Analysis
- max time kernel
150s - max time network
155s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
28/07/2026, 05:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
27 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
25 signatures
150 seconds
General
- Target 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe
- Size 13.5MB
- Sample260728-gl1pyacj5x
- SHA256 e245c3895c6d73ce482c3dcfe8bc72a814d404259300cc998320700978ea7a73
- MD5 2d6970e43026460604924f2bbf66ecd8
- SHA1 977b1aa078f26dc283fb78586c33d0dddfe102f0
- SHA512 d34f1b158e5fd186ec30226b5075edeeb562bcf08fd3398234b734911754f49433f1992bf9872512a246b012b2ca6773ce47b69d6f32d61be272558b30812635
- SSDEEP 393216:BO5xsSLhyiJ4YyjRBdAa36vQfPFavGQRU7c3OnnSkg:BnSJM7HPCRU7c38Skg
- TLSH T17CE6232177E4C076E2B307301E3AD3B9567ABC619E31815FA7E45E1E6A31A81D538B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "0" tcmd.exe - Modifies visibility of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" tcmd.exe - Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 3 IoCs
pid Process 2264 MSI556A.tmp 3636 tcmd.exe 4964 TCC.EXE - Loads dropped DLL 39 IoCs
pid Process 4812 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe 368 MsiExec.exe 368 MsiExec.exe 368 MsiExec.exe 3288 MsiExec.exe 3288 MsiExec.exe 3288 MsiExec.exe 3056 MsiExec.exe 4636 MsiExec.exe 4636 MsiExec.exe 4636 MsiExec.exe 4636 MsiExec.exe 620 MsiExec.exe 368 MsiExec.exe 3636 tcmd.exe 368 MsiExec.exe 3636 tcmd.exe 3636 tcmd.exe 3636 tcmd.exe 3636 tcmd.exe 3636 tcmd.exe 3636 tcmd.exe 3636 tcmd.exe 3636 tcmd.exe 3636 tcmd.exe 3636 tcmd.exe 3636 tcmd.exe 4964 TCC.EXE 4964 TCC.EXE 4964 TCC.EXE 4964 TCC.EXE 4964 TCC.EXE 4964 TCC.EXE 4964 TCC.EXE 4964 TCC.EXE 4964 TCC.EXE 4964 TCC.EXE 4964 TCC.EXE 4964 TCC.EXE - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\X: 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\D: 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\G: 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe File opened (read-only) \??\Z: 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe File opened (read-only) \??\N: 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe File opened (read-only) \??\R: 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe File opened (read-only) \??\X: 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\K: 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe File opened (read-only) \??\D: 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe File opened (read-only) \??\I: 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe File opened (read-only) \??\U: 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\O: 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe File opened (read-only) \??\A: 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe File opened (read-only) \??\G: 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe File opened (read-only) \??\Y: 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe File opened (read-only) \??\H: 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe File opened (read-only) \??\J: 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe File opened (read-only) \??\V: 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe File opened (read-only) \??\Y: 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe File opened (read-only) \??\T: 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe File opened (read-only) \??\V: 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\P: 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe File opened (read-only) \??\R: 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe File opened (read-only) \??\S: 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe File opened (read-only) \??\L: 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe File opened (read-only) \??\O: 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe File opened (read-only) \??\Q: 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\M: 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe File opened (read-only) \??\H: 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe File opened (read-only) \??\A: 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe File opened (read-only) \??\N: 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe File opened (read-only) \??\Q: 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe File opened (read-only) \??\T: 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe File opened (read-only) \??\U: 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe File opened (read-only) \??\B: 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe File opened (read-only) \??\K: 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe File opened (read-only) \??\Z: 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe File opened (read-only) \??\J: 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe File opened (read-only) \??\P: 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe File opened (read-only) \??\S: 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe - Drops file in Program Files directory 46 IoCs
description ioc Process File created C:\Program Files (x86)\JPSoft\TCMD14\ipworksssnmp9.dll msiexec.exe File created C:\Program Files (x86)\JPSoft\TCMD14\updater.exe msiexec.exe File created C:\Program Files (x86)\JPSoft\TCMD14\German.dll msiexec.exe File created C:\Program Files (x86)\JPSoft\TCMD14\Italian.dll msiexec.exe File created C:\Program Files (x86)\JPSoft\TCMD14\ItalianD.dll msiexec.exe File created C:\Program Files (x86)\JPSoft\TCMD14\ipworksssl9.dll msiexec.exe File created C:\Program Files (x86)\JPSoft\TCMD14\BorlndMM.dll msiexec.exe File opened for modification C:\Program Files (x86)\JPSoft\TCMD14\updater.ini msiexec.exe File created C:\Program Files (x86)\JPSoft\TCMD14\license.txt msiexec.exe File created C:\Program Files (x86)\JPSoft\TCMD14\onig.dll msiexec.exe File created C:\Program Files (x86)\JPSoft\TCMD14\English.dll msiexec.exe File created C:\Program Files (x86)\JPSoft\TCMD14\IsLicense50.dll msiexec.exe File created C:\Program Files (x86)\JPSoft\TCMD14\readme.txt msiexec.exe File created C:\Program Files (x86)\JPSoft\TCMD14\RussianD.dll msiexec.exe File created C:\Program Files (x86)\JPSoft\TCMD14\tcchere.btm msiexec.exe File created C:\Program Files (x86)\JPSoft\TCMD14\tcctabhere.btm msiexec.exe File created C:\Program Files (x86)\JPSoft\TCMD14\takecmd.dll msiexec.exe File created C:\Program Files (x86)\JPSoft\TCMD14\tcmdhere.btm msiexec.exe File created C:\Program Files (x86)\JPSoft\TCMD14\tcmd.chm msiexec.exe File created C:\Program Files (x86)\JPSoft\TCMD14\v.exe msiexec.exe File created C:\Program Files (x86)\JPSoft\TCMD14\ipworksssh9.dll msiexec.exe File created C:\Program Files (x86)\JPSoft\TCMD14\TPipe.exe msiexec.exe File created C:\Program Files (x86)\JPSoft\TCMD14\tcmd.exe msiexec.exe File created C:\Program Files (x86)\JPSoft\TCMD14\ide.exe msiexec.exe File created C:\Program Files (x86)\JPSoft\TCMD14\ShrAlias.exe msiexec.exe File created C:\Program Files (x86)\JPSoft\TCMD14\SpanishD.dll msiexec.exe File created C:\Program Files (x86)\JPSoft\TCMD14\WiFiMan.dll msiexec.exe File created C:\Program Files (x86)\JPSoft\TCMD14\textpipeengine.dll msiexec.exe File created C:\Program Files (x86)\JPSoft\TCMD14\v.chm msiexec.exe File created C:\Program Files (x86)\JPSoft\TCMD14\VESP.dll msiexec.exe File created C:\Program Files (x86)\JPSoft\TCMD14\EnglishD.dll msiexec.exe File created C:\Program Files (x86)\JPSoft\TCMD14\GermanD.dll msiexec.exe File created C:\Program Files (x86)\JPSoft\TCMD14\Russian.dll msiexec.exe File created C:\Program Files (x86)\JPSoft\TCMD14\tcmdbatch.btm msiexec.exe File created C:\Program Files (x86)\JPSoft\TCMD14\ipworkszip9.dll msiexec.exe File created C:\Program Files (x86)\JPSoft\TCMD14\FrenchD.dll msiexec.exe File created C:\Program Files (x86)\JPSoft\TCMD14\SciLexer.dll msiexec.exe File created C:\Program Files (x86)\JPSoft\TCMD14\Spanish.dll msiexec.exe File created C:\Program Files (x86)\JPSoft\TCMD14\tccbatch.btm msiexec.exe File created C:\Program Files (x86)\JPSoft\TCMD14\VFRA.dll msiexec.exe File created C:\Program Files (x86)\JPSoft\TCMD14\VITA.dll msiexec.exe File created C:\Program Files (x86)\JPSoft\TCMD14\VRUS.dll msiexec.exe File created C:\Program Files (x86)\JPSoft\TCMD14\French.dll msiexec.exe File created C:\Program Files (x86)\JPSoft\TCMD14\tcc.exe msiexec.exe File created C:\Program Files (x86)\JPSoft\TCMD14\ipworks9.dll msiexec.exe File created C:\Program Files (x86)\JPSoft\TCMD14\stdvcl40.dll msiexec.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3944_625359289\_locales\tr\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3944_625359289\_locales\ml\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3944_625359289\_locales\pt_BR\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3944_625359289\_locales\ca\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3944_625359289\_locales\lt\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3944_625359289\_locales\ta\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3944_625359289\page_embed_script.js msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3944_625359289\_locales\fr_CA\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3944_625359289\_locales\lv\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3944_625359289\_locales\zh_TW\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3944_625359289\offscreendocument.html msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3944_625359289\manifest.json msedge.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3944_625359289\_locales\mr\messages.json msedge.exe File created C:\Windows\Installer\{3B6CA0C4-8FAB-4B69-8169-0963C264BD79}\tcmd.exe msiexec.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3944_625359289\_locales\pa\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3944_625359289\_locales\lo\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3944_625359289\_locales\hr\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3944_625359289\_locales\te\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3944_625359289\_locales\zh_CN\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3944_658827112\manifest.json msedge.exe File opened for modification C:\Windows\Installer\MSI4818.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF1BB627B6F32699A0.TMP msiexec.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3944_625359289\_locales\pt_PT\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3944_625359289\_locales\eu\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3944_625359289\_locales\ar\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3944_625359289\_locales\en_US\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3944_625359289\_locales\bg\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3944_625359289\_locales\kn\messages.json msedge.exe File opened for modification C:\Windows\Installer\MSI4AC9.tmp msiexec.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3944_625359289\_locales\en_GB\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3944_625359289\_locales\iw\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3944_625359289\128.png msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3944_625359289\_metadata\verified_contents.json msedge.exe File opened for modification C:\Windows\Installer\e5a41cd.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI46CF.tmp msiexec.exe File created C:\Windows\SystemTemp\msedge_url_fetcher_3944_2105930756\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3944_625359289\_locales\ro\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3944_625359289\_locales\is\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3944_625359289\_locales\af\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3944_625359289\_locales\vi\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3944_625359289\_locales\es_419\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3944_625359289\_locales\sr\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3944_625359289\_locales\ja\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3944_625359289\_locales\fr\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3944_625359289\_locales\cs\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3944_625359289\_locales\fil\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3944_625359289\_locales\id\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3944_625359289\_locales\ms\messages.json msedge.exe File created C:\Windows\Installer\SourceHash{3B6CA0C4-8FAB-4B69-8169-0963C264BD79} msiexec.exe File opened for modification C:\Windows\Installer\MSI556A.tmp msiexec.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3944_625359289\_locales\pl\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3944_625359289\_locales\en\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3944_625359289\_locales\sw\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3944_625359289\_locales\km\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3944_625359289\_locales\uk\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3944_625359289\_locales\mk\messages.json msedge.exe File opened for modification C:\Windows\Installer\MSI44BB.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF18B59BE43B7A7CDB.TMP msiexec.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3944_625359289\_locales\gu\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3944_625359289\_locales\be\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3944_625359289\_locales\hu\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3944_625359289\_locales\th\messages.json msedge.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSI556A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tcmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TCC.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 4436 msedge.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000067831fc6f5c7bf350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380167831fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410167831fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e367831fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e667831fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\DataMystic\TextPipe Engine MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\DataMystic MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\DataMystic\TextPipe Engine MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry msedge.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134296917502415525" msedge.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE MsiExec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A261033C-A5F8-41E6-905C-261AA9DD316C}\ProxyStubClsid32 MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TextPipeEngine.TPscriptInterface MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4C0AC6B3BAF896B4189690362C46DB97\PackageCode = "5CCE540F517D7A0458CA4AA58EB6784D" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IsLicense50.IsLicenseMgr MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3C4ABAB8-F6D3-4BC3-922D-43715A228CC2} MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3C4ABAB8-F6D3-4BC3-922D-43715A228CC2}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E4CF2EF5-6059-467C-84EA-2A4475B6D4EF}\ProxyStubClsid32 MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TextPipeEngine.Application MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BDDB5EBA-DA0E-4398-815C-978DB1CB9C6A}\TypeLib\Version = "1.0" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6997D07B-5EA5-45D5-B1F3-4984AEF877EA}\TypeLib\Version = "1.0" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C48067D1-B25E-43A8-BC49-E016D3482B7B}\1.0\FLAGS\ = "0" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D7C6C53B-C335-417f-ABB8-F5A157F92EA0}\VersionIndependentProgID MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3C4ABAB8-F6D3-4BC3-922D-43715A228CC2}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BDDB5EBA-DA0E-4398-815C-978DB1CB9C6A}\ProxyStubClsid32 MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BDDB5EBA-DA0E-4398-815C-978DB1CB9C6A}\TypeLib MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TextPipeEngine.FilterWindow\ = "FilterWindow Object" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D7C6C53B-C335-417f-ABB8-F5A157F92EA0} MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8D732308-066E-4E85-9D5C-4410EB6BFDBC}\1.0\0\win32 MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3C4ABAB8-F6D3-4BC3-922D-43715A228CC2} MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BDDB5EBA-DA0E-4398-815C-978DB1CB9C6A}\ = "ITPscriptInterface" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CC0DC738-2C95-43D1-A63E-0C882E481BF8}\TypeLib MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CC0DC738-2C95-43D1-A63E-0C882E481BF8}\ProxyStubClsid32 MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CC0DC738-2C95-43D1-A63E-0C882E481BF8}\TypeLib MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A261033C-A5F8-41E6-905C-261AA9DD316C}\TypeLib\ = "{C48067D1-B25E-43A8-BC49-E016D3482B7B}" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C48067D1-B25E-43A8-BC49-E016D3482B7B}\1.0\HELPDIR MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A261033C-A5F8-41E6-905C-261AA9DD316C}\ = "IFilterWindowEvents" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A261033C-A5F8-41E6-905C-261AA9DD316C}\ProxyStubClsid32 MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4626556F-5543-4A12-9E36-D92313D36262}\Version MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F5032B4D-662A-4E3B-AE35-DFF4095EBF8F}\ProgID MsiExec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4C0AC6B3BAF896B4189690362C46DB97\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4C0AC6B3BAF896B4189690362C46DB97\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4C0AC6B3BAF896B4189690362C46DB97\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BDDB5EBA-DA0E-4398-815C-978DB1CB9C6A}\TypeLib\ = "{C48067D1-B25E-43A8-BC49-E016D3482B7B}" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4CF2EF5-6059-467C-84EA-2A4475B6D4EF} MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4CF2EF5-6059-467C-84EA-2A4475B6D4EF}\TypeLib MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A261033C-A5F8-41E6-905C-261AA9DD316C}\TypeLib MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4626556F-5543-4A12-9E36-D92313D36262}\ = "FilterWindow Object" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F5032B4D-662A-4E3B-AE35-DFF4095EBF8F}\InprocServer32 MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F5032B4D-662A-4E3B-AE35-DFF4095EBF8F}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{55887DBE-5359-4223-9245-2A844433B2BF}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D7C6C53B-C335-417f-ABB8-F5A157F92EA0}\InprocServer32\ = "C:\\Program Files (x86)\\JPSoft\\TCMD14\\IsLicense50.dll" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D7C6C53B-C335-417f-ABB8-F5A157F92EA0}\TypeLib\ = "{8D732308-066E-4e85-9D5C-4410EB6BFDBC}" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TextPipeEngine.FilterWindow\Clsid\ = "{4626556F-5543-4A12-9E36-D92313D36262}" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F5032B4D-662A-4E3B-AE35-DFF4095EBF8F}\InprocServer32\ = "C:\\PROGRA~2\\JPSoft\\TCMD14\\TEXTPI~1.DLL" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F5032B4D-662A-4E3B-AE35-DFF4095EBF8F}\Version MsiExec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4C0AC6B3BAF896B4189690362C46DB97\AdvertiseFlags = "388" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\1CDC5EDEDBFF9A140A383CFDF225F905 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4C0AC6B3BAF896B4189690362C46DB97\SourceList\Media\1 = ";" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8D732308-066E-4E85-9D5C-4410EB6BFDBC}\1.0\FLAGS MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8D732308-066E-4E85-9D5C-4410EB6BFDBC}\1.0\0\win32\ = "C:\\Program Files (x86)\\JPSoft\\TCMD14\\IsLicense50.dll" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3C4ABAB8-F6D3-4BC3-922D-43715A228CC2}\TypeLib\ = "{8D732308-066E-4E85-9D5C-4410EB6BFDBC}" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6997D07B-5EA5-45D5-B1F3-4984AEF877EA}\ = "ITPscriptInterfaceEvents" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E4CF2EF5-6059-467C-84EA-2A4475B6D4EF}\TypeLib MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4626556F-5543-4A12-9E36-D92313D36262}\InprocServer32\ = "C:\\PROGRA~2\\JPSoft\\TCMD14\\TEXTPI~1.DLL" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TextPipeEngine.FilterWindow\Clsid MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4626556F-5543-4A12-9E36-D92313D36262}\ProgID MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8D732308-066E-4E85-9D5C-4410EB6BFDBC} MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BDDB5EBA-DA0E-4398-815C-978DB1CB9C6A}\TypeLib MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6997D07B-5EA5-45D5-B1F3-4984AEF877EA}\ProxyStubClsid32 MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6997D07B-5EA5-45D5-B1F3-4984AEF877EA}\TypeLib MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F5032B4D-662A-4E3B-AE35-DFF4095EBF8F}\Version\ = "1.0" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{55887DBE-5359-4223-9245-2A844433B2BF}\ = "Application Object" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{55887DBE-5359-4223-9245-2A844433B2BF}\InprocServer32\ = "C:\\PROGRA~2\\JPSoft\\TCMD14\\TEXTPI~1.DLL" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{55887DBE-5359-4223-9245-2A844433B2BF}\Version\ = "1.0" MsiExec.exe - Modifies system certificate store 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868\Blob = 5900000001000000120000005200530041002f00530048004100310000006b0000000100000020000000687fa451382278fff0c8b11f8d43d576671c6eb2bceab413fb83d965d06d2ff20f000000010000001400000009b9105c5bba24343ca7f341c624e183f6ee7c1b090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b00000001000000260000005300650063007400690067006f00200028004100640064005400720075007300740029000000620000000100000020000000687fa451382278fff0c8b11f8d43d576671c6eb2bceab413fb83d965d06d2ff2140000000100000014000000adbd987a34b426f7fac42654ef03bde024cb541a1d000000010000001000000006f9583c00a763c23fb9e065a3366d557e0000000100000008000000000063f58926d70168000000010000000800000000409120d035d90103000000010000001400000002faf3e291435468607857694df5e45b6885186819000000010000001000000045ed9bbc5e43d3b9ecd63c060db78e5c5c00000001000000040000000008000020000000010000003a040000308204363082031ea003020102020101300d06092a864886f70d0101050500306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74301e170d3030303533303130343833385a170d3230303533303130343833385a306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b7f71a33e6f200042d39e04e5bed1fbc6c0fcdb5fa23b6cede9b113397a4294c7d939fbd4abc93ed031ae38fcfe56d505ad69729945a80b0497adb2e95fdb8cabf37382d1e3e9141ad7056c7f04f3fe8329e74cac89054e9c65f0f789d9a403c0eac61aa5e148f9e87a16a50dcd79a4eaf05b3a671949c71b350600ac7139d38078602a8e9a869261890ab4cb04f23ab3a4f84d8dfce9fe1696fbbd742d76b44e4c7adee6d415f725a710837b37965a459a09437f7002f0dc29272dad03872db14a845c45d2a7db7b4d6c4eeaccd1344b7c92bdd430025fa61b9696a582311b7a7338f567559f5cd29d746b70a2b65b6d3426f15b2b87bfbefe95d53d5345a270203010001a381dc3081d9301d0603551d0e04160414adbd987a34b426f7fac42654ef03bde024cb541a300b0603551d0f040403020106300f0603551d130101ff040530030101ff3081990603551d2304819130818e8014adbd987a34b426f7fac42654ef03bde024cb541aa173a471306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74820101300d06092a864886f70d01010505000382010100b09be08525c2d623e20f9606929d41989cd9847981d91e5b14072336658fb0d877bbac416c47608351b0f9323de7fcf62613c78016a5bf5afc87cf787989219ae24c070a8635bcf2de51c4d296b7dc7e4eee70fd1c39eb0c0251142d8ebd16e0c1df4675e724adecf442b48593701067ba9d06354a18d32b7acc5142a17a63d1e6bba1c52bc236be130de6bd637e797ba7090d40ab6add8f8ac3f6f68c1a420551d445f59fa76221681520433c99e77cbd24d8a9911773883f561b313818b4710f9acdc80e9e8e2e1be18c9883cb1f31f1444cc604734976600fc7f8bd17806b2ee9cc4c0e5a9a790f200a2ed59e63261e559294d882175a7bd0bcc78f4e8604 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3532 msiexec.exe 3532 msiexec.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3636 tcmd.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeCreateTokenPrivilege 4812 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe Token: SeAssignPrimaryTokenPrivilege 4812 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe Token: SeLockMemoryPrivilege 4812 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe Token: SeIncreaseQuotaPrivilege 4812 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe Token: SeMachineAccountPrivilege 4812 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe Token: SeTcbPrivilege 4812 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe Token: SeSecurityPrivilege 4812 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe Token: SeTakeOwnershipPrivilege 4812 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe Token: SeLoadDriverPrivilege 4812 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe Token: SeSystemProfilePrivilege 4812 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe Token: SeSystemtimePrivilege 4812 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe Token: SeProfSingleProcessPrivilege 4812 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe Token: SeIncBasePriorityPrivilege 4812 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe Token: SeCreatePagefilePrivilege 4812 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe Token: SeCreatePermanentPrivilege 4812 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe Token: SeBackupPrivilege 4812 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe Token: SeRestorePrivilege 4812 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe Token: SeShutdownPrivilege 4812 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe Token: SeDebugPrivilege 4812 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe Token: SeAuditPrivilege 4812 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe Token: SeSystemEnvironmentPrivilege 4812 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe Token: SeChangeNotifyPrivilege 4812 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe Token: SeRemoteShutdownPrivilege 4812 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe Token: SeUndockPrivilege 4812 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe Token: SeSyncAgentPrivilege 4812 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe Token: SeEnableDelegationPrivilege 4812 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe Token: SeManageVolumePrivilege 4812 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe Token: SeImpersonatePrivilege 4812 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe Token: SeCreateGlobalPrivilege 4812 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe Token: SeSecurityPrivilege 3532 msiexec.exe Token: SeCreateTokenPrivilege 4812 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe Token: SeAssignPrimaryTokenPrivilege 4812 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe Token: SeLockMemoryPrivilege 4812 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe Token: SeIncreaseQuotaPrivilege 4812 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe Token: SeMachineAccountPrivilege 4812 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe Token: SeTcbPrivilege 4812 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe Token: SeSecurityPrivilege 4812 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe Token: SeTakeOwnershipPrivilege 4812 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe Token: SeLoadDriverPrivilege 4812 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe Token: SeSystemProfilePrivilege 4812 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe Token: SeSystemtimePrivilege 4812 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe Token: SeProfSingleProcessPrivilege 4812 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe Token: SeIncBasePriorityPrivilege 4812 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe Token: SeCreatePagefilePrivilege 4812 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe Token: SeCreatePermanentPrivilege 4812 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe Token: SeBackupPrivilege 4812 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe Token: SeRestorePrivilege 4812 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe Token: SeShutdownPrivilege 4812 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe Token: SeDebugPrivilege 4812 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe Token: SeAuditPrivilege 4812 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe Token: SeSystemEnvironmentPrivilege 4812 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe Token: SeChangeNotifyPrivilege 4812 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe Token: SeRemoteShutdownPrivilege 4812 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe Token: SeUndockPrivilege 4812 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe Token: SeSyncAgentPrivilege 4812 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe Token: SeEnableDelegationPrivilege 4812 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe Token: SeManageVolumePrivilege 4812 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe Token: SeImpersonatePrivilege 4812 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe Token: SeCreateGlobalPrivilege 4812 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe Token: SeCreateTokenPrivilege 1252 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe Token: SeAssignPrimaryTokenPrivilege 1252 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe Token: SeLockMemoryPrivilege 1252 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe Token: SeIncreaseQuotaPrivilege 1252 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe Token: SeMachineAccountPrivilege 1252 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 4812 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe 4812 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe 3944 msedge.exe - Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 3532 msiexec.exe 368 MsiExec.exe 3288 MsiExec.exe 3056 MsiExec.exe 4636 MsiExec.exe 4636 MsiExec.exe 620 MsiExec.exe 3636 tcmd.exe 3636 tcmd.exe 3636 tcmd.exe 3636 tcmd.exe 3636 tcmd.exe - Suspicious use of WriteProcessMemory 55 IoCs
description pid Process procid_target PID 3532 wrote to memory of 368 3532 msiexec.exe 90 PID 4812 wrote to memory of 1252 4812 2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe 92 PID 3532 wrote to memory of 5684 3532 msiexec.exe 97 PID 3532 wrote to memory of 3288 3532 msiexec.exe 99 PID 3532 wrote to memory of 3056 3532 msiexec.exe 100 PID 3532 wrote to memory of 4636 3532 msiexec.exe 101 PID 3532 wrote to memory of 620 3532 msiexec.exe 102 PID 3532 wrote to memory of 2264 3532 msiexec.exe 104 PID 2264 wrote to memory of 3944 2264 MSI556A.tmp 105 PID 3944 wrote to memory of 3000 3944 msedge.exe 106 PID 3944 wrote to memory of 1224 3944 msedge.exe 107 PID 3944 wrote to memory of 4436 3944 msedge.exe 108 PID 3944 wrote to memory of 1224 3944 msedge.exe 107 PID 3944 wrote to memory of 1224 3944 msedge.exe 107 PID 3944 wrote to memory of 4704 3944 msedge.exe 109 PID 3944 wrote to memory of 4704 3944 msedge.exe 109 PID 3944 wrote to memory of 2900 3944 msedge.exe 110 PID 3944 wrote to memory of 2828 3944 msedge.exe 111 PID 3944 wrote to memory of 2900 3944 msedge.exe 110 PID 3944 wrote to memory of 2900 3944 msedge.exe 110 PID 3944 wrote to memory of 2828 3944 msedge.exe 111 PID 3944 wrote to memory of 2828 3944 msedge.exe 111 PID 3944 wrote to memory of 4540 3944 msedge.exe 113 PID 3944 wrote to memory of 4540 3944 msedge.exe 113 PID 3944 wrote to memory of 4540 3944 msedge.exe 113 PID 3944 wrote to memory of 5504 3944 msedge.exe 114 PID 3944 wrote to memory of 5504 3944 msedge.exe 114 PID 3944 wrote to memory of 5504 3944 msedge.exe 114 PID 3944 wrote to memory of 1692 3944 msedge.exe 115 PID 3944 wrote to memory of 1692 3944 msedge.exe 115 PID 3944 wrote to memory of 1980 3944 msedge.exe 116 PID 3944 wrote to memory of 1980 3944 msedge.exe 116 PID 3944 wrote to memory of 1980 3944 msedge.exe 116 PID 3944 wrote to memory of 6044 3944 msedge.exe 117 PID 3944 wrote to memory of 4872 3944 msedge.exe 118 PID 3944 wrote to memory of 6044 3944 msedge.exe 117 PID 3944 wrote to memory of 4872 3944 msedge.exe 118 PID 3944 wrote to memory of 5328 3944 msedge.exe 120 PID 368 wrote to memory of 3636 368 MsiExec.exe 121 PID 3944 wrote to memory of 3340 3944 msedge.exe 124 PID 3944 wrote to memory of 3340 3944 msedge.exe 124 PID 3944 wrote to memory of 2196 3944 msedge.exe 125 PID 3944 wrote to memory of 2196 3944 msedge.exe 125 PID 3944 wrote to memory of 2604 3944 msedge.exe 126 PID 3944 wrote to memory of 2604 3944 msedge.exe 126 PID 3944 wrote to memory of 4852 3944 msedge.exe 133 PID 3944 wrote to memory of 4852 3944 msedge.exe 133 PID 3636 wrote to memory of 4964 3636 tcmd.exe 130 PID 3944 wrote to memory of 1940 3944 msedge.exe 132 PID 3944 wrote to memory of 4852 3944 msedge.exe 133 PID 3944 wrote to memory of 4656 3944 msedge.exe 134 PID 3944 wrote to memory of 3340 3944 msedge.exe 135 PID 3944 wrote to memory of 3340 3944 msedge.exe 135 PID 3944 wrote to memory of 5576 3944 msedge.exe 139 PID 3944 wrote to memory of 5576 3944 msedge.exe 139 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe" /i "C:\Users\Admin\AppData\Roaming\JP Software\Take Command 14.0 14.01.33\install\264BD79\tcmd.msi" EXECUTEACTION="INSTALL" SECONDSEQUENCE="1" CLIENTPROCESSID="4812" ADDLOCAL="MainFeature" ACTION="INSTALL" CLIENTUILEVEL="0" ALLUSERS="1" PRIMARYFOLDER="APPDIR" ROOTDRIVE="C:\" EXE_CMD_LINE="/exenoupdates /exelang 0 /noprereqs " AI_SETUPEXEPATH="C:\Users\Admin\AppData\Local\Temp\2026-07-28_2d6970e43026460604924f2bbf66ecd8_darkgate_elex_rhadamanthys_stop.exe" SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp\" TARGETDIR="C:\" APPDIR="C:\Program Files (x86)\JPSoft\TCMD14\" SHORTCUTDIR="C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TCMD14"2⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1252
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3532 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 31F32DF68DE83422249774CB8C1FBB9B C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:368 -
C:\Program Files (x86)\JPSoft\TCMD14\tcmd.exe"C:\Program Files (x86)\JPSoft\TCMD14\tcmd.exe"3⤵
- Modifies visibility of file extensions in Explorer
- Modifies visibility of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3636 -
C:\Program Files (x86)\JPSoft\TCMD14\TCC.EXE"C:\Program Files (x86)\JPSoft\TCMD14\TCC.EXE"4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4964
-
-
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:5684
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 77A87E147F38C5331CC0B1ED8875016F2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3288
-
-
C:\Windows\syswow64\MsiExec.exe"C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\JPSoft\TCMD14\IsLicense50.dll"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3056
-
-
C:\Windows\syswow64\MsiExec.exe"C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\JPSoft\TCMD14\textpipeengine.dll"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4636
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 0F5C5CDF200368BD05DED3807E99B1CE E Global\MSI00002⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:620
-
-
C:\Windows\Installer\MSI556A.tmp"C:\Windows\Installer\MSI556A.tmp" http://jpsoft.com/on-install-take-command.html2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://jpsoft.com/on-install-take-command.html3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x358,0x7ffd8ae6c188,0x7ffd8ae6c194,0x7ffd8ae6c1a04⤵PID:3000
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1568,i,13478593093787727698,7870476973437228877,262144 --field-trial-handle=1832,i,6067222810939978916,10332768530569919098,262144 --variations-seed-version --mojo-platform-channel-handle=2136 /prefetch:24⤵PID:1224
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1804,i,9119791122129937367,11276465037226134401,524288 --field-trial-handle=1832,i,6067222810939978916,10332768530569919098,262144 --variations-seed-version --mojo-platform-channel-handle=2204 /prefetch:114⤵
- System Time Discovery
PID:4436
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2488,i,8389283220094874740,17639546441262378243,524288 --field-trial-handle=1832,i,6067222810939978916,10332768530569919098,262144 --variations-seed-version --mojo-platform-channel-handle=3144 /prefetch:134⤵PID:4704
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3576,i,4260825425883343257,17773392482046007164,2097152 --field-trial-handle=1832,i,6067222810939978916,10332768530569919098,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:14⤵PID:2900
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3560,i,5307412296526555316,15197463182219537038,2097152 --field-trial-handle=1832,i,6067222810939978916,10332768530569919098,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:14⤵PID:2828
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4316,i,8291105512777853191,15935619279785191249,2097152 --field-trial-handle=1832,i,6067222810939978916,10332768530569919098,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:14⤵PID:4540
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4340,i,5336704962661413281,9037910800298902972,2097152 --field-trial-handle=1832,i,6067222810939978916,10332768530569919098,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:94⤵PID:5504
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3692,i,16779252267134731067,3721287580223960620,524288 --field-trial-handle=1832,i,6067222810939978916,10332768530569919098,262144 --variations-seed-version --mojo-platform-channel-handle=3792 /prefetch:144⤵PID:1692
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5424,i,4452826948271888630,9265495731737637603,2097152 --field-trial-handle=1832,i,6067222810939978916,10332768530569919098,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:14⤵PID:1980
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3592,i,2630398601337895733,13314953207923360902,524288 --field-trial-handle=1832,i,6067222810939978916,10332768530569919098,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:144⤵PID:6044
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3772,i,8041098704673788134,15517137602052622232,524288 --field-trial-handle=1832,i,6067222810939978916,10332768530569919098,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:144⤵PID:4872
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6156,i,5671814717685050215,9865759405062254432,524288 --field-trial-handle=1832,i,6067222810939978916,10332768530569919098,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:144⤵PID:2612
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6156,i,5671814717685050215,9865759405062254432,524288 --field-trial-handle=1832,i,6067222810939978916,10332768530569919098,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:144⤵PID:5328
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6508,i,6355726977648876417,15506752273152670021,524288 --field-trial-handle=1832,i,6067222810939978916,10332768530569919098,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:144⤵PID:3340
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6616,i,6791348835096946251,8838927641122320523,524288 --field-trial-handle=1832,i,6067222810939978916,10332768530569919098,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:144⤵PID:2196
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6852,i,8394704062451782781,6272549554905125011,524288 --field-trial-handle=1832,i,6067222810939978916,10332768530569919098,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:144⤵PID:2604
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6452,i,3101585449188323363,17668866711552617519,524288 --field-trial-handle=1832,i,6067222810939978916,10332768530569919098,262144 --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:144⤵PID:4852
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4336,i,3940714426145703628,1229631697498408193,524288 --field-trial-handle=1832,i,6067222810939978916,10332768530569919098,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:144⤵PID:1940
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3852,i,2223608615904148549,18310290532038448759,524288 --field-trial-handle=1832,i,6067222810939978916,10332768530569919098,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:144⤵PID:4852
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5404,i,15604143991142630437,2519720316884420341,524288 --field-trial-handle=1832,i,6067222810939978916,10332768530569919098,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:144⤵PID:4656
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5688,i,15947249087690612723,4942719868238474102,524288 --field-trial-handle=1832,i,6067222810939978916,10332768530569919098,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:144⤵PID:3340
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,11493316561495653739,15862017040724090136,524288 --field-trial-handle=1832,i,6067222810939978916,10332768530569919098,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:144⤵PID:5576
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:1556
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵PID:624
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵PID:432
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:3048
Network
MITRE ATT&CK Enterprise v16
Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Modify Registry
3Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e5a41ce.rbs
- Size 27KB
- SHA256 3f86ff8bd996c593ac9f4d1dc04ef641a5fd0c3347db05807b338860fb759a38
- MD5 ae5712180c26537511a13f9fc0a253c2
- SHA1 bbc6343a6ca70f6a8c32dfbd483e8d3556470445
- SHA512 4bd4f9f623eb74dfeb80101c8281bb9525dd0e995a206ce264527815649be96b4b4580ca291d2eb0850c6c9c279b8f0ee769f986845519c991aaab30bfa8e4c7
- SSDEEP 384:T5MXikmMIUWue8MCguj4NyvdXhqh7h0/i:T5gZFHs3NyvdX4TCi
- TLSH T155C2E983AA0D82D2E041DF7983817D2A7767AF56E760481F02DE5661CF81FF427AD0B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\JPSoft\TCMD14\updater.ini
- Size 376B
- SHA256 f3c154c7619331b90cc18011192641d2c7907e1920378b02b1bc532e1ce3d3f4
- MD5 f369c480cc9169f2de63d57432188cb8
- SHA1 67cd12513cc1d2d346c6f15dbae5b58a9d2f48e6
- SHA512 f6d314c906dd7cee640630a006fca3a4a5b20d1cd1560397be9d3d93a9e52e16812bd96408672645d6a8f5d7c32a1c2a84f614fa9b78414a9af19ddaf44fe8fa
- TLSH T150E0C08733DDC78AD6D2594343F9644400F29388BFC009B441A83C5DF780C1826AB29B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1F356F4D07FE8C483E769E4586569404
- Size 33KB
- SHA256 3e69adfe8359b04267d05c024df5c2737df740200f643e01d35f16ead08f8cf8
- MD5 ce146374598fdc8164c9a06d7457af6f
- SHA1 d83a4d05a57b15bf503629bdf02403223f1bed88
- SHA512 3cb3943e44407691ffc1eb555233a8e1ae126123d56d219bba3b3dc25dc6488a1df67e4cf4b05a9c965f3b9ca50f38e7cba426fab4fd13f61974ed8a5dbd8e8f
- SSDEEP 768:RenfKYyUZ8PP8LsiRhIyMCfMbVz0t9bj7:RwKTUdK1CfkVzc
- TLSH T131E283A86D7A6C6091CEC1720198775E1E3AF6D622D31909CB397A040602ACF6F7FF17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3B6E683A7A45CC59BF035C9BA8C7AB9D
- Size 546B
- SHA256 5bb269828c26ef79f8824fd4385df89066f3cf6dba105bbf158f7cfd81a6cec2
- MD5 0fbfa4e5a64ae923f9dec1d4050cb16b
- SHA1 a1bdedda3b605a95f96edace8ef5a63d6d5ae653
- SHA512 733da2169018b51598727e4989d9dae91cb1a38ab4355efbb4fbf9e3d18df489daf5bd70388eeec95e320bd050ffaf5889dfc5ad9a4f1adb53e587c1a377f7d1
- TLSH T145F020650F4C94466DDB2ECAE296DD2FBCF077E26061A4929208C33820BAB469544CBF
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5457A8CE4B2A7499F8299A013B6E1C7C_D734EC3DD00546F46D368325396086B0
- Size 5B
- SHA256 bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128
- MD5 5bfa51f3a417b98e7443eca90fc94703
- SHA1 8c015d80b8a23f780bdd215dc842b0f5551f63bd
- SHA512 4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B90B117906B8A74C79D1BC450C2B94B1_A54F26A8A41DE52C237D54D67F12793F
- Size 1KB
- SHA256 c423897db208927ed695cf0a2ac43ccf57dc6f2a4cf017b457905f43c2ee73e8
- MD5 d58a93369724899fbc12ec8dea5398ec
- SHA1 85470bf5e9a3d0f6fc873dc802d561e2e498ad34
- SHA512 17e774f1f95d6118eb366bc5fcd2a8613fd3621c029ad206ac23b3beb33d4ac1165148dcf9bbca40366a2216248216aa30e255b33e1d80655b2fd8de530fc859
- TLSH T13F41D8E79BB9B3C84C34834051B5C3255EB495A5A2A145E5700A84A3178A7B1FA2940E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1F356F4D07FE8C483E769E4586569404
- Size 300B
- SHA256 a72149587f4e331858ed292df34601b61ccd3bc601ee2ba662d368847100d37e
- MD5 a31b839fa42b6c0702b6e2e2bb9351cf
- SHA1 a76c5521378878d0b873668f9ed8cfc0e9a1f627
- SHA512 bfaf95e59a81369bf04b26d175708dbee512658c53f98ba3800a8d90242fcb65ff65f36251c454877e204b9ceab7ee28dcd215fc4fe2a17223848e85d2b6958d
- TLSH T104E02B0C166C001BE12AFA7D87C11B51EA317911AA024B040FA223444D08B433FA164E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3B6E683A7A45CC59BF035C9BA8C7AB9D
- Size 306B
- SHA256 06be10db3fd316c48be7e50ab4fecedd8ad6a490c73535b8c68463c1d96be4d4
- MD5 24f8ed15814152855ffc42e7642ef7ec
- SHA1 ed5546fe43efd825317b9df5b6b41e9de810121e
- SHA512 5b3f92f8cc91461412d65522822142da19448769e5810d8e72b51bfecee21afc7680f6fa241ca9959d1d3d8ad7eea2ab2b137133f930e59b4166b5e541e250c2
- TLSH T1D7E05E6057E6612AF1371B7E5AB05A92EA35F59BBA06CE0D1F7B040D5D24B83A43280E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5457A8CE4B2A7499F8299A013B6E1C7C_D734EC3DD00546F46D368325396086B0
- Size 398B
- SHA256 945848158b294850bf3c1abecb834d2ed551a547bdea6f2c0bd61a6951d12a60
- MD5 7b2339c8dac274e5a427c4527a6c5199
- SHA1 784c9cbdb7131c44bee598800becaf5cf032a8fb
- SHA512 b7709bf20cee0e7e89b6f9e995b800d99b6bef4c8e9b47bd43c2cb7f44ddfeca3b6486833d97b467951b580044dd388412861361d869318d0783615f5f1a2d03
- TLSH T1A2E07D183FFD013DF1731CF585D946144C6EF0710849A37D064013097B27900CCB1932
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B90B117906B8A74C79D1BC450C2B94B1_A54F26A8A41DE52C237D54D67F12793F
- Size 500B
- SHA256 5fe807dcbf22c603230debe68d905a3ce153e244d48b35d25d674e93ef33218f
- MD5 90befe845ed07d7f498e200db800f02a
- SHA1 68cbae8ad77dcc1fa4a20cfb536882b3918f66fc
- SHA512 3654b40f70295e8ba4b21f31e3a90f3b09ba91b4a8c7db3bfd59e55e4c8c8b3c691031548f3d07ec4952f867f4e33dd213823cd9e7cc2aaa2e29b708adc51060
- TLSH T19AF0DC6C29F2001AF272DE7486D2A293C417B1526C0080BB06A38A0B7F0AB526CE3129
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F4D9C889B7AEBCF4E1A2DAABC5C3628A_7952E7C849DD34C540381487D7CC43B5
- Size 396B
- SHA256 5978c005c911c2347f5932d03267b568844bdaa2c987ae0763adcc8c5b203677
- MD5 777ad79d77c5164a4e674e486cfb8fe1
- SHA1 b4fe83cc5e0f79308d9a84592cd61ab296ce78c2
- SHA512 f16ed322e9bdc61993701825a669e21cacf6d0bb729ce031bde9bb0dc0499815898d54876f81dfc7b8667103c27933175cd8091368655cd835c8ffc08a249193
- TLSH T13DE02C2C32FE620EE073EEB84BC6E290CF75F3200A0167A805C05215AA42C001CD1AB3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 dfacefa73d018d54e3feba3eef28ec722a8422fee8768a2c3d8d6253f863b375
- MD5 cb5000b6fab1115bfff50bedcc3eb9fd
- SHA1 afbfe0ec03df59e7a1eba1da4227111508419c03
- SHA512 aab9a1afd5de2f983466724b6ecf0dbc2e176c5a1eb2f059b9507511cc53643fcf9ed990bd565f22f8d53fb82db71cba238962a75c68db02d5f10b526661bd08
- TLSH T15AD09B667354991CC9C439712462565161015820941443581D96B16CCDE56C707561DA
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 ecdd5c8034c45eff453cbaf31d8886e2bd9609a73853367a6d096a69cc81f1be
- MD5 a774534a956a5c8affebe08e87c80683
- SHA1 b3e4e20a91e4087d3b9247b5ef6815f51858a041
- SHA512 27769aee2cac148a0154fe42b51da2a9a1088e9e990873915b4c7ab9bd5442a3facf82b2bd1cbaef75328bd5937813698b96ac06aa76d934d07ab5ebb194a824
- TLSH T103D09B6673449A1CC9C439712461565161115820E41443581C96715CCDE56C707571DE
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 2KB
- SHA256 8a8908228cfecce45f3493885995bef6b8e4c8f34e901143b7125623ed879eba
- MD5 fc3f23ff75974724ccb5b839872c1ea0
- SHA1 714f272872796576a59b35efdaea11beb57fdbf2
- SHA512 426703c017e8e0888aed1271d4796f367d9ad1528103fba66afca8b8afc153946c0c76291c1bd5266fa399e34916740d6eaf50f141d3f84aa41640cdca609394
- TLSH T1F351E84B6BAF8AD2E73C45F181F680CABFBD94460E8F2E9D15442073DBC3356A108632
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5acc69.TMP
- Size 2KB
- SHA256 70950784ff253f64bbebf94f62410fc8f6018dbec23ca8551735bcd5a21ab436
- MD5 eeea88af8c28ce694146dcc770a2d023
- SHA1 f23491a956239343b49b705029f8f57dabdec2bb
- SHA512 da3fc3fee433bfd91b909eb0b884257dab227894577821a0bd76d65df21e2411305f09cf1e5df667dbdc9dfbf653a8a7e3f02ffdcd70e67004230324b2f9168d
- TLSH T19451A3537BAF8AE2E73D49F192F240CABE7D94160E8F2A1D11482173DBC735BA100231
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
- Size 2B
- SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
- MD5 99914b932bd37a50b983c5e7c90ae93b
- SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
- SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
- Size 70KB
- SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
- MD5 efe54a870e0f5ff28d7e00036b861065
- SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
- SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
- SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
- TLSH T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 0736e7874945996c582eb29a17d7d8e36652b9c42e968e555bbf9ae9a9aaeef9
- MD5 97d89500bad06927867290da176f2a78
- SHA1 cb4cf3171bea49b0394510dfc103db7b9748102d
- SHA512 eda55f85a2583e02232ade5ef12e435270ddb57d6cbc81a0f0c81db20ed03b937f9e0a0265e74a8017f821b26c60260cbe86fd58480255c0f308d7b81e31ec7b
- TLSH T182518DF7C3F8866E890156F0AA146E2FDE6D0914432C3D6AC9E4EF1B93E24B1E14165E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
- Size 40B
- SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
- MD5 20d4b8fa017a12a108c87f540836e250
- SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
- SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 11KB
- SHA256 d42c593861bfadc2ec6abf45191d4fd79f90726d2bcfc0aa9b64c2a4e9848439
- MD5 c864945d985e4676e3acf8c0910240ed
- SHA1 b395e8134933e135aec62dfad171e3e5acfbc9a1
- SHA512 737144320214869667610857513f21dc7bdba0f7fb2122cb25adce081abe6565f19f035b45d5af62f061d50174a85382dbf824b4bd7ee4f88d3841f4e5bba787
- SSDEEP 192:sxRDrCI/fCsOWH4jZqXKrzoA8p18/g6+WNTkw/YD9w6StG/fIgViahJ:sxRDeI/fCsnH4NwKKO/5//kSY9
- TLSH T16242B61A6928993B5CC7D21DBA65BF53D6F96032A1912E48EBFC8B0C14E76DD230740F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 12KB
- SHA256 1174be0f60cf1f7ef32f5116976517d04b4e03db33a73b5783a33567d13ee036
- MD5 a83f76571ebd501b566b058137cd5c8d
- SHA1 adaac40016c01e3331f0b17ee78ec07e3f2ac004
- SHA512 a1291198504b0bdbdf1d0ecf76159ec1e1f8ef6fa2cece43eaf115ae2a8185a077dcc1ed9bd4b5ccb6e5961b2d88ceb52fb74f1a286699d606dccc54992406f2
- SSDEEP 192:sxRErCI/fCsGWHjjZqXKrzoA8p18/g6+WNTkw/YD9Q6StG/fIgDGiahJ:sxREeI/fCs/HjNwKKO/5//aSYO
- TLSH T1BA42A61A6928993B6CCBD21DBA55BF53D6F9603291912E48E7FC8B0C14E76DD220740F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 12KB
- SHA256 f33e2cdf15e069054e3674facb856cbabdfd169d4357dc0a399b891fac75166f
- MD5 fc6bd82e92d03a79bc5da0df2d9fa92d
- SHA1 04b64470609231d7039a8127ff4b874d854d6350
- SHA512 81b869d50401b314995660809c07a6e5670acc28d79b2f3845988984ec86941c13084ebab599ca323dfb4b88c6488642df41d1a1af0dadd14e0f976b1c3b49eb
- SSDEEP 192:sxRErCI/fCsGWH4jZqXKrzoA8p18/g6+WNTkw/YD9w6StG/fIgDkiahJ:sxREeI/fCs/H4NwKKO/5//kSYE
- TLSH T17142C61A6928993B5CCBD21DBA55BF53D6F96032A1912E48EBFC8B0C14E67DD220740F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
- Size 29KB
- SHA256 c4d5eb2727c4ee35951027fb81b9526fddfa6d116e20ed69c2a78bd8b58c76d7
- MD5 4b44f01bab18ea6eaa03b567c373f8cd
- SHA1 b936bcd49805e06e861202893a1dbcf9255c3a93
- SHA512 d0a388e465f2c0e98f6d4c8882bb1754b5c665dae941dcc142ea50c962e3049aa0196ceab31f4b4d94874efc58c2b5595e7a56a41fa2897d4497363890da6a8f
- SSDEEP 768:azfWaU7pLuLf30Wg/Xf7f8F1+UoAYDCx9Tuqh0VfUC9xbog/OVrxYc16Krop+icP:azfWaYEf30Wg/Xf7fu1jaMxYy6hp+LF
- TLSH T169D2EA7B240CCB7F4F800ADDAD197E9B6D6802CB9698CD5047FE981C02C6BEB52164DB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\57366a8c-3c2d-4412-bd10-bace6e04d23f.tmp
- Size 22KB
- SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
- MD5 f768bcb451a187c18099961c484eef8b
- SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
- SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
- SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
- TLSH T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 35KB
- SHA256 ed23ac1285de500afe61904c7123b3b86d331805ea9f34cd329c09988c17d9ce
- MD5 9db9108e81a03e5936e04843d67ab489
- SHA1 c4cbcf0e4c210f6db1e835526ca5b69b8f2cbc1a
- SHA512 4a614992e774220041f045655e335d3957db009766500d260e9dcbddc97b775952c70962988892b46531544d52a4c179119431ef1ad95baf10c5002ac258d013
- SSDEEP 384:nxZcIt38N0+eNzs71jWZlf8hyEG2dUGyfbFn5y2rEoajo4cdR8eHhVODjYPNDUMB:Zt3R2Ii0a6rEnjN3Gac1Fbb9Ma
- TLSH T149F2B0757C64DEB38CEBE34575833B52AEE026A3C5D40A98D6D9E70C05835EC170B82B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 44KB
- SHA256 4ab579a97795abf6d78e5a8b4b487e9e7e269764e08d7ca8e4aee3c524b1e51c
- MD5 986c58292eaa4454e8c1e3885fcd8c85
- SHA1 607feb639922a628b2edfd317a51eff47c0aaf8a
- SHA512 bfc0d332615e985255f3bac4ec755969fcac8e8ebb18ff33ce9e80d8e6ed76e7352263df5310a92900fd3dce24c556a70668e3e815e83e375446a2502783020b
- SSDEEP 384:naiFiZcI138N88TUNTUlIl+eNzs7Mj4Hf05yEG2dUGyfbFM5y2rEoajo4cdR8eHn:RFQ13Xwg5P3saPrEnjN3Gac1Fbb9Ma
- TLSH T1B11327F598D78A76D8EE9343677D2E429DBCD163B5884994B7C49D0CCC821BFC30A816
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 38KB
- SHA256 f804447ce479c814da03592aa27b1408ee65050745bd76fd6c362556d29eca19
- MD5 77ca21a6026d5fcc4e499336e7f637ca
- SHA1 28aecb638edb7c1c3ee15fac0ac0b3a134783dc2
- SHA512 8b2724d90125e90a3cbb6e4c47ffa6a881680a5346863fc1890dce46bad0e719840f8314a8b208e21452335b5ef3125d549a9108943212e50828bd172ef37d12
- SSDEEP 768:Erv+4UNbdS3uAIi0aorEnjN3Gac1FbByt:Ebsbg3utXQnjMaEBk
- TLSH T1B403BF3579A8CDB38CEBE385B0477A537FB4259389C50BA4CAC96B0C15875ED270B827
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 38KB
- SHA256 80a07c2c41c807239431d9e8e20f7e3d772adb810f761dfe711d518bfd6e1099
- MD5 d6a992b85a4ef1e91397ad0a55268f1c
- SHA1 c6d6af9c8796c9efdda886e41d1aab2175f74148
- SHA512 7013e6a123734fb912220eeb56a9f7d10732fd454a6c2afcc670141b42e598ebbd41683fe00875c254f64d786aa28160bfcddd9ac3cb6ad8f1c0f4f5ff17302f
- SSDEEP 768:rrv+4UNbdS3kmi0aNrEnjN3Gac1ZIeVH1SCz:rbsbg3j0QnjMaTEH1V
- TLSH T1C103CF3669A89E738CEBE38575837A037FF4525386840BE4C6DD6B0D029B5EC130B827
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
- Size 153KB
- SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
- MD5 c4a20d073fe58488935da829aae6fa17
- SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
- SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
- SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
- TLSH T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
- Size 132B
- SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
- MD5 ae3a19c226264ff6cb64877f1e7e7243
- SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
- SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
- TLSH T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
- Size 13B
- SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
- MD5 2aa9e263ee3796d9ce358460a2451b4c
- SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
- SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_4812\background
- Size 13KB
- SHA256 7ca4c29985838d1be2649c9f5456d54f233828176ef7af8562789018279a95ca
- MD5 536c141d33166050c1070d246b84ec6d
- SHA1 f2cd64d3c6e34d989bb66d388436c87e42d31636
- SHA512 6715c89c431c9f6df576468dcbb154833fb72f0afa0efadedecc03d90a4677c33941f1f818b61f142b9940e5b0ca8380a73bd706079b70aca6ae6750b9541ec1
- SSDEEP 384:psfdPlrIGRkiqPJtq35uySh6aXwmcP2G8Zy3bVq:6lP5I+qhtQ5uPGmO2b9
- TLSH T152526D2617FB799FD3CA5935B116C27B712E64234293D9864C792FC26D407E38F24D20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_4812\exitbackground
- Size 10KB
- SHA256 b725b36b0ac4865b464e6dc2592663c54309f1b9b2ddab3c7f271e873214e4d9
- MD5 d686a75e0501e2da6a245d7472368147
- SHA1 18c7c83e76550549b6700a04ce2daf6f37eaaf91
- SHA512 b9d26d5858a1e971693e7c62b0bc6913ce87f3452301a4daa1fbe17dcdf1e4d14101aa2f4e610210c7562545b8edaa51ec4c5efc034ee31fdc9463913f20f9ef
- SSDEEP 192:pbhYScS6pc6goRsPiS/4QAAgDYlPSgbW3frqn8:pbhYTpzbciSYKPdWD1
- TLSH T12D226B724AE3F9EFD2D009326562D2BF74AD7991894BC88A0D32A785ED10377CF79011
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_4812\sys_close_down.bmp
- Size 1KB
- SHA256 4488141f07df133c8cf0fd47245b0b3fa00489c992d44c302dfda1b59f69e45c
- MD5 cac3d7cc82721ed5d2845644fe5a508d
- SHA1 8a45865de6f065c8d86d3a25a604f023f81be270
- SHA512 7608a1344ea6031494b6d556e8fcb6b59d365130f928ef2454af3586b7dced573f31dc448f60a9eb9a2f00d9d323d85387de647ddb78d42c144eaa3042febf66
- TLSH T1723194962B46D896C01CD77D46983BE9DB7B4E8E9B61D186EF03F21F8D72108729F120
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_4812\sys_close_hot.bmp
- Size 1KB
- SHA256 5152c26d8c4b398552d243a7d3d4df250310cbfc5b0c6172620aaaebef56d21a
- MD5 27576f2d743d311c4f8859fd3c324044
- SHA1 f6eeb8b2409b65858133f56509bbbb725f355920
- SHA512 b82c86380d50bf765657d94399c238228cf4b6582b7a21cb9d11fb616e4aa577135141c3882d7e6ddd99cec584b0ae88ebe42b41847feeef73074fbc716d5ea4
- TLSH T15D31B481B69108DDD50F063D09E461D33D7F784EB44991A4FF13A8974B2F23DDA46B09
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_4812\sys_close_inactive.bmp
- Size 1KB
- SHA256 6b76f7d524af67cfbe4019afb3c5c7801e3744cbeeb08d616faf19cb771fa84b
- MD5 a13b497ec2a4508aec25100d68c98c19
- SHA1 8cc7ff0744ccda78b64157a20bfa380126d6f316
- SHA512 c52116b238d4cdfce1fd27c1d3f1fb151c718da949c038866a8aee01d70c7d93a0db88a03f2bce97b89a03ee47494b6b57ff48150cbfabb0f065e3c725e1105f
- TLSH T1CA31590C36465084F698A631CE43C1FE1C2E3E88CF1484AB3AEA7F6A753690A0C11EE0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_4812\sys_close_normal.bmp
- Size 1KB
- SHA256 31794fd41dfa1b2bf79b07800fb1d87cdeecfe212749783d182719a1d0699f98
- MD5 c9c8adc3286bd27b74fd560112ce1b4e
- SHA1 fbcce927aaa09435f677aac7736ef30c09c36224
- SHA512 525c31cb68b9a53e8bab25ada1345ffa8c87da9993f5e3fed41f93300b46fe6939ae23654fabf89de9782bbed6adcff14a1b19c857ba7eab038c548e4f10b0cc
- TLSH T12E31680AB7639082C015C138CC60CCFC2227BC88DC2000B3BED43F8FF675A0821C8650
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_4812\sys_min_down.bmp
- Size 1KB
- SHA256 a03704bfe923e0859f3f2c7ca09c9354c4f336a66cf0ce0d171d0232ace864a1
- MD5 5a947464300ae8ed294e23d77d46b665
- SHA1 84628e9ced4b97111fd3f4383b760a5b15f39bec
- SHA512 de726cc7f2834e32d7031c9af4148db7e2a4d6edb7c7c992d7370a42cfb0410258e08c06c35750cbd82be53d51ac93f77abd43dba4c4c5f078858cabb0e123dd
- TLSH T19531A4925F86C866C028D73D469836DA967B8E8DCA51D149EF03FA1FCD7110873AE354
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_4812\sys_min_hot.bmp
- Size 1KB
- SHA256 f6320e38c589cbbff9c3acf0e4d1f667c861a40ed3cfac537baa1802249c1f3d
- MD5 1f5f6fbae39e2bcfaa5b395eb3c02824
- SHA1 d34f023e598e2a9ab76e6934aee75ac480d1dfb2
- SHA512 931be81ff61136a57f336c93612ac88acb8ed3cd6cfd388fa1e7af598e69780f0d084f7620fb7d5d2d1450145b5e4c515a4ebe7de379e92930a1a388849206f4
- TLSH T17531BE91BA61499DD72B053E0AA490C32DBF7C4DE44941E8FF12785F8A3A13ED646B0D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_4812\sys_min_inactive.bmp
- Size 1KB
- SHA256 8ddb4ec64f3f085cb6e8ef46c36bde5d4609997cb7707da23af992cdd457ac9e
- MD5 1cbc0c106dfc990c5a6d904c4b8e63a1
- SHA1 f88ca855dda95291775667902d6abe0b68056f6b
- SHA512 43cfb84b54d17d4382e1fb1f80729ef5c6b6d0bb8477d5a9b39ce78a4ee1395375a6941433ccebf272341cae880de9469aeeef9b3076808883a03ff524cd3227
- TLSH T18231500E35024840E4C96031CE8A94ED06183CE8BE00888F39D73F3A243B3061865EB6
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_4812\sys_min_normal.bmp
- Size 1KB
- SHA256 4b81797942530350794bbe9bf6ca8f1ea1d048c76c7155995a5bd1a7fb243a30
- MD5 a7316bfb8790b44c4b6c4c4ec4c4b308
- SHA1 5c4696e240dbdba4025cd82c295451e0ffd14ab1
- SHA512 048f0745c3fdaf7e89315aaf4b0dbe3cf08283b63fa344886c7a0ea3ba35fd0d1e0cda731f4fe82a26bce45e2b89a11c2684012063b04945c3b8d20aa1168f13
- TLSH T14F310C5B76668517E109807CDC38E9EC527B7D59DC040263F7D67F1F7632C4551C9440
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI3F32.tmp
- Size 69KB
- SHA256 5964196cc4374474b0c8b1d664bd661816f3094c5f93dd9c830a542252e4672e
- MD5 dcdec2468aa75959f674ccc8dc048c67
- SHA1 35a7c0e2a8343a30b6962e73b6c8a6deeff91a9b
- SHA512 82851ae0e64dcf70da02b6e0f60cf1e30aa0e20a4b0e9f8721645430af897baf4392944432b54247ff06ab90ec231250679c3f61a8f49fed8d89d3083139a127
- SSDEEP 1536:Dqfk6yWumvwI4UQPxabT7sM//QtxO2N+W5xa:DqMCnwZUQPx0sM/tiM
- TLSH T1FC6349A171E494B5F0A635707FFACA25C277F8A929B2844B8B540D0716E5982FF36333
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\URL55D2.url
- Size 72B
- SHA256 0957e39c0ebad4934ef865ef47047b9e33179f1967da65151c731459a5ef2666
- MD5 c844b664f6b13c290c9c4447bb6e8cd1
- SHA1 13991cb2af4d892d0b3556f6027d5cc1f28c6397
- SHA512 683845455f539492ff494df9dbe261b39d3342541c2ddc49b8ec43ffefc06cdbb7f9278805494b309035a6b341ba30803c1da180bdd29031e6836dd0d8ef73db
- TLSH T140A024044DDDC0154411C44C00714030DC01D0D04051C0D4C1D1DD0C054F1C130D0345
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\a6e0d677-7489-4aa0-b12a-23faa25dbb82.tmp
- Size 1B
- SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
- MD5 5058f1af8388633f609cadb75a75dc9d
- SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
- SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3944_1292444147\CRX_INSTALL\content_new.js
- Size 10KB
- SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
- MD5 3de1e7d989c232fc1b58f4e32de15d64
- SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
- SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
- SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
- TLSH T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\JP Software\Take Command 14.0 14.01.33\install\264BD79\BorlndMM.dll
- Size 33KB
- SHA256 495c4bafc2fbff7ad570dcb63c3c72c10b64acfda1dd8286cea916e6aceb1e82
- MD5 629f4e7e18abb2e72577c493d45fbb5f
- SHA1 cd8e5f222edab0c4c28237ede206109b977ff79b
- SHA512 edff8b8262aa3a26eba64c4387af3ae1a5f95c13e86310549d24be7a2673f7b2223826baae84ec70089f9eda7788fb16127e4c27d56228e7dce7aef2a3254776
- SSDEEP 768:HjOAn/ija+1IIsQ1LfBfgvWija+1I0Dx9DT8zjhQs2jbiYKv2o:HjOZsaLVKFDT8zjF2yv2o
- TLSH T1F5F28EA1E3C48034F06103749D37916BFBBBAE21163216B705E9BC3C6D89B94B44EA57
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\JP Software\Take Command 14.0 14.01.33\install\264BD79\English.dll
- Size 607KB
- SHA256 20c9232f82953b01c55f9b3fef1185718d2641dcd38f7739723fb17651f57674
- MD5 377ab631ff70862d6f05b5b8a78ce20f
- SHA1 2eba3997fdec626a75703233a69b8d62810a9ebe
- SHA512 57240a0c363211a578cfa05a05b574ff2480f3808c0da4fb26786401f6597f946b88de7836fcde4e5f896b4343609e7e141f8635eb07266436d48a02d1aedac0
- SSDEEP 3072:5v4Fg47a1b/c1e2y4uYoZxX1KCPD5jmrULpd81lggsW3kLCnGqdctvH9cAlL42vY:Vr1b/c1y53l/8IgsW3lnpdS1TlL4ubVQ
- TLSH T152D4C55053F9C504F1F36E7CAA7687948F36BCA1993DC60F45A13D4F18B6A84AE21B23
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\JP Software\Take Command 14.0 14.01.33\install\264BD79\EnglishD.dll
- Size 397KB
- SHA256 049f2635d23480c2f41e44cddb2eb5188c54481d968d6ec0ad36a4f5705a39f8
- MD5 2aa86ba63e99d6bd965f49504fdef180
- SHA1 2dd3dba241774c623720120f9618b56979a1bbc6
- SHA512 a7ecce2f81ba27139df5c5a7da5ee0d779249dcfdf72b30a60606b601738bc0b343a439cf37680a815b60b4f7d59534daf5aa70cf38be187462e41c5c2114b54
- SSDEEP 3072:IAg47a1b/c1eI61z+d21Knh5kyPD5jmrULpd81lggsW3kLCnm9cAlL42vggegpOn:s1b/c1wghmE8IgsW3ln4TlL4TN+Y
- TLSH T19E843850E3A8C500F1A65D74A973CB60CA36BCA15A3DC61B09E13D6F38B7AC66F12717
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\JP Software\Take Command 14.0 14.01.33\install\264BD79\French.dll
- Size 643KB
- SHA256 8b9c0e28d50b52ff5eebb2bb24a70cbc8b8d04be888fc67bdc7ca2707e151abb
- MD5 c190c4e0a5c78da1ef0e45ab63ece649
- SHA1 d32c44a45c58a3e69c1e07ea38c74b24eeeb16c4
- SHA512 e4b89f11b2dcd46b9a646732d48380946147a80a217e5c490c2e74e4f6b8bd17a8d17cb5573da327ab4b87ce05098dbf3c7f6a287cc45e1c94fdac07f72de53f
- SSDEEP 6144:XEhK1b/c1503/8IgsW3lnpdS1TlL4haSDIcj:XEM1wr03/83pyl8hjj
- TLSH T141E4A61063E9C601F2F27E78A9B646549F37BC928D39C61F05A13D4F28B6E44DE25B23
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\JP Software\Take Command 14.0 14.01.33\install\264BD79\FrenchD.dll
- Size 403KB
- SHA256 e26437d4b7976716da8004ddfda06f818a2c7249a0add509bcf31140fa2af073
- MD5 92706019c0de33622b56b896eee10ef7
- SHA1 6fec9a6284ba4d89375e873aa469b6281a9d4095
- SHA512 112341190e108a51a4ad6f23fc8e8a6f40a911fc4e28e273c574ccfda166fdc1ee671ace041ac39b1e9de881e0690b82128cad177ad0f9818d20352c0e84a9f4
- SSDEEP 3072:DTsg47a1b/c1evp1z+d21Knh5kyPD5jmrULpd81lggsW3kLCnm9cAlL42vggegpI:DTp1b/c1MghmE8IgsW3ln4TlL4RSDIh5
- TLSH T141942950A3A8C510F2A25D74E973DB54CA36BC928A39C21F09E13D6F38B7AC56F12717
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\JP Software\Take Command 14.0 14.01.33\install\264BD79\German.dll
- Size 642KB
- SHA256 7f563c95b7105b80a40e633d8f24eb5cc736fb8bf8c7fc1f2d28fd8aca619786
- MD5 6635ee293d4f88b9b25fe95995f98f96
- SHA1 be20342f5634f56ba4d9b8012acfa5d6f157a05f
- SHA512 2ea9c6530b51778f0b802cdb2d8349e305cef5ab26b2c96adc96d41d703ea8c19416b19102f7b6fb4a344ffb3e584e20f07a1719bb2ef0f48c2da01fdca49af4
- SSDEEP 6144:KFJ1b/c1503/8IgsW3lnpdS1TlL4WvyXOo:Kz1wr03/83pyl8WRo
- TLSH T14FE4C81053E9C514F1F26F7CADB28394AF32BDA15E79C90F45A0395F24B6A44AE21B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\JP Software\Take Command 14.0 14.01.33\install\264BD79\GermanD.dll
- Size 403KB
- SHA256 2f2bf23cdfaf549524900e23da9990397aef8251d3ed6213e1a0d5f5c4b41650
- MD5 637f1f72402caf56664b7d4a2f6d8d83
- SHA1 e83a6a5a5e2fd20347a453ac14fbb68599ad18b4
- SHA512 df35178fc7049afd927911d9362d6c7bce926d58df0e516fbb531e0b3b0ed3ac3e5bbdc143164dda5f00e3ea47f9021107cc09887663387a5117effa3fb5d60d
- SSDEEP 3072:g8uSg47a1b/c1evp1z+d21Knh5kyPD5jmrULpd81lggsW3kLCnm9cAlL42vggegX:gr1b/c1MghmE8IgsW3ln4TlL4IBeFO
- TLSH T182944A50A3E8C614F1A24E74A973D750DB22FCA15A79820F09E13D6F38B76C66F12637
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\JP Software\Take Command 14.0 14.01.33\install\264BD79\IsLicense50.dll
- Size 2.2MB
- SHA256 a02b81faaf410622e89374531383baa6f208df3f30349f829e49be9478e7cf30
- MD5 2cbbb38cd864811187dd7ec789160e88
- SHA1 0900b92869f85dcc73804753693c82fbbb1ca618
- SHA512 7ff201130af687babd20719ca759b8cb20f8470f20017e01d10509b6e6120f50760990409ee772a671745a9e8d739c0be2af268b51a08e1dfa08f135038b5dcc
- SSDEEP 49152:lRgGUX6NwXcsoSmK0bLobIs2mG2cAet5a1qhT+8o4JwKQ3MlU2XcEvogQEqgRfiZ:lmzcEmZbLobIs2mG5Aet4Si8o4J9lU26
- TLSH T1B8B59E327A919072C26F25704219B3AC76BAE5700B7246D7B6E01F3E6E345D26E3835F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\JP Software\Take Command 14.0 14.01.33\install\264BD79\Italian.dll
- Size 633KB
- SHA256 e9f5974c55cdcb753ad47f8b98d7d79f83702b6ac8f6b43a22520794108a5599
- MD5 5fd0fb5ce5f53ff29fc1238835253e52
- SHA1 592408f7929d29724fe1458ea8090f2c3411af9f
- SHA512 ee775ed6aa6a2dddb55f83a7e1b22d803ab4131258fdc8069a816821c4ad205a72f9c3c83dd9b43b6daf1479829d604fdb9a05e4e4735aa9676743a1abcf7288
- SSDEEP 6144:kNF1b/c15u3l/8IgsW3lnpdS1TlL4WtenluNOP3U6X4:aF1wrQl/83pyl86U4
- TLSH T10BD4C410A3FDC604F1F36E78A97687548F36BD61A93DC51F05A1394F18B6E84AE21B23
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\JP Software\Take Command 14.0 14.01.33\install\264BD79\ItalianD.dll
- Size 400KB
- SHA256 e5ad0c2adbcb88a684e5dbabea38826b0c8638f293dfeae0dce145f99cb2b82d
- MD5 90194f2a3f1a979fb3340857d663b0ac
- SHA1 553f7a8a602a47af81b878742042db70d2256de9
- SHA512 8ab31bcb2a8363e4a8fb0748f2ace9323a7f245585a6cd5101df3bddb59ded8691a498ca5cf261a40dd1767683cb4dd343588a2b1b126b38f2b378442008294d
- SSDEEP 6144:fJ1b/c1Mghs8IgsW3ln4TlL4lzTjbtenlIJZ4vVLqJ:fJ1wWGs83sl8FJ
- TLSH T1EC941850A7ACC600F2F24D74A9739B44CA37BC62597D821F09A13D6F28B7AC56F22717
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\JP Software\Take Command 14.0 14.01.33\install\264BD79\Russian.dll
- Size 667KB
- SHA256 a786914370c1b37db1a47184544fdbc0f0631d3f4db0aeec7ef44d32f55f5b12
- MD5 a61a49afae32c324e735f260f3185650
- SHA1 e7cea665937a9dc66a88f443b5a512fcad33256c
- SHA512 0ba81b884b763fa00a648e74c8b8f9dc264749402a01064c213ffd7a9341584c8118ff0b8230be960352e6527458a1bb465315248983851372eae126c4e6c018
- SSDEEP 6144:5861b/c1y53l/8IgsW3lnpdS1TlL4UkavgBOD:91wU5l/83pyl89cD
- TLSH T109E4B51FEB7CC610E060D0785B538BD25666BF10232D8987869F3D6E60BD6B93B21787
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\JP Software\Take Command 14.0 14.01.33\install\264BD79\RussianD.dll
- Size 402KB
- SHA256 0f2b4d3ced431862707f0b7b5f1e5e616f76724bd299c112ddeeed6b26510b32
- MD5 a94a18845ada0e56aff5049cfa4100f3
- SHA1 3b097ec8f0f773567369658ca3e0d67cc0ffcad5
- SHA512 6942acdfd46408a8528dd8cf030c71d945ee9bc03eac1e926e06f54c92bd550d637c73e9c41528e0aea83014b1427e1f1ce1e8c9b8cdc9b1b7269b48641f1cac
- SSDEEP 3072:+Ytg47a1b/c1eI61z+d21Knh5kyPD5jmrULpd81lggsW3kLCnm9cAlL42vggegpu:hW1b/c1wghmE8IgsW3ln4TlL4b/
- TLSH T1ED944912E73CC610F09588759963CBE4C626BD60572D821B4AEB3D6F34BB2E63F1254B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\JP Software\Take Command 14.0 14.01.33\install\264BD79\SciLexer.dll
- Size 632KB
- SHA256 d7d63d5b0a1eaba5a35b39fc21c8cb1823a16b16b840bd9bc209372511f7eee1
- MD5 10d68bd61b4d671f22085cea40b16cc8
- SHA1 d0a178fb56f27bfcdf919a7bc01b732c37289ad1
- SHA512 5269e1eee591f6c1c569569d033f6f783d1f9fed0a12bc6ee804be2c436d12b9d9551144ff2c85c1c2d313b7a7be6f2b81bd1fd628e9e18394c60ee8286c8a94
- SSDEEP 12288:xQGwHsXlEubMalgxmnn3wvhDVipSLCXvehlnfOTHNn/Wu:xMMXlEulgI3wxViELCXW/WTtr
- TLSH T16AD4B063B2C3E0B3C52E2531A629B3B599B9AD315435DC8326EC2A166F30590763F3D3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\JP Software\Take Command 14.0 14.01.33\install\264BD79\ShrAlias.exe
- Size 39KB
- SHA256 41f236823a0c8da48199b834ea2038a85d2578914a2d8c3088200eb6788e6555
- MD5 7b5fddd15a1059dc6e77cfaa595f5d9f
- SHA1 97c05c3712eeaa5b33982ec26adf28dd8ab77e0d
- SHA512 0e0884d9985f7b76c7e44c00225ff87abb4756d7ce56b4c859e27c762c5f51dcb33cdc49dff03e06eaf0092f36a79b3ef2f01a9e28feda4cc90d8e60023214ce
- SSDEEP 768:FdgupinhN/l+6EDxAnqmpNEgc1IILZ8I4ki5:FdghvHL9cVSXX5
- TLSH T141035B5276A55032E0635E3029F8D2625E3BBC826EB0815F3B98517D4FF17C19EB836B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\JP Software\Take Command 14.0 14.01.33\install\264BD79\Spanish.dll
- Size 639KB
- SHA256 3396abdea39d0dae1099ee719c73d611fe45e6855e5e99b136ea2c13bb041d8d
- MD5 d2af8e05911f54fe72c39fc9e2c54ff9
- SHA1 7c568d3e9644c786b7a003db4f3116b09479eebf
- SHA512 12549139e8d6ea7bf12dc08c697ff81460edb577a3b2c882f4e6c38392bf48812f26a4c7aea00b7662065de2677402eb8681ce356da0ab3709c2a5835c6431ab
- SSDEEP 6144:Za1b/c15u3l/8IgsW3lnpdS1TlL4AR3TLY:s1wrQl/83pyl8+3Y
- TLSH T125D4921057F9C601F1F3AE7CA9B647948F36BC91A93DC50F45A0391F18B6E84AE25B23
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\JP Software\Take Command 14.0 14.01.33\install\264BD79\SpanishD.dll
- Size 404KB
- SHA256 f4f8c9d3283a6c89cd6b6e6a96cc2bb971f4f0582f14f567d96956600db3be9c
- MD5 e0c709bad946d9e342e1a353ef624992
- SHA1 42e80aa55f69bdc23d58dc705939e608a0f0af2e
- SHA512 23f6f712120e20a173baba8cc92c87d40c9be09a8ccd2db05359da5b7b3235426d3f4007d7f04d746042ae6568046703b6a519489fcddaf37ad208e2dc338344
- SSDEEP 3072:hxg47a1b/c1evp1z+d21Knh5kyPD5jmrULpd81lggsW3kLCnm9cAlL42vggegpOF:I1b/c1MghmE8IgsW3ln4TlL41BN
- TLSH T1BC941750A7A8C600F1B35E74A5738B94CA36BCA1993D821F06E13D6F38B7AC56F12717
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\JP Software\Take Command 14.0 14.01.33\install\264BD79\TPipe.exe
- Size 118KB
- SHA256 a59f415b7edd23d6007a4e66fd82c20ca9a89310286cf1e12e53b0257d72cea0
- MD5 bdaa3bdedfbe5adfee15f561f3d4d1fd
- SHA1 81c1ad729d0f2f619771d33cdcdaa052686d3060
- SHA512 2b865b3f5e5492d44688a646d8061d53ff22fc9a322404eff9d05d8b3e03af0986dc5a11fb1c78721b2a51f1593efbccce776af5b4688af6ad79edcf86279c7f
- SSDEEP 3072:Fksm2Y0sP/jsZ2guNINl0zfqICHltnQiVuTqetl5I+/9R:tXY0sP/jsg0HltQi4TTr5z/9R
- TLSH T118C39E3131D0C036D5A228318C75CAA29D7EB8B25B38D4CBBB98157D5E913D0DBB936B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\JP Software\Take Command 14.0 14.01.33\install\264BD79\VESP.dll
- Size 804KB
- SHA256 9546ee00659e5b3b47a6abd80499d7a19e1e8fce4c2cc9f7d70d93136ee9d3d8
- MD5 ebab5ad7392abe3f3a405dab3320396d
- SHA1 6595e46403345354c651cacba522b4a2f0fd2c65
- SHA512 113f1a1eaafa9cd9643a241cee8f29b013bb543b627114e79b4d58e60834fd729a1ebf6e24d73f3306069b04ee4559a397aeb29aca5b27ca83c62b5c769c9b03
- SSDEEP 6144:8csyag1b8XxtXLPSAj8k5fk5XcrruIugIUsiKfNISMTJJJ33xD9z1:8vxtDDWbgIr2ScB9
- TLSH T1B7050E00A7F9D605F0BF6B38997197A54E37BCA0AC39C52F2664364F2D71B409D24B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\JP Software\Take Command 14.0 14.01.33\install\264BD79\VFRA.dll
- Size 800KB
- SHA256 a7121889bf5ff8e8f1d8e1975e6492a126d26de11b48261cdaaf3d8ff5adfc9a
- MD5 a283cb1b06a53259bfd0620ba083187d
- SHA1 4c9cc3a21cdc49843bdd230b916399d6e52cdefb
- SHA512 9b74e6ea590f134885bf7f09a601db75650613e0693210b69a49ef76a1db4c811a5e668000bc062f585e05bb511a13088019cb3f647b7bdabb8da70a6f1a30a0
- SSDEEP 6144:V7uUfVkbd3Q5md/baSAj8k5fk5XcrruIugIUsiKfNISMTJJJ33xD9HSn:V7obaDWbgIr2ScB98
- TLSH T143051F00A3E5C605F5FE6B34ADB587A90E37BC965C36C52F2665368F2871F40CD24B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\JP Software\Take Command 14.0 14.01.33\install\264BD79\VITA.dll
- Size 785KB
- SHA256 8a0d2073424baaf570833a15e7796dded5811543dfc71a4579bbf6f4edb18f71
- MD5 b965aff56f2700026c930ddf636ac54a
- SHA1 20b17eac02cf7a932bf1ac5a73e6b32664c5e627
- SHA512 f7e1adf528d55c43395a601c6cb9320b30065e73ded3964db2277088fc30fcd6ab433439dbdfb92d9cff2608355a2eb69f1143fafb425a3d0dad2da522e2587d
- SSDEEP 6144:z+NRZbxjDTJJJ39qjmkffk5XLbWuwu+I2+iKfNIwIH4LS0TmF4Oy:z+NRZbBwGT+IH23YA4
- TLSH T190051C00A3F8D605F1FF6B38AD7697A50A37BC616C35C52F26A5364F2871B409D60B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\JP Software\Take Command 14.0 14.01.33\install\264BD79\VRUS.dll
- Size 783KB
- SHA256 6e11a3817e1002c68113f0098a059fc39f0255175c21760873812c3ae696c5a9
- MD5 8e019756c521c9596e514fb1638a108f
- SHA1 a5c21c351c70a6bef827ba5c694ed648365cf7a7
- SHA512 d0f6835fd10d85c85cf39ddcadb64c411156a2510e6257b88756491e640aeb2b0486d89fd23b69a5c8223435dd82ef9db3ca2e14a8fe8cab0e665b6f969d08e7
- SSDEEP 6144:j3QZSAj8k5fk5XcrruIugIUsiKfNISMTJJJ33xD9N:TQZDWbgIr2ScB9
- TLSH T10C05421FE678D201E46CD1344E62CBE71126BE10272185A7A6AF7E5B70793317F24B8E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\JP Software\Take Command 14.0 14.01.33\install\264BD79\WiFiMan.dll
- Size 244KB
- SHA256 cea9e6c8e90988b32dc515147134a8abcea4953018744b4f695e0c2f25421949
- MD5 684d4383eb84f2df62ed594e46be82d0
- SHA1 7b1757f59fa587a0c1591b9d0b38df784d54a125
- SHA512 d50bc20266304dd5e3e899539d25aa564a621b51a77f7c72d3a4ec314861783e773566d5ce746c862cde1cffca9ac2d57a6767a36eb93501157b9ccb0d299535
- SSDEEP 3072:firESRcP6xSgCsME0srdNE7iwMsgcGSgzvJgtaGnRR:h3PXgPME0oNEABoct
- TLSH T1A4349D827FC2C072E50B527D051717764E7EAAD1A32743EBBB9C270C9AA32C12BF5195
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\JP Software\Take Command 14.0 14.01.33\install\264BD79\ide.exe
- Size 3.5MB
- SHA256 cd161b730a79335de1b6a50224dff2535b9befd28e6b0e03cddceb1169d9fe15
- MD5 95e333c6526a30b9911f02acc750b760
- SHA1 d9479fcefb9d390a1b83f5376fe4a62ebbbda178
- SHA512 65b0171c878bfa3d3cfdb75753edd10f03b6e6607aeee0069e808b21e9047fdb49f69192448f979ca58679b92cc47365d77455a718a5383f1d9bad25d24bfb57
- SSDEEP 98304:5IQT12eUHihPjuYwwDgdfcLPb9+lAsSo7RXUEtnpT43qFG:D1VrwHfS9iX5tnpT4f
- TLSH T1A106AE217B919079D2622631C9EDA62D956DE6230F3842CF16AC1E3D6E342D36F39337
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\JP Software\Take Command 14.0 14.01.33\install\264BD79\ipworks9.dll
- Size 1009KB
- SHA256 21c4018f53ba3c673f2623d7bcf7b277fba2e1f03c639bc36cd82aff3308f295
- MD5 0cdba111981469b32284a982ffeb90ea
- SHA1 302d6f9c19128ba3ce2d51624fd920d6ae6607cf
- SHA512 b8760b934bd85425efe388d7f10fa33b0bc4dd2d1c0ed3dfd0daab11d7527b79196a3c6d69fcaba9066e0e50b6a4ab300d93302e14ecfcd303abbfab7cd7bbc4
- SSDEEP 24576:RTQdX98icYtNOg3oBoE9iQe0ZrJxpAttqJcSMwNumKRE0gpqOj3gQSfjrAU/Uf:FQdW9YytJx4yJKR5glQQSfx/Uf
- TLSH T1BB258E2263D4763DE521903246CD771B42FAD3304B7A688A69D62C8879F5DD3E32F392
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\JP Software\Take Command 14.0 14.01.33\install\264BD79\ipworksssh9.dll
- Size 399KB
- SHA256 4a14b352c6a389cd6939a8cfab0971932ce95d7bca46f8e639819b8ad0a82358
- MD5 91759c34a5c567c7e9b0bd0ad6ce2c98
- SHA1 be262d407f4a8d960502b9ccfefdc5f9cdd7eb44
- SHA512 039464b45ac101435c213730ecd206c56b16dfd79b07f5a1414f0759322e707a740a7a333e1eb7c3b90288f66b4e90fd63d1666c0a4ca7a2ed81f412314d340f
- SSDEEP 12288:gImdzVd7boYDrpH4Pug375y9TTYIRXjZSsmxd:1Ad7boYDrpH6r37I9TTdRXVGxd
- TLSH T1EF94AF6263C0693EF0A751314EC9672686F9E734473A1D429AD59C8839E5DE3E33E383
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\JP Software\Take Command 14.0 14.01.33\install\264BD79\ipworksssl9.dll
- Size 1004KB
- SHA256 6b65c5fe809214bc2dbce2232c1120e9a0ce7f07ffc37bbee89737b948eb4825
- MD5 5bdece8e3025046dc0acc93410f954c8
- SHA1 dbfef6d5c1ad9fafddfbe1ee51ac4494e64ddf70
- SHA512 07ea04f2e8fbc6b95a37f3b034f4910cee7d682bd336c523ce6bff50fb33923c80517640db2b6f303f1e81afa98d36e4d1b03bc6f78684e13c7e10ab4f26d055
- SSDEEP 24576:QQnAivYlnQ9+yeuN/UtfP3/anXzJMnnocflLT6h6l7Zicw9yVoxUgpubKSf8UaxI:3nAiv/l8vlLW3cwZx9wbKSf8Uaxt19ju
- TLSH T1CB258D32A384763DE825A1314ACD771B42FAE3304A76588A6AD15CC879F59D7B33F342
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\JP Software\Take Command 14.0 14.01.33\install\264BD79\ipworksssnmp9.dll
- Size 161KB
- SHA256 f102d73dbb66a1ac764a07fda56400a42a14fb869a9d7a33815347201280f215
- MD5 873c00388df011d4daf311bc563d3a97
- SHA1 c5ade0604b1b13294a0d0c2733d1aa9c19bf60f8
- SHA512 ca8035083d58c04a6e0c560492547e8264274668c211c4de87221d7aa4bf333ae70a5426a1cef095be53be734f98a6752bee76674629e5d607b9ba89de66a100
- SSDEEP 3072:v0ULtpdBZNbJDkbmx3VlkmE1CR7qYD+mjPCwa9cu+ec1:BT1bJDnl6mE13YBjCwaqu+n
- TLSH T103F39D36B2A0593DD10312718A8B371A97F5D328073A4D42A6D19DC06AE69E3D73F3E6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\JP Software\Take Command 14.0 14.01.33\install\264BD79\ipworkszip9.dll
- Size 729KB
- SHA256 3b7bc2256af481991eacbed2c18d958bfc04dc0eaacaeed8dccbd5806801be53
- MD5 7c0b56d8843c655d797e43dc6bf0b7b6
- SHA1 2852be72d3081006098314646c8960957d2eb59a
- SHA512 f24e96787eebd5dc78351f7efa5f5ac19ce447be5015100881780ab34ab92fe2ffd2169135e1416e7d5f24c3f4ca7218449415fc536f993844036eed5854f0e3
- SSDEEP 12288:+Y9yn9cOKey9+WgVCFRwXpccQzEHotOUuw1KonFT3l5ROLigS58Map:99yn9c+yYWoCFRwezEHotOUuw1KoFT32
- TLSH T161F4BF12B38041BED07681318DD6577BDBB1F92907384B4F2BD55A893F236A2DF2A352
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\JP Software\Take Command 14.0 14.01.33\install\264BD79\license.txt
- Size 9KB
- SHA256 4e1e2e35e90835a96bbcd90b94b9cbf90f1a1822185500c6849978dbbe0a6ff6
- MD5 2d9ad44361fdd167f1a2ae16b05ed559
- SHA1 cce9fb811df6d674131b0b89a5430917842ffd56
- SHA512 e44c4a2cfeb67e8640ec0d01c7a6b725fbb7a792ffd9efe108fc612875d19388dd20710098d4dc740cccd172f4f5e2dac35ec2bd338d1c7f28ff6f21c940798b
- SSDEEP 192:JLj+Lv7LrPZcbNsYIq/DHEKIk/XdP9+dSgxN5FFO:J2ZoF4K6d4
- TLSH T11912EABE7317136110A103513B4E6CDBF60E82B9A5AF5A563478920C23B7A3D53F7988
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\JP Software\Take Command 14.0 14.01.33\install\264BD79\onig.dll
- Size 290KB
- SHA256 7036c6f6d117776db0cb954ad5120d8c87126a2d3c898c9c6538e0b5e5edeada
- MD5 0afe4593c098e8f9f1922b523480de9a
- SHA1 74de92344f57f4db96d052ada06b700dd6760ce0
- SHA512 de3dc2e232d7654c8661985e536d30658a955fe4c3b8a389e49a784ff81c7bccf739018951f042c4164b008d394c08424dfc0026cf7e01d70bdc184c5d07f87e
- SSDEEP 6144:sdmQKkB+zLWNm+wxGIBIJsInKl8WOWlrdyP/+anf/SSPQRGnVTCtl:smQKkB+JxGIBIJsIngJ+nHS3l
- TLSH T11F54F702FF82AB73C0AF867914EE93A5663DE603171386D322181972BC673E519F93D5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\JP Software\Take Command 14.0 14.01.33\install\264BD79\readme.txt
- Size 7KB
- SHA256 7a27ae549439b95479974f0b2adbc00887b9aef437b1f24900a870803ab0274d
- MD5 18a7b7d7d188d4eaeb773a2e485438b4
- SHA1 896516a828f8cdf2445d61c3e6888dbc43397be0
- SHA512 6aa09e3f038e5a04594686d5b7c1ba7d4bff854e3917d9b24b11a4919d65a1e70719dafd7c82069bd65a12650806d4ecd8f046df12a9aa7ecb2d102b091fac7e
- SSDEEP 96:Kofq+DvQZzjnuHx2TnH4Z2JISz1UGRRp5peTRkg9NHi3Z7UDa5ZPTxHG3kOQkHht:5PYZHuQnH4Z2JISJU20CdvP90kOQkf
- TLSH T1E3E173AFBE7E53025533D14675061E41EB0A92AB69028CA3769C96142FBA121D3FF26C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\JP Software\Take Command 14.0 14.01.33\install\264BD79\stdvcl40.dll
- Size 443KB
- SHA256 920348e86cc1e6e26d256d37cdeba2587dd220c06337db10d22d53e2b6757c81
- MD5 712e7ac511b4b5432b2e66637d85ece9
- SHA1 cd8b42e8e192045cebde4c17162851ea11364901
- SHA512 eeadb7e4a931a55204d61ab8da9f44e4ccaf44842688de1f6cb1ec6af6c38a297a55e3a82309322af800ea69d44f5102f2de22518ed1cbb3301c823381331364
- SSDEEP 12288:bCYjVA+mAWP7OwoGkAfhLrawBVgQ7JTQ:bJV3WIkaw8QZ
- TLSH T172A46C62B2D04433C2631A7C9D5BA7BC9D26FE103A2999463BF91C4C5F39681793B393
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\JP Software\Take Command 14.0 14.01.33\install\264BD79\takecmd.dll
- Size 1.4MB
- SHA256 b6e19fc7116fc4711e27578174056eaac7a00f6beb81155cd777291be6d5c1d6
- MD5 c99b3eab145b7d6f7e4e3870814ca3df
- SHA1 6a507d02832d6b55f64139f198990f6c47817ca1
- SHA512 2484761d938591f97f136660a8e76a7a9b876b2459b4efccfca0d2bde6fc4c17ad4a5affb278ce99e2c7b62d39a8edbd420ed6c73d04c1fce16c5c1cb9aeb076
- SSDEEP 24576:T72Y5O8U8m2Z4t+8k8+YWyFQBVmPrINcW/YMStXjmNLqmRX8DbD73Db:Tobhj+Y/+BCMoXjm9q28DbD7Tb
- TLSH T17565BF01A7CAC161F1A825B465F6FB271A7DA9210F2C98CBB3E03DF96C706D1653934B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\JP Software\Take Command 14.0 14.01.33\install\264BD79\tcc.exe
- Size 247KB
- SHA256 6ee4dd231f061ea0c9208ace44aac0d35e497c86775b554f13feb3bff3137ccf
- MD5 9e0e678506990d36043843dbe533ce6b
- SHA1 480695aab22a083ef6a6c4f2beceb5b4d587bc29
- SHA512 ff73d30c340cf7ce87421a7cb70826d0a162dd7a4d517a53541a296ac89ea9cf94ad097c3bdb05fadc425c71bb738fb0d5420e4d785e02658f45d2e2f55fb993
- SSDEEP 6144:bcGlUwsClZdSIC/KoBtKw/7kM+XRv6fu+AOjEt3w5oScQ:bcgUwVWNj/w1V6EC5oScQ
- TLSH T14334DF2076DA8437E1921C7094A3C7528E7EE6721F2DD493EDD81E3E5EA93C11A75343
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\JP Software\Take Command 14.0 14.01.33\install\264BD79\tccbatch.btm
- Size 1000B
- SHA256 a00c73b699586ce9243899b0779cca3459c7fe4e008f19f6e16f1c3a07dfbf1c
- MD5 ef31535b3f8229f1dc049754024c4a44
- SHA1 abf5e56ea5332a8a9afed88c4e7a2976bcbb3311
- SHA512 7c580c80809b9fe8023d09f3dd449f0caa82316856ddf9a4f8064c427417fa15a083c73953b4d6f51e4824ffaeab674d0ee8c8bab0bf1e54ba8c1e638f0098bd
- TLSH T1BE119E42350F9311865295C18B3E11E24D8F085F2B0F6D97B02BC57623BEBA1E6FD2A4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\JP Software\Take Command 14.0 14.01.33\install\264BD79\tcchere.btm
- Size 1KB
- SHA256 a6789e5051b7f111506027001cc5c87ffead64a8186a8f4903e1c1c0da77fc45
- MD5 98dc716f8c51bb1599cf210de656703f
- SHA1 2fc4a38724dbbdce82399d572d65c6ca7deaac2a
- SHA512 798b2d5b4ed7300940a905c5e6cd0ecff362f96663ba0df52c800a29940ef82d436c1ab98d8e77698d66f43aed0db09db53e382715918abdc6e877d5c8a6ca92
- TLSH T1E021CE21F1178B60A5A98041162F3923F547C25B3E528E13B23BB3714BEC9C2A5F8496
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\JP Software\Take Command 14.0 14.01.33\install\264BD79\tcmd.chm
- Size 3.3MB
- SHA256 e761fc2f7697287c43cb765ba1eec1df25ebc7a313a8b5c1d039baba813912ab
- MD5 3e04e8f4da065d54b84c385f28537acf
- SHA1 d9646eb9632b27e01f2abc407fe22e05a7d8062a
- SHA512 a338b25c4045e2ac28fb45b6c5893f3ac480790c15e0d77042a3cd2adaea60e91b38a36d9377511618392b4867c8f9d912f9832070e054cc30410f234ec0f187
- SSDEEP 98304:AXkdy0ePIDFVqGosM5qga4EvXl4+sb6BUnui4TUR:AUvDFVqGoUga4EflI44
- TLSH T1BBF533900BB2B283C6FDE67A9C073A666F696C9AF5E03023DE4E44D838E1F1151757D2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\JP Software\Take Command 14.0 14.01.33\install\264BD79\tcmd.exe
- Size 3.8MB
- SHA256 295ce43c84188a30420ce1ea6fb93f1698958561865762ef7481c596a1e40862
- MD5 9a9295635ac2826c0c02fcf2b69e5acd
- SHA1 ce50fdcf44db5f88deb684df54d7f5277ef6e34e
- SHA512 cb20484ac36a75f9a201477602a3618c424a1f1ee390eb641e1b1934aec1c8f1e1e580cf3def8e7c0b6c459647a16fb5922492893018f49547da963f84462684
- SSDEEP 98304:rDi/nyNkp9hSaGt+5zgAfx306VlkDv0WsnXl/diQA7:K/pG6fCJTzsnXl0h
- TLSH T19F06BF207B918175E6B331728D7E672EA56DEA750B3942C715D42E3E2E302C3AE35327
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\JP Software\Take Command 14.0 14.01.33\install\264BD79\tcmd.msi
- Size 1.2MB
- SHA256 c8734d26ad335a2c0eb0c061703b2950f71c922af31d2ae395b89c3046209b25
- MD5 1a3cac6739fa1df21274644ca8590af6
- SHA1 8323f2d84ee48e64f47ae9cac698dcffc68da2f5
- SHA512 bd00ea5e8f530d9bb5eddb77ff7654cb7815aac730e1ed064b04bc03cd188bcb66b461d2db0e64c7b96349ce5be6c81baf473b47bcbea1195ed978945b28f14e
- SSDEEP 12288:vGFh3k3znw0GETpTeoIVUQ50/ltTaW1sVFlSmF6e646XIker55:vGFuwtETpTeoIVw/TP1ComF64QIked
- TLSH T1E445AE51BA989611D0820375F603E387AAB5EC708E89901754DBBB2F2FFB5E463674C3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\JP Software\Take Command 14.0 14.01.33\install\264BD79\textpipeengine.dll
- Size 5.9MB
- SHA256 acb0e2b35a52f925982c8cc2cf54b2c9eef709569033f866d6b10fdd10b77785
- MD5 fa71ae37e8d0c11c6bc74d6b48a0f92b
- SHA1 ca2738dfe59049c1ce6606fe9915bc31e694d6d5
- SHA512 9267db907992cb1e54b5564bfbd99869966eaeb09efbbbb97ca37aa454470740ed78dec7d4986b8e926a5fcd9fd31df5932f2a66ddf1e514ba0f134cb25092f3
- SSDEEP 98304:/VbP2RL8dflTocuewNsag0FjljrmNw79p:NbeWtTQNlBlrmNwBp
- TLSH T1CD569D12F7818E33C26317788D6797E99A3AFE106F24A55B37B53E4C6F7A2517810283
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\JP Software\Take Command 14.0 14.01.33\install\264BD79\v.chm
- Size 360KB
- SHA256 d1c68cfc2c867680dece8d43298796185704633666a939b7cc8a80e962ccbb7f
- MD5 d55c1ea2c678a3c267beaa3c8e566663
- SHA1 58d7993d5d5c37fb196d10912153e5f5ad8d3cd6
- SHA512 08b1a02db00f381dbbaef19f19fa03497241ef058be50dd7c62201438b3efb57d4186461b43ff287a3ba4a6f9c1f4fcc83cdf433bc7362a50cf836a74d621006
- SSDEEP 6144:cBiAZkECmkqiLSOQmuM7sm2hgl4agRxD2IgWjanoqkcL4gFS1qgNS5IfpCtjJiO:QkCsrygWljaoHcLrFS1qmf0t1iO
- TLSH T1747423DDCD386627E5692D305AC13512BA130BAEAF0572CBE0BFA560C461FAF7058DB4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\JP Software\Take Command 14.0 14.01.33\install\decoder.dll
- Size 120KB
- SHA256 e4e59e0fe1f48e03fa9222b515d1db2165676beddcff23ff352d7dc67e2ec1b9
- MD5 501c773c7ea349232ca73653074e1b7b
- SHA1 962252750f1a1e02fe43700596336a636bdab2df
- SHA512 e4198be3039f24b9a4c9c42dc104804029c53d04a8f08ec0a77baea362d7bbc8e919de013a63422ab9680fb6a77889db447d9aa26238fec887fa52339977184c
- SSDEEP 3072:1HLohTAI0NkxvLIe9R7Lw1Uz63MrWlhm+V:Fo+5yxzIebLXe
- TLSH T1D6C39E3133C1C072F11F113E8806E7B99B6F7AA1C9A09A8B7FA40A655F35291DF39356
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI556A.tmp
- Size 8KB
- SHA256 44a2097eae69367d4f735063e1af66362ecea0f549f4d8899de595c8e9a31252
- MD5 757c809626337ec5d49b6d42f45bdca4
- SHA1 86347293eed37e56024e32f75fb0f679f0de9e1d
- SHA512 73ab1c86a9987ccc76e8772aafe1183d83a7306954ad860b515a2b4214a5b27de21450a7da8a4466b6b544d2402160b759d7474efa7eaf9eecb2e191189f8963
- SSDEEP 96:1yemR7f9zHPZroueTE+my84qR4wEz7yMhtjv9cUoB6pNu7+woa4NO4wB:1kR7RHWue/8uyMrj6Pou7+woa4NkB
- TLSH T14A024A870B142660D5E14EB121BEDC838D71B3E16BE2DD6E69A6C1D23DC13F7211C25E
- MD5 SHA1 SHA512 SSDEEP TLSH