Analysis

  • user interaction
    yes
  • max time kernel
    73s
  • max time network
    70s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    18/10/2026, 15:24

General

  • Target
    enigma64_7.40_20230424.exe
  • Size 28.3MB
  • Sample261018-stem8afx9v
  • SHA256 41b6ff7d305bd14f7b282e63dc356eab766e64ace3a0eb1074076fa6f4fd3980
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 64 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

  • Modifies registry class 10 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\enigma64_7.40_20230424.exe
    "C:\Users\Admin\AppData\Local\Temp\enigma64_7.40_20230424.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3952
    • C:\Users\Admin\AppData\Local\Temp\is-4RJ94.tmp\enigma64_7.40_20230424.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-4RJ94.tmp\enigma64_7.40_20230424.tmp" /SL5="$60228,29388718,56832,C:\Users\Admin\AppData\Local\Temp\enigma64_7.40_20230424.exe"
      2⤵
      • Drops file in Program Files directory
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:4376
      • C:\Program Files (x86)\The Enigma Protector\Enigma64g.exe
        "C:\Program Files (x86)\The Enigma Protector\Enigma64g.exe"
        3⤵
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:3104
  • C:\Program Files (x86)\The Enigma Protector\Enigma64g.exe
    "C:\Program Files (x86)\The Enigma Protector\Enigma64g.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Executes dropped EXE
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:5080

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Enigma64g.exe

        • Path C:\Program Files (x86)\The Enigma Protector\Enigma64g.exe
        • Size 11.4MB
        • SHA256 e49ab864acde70690c0a182fb4548117330f103c4fcce02e8b14083b1586e834
        • MD5 SHA1 SHA512 SSDEEP TLSH

        is-AJM3B.tmp

        • Path C:\Program Files (x86)\The Enigma Protector\EnigmaPluginsSDK\Delphi\is-AJM3B.tmp
        • Size 6KB
        • SHA256 d5d06b6b4163f62d46e9eecff378ca56be82c4baea6bc8e8c9f92681ab69700d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        is-OV6IG.tmp

        • Path C:\Program Files (x86)\The Enigma Protector\EnigmaPluginsSDK\FPCx64\is-OV6IG.tmp
        • Size 2KB
        • SHA256 5b5a94929b3ff2c02099b75a9a877b56e4c48603f3447eb97d7781977e6908e2
        • MD5 SHA1 SHA512 TLSH

        keygen.dll

        • Path C:\Program Files (x86)\The Enigma Protector\EnigmaSDK\Bcb\keygen.dll
        • Size 451KB
        • SHA256 afadd5da0d68b98519dd38c3341768b60da785c381fc22bf98e6e0f11f0a0b48
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Enigma_IDE.cs

        • Path C:\Program Files (x86)\The Enigma Protector\EnigmaSDK\C# (.NET)\Enigma_IDE.cs
        • Size 39KB
        • SHA256 fa4c78ab772489427c9d469cc0a2e330ab2e31889df1af21d0966caac7895a65
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Enigma_KeyGen_IDE.cs

        • Path C:\Program Files (x86)\The Enigma Protector\EnigmaSDK\C# (.NET)\Enigma_KeyGen_IDE.cs
        • Size 36KB
        • SHA256 1440ad81ae334b59561622af242a67320d8c63f8618053335d66fdb1c25779b0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Enigma_KeyGen_IDE64.cs

        • Path C:\Program Files (x86)\The Enigma Protector\EnigmaSDK\C# x64 (.NET)\Enigma_KeyGen_IDE64.cs
        • Size 35KB
        • SHA256 4e6f6fde75da49460aecb8a389805e34265c4094412a284bc1f64d4ecf820b66
        • MD5 SHA1 SHA512 SSDEEP TLSH

        keygen

        • Path C:\Program Files (x86)\The Enigma Protector\EnigmaSDK\CGI Keygen\Linux\keygen
        • Size 439KB
        • SHA256 8d1f99c342ab84dafbd39c6f7a6105e1d7da7c5096f0a357be5deb08ddf9b768
        • MD5 SHA1 SHA512 SSDEEP TLSH

        keygen64

        • Path C:\Program Files (x86)\The Enigma Protector\EnigmaSDK\CGI Keygen\Linux\keygen64
        • Size 1.3MB
        • SHA256 9ac265d659bb736dc466a3bf1b27e78ee9768050b4a813a82fa0c7977c7f87c0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        keygen.exe

        • Path C:\Program Files (x86)\The Enigma Protector\EnigmaSDK\CGI Keygen\Windows\keygen.exe
        • Size 450KB
        • SHA256 3ff23a87a3a97a2e84fc4df2711d5f7cfec0c31f873634456b2ce4aec7687545
        • MD5 SHA1 SHA512 SSDEEP TLSH

        keygen64.exe

        • Path C:\Program Files (x86)\The Enigma Protector\EnigmaSDK\CGI Keygen\Windows\keygen64.exe
        • Size 611KB
        • SHA256 16faa1dae562f76fa97b67efbe190b47112ff122c388e9771e5a19537e76b748
        • MD5 SHA1 SHA512 SSDEEP TLSH

        keygen64.dll

        • Path C:\Program Files (x86)\The Enigma Protector\EnigmaSDK\FPCx64\keygen64.dll
        • Size 831KB
        • SHA256 98b8059b7364049779c2da49f2b40be2717f77ff43ed2efab23e226bf4a38683
        • MD5 SHA1 SHA512 SSDEEP TLSH

        enigma_ide.h

        • Path C:\Program Files (x86)\The Enigma Protector\EnigmaSDK\VC\enigma_ide.h
        • Size 25KB
        • SHA256 60d873f3777b3a7bfdce0c5fa78029ad0381238da3a47f892f08f6a76158d0bc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        enigma_ide.lib

        • Path C:\Program Files (x86)\The Enigma Protector\EnigmaSDK\VC\enigma_ide.lib
        • Size 24KB
        • SHA256 d7faa2b745fd3c289a4ee83347dd10771269fc9f9435fb99f7a6c8534b57c69f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        enigma_ide64.lib

        • Path C:\Program Files (x86)\The Enigma Protector\EnigmaSDK\VC\enigma_ide64.lib
        • Size 22KB
        • SHA256 e8122202849835b262c9c48d57c644a401b278cfa4d6b4169216ec458f6fac23
        • MD5 SHA1 SHA512 SSDEEP TLSH

        keygen.lib

        • Path C:\Program Files (x86)\The Enigma Protector\EnigmaSDK\VC\keygen.lib
        • Size 5KB
        • SHA256 da0c232285d2f89e6eed134c1cf6d5da5c29068f8aa05ab9e091885b84cceec7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        keygen64.lib

        • Path C:\Program Files (x86)\The Enigma Protector\EnigmaSDK\VC\keygen64.lib
        • Size 4KB
        • SHA256 58ec2d2bfa9c063952f3c7afb119f39c2b2cf4011e881f9cb71b58ce24ed6b9d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Enigma_IDE.vb

        • Path C:\Program Files (x86)\The Enigma Protector\EnigmaSDK\Visual Basic (.NET)\Enigma_IDE.vb
        • Size 39KB
        • SHA256 18ed6c08b4e489b9bb6135d259e0f160cb0fbff2cdf4b83027d699409f9b6054
        • MD5 SHA1 SHA512 SSDEEP TLSH

        is-KQS3B.tmp

        • Path C:\Program Files (x86)\The Enigma Protector\Examples\CheckEnigma\Delphi\is-KQS3B.tmp
        • Size 56KB
        • SHA256 6fa7f44d197ec5ab0c15bc41cb6775a1bf7eae925c445c2cf56c67cb85b76508
        • MD5 SHA1 SHA512 SSDEEP TLSH

        is-3RKMU.tmp

        • Path C:\Program Files (x86)\The Enigma Protector\Examples\ExecutedCopies\Bcb\is-3RKMU.tmp
        • Size 205B
        • SHA256 2455017bfd56d2e1ef42ee81e7d78752fa4ae5a26124208d6cd8c4e734da8db7
        • MD5 SHA1 SHA512 TLSH

        is-MJJ4R.tmp

        • Path C:\Program Files (x86)\The Enigma Protector\Examples\ExecutedCopies\Bcb\is-MJJ4R.tmp
        • Size 2KB
        • SHA256 c345bf64b112ef6f5b516a2e6d0c37e29922b16cc232f1d65982e4bc987cfc02
        • MD5 SHA1 SHA512 TLSH

        is-O8U79.tmp

        • Path C:\Program Files (x86)\The Enigma Protector\Examples\ExecutedCopies\Delphi\is-O8U79.tmp
        • Size 56KB
        • SHA256 c288a8c25868b591015f8e72b08522956ef55340f64fa5352ddcb19cca70c8ed
        • MD5 SHA1 SHA512 SSDEEP TLSH

        is-TTESR.tmp

        • Path C:\Program Files (x86)\The Enigma Protector\Examples\HardwareID\C# (.NET)\is-TTESR.tmp
        • Size 50KB
        • SHA256 f5581453919cf1a3001f23d1f72526161cba45b26436386b88eebd1f6572d29a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        is-RLINB.tmp

        • Path C:\Program Files (x86)\The Enigma Protector\Examples\HardwareID\Delphi\is-RLINB.tmp
        • Size 446B
        • SHA256 91502e94bd83b8803e91d20d1b231c112d65561f588b92e888982f7753374e8d
        • MD5 SHA1 SHA512 TLSH

        Test.csproj

        • Path C:\Program Files (x86)\The Enigma Protector\Examples\KeyExpiration\C# (.NET)\Test.csproj
        • Size 4KB
        • SHA256 d6a2c06eece0aa5ccbae48e9eef8398aad037b9ab4cebd3b52e212fd2ffd689d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        is-36J29.tmp

        • Path C:\Program Files (x86)\The Enigma Protector\Examples\KeyExpiration\C# (.NET)\is-36J29.tmp
        • Size 2KB
        • SHA256 c7c52c31b58c42bdf054e9376720c34bde2295ab2591f1e2662a9fdde822f91e
        • MD5 SHA1 SHA512 TLSH

        is-DPAJ8.tmp

        • Path C:\Program Files (x86)\The Enigma Protector\Examples\KeyExpiration\C# (.NET)\is-DPAJ8.tmp
        • Size 1KB
        • SHA256 09cb7569fccc14ec44ced9e3791b50bdfa134070772a0430c8d2514491580f91
        • MD5 SHA1 SHA512 TLSH

        is-L9IR4.tmp

        • Path C:\Program Files (x86)\The Enigma Protector\Examples\KeyExpiration\C# (.NET)\is-L9IR4.tmp
        • Size 15KB
        • SHA256 407ba667e3f6588106130f62335e9736e30ff407342774dd1706a10d544c37a3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        is-MTSHN.tmp

        • Path C:\Program Files (x86)\The Enigma Protector\Examples\KeyExpiration\C# (.NET)\is-MTSHN.tmp
        • Size 1KB
        • SHA256 382cd3997832491be248e19daf00e5881057c7a0818af23649341a2b97e12527
        • MD5 SHA1 SHA512 TLSH

        is-NHGOE.tmp

        • Path C:\Program Files (x86)\The Enigma Protector\Examples\KeyExpiration\C# (.NET)\is-NHGOE.tmp
        • Size 893B
        • SHA256 242e72d8748808e600abc2132e7c21239d2fe39edbb031a57580d187c13b3f86
        • MD5 SHA1 SHA512 TLSH

        is-BMARK.tmp

        • Path C:\Program Files (x86)\The Enigma Protector\Examples\KeyExpiration\Delphi\is-BMARK.tmp
        • Size 50KB
        • SHA256 cfba8d29e56298994fa09749c296b43cce0a02b7bf4b91f09e6659b4b8e95f7f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        is-POUK5.tmp

        • Path C:\Program Files (x86)\The Enigma Protector\Examples\KeyExpiration\Delphi\is-POUK5.tmp
        • Size 257B
        • SHA256 2cdf51fbb9c68bd3811aa616cf85d75db9f3b4e197a9761eb30f853f3b95b994
        • MD5 SHA1 SHA512 TLSH

        is-5K6RI.tmp

        • Path C:\Program Files (x86)\The Enigma Protector\Examples\KeyGenUnicode\C# (.NET)\is-5K6RI.tmp
        • Size 102KB
        • SHA256 1f5c0f25c9030903d4d513ecb9584e9d9f3e94e001d9061f368f08ca58285def
        • MD5 SHA1 SHA512 SSDEEP TLSH

        is-BMPOI.tmp

        • Path C:\Program Files (x86)\The Enigma Protector\Examples\KeyGenUnicode\C# (.NET)\is-BMPOI.tmp
        • Size 4KB
        • SHA256 c89eeb27b20d3111f89ec48411ab1edb97d8ae9f86778a5bcdcfd33b7552bed9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        is-RCBC6.tmp

        • Path C:\Program Files (x86)\The Enigma Protector\Examples\KeyGenUnicode\C# (.NET)\is-RCBC6.tmp
        • Size 1KB
        • SHA256 df5d2f49402b4cfcad7a6c586eeae1352b1e096dfa14fc0354032bd48feed3a5
        • MD5 SHA1 SHA512 TLSH

        is-7RIKS.tmp

        • Path C:\Program Files (x86)\The Enigma Protector\Examples\KeyGenUnicode\C# x64 (.NET)\is-7RIKS.tmp
        • Size 5KB
        • SHA256 4a478c685dcf646403a775231d95768f7042c44754f3ef4c6351d56cccb3a90a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        is-K34BF.tmp

        • Path C:\Program Files (x86)\The Enigma Protector\Examples\KeyGenUnicode\Delphi_2009UP\is-K34BF.tmp
        • Size 265B
        • SHA256 f3e9dc211755c57ed33609381026bb772c95a9669c1c492a40a64d9e1e07dafb
        • MD5 SHA1 SHA512 TLSH

        is-EQLUE.tmp

        • Path C:\Program Files (x86)\The Enigma Protector\Examples\KeyGenUnicode\VC\is-EQLUE.tmp
        • Size 1KB
        • SHA256 723c1284eda845af9620c9ebe1924971b07cabec9ae43ef422f3b552bc177291
        • MD5 SHA1 SHA512 TLSH

        is-KBB3T.tmp

        • Path C:\Program Files (x86)\The Enigma Protector\Examples\KeyGenUnicode\VC\is-KBB3T.tmp
        • Size 4KB
        • SHA256 438682eba86a38fe4e23c525154ca4a345094e7297dc6bc05755bce4c2d5918e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        is-MPGO8.tmp

        • Path C:\Program Files (x86)\The Enigma Protector\Examples\KeyGenUnicode\VC\is-MPGO8.tmp
        • Size 398B
        • SHA256 29be6f1ead66f56c539b87c578ec018af65b1c39320818ab944774cf4537e7e3
        • MD5 SHA1 SHA512 TLSH

        is-OQD79.tmp

        • Path C:\Program Files (x86)\The Enigma Protector\Examples\KeyGenUnicode\VC\is-OQD79.tmp
        • Size 1KB
        • SHA256 671cb012f54eec34061d28242ee01fa0490f7cc733e6737f6573f59c86bc86ae
        • MD5 SHA1 SHA512 TLSH

        is-QDH77.tmp

        • Path C:\Program Files (x86)\The Enigma Protector\Examples\KeyGenUnicode\VC\is-QDH77.tmp
        • Size 1KB
        • SHA256 3c88d1fd739a6214987f39e700355d148a07aa52fdd1bda01dd37be92d9c0a60
        • MD5 SHA1 SHA512 TLSH

        is-QPF8H.tmp

        • Path C:\Program Files (x86)\The Enigma Protector\Examples\KeyGenUnicode\VC\is-QPF8H.tmp
        • Size 208B
        • SHA256 cc58d716ed8de82d3feec0c9ec56073eaac478a140239139b5cd74ab595078db
        • MD5 SHA1 SHA512 TLSH

        is-R1BCL.tmp

        • Path C:\Program Files (x86)\The Enigma Protector\Examples\KeyGenUnicode\VC\is-R1BCL.tmp
        • Size 2KB
        • SHA256 a599423a4fb4ecc9456a9dc490ac978a80879f2088ada43d56bb098797798b03
        • MD5 SHA1 SHA512 TLSH

        is-T5FP8.tmp

        • Path C:\Program Files (x86)\The Enigma Protector\Examples\KeyGenUnicode\VC\is-T5FP8.tmp
        • Size 10KB
        • SHA256 59e5837721aa74add491bd67101f26f537e11202be13b5f9e463cebf35d5ca60
        • MD5 SHA1 SHA512 SSDEEP TLSH

        is-UA6CD.tmp

        • Path C:\Program Files (x86)\The Enigma Protector\Examples\KeyGenUnicode\VC\is-UA6CD.tmp
        • Size 3KB
        • SHA256 bdaf84d20b8042bfc7b01f64936cd586990f7ace1a713251aa9ab081a2b9f0c9
        • MD5 SHA1 SHA512 TLSH

        is-UQ6MD.tmp

        • Path C:\Program Files (x86)\The Enigma Protector\Examples\KeyGenUnicode\VC\is-UQ6MD.tmp
        • Size 535B
        • SHA256 1a1c1bdfa85acccccfb941f7509a310654d9905aeeec217f749962571a0a7aee
        • MD5 SHA1 SHA512 TLSH

        is-I6FRA.tmp

        • Path C:\Program Files (x86)\The Enigma Protector\Examples\KeyGen\Bcb\is-I6FRA.tmp
        • Size 876B
        • SHA256 c77d75b04887c4919cd3d10fb435c9649c283e8c886e49c9f4f027328af6f62c
        • MD5 SHA1 SHA512 TLSH

        is-TMKGT.tmp

        • Path C:\Program Files (x86)\The Enigma Protector\Examples\KeyGen\C# (.NET)\is-TMKGT.tmp
        • Size 50KB
        • SHA256 7e04ebc58b59931d98c8624734102365db593ef68527a966bff18ddca7d8119e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        is-HHEAT.tmp

        • Path C:\Program Files (x86)\The Enigma Protector\Examples\KeyGen\C# x64 (.NET)\is-HHEAT.tmp
        • Size 6KB
        • SHA256 fdedd586fdd029a9420deb586edc92cbb0857d3194f4dffde1398bf97c9e0f2b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        is-KVU77.tmp

        • Path C:\Program Files (x86)\The Enigma Protector\Examples\KeyGen\CGI Linux\is-KVU77.tmp
        • Size 4KB
        • SHA256 b022eb90373cda332251e0f37c41a8ff09dcec4be1515d3d572b5437edcdc07c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        is-8BBS0.tmp

        • Path C:\Program Files (x86)\The Enigma Protector\Examples\KeyGen\CGI Windows\is-8BBS0.tmp
        • Size 4KB
        • SHA256 3056d8b3327d1257b8460d65e3e4b01339687b5a8120e514f7ecb29ea79dad57
        • MD5 SHA1 SHA512 SSDEEP TLSH

        is-00395.tmp

        • Path C:\Program Files (x86)\The Enigma Protector\Examples\KeyGen\VC\is-00395.tmp
        • Size 1KB
        • SHA256 17d9ba10a2faf5620bd85df1b7691c1f1de2c29db33c3eef719c90d0d10aea94
        • MD5 SHA1 SHA512 TLSH

        is-7V8NK.tmp

        • Path C:\Program Files (x86)\The Enigma Protector\Examples\KeyInformation\C# (.NET)\Properties\is-7V8NK.tmp
        • Size 5KB
        • SHA256 66b5ebd1b0fc73f041ba669ce2184f6f471d5e3524efa34ca31233e9f5395262
        • MD5 SHA1 SHA512 SSDEEP TLSH

        is-H9SAQ.tmp

        • Path C:\Program Files (x86)\The Enigma Protector\Examples\KeyInformation\C# (.NET)\is-H9SAQ.tmp
        • Size 68KB
        • SHA256 f836d2a41c7b2d32b1fcc3f21da19db520a22bbf76390732bc7cde722c62c701
        • MD5 SHA1 SHA512 SSDEEP TLSH

        is-2QBQM.tmp

        • Path C:\Program Files (x86)\The Enigma Protector\Examples\KeyInformation\Visual C++\is-2QBQM.tmp
        • Size 1004B
        • SHA256 a5515e68d98dd13bbde844d13fa7431322733bcf8716eba5b65935730e22c90e
        • MD5 SHA1 SHA512 TLSH

        is-8HF7M.tmp

        • Path C:\Program Files (x86)\The Enigma Protector\Examples\KeyInformation\Visual C++\is-8HF7M.tmp
        • Size 206B
        • SHA256 a232c54aab00b8059a711b3920e966def527d6aadb56ee05cc0b5b5998cb4057
        • MD5 SHA1 SHA512 TLSH

        is-A5SPQ.tmp

        • Path C:\Program Files (x86)\The Enigma Protector\Examples\KeyInformation\Visual C++\is-A5SPQ.tmp
        • Size 999B
        • SHA256 b8cc45072e9812dc728b0f226fc621cb1c28d1d5cc2a3ae82e40a4f032d19340
        • MD5 SHA1 SHA512 TLSH

        is-A7JGN.tmp

        • Path C:\Program Files (x86)\The Enigma Protector\Examples\KeyInformation\Visual C++\is-A7JGN.tmp
        • Size 396B
        • SHA256 152b2cbfb3b65eeeee79b0f1ec220aa76447d99ce4ea62737c6fcaaf768c8fcc
        • MD5 SHA1 SHA512 TLSH

        is-B2JER.tmp

        • Path C:\Program Files (x86)\The Enigma Protector\Examples\KeyInformation\Visual C++\is-B2JER.tmp
        • Size 4KB
        • SHA256 40ac1d93356024ec28aea373f41c794017fd1ca137460eaf31674ad85ce6e3b8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        is-GVMCL.tmp

        • Path C:\Program Files (x86)\The Enigma Protector\Examples\KeyInformation\Visual C++\is-GVMCL.tmp
        • Size 531B
        • SHA256 8ad830c667866d7330f1fa8e96457d47aad897a07f3b894e6dc77cbf6aabe6a5
        • MD5 SHA1 SHA512 TLSH

        is-KFLEN.tmp

        • Path C:\Program Files (x86)\The Enigma Protector\Examples\KeyInformation\Visual C++\is-KFLEN.tmp
        • Size 1KB
        • SHA256 9848cb91625f913a0d2742d6436cb073c38fcbd037701ff8abc5d7e5d249acba
        • MD5 SHA1 SHA512 TLSH

        is-LEDK1.tmp

        • Path C:\Program Files (x86)\The Enigma Protector\Examples\KeyInformation\Visual C++\is-LEDK1.tmp
        • Size 1KB
        • SHA256 ede2dbfd057da189f7d0e5ff0482cd3cfb0bca0fadb76cea6aafc4e0232dd736
        • MD5 SHA1 SHA512 TLSH

        is-SP3PQ.tmp

        • Path C:\Program Files (x86)\The Enigma Protector\Examples\MarkersCheckProtection\Delphi\is-SP3PQ.tmp
        • Size 1KB
        • SHA256 e232278525caf7933972916470c59027b8ca62777f3b2c40856885741f58aab6
        • MD5 SHA1 SHA512 TLSH

        is-MDCUU.tmp

        • Path C:\Program Files (x86)\The Enigma Protector\Examples\MarkersCheckProtection\VB\is-MDCUU.tmp
        • Size 56KB
        • SHA256 9c5bf63fdc059a04325c8f6fa421501dd74db088fcfeb29f12849ac2f371f23b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        is-28HRK.tmp

        • Path C:\Program Files (x86)\The Enigma Protector\Examples\MarkersDecryptOnExecute\VB\is-28HRK.tmp
        • Size 49B
        • SHA256 dea4099af22744a8b1f52c5fc0915d9ebaeff7169e00df659575d4811dd1c0c9
        • MD5 SHA1 SHA512

        is-7HEDA.tmp

        • Path C:\Program Files (x86)\The Enigma Protector\Examples\MarkersDecryptOnExecute\VB\is-7HEDA.tmp
        • Size 50KB
        • SHA256 522d7e39497df71868b51dc58a6bb93fe71f280a311cc8dd5362c6655669fbd0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        is-FSA25.tmp

        • Path C:\Program Files (x86)\The Enigma Protector\Examples\MarkersRegCrypt\Simple\Delphi\is-FSA25.tmp
        • Size 50KB
        • SHA256 9775b6e04d3f3b9681433b6256141a581576fc92b564fbed2382232f011b88cd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        is-VAKNC.tmp

        • Path C:\Program Files (x86)\The Enigma Protector\Examples\MarkersRegCrypt\Simple\VB\is-VAKNC.tmp
        • Size 698B
        • SHA256 359c210882c329533991e5f93918813f77fa88669458a7ad80b438bf0bfe11a2
        • MD5 SHA1 SHA512 TLSH

        is-HCVLO.tmp

        • Path C:\Program Files (x86)\The Enigma Protector\Examples\MarkersRegCrypt\WithAPI\Delphi\is-HCVLO.tmp
        • Size 876B
        • SHA256 3870b5557969b6a92714d8f1e7670982a9b98dde13fab8b484cace8a432bd7f2
        • MD5 SHA1 SHA512 TLSH

        is-3B399.tmp

        • Path C:\Program Files (x86)\The Enigma Protector\Examples\MarkersUnprotect\VB\is-3B399.tmp
        • Size 50KB
        • SHA256 f06073bbb0b119b9aa828e59039782e16abe4c1860688a76fd165276f531d0d5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        is-FBMDH.tmp

        • Path C:\Program Files (x86)\The Enigma Protector\Examples\MarkersVMRISC\Delphi\is-FBMDH.tmp
        • Size 1KB
        • SHA256 4f7376eede0a787724d8407937ab6bb742324772e5d9cd1742bc5f2cf082420e
        • MD5 SHA1 SHA512 TLSH

        is-LOIA7.tmp

        • Path C:\Program Files (x86)\The Enigma Protector\Examples\MarkersVMRISC\Delphi\is-LOIA7.tmp
        • Size 472B
        • SHA256 c925fc7c4fa293f76bbf7b8c88f6ececc9e5aa4c1f854bb89d1f610edcb33eb7
        • MD5 SHA1 SHA512 TLSH

        is-7H003.tmp

        • Path C:\Program Files (x86)\The Enigma Protector\Examples\MarkersVM\Delphi\is-7H003.tmp
        • Size 2KB
        • SHA256 b9c5b97f555e6c6a2d5515f1e1e1defaf001ae0d0988ab8b53192dc38b1b2a88
        • MD5 SHA1 SHA512 TLSH

        is-FO8AJ.tmp

        • Path C:\Program Files (x86)\The Enigma Protector\Examples\MarkersVM\Delphi\is-FO8AJ.tmp
        • Size 1KB
        • SHA256 f3ec5d152d65a79885d9fd23b1f7e05dc4de05905d8180346a425b84c98e2edd
        • MD5 SHA1 SHA512 TLSH

        is-G4M74.tmp

        • Path C:\Program Files (x86)\The Enigma Protector\Examples\MarkersVM\Delphi\is-G4M74.tmp
        • Size 1KB
        • SHA256 b5ab68e94a16a680ec42304a2d0428b40eef9caaf2db8626f40470f7cdbe6e85
        • MD5 SHA1 SHA512 TLSH

        is-RT123.tmp

        • Path C:\Program Files (x86)\The Enigma Protector\Examples\MarkersVM\Delphi\is-RT123.tmp
        • Size 2KB
        • SHA256 d22705b79f2aa204235c83aa0abdc8c23f5e3f2ba5574bd78b2f9f0146c46941
        • MD5 SHA1 SHA512 TLSH

        is-TVVJ0.tmp

        • Path C:\Program Files (x86)\The Enigma Protector\Examples\MarkersVM\Delphi\is-TVVJ0.tmp
        • Size 1KB
        • SHA256 c1af627edd407ebb76dd85033e7b902afd4ae7cf74553dfbae54b5f799914590
        • MD5 SHA1 SHA512 TLSH

        is-HMCUA.tmp

        • Path C:\Program Files (x86)\The Enigma Protector\Examples\MarkersVM\VB\is-HMCUA.tmp
        • Size 698B
        • SHA256 4e7d94b2324de2b9bb99e3115f5ba26b97f96416f7f5220e633290fff79313ba
        • MD5 SHA1 SHA512 TLSH

        is-3714U.tmp

        • Path C:\Program Files (x86)\The Enigma Protector\Examples\ProtectedStrings\C# (.NET)\Properties\is-3714U.tmp
        • Size 249B
        • SHA256 f6a4290723520caddd934b8800319c7ca6cc7eeab647059ec89b7a13b1513265
        • MD5 SHA1 SHA512 TLSH

        is-RGTIT.tmp

        • Path C:\Program Files (x86)\The Enigma Protector\Examples\ProtectedStrings\C# (.NET)\is-RGTIT.tmp
        • Size 471B
        • SHA256 bc6b47344f88a8a3859e4138af876765ef92b85ba22d448a12338c75cc8ab62c
        • MD5 SHA1 SHA512 TLSH

        is-OM5GB.tmp

        • Path C:\Program Files (x86)\The Enigma Protector\Examples\ProtectedStrings\VB\is-OM5GB.tmp
        • Size 50KB
        • SHA256 0b68ca02ecc50d21135103f9103ea76918820894b2c0d61582c224dcf8657ae7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        is-L1ILG.tmp

        • Path C:\Program Files (x86)\The Enigma Protector\Examples\RegistrationShowDialog\Delphi\is-L1ILG.tmp
        • Size 253B
        • SHA256 72624f51ff8249428b4371312ef1a245610a2a470d7c57b295ff20365084a7cc
        • MD5 SHA1 SHA512 TLSH

        is-R0J0I.tmp

        • Path C:\Program Files (x86)\The Enigma Protector\Examples\RegistrationUnicode\C# (.NET)\is-R0J0I.tmp
        • Size 4KB
        • SHA256 0adfb0b149e50cb0ccac4e2e3780174018fab29b51bde005417c20bbf2017f55
        • MD5 SHA1 SHA512 SSDEEP TLSH

        is-SGB11.tmp

        • Path C:\Program Files (x86)\The Enigma Protector\Examples\RegistrationUnicode\C# (.NET)\is-SGB11.tmp
        • Size 1KB
        • SHA256 a5a1a3863ff5c0613fb387a23f52a56dcf62b9d61724adcbc9a5cd206e981051
        • MD5 SHA1 SHA512 TLSH

        is-8QV4J.tmp

        • Path C:\Program Files (x86)\The Enigma Protector\Examples\RegistrationUnicode\Delphi_2009UP\is-8QV4J.tmp
        • Size 71KB
        • SHA256 159d54161e4f7600baeca56b4464befdfbd55ea69a42be966e83cb7a0af8f66e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        is-CSL60.tmp

        • Path C:\Program Files (x86)\The Enigma Protector\Examples\RegistrationUnicode\Delphi_2009UP\is-CSL60.tmp
        • Size 4KB
        • SHA256 d2a0bdb6edd51db0922b9f7d0974a746e261ef3fa750927cf4252422e327f09f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        is-G4NSL.tmp

        • Path C:\Program Files (x86)\The Enigma Protector\Examples\RegistrationUnicode\Delphi_2009UP\is-G4NSL.tmp
        • Size 283B
        • SHA256 acd0b2be233fa6886ea8e151b48193f8c90b40d68b7b0424be3b760744bbdb1a
        • MD5 SHA1 SHA512 TLSH

        is-V0283.tmp

        • Path C:\Program Files (x86)\The Enigma Protector\Examples\RegistrationUnicode\VC\is-V0283.tmp
        • Size 1KB
        • SHA256 8f00ef604efaae30e0fdb2c29947e6d37351de85cb8c2bfe4afe31e3b3068d13
        • MD5 SHA1 SHA512 TLSH

        is-0SC4D.tmp

        • Path C:\Program Files (x86)\The Enigma Protector\Examples\Registration\Bcb\is-0SC4D.tmp
        • Size 1KB
        • SHA256 eec4f2729ee8884204f50ace62d09ea00d954b08afa7439649a2dfd2763a777b
        • MD5 SHA1 SHA512 TLSH

        is-77IK6.tmp

        • Path C:\Program Files (x86)\The Enigma Protector\Examples\Registration\Bcb\is-77IK6.tmp
        • Size 2KB
        • SHA256 900cf2c6f4773c87658afce36aaa24ab90faa267879f36c430fb767159989420
        • MD5 SHA1 SHA512 TLSH

        is-PQDK5.tmp

        • Path C:\Program Files (x86)\The Enigma Protector\Examples\Registration\Bcb\is-PQDK5.tmp
        • Size 2KB
        • SHA256 b88421c178cb1d7f85fa43e1c7a2ff4b2693a0bc4fa4273f723a10b97efeb029
        • MD5 SHA1 SHA512 TLSH

        is-RTMGE.tmp

        • Path C:\Program Files (x86)\The Enigma Protector\Examples\Registration\Bcb\is-RTMGE.tmp
        • Size 740B
        • SHA256 8d0dfe46ccf5e2f57c079a827801752bd61640731a3a5effd466e7959ef120cb
        • MD5 SHA1 SHA512 TLSH

        is-1SOSE.tmp

        • Path C:\Program Files (x86)\The Enigma Protector\Examples\Registration\C# (.NET)\is-1SOSE.tmp
        • Size 8KB
        • SHA256 604313ac7bf06172e3377f73b3adb97398c024f4121703cd7ccab59a1cb08ba2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        is-49MDL.tmp

        • Path C:\Program Files (x86)\The Enigma Protector\Examples\Registration\C# (.NET)\is-49MDL.tmp
        • Size 71KB
        • SHA256 fbe58edcb3cb73c80ba2f20f767c0b406721236e41b8cf72aed4a6047baa9502
        • MD5 SHA1 SHA512 SSDEEP TLSH

        is-7L7K8.tmp

        • Path C:\Program Files (x86)\The Enigma Protector\Examples\Registration\VC\is-7L7K8.tmp
        • Size 4KB
        • SHA256 7407cca9665a3ac16c5d35e9d105cff629ef322074b52b234f00513015ec48ba
        • MD5 SHA1 SHA512 SSDEEP TLSH

        is-QSEQE.tmp

        • Path C:\Program Files (x86)\The Enigma Protector\Examples\Registration\VC\is-QSEQE.tmp
        • Size 1KB
        • SHA256 986d14deec554cd47e0affecca71f6acc3a5029563de6f084a71ee52b4372b2b
        • MD5 SHA1 SHA512 TLSH

        is-TGKIF.tmp

        • Path C:\Program Files (x86)\The Enigma Protector\Examples\Registration\VC\is-TGKIF.tmp
        • Size 5KB
        • SHA256 9c3dbd985e10156518b1763754bdcec8de747579b40dff3d15139baebaae9284
        • MD5 SHA1 SHA512 SSDEEP TLSH

        is-09E8H.tmp

        • Path C:\Program Files (x86)\The Enigma Protector\Examples\Registration_RuntimeKey\Bcb\is-09E8H.tmp
        • Size 2KB
        • SHA256 c3d523fa8faeef8ae14e916d7db8655fe4789d2b19497afabe57ebe2b9f8746f
        • MD5 SHA1 SHA512 TLSH

        is-PFA0R.tmp

        • Path C:\Program Files (x86)\The Enigma Protector\Examples\Registration_RuntimeKey\Bcb\is-PFA0R.tmp
        • Size 710B
        • SHA256 cd8eff95694484d100ff57695a7924a14253b1aade99ecbaade8a846adb4da72
        • MD5 SHA1 SHA512 TLSH

        is-BM7MM.tmp

        • Path C:\Program Files (x86)\The Enigma Protector\Examples\Registration_RuntimeKey\C# (.NET)\is-BM7MM.tmp
        • Size 87B
        • SHA256 d9d5a6495b6a5c4ed69a68b9d132ed081da8a5a6fec14cac1264504635712748
        • MD5 SHA1 SHA512 TLSH

        is-U8KM6.tmp

        • Path C:\Program Files (x86)\The Enigma Protector\Examples\Registration_RuntimeKey\C# (.NET)\is-U8KM6.tmp
        • Size 72KB
        • SHA256 c4e18de0283b3f5075fdf44cfadef1e1d9ec579f20e713f040aaa08ab78019a4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        is-HPLJN.tmp

        • Path C:\Program Files (x86)\The Enigma Protector\Examples\TrialExecutionTime\C# (.NET)\is-HPLJN.tmp
        • Size 50KB
        • SHA256 ca510d8c9ba2e6381cff5850a912894218760af34fc857c35ffd656abf5b511d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        is-3T9BE.tmp

        • Path C:\Program Files (x86)\The Enigma Protector\Examples\Trial\C# (.NET)\is-3T9BE.tmp
        • Size 72KB
        • SHA256 65d3496b1bca5b3b6ede45800bba846f311b2da40c8b175d77fdc0905d24d7a6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        is-0QFDM.tmp

        • Path C:\Program Files (x86)\The Enigma Protector\Examples\Trial\Vc\is-0QFDM.tmp
        • Size 4KB
        • SHA256 187054453a66d5b1d1973d2082336a0663f2f4c2f49ce0219833e905715e2e23
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Help.chm

        • Path C:\Program Files (x86)\The Enigma Protector\Help.chm
        • Size 2.2MB
        • SHA256 64a4f6253270a5470c6e904e22bca3562479f58c527466527052c8ba21533f94
        • MD5 SHA1 SHA512 SSDEEP TLSH

        enigma_ide.dll

        • Path C:\Program Files (x86)\The Enigma Protector\enigma_ide.dll
        • Size 126KB
        • SHA256 c140be447944a3d20ed415fd2696d780ec3500dbbd4c9ee4de0a5739887cc023
        • MD5 SHA1 SHA512 SSDEEP TLSH

        enigma_ide64.dll

        • Path C:\Program Files (x86)\The Enigma Protector\enigma_ide64.dll
        • Size 296KB
        • SHA256 9f6a3b53f10cda22cfecdf4fb739075007cb69917bb5e08baf3bdd6dce7853e4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        is-F14G0.tmp

        • Path C:\Program Files (x86)\The Enigma Protector\is-F14G0.tmp
        • Size 7KB
        • SHA256 1529119439b29706a8eff9d9ba4b20784e2c80caa5457232b8ddb9ac133eed69
        • MD5 SHA1 SHA512 SSDEEP TLSH

        libeay32.dll

        • Path C:\Program Files (x86)\The Enigma Protector\libeay32.dll
        • Size 1.0MB
        • SHA256 b0826835b77ef66964244cb708a58ab8baff69f4dfabefa412e377a86aa20246
        • MD5 SHA1 SHA512 SSDEEP TLSH

        libspv.dll

        • Path C:\Program Files (x86)\The Enigma Protector\libspv.dll
        • Size 868KB
        • SHA256 8338de9a14e5bea902708b00d25c16ec5549639167b96ae162dcdd22f65ec955
        • MD5 SHA1 SHA512 SSDEEP TLSH

        libssv.dll

        • Path C:\Program Files (x86)\The Enigma Protector\libssv.dll
        • Size 904KB
        • SHA256 8acd36a0566c657497419be076faf43acc49f6d169cf5133e9060a3d46e2bd23
        • MD5 SHA1 SHA512 SSDEEP TLSH

        udis.dll

        • Path C:\Program Files (x86)\The Enigma Protector\udis.dll
        • Size 129KB
        • SHA256 4f21456111057cfae3147c674573a3f72edc2ab22d1ea2b1b07611bfe9678eca
        • MD5 SHA1 SHA512 SSDEEP TLSH

        enigma64_7.40_20230424.tmp

        • Path C:\Users\Admin\AppData\Local\Temp\is-4RJ94.tmp\enigma64_7.40_20230424.tmp
        • Size 702KB
        • SHA256 6fce0c97df887faa1226a8b00c535261212705c4cf793f6b60d0419386fff73f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        memory/3104-3575-0x0000000000400000-0x000000000279E000-memory.dmp

        memory/3104-3577-0x0000000000400000-0x000000000279E000-memory.dmp

        memory/3104-3571-0x0000000000400000-0x000000000279E000-memory.dmp

        memory/3104-3574-0x0000000000400000-0x000000000279E000-memory.dmp

        memory/3104-3573-0x0000000000400000-0x000000000279E000-memory.dmp

        memory/3104-3569-0x0000000000400000-0x000000000279E000-memory.dmp

        memory/3952-0-0x0000000000400000-0x0000000000414000-memory.dmp

        memory/3952-3572-0x0000000000400000-0x0000000000414000-memory.dmp

        memory/3952-11-0x0000000000400000-0x0000000000414000-memory.dmp

        memory/4376-3570-0x0000000000400000-0x00000000004BC000-memory.dmp

        memory/4376-3532-0x0000000000400000-0x00000000004BC000-memory.dmp

        memory/4376-13-0x0000000002200000-0x0000000002201000-memory.dmp

        memory/4376-12-0x0000000000400000-0x00000000004BC000-memory.dmp

        memory/4376-6-0x0000000002200000-0x0000000002201000-memory.dmp

        memory/5080-3583-0x0000000000400000-0x000000000279E000-memory.dmp

        memory/5080-3584-0x0000000000400000-0x000000000279E000-memory.dmp

        memory/5080-3585-0x0000000000400000-0x000000000279E000-memory.dmp

        memory/5080-3587-0x0000000000400000-0x000000000279E000-memory.dmp