Analysis
- max time kernel
149s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/08/2026, 00:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4f8f19ac.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
30 signatures
150 seconds
Behavioral task
behavioral2
Sample
4f8f19ac.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
15 signatures
150 seconds
General
- Target 4f8f19ac.msi
- Size 6.7MB
- Sample260804-apvjrssxhz
- SHA256 16628054549d3e1f10ea645ab7e34be6ee10934ea483951489c6ce32eef7921e
- MD5 1f2972abda045d02a5c7266180dbcc30
- SHA1 078dd51ea09a9d7e841c00378eeb1fb2226b5ffa
- SHA512 3b43e22a38aedf28808e218570944e17a0483534efce250d77ca270d00b6ddbb6380edbcfe51835009b7b87485ea797746da0e7c42d1b621c1719b79a731ea93
- SSDEEP 196608:bdz/6ety7BYWr27nWfwx9qO7EkJPAWqpq3n7nT:pz/65F2LgOXqbpqv
- TLSH T1216633E3D5782522F32756F488376A8994104D0443F39AE76699F8AD1EFA26CEC704CF
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
hijackloader
Attributes
-
directory
%APPDATA%\CitiumDataset
-
inject_dll
%windir%\SysWOW64\rasapi32.dll
xor.hex
Signatures
- Family: HijackLoader, IDAT loader, Ghostulse,
HijackLoader is a multi-stage loader, first seen in 2023.
- Detects HijackLoader (aka IDAT Loader) 1 IoCs
resource yara_rule behavioral2/files/0x000d00000001c551-99.dat family_hijackloader - Executes dropped EXE 2 IoCs
pid Process 1172 S_Fusion.exe 1252 S_Fusion.exe - Loads dropped DLL 26 IoCs
pid Process 1172 S_Fusion.exe 1172 S_Fusion.exe 1172 S_Fusion.exe 1172 S_Fusion.exe 1172 S_Fusion.exe 1172 S_Fusion.exe 1172 S_Fusion.exe 1172 S_Fusion.exe 1172 S_Fusion.exe 1172 S_Fusion.exe 1172 S_Fusion.exe 1172 S_Fusion.exe 1172 S_Fusion.exe 1172 S_Fusion.exe 1252 S_Fusion.exe 1252 S_Fusion.exe 1252 S_Fusion.exe 1252 S_Fusion.exe 1252 S_Fusion.exe 1252 S_Fusion.exe 1252 S_Fusion.exe 1252 S_Fusion.exe 1252 S_Fusion.exe 1252 S_Fusion.exe 1252 S_Fusion.exe 1252 S_Fusion.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\K: msiexec.exe - Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\SystemTemp\~DF525909F52ADCC0E5.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIEA37.tmp msiexec.exe File created C:\Windows\Installer\e59e315.msi msiexec.exe File created C:\Windows\SystemTemp\~DF0DF50CEF89BB3A84.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF406C540BC2D994B0.TMP msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DF57E30903D1ACFA90.TMP msiexec.exe File created C:\Windows\Installer\e59e313.msi msiexec.exe File opened for modification C:\Windows\Installer\e59e313.msi msiexec.exe File created C:\Windows\Installer\SourceHash{C1DD30EA-5531-47E7-AE22-33D5D3A54E9E} msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 4764 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language S_Fusion.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language S_Fusion.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000031a81fc62ba3bf350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380131a81fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410131a81fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e331a81fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e631a81fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe - Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 4752 msiexec.exe 4752 msiexec.exe 1172 S_Fusion.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4764 msiexec.exe Token: SeIncreaseQuotaPrivilege 4764 msiexec.exe Token: SeSecurityPrivilege 4752 msiexec.exe Token: SeCreateTokenPrivilege 4764 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4764 msiexec.exe Token: SeLockMemoryPrivilege 4764 msiexec.exe Token: SeIncreaseQuotaPrivilege 4764 msiexec.exe Token: SeMachineAccountPrivilege 4764 msiexec.exe Token: SeTcbPrivilege 4764 msiexec.exe Token: SeSecurityPrivilege 4764 msiexec.exe Token: SeTakeOwnershipPrivilege 4764 msiexec.exe Token: SeLoadDriverPrivilege 4764 msiexec.exe Token: SeSystemProfilePrivilege 4764 msiexec.exe Token: SeSystemtimePrivilege 4764 msiexec.exe Token: SeProfSingleProcessPrivilege 4764 msiexec.exe Token: SeIncBasePriorityPrivilege 4764 msiexec.exe Token: SeCreatePagefilePrivilege 4764 msiexec.exe Token: SeCreatePermanentPrivilege 4764 msiexec.exe Token: SeBackupPrivilege 4764 msiexec.exe Token: SeRestorePrivilege 4764 msiexec.exe Token: SeShutdownPrivilege 4764 msiexec.exe Token: SeDebugPrivilege 4764 msiexec.exe Token: SeAuditPrivilege 4764 msiexec.exe Token: SeSystemEnvironmentPrivilege 4764 msiexec.exe Token: SeChangeNotifyPrivilege 4764 msiexec.exe Token: SeRemoteShutdownPrivilege 4764 msiexec.exe Token: SeUndockPrivilege 4764 msiexec.exe Token: SeSyncAgentPrivilege 4764 msiexec.exe Token: SeEnableDelegationPrivilege 4764 msiexec.exe Token: SeManageVolumePrivilege 4764 msiexec.exe Token: SeImpersonatePrivilege 4764 msiexec.exe Token: SeCreateGlobalPrivilege 4764 msiexec.exe Token: SeBackupPrivilege 3080 vssvc.exe Token: SeRestorePrivilege 3080 vssvc.exe Token: SeAuditPrivilege 3080 vssvc.exe Token: SeBackupPrivilege 4752 msiexec.exe Token: SeRestorePrivilege 4752 msiexec.exe Token: SeRestorePrivilege 4752 msiexec.exe Token: SeTakeOwnershipPrivilege 4752 msiexec.exe Token: SeRestorePrivilege 4752 msiexec.exe Token: SeTakeOwnershipPrivilege 4752 msiexec.exe Token: SeRestorePrivilege 4752 msiexec.exe Token: SeTakeOwnershipPrivilege 4752 msiexec.exe Token: SeRestorePrivilege 4752 msiexec.exe Token: SeTakeOwnershipPrivilege 4752 msiexec.exe Token: SeRestorePrivilege 4752 msiexec.exe Token: SeTakeOwnershipPrivilege 4752 msiexec.exe Token: SeRestorePrivilege 4752 msiexec.exe Token: SeTakeOwnershipPrivilege 4752 msiexec.exe Token: SeRestorePrivilege 4752 msiexec.exe Token: SeTakeOwnershipPrivilege 4752 msiexec.exe Token: SeRestorePrivilege 4752 msiexec.exe Token: SeTakeOwnershipPrivilege 4752 msiexec.exe Token: SeRestorePrivilege 4752 msiexec.exe Token: SeTakeOwnershipPrivilege 4752 msiexec.exe Token: SeRestorePrivilege 4752 msiexec.exe Token: SeTakeOwnershipPrivilege 4752 msiexec.exe Token: SeRestorePrivilege 4752 msiexec.exe Token: SeTakeOwnershipPrivilege 4752 msiexec.exe Token: SeRestorePrivilege 4752 msiexec.exe Token: SeTakeOwnershipPrivilege 4752 msiexec.exe Token: SeRestorePrivilege 4752 msiexec.exe Token: SeTakeOwnershipPrivilege 4752 msiexec.exe Token: SeRestorePrivilege 4752 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4764 msiexec.exe 4764 msiexec.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4764 msiexec.exe 4752 msiexec.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4752 wrote to memory of 4816 4752 msiexec.exe 93 PID 4752 wrote to memory of 1172 4752 msiexec.exe 96 PID 1172 wrote to memory of 1252 1172 S_Fusion.exe 97 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\4f8f19ac.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4764
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:4816
-
-
C:\Users\Admin\AppData\Roaming\Alligator\S_Fusion.exe"C:\Users\Admin\AppData\Roaming\Alligator\S_Fusion.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\ProgramData\CitiumDataset\S_Fusion.exeC:\ProgramData\CitiumDataset\S_Fusion.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1252
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3080
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e59e314.rbs
- Size 9KB
- SHA256 810af9ae11dc90e262b01f807d2442004ad192ee704be7fe45106b34ebd4aac4
- MD5 25e5f11e35670d9d6dfe5df8f1d66582
- SHA1 4560a1e644036097627f6b5fe8eaec24ee6ca583
- SHA512 5062a96b86036fe38610b654d9c9749efc82c71ca685d9637cc2e3281818dd75bfb0adf1700c2a08696051646725f00b7d3a56980c4de00325bc46d7431665cb
- SSDEEP 192:U9H0QGCSV7TpbIQpbSN/hgn+XVg1es54psqNgN9NDNaNjQNQNp:UR/UV/pjp+N/in+XVg1ekqenZEtQSL
- TLSH T1B7222342FA48D2D1ECB2277583279B0837B5E3E5EB206B0F065C85619FA37DCBA451E1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Alligator\S_Fusion.exe
- Size 1.8MB
- SHA256 c82d2de495350be0453d25cc9939eb0ab7dd51b10f1db290c709f224465f70c1
- MD5 767566fa3f21edfc0d8aac6a0fce249d
- SHA1 1ebdfded1293415a125514363ba6ce2895c31433
- SHA512 acc3869df411722f9e1afa425506b8cdd4dd87ff8b405e1236410ffa5f34dda252d7de9f2b0ddffe14027084315b4f09a9d7113f2e90ba5414ea70eaf8d8e483
- SSDEEP 49152:/s2vpgWmekdGTl9Fg5k1nje7MQLCT/JSC6O:/xc7il9Fg5QnKH4JSC6
- TLSH T17F857C21A385C823D1632E769D2FDAD4A425BE301F38854B3FE92E0C5F79B41B929357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Alligator\clustersec.cfg
- Size 8KB
- SHA256 37b84449458e3bf7b8a65c6f8f278d08358c55a74ac3dc92c9eb0bf03c7ab992
- MD5 b5528af873719e411d44d9e50adf8a00
- SHA1 a63f0b897080f5224c083082946a2605c1a57db6
- SHA512 fe5ecc69908b796b5b9955eff7cb330d0cbbf8470d07aa41380ddb68589ff44f9cccb48daeab286bc3fa79d4c7a49ed920ffbe675f680e87e31289a8fbd48c81
- SSDEEP 192:WpU4+RZ+qPYG3AlT6CBHMdb5HJwBn6SPOnFFUncqAdDU/VG5CfUAPFyI7gLns08J:8ioq50T6CBHMdb5pYn6SPiLUncqAdDUR
- TLSH T177023A2862472249A402FD17A724E752C347AA3AF61F400A6EC3E8458DDF76BEDCD54F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Alligator\datastate.dll
- Size 78KB
- SHA256 7623436ebbed5c00bc08683bb24978562f7452f24f35af314dbf950782f64eed
- MD5 64f53254054885752c22cfb17321fd71
- SHA1 50c00e5c886bc15bc977147164a5fead563d2175
- SHA512 9f074c5134fa38104d3e7c4d1a4ab2cf2b33fd35f1438e2cc5ce8bf01809d5a4bd173507d65a50601534789dfe0b59bb1a2cb8b40296112aa2aa77cbb5dd94c7
- SSDEEP 1536:S+XrMzPCiE6BorrJIXJpCRMaR8p4kwbioQ+zXAwbtQ+8iAs:S+SE6ChIXJpCRMaR8eNtXtyDs
- TLSH T1DF738C113A50D073C95B29309495CBB2ADB97961AFF0404B3FBA077E6F613D2A73921B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Alligator\dispatch16.so
- Size 4.4MB
- SHA256 18e2f2c66522f2e88b96ee862d9382e2453380566da8c8ec660f1ec89e481025
- MD5 272689bdba950eac9ab08422bba79fca
- SHA1 a8ea5d057b5615152986a121f9fbdf85c9f66b90
- SHA512 c119e875244aaf71928e04d78e0b0f7f402684fe286ac272ce82fcbcf7237e61e4086d48d0a37db8729c2ad3ac003b10d75d0da5e7ae42a51e92b4f3fc360fe1
- SSDEEP 98304:DjoDlCDrr5AwYUdLrhree90++a71IxG9M1u6/lHT7yZ/hIw6R+PZ4XW:D5XGtirhaeppIB8oHTM/j5hp
- TLSH T1702623CDC6CD8DF3F6259C770A156A48A0CBF9F402279655980BEEE4FA0D04184F6B9E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Alligator\madBasic_.bpl
- Size 212KB
- SHA256 4926203fdd4fd70b55409e84728faf927d71274fb368193205d44e4f04a605f8
- MD5 73bc46c0170de5d72d1e5e0df51ee68f
- SHA1 bc92d0c16258b2a42ad9774fa7b6006bc32607ed
- SHA512 642b19235bc62c26610092a865a1cabb7421296ac1885d1a50e99affe92a732347723fd028f71ff3d641a8ac7ec1567a97c8423369f28c806da9dbe00cd09e9b
- SSDEEP 6144:lN/kSQxE6qeM/k4qTl5L5e5+53WCG1CbF/FrfkXK:GqeM/k4qR5L5e5+53WulZkXK
- TLSH T10F247E36A1008C33C2A3797BCCBFB950A96479640A3644DF7DEC4E84AB5A2D5772D387
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Alligator\madDisAsm_.bpl
- Size 64KB
- SHA256 20ddd0bdf076a91d9d82c8e447e1dbf6dba52fe6613cfe1e5373aeac7f889b62
- MD5 f1d430eacd5aac17c5de78f0de3cf774
- SHA1 b1c410ea2659d2d7a44b8458ffd98e14ef6ddb8d
- SHA512 bcbf4b4c7b02ddefd78d03f1d6d047aa5729a4e8ae673ca6d72488ca7d3fc6a03893d9a6b446e6bb629927352535d85745b882c80b5913c726d5674efaf2339e
- SSDEEP 1536:SNy3eqMne0sXB0IWtCLwEJhY0w1kwbioQ+RawTQ+8iAg:mqMnfIB04LwEJhY0w1N3sDg
- TLSH T18A537CB35644E037D85375728CAAE6F2A9B07A211D3050EB3CEC0B98EF567842F1965B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Alligator\madExcept_.bpl
- Size 438KB
- SHA256 655c2a4b484ce587c8c99cbc17f7cada640e79fc8f92b4de2d68882d79c0c815
- MD5 9ff9e6b33bee8e297bbdb47e8ac9b60f
- SHA1 b49d037a12c43958ab24b3869359e6ddbe8cc551
- SHA512 7552139146d3cc913cb0c20ac612e194cdca01f202abb668e3451c343d8e4b5e967a3c90420817cea400a20c215b4cb4956a80896d6bb10c4f5ad720b9667109
- SSDEEP 6144:FlAz49EKhEV30F8sl88nTjQ4Q50gEcW/jd+o72niVUNMa4Yn2S4fb:FlG4ut30F8slzYlQcW/jd++2nJ6u2S4T
- TLSH T104944D31D288C077D062263BCC2AD6C461B975341A34A95F7DE80F4CAF77A91AF26397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Alligator\msvcp_win.dll
- Size 489KB
- SHA256 a6ddbc4954687b359c4b1bc7105647828ed9c6c34fba89c395806ea2420dbb2f
- MD5 1f132c76a07adc8a41b6f9859323e0e0
- SHA1 85a1bb9b7b719fadcf0ee8d7f63d053f9fcb1bd5
- SHA512 1b70b150df2a6fc65329c89d20e101ac94135be145c469ca356a0aa41e04bd2a84652f2675f4eff487b295474185a4db273fe4bf00c82327f3c8a4d861042d7f
- SSDEEP 12288:AN9jSIScPnEd4ZiUCujHhUgiW6QR7t5s03Ooc8dHkC2esjEFPYQ:29jSISNd4ZJE03Ooc8dHkC2eOEFPH
- TLSH T135B42A237B4149B1D58A63F021CA936283F9AC6547A0F3C357EAF16DBF293D19633681
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Alligator\rtl120.bpl
- Size 1.1MB
- SHA256 b3dee68af7b2805f6cf74976b60564dcc7d6d38444078d32cdca99ee1bb5bb22
- MD5 4f2040add9f5b541db07a2e866e2c5ca
- SHA1 b04da67e7ba7207deb99f56062661edc919f543a
- SHA512 4fc2f75a8999e1a463d97bb89ad3cfdef4dd35615df6538f794e01f98de205a19bdae9dee58ceff6e9e3f08b5497c0f62e1b971a859bce711974d5f2e2180914
- SSDEEP 24576:yEsEWbADYcUsnkqB8CVxIA99SGcM8sq4eXauOOqNTLjdecRzT:pHgcTLheM
- TLSH T190356C30F34A88BBD2A626BD4519BE14ACB87E10E1A4D599ACF4CD0DB975584373C3CB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Alligator\sqlite3.dll
- Size 908KB
- SHA256 bc0c750c98bd413e7975e8b17b1101c346dda53100020161bc5141f77ed98932
- MD5 5b5a926a887f4a9f3eecc54598f697db
- SHA1 86044be248e9fac25a0d8a3dd3c617da8688b7ea
- SHA512 3031b4cf17cd4261d9c36495cfb707c6be10bd1444c8e474d1f117df55cadb32fe1661f239499d6f1ba3d3d96def6f6b4eae7e3fba543c6a5c8b98dedeb91412
- SSDEEP 24576:MRxNAQB74x0FwTuis6eCwjH+SW61zf/AF+e:Ma+syis/LjH+S31o
- TLSH T1BF157D46EA17A87BDC5701754607F39B0575DA30A832CB8BEBC91D68DEB3ED2160A343
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Alligator\ucrtbase.dll
- Size 1.1MB
- SHA256 50825771d83ed274c814961c7d84e124539821f647f71c8a60b620a3008a1605
- MD5 cc3bf1319f2ef9c9718735bdbd2441a9
- SHA1 ee1cd03129e6a00ed5aaf31e2c36b7f4356ae0ef
- SHA512 4632f285624ba9aa963b0198ed5467dec7e71e683cd324623a255ae71d486eee61cabae135078e5dc1b75e38bf524f9547ecb00248bf93ef6691a2edab5daa5e
- SSDEEP 24576:lcjIrXW7AX5t0C6HjqiEwopCJrNlkH2uuYYH5JMmcvIZPoy4TsJ4:qjIrXW0JteEwopCaTYH5JcsJ4
- TLSH T1AA455A11758580AED85C31796359F922247F72B24B7AE8C373C41AE99E305C0773AEEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Alligator\vcl120.bpl
- Size 1.9MB
- SHA256 19e61333b1d1732a0af016c792f633b8f96c0ce8651d991da60e7527c2c6c559
- MD5 ee485ba5230f6b7c2d94e9b0a64a510f
- SHA1 3ebcd4279932a71acfd85e391ad0f3791fb69a0c
- SHA512 d8d70e209814d4ca3a241f78ba8e1c4849470a45831c522a10e690c14bf82565097bed6144419c6a7a0afcfa411a02f43e7d9a177ecbbd5c6335eea67e7a5a7d
- SSDEEP 24576:prKziiTDpqb13me26exdBkCWgB/S8H4PM+Hs+W0mN6WZA53lKiHLpyz6m3U:Oillexp1SG4P/lma539HLo+j
- TLSH T164957DA0B33D0DF2C5A32B7C159FAE50F925AF106360925BAAF5BC4D5EF06903A1531B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e59e313.msi
- Size 6.7MB
- SHA256 16628054549d3e1f10ea645ab7e34be6ee10934ea483951489c6ce32eef7921e
- MD5 1f2972abda045d02a5c7266180dbcc30
- SHA1 078dd51ea09a9d7e841c00378eeb1fb2226b5ffa
- SHA512 3b43e22a38aedf28808e218570944e17a0483534efce250d77ca270d00b6ddbb6380edbcfe51835009b7b87485ea797746da0e7c42d1b621c1719b79a731ea93
- SSDEEP 196608:bdz/6ety7BYWr27nWfwx9qO7EkJPAWqpq3n7nT:pz/65F2LgOXqbpqv
- TLSH T1216633E3D5782522F32756F488376A8994104D0443F39AE76699F8AD1EFA26CEC704CF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 c5176c03401688f762abb367df2692add80d99d48d8b2761577f7f55038278b5
- MD5 d9442cea84468ba1c378911a1f4433ff
- SHA1 eb32a5db2c936e3404f6d2d912d0676fed4a8a1f
- SHA512 b71e5f090689d67b426ca577ede36400906012f9e11e4caac974d42ef0f36b82e317003297787c607656dfe69d672501e8848e6aa682bb6f226ce5c4ed6b2967
- SSDEEP 24576:WFo3DMP+doO/vvTL/yAjDilQP7eJY7Eg0+1xNudb1WtqJESTsIRmD6pin+z:VHI
- TLSH T17D57B31436F92200E7B79E3DB8F06A234D397D5BAC15DE8D45511B8E0822F71E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{c61fa831-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{a2443214-febf-4cfe-95e7-4aaeb585f0bd}_OnDiskSnapshotProp
- Size 6KB
- SHA256 4c141750d552e92f5c0a0f30e9eff6e432fc891d69324e38c82573b7103471d0
- MD5 ba8c35af5cd2bdbb5f0d61056e157839
- SHA1 f2d1b341fe03cc69a5e91081f000947cfc3f5e96
- SHA512 f60f5ace81c3dc0e54b09703189951d9c23a660b463368e5544c2149d1436096299d480393058b310025bc3f908a34fa50c51bb313e37631faf5b5430f33f7ef
- SSDEEP 96:FAI+b8vc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:2IZb++uVm
- TLSH T189D177085AF54711E2B3AB3228F14557A877B911EF33CB8E0198238E6671A10F975F6F
- MD5 SHA1 SHA512 SSDEEP TLSH