quasar | bf93b1578a876f6bbd0368b9d91e78a5b57b499e906b7ceb8e534c1c55626153

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/07/2026, 02:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-16_37409f4530f6f1eea906b633903646bd_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Size 33.2MB
Sample260716-dfbl3sft2t
SHA256 bf93b1578a876f6bbd0368b9d91e78a5b57b499e906b7ceb8e534c1c55626153
MD5 37409f4530f6f1eea906b633903646bd
SHA1 0259ca91563f15dab4ff0ee0adc5e1555090f487
SHA512 a5064b80b82f520a9537254bb6d7c97c13c24d504fdef9f612b53326242fd7a245cb97cacfafa65b35bdff520891733edad337086e145d3967986f2019377c8a
SSDEEP 786432:SDcLHzPqxMSF8fg7amN79SA0X2d2lpIwBPunjMsIc:SDkzyxMSefg+CSfvSwRunRIc
TLSH
T13B773318D77521B2E0EA99B8DE619757D3723CD00FB2C0DB12541A6ABEB37508E313B6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery quasar installer spyware trojan

Malware Config

Extracted

Family

quasar

Attributes

encryption_key
601A8BC9374B13CCF1F064E4E3BF31EEB9A6564B
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
reconnect_delay
3000

Signatures

Family: Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 3 IoCs

resource	yara_rule
behavioral1/memory/2304-312-0x0000000000D60000-0x0000000000E54000-memory.dmp	family_quasar
behavioral1/memory/2304-307-0x0000000000D60000-0x0000000000E54000-memory.dmp	family_quasar
behavioral1/memory/2304-320-0x0000000000D60000-0x0000000000E54000-memory.dmp	family_quasar

Detects Windows executables referencing non-Windows User-Agents 3 IoCs

resource	yara_rule
behavioral1/memory/2304-312-0x0000000000D60000-0x0000000000E54000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/memory/2304-307-0x0000000000D60000-0x0000000000E54000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/memory/2304-320-0x0000000000D60000-0x0000000000E54000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 3 IoCs

resource	yara_rule
behavioral1/memory/2304-312-0x0000000000D60000-0x0000000000E54000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral1/memory/2304-307-0x0000000000D60000-0x0000000000E54000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
behavioral1/memory/2304-320-0x0000000000D60000-0x0000000000E54000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL

Detects executables manipulated with Fody 3 IoCs

resource	yara_rule
behavioral1/memory/2304-312-0x0000000000D60000-0x0000000000E54000-memory.dmp	INDICATOR_EXE_Packed_Fody
behavioral1/memory/2304-307-0x0000000000D60000-0x0000000000E54000-memory.dmp	INDICATOR_EXE_Packed_Fody
behavioral1/memory/2304-320-0x0000000000D60000-0x0000000000E54000-memory.dmp	INDICATOR_EXE_Packed_Fody

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	2026-07-16_37409f4530f6f1eea906b633903646bd_cryptbot_icedid_luca-stealer_njrat_stealc.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tagmhelpar.exe	tagmhelpar.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tagmhelpar.exe	tagmhelpar.exe

Executes dropped EXE 5 IoCs

pid	Process
4868	tagmansetup.exe
1452	tagmansetup.tmp
1836	closeapp.exe
5060	Tagman.exe
3060	tagmhelpar.exe

Loads dropped DLL 1 IoCs

pid	Process
1452	tagmansetup.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3060 set thread context of 2304	3060	tagmhelpar.exe	94

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Tagman\lang\is-3P7PP.tmp	tagmansetup.tmp
File created	C:\Program Files (x86)\Tagman\lang\is-UCG0R.tmp	tagmansetup.tmp
File created	C:\Program Files (x86)\Tagman\lang\is-9038T.tmp	tagmansetup.tmp
File opened for modification	C:\Program Files (x86)\Tagman\AbApi.dll	tagmansetup.tmp
File created	C:\Program Files (x86)\Tagman\ffmpeg32bit\is-MLCB4.tmp	tagmansetup.tmp
File created	C:\Program Files (x86)\Tagman\lang\is-75CCD.tmp	tagmansetup.tmp
File created	C:\Program Files (x86)\Tagman\lang\is-EC4G5.tmp	tagmansetup.tmp
File created	C:\Program Files (x86)\Tagman\lang\is-TKUGE.tmp	tagmansetup.tmp
File created	C:\Program Files (x86)\Tagman\lang\is-GU98J.tmp	tagmansetup.tmp
File created	C:\Program Files (x86)\Tagman\lang\is-7R5GI.tmp	tagmansetup.tmp
File created	C:\Program Files (x86)\Tagman\lang\is-T4C8K.tmp	tagmansetup.tmp
File created	C:\Program Files (x86)\Tagman\unins000.dat	tagmansetup.tmp
File created	C:\Program Files (x86)\Tagman\is-7M114.tmp	tagmansetup.tmp
File created	C:\Program Files (x86)\Tagman\lang\is-KOGEO.tmp	tagmansetup.tmp
File created	C:\Program Files (x86)\Tagman\lang\is-5N0M3.tmp	tagmansetup.tmp
File created	C:\Program Files (x86)\Tagman\lang\is-V7A3N.tmp	tagmansetup.tmp
File created	C:\Program Files (x86)\Tagman\is-ALL33.tmp	tagmansetup.tmp
File created	C:\Program Files (x86)\Tagman\is-AOST0.tmp	tagmansetup.tmp
File created	C:\Program Files (x86)\Tagman\manual\is-VE1GB.tmp	tagmansetup.tmp
File created	C:\Program Files (x86)\Tagman\lang\is-3JE65.tmp	tagmansetup.tmp
File opened for modification	C:\Program Files (x86)\Tagman\closeapp.exe	tagmansetup.tmp
File opened for modification	C:\Program Files (x86)\Tagman\AbGui.dll	tagmansetup.tmp
File opened for modification	C:\Program Files (x86)\Tagman\XDMessaging.dll	tagmansetup.tmp
File created	C:\Program Files (x86)\Tagman\lang\is-N353P.tmp	tagmansetup.tmp
File created	C:\Program Files (x86)\Tagman\lang\is-TE7GJ.tmp	tagmansetup.tmp
File created	C:\Program Files (x86)\Tagman\lang\is-TBM4P.tmp	tagmansetup.tmp
File created	C:\Program Files (x86)\Tagman\is-LP420.tmp	tagmansetup.tmp
File opened for modification	C:\Program Files (x86)\Tagman\Newtonsoft.Json.dll	tagmansetup.tmp
File opened for modification	C:\Program Files (x86)\Tagman\AbFlexTransEditor.exe	tagmansetup.tmp
File opened for modification	C:\Program Files (x86)\Tagman\AbLiteRegistration.dll	tagmansetup.tmp
File opened for modification	C:\Program Files (x86)\Tagman\nunit.mocks.dll	tagmansetup.tmp
File created	C:\Program Files (x86)\Tagman\lang\is-LNTI4.tmp	tagmansetup.tmp
File created	C:\Program Files (x86)\Tagman\is-KB41O.tmp	tagmansetup.tmp
File created	C:\Program Files (x86)\Tagman\is-2U8S9.tmp	tagmansetup.tmp
File opened for modification	C:\Program Files (x86)\Tagman\Tagman.exe	tagmansetup.tmp
File opened for modification	C:\Program Files (x86)\Tagman\Hardcodet.Wpf.TaskbarNotification.dll	tagmansetup.tmp
File opened for modification	C:\Program Files (x86)\Tagman\NAudio.dll	tagmansetup.tmp
File created	C:\Program Files (x86)\Tagman\lang\is-PH73C.tmp	tagmansetup.tmp
File created	C:\Program Files (x86)\Tagman\lang\is-0GD74.tmp	tagmansetup.tmp
File created	C:\Program Files (x86)\Tagman\is-7LQ7L.tmp	tagmansetup.tmp
File created	C:\Program Files (x86)\Tagman\manual\is-GCMOS.tmp	tagmansetup.tmp
File opened for modification	C:\Program Files (x86)\Tagman\AbSettingsKeeper.dll	tagmansetup.tmp
File created	C:\Program Files (x86)\Tagman\lang\is-PS1NM.tmp	tagmansetup.tmp
File created	C:\Program Files (x86)\Tagman\is-00EHA.tmp	tagmansetup.tmp
File created	C:\Program Files (x86)\Tagman\is-34HF9.tmp	tagmansetup.tmp
File created	C:\Program Files (x86)\Tagman\lang\is-DLIH6.tmp	tagmansetup.tmp
File created	C:\Program Files (x86)\Tagman\is-6J6IV.tmp	tagmansetup.tmp
File created	C:\Program Files (x86)\Tagman\is-51ALJ.tmp	tagmansetup.tmp
File created	C:\Program Files (x86)\Tagman\is-Q64S0.tmp	tagmansetup.tmp
File created	C:\Program Files (x86)\Tagman\is-4BUKI.tmp	tagmansetup.tmp
File created	C:\Program Files (x86)\Tagman\manual\is-JD79J.tmp	tagmansetup.tmp
File opened for modification	C:\Program Files (x86)\Tagman\ffmpeg32bit\ffmpeg.exe	tagmansetup.tmp
File opened for modification	C:\Program Files (x86)\Tagman\nunit.framework.dll	tagmansetup.tmp
File created	C:\Program Files (x86)\Tagman\is-J1UBK.tmp	tagmansetup.tmp
File created	C:\Program Files (x86)\Tagman\is-QS25V.tmp	tagmansetup.tmp
File created	C:\Program Files (x86)\Tagman\is-Q055Q.tmp	tagmansetup.tmp
File opened for modification	C:\Program Files (x86)\Tagman\unins000.dat	tagmansetup.tmp
File opened for modification	C:\Program Files (x86)\Tagman\AbSettings.dll	tagmansetup.tmp
File opened for modification	C:\Program Files (x86)\Tagman\FlacLibSharp.dll	tagmansetup.tmp
File created	C:\Program Files (x86)\Tagman\is-0BDPD.tmp	tagmansetup.tmp
File created	C:\Program Files (x86)\Tagman\lang\is-GAOQ4.tmp	tagmansetup.tmp
File created	C:\Program Files (x86)\Tagman\is-PILNP.tmp	tagmansetup.tmp
File created	C:\Program Files (x86)\Tagman\is-KL9VN.tmp	tagmansetup.tmp
File opened for modification	C:\Program Files (x86)\Tagman\AbBugReporter.dll	tagmansetup.tmp

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\Fonts\is-KSE93.tmp	tagmansetup.tmp
File created	C:\Windows\Fonts\is-T7L8F.tmp	tagmansetup.tmp
File created	C:\Windows\Fonts\is-K0JPG.tmp	tagmansetup.tmp
File created	C:\Windows\Fonts\is-QTUJS.tmp	tagmansetup.tmp
File created	C:\Windows\Fonts\is-I0NI3.tmp	tagmansetup.tmp
File created	C:\Windows\Fonts\is-4H9QM.tmp	tagmansetup.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3188	2304	WerFault.exe	94
3824	2304	WerFault.exe	94

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jsc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tagmansetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tagmansetup.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	closeapp.exe

Inno Setup is an open-source installation builder for Windows applications. 4 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/files/0x0017000000024448-6.dat	innosetup
behavioral1/memory/4868-15-0x0000000000400000-0x000000000042D000-memory.dmp	innosetup
behavioral1/memory/4868-34-0x0000000000400000-0x000000000042D000-memory.dmp	innosetup
behavioral1/memory/4868-223-0x0000000000400000-0x000000000042D000-memory.dmp	innosetup

Modifies system certificate store 2 TTPs 7 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD	Tagman.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 0f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b1400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba953030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f	Tagman.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 190000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba9531400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b0b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f	Tagman.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 0400000001000000100000004fdd07e4d42264391e0c3742ead1c6ae0f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff153000000010000007e000000307c301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301f06092b06010401a032010230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000056000000305406082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030906082b0601050507030106082b060105050703080b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d0020005200360000006200000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf697f0000000100000016000000301406082b0601050507030306082b06010505070309140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a01d0000000100000010000000521f5c98970d19a8e515ef6eeb6d48ef7a000000010000000c000000300a06082b060105050703097e00000001000000080000000080c82b6886d7010300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd1190000000100000010000000cb9dd0fceaaa492f75ce292c21bbfbdd200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410	Tagman.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 5c000000010000000400000000100000190000000100000010000000cb9dd0fceaaa492f75ce292c21bbfbdd0300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd17e00000001000000080000000080c82b6886d7017a000000010000000c000000300a06082b060105050703091d0000000100000010000000521f5c98970d19a8e515ef6eeb6d48ef140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a07f0000000100000016000000301406082b0601050507030306082b060105050703096200000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf690b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520036000000090000000100000056000000305406082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030906082b0601050507030106082b0601050507030853000000010000007e000000307c301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301f06092b06010401a032010230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff10400000001000000100000004fdd07e4d42264391e0c3742ead1c6ae200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410	Tagman.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1	Tagman.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 0f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff153000000010000007e000000307c301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301f06092b06010401a032010230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000056000000305406082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030906082b0601050507030106082b060105050703080b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d0020005200360000006200000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf697f0000000100000016000000301406082b0601050507030306082b06010505070309140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a01d0000000100000010000000521f5c98970d19a8e515ef6eeb6d48ef7a000000010000000c000000300a06082b060105050703097e00000001000000080000000080c82b6886d7010300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd1200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410	Tagman.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1836	closeapp.exe
1836	closeapp.exe
1452	tagmansetup.tmp
1452	tagmansetup.tmp
5060	Tagman.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5060	Tagman.exe
Token: SeDebugPrivilege	2304	jsc.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
1452	tagmansetup.tmp
5060	Tagman.exe
5060	Tagman.exe
5060	Tagman.exe
5060	Tagman.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
5060	Tagman.exe
5060	Tagman.exe
5060	Tagman.exe
5060	Tagman.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4200 wrote to memory of 4868	4200	2026-07-16_37409f4530f6f1eea906b633903646bd_cryptbot_icedid_luca-stealer_njrat_stealc.exe	84
PID 4868 wrote to memory of 1452	4868	tagmansetup.exe	86
PID 1452 wrote to memory of 1836	1452	tagmansetup.tmp	87
PID 1452 wrote to memory of 5060	1452	tagmansetup.tmp	92
PID 4200 wrote to memory of 3060	4200	2026-07-16_37409f4530f6f1eea906b633903646bd_cryptbot_icedid_luca-stealer_njrat_stealc.exe	93
PID 3060 wrote to memory of 2304	3060	tagmhelpar.exe	94
PID 3060 wrote to memory of 2304	3060	tagmhelpar.exe	94
PID 3060 wrote to memory of 2304	3060	tagmhelpar.exe	94

C:\Users\Admin\AppData\Local\Temp\2026-07-16_37409f4530f6f1eea906b633903646bd_cryptbot_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-16_37409f4530f6f1eea906b633903646bd_cryptbot_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4200
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\tagmansetup.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\tagmansetup.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4868
- - C:\Users\Admin\AppData\Local\Temp\is-HOBFE.tmp\tagmansetup.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-HOBFE.tmp\tagmansetup.tmp" /SL5="$70220,32529604,157696,C:\Users\Admin\AppData\Local\Temp\RarSFX0\tagmansetup.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1452
  - - C:\Users\Admin\AppData\Local\Temp\is-T1HAE.tmp\closeapp.exe
      "C:\Users\Admin\AppData\Local\Temp\is-T1HAE.tmp\closeapp.exe" Tagman
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:1836
  - - C:\Program Files (x86)\Tagman\Tagman.exe
      "C:\Program Files (x86)\Tagman\Tagman.exe"
      4⤵
      Executes dropped EXE
      Modifies system certificate store
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:5060
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\tagmhelpar.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\tagmhelpar.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:3060
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2304
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2304 -s 1088
      4⤵
      Program crash
      PID:3188
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2304 -s 1088
      4⤵
      Program crash
      PID:3824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2304 -ip 2304
1⤵
PID:1880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2304 -ip 2304
1⤵
PID:4636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AbApi.dll

Path C:\Program Files (x86)\Tagman\AbApi.dll
Size 53KB
SHA256 074f4333b1e757d998f2341a4483729662534f1ea5badd0da43cc87cce8c7157
MD5 275eaa1607fa43a6b799c39d7db1facd
SHA1 bd681c62d09ce2c77cb58e6370fd826aa95ad6dd
SHA512 f6e45a150304d7fc96fcc9f4305c7c7fd9d94da9e3ec1ef3aae1a1685f9aedbd93401b6c3bb90fa6aea5586a3dad1a80ebab2a48da152d576deb14537a43ec0d
SSDEEP 1536:B8OvgYA2889dfZOU5rr00DgSgxovTflAxwN:B8NcIcgdSflywN
TLSH
T1BA434B4273FD4522EABF0FBCA495D12107F0BA4BA455DA5C1CC760DC1AA73908A64BEF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AbBugReporter.dll

Path C:\Program Files (x86)\Tagman\AbBugReporter.dll
Size 203KB
SHA256 6fe59744a1567f0c1f5786629564d65cee97217b96408976528f3a90f8330911
MD5 c9ac1e19d0239b9a021e26b8d5c76ac7
SHA1 9a0ba89a9db12f73b1c00222d20f204b5be13fef
SHA512 b6d989adf2a5a8ca5bcccdd573d6c2a3508a34e07bfd2d9b118e47830f34e0f0d2ef603f8e10f1ef7d597afd2bb6462a7e8e382751a315aac31f720d65bf6148
SSDEEP 3072:TIONidJfRYSPK90Dk/U+OBOg/+s5Sm76pM1Lfif9BZyXFl8vBRJah5kglNw+:T2S9Z8D8sUmepMBfif9WkuXlNd
TLSH
T13E14F16333889427E66A0BBE98B094C117757E363664D3DF6CC5229E2CB3315A711F2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AbCommons.dll

Path C:\Program Files (x86)\Tagman\AbCommons.dll
Size 111KB
SHA256 d20d5c7892cc2a0fe7331e9ba55ebc08a313fb2c7dbc5f408885b2630cb6f31f
MD5 80528f552b31a27f74e9180eb941f262
SHA1 5fc01bd523698412633d922a5adaf92b41a2ab5a
SHA512 0a2da9e8b64e5fd35ed4e5ccfb9d54f7169c73ed96f8e7aacf551e40ca226d0d279d042315eda1bb9ca3d17fffa84a053ae7c151da9e580f64f5b13e5420e33d
SSDEEP 3072:D/rSV0zLI0ROn35T5uXjIbkYfdoz8cltL/zI659g/YYtlP6wU:D/WV0zM33FpbkGTYMlP6f
TLSH
T172B3D68127FE465BF6FB7F74B8B081415A7ABD656831DB1D0A80608C1972B908AF0F77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AbFlexTrans.dll

Path C:\Program Files (x86)\Tagman\AbFlexTrans.dll
Size 45KB
SHA256 64964e6af898754b373bf3cf3061cd853175c5785a70ba6cfb40645bf0459fc7
MD5 ed5e146d7e8fac52abb0dd8d775c438c
SHA1 8fe1a1b808bb769fae47ce5f85b15fe99fe17862
SHA512 ebf4a6d59174b51407d17537417ca7b53ffbc800245201ea4573a2a3fdfa5029c320ab3ce95cd9e63e6c1cda5e2a287bfa52931ad7bbbc4cf4b6e59c99b0bd9d
SSDEEP 768:ygMZJZGu0VlPm41k9AH6GELjRRCjOShD9Pks7PNj29hr5UL7whm4ATjRr2mALvoz:ygMRGusEC6GCjij29hr5G0AtlA0ZwK
TLSH
T15523E51167E8864AFFFB6F30F8E055052972FD967C79DA0E1A4146CD0D227809A61F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AbGui.dll

Path C:\Program Files (x86)\Tagman\AbGui.dll
Size 1.4MB
SHA256 2c916b0507942753cdc87a58cfb2535407d2e4d1a1aea1aa82723233ffd91019
MD5 33c11fcaa4501574e51188a50e606f08
SHA1 fcbf53dd62216e999c804c5402003ba3195481cd
SHA512 f4f7056c9b14307ab3bb6cf4787378d3cc6280eb2ac99b846538c25ffad65de3b433db3db261fe053cc4e60b0986daf66560be8a09809a08014d7a1d258383dc
SSDEEP 24576:jfwoZ3793tmjgwjIkLm75KDplptCNquM1jLKi/aoBUV8YBF2gr:jfwq3VwZLmgjHCNqn1jGzUKFr
TLSH
T13565126162A8447DCA670B7A54B34240AB329A5A2BD1CF6DAC4F91CCDDC73470B533BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AbLiteRegistration.dll

Path C:\Program Files (x86)\Tagman\AbLiteRegistration.dll
Size 238KB
SHA256 60f8417df12e15a43f4518b2295ba09d04aad60c101802a7a1ff61e3e3ec0c13
MD5 c4d664b8eabc9b811655d0c7ce102f67
SHA1 6af68860567b02e039602a8657a57e7903b80468
SHA512 e46e8a7e301e0cb330c41c28aad0d04347d33fe8846c2f583affeb4314469268209a24d0eb1b19e06794c8c0a112af8cdd050fd5a35f95428fdf46882fc44a2f
SSDEEP 6144:8yA2CMofUfmUzMjiDvsa1Pw4hpd2sU+REqsAflur:y27ofOmZjWrhnnUbAC
TLSH
T1A2349E51F7EC4493E87F07B2587B95111AB27A7DA9B1D24E2D8B325908F33820653B1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AbSettings.dll

Path C:\Program Files (x86)\Tagman\AbSettings.dll
Size 66KB
SHA256 66eb5930be74d23469f8617a7708215954f3c9d3422e868dfd96e5d25bd54d67
MD5 b2c6d56ea21d17a2f0696db0a5e330f6
SHA1 3d5a2bc172828b8e0e1cedbd83f7d8539574109d
SHA512 463eef8a7297cf89d7d70376dde8007d59c85778a0c6ff17ea5aea38b9d3ed7f922991acfb30b6bac6b43471a285376fd3fd3fecfb09db3968a141d24e9f9131
SSDEEP 768:KtKZ8HyOPQ+DqgfEONv2sUMyyiVwJ0oXoDbOxvym761mVuPTr2mALvIGTV+wBf:KAxbYUJyi+J0oQOxvyXXlAwwJ
TLSH
T1D1635C1533DC8659FBFFBF79B47001214AB0F982AC66F74E1E92119D09263D44AA0BB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AbSettingsKeeper.dll

Path C:\Program Files (x86)\Tagman\AbSettingsKeeper.dll
Size 34KB
SHA256 2039737fe59cda1bef616c0bd2e280b94db50ee4783a772287e2e0b5565f6fe6
MD5 7694afcafa7e9217ebf5e08ca602d9d4
SHA1 6195c443b0009bb6c73a47d8fd81d7aee5890729
SHA512 0ffa89acac524398b95f797ade7180d11b6cbe16c7082567f2f636884bd99dc9f62d06b5e5580f90666e0d22ecf78daa08349c178bf37a0ead820fcd1fd0891a
SSDEEP 384:+XQt+u1MXPX1XCBNSqlo86IUUHTsXgv+bZ0V8I/uo6ki2m5i6qvZSjTfNLbcrWBJ:N+ugY1b6I+Xbblhr2mALvEjTV+wN
TLSH
T1D4F24C435BF88107EB9F4ABEB0F252560F74F96369EAE68E094D60385D073D02F54B26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AbWpfRegistration.dll

Path C:\Program Files (x86)\Tagman\AbWpfRegistration.dll
Size 291KB
SHA256 4a5f564b9f82e024091109bc068580850fc4410864912f4668e4c7c57fa9441c
MD5 02c2f81f984ce90be223789db2ef80b9
SHA1 aaf0ad3e55f24bd03bf30a30663216200a04c6bd
SHA512 74782ba211fd807b032bbe0c8c4b6c2436c7360b2e231be61259107e759d4b725c9b7140dd89c92a1bee66315777f007e0ae0c26f37cf6510002edf074a302d8
SSDEEP 3072:jqy34FvSlrK++Ov81KDYsxcsFsfdzXvxQYs6ulfwV:jqRFvQd+Ov81KDYs+NvYtlf2
TLSH
T118548DB4320DDA62E159C775C8ADC0828A307D506E81E9AB36C6B75F30BB3E1C91652F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GuiUtils.dll

Path C:\Program Files (x86)\Tagman\GuiUtils.dll
Size 56KB
SHA256 d64348ff760e57cd1b8a36946c04d4859e4c0f41f014e78e302f576c0b26e428
MD5 8019255d5ca71a1e7628f1c102833b62
SHA1 12db5e9fdfe084f4ea907c551781b5e2927a4a66
SHA512 299744ed27047e277a196464a3a6a5a69200620c48cb85698290a3250beb829d7d5d8e9a08d727a8c075a5d1ac21dbeaacca53245f50ae89e6b3c6f59b2e9db4
SSDEEP 1536:rTATAnt70LWyD22V8kwjz5IGa3DRNQd+LclA+MwV:AMq951zQ8clrMwV
TLSH
T1A3437D412B3C4523CB9F0BBAA8F542169A34D6832BE6C78E6C48606C6DC73531B5277F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hardcodet.Wpf.TaskbarNotification.dll

Path C:\Program Files (x86)\Tagman\Hardcodet.Wpf.TaskbarNotification.dll
Size 58KB
SHA256 3f8cecb4553ec7b853f9b0d6e66ff0b725188bf9370cede452b947b24dada006
MD5 aed0cda3c9f40c44c6a0fc2ce8ebeaae
SHA1 9bdd7c0f03fe0cf87625672c12cb7a2fcf1ce99a
SHA512 1cfe7cdd3ea47a38ed1768b9e850992e4f1170ad239f0d4e4d6af0a68137a4f367007d13602505e9bcd3085af38cb4b8b17e5346fdebb77c92070ab041caa50c
SSDEEP 768:kwMiT37RjNbwbfWNSjCpB9HMZ3hZYfJkOece9Rr2mALvTGTV+w7:kQT31jNoWk49+hy2Oece9tlA/zw7
TLSH
T1AF434C8737BC8027D7EF0AB8785961214634EA8379A7EB4E5881626D15CABC037447EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ICSharpCode.SharpZipLib.dll

Path C:\Program Files (x86)\Tagman\ICSharpCode.SharpZipLib.dll
Size 209KB
SHA256 c322e2d5e43459d030a114ba4198516018e094068e6cd75b1d5b7d940493438e
MD5 b565daf89665761ce257d3d0057b7e60
SHA1 40a797ea316cc96cc39c85a5ed8b5d53c0692dd5
SHA512 a54e5ab694a050762d99daab05fbc269a001b6fd0f137b7c311af75429e9160f5b6ceb2ac7773f7eaf3a78e932dffd678478fc97468dac04fe5318df2ff7c712
SSDEEP 3072:MjMibqfQqFyGCDXiW9Pp/+Tl4abpuu201PB1BBXIDwtqSPVINrAfvp1yldwut:3ibqI59PpOPf201/z7pMldNt
TLSH
T1C024281967FC464BF6EA4BB8E47524A6C7F0F996362ED74E884050FF1C127A0C964363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Expression.Drawing.dll

Path C:\Program Files (x86)\Tagman\Microsoft.Expression.Drawing.dll
Size 133KB
SHA256 b8f240c60150101e3c96b9aef80e2442fab6c37be8b2a91a5b5953923a046b35
MD5 b5fc5e8e917527c7e17cbfeb6f6c4cf1
SHA1 2bd000b49db42703722a207438b13b60ea60ab1c
SHA512 14a91822f13024358fe37eccd11c8b2ba90b4aad0d2deb974a31a144917f6a12c3f6254b24af93e22dce5d16a851e2da88abf881ed6e00f9856ffb5ea886169b
SSDEEP 3072:AaBPOWg2uLcdk6i/OKPA5Dgh/rM2Plf7sShhXslRwJ:982ds/OyA5c3VsIh8lR2
TLSH
T1E0D36B7D0758CA3BCEDE1ABEA8A021107730C73B3947EB496DC025FB56937611A86297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mp3Lib.dll

Path C:\Program Files (x86)\Tagman\Mp3Lib.dll
Size 34KB
SHA256 775add6fa8f1897c78f986676c3388f769f5b0e872d26a6974c324ef72cb1071
MD5 18850fde49cb4e626c20f5568c59b334
SHA1 cd7eef4a5100e7e7f72115a01d8114272de7ea1c
SHA512 bb024f9747ceb667e05d616dc3fbeb4f8a5ebd28e25859faaff17fccd901b93e242ec31312448c38f58fcd6817df036483541ad95188b7bb0cbca284a0e91c1e
SSDEEP 384:IivqrcaWAhfnvdTqSMrboeAS6rURSZ1Jo/9iKRRHWp2C/uo6ki2m5i6qv/ZTfNLv:IivsWIvd2SM42fi0U2r2mALvxTV+wMxG
TLSH
T198F26B0366358BB3D7A9CBB795E105521BF4F38249C7EA0A1CE503E81C573893F9691B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Newtonsoft.Json.dll

Path C:\Program Files (x86)\Tagman\Newtonsoft.Json.dll
Size 497KB
SHA256 ea19538f79c681b97b58d409a97fd2f028ec6e5749e51b305e6cc566cab43e81
MD5 784dd2cd64958a3a5659722104671f2a
SHA1 13b03f1a10cab23534c0ba4f8a0ba3d6268134b8
SHA512 15ebd0398a31ffdb39c487c662fee05800a3dd91bfdef9e2bcc48c1914158d07791898d27dea6c450b42069de10c0b5400d1a2dbcb90fd7d6da959ec79af0225
SSDEEP 6144:vCJHpwzKCaQcy7Xt5RH71xxc5jE4RyX2z+NzQcRBNnPUEbxakdr0tqzp/aN+Xohe:ALscYJRxxc5YOwRBNnclcQ0NozXpK
TLSH
T1EDB45B0297EC4B6BEAEFA335E530111587F9F856A6BDD7CF1945A5BA0C837819C003A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tagman.exe

Path C:\Program Files (x86)\Tagman\Tagman.exe
Size 2.5MB
SHA256 cc6a78466461191aa9f9130aee6c35e2494f0ad0cb99aef53291d27d8b8410af
MD5 cd139f032ab025ccc96ea7d513690d2c
SHA1 0ceaa1ba55152d763671b2eaa813ca67d322ea48
SHA512 c5b0ba23006045389a7cd5ecea1affeda555c02462f0edb66fdc5e282cff0ffa7a8f73f0b8637c5b69edf5024623c9344d708849cfa10b121fa723a60fee0265
SSDEEP 49152:wIWUYxwxq0ER0qZYTWuwRj5GQfvSX7ZE8f+Ap+Aj:YR0qWWuwd5GQfvSFE82AIAj
TLSH
T1BDC501012368DAA9D68F4733E0E24201E773E61BE347CB5AB95D544D2FA37DA4E02673
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tagman.exe.config

Path C:\Program Files (x86)\Tagman\Tagman.exe.config
Size 4KB
SHA256 6458e75c7de522ba12892d3506049bfe8eb4e784bcdcd1c8639dcb1f2819b94e
MD5 0c179c6c162f0f1bb0996782672a1691
SHA1 8217c7c45e31da5013cd0968f01dd197600ff8ee
SHA512 b4d21e06f54ad88d47c91e2fe2342d9a43a193878943cf9235ae1d74046566d7c4c6b095e5acb8875b5cebaa730c0b9877dd40de11a06e6b3046ef6eb60cb249
SSDEEP 96:Kr71p7KrQrrHu8Ch88j7sWW8qvtQvWi6arzsiv2e91vAXUXz4QjlScL:Kr7T7OQrrRa41QfN9
TLSH
T1FAB1F70DB1C1EF5902726636F6325291EEB046731175A0E4B4ED31675F31CEA4AF3366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XDMessaging.Transport.IOStream.dll

Path C:\Program Files (x86)\Tagman\XDMessaging.Transport.IOStream.dll
Size 27KB
SHA256 8d8d674e84e1c53353045c2d8670a02e2a6d1a032b1de6b2ec96dccca5b00989
MD5 f26d4de659268e259b359fb7e63058c6
SHA1 674891236bd83260492462b1f84212d89793412e
SHA512 f1805dfb71b51cd215ae38733b7520de2b61e11f7969c71de16f1f655fe0e5f7f418717a3fd8e884213b80ccf96ecfa659949268441648068973f9560c44b754
SSDEEP 384:B+h6qiVrSb3r5BZFjkriCrVbZHR4Eby7yWy0vzuyqyX/uo6ki2m5i6qvDT1TfNL2:0h6qGSbvfsfby7l92r2mALvtTV+wGI6
TLSH
T155C2498267E84213FFBB5F7AA4F561160D70FE839DFAD50FA00A40591E4A7906E3473A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XDMessaging.dll

Path C:\Program Files (x86)\Tagman\XDMessaging.dll
Size 62KB
SHA256 750fed6560a10ca3b1a95e3795a01e658c29a70c8521d1bc84489c723a2f7c5a
MD5 b86b61f9c222bd4f0552dc1cedc1bcbc
SHA1 ed1ba1482ae3e3aa89170ebf420ad521bdbd8889
SHA512 7f83bb2974728fbe33295e789fa132efa2c3f1de2f1aa6657ca3b20ea62a495bbb9423aaa0505191a6bee9974ea77f5be9fca95eb387fa689cb7cc42a91b7849
SSDEEP 1536:1sWq8hgmQMeMoSSJNL/MhbQr9I+7+lAdwLm:1sruLoSSJNL/M47+lWwq
TLSH
T173534C416F58CA33C7BF5A79B8B153120B75E697A992F34BA88891E51C523C01F703AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AbCore.ar.lang

Path C:\Program Files (x86)\Tagman\lang\AbCore.ar.lang
Size 26KB
SHA256 391ed5c1b46c91e0b59205aac3bb6b5486f891678595bacee330f73919ee26d9
MD5 e85da8ca6a20eda3cef4879610a2f70f
SHA1 0f84a8af4288eecc8c3e198fd3c97a65d239caee
SHA512 405d9475faa456d48f334730e05afc3cd6014629bd5bfba9b67d76c75b7a8f9dbb7faae40ad7b61ec6ce3f76cfc0c871c779eb309ee41e7bc3712c3019720fd4
SSDEEP 768:Ig2t+7LOsB3Y7TA/J4zYbhwPf82uRcuOlF+713ThR0NuOf:Ig2t0Ly/A/JMKhqE2McvlF+BDLIuu
TLSH
T113C27DA22A61C8600BF99E0FF593701CDD791C5BC647B966B4C30A614EB7C31D1AB1B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AbCore.cz.lang

Path C:\Program Files (x86)\Tagman\lang\AbCore.cz.lang
Size 13KB
SHA256 5bc3e3055e56e1a251975a20573fdcca7d03f93947faaf410bdd8d609c4e345e
MD5 15c26c84b58b8666e85cf6b8c203e594
SHA1 96bd7baa2aeea57cd7d0c3bd638993dd4f56d8f8
SHA512 e9e192afe05b2892469274c23bc82ddc005085a1a2e4a08e03d5da11a2bf7b1c3e9f96dc77c02c1749343a1afc81ee7ec1d99723474a4933585edda1887d8e69
SSDEEP 192:6guncq1PYpp7FPKR4fpohhnBt1Bl7S0yNZuvTpHgAf:6gunJ1APFPuZ7S0yNtAf
TLSH
T170529D26BA82CD110BF86E0FB903A44CAE5D059FC1022A9BB4C55CA61EFBD3591F31C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AbCore.de.lang

Path C:\Program Files (x86)\Tagman\lang\AbCore.de.lang
Size 23KB
SHA256 b0c3e7e90c165ddddb92dd0e646ee33dfb4ffd0a06ec61f50986c63b28916c3e
MD5 1ecc378e0b6a15cc30c312af63b614c1
SHA1 c900ef069eb9435926f1d9e803bf506eea6eef65
SHA512 561a5a662b428f71bfaa70f42d2dc25e8f7d261e96b2dd8143c3fc57882c108d2350b0b76853df5ccdc0dd561b5b392fd0c357e1d22f11e261028ff303cc1e3f
SSDEEP 384:5sRBhZmJRpmgH3OBZZGyQwbaNuudc9HD3dPJU2grVZrr9bef:5uhZmJ3mgHeBZZvQkm7wPJmZNbef
TLSH
T1D2B2BB66BA82DD114BF96F4F7A03A05D6E5C255FC2032A8BB4C548A70EBBC3191B70D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AbCore.el.lang

Path C:\Program Files (x86)\Tagman\lang\AbCore.el.lang
Size 31KB
SHA256 0987f7bb6285cf187fc30b36f321238c87b1197b7a769b9dc3df54799e9bd823
MD5 6a38c04209ea9dfd5f2625dae467d3e7
SHA1 07ae038a86655acb92b65afd5b24e697a3f4bfa1
SHA512 4e5d8375ebf7b49518b81afa534c059efc087b37ab6a263e974c65af2f65643f7bf5ae062dded28192529844503899f7a24a259a5f7b0db1377d0658fcdf4061
SSDEEP 384:C8pE5gAkDYuGQdgYWsXXbyKaFN6NjjfMlY01MofYgPUffFZQyp4ywiFrCf:C8pygiCBtaPE01Mfrp4xi8f
TLSH
T179E2F2AFB545DC9446B45A0F68C6A03C7F5A0C6ED606D7C9B1A8CA613DFD830A13398F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AbCore.en-uk.lang

Path C:\Program Files (x86)\Tagman\lang\AbCore.en-uk.lang
Size 20KB
SHA256 ebb3f84bb34e62abb42c32462ce4c9824000f2e395538b2849885599ec3ff061
MD5 fc0842bc90626b48cf05fba31574f59e
SHA1 8a853be5818f9afa73b9472dc72f55a79bc9fab5
SHA512 fc28705e2ebc66e5cd1ce36b719b93b4ab3aca8db67b1aa576e22d6692f41db035275159cb46f9c493fd7306d421f8d152fdbe40c3d728078b64cd0ecbf2e8f1
SSDEEP 384:NBre+dxHKFH0+vEXz3hTNmgZJBfwM9F9VJ5f:NBq+dgFcvTt5f
TLSH
T1EA92E126BA42DD114BF96E4FB907A14CBE1C149FD302269BB4C518A60FBBD34A1B31D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AbCore.en.lang

Path C:\Program Files (x86)\Tagman\lang\AbCore.en.lang
Size 21KB
SHA256 634a48cd94606475c01575f89db6f052e82aa09971897c7ecbbcb97142d14946
MD5 7d257f8cc6109171b7c39aa4b25c6991
SHA1 1763bb0afd75e1069515f6bc4fd56216b77735ec
SHA512 1d818d3bcdc6a09bad74a600a26e174e5b290f958e01ce8d5674e426515c1440c5f1a9a4bdbdce44e5e7b5cc229bc1346bffec2b38ccc7a330457f46d1aaef3f
SSDEEP 384:vBQ+dxHKFH0+vEXz3hTNmgZJBfwM9F9VzjmHf:vBQ+dgFcvTXjMf
TLSH
T1E6A2D127BA42DD114BF96E4FB907A04CBE1D149FD202269BB4C518A60FBBD34A1B31D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AbCore.es.ar.lang

Path C:\Program Files (x86)\Tagman\lang\AbCore.es.ar.lang
Size 13KB
SHA256 fc145125f4995c90c3658ef1503c0c5f1406ebea63fdd469a6d3e50d2f957393
MD5 af2b5d3f098a457f7bd5739c27435439
SHA1 f340194cc6aa0e119d1f554aa9c3b44b85f30f4f
SHA512 48e3162a00b8f357dd11bcd4e2ac0bb189d62ceb3394e3b00e9e64ee9a53055b9ebce205b2e6f688dbf89ca858661b3830dee49a4740a057ac77d4d1f5a2731f
SSDEEP 96:A1T5TQTKETVyTDuT4TaUTxSTCiT2LrTVTkuEhTZg+TWNTNTS1TYvTETQTxTCTvVh:KJCsxtLzgvqSaOKv6BeZDdNZuvTpHxjf
TLSH
T11F528C26BA82CD114BF96E4FB903A40DAE4D049FD10666CBB4CD19A61FFAD3091B31D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AbCore.es.lang

Path C:\Program Files (x86)\Tagman\lang\AbCore.es.lang
Size 22KB
SHA256 ef79ba1106b12ee03cfc445fdfc53b36a4c7ffd6df6b4b0dcf87940db6ac1392
MD5 1485373997cfca16bcec3f4cb7cfe081
SHA1 53061765e8212e55193ac0e7a18124fb8a331c47
SHA512 f724010e72944e11c9a45bc6a284247b7e202edd860bb52d143d5fe6df843d75c36a9015bfb8e12ad60cb4d41978f3878ec79d62ee7ac33fac1c5b13969e9504
SSDEEP 384:D7gT2VFcJOjhS+OwNq8fNuXKeoTXkQig3569K:D7gT2VFkbIqWTX8geK
TLSH
T1C1A2EC76BA82CD118BF96E4F7903E00DAE4C045FD20666CBB4C509A70EBAD74A1B35D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AbCore.fr.lang

Path C:\Program Files (x86)\Tagman\lang\AbCore.fr.lang
Size 18KB
SHA256 a4c94fac8a8267e11d7912e4a34793536fd3d3bad03414a01780e61ffe9f15f6
MD5 e5495fad5b5625f8fddf14acb3735660
SHA1 bafa3b9c9d8292b65eaab15c81a8c75164c042d2
SHA512 75d29cd9ac3a56ebd6d00889c1ce3379607b5fb810d54261859b665b4bfb6748728a57a644cad2185a2ccc50d3192cd3d5dad941930444631a390747a57a3390
SSDEEP 384:u8WhxequUoMfo/Xx7LZHN9HsEgl+/RwLR7GvNhef:uPhxeBIfu7NtlsEglARwLRSDef
TLSH
T15482016ABA92C9500FF96E0FBD03A14CAE1C154FD112679AB4C909670FBAC7492770DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AbCore.hu.lang

Path C:\Program Files (x86)\Tagman\lang\AbCore.hu.lang
Size 13KB
SHA256 290141124febb553797c8d04f847795aeeab64f5d45d2e573422bd61cdcc89a0
MD5 2dc67d0051c907931eefc0c35d254671
SHA1 bad2e8bf107519b89a0ff40f486b7d6543d68d9c
SHA512 3ecbd711d057a6c23ca14c5d95905abe007f02e3dcba2ea1d44c7b83f9a022f10543a37e1567b1630d3dd29a3398571a317dae55ad802b0790736e7110d971ac
SSDEEP 192:1RHQbcM5g8gK9+659rOlijq97NZuvTpHlqf:1RHg7g8g4HrOijq97Nwqf
TLSH
T13F528A36BA92CC104FF86E4FB903A44C6E5D145FD5022A9BB5C518A61EFBD3051B31DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AbCore.it.lang

Path C:\Program Files (x86)\Tagman\lang\AbCore.it.lang
Size 22KB
SHA256 0c3dd1de1e0c0359fd84397d5cdd1731b28a4782baa38432ccd5ec1265c326aa
MD5 08d2b116456d86c5b49a7fa64e31e877
SHA1 979d42c63d1fe0540683894c9d626cce398b8153
SHA512 d8132b11cfed6e7774f13df4e5cd4841f59004deaab64911386ec0d6a7cb22bba02b088e0d2a3c6089ae6bb743e00db7958ac4ff141c0252c49e164718494e9c
SSDEEP 384:SN9mV+pfHQmTfWAhJx+YHzbGDyTgnxSHRZf:OYVS13+mzbiyTcxqf
TLSH
T14EA2B072BA82CC114BF96F4F7903A04CBE5D149FD606268AB5C509A60FBBD30A1B71D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AbCore.ko.lang

Path C:\Program Files (x86)\Tagman\lang\AbCore.ko.lang
Size 23KB
SHA256 a267ab64bbedae771619d68ab5446ab6c7d14cbb6455f4678c6d3298831552cf
MD5 adeaacb6715e402995167245b6cee94a
SHA1 622a15a8e4e782353c2dca95c86783183332c7e9
SHA512 aa8ba0eab398eef3eea37e361fa1f7c0ec09687539557e222b134233a2a41f6c210d55dc00c33ad5eb89535e28b0b08f8495ab95ae3d71886060d91d508f80e7
SSDEEP 384:xwkXrV3uOVzJZn0Q3iGNUTYAVSQwxXOfLf:xwkXrV+OVdGgTUEAVSQuXMLf
TLSH
T1D2B2CD62BA93CC400BF99E4F7D53B10DAE5D409FD707169AB8C44CA24EBAC7190A74E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AbCore.nl.lang

Path C:\Program Files (x86)\Tagman\lang\AbCore.nl.lang
Size 23KB
SHA256 68062b9df9ae99151214ad0f9f84a6b6968190dc37e1798e8c8c3b054c434bbb
MD5 9efb01218e33f47530dee8bca28797db
SHA1 0a734bd6f0b51a3e9eda1d310f71beca27199686
SHA512 a8fb1e043d4eb9ebe809eefe78aaf11e06bf38fdf5ec8d658de79aa6a303f9997edab676db5de6c207fe399b4a66d055fa906dc744302e5dfa30fe23f8e25dbb
SSDEEP 384:g0HZcm8hZoWo5IY93TzwkTVNurwCXzUn5Ai6zYiM6R3lEzDtwAuLh/+byBVmDFf:98hZoWo5/T9Z0Fzw6/CFf
TLSH
T126B2B8227AD5DC264BFD9F4F9C43600EAE1D429F912AA2DC74D984330E73D6428B74DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AbCore.pl.lang

Path C:\Program Files (x86)\Tagman\lang\AbCore.pl.lang
Size 13KB
SHA256 88a08a0081615a2de22cdb8da42944087763c9b3648da9745f8f1e0ea9501744
MD5 237e0809d3128c48dc66d9fdb28a9ff0
SHA1 45617fec1a95f5d618fff8a49d92473b65d92d4b
SHA512 799e89da3de79a3365ad1eaa9fb784281960b79dc5742995071cca1c31cd82367fc8643c349cede248109c755aea5983f27344deb1c909897ca2ace000099d2c
SSDEEP 192:wDzefHuG5J1yEXwXwXM3TXL3sy2JXFTFXwgglKEM+1NZuvTpHF0f:wDzefHusXgAqbcpVJAgglKfWNA0f
TLSH
T10C52AD26BA92CD100FFC6E4FB943A84CAE5D149FC1026A8BB5C508A70EBBD3451B31D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AbCore.pt-BR.lang

Path C:\Program Files (x86)\Tagman\lang\AbCore.pt-BR.lang
Size 26KB
SHA256 958ab2a0a539087190e701b0ed8e5c0176759c15d789d4cf84fc50f4afe54eef
MD5 14f3bb09d74e335326f6ee9211fee6a6
SHA1 ebcbeb8de836bfc9b76e5efa872bd2683d61dff2
SHA512 edf123cb2b1f82e5e98342762fa0f6838f348bde63dc470cbb23aae0f168c83affd6542a8f73f32ac0a40aebc46565f148a10110fef49358d3f416c4a7d09fdd
SSDEEP 384:b8k5NCDdARrnTYIf1mLzGf3EkCesulaPcqyGEmHN4g5pH4TZs+Bk9pLJDG8CE1Sk:b8kuDdHIaMlaPLcsh9pL4ASD/wf
TLSH
T1B5C2EC227BC1DD604AFD8F8F1C53A54E9C5C058FA407A2CEB5DA85234FB2D6064B35EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AbCore.pt-PT.lang

Path C:\Program Files (x86)\Tagman\lang\AbCore.pt-PT.lang
Size 12KB
SHA256 a5d1d2757074b8f811939910a12a123dc673d7b74fd2adba10c18d82518412e6
MD5 0462abe2a9384630b4f004a8e1f565a3
SHA1 0d6510919a0f6a6128f5c87244f80e4fd0990842
SHA512 d208bf82c3e7cc9fedd1d0f7a1a21de523d04f2fd3f256b26a20f87b05159f054e3e5b93b739483064726259a55a757884e5569fc2f6440c8f779200c0551d7f
SSDEEP 192:FWSI9LABlIe0//AxXOpo7RNZuvTpHWO0f:oSI9LAByBHe7RNTzf
TLSH
T132426B26BA82CD114FF96E4F7A03A80DAE5D145FC1066ACBB5C51CA60EFAC3091B35D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AbCore.ru.lang

Path C:\Program Files (x86)\Tagman\lang\AbCore.ru.lang
Size 29KB
SHA256 eeab30a5b4328f1c397e3eb356047702814bdf5464cc59e0df52753a0eea4ba0
MD5 fb201a4174745509621c2178ce3fe262
SHA1 8c8f4323cb5ea083341561e0b071908d4e08e331
SHA512 e4657fede92d7b5c6463f9781d891dca10fdeddd6c1eb47ff7ec312ab662ae1784a23fc3084f74d3ac53e97c7f6b0aa5803fc01bf7c5143c63d2be7681dfc060
SSDEEP 768:ZBZu6qRh9LXdAIK1XVCzteosNDxTDZOJSSoyvLXDf:ZBZu6qXdX1YCzt0sSCvLXr
TLSH
T1E7D2CD21669A985907B4B91FFC06B90D7D9A04BFEB17138635D01C7B3EF6830827B19B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AbCore.sl.lang

Path C:\Program Files (x86)\Tagman\lang\AbCore.sl.lang
Size 22KB
SHA256 918b76040f91322787021698ff953f57bf2fa9271784850f71f7d8c4c8e260ec
MD5 b1f37b8af57021499323a81c8f51c6df
SHA1 5f3bc3bf281e4fc52780d462ed326d636c9fe229
SHA512 2b6f81ebc84a890cec76261369152cb576746b9b7a586e12ca7cc61ad3b8720fb797271e12321d3d8061f598892054fb5b2776c31b89ef8026d43e3351f75f6d
SSDEEP 384:YgyUATy1P/JvCXo+1U9RxNVlqJzBITkl/L+Hef:xyUAG1P/oX9WRTVwB6kBLhf
TLSH
T1D1A2E132BAD2CD114BF9AE4FB903950C6E5C044FC603169BB4C919A64EBBC3191B71D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cs-cz.lang

Path C:\Program Files (x86)\Tagman\lang\cs-cz.lang
Size 17KB
SHA256 72ac4fdf5d5f52c030161879c39257b58196cb7567fcbba93da64c40ab13ec3d
MD5 9aeff3276548994c30fb2c956d0ef3c6
SHA1 8c237caeb5ba174d5b083b9f2c5fa55537daebc8
SHA512 e8e9a84e8f50d081e9597866ebd1c0eb8928a3d6e19c3e184f098ff51eec3e6f87620338dc1139e21fbce5ec333141d7e92e65c479547bd69222d0a1f2265c9d
SSDEEP 384:2CKxY8FaOQmUY5xNOoKtOfnGjX/zu3uug4vk/hsrGkjOkyoWIctCf:X8FaY5xktlrY1Xk/hsrGkjOErcCf
TLSH
T14782A83BBAA1DC244AFD8F4F1D63A40C9C5D06DF911B62D938C608271E73D3968B359A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

de.lang

Path C:\Program Files (x86)\Tagman\lang\de.lang
Size 25KB
SHA256 1e5628e2afd02275140c6270684f66d468b2bdb5638452bf3cc3cf9ce16934f3
MD5 2bb42692e053b784dae9da6254b9ed99
SHA1 0e0c9e937abb597f8a26eb676b1271fe62ba5e6f
SHA512 d8e5d76b7a06ea380c37c4ff6e6db2249efa8910c11a99ad6ac6f9ae558166539597842ee2f70b949dadad18c78331ae0aeefff65fe314568234090e75a935a1
SSDEEP 384:B16ImH89zsnXhoPppOavZJb8qcLIN9iMDSELiUvk25ZsGh2bh4TLUpAsf:B13mHwsXhoPOwncLIVDSELTv5I5Vf
TLSH
T1D0C2C722BA95DD148BFD9F4F5903A82EA91CA1DF9257328C75C980330F77C7158BB09A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.lang

Path C:\Program Files (x86)\Tagman\lang\default.lang
Size 23KB
SHA256 38ad903316dcf1c74e377ecb04d35f49f1e0a953bbea3d9de85fefbd9eb103f6
MD5 329c0481dbb274c8fb05bd66f1edcd92
SHA1 dc008293c26ccc75cfea2e0de740c47d143b341c
SHA512 f27d3055c1e49fbdf6d863ea3d8a84eb36f9becb701a983c0bceed87f393e0f774c3f096c34614a95044e0cdb43f18d20436afc65c9f71260fd9f37283de9ec4
SSDEEP 384:G1hznrN/Aub3EUa6zUTc3/7wfXBVygZpaMcRpnbNmGJef:G1hz5/AoP/8XBV9Zpar3QUef
TLSH
T1D4B2A723BB91CD264AFD8F8F6D17644C9A1D019F8223628C74C8182A1F77DB561F35EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

es-ES.lang

Path C:\Program Files (x86)\Tagman\lang\es-ES.lang
Size 25KB
SHA256 7f307d52b57a3b211ab38f065e1a0f3b24684d7385ab06130ef735015c732bdd
MD5 d224132de844f4f2be5cdb44852ba586
SHA1 a15f1262ea8273b9604e4323f6109ce565e3eff7
SHA512 6256c1c2c8ca7589a26c9ba9d8c03758e787eb4300af0df7df19be2b09bfb34a16a6d4f7a860d35b0b56e8733382fe587cfbe172a2ca0cd08a9701085bf5d69c
SSDEEP 384:7ikitvW/Z/sNND3bqFNudM90mE4q28HaD3VSnOGp3D0fpe4H+xGmqbcfrFB8FRH9:7ikSAZ/sGFNuOYHaEUGqbcfrSlLXf
TLSH
T182C2AA227AC0DD518AF98F4F9943E00EC84C448FA41792CD75C946371FBAD7869F3A9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fr.lang

Path C:\Program Files (x86)\Tagman\lang\fr.lang
Size 26KB
SHA256 c5d44518d1498f343056ab89442d7d686ab9f8768fcf6a98bdae25b34e614d00
MD5 299404dc101dba33be301838777e0b8c
SHA1 0d4f468641b00f9f7017e29968bebb67f0770b30
SHA512 5cb43121f78bded01ea7638c350c8f4b9ab56e3f75e2cee3f04cc6fe886ae058ee0c0f8dcd1840711cdc3cb3bc0a458a10c85085f27d59e70ccc0c5694979e30
SSDEEP 768:EzDMnoKnQ0rt3yD7tDpeL+f2ObQpvG8KOCerff:QAnoAQ0rENN44bQpTtH
TLSH
T11FC2BA26BAC0DC024AF98F4F6D13B41E9D2C418F9016B29875C6152B1FB7CB860F75EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hu-hu.lang

Path C:\Program Files (x86)\Tagman\lang\hu-hu.lang
Size 23KB
SHA256 735f241390b15b6948122290cd3da790406cae3ce8651da852b45437692eac59
MD5 060657b3ab7af2e9dbcba52ee01207c4
SHA1 3f164ecb03f3e1d4f4b0121a2a9fdf81fcc1ccda
SHA512 71180104bef0fcb1343e3b0ad95ce8744402a1cd0b3a375cfb43cf297a5500914648b6941e69b420ef9043ac67979825a1bda175a2a878c9c8157c03431342ba
SSDEEP 384:w42iFJlJXLojHhOOVNwHzmBJdOG3/T4lZNBaMPFLHiJ0LwDF+DJz56WKMg1EXtQu:w4ZX8jHHlLoE/TYZNBa30L20DBog9Jf
TLSH
T1AFB2D8327AA1DC019AFD8F4F4D13650C9D2D429F90572AEA34D1587B0E76E7468B30AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

it.lang

Path C:\Program Files (x86)\Tagman\lang\it.lang
Size 22KB
SHA256 e27bfae99ccaf7f61475e05632e1bdf3b1efababd5d21287a0e45b30472c3985
MD5 4101ce2a8d09f54e8a84924359e10fbd
SHA1 e49c3b54e83c3e353e0ef5116667f017bff00d70
SHA512 e2bb36274743874bcaa6866aae515866ead540dd3823cd73255996d0c02f1aeda9e296ac23e9d8a223274f5c87daa03cee7b6843ba6647069b2c26caab820fe1
SSDEEP 384:SE2cME6wx4Dhg1DyD97aIsM/R026FA8GbOgGmia13f:v2PE6hDVZ7acIFA8OO43f
TLSH
T14FA283327A81DC149AFE8F8F8923B04C985D58CFA61621DC35D6052B1FBBD6034FB59A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb-NO.lang

Path C:\Program Files (x86)\Tagman\lang\nb-NO.lang
Size 24KB
SHA256 c4d3ed3a159fb2238c1e64d1cf86efbb9a035801f46cf075d280c03e434da236
MD5 b398aa99d034ea4a6dd239c47d3e2ddf
SHA1 7894775ee245aa555e0cc15f06d079ad5d00f508
SHA512 fa331724d824633e5cc5462aac85cef76aa63dd52fa646c438fb2e3d083bffecaaaa6d6da2ec5e43860ab7115699ad7fb9c743e555107be7ffbeb53a975d15db
SSDEEP 384:DD2vuh81iCwDvY5vBWFrjWpEv8eaJjcbqt6OLcEIhvuf:O2h85WvY5vwFLv8eahcbqtZdGvuf
TLSH
T102B29222BAD1ED199BFC8F4F5923A41D992E05AFC01266DD35C4843B1EB3D7420F729A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nl-NL.lang

Path C:\Program Files (x86)\Tagman\lang\nl-NL.lang
Size 23KB
SHA256 b7476e5cd1226f85fa54ba9ac367ef0f4e9e99eab5c0968866a7717dafedf3ec
MD5 760a931f28ce69d56da39628da3562fd
SHA1 707e7f0e4a0c42bca9edd3c3f1091d977d7bee21
SHA512 00ab21e6c3da9e21afbfbdedddbfa540918e593d09841633efc54668a9ad53fef7b38f7f8d261aa4d8e25ae0c4844d2dbb16b79965aa25f1851877c8e69c9504
SSDEEP 384:0xnYhZRtlGSzYvEmvbDirLmrqPfkkk7ibyc5q1beYf:2YhZ5GSzYvEmv/iNq7ay4qgYf
TLSH
T11AB295227EC4DC294AFD9F8F9D03601EA92D818F811AA6DC74D994371E73E6424F70DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pl.lang

Path C:\Program Files (x86)\Tagman\lang\pl.lang
Size 23KB
SHA256 f8a27a946ad2c15011ef63e79d2a5bbedb80c07dbcd63c788f25a09344305a1e
MD5 037cf3a5c440c9b74e551f4578ccf8a9
SHA1 d478f9cc8f352fb60d7f7f5eb0cf59122d4eea08
SHA512 480a43c593716a747bfe944f15d42929588aecf25956340afbed0a04bd2dec673a31a6850f25d3e131daea3f7d3c2986e22a60cf3af579d6894aa3c2041cce7a
SSDEEP 384:UbPdhl5+f4cc9oIKiFXaJ1IrQzamh4lN6jX8c1A4Wpl1pFaSPGf:UaQcc5paJWmFjX8c1QlpGf
TLSH
T1BDB2A722BAD2CC188EFD8E8F9C53A80C9DAC048FD11662CD74DA14271F77D6925B74DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pt-BR.lang

Path C:\Program Files (x86)\Tagman\lang\pt-BR.lang
Size 26KB
SHA256 7c6db1f0f6707faf7fbdb107e613ca852370529164c1e547dd94a67d6f288d0a
MD5 ec94e3ed0fff242cd5e84f76ef2a8ed7
SHA1 1fab578bc529ad3f7f98467ebc2760ffd9f8244c
SHA512 222938210260ea43425ec2ab921168df4b52090e09797687fab81c11566e24bd24f09e8e0945cebc5a6cf61c7af91f7e6606e935f0de1b096996fa18d6a0e0f2
SSDEEP 384:w7WkRDdASJVCTYIf1mLl9KfzL+Cb7UOg+3Yw9mmHMRZX+eZYqtPsUNwkVAjUqHmg:w7FDdnvIcs9rg8seQPnNwcifHf
TLSH
T1E5C2EB227AC1DD604AFE8F8F1C53A54E9C5C058FA00792CDB5DA85334FB6D6064B36EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

se.lang

Path C:\Program Files (x86)\Tagman\lang\se.lang
Size 19KB
SHA256 bd845cacab51e1a4d2a6d49011b3d209a977b7a722d55d88b0037f270c5541b3
MD5 078bd7eef67bb4f7949fca68cc222fe8
SHA1 e9dea7a3eafe0c8a75d094c2358f6ec04aa06694
SHA512 7d7289b6785044c42bb215a3e8909ac2094f4ae7d3874e0851a9d7319f8c55b6415f871c63259de50d9eac2daa21ef291a1aa7769e9e8fef7ffb8813f4ba3913
SSDEEP 384:/elpoBTwcANrDeMf/AWzJ5EKgdDYQ0VBZU2z/BzrzVzmzSKO10wSf:jBTa1fqKgdDYQ0TW2z/BzrzVzmz21zSf
TLSH
T13092A222BEA0DC156BFD8E4F5D23650D999D8AEF8153628830C5483B4F77D6028FB19E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

log4net.dll

Path C:\Program Files (x86)\Tagman\log4net.dll
Size 249KB
SHA256 ecf234bac4f8460ff8b8e568c7a52bf7efb7fd49018f99d5c94a6d38bcf82e54
MD5 9df75b9e39e0b648bb0e8a32a62ab5f5
SHA1 b954de60edfd9028b0496d191746f2066b88a08f
SHA512 f98a88fe41e5a688b88cfec1aef730c9ee4ffc9c377c138dced1a0b4c9217783be1d1887f358b80ee0cb2c1a1f3f4ae1d33d8824e6f13573e93b8a8c32482913
SSDEEP 3072:QGvQvyUvWiGu5H2kujT/asQ3RY78WSE4Vp5LJyOTjsumwVZpITt7sB9YHBPSV3qe:Q1vyUfGukTys9JS3z5VtpPgACblWL
TLSH
T19444E41137F8165AF2FF5BB9B935482186B9FD4678BEC74E588590AD0C33B8089603B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tagman.settings.xml

Path C:\Users\Admin\AppData\Local\Abelssoft\Tagman\Tagman.settings.xml
Size 1KB
SHA256 eca73270643f36a9c8f87cdf34bdbd46ff0b425fcc3dbbf15bd8e7dc52de2b1c
MD5 241f171a5f389dbc564558963a4977a1
SHA1 3c0c7a8148dfc0fd52a2afe77352b0f7b48aa6f7
SHA512 c1964494b3e6824c65b4a804e95c472745925b63bc8f5559a4cb179424c83fa461230579b158fd7efa30b8ce3a8e309204a463a021987cb7f7438fca687ff068
TLSH
T168118F1882D5B72C173A5B05F5B6DA1DCA50A1A3D4D40C737E99669FBB7D09203CBE02
MD5 SHA1 SHA512 TLSH

Submit Download

Tagman.settings.xml

Path C:\Users\Admin\AppData\Local\Abelssoft\Tagman\Tagman.settings.xml
Size 2KB
SHA256 2987a93d942546387402ba6138a1dfd1f33c959027d3a85a95a98b885f8f4896
MD5 1098b9733a814335df74d62d86fb7cd4
SHA1 4db5fd47326da31a5d635a668a20ef70d5fe3361
SHA512 897eef09a829630d3b75e989c6823cf8da463458d98fa0f643633a58f7d19f77478fccdb48d586f69d90583cc08869e0485d12e5100dee58fc7d9efbb7ed277e
TLSH
T188415E1882C8B32C173A1A45F1A6DA6DCE9090A7D4940C737F94669FBF7A19203CBE03
MD5 SHA1 SHA512 TLSH

Submit Download

tagmansetup.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\tagmansetup.exe
Size 31.4MB
SHA256 f930b5bd95b477a424267388b54de9820f02c7e1a5f4a5b111ccd0d17b7d5d69
MD5 52cee0f54ddf6b5f3301384ebfcd8ff0
SHA1 4d1f7fab67dc7daee7efc6c7969ade8086fc2e0a
SHA512 932cf4db85357faefa107297d58e3a8f9dbb9b7e98e890b7a03f116d9d0f2afcb58136248cf1bd3e89bb1c56c37199fdfd385dc4c68a5be16f72562ba4952d3a
SSDEEP 786432:PVkeehiiICQWWtq40Lrf2XVwx7S7YgoRrA+sAN:6eehih/Y44T2KA+NN
TLSH
T12A773303D870A17ED728D73699636885EA903EA175B2E23E30155D9A3B3EF4F530C5B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tagmansetup.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-HOBFE.tmp\tagmansetup.tmp
Size 799KB
SHA256 3c0f94d3f888b7cc90e94749b2141ee943e8366b566580e85b1ccc786871385e
MD5 d8fa17d1ae8d39d95826b8997dfb92db
SHA1 4f7852ee87924fefd84fc03447b0bbf81a3c532b
SHA512 9311e6bee7e864496a20560cf42a0a4d0d2a7dfb7acb48a72dd55e2ce5149ffc9211d718a6b211b5b2710a40920464fec37bbc9da6a15a40565f462b34fcced2
SSDEEP 24576:AIZg+uiirPO37fzH4A6haDbcUZEbdT9TaWwtQ2r+A0yx9xL:AgqrPO37fzH4A6ha3cJ2r+A9D
TLSH
T17E058D32F2A0C837D1732E789D1B82955936FD113F38A5A736E91F0C4E796817A272D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

closeapp.exe

Path C:\Users\Admin\AppData\Local\Temp\is-T1HAE.tmp\closeapp.exe
Size 227KB
SHA256 40e33b4ded6db4e96b7ba89770b248d62ffd5f9175e2e0b58692084ce3b91a10
MD5 9a2bbf4de6279c9321969c6257f48939
SHA1 4fdf355fa10fbd61c1d4c47e21e66b09493a1621
SHA512 3afd50668327f518e0d5dfe8200f43ee29cdf8dea8667e31131005e1d0e67acb96f4c218b2ab1f7a3ee926bf600b57b046b5c21ba40de779acc03d130087a4cc
SSDEEP 1536:3tqUEsMsoOJvX+0o/6fmznbtTRIXvOzyJgCxvGO4pCOqUCiroHc/A2eDpJ5u:LddJvX+00hCOzyJgeGOrOqUCix2DpTu
TLSH
T117341A13319AB1A8F9330FF62D0D8C9106027DBD5162915D3FDB776B98E1AA2853B393
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

isxdl.dll

Path C:\Users\Admin\AppData\Local\Temp\is-T1HAE.tmp\isxdl.dll
Size 121KB
SHA256 b0cc4697b2fd1b4163fddca2050fc62a9e7d221864f1bd11e739144c90b685b3
MD5 48ad1a1c893ce7bf456277a0a085ed01
SHA1 803997ef17eedf50969115c529a2bf8de585dc91
SHA512 7c9e7fe9f00c62cccb5921cb55ba0dd96a0077ad52962473c1e79cda1fd9aa101129637043955703121443e1f8b6b2860cd4dfdb71052b20a322e05deed101a4
SSDEEP 1536:dohlISko4eZHOMazWpdYoEWSekaDnXUq5o5dInL:dkIM4ehDaqEpMXUq5o5dIL
TLSH
T18FC36B317350D433C06B193A191A87BA637FBA3195B5984B7B840FBE6F30691DA3631B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SEGOEWP-BLACK_0.TTF

Path C:\WINDOWS\FONTS\SEGOEWP-BLACK_0.TTF
Size 46KB
SHA256 b89b913075552fe0a29d07de7d23ab5f91ca4997caa46b374ae158212e1c0bb8
MD5 8ca1f41561e2bf9bb166e8e1161d8b86
SHA1 fbc3cd94761c653bdfb0e9d3d9df8b902ce1cf3a
SHA512 88722c99f2ee3d7ff98daabee920c42483d552baf2de44a8d5c5d6091d7377dbe7f289e43d3e3f825e5de166300aa61cb4520c80ce5a85973080bb78a5cfbfec
SSDEEP 768:PRoqqqCPVOKycNBEQSm105k/sDGBNW3xZHz0vmZMYY7fDzlAZb/p+JCpaARftpDv:5oqqqoycNBtf0zDGqHhEfvwb/JBRrdp
TLSH
T1B3235D6857925B98C2A379BCD0A9C2845FB6BE326B61C32F610DD67379015C0E8CD7EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SEGOEWP-BOLD_0.TTF

Path C:\WINDOWS\FONTS\SEGOEWP-BOLD_0.TTF
Size 32KB
SHA256 3f5f46e470284c99971628ab410ec4b92337dbfc78db7ceda2414cd778c95b6d
MD5 440caf490856cd379f1418612b465881
SHA1 ec77b5633d1788f03544f17d56bc53edc7771f94
SHA512 9d97ec2a35ff9a92aabe81afa3171e05d10baf6a8ffcdbcfb6028daed00fcd6e5ad3dbd8c42317dd09eb61a431645289b5c22b0958da38db04bc121271a91ea7
SSDEEP 768:Yjm+hktsoAcLzwL6pZTf4vWpHcMBTOBOSBM:ofo7sEZ894
TLSH
T193E24C1AE3ABC709D06A25F9C864D3C21737BE22BD2AC30F75CDDF7A99015A39944790
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SEGOEWP-LIGHT_0.TTF

Path C:\WINDOWS\FONTS\SEGOEWP-LIGHT_0.TTF
Size 35KB
SHA256 ac2fd6bb99e8a02bb971fa8d26a2f3a6001622c3a8631b4906bd6df3eedfe172
MD5 5d8773d71aacc48eef1a312cc0291ad7
SHA1 098dc647df538d28dde58e3437f58807127561e0
SHA512 29077621650d17cd58cb13df95c57b7774f5e6bf8bc5f52a279245fcf5b49f71fa84534f0b02a763c88e0f7a1d4a42c3f906c243c466383166aacaa73525d41d
SSDEEP 768:emXKYHZWQLLvenaELdRS2v2+tkJIy0i0zVB0WBdXHXwsBuSA7094haP36bxM:HXarJRS2v2mg0i8B0WbHXbBuSes4haPN
TLSH
T138F25B55C3B7EB08E1A334BC986593D15777FE38AD22C31B699D8B37AA02550CC88B58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SEGOEWP-SEMIBOLD_0.TTF

Path C:\WINDOWS\FONTS\SEGOEWP-SEMIBOLD_0.TTF
Size 47KB
SHA256 f35cabd7e2ca8d38154e9c2dcc11cedd7258d023a5d8f6bbe5f4b014f1271231
MD5 ca4c5e1ddcd24bb157b003652e18cc91
SHA1 da3905d62a4d16c846d68275546afc9dff0b4d85
SHA512 b618a3262e8c68dd96acfda3a88bd588321159a06bbb40d7ac830e8514f09038c95b6431a8b3a0f4ded169d76197c4959e19259a2964a03fe252fe2fd1e93c3a
SSDEEP 768:00ITLGJysgWNJJ13TGxP7vciltK5acnG7L+W4QAuQV+pZme3drBtdMddxw4g5yia:hI3ol1jGxwilI+NAuE8n9BtdiPwtC
TLSH
T1DA235B0D8357878EE02726FE8C1D6332099E7C576B56831B2ACC4B1BE44716CF795ACA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1452-36-0x0000000000400000-0x00000000004D7000-memory.dmp

Download

memory/1452-211-0x0000000000400000-0x00000000004D7000-memory.dmp

Download

memory/1452-35-0x0000000000400000-0x00000000004D7000-memory.dmp

Download

memory/1452-216-0x0000000000400000-0x00000000004D7000-memory.dmp

Download

memory/1452-38-0x0000000000400000-0x00000000004D7000-memory.dmp

Download

memory/1452-21-0x0000000000400000-0x00000000004D7000-memory.dmp

Download

memory/1452-22-0x0000000000400000-0x00000000004D7000-memory.dmp

Download

memory/1836-33-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2304-324-0x0000000005400000-0x0000000005492000-memory.dmp

Download

memory/2304-307-0x0000000000D60000-0x0000000000E54000-memory.dmp

Download

memory/2304-320-0x0000000000D60000-0x0000000000E54000-memory.dmp

Download

memory/2304-312-0x0000000000D60000-0x0000000000E54000-memory.dmp

Download

memory/2304-323-0x00000000059B0000-0x0000000005F54000-memory.dmp

Download

memory/2304-326-0x00000000055B0000-0x00000000055BA000-memory.dmp

Download

memory/2304-325-0x0000000005350000-0x0000000005384000-memory.dmp

Download

memory/2304-310-0x0000000000E60000-0x0000000000E61000-memory.dmp

Download

memory/4868-223-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/4868-34-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/4868-15-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/4868-14-0x000000000040E000-0x000000000040F000-memory.dmp

Download

memory/5060-238-0x000002095EA00000-0x000002095EB60000-memory.dmp

Download

memory/5060-331-0x000002095F320000-0x000002095F33C000-memory.dmp

Download

memory/5060-285-0x000002095E870000-0x000002095E882000-memory.dmp

Download

memory/5060-314-0x000002095E9D0000-0x000002095E9F4000-memory.dmp

Download

memory/5060-284-0x0000020944D80000-0x0000020944D8A000-memory.dmp

Download

memory/5060-282-0x000002095E7D0000-0x000002095E7E2000-memory.dmp

Download

memory/5060-317-0x000002095F0A0000-0x000002095F120000-memory.dmp

Download

memory/5060-244-0x0000020944D70000-0x0000020944D7C000-memory.dmp

Download

memory/5060-246-0x000002095E8A0000-0x000002095E8DE000-memory.dmp

Download

memory/5060-242-0x000002095D4B0000-0x000002095D4C2000-memory.dmp

Download

memory/5060-321-0x000002095F050000-0x000002095F072000-memory.dmp

Download

memory/5060-322-0x000002095F020000-0x000002095F040000-memory.dmp

Download

memory/5060-240-0x000002095E820000-0x000002095E86C000-memory.dmp

Download

memory/5060-289-0x000002095E810000-0x000002095E820000-memory.dmp

Download

memory/5060-297-0x000002095E940000-0x000002095E952000-memory.dmp

Download

memory/5060-202-0x00000209433B0000-0x00000209433C4000-memory.dmp

Download

memory/5060-206-0x00000209433D0000-0x00000209433DE000-memory.dmp

Download

memory/5060-330-0x000002095E9C0000-0x000002095E9CE000-memory.dmp

Download

memory/5060-329-0x000002095F360000-0x000002095F398000-memory.dmp

Download

memory/5060-328-0x000002095E9B0000-0x000002095E9B8000-memory.dmp

Download

memory/5060-204-0x0000020943580000-0x000002094359E000-memory.dmp

Download

memory/5060-333-0x000002095F080000-0x000002095F08C000-memory.dmp

Download

memory/5060-327-0x000002095E9A0000-0x000002095E9A8000-memory.dmp

Download

memory/5060-208-0x000002095D470000-0x000002095D4A6000-memory.dmp

Download

memory/5060-200-0x0000020942D90000-0x000002094300C000-memory.dmp

Download

memory/5060-299-0x000002095EEA0000-0x000002095EEDE000-memory.dmp

Download

memory/5060-286-0x000002095E960000-0x000002095E99C000-memory.dmp

Download

memory/5060-305-0x000002095EEE0000-0x000002095EF14000-memory.dmp

Download

memory/5060-352-0x0000020964C50000-0x0000020964C58000-memory.dmp

Download

memory/5060-353-0x000002095E160000-0x000002095E2AE000-memory.dmp

Download