZtAzWDfxA3OnjrYQ9EU0/hEw:TeNO5ZtfDfxjjs+Cj
TLSH
T1303423311E32FC670EE8E9A9640E6B48AFD4BC2AD2869DD761D83B4D14AA5DD103F430
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 c7d226ad80e0fba6b7d8cc2ba470a25aebe57a8519456025a39beb477e95f568
MD5 eedf71bb51fd6032cedd4b8612cb3b61
SHA1 dc658e86d84fb8b7c2fccac57ab913c3cf0fa367
SHA512 241a5a5ed0c3539d87d82ec01f8efcec45adf9fcdecdb52a8b5e6db08d9db2a47b7f604118f1dcc88b2819c836d536ceb4d91aa379d8863889274cb3120927c1
SSDEEP 6144:j8i0Aw9NDv+qw5ZtAzWDfxA3OnjrYQ9EU0/hEw:jeNO5ZtfDfxjjs+Cj
TLSH
T1BA3412312E32FCAB0EE8A955640E6B08AFE4BC6BD586DDD765983F4D11AA4DD103B420
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 176c6e6bc7afaaaf46990de4e2bbd818c9db8ebc52ca14a0be1e1f2df1574ba1
MD5 f59b7199a5a0de1134f01f5fbe9bbc4f
SHA1 81def109c5972e815cb54c4b7ea7ecbb2c0da3d1
SHA512 50f9d3dd76b572d86fabae71f2d28c5c0387f694fcfd5ac73fc46a3b68a8702d702ebaeaed71fc0c29aed9ce88a11eddfb1886e745227f770bdccd5ab8db477d
SSDEEP 6144:+8i0Aw9NDv+qw5ZtAzWDfxA3OnjrYQ9EU0/hEw:+eNO5ZtfDfxjjs+Cj
TLSH
T1053422311E32FC670EE8E9A9640E6B48AFD4BC2AD2869DD761D83B5D14AA5DD103F430
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 82ba3917c7fee7d74928e7584e16a80f292c07030ea821bc5307451f93b1d327
MD5 892db30b7609b6e04126a4f2b2e7b33a
SHA1 35bd600653d0b3c51e4a2f361e9e1f7de46e64bb
SHA512 c73f5231c7777f937876c3a4789f0867d1c341285a7b109c22a5f4f5da4d7e935025ed9645409224386e3f3f6500f696c5f8ed1fd02d96500a0163d14d88a80b
SSDEEP 3072:/zWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAIToV:LWDfxA3OnjrYQ9EU0/hEV
TLSH
T1FCC302A11C36BD660DF8EE98B40D3A60BFF4AC9A91435DC351ED2F4C14FA5C81139970
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations
Size 86B
SHA256 2741df9ee9e9d9883397078f94480e9bc1d9c76996eec5cfe4e77929337cbe93
MD5 f732dbed9289177d15e236d0f8f2ddd3
SHA1 53f822af51b014bc3d4b575865d9c3ef0e4debde
SHA512 b64e5021f32e26c752fcba15a139815894309b25644e74ceca46a9aa97070bca3b77ded569a9bfd694193d035ba75b61a8d6262c8e6d5c4d76b452b38f5150a4
TLSH
T168A012078473800AE4184092C45C024114A480460119D0015070931314950CA03A5435
MD5 SHA1 SHA512 TLSH

Submit Download

first_party_sets.db

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\first_party_sets.db
Size 48KB
SHA256 0c2a7d9a05ecc2cc77765a0a5d71529f2237755fe60ac3d742d6c07805f80d14
MD5 e045e65cd8ef3d083617318874fb79ea
SHA1 c2fa643f68ddf8df9e99d41cecc7525e5a2c08c3
SHA512 23c380211a66716c26bb85d47c8d82531cd1ed92636bb91e281a4abb9e2e2123967e8b4761d830c99c8fabdd7d6e7526165d78111e0ffae97194ce7a1195dcb6
SSDEEP 24:TL74/arHRH34kQrq+i7ZYZY5J+Qnj3k0rJXAeL3mkAD6W6Ivrr6UwgfL:TY/IHRH34kWqB1kQnjhHmr6ITmU9L
TLSH
T1C223886EDA2CB9A1FEE40B3DD7D1D0127735AA0EC2E4D9F1099B406746C540405EB63E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

13c6-62a9-55ca-0a73.tmp

Path C:\Users\Admin\AppData\Local\Temp\13c6-62a9-55ca-0a73.tmp
Size 15KB
SHA256 e065b9b0c3ed124603a1b35febad0c4165016026469e7db8729fa13e2fbdfd45
MD5 beb3d10187ba5876898f2f7bd0d7997e
SHA1 ae26521465559759d0dbe6fd8a7cc38a27ad3705
SHA512 aff4994b05772868ad11ad5e2c42d99e5270ed56756fcba83da1ffd619cc982afd96ab0d6b39f4b69b548d80de9ad8ee03ac4a0d8c2b4d89befe6b53c3689deb
SSDEEP 384:aie5gGb6HO+FxuzsNpiO0CWmxnIZVwY9vP//3Ai1jqV/nK7q4F:fewNxuwNpiOhWmCkYBX/AkjqV/KX
TLSH
T15072D091041116BFECB0582BADD26C48B56EB142D81A084A58097A7A92745F63FF3F93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

S_Fusion.exe

Path C:\Users\Admin\AppData\Roaming\Alligator\S_Fusion.exe
Size 1.8MB
SHA256 c82d2de495350be0453d25cc9939eb0ab7dd51b10f1db290c709f224465f70c1
MD5 767566fa3f21edfc0d8aac6a0fce249d
SHA1 1ebdfded1293415a125514363ba6ce2895c31433
SHA512 acc3869df411722f9e1afa425506b8cdd4dd87ff8b405e1236410ffa5f34dda252d7de9f2b0ddffe14027084315b4f09a9d7113f2e90ba5414ea70eaf8d8e483
SSDEEP 49152:/s2vpgWmekdGTl9Fg5k1nje7MQLCT/JSC6O:/xc7il9Fg5QnKH4JSC6
TLSH
T17F857C21A385C823D1632E769D2FDAD4A425BE301F38854B3FE92E0C5F79B41B929357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

clustersec.cfg

Path C:\Users\Admin\AppData\Roaming\Alligator\clustersec.cfg
Size 8KB
SHA256 37b84449458e3bf7b8a65c6f8f278d08358c55a74ac3dc92c9eb0bf03c7ab992
MD5 b5528af873719e411d44d9e50adf8a00
SHA1 a63f0b897080f5224c083082946a2605c1a57db6
SHA512 fe5ecc69908b796b5b9955eff7cb330d0cbbf8470d07aa41380ddb68589ff44f9cccb48daeab286bc3fa79d4c7a49ed920ffbe675f680e87e31289a8fbd48c81
SSDEEP 192:WpU4+RZ+qPYG3AlT6CBHMdb5HJwBn6SPOnFFUncqAdDU/VG5CfUAPFyI7gLns08J:8ioq50T6CBHMdb5pYn6SPiLUncqAdDUR
TLSH
T177023A2862472249A402FD17A724E752C347AA3AF61F400A6EC3E8458DDF76BEDCD54F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

datastate.dll

Path C:\Users\Admin\AppData\Roaming\Alligator\datastate.dll
Size 78KB
SHA256 7623436ebbed5c00bc08683bb24978562f7452f24f35af314dbf950782f64eed
MD5 64f53254054885752c22cfb17321fd71
SHA1 50c00e5c886bc15bc977147164a5fead563d2175
SHA512 9f074c5134fa38104d3e7c4d1a4ab2cf2b33fd35f1438e2cc5ce8bf01809d5a4bd173507d65a50601534789dfe0b59bb1a2cb8b40296112aa2aa77cbb5dd94c7
SSDEEP 1536:S+XrMzPCiE6BorrJIXJpCRMaR8p4kwbioQ+zXAwbtQ+8iAs:S+SE6ChIXJpCRMaR8eNtXtyDs
TLSH
T1DF738C113A50D073C95B29309495CBB2ADB97961AFF0404B3FBA077E6F613D2A73921B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dispatch16.so

Path C:\Users\Admin\AppData\Roaming\Alligator\dispatch16.so
Size 4.4MB
SHA256 18e2f2c66522f2e88b96ee862d9382e2453380566da8c8ec660f1ec89e481025
MD5 272689bdba950eac9ab08422bba79fca
SHA1 a8ea5d057b5615152986a121f9fbdf85c9f66b90
SHA512 c119e875244aaf71928e04d78e0b0f7f402684fe286ac272ce82fcbcf7237e61e4086d48d0a37db8729c2ad3ac003b10d75d0da5e7ae42a51e92b4f3fc360fe1
SSDEEP 98304:DjoDlCDrr5AwYUdLrhree90++a71IxG9M1u6/lHT7yZ/hIw6R+PZ4XW:D5XGtirhaeppIB8oHTM/j5hp
TLSH
T1702623CDC6CD8DF3F6259C770A156A48A0CBF9F402279655980BEEE4FA0D04184F6B9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

madBasic_.bpl

Path C:\Users\Admin\AppData\Roaming\Alligator\madBasic_.bpl
Size 212KB
SHA256 4926203fdd4fd70b55409e84728faf927d71274fb368193205d44e4f04a605f8
MD5 73bc46c0170de5d72d1e5e0df51ee68f
SHA1 bc92d0c16258b2a42ad9774fa7b6006bc32607ed
SHA512 642b19235bc62c26610092a865a1cabb7421296ac1885d1a50e99affe92a732347723fd028f71ff3d641a8ac7ec1567a97c8423369f28c806da9dbe00cd09e9b
SSDEEP 6144:lN/kSQxE6qeM/k4qTl5L5e5+53WCG1CbF/FrfkXK:GqeM/k4qR5L5e5+53WulZkXK
TLSH
T10F247E36A1008C33C2A3797BCCBFB950A96479640A3644DF7DEC4E84AB5A2D5772D387
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

madExcept_.bpl

Path C:\Users\Admin\AppData\Roaming\Alligator\madExcept_.bpl
Size 438KB
SHA256 655c2a4b484ce587c8c99cbc17f7cada640e79fc8f92b4de2d68882d79c0c815
MD5 9ff9e6b33bee8e297bbdb47e8ac9b60f
SHA1 b49d037a12c43958ab24b3869359e6ddbe8cc551
SHA512 7552139146d3cc913cb0c20ac612e194cdca01f202abb668e3451c343d8e4b5e967a3c90420817cea400a20c215b4cb4956a80896d6bb10c4f5ad720b9667109
SSDEEP 6144:FlAz49EKhEV30F8sl88nTjQ4Q50gEcW/jd+o72niVUNMa4Yn2S4fb:FlG4ut30F8slzYlQcW/jd++2nJ6u2S4T
TLSH
T104944D31D288C077D062263BCC2AD6C461B975341A34A95F7DE80F4CAF77A91AF26397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maddisAsm_.bpl

Path C:\Users\Admin\AppData\Roaming\Alligator\maddisAsm_.bpl
Size 64KB
SHA256 20ddd0bdf076a91d9d82c8e447e1dbf6dba52fe6613cfe1e5373aeac7f889b62
MD5 f1d430eacd5aac17c5de78f0de3cf774
SHA1 b1c410ea2659d2d7a44b8458ffd98e14ef6ddb8d
SHA512 bcbf4b4c7b02ddefd78d03f1d6d047aa5729a4e8ae673ca6d72488ca7d3fc6a03893d9a6b446e6bb629927352535d85745b882c80b5913c726d5674efaf2339e
SSDEEP 1536:SNy3eqMne0sXB0IWtCLwEJhY0w1kwbioQ+RawTQ+8iAg:mqMnfIB04LwEJhY0w1N3sDg
TLSH
T18A537CB35644E037D85375728CAAE6F2A9B07A211D3050EB3CEC0B98EF567842F1965B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp_win.dll

Path C:\Users\Admin\AppData\Roaming\Alligator\msvcp_win.dll
Size 489KB
SHA256 a6ddbc4954687b359c4b1bc7105647828ed9c6c34fba89c395806ea2420dbb2f
MD5 1f132c76a07adc8a41b6f9859323e0e0
SHA1 85a1bb9b7b719fadcf0ee8d7f63d053f9fcb1bd5
SHA512 1b70b150df2a6fc65329c89d20e101ac94135be145c469ca356a0aa41e04bd2a84652f2675f4eff487b295474185a4db273fe4bf00c82327f3c8a4d861042d7f
SSDEEP 12288:AN9jSIScPnEd4ZiUCujHhUgiW6QR7t5s03Ooc8dHkC2esjEFPYQ:29jSISNd4ZJE03Ooc8dHkC2eOEFPH
TLSH
T135B42A237B4149B1D58A63F021CA936283F9AC6547A0F3C357EAF16DBF293D19633681
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rtl120.bpl

Path C:\Users\Admin\AppData\Roaming\Alligator\rtl120.bpl
Size 1.1MB
SHA256 b3dee68af7b2805f6cf74976b60564dcc7d6d38444078d32cdca99ee1bb5bb22
MD5 4f2040add9f5b541db07a2e866e2c5ca
SHA1 b04da67e7ba7207deb99f56062661edc919f543a
SHA512 4fc2f75a8999e1a463d97bb89ad3cfdef4dd35615df6538f794e01f98de205a19bdae9dee58ceff6e9e3f08b5497c0f62e1b971a859bce711974d5f2e2180914
SSDEEP 24576:yEsEWbADYcUsnkqB8CVxIA99SGcM8sq4eXauOOqNTLjdecRzT:pHgcTLheM
TLSH
T190356C30F34A88BBD2A626BD4519BE14ACB87E10E1A4D599ACF4CD0DB975584373C3CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Roaming\Alligator\sqlite3.dll
Size 908KB
SHA256 bc0c750c98bd413e7975e8b17b1101c346dda53100020161bc5141f77ed98932
MD5 5b5a926a887f4a9f3eecc54598f697db
SHA1 86044be248e9fac25a0d8a3dd3c617da8688b7ea
SHA512 3031b4cf17cd4261d9c36495cfb707c6be10bd1444c8e474d1f117df55cadb32fe1661f239499d6f1ba3d3d96def6f6b4eae7e3fba543c6a5c8b98dedeb91412
SSDEEP 24576:MRxNAQB74x0FwTuis6eCwjH+SW61zf/AF+e:Ma+syis/LjH+S31o
TLSH
T1BF157D46EA17A87BDC5701754607F39B0575DA30A832CB8BEBC91D68DEB3ED2160A343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Roaming\Alligator\ucrtbase.dll
Size 1.1MB
SHA256 50825771d83ed274c814961c7d84e124539821f647f71c8a60b620a3008a1605
MD5 cc3bf1319f2ef9c9718735bdbd2441a9
SHA1 ee1cd03129e6a00ed5aaf31e2c36b7f4356ae0ef
SHA512 4632f285624ba9aa963b0198ed5467dec7e71e683cd324623a255ae71d486eee61cabae135078e5dc1b75e38bf524f9547ecb00248bf93ef6691a2edab5daa5e
SSDEEP 24576:lcjIrXW7AX5t0C6HjqiEwopCJrNlkH2uuYYH5JMmcvIZPoy4TsJ4:qjIrXW0JteEwopCaTYH5JcsJ4
TLSH
T1AA455A11758580AED85C31796359F922247F72B24B7AE8C373C41AE99E305C0773AEEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcl120.bpl

Path C:\Users\Admin\AppData\Roaming\Alligator\vcl120.bpl
Size 1.9MB
SHA256 19e61333b1d1732a0af016c792f633b8f96c0ce8651d991da60e7527c2c6c559
MD5 ee485ba5230f6b7c2d94e9b0a64a510f
SHA1 3ebcd4279932a71acfd85e391ad0f3791fb69a0c
SHA512 d8d70e209814d4ca3a241f78ba8e1c4849470a45831c522a10e690c14bf82565097bed6144419c6a7a0afcfa411a02f43e7d9a177ecbbd5c6335eea67e7a5a7d
SSDEEP 24576:prKziiTDpqb13me26exdBkCWgB/S8H4PM+Hs+W0mN6WZA53lKiHLpyz6m3U:Oillexp1SG4P/lma539HLo+j
TLSH
T164957DA0B33D0DF2C5A32B7C159FAE50F925AF106360925BAAF5BC4D5EF06903A1531B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e589527.msi

Path C:\Windows\Installer\e589527.msi
Size 6.7MB
SHA256 16628054549d3e1f10ea645ab7e34be6ee10934ea483951489c6ce32eef7921e
MD5 1f2972abda045d02a5c7266180dbcc30
SHA1 078dd51ea09a9d7e841c00378eeb1fb2226b5ffa
SHA512 3b43e22a38aedf28808e218570944e17a0483534efce250d77ca270d00b6ddbb6380edbcfe51835009b7b87485ea797746da0e7c42d1b621c1719b79a731ea93
SSDEEP 196608:bdz/6ety7BYWr27nWfwx9qO7EkJPAWqpq3n7nT:pz/65F2LgOXqbpqv
TLSH
T1216633E3D5782522F32756F488376A8994104D0443F39AE76699F8AD1EFA26CEC704CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.6MB
SHA256 59829c66133f0190a2ace9ed15ab6064d335cbfbbcab2bfc6344d874e01a92cf
MD5 ff4cd7117562c6d163283b0173f518d8
SHA1 7c92039f5a829c1eaf8840f5d7a7348be87ff205
SHA512 6a04462f455abe0a69034aa04c1ccf0bfa180256560ba351f0c7e46944409d1220b5526eaa864ac94c434cdad09323f1be14e8353d752267809de1bbea87d7e8
SSDEEP 24576:O2gmSp1DdoO/vvTLB2q+RknK/qpBA4eA22p9XpEqzRaIE2OvYR7d7nANh:w
TLSH
T1C447C32436F92210E7F79E3CA8F0AA234D3A7D5B9C15DE8D05411B4E0961FB1E872F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{19a9b575-69b2-4873-b4eb-1758eeb367a0}_OnDiskSnapshotProp

Path \??\Volume{0dc89376-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{19a9b575-69b2-4873-b4eb-1758eeb367a0}_OnDiskSnapshotProp
Size 6KB
SHA256 7d68348456c7bdade6e5f5121bf4a56421200b37fbf44d2c6b7743c947eaf578
MD5 8ceb7d6c81149a9ee31ff5ee17a581c0
SHA1 f45da9e3e945ba8a731e04758a60fa93b611faf0
SHA512 63cc15c1fb3cbf243434e68922cf9c7d3c02d2cbedf1875714b116f46369ce216b7c1a9620f216df4bf5e8e06239229386b4eb99dc91bb1d24685ebb0480edb4
SSDEEP 96:FilUVzwOvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:oqfb++ZVm
TLSH
T1B1D179185AF54711E2B3AB3128F18557A877B811EF33CB8E0198638E6670A10F975F5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3900-52-0x0000000057800000-0x0000000057812000-memory.dmp

Download

memory/3900-89-0x00007FF826420000-0x00007FF826629000-memory.dmp

Download

memory/3900-54-0x0000000061E00000-0x0000000061ECA000-memory.dmp

Download

memory/3900-53-0x0000000050120000-0x000000005030E000-memory.dmp

Download

memory/3900-51-0x0000000057000000-0x000000005703F000-memory.dmp

Download

memory/3900-50-0x0000000050000000-0x0000000050117000-memory.dmp

Download

memory/3900-49-0x0000000059800000-0x000000005986E000-memory.dmp

Download

memory/3900-48-0x0000000000400000-0x0000000000603000-memory.dmp

Download

memory/3900-75-0x0000000061E00000-0x0000000061ECA000-memory.dmp

Download

memory/3900-69-0x0000000000400000-0x0000000000603000-memory.dmp

Download

memory/3900-88-0x0000000074340000-0x0000000074430000-memory.dmp

Download

memory/4012-144-0x0000000000400000-0x0000000000603000-memory.dmp

Download

memory/4012-131-0x0000000050000000-0x0000000050117000-memory.dmp

Download

memory/4012-135-0x0000000050120000-0x000000005030E000-memory.dmp

Download

memory/4012-132-0x0000000059800000-0x000000005986E000-memory.dmp

Download

memory/4012-130-0x0000000000400000-0x0000000000603000-memory.dmp

Download

memory/4012-136-0x0000000061E00000-0x0000000061ECA000-memory.dmp

Download

memory/4012-174-0x0000000074340000-0x0000000074430000-memory.dmp

Download

memory/4012-150-0x0000000061E00000-0x0000000061ECA000-memory.dmp

Download

memory/4012-160-0x0000000074340000-0x0000000074430000-memory.dmp

Download

memory/4012-161-0x00007FF826420000-0x00007FF826629000-memory.dmp

Download

memory/4012-163-0x0000000074340000-0x0000000074430000-memory.dmp

Download