Analysis
- user interaction
yes - max time kernel
475s - max time network
427s - platform
windows11-21h2_x64 - resource
win11-20260911-en - resource tags
- submitted
26/09/2026, 17:48
General
- Target https://dl.thread-community.net/d/20260923/f36d52669761e9b9a69765631f254a33?exp=1790444997&sig=83bG324gAFddFWfxnKaoQpKDWuoQveYjAvtjU25cnlU&name=%5Bthread-community.com%5D+DarkCore+2.6.8+%5BTHREAD-20260923-125603-2WD6E9%5D.zip
- Sample260926-wdevtsycpa
Score
8/10
Malware Config
Signatures
- Downloads MZ/PE file 1 IoCs
- Modifies Windows Firewall 2 TTPs 4 IoCs
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 10 IoCs
- Loads dropped DLL 64 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 47 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service 1 TTPs 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 7 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 15 IoCs
- Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 12 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- Executes a command shell one-liner 1 TTPs 4 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 26 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 12 IoCs
- Modifies data under HKEY_USERS 3 IoCs
- Modifies registry class 64 IoCs
- Modifies registry key 1 TTPs 1 IoCs
- Modifies system certificate store 2 TTPs 6 IoCs
- NTFS ADS 4 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 6 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 32 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://dl.thread-community.net/d/20260923/f36d52669761e9b9a69765631f254a33?exp=1790444997&sig=83bG324gAFddFWfxnKaoQpKDWuoQveYjAvtjU25cnlU&name=%5Bthread-community.com%5D+DarkCore+2.6.8+%5BTHREAD-20260923-125603-2WD6E9%5D.zip1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x244,0x248,0x24c,0x240,0x258,0x7ffae30dc188,0x7ffae30dc194,0x7ffae30dc1a02⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1748,i,3222198491657330206,14936769876672503082,524288 --field-trial-handle=2132,i,16011242376671909563,11418562805752171031,262144 --variations-seed-version --mojo-platform-channel-handle=2172 /prefetch:112⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1528,i,13254478045935245218,5348643360294866698,262144 --field-trial-handle=2132,i,16011242376671909563,11418562805752171031,262144 --variations-seed-version --mojo-platform-channel-handle=2128 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2248,i,13818250086654540243,5111146103441644904,524288 --field-trial-handle=2132,i,16011242376671909563,11418562805752171031,262144 --variations-seed-version --mojo-platform-channel-handle=2952 /prefetch:132⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3512,i,17136063777982891232,17624894235161645462,2097152 --field-trial-handle=2132,i,16011242376671909563,11418562805752171031,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3516,i,8171663533266341288,16757299482220764651,2097152 --field-trial-handle=2132,i,16011242376671909563,11418562805752171031,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4040,i,7085244737896143520,12392385573041197693,2097152 --field-trial-handle=2132,i,16011242376671909563,11418562805752171031,262144 --variations-seed-version --mojo-platform-channel-handle=4104 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4064,i,9246225528745501935,2249512076088364059,2097152 --field-trial-handle=2132,i,16011242376671909563,11418562805752171031,262144 --variations-seed-version --mojo-platform-channel-handle=4148 /prefetch:92⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4084,i,13928102288435750126,17944100646094721401,2097152 --field-trial-handle=2132,i,16011242376671909563,11418562805752171031,262144 --variations-seed-version --mojo-platform-channel-handle=4160 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=1576,i,9047158832059167182,12599726305685253727,2097152 --field-trial-handle=2132,i,16011242376671909563,11418562805752171031,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:92⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5296,i,3320381734127954883,12544985564097411900,524288 --field-trial-handle=2132,i,16011242376671909563,11418562805752171031,262144 --variations-seed-version --mojo-platform-channel-handle=3828 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5304,i,2959823512157055608,6323477954645924258,524288 --field-trial-handle=2132,i,16011242376671909563,11418562805752171031,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5744,i,593923476793363980,7935834102813988454,524288 --field-trial-handle=2132,i,16011242376671909563,11418562805752171031,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5760,i,2012292232274663312,17028197722258838057,2097152 --field-trial-handle=2132,i,16011242376671909563,11418562805752171031,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6488,i,14450337451912326252,10608857593226119164,524288 --field-trial-handle=2132,i,16011242376671909563,11418562805752171031,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:142⤵
- NTFS ADS
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6488,i,11699573504299913214,4249308634465735305,524288 --field-trial-handle=2132,i,16011242376671909563,11418562805752171031,262144 --variations-seed-version --mojo-platform-channel-handle=6540 /prefetch:142⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.execookie_exporter.exe --cookie-json=11403⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6612,i,2082616947845249650,18038487725934552312,524288 --field-trial-handle=2132,i,16011242376671909563,11418562805752171031,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6612,i,2082616947845249650,18038487725934552312,524288 --field-trial-handle=2132,i,16011242376671909563,11418562805752171031,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3612,i,10341367645030369968,6944681819819138775,524288 --field-trial-handle=2132,i,16011242376671909563,11418562805752171031,262144 --variations-seed-version --mojo-platform-channel-handle=6716 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3860,i,4622453110085363671,10993629316713945632,524288 --field-trial-handle=2132,i,16011242376671909563,11418562805752171031,262144 --variations-seed-version --mojo-platform-channel-handle=3868 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4280,i,16590221270661838987,14395132225567261830,524288 --field-trial-handle=2132,i,16011242376671909563,11418562805752171031,262144 --variations-seed-version --mojo-platform-channel-handle=1532 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=992,i,12209077823905041592,17346269153834121443,524288 --field-trial-handle=2132,i,16011242376671909563,11418562805752171031,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3860,i,8678324736095693398,3785554332576430009,262144 --field-trial-handle=2132,i,16011242376671909563,11418562805752171031,262144 --variations-seed-version --mojo-platform-channel-handle=1576 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5956,i,12081439873770854615,15459426679214657343,524288 --field-trial-handle=2132,i,16011242376671909563,11418562805752171031,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7000,i,3785134578039558541,16690833752936885673,524288 --field-trial-handle=2132,i,16011242376671909563,11418562805752171031,262144 --variations-seed-version --mojo-platform-channel-handle=4112 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6716,i,17799581252466740326,12812379566988932879,524288 --field-trial-handle=2132,i,16011242376671909563,11418562805752171031,262144 --variations-seed-version --mojo-platform-channel-handle=2672 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=4388,i,10179388195964788680,18043173991297825374,2097152 --field-trial-handle=2132,i,16011242376671909563,11418562805752171031,262144 --variations-seed-version --mojo-platform-channel-handle=4072 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=4884,i,6131333862965149792,15151460009872872709,2097152 --field-trial-handle=2132,i,16011242376671909563,11418562805752171031,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=4056,i,4163435823451825725,9349481266799693129,2097152 --field-trial-handle=2132,i,16011242376671909563,11418562805752171031,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=6116,i,6121478743680378738,4483094502676633799,2097152 --field-trial-handle=2132,i,16011242376671909563,11418562805752171031,262144 --variations-seed-version --mojo-platform-channel-handle=3804 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=4172,i,9228968918372339756,13228939558711972263,2097152 --field-trial-handle=2132,i,16011242376671909563,11418562805752171031,262144 --variations-seed-version --mojo-platform-channel-handle=7296 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7512,i,7932816995188669712,3810931485380043236,524288 --field-trial-handle=2132,i,16011242376671909563,11418562805752171031,262144 --variations-seed-version --mojo-platform-channel-handle=7032 /prefetch:142⤵
- NTFS ADS
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=4064,i,16495921276969260391,4770168152181383889,2097152 --field-trial-handle=2132,i,16011242376671909563,11418562805752171031,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4948,i,14458012431480795028,11377611740012639853,524288 --field-trial-handle=2132,i,16011242376671909563,11418562805752171031,262144 --variations-seed-version --mojo-platform-channel-handle=7548 /prefetch:142⤵
- NTFS ADS
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=6524,i,2968011166150351717,10648192296404172041,2097152 --field-trial-handle=2132,i,16011242376671909563,11418562805752171031,262144 --variations-seed-version --mojo-platform-channel-handle=1436 /prefetch:12⤵
-
-
C:\Windows\System32\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\python-manager-26.3.msi"2⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\[thread-community.com] DarkCore 2.6.8 [THREAD-20260923-125603-2WD6E9].zip"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Downloads MZ/PE file
- Subvert Trust Controls: Mark-of-the-Web Bypass
- Checks processor information in registry
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1972 -prefsLen 27097 -prefMapHandle 1976 -prefMapSize 270279 -ipcHandle 2064 -initialChannelId {517086a9-8b6e-406a-a9d7-c972a56d6c01} -parentPid 4556 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4556" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2432 -prefsLen 27133 -prefMapHandle 2436 -prefMapSize 270279 -ipcHandle 2444 -initialChannelId {a1adb951-cc50-4f7a-b032-52544507f177} -parentPid 4556 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4556" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3928 -prefsLen 27274 -prefMapHandle 3932 -prefMapSize 270279 -jsInitHandle 3936 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3944 -initialChannelId {29d3e99f-8e60-4778-b1eb-2d0987900502} -parentPid 4556 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4556" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4104 -prefsLen 27274 -prefMapHandle 4108 -prefMapSize 270279 -ipcHandle 4152 -initialChannelId {1f71eb69-d26d-4025-ade1-7ccd7e301e53} -parentPid 4556 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4556" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4444 -prefsLen 34773 -prefMapHandle 4448 -prefMapSize 270279 -jsInitHandle 4452 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1032 -initialChannelId {9cd810cc-c02e-469e-84fb-3b3f460c3867} -parentPid 4556 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4556" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 3248 -prefsLen 35089 -prefMapHandle 3348 -prefMapSize 270279 -ipcHandle 4676 -initialChannelId {b63a886f-da6f-4f8b-a5d9-5659877c52e2} -parentPid 4556 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4556" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5556 -prefsLen 33031 -prefMapHandle 5560 -prefMapSize 270279 -jsInitHandle 5564 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5576 -initialChannelId {27c84533-190c-40ca-9671-84326f328bde} -parentPid 4556 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4556" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5728 -prefsLen 33031 -prefMapHandle 5724 -prefMapSize 270279 -jsInitHandle 5532 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5776 -initialChannelId {3250e549-2c06-479b-885a-226006ec5b03} -parentPid 4556 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4556" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5788 -prefsLen 33031 -prefMapHandle 5792 -prefMapSize 270279 -jsInitHandle 5796 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5804 -initialChannelId {3a33ee34-ae4b-452c-8750-c90ef696b38f} -parentPid 4556 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4556" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6044 -prefsLen 33071 -prefMapHandle 5708 -prefMapSize 270279 -jsInitHandle 5948 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5540 -initialChannelId {ac177006-7bbf-4de3-96e2-3b449e82bb66} -parentPid 4556 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4556" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5472 -prefsLen 33071 -prefMapHandle 5596 -prefMapSize 270279 -jsInitHandle 5676 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6132 -initialChannelId {e9049bb4-d30f-4999-8427-43663a17eb94} -parentPid 4556 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4556" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab3⤵
- Checks processor information in registry
-
-
C:\Users\Admin\Downloads\7z2603-x64.exe"C:\Users\Admin\Downloads\7z2603-x64.exe"3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Desktop\[thread-community.com] DarkCore 2.6.8 [THREAD-20260923-125603-2WD6E9].zip"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\DarkCore 2.6.8\Start DarkCore Offline.cmd" "1⤵
- Executes a command shell one-liner
-
C:\Windows\system32\where.exewhere py2⤵
-
-
C:\Windows\system32\where.exewhere python2⤵
-
-
C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exepython DarkCore_Offline.py2⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Desktop\DarkCore 2.6.8\Start DarkCore Offline.cmd"1⤵
- Executes a command shell one-liner
-
C:\Windows\system32\where.exewhere py2⤵
-
-
C:\Windows\system32\where.exewhere python2⤵
-
-
C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exepython DarkCore_Offline.py2⤵
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\DarkCore 2.6.8\HOW TO RUN.txt1⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"1⤵
-
C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exepython2⤵
-
-
C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exepython -m pip install cryptography2⤵
-
-
C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exepython -m pip install cryptography2⤵
-
-
C:\Users\Admin\Desktop\DarkCore 2.6.8\DarkCore.exe"C:\Users\Admin\Desktop\DarkCore 2.6.8\DarkCore.exe"1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\DarkCore 2.6.8\Start DarkCore Offline.cmd" "1⤵
- Executes a command shell one-liner
-
C:\Windows\system32\where.exewhere py2⤵
-
-
C:\Windows\system32\where.exewhere python2⤵
-
-
C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exepython DarkCore_Offline.py2⤵
-
-
C:\Windows\System32\NOTEPAD.EXE"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Desktop\DarkCore 2.6.8\Start DarkCore Offline.cmd1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"1⤵
-
C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exepython darkcore_offline.py2⤵
-
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument microsoft-edge:?url=https%3A%2F%2Fwww.bing.com%2Fsearch%3Fq%3Dpython%26filters%3Dufn%253a%2522Python%2B(programming%2Blanguage)%2522%2Bsid%253a%2522e65d3762-dcc6-13d6-cc71-5e09b7526398%2522%26asbe%3DEP%26form%3DWSBEDG%26qs%3DMB%26cvid%3D524c2bd6b64c481f9c9101e34759f2d2%26pq%3Dpython%26cc%3DUS%26setlang%3Den-US%26nclid%3D27D1B62FE4572B22A5EBD60C589994E5%26ts%3D1790445133723%26nclidts%3D1790445133%26tsms%3D723%26wsso%3DModerate%26PC%3DWSBQUF×tamp=1790445133723&source=WindowsSearchBox&campaign=addedgeprot&medium=AutoSuggest1⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 27748426F50CD927CE05AEA70DDD2FD8 C2⤵
- Loads dropped DLL
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding BEDCC77D111079C520E0264FB8BE2F8E2⤵
- Loads dropped DLL
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"1⤵
-
C:\Program Files\PyManager\python.exepython2⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Modifies system certificate store
-
C:\Users\Admin\AppData\Local\Python\pythoncore-3.14-64\python.exe"C:\Users\Admin\AppData\Local\Python\pythoncore-3.14-64\python.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
C:\Program Files\PyManager\py.exepy -m pip install cryptography2⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Python\pythoncore-3.14-64\python.exe"C:\Users\Admin\AppData\Local\Python\pythoncore-3.14-64\python.exe" -m pip install cryptography3⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Modifies system certificate store
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\DarkCore 2.6.8\Start DarkCore Offline.cmd" "1⤵
- Executes a command shell one-liner
-
C:\Windows\system32\where.exewhere py2⤵
-
-
C:\Program Files\PyManager\py.exepy DarkCore_Offline.py2⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Python\pythoncore-3.14-64\python.exe"C:\Users\Admin\AppData\Local\Python\pythoncore-3.14-64\python.exe" DarkCore_Offline.py3⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Enumerates system info in registry
-
C:\Windows\SYSTEM32\reg.exereg add HKCU\Software\DarkCore /v EulaAcceptedV1 /t REG_SZ /d 1 /f4⤵
- Modifies registry key
-
-
C:\Users\Admin\Desktop\DarkCore 2.6.8\DarkCore.exe"C:\Users\Admin\Desktop\DarkCore 2.6.8\DarkCore.exe"4⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Reads the TCP/IP host and domain name from the registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SYSTEM32\netsh.exenetsh advfirewall firewall delete rule name="DarkCore listen TCP 43592"5⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SYSTEM32\netsh.exenetsh advfirewall firewall add rule name="DarkCore listen TCP 43592" dir=in action=allow protocol=TCP localport=43592 profile=any enable=yes5⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SYSTEM32\netsh.exenetsh advfirewall firewall delete rule name="DarkCore app inbound"5⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SYSTEM32\netsh.exenetsh advfirewall firewall add rule name="DarkCore app inbound" dir=in action=allow program="C:\Users\Admin\Desktop\DarkCore 2.6.8\DarkCore.exe" protocol=TCP profile=any enable=yes5⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
2Component Object Model Hijacking
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
2Component Object Model Hijacking
1Netsh Helper DLL
1Defense Evasion
Debugger Evasion
1Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
2Subvert Trust Controls
2Install Root Certificate
1SIP and Trust Provider Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
e5cee21.rbs
7z.dll
7zFM.exe
5A6896595A9B5FF7A8254147F2B2367B
77003E887FC21E505B9E28CBA30E18ED_8ACE642DC0A43382FABA7AE806561A50
EF7234CDBB1649702229F955C785C39F
5A6896595A9B5FF7A8254147F2B2367B
77003E887FC21E505B9E28CBA30E18ED_8ACE642DC0A43382FABA7AE806561A50
EF7234CDBB1649702229F955C785C39F
settings.dat
settings.dat
settings.dat
LOG.old
f_00006c
f_00007b
f_00007c
the-real-index
the-real-index
the-real-index~RFe58d3b6.TMP
data_1
Edge Profile.ico
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Sdch Dictionaries~RFe5c7a29.TMP
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
OperationConfig
OperationConfig~RFe596d18.TMP
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
RevisitationBloomfilter
RevisitationBloomfilter~RFe5c9a63.TMP
7418b3c0-ce9b-4f37-8b05-479479214ce7.tmp
AILog.txt
AILog.txt
AILog.txt
AILog.txt
AILog.txt
AILog.txt
AILog.txt
python.exe.__target__
python3.14.exe
pythonw.exe.__target__
pythonw3.14.exe
__init__.py
_cffi_gen_src.py
_imp_emulation.py
_shimmed_dist_utils.py
api.py
backend_ctypes.py
cffi_opcode.py
commontypes.py
cparser.py
error.py
ffiplatform.py
gen_src.py
lock.py
model.py
pkgconfig.py
recompiler.py
setuptools_ext.py
vengine_cpy.py
vengine_gen.py
verifier.py
__about__.py
__init__.py
cobblestone.py
exceptions.py
fernet.py
__init__.py
_oid.py
__init__.py
asn1.py
__init__.py
__init__.py
backend.py
_conditional.py
binding.py
algorithms.py
modes.py
__init__.py
_asymmetric.py
_cipheralgorithm.py
_modes.py
_serialization.py
dh.py
dsa.py
ec.py
ed25519.py
ed448.py
mldsa.py
mlkem.py
padding.py
rsa.py
types.py
utils.py
x25519.py
x448.py
__init__.py
aead.py
algorithms.py
base.py
modes.py
cmac.py
constant_time.py
hashes.py
hmac.py
hpke.py
__init__.py
argon2.py
concatkdf.py
hkdf.py
kbkdf.py
pbkdf2.py
scrypt.py
x963kdf.py
keywrap.py
padding.py
poly1305.py
__init__.py
base.py
pkcs12.py
pkcs7.py
ssh.py
__init__.py
hotp.py
totp.py
utils.py
__init__.py
base.py
certificate_transparency.py
extensions.py
general_name.py
name.py
ocsp.py
oid.py
verification.py
LICENSE.APACHE
LICENSE
INSTALLER
__init__.py
_ast_gen.py
ast_transforms.py
c_ast.py
c_generator.py
c_lexer.py
c_parser.py
python.exe
pythonw.exe
MSIAF62.tmp
cffi-2.1.1-cp314-cp314-win_amd64.whl.metadata
cryptography-50.0.1-cp311-abi3-win_amd64.whl.metadata
pycparser-3.0-py3-none-any.whl.metadata
cffi-2.1.1-cp314-cp314-win_amd64.whl
cryptography-50.0.1-cp311-abi3-win_amd64.whl
pycparser-3.0-py3-none-any.whl
index.json.cat
AlternateServices.bin
AlternateServices.bin
data.safe.tmp
data.safe.tmp
events
437975d8-5142-4f64-900b-cd0cd7ed8edf
51a96d9e-ee3b-4399-982b-cb1da928a5be
9741ba48-773e-42d9-8bbf-4241e3b503bd
a91c5028-8808-4852-8216-f7768e7d5a28
af58677d-f6cb-4595-ba03-0b57a794bc32
c798274d-803c-4083-91b0-52f16eaf3066
c7b1aa41-5074-41cc-ba43-20744bcac001
prefs-1.js
prefs.js
prefs.js
prefs.js
prefs.js
sessionCheckpoints.json.tmp
3870112724rsegmnoittet-es.sqlite
vlc-qt-interface.ini
vlc-qt-interface.ini
vlc-qt-interface.ini
vlc-qt-interface.ini.lock
DarkCore.exe
DarkCore_Offline.py
HOW TO RUN.txt
Start DarkCore Offline.cmd
darkcore.cfg
darkcore.pub
darkcore_mod.log
darkcore_mod.log
manifest.local.json
7z2603-x64.LN5NnIfl.exe.part
7z2603-x64.exe:Zone.Identifier
[thread-community.com] DarkCore 2.6.8 [THREAD-20260923-125603-2WD6E9].zip
[thread-community.com] DarkCore 2.6.8 [THREAD-20260923-125603-2WD6E9].zip:Zone.Identifier
python-manager-26.3.msi.crdownload
python-manager-26.3.msi:Zone.Identifier
python-manager-26.3.msix:Zone.Identifier
memory/3248-1275-0x00007FFAE0A90000-0x00007FFAE0D46000-memory.dmp
memory/3248-1274-0x00007FFAE74E0000-0x00007FFAE7514000-memory.dmp
memory/3248-245-0x00007FF7EE850000-0x00007FF7EE948000-memory.dmp
memory/3248-252-0x00007FFAE0180000-0x00007FFAE0510000-memory.dmp
memory/3248-250-0x00007FFAE05C0000-0x00007FFAE05E2000-memory.dmp
memory/3248-259-0x00007FFADF9E0000-0x00007FFADFA21000-memory.dmp
memory/3248-251-0x00007FFAE0590000-0x00007FFAE05BB000-memory.dmp
memory/3248-256-0x00007FFADFB20000-0x00007FFADFDB6000-memory.dmp
memory/3248-249-0x00007FFAE06D0000-0x00007FFAE06E9000-memory.dmp
memory/3248-248-0x00007FFAF25A0000-0x00007FFAF25B1000-memory.dmp
memory/3248-247-0x00007FFAE0A90000-0x00007FFAE0D46000-memory.dmp
memory/3248-254-0x00007FFAE0550000-0x00007FFAE0561000-memory.dmp
memory/3248-255-0x00007FFAE00A0000-0x00007FFAE0172000-memory.dmp
memory/3248-253-0x00007FFAE0570000-0x00007FFAE0584000-memory.dmp
memory/3248-258-0x00007FFADFA30000-0x00007FFADFB13000-memory.dmp
memory/3248-246-0x00007FFAE74E0000-0x00007FFAE7514000-memory.dmp
memory/3248-257-0x00007FFADFFB0000-0x00007FFAE0098000-memory.dmp
memory/3248-1273-0x00007FF7EE850000-0x00007FF7EE948000-memory.dmp
memory/3248-266-0x00007FFADF8D0000-0x00007FFADF8E1000-memory.dmp
memory/3248-270-0x00007FFADF7B0000-0x00007FFADF7D5000-memory.dmp
memory/3248-271-0x00007FFAD4EB0000-0x00007FFAD50F5000-memory.dmp
memory/3248-268-0x00007FFADF830000-0x00007FFADF8C8000-memory.dmp
memory/3248-267-0x0000011BEA180000-0x0000011BEA38B000-memory.dmp
memory/3248-269-0x00007FFADF7E0000-0x00007FFADF82F000-memory.dmp
memory/3248-265-0x00007FFADF8F0000-0x00007FFADF901000-memory.dmp
memory/3248-264-0x00007FFADF910000-0x00007FFADF92A000-memory.dmp
memory/3248-263-0x00007FFADF930000-0x00007FFADF95D000-memory.dmp
memory/3248-260-0x00007FFADF9B0000-0x00007FFADF9DF000-memory.dmp
memory/3248-262-0x00007FFADF960000-0x00007FFADF986000-memory.dmp
memory/3248-261-0x00007FFADF990000-0x00007FFADF9A8000-memory.dmp
memory/4988-2266-0x00000196A2B80000-0x00000196A3642000-memory.dmp
memory/9048-10235-0x000002D202A60000-0x000002D202A7B000-memory.dmp
memory/9048-10209-0x000002D202420000-0x000002D202454000-memory.dmp
memory/9048-10232-0x000002D2029E0000-0x000002D202A13000-memory.dmp
memory/9048-10230-0x000002D202980000-0x000002D2029AD000-memory.dmp
memory/9048-10229-0x000002D202770000-0x000002D20279B000-memory.dmp
memory/9048-10227-0x000002D202710000-0x000002D202735000-memory.dmp
memory/9048-10226-0x000002D2026E0000-0x000002D202702000-memory.dmp
memory/9048-10224-0x000002D2026A0000-0x000002D2026BD000-memory.dmp
memory/9048-10223-0x000002D202680000-0x000002D20269A000-memory.dmp
memory/9048-10221-0x000002D202640000-0x000002D202655000-memory.dmp
memory/9048-10220-0x000002D202600000-0x000002D202632000-memory.dmp
memory/9048-10218-0x000002D2025A0000-0x000002D2025CC000-memory.dmp
memory/9048-10217-0x000002D202570000-0x000002D20259A000-memory.dmp
memory/9048-10215-0x000002D202510000-0x000002D202534000-memory.dmp
memory/9048-10214-0x000002D2024E0000-0x000002D202501000-memory.dmp
memory/9048-10212-0x000002D2024A0000-0x000002D2024BC000-memory.dmp
memory/9048-10211-0x000002D202480000-0x000002D202499000-memory.dmp
memory/9048-10233-0x000002D202A20000-0x000002D202A36000-memory.dmp
memory/9048-10208-0x000002D2023E0000-0x000002D202411000-memory.dmp
memory/9048-10205-0x000002D202350000-0x000002D202379000-memory.dmp
memory/9048-10203-0x000002D2022F0000-0x000002D202313000-memory.dmp
memory/9048-10202-0x000002D2022D0000-0x000002D2022F0000-memory.dmp
memory/9048-10200-0x000002D202290000-0x000002D2022AB000-memory.dmp
memory/9048-10199-0x000002D202270000-0x000002D202288000-memory.dmp
memory/9048-10197-0x000002D202210000-0x000002D202243000-memory.dmp
memory/9048-10194-0x000002D202180000-0x000002D2021AA000-memory.dmp
memory/9048-10191-0x000002D2020F0000-0x000002D202112000-memory.dmp
memory/9048-10190-0x000002D2020D0000-0x000002D2020EF000-memory.dmp
memory/9048-10188-0x000002D202090000-0x000002D2020AA000-memory.dmp
memory/9048-10187-0x000002D202070000-0x000002D202087000-memory.dmp
memory/9048-10206-0x000002D202380000-0x000002D2023AB000-memory.dmp
memory/9048-10196-0x000002D2021E0000-0x000002D202210000-memory.dmp
memory/9048-10193-0x000002D202150000-0x000002D202178000-memory.dmp