Analysis
- max time kernel
149s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
27/10/2026, 03:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
What.Command_0.1.0_x64_en-US.msi
Resource
win10v2004-20260911-en
windows10-2004-x64
19 signatures
150 seconds
Behavioral task
behavioral2
Sample
What.Command_0.1.0_x64_en-US.msi
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
20 signatures
150 seconds
General
- Target What.Command_0.1.0_x64_en-US.msi
- Size 12.5MB
- Sample261027-efl89aat4v
- SHA256 36b2afef18b3e068fc065d18b2518af78937fac5d8feba8e2e6900fb8594f913
- MD5 65347ef4f71b2ace31173d19936e66a1
- SHA1 cfe7bedffd19d44dc3575b904757a3c5db8a7fcb
- SHA512 e177de8031be4034368e160288d6d0161f11b6d0e213acbcc84643920caf87f40d10ad8dc871192a630421db040b3add92e055afe1b547bae3a4aae704d24e61
- SSDEEP 393216:A/R1iUAXOR7HVNtoAaRu+A25vzLfSYRMCCNP:A/R1ci71NtoLRlAuvyY4
- TLSH T154D633073C8A8257C42B5D310DBFDB586A79BC181C611D17BB91BB6CCAF26C04ABADC5
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 800 desktop.exe - Loads dropped DLL 6 IoCs
pid Process 1624 MsiExec.exe 800 desktop.exe 800 desktop.exe 800 desktop.exe 800 desktop.exe 800 desktop.exe - Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA desktop.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe - Drops file in Program Files directory 17 IoCs
description ioc Process File created C:\Program Files\What Command\ggml-base.dll msiexec.exe File created C:\Program Files\What Command\llama-perplexity-impl.dll msiexec.exe File created C:\Program Files\What Command\ggml-cpu.dll msiexec.exe File created C:\Program Files\What Command\llama-quantize-impl.dll msiexec.exe File created C:\Program Files\What Command\commands.db msiexec.exe File created C:\Program Files\What Command\llama-bench-impl.dll msiexec.exe File created C:\Program Files\What Command\llama-fit-params-impl.dll msiexec.exe File created C:\Program Files\What Command\desktop.exe msiexec.exe File created C:\Program Files\What Command\mtmd.dll msiexec.exe File created C:\Program Files\What Command\llama.dll msiexec.exe File created C:\Program Files\What Command\Uninstall What Command.lnk msiexec.exe File created C:\Program Files\What Command\ggml.dll msiexec.exe File created C:\Program Files\What Command\llama-batched-bench-impl.dll msiexec.exe File created C:\Program Files\What Command\llama-common.dll msiexec.exe File created C:\Program Files\What Command\llama-completion-impl.dll msiexec.exe File created C:\Program Files\What Command\WebView2Loader.dll msiexec.exe File created C:\Program Files\What Command\octodock_lib.dll msiexec.exe - Drops file in Windows directory 20 IoCs
description ioc Process File created C:\Windows\Installer\{D987DD45-8933-42B4-BECE-4F71BE637871}\ProductIcon msiexec.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4392_1589712758\manifest.json msedgewebview2.exe File opened for modification C:\Windows\Installer\e59a58d.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DF4042420F5E706DA0.TMP msiexec.exe File opened for modification C:\Windows\Installer\{D987DD45-8933-42B4-BECE-4F71BE637871}\ProductIcon msiexec.exe File created C:\Windows\Installer\e59a58f.msi msiexec.exe File created C:\Windows\SystemTemp\~DFBACB4F999A231966.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF7D591D28B537E6C6.TMP msiexec.exe File created C:\Windows\Installer\SourceHash{D987DD45-8933-42B4-BECE-4F71BE637871} msiexec.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4392_1589712758\_platform_specific\win_x64\widevinecdm.dll msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4392_1589712758\_platform_specific\win_x64\widevinecdm.dll.sig msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4392_1589712758\manifest.fingerprint msedgewebview2.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4392_1589712758\LICENSE msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4392_1589712758\_metadata\verified_contents.json msedgewebview2.exe File created C:\Windows\Installer\e59a58d.msi msiexec.exe File created C:\Windows\SystemTemp\~DFBC49121B02DC9A61.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIAA40.tmp msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 5468 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000032ed1b0a2a5ec3f10000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380132ed1b0a0000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410132ed1b0a000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e332ed1b0a00000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e632ed1b0a00000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedgewebview2.exe - Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe - Modifies registry class 26 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\54DD789D33984B24EBECF417EB368717\Version = "65536" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\54DD789D33984B24EBECF417EB368717\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\54DD789D33984B24EBECF417EB368717\InstanceType = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\54DD789D33984B24EBECF417EB368717\SourceList msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\54DD789D33984B24EBECF417EB368717\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\54DD789D33984B24EBECF417EB368717\MainProgram msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\54DD789D33984B24EBECF417EB368717\ProductName = "What Command" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\54DD789D33984B24EBECF417EB368717\Language = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\54DD789D33984B24EBECF417EB368717\ProductIcon = "C:\\Windows\\Installer\\{D987DD45-8933-42B4-BECE-4F71BE637871}\\ProductIcon" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\54DD789D33984B24EBECF417EB368717\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\54DD789D33984B24EBECF417EB368717 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\54DD789D33984B24EBECF417EB368717\PackageCode = "A847FACDD07CC654888CF193089C917E" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\54DD789D33984B24EBECF417EB368717\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\54DD789D33984B24EBECF417EB368717\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\656903E76EACA8255B1F4CB1FCBF0ECB msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\656903E76EACA8255B1F4CB1FCBF0ECB\54DD789D33984B24EBECF417EB368717 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\54DD789D33984B24EBECF417EB368717\SourceList\PackageName = "What.Command_0.1.0_x64_en-US.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\54DD789D33984B24EBECF417EB368717\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\54DD789D33984B24EBECF417EB368717\ShortcutsFeature = "MainProgram" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\54DD789D33984B24EBECF417EB368717\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\54DD789D33984B24EBECF417EB368717\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\54DD789D33984B24EBECF417EB368717\SourceList\Media\1 = ";" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\54DD789D33984B24EBECF417EB368717\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\54DD789D33984B24EBECF417EB368717 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\54DD789D33984B24EBECF417EB368717\Environment = "MainProgram" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\54DD789D33984B24EBECF417EB368717\External msiexec.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2788 msiexec.exe 2788 msiexec.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
pid Process 4392 msedgewebview2.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 5468 msiexec.exe Token: SeIncreaseQuotaPrivilege 5468 msiexec.exe Token: SeSecurityPrivilege 2788 msiexec.exe Token: SeCreateTokenPrivilege 5468 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 5468 msiexec.exe Token: SeLockMemoryPrivilege 5468 msiexec.exe Token: SeIncreaseQuotaPrivilege 5468 msiexec.exe Token: SeMachineAccountPrivilege 5468 msiexec.exe Token: SeTcbPrivilege 5468 msiexec.exe Token: SeSecurityPrivilege 5468 msiexec.exe Token: SeTakeOwnershipPrivilege 5468 msiexec.exe Token: SeLoadDriverPrivilege 5468 msiexec.exe Token: SeSystemProfilePrivilege 5468 msiexec.exe Token: SeSystemtimePrivilege 5468 msiexec.exe Token: SeProfSingleProcessPrivilege 5468 msiexec.exe Token: SeIncBasePriorityPrivilege 5468 msiexec.exe Token: SeCreatePagefilePrivilege 5468 msiexec.exe Token: SeCreatePermanentPrivilege 5468 msiexec.exe Token: SeBackupPrivilege 5468 msiexec.exe Token: SeRestorePrivilege 5468 msiexec.exe Token: SeShutdownPrivilege 5468 msiexec.exe Token: SeDebugPrivilege 5468 msiexec.exe Token: SeAuditPrivilege 5468 msiexec.exe Token: SeSystemEnvironmentPrivilege 5468 msiexec.exe Token: SeChangeNotifyPrivilege 5468 msiexec.exe Token: SeRemoteShutdownPrivilege 5468 msiexec.exe Token: SeUndockPrivilege 5468 msiexec.exe Token: SeSyncAgentPrivilege 5468 msiexec.exe Token: SeEnableDelegationPrivilege 5468 msiexec.exe Token: SeManageVolumePrivilege 5468 msiexec.exe Token: SeImpersonatePrivilege 5468 msiexec.exe Token: SeCreateGlobalPrivilege 5468 msiexec.exe Token: SeCreateTokenPrivilege 5468 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 5468 msiexec.exe Token: SeLockMemoryPrivilege 5468 msiexec.exe Token: SeIncreaseQuotaPrivilege 5468 msiexec.exe Token: SeMachineAccountPrivilege 5468 msiexec.exe Token: SeTcbPrivilege 5468 msiexec.exe Token: SeSecurityPrivilege 5468 msiexec.exe Token: SeTakeOwnershipPrivilege 5468 msiexec.exe Token: SeLoadDriverPrivilege 5468 msiexec.exe Token: SeSystemProfilePrivilege 5468 msiexec.exe Token: SeSystemtimePrivilege 5468 msiexec.exe Token: SeProfSingleProcessPrivilege 5468 msiexec.exe Token: SeIncBasePriorityPrivilege 5468 msiexec.exe Token: SeCreatePagefilePrivilege 5468 msiexec.exe Token: SeCreatePermanentPrivilege 5468 msiexec.exe Token: SeBackupPrivilege 5468 msiexec.exe Token: SeRestorePrivilege 5468 msiexec.exe Token: SeShutdownPrivilege 5468 msiexec.exe Token: SeDebugPrivilege 5468 msiexec.exe Token: SeAuditPrivilege 5468 msiexec.exe Token: SeSystemEnvironmentPrivilege 5468 msiexec.exe Token: SeChangeNotifyPrivilege 5468 msiexec.exe Token: SeRemoteShutdownPrivilege 5468 msiexec.exe Token: SeUndockPrivilege 5468 msiexec.exe Token: SeSyncAgentPrivilege 5468 msiexec.exe Token: SeEnableDelegationPrivilege 5468 msiexec.exe Token: SeManageVolumePrivilege 5468 msiexec.exe Token: SeImpersonatePrivilege 5468 msiexec.exe Token: SeCreateGlobalPrivilege 5468 msiexec.exe Token: SeCreateTokenPrivilege 5468 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 5468 msiexec.exe Token: SeLockMemoryPrivilege 5468 msiexec.exe - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 5468 msiexec.exe 5468 msiexec.exe 800 desktop.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 5468 msiexec.exe 2788 msiexec.exe 1624 MsiExec.exe - Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 2788 wrote to memory of 1624 2788 msiexec.exe 90 PID 2788 wrote to memory of 4568 2788 msiexec.exe 96 PID 5468 wrote to memory of 800 5468 msiexec.exe 99 PID 800 wrote to memory of 4392 800 desktop.exe 100 PID 4392 wrote to memory of 564 4392 msedgewebview2.exe 101 PID 4392 wrote to memory of 5516 4392 msedgewebview2.exe 102 PID 4392 wrote to memory of 5516 4392 msedgewebview2.exe 102 PID 4392 wrote to memory of 5516 4392 msedgewebview2.exe 102 PID 4392 wrote to memory of 5516 4392 msedgewebview2.exe 102 PID 4392 wrote to memory of 636 4392 msedgewebview2.exe 103 PID 4392 wrote to memory of 5176 4392 msedgewebview2.exe 104 PID 4392 wrote to memory of 5176 4392 msedgewebview2.exe 104 PID 4392 wrote to memory of 5176 4392 msedgewebview2.exe 104 PID 4392 wrote to memory of 3348 4392 msedgewebview2.exe 105 PID 4392 wrote to memory of 3348 4392 msedgewebview2.exe 105 PID 4392 wrote to memory of 3348 4392 msedgewebview2.exe 105 PID 4392 wrote to memory of 3348 4392 msedgewebview2.exe 105 PID 4392 wrote to memory of 3348 4392 msedgewebview2.exe 105 PID 4392 wrote to memory of 6072 4392 msedgewebview2.exe 108 PID 4392 wrote to memory of 6072 4392 msedgewebview2.exe 108 PID 4392 wrote to memory of 6072 4392 msedgewebview2.exe 108 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\What.Command_0.1.0_x64_en-US.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5468 -
C:\Program Files\What Command\desktop.exe"C:\Program Files\What Command\desktop.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:800 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=desktop.exe --webview-exe-version=0.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.involvex.whatcommand\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=800.3188.11215649286626252810 /pfhostedapp:00ab7b39e287963295667d254067d3bf91219b453⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.involvex.whatcommand\EBWebView /prefetch:4 /pfhostedapp:00ab7b39e287963295667d254067d3bf91219b45 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.involvex.whatcommand\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffaffee5fd8,0x7ffaffee5fe4,0x7ffaffee5ff04⤵PID:564
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.involvex.whatcommand\EBWebView" --webview-exe-name=desktop.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1772 --field-trial-handle=1776,i,14073979136467745311,17965804941051346942,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:00ab7b39e287963295667d254067d3bf91219b454⤵PID:5516
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.involvex.whatcommand\EBWebView" --webview-exe-name=desktop.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2092 --field-trial-handle=1776,i,14073979136467745311,17965804941051346942,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:00ab7b39e287963295667d254067d3bf91219b454⤵PID:636
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.involvex.whatcommand\EBWebView" --webview-exe-name=desktop.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2084 --field-trial-handle=1776,i,14073979136467745311,17965804941051346942,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:00ab7b39e287963295667d254067d3bf91219b454⤵PID:5176
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.involvex.whatcommand\EBWebView" --webview-exe-name=desktop.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3316 --field-trial-handle=1776,i,14073979136467745311,17965804941051346942,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:00ab7b39e287963295667d254067d3bf91219b45 /prefetch:14⤵PID:3348
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.involvex.whatcommand\EBWebView" --webview-exe-name=desktop.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=348 --field-trial-handle=1776,i,14073979136467745311,17965804941051346942,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:00ab7b39e287963295667d254067d3bf91219b454⤵PID:6072
-
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 6D6A0C100B1EB4D87D50C3D4A381156B C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1624
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:4568
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:2868
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e59a58e.rbs
- Size 18KB
- SHA256 6328175aa38ebef6fd2a3ea608e33170dae1fc9eccfa95693bb074774f95bed2
- MD5 9ccbea61e94570ad80ad74078fd820c2
- SHA1 696d8e4437db2c3bb1553bc9caa566def9c00078
- SHA512 c502b533e50ac4efe96770f22f3e3304300a989a7fefe1e4f94cbb2fa5c88b86309574020d302f873b488499269daf53fa1fdd402c457a96697a1cf53d857634
- SSDEEP 384:XnghMOTpL5Pzgp0+5AP6c1wgMtotototototototototototototXJoHowAnkFo8:XghMOTpL5Pzgp0EAP6c1wgMtotototob
- TLSH T1BC82BD42AA10C393E5CF1A38EB9717143772C6CD5384921B16DDA12C8E937D52FE6A4E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\What Command\commands.db
- Size 11.4MB
- SHA256 2f00faca628542c45b508f1e6d43fce485922fa3736943444c3e907fe4f4b112
- MD5 3732d4be52da59034cefcc3ec55eb51f
- SHA1 d788c185e31f5349066ce805f43ba1bf42929a08
- SHA512 8b7c893e8acb4b533984a97a71c8ffc871b4b95ad0e9fe4396613f5d788b10777defeafcd7d7f0e4a947134d7e025cc66f6e04ea81c948c53179ff9a36314f37
- SSDEEP 49152:zsbcypFLXSGDXX27/1i1B32gDny3/fue07zQfA8y1VhWmL1WdjHrpTFtbtI3O:2FX2gD6/21uHti+
- TLSH T137C6D4932BF80363D83EB73AD0BD37171439B385DA165880EA5FB73085C9576491AF8A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\What Command\desktop.exe
- Size 10.5MB
- SHA256 890e6008955da06f2a48735183034ad6c12802e26ae22a2cb28b318d9849b8fd
- MD5 8573ebde8f37147c206396bec37b63ac
- SHA1 36a6e7b86ecc94273efe9977c14483e6c40ba621
- SHA512 b828f251b02a6dbc1139e88ee45b357a54404e56559b73a430f514ca4b3c66a4457e76a57e62d7736006a3491e6f96f37f8144f70c969cf8f46d033335f1d107
- SSDEEP 98304:fZJKr5LSlfj4/gRCGPlQgU79K4+nkG8INon3Ei5xfh6wQKB4T5D+S3CPIElD2iGS:fjKrMu0dQLEiPfhTTGo5IEAiGlKjBf
- TLSH T1EFB65A43F76280E8C56AC075835A6232FA317C494B347AEB5BE08B253E66FD06B3D754
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\What Command\ggml-base.dll
- Size 874KB
- SHA256 4e13a83d720e7a1c7bb83b28ccd409802e9ebe882c7a4e60313f1a9d8ca35a2d
- MD5 46431300198b65eb1de30955c1cebdec
- SHA1 c2e94fd758e8968a42085e3902283fa2041de0e8
- SHA512 59c2b598dc68e3d533ee2771599ef721fca78fecc16d89d0e917a6c95bd231125c028fdbcfdc35daa9842e3211ac85da8b6711a88cf2da2cf4429661c54ce1e3
- SSDEEP 24576:K0PkqyU7wgtksqMsb83bfM5TH7YXbV3Jqf1KG7X9W0RIQhyu+j7CMCuRnzCf0:NvkslG83bfM5TH7YLV3JiKG7X9jRIQhd
- TLSH T11515833BFBA603D4D5B6D1B9A9922726FCA070A543B49BD7DBC147060671BE0E93D380
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\What Command\ggml-cpu.dll
- Size 1.3MB
- SHA256 13e58af64278b439338d00866827d183021b7b4d3b93dcc336d6f7a6d802dd15
- MD5 d41c868db175fa49c5d70ffb8af485d4
- SHA1 e1206101ce16e373eb7fb1d9a05a7702b72cd2bf
- SHA512 549091bfa9a83df79bbe086b24e32eeafec0556ac70d18b44267cc17bffcb1e8ac175c07127cf48c0388fa39683daa45ead0c19ec504c3c10b51a000648cc34f
- SSDEEP 24576:4AAlYFx2HjI7m3kMEUuiJd+hmIyDfczRcjD4soZAn3IMZsH0MYGRQ4HHVtJqsKVm:dFx2HjI7m3nEUukd+hmdDfczRcjD4soT
- TLSH T165554727FB71C2D8F0B5D27996532323BDA57C6D833437AB878197911A60B90BA383D4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\What Command\ggml.dll
- Size 103KB
- SHA256 e1091b76c9154e8c6e400f36912ec3465807d2d85d6cf8fe20d5f03e8af630a6
- MD5 d192ede5e1b0cdfb99c9e2dd5b9ab0a9
- SHA1 aa1ea93578bd5753c9a2e5d7c62822d6f4e5885d
- SHA512 6d03d9487fbaf523cf5af4f5a0bf7c445498b1885761c6b3d47a1f5a4963c4dd6c772168a027897acac91fbf1f8f796a244613092d3e79dd4fd2234d4ed0b92a
- SSDEEP 1536:pitVGmJfenYfDMZMg1Xyx5HfGGn/6Y6FdOeIbgiE7KJ:gz79enYfDMZM95HfGIaXOx1E7K
- TLSH T1E0A3520BA96551E2C5BDC0389582652EFDA170E643B067CBAB815E870772FF4BE3E740
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\What Command\llama.dll
- Size 3.4MB
- SHA256 0573558e074319dde644f2454c60cca3e8f03dd979a6c15ae4a8ed43d42124b2
- MD5 7d43c786b89f441ee3af097dfdc85a7a
- SHA1 3ab2068a8fcb47c7a9cc731dc1c0fb4aae665380
- SHA512 64c8e7449f6531378a30215658573b19a177c08ff777851649c95ab4de919b1680317a506885f31ccdced23abb45ad6010d879d246e115ef2a272b15634259a1
- SSDEEP 49152:KdU+cfI38MB5AdZ8TJ6+66jRXA+bIabxo75g0GsMY:O9db
- TLSH T1B5F53F9ADB7991E1C8BAC479D1636227F870385DC338A7D3DB515E026B65BE0E83E700
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\What Command\What Command.lnk
- Size 1KB
- SHA256 9cd0e0b846a47a7f0e7b1d5413bedfa0566b6724d6acaa47d22460917abae483
- MD5 878cba862f9e4b66247b217f12579c14
- SHA1 23d3a1b980f900e1765ce84d0c2190b9308bc31d
- SHA512 18eff1cf8e6f06cf619cc3a6b12bfb3b06bb4dad477f90898e2ebc2cb7a73a9974442e1cab4c30b04941d4446db31ba7c5d1d7a424e4fd45fa00547048c04ee1
- TLSH T1FF41D2213BF4072AF3B35A755D724A705B35FC52A9708F1B02C681451CF5B818AE8F3A
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\What Command\~hat Command.tmp
- Size 2KB
- SHA256 7c318b11363748e0c6013d7356fe8749a40c937efa4c34fdeaa8a66e0e75a86e
- MD5 e08597effb64cdd3bc0058561492a2dc
- SHA1 86982256a488588638f48538ec9e98fb256689d5
- SHA512 b0e3b6a7f88458a4f695c864eb67abdef3110b8424f301a5da3925da79ea06913c022111679f40a783f408ae21d3a3948b50134b6997288e9224c8c67ca4215a
- TLSH T13041B1212BF9072AF3B356356D724A705B35FC92A9708B5B02C681451CF5B808AE8F2B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI4BE4.tmp
- Size 132KB
- SHA256 7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc
- MD5 cfbb8568bd3711a97e6124c56fcfa8d9
- SHA1 d7a098ae58bdd5e93a3c1b04b3d69a14234d5e57
- SHA512 860cbf3286ac4915580cefaf56a9c3d48938eb08e3f31b7f024c4339c037d7c8bdf16e766d08106505ba535be4922a87dc46bd029aae99a64ea2fc02cf3aec04
- SSDEEP 3072:Kx2YbpcgwmiTPJDnCO+DATkURBnrskNwPj2:XXgwmY1CPx2XG2
- TLSH T1DBD39D02B5D0C473D9BE09390870DB229F7EB930DF909EDB636856699E702C19E35A37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\com.involvex.whatcommand\EBWebView\81ffb693-39b9-438f-9fc1-9875175495ba.tmp
- Size 15KB
- SHA256 43f5705671f4365b145524eac4deec8d01e4d455baa5db4e8d0c6fc0c40d260b
- MD5 61d59601d36391b0c22be251eb73e85b
- SHA1 a79b1131847574c46abac6e422c9c496228d205f
- SHA512 d01961283d71b82fd0159dc1cac6cae6d83da52869e62cbbf6f8dd8e89cc7d78be6a11595ca914c89d21582cc1d42f5437c98275b9ae2ff50a21b2cf2d1635c4
- SSDEEP 384:2+OBqImmJvGBLx3NaFMJFNNBSHZ/t70g6r+:jcvGtlNwV7KS
- TLSH T19972AEB62C756E672CFACA09BE8A3747CB64A293C4D17BD4DCEC9F0E412B0941352852
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\com.involvex.whatcommand\EBWebView\99e4fd2e-8340-4170-b8d7-f8ce9dbb4478.tmp
- Size 2KB
- SHA256 e8ed53d3c00591ac11735a4ac55c07d37a2715967a838a07e25f9ce773d4977e
- MD5 1679781a5f3d7f69589e5f03d59b07af
- SHA1 f97e218ff0b02587410e50a46bf6f1060b973885
- SHA512 86f7e65d64c839086f2a4d356bef567f865e03c91554e093ed1bf4755e450f394c87757f52931d3ffab2a5e67d800e4f9ef919bf2315f02d9544d4c5a0880849
- TLSH T12351B573AC34ABB79AE28B04B8467F23DE39B0669A521F5099DC0B1C40D756C2741C33
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\com.involvex.whatcommand\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 569171b29da6b5637c2ce3f6005c22d355247b06aa20decd4a920c882261f449
- MD5 d07ba31cf1324da4da24eb9499f6b7b4
- SHA1 70276ae800a7c2da412a0acdaec2fc3201838bc4
- SHA512 d86ef045fb2fb8aa700908d5b28c2f954d382c38305a46cf985763afcb856f087e89fc6c355e6f50a37ac4874c7f334c53ad499ca3b924f5fd391579cb9bebc0
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\com.involvex.whatcommand\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 3d0e63673580f4274948225f868ace7263454929e5b68a5edf738afaf0c0a3c7
- MD5 86e51014aa0f1a17b18ea36aa7c62102
- SHA1 8438d00fe5dabe26f8f656e9928a0032ca9f26da
- SHA512 80fb412c149e655c992f9a5ff7e3fcc0f9552bcab654eb8076de894c4b5539968f9d9ab2d719ab795448bb29a2b1dcc9bebd22e5e7857611e55982cabadb0ab2
- TLSH T1EED0122376120238C41120330902A10C2601C10F414D94049429851D1B444544D12451
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\com.involvex.whatcommand\EBWebView\Crashpad\throttle_store.dat
- Size 20B
- SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
- MD5 9e4e94633b73f4a7680240a0ffd6cd2c
- SHA1 e68e02453ce22736169a56fdb59043d33668368f
- SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\com.involvex.whatcommand\EBWebView\Default\608fac60-6100-4faf-a5c3-09c623981ea7.tmp
- Size 6KB
- SHA256 7dffc154f9873542540f70f968aec1a48e50e9ec273d2d4bf28244cd1c18b557
- MD5 ce5832ba5f24ebf2846038644cb59c4c
- SHA1 77c5f6b6acf536f711a1239178ce3fe6ad2015c6
- SHA512 eca810f7d8a008b1288fd6d1aa210d66a208a7070b8f0c531bd1dbfa1cf74ad7a5b6e2b40ad741ca61de4c2162e27e6d92ee28f3e8a5f747c1559f611d11e434
- SSDEEP 96:stO/dbLQWV8b9rkLo5h16Z0/s7/x+6MhmuecJLh1ejekK+glo28XM1C7K:stWB76Gon/sV+FdLhQj4wG6K
- TLSH T161D1A7025E7479BB4CCAE209BA39BA17E6F9903265D21E58E7FC452C04D76DC630790B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\com.involvex.whatcommand\EBWebView\Default\Code Cache\js\index-dir\temp-index
- Size 96B
- SHA256 230485dab28cf6d0afb3058066b18afa676c087490bc20ec99bc76436984c985
- MD5 ad27afd56cbdfce3185fbb282d6675df
- SHA1 c9b1a3e33d9f099d60170ecfade036f6f03dd17c
- SHA512 c126fed1b0c612dc38dd3c71bfa22bc739c7d8a4a2a20ac60006872767a46e3e724c9e4d41ba8ad03ac71408500b22c7f86aed24d9b01e96f80a3d348eda7158
- TLSH T1A9B0025D6A424396D38273F126D711E276B44D3003C78AB2C1EDFAF8D4D07545B35266
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\com.involvex.whatcommand\EBWebView\Default\Code Cache\js\index-dir\the-real-index
- Size 48B
- SHA256 73bac26acc88ed1329d9bd21f69af4caea9efc6ce4318754978edc7725d728f3
- MD5 85508f53493b622072606111e1a26902
- SHA1 280e5f53a9074a6e534b6312464bf77836b0bd9a
- SHA512 622ea5808a6baf0307f1fdee496bfe04031fd2cee1ca68df7f9e08758771ab61e9f398ede37db820ada070c849f358238a91e0702cee50e225a9196d782761eb
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\com.involvex.whatcommand\EBWebView\Default\Network\9a7586f5-a2dd-4708-8de8-12c60786528e.tmp
- Size 821B
- SHA256 288edcaad240820ade1a7f285a5eb3a8f7f1279c99eb42027c117f96a6380db2
- MD5 cb2890d3772ba2e97e68a672b353a820
- SHA1 190b8596849ac7c300373f8ab1d8ceee9f2a6c38
- SHA512 521ff1c22a523418266a39c4e8923cbf3c287e9b0348ba4d50c9147dbd74f1aaca955d6045b9c99b59cc35226c101279b3b40acf04c1552dc6e48146174b947f
- TLSH T12101CEA6C3D4C67D8A4117E427343817CD3E051992282E2BCDEEEBDA97E1475D21154F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\com.involvex.whatcommand\EBWebView\Default\Network\Network Persistent State
- Size 59B
- SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
- MD5 2800881c775077e1c4b6e06bf4676de4
- SHA1 2873631068c8b3b9495638c865915be822442c8b
- SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
- TLSH T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\com.involvex.whatcommand\EBWebView\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\com.involvex.whatcommand\EBWebView\Default\shared_proto_db\metadata\CURRENT
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\com.involvex.whatcommand\EBWebView\Default\shared_proto_db\metadata\MANIFEST-000001
- Size 41B
- SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
- MD5 5af87dfd673ba2115e2fcf5cfdb727ab
- SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
- SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\com.involvex.whatcommand\EBWebView\GrShaderCache\data_0
- Size 8KB
- SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
- MD5 cf89d16bb9107c631daabf0c0ee58efb
- SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
- SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
- SSDEEP 3:MsFl:/F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\com.involvex.whatcommand\EBWebView\GrShaderCache\data_1
- Size 264KB
- SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
- MD5 d0d388f3865d0523e451d6ba0be34cc4
- SHA1 8571c6a52aacc2747c048e3419e5657b74612995
- SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
- SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\com.involvex.whatcommand\EBWebView\GrShaderCache\data_2
- Size 8KB
- SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
- MD5 0962291d6d367570bee5454721c17e11
- SHA1 59d10a893ef321a706a9255176761366115bedcb
- SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
- SSDEEP 3:MsHlDll:/H
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\com.involvex.whatcommand\EBWebView\GrShaderCache\data_3
- Size 8KB
- SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
- MD5 41876349cb12d6db992f1309f22df3f0
- SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
- SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
- SSDEEP 3:MsGl3ll:/y
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\com.involvex.whatcommand\EBWebView\Local State
- Size 1KB
- SHA256 0ea2e35f27e10d9d7ffa671887a01d1dbdca149fa8bb9ffb4e5c922e081507fd
- MD5 63a213143e4cc2041cdca6018f4519a9
- SHA1 756e62bb50a77435b7b9f5aa0fca7d13ac4c0ba4
- SHA512 cc6363a5e05dcd033337b9271f54692a70fb559a1ec925fd5cd3e99d395498d12695e2c586ad1f22bd98c8eab1a82fbd64d1d64caf493c4ed845ef206faaeadf
- TLSH T18621BAB2D874AFB2AE95A7056453BA5B9D31707F83414F4094DD8B1C42D709CDD25C33
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\com.involvex.whatcommand\EBWebView\fee2cee6-c493-4a17-87a4-ab32a7239998.tmp
- Size 3KB
- SHA256 f498ef8592590c0d1ba55634e2cfcc38b70e93a4a4c9318444ffcbea31a20cc2
- MD5 c8338b54c4c196026c688e03984b86dc
- SHA1 889f77e5412c4afcbd558b4c3754450ea6ae28ed
- SHA512 f7190ea5e5ea20039ca49b716cb9c2ee593e2832f8bd9ea157a95b382ceeae5e3a85d6b2ba37455b9b6383b3d028a0948369608f9677350829527ff29b2935df
- TLSH T168618472AC74E9675EF6DB05B8863B16FAA5A027D5823FA5C9EC0F1C41D72981341C13
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Installer\e59a58f.msi
- Size 12.5MB
- SHA256 36b2afef18b3e068fc065d18b2518af78937fac5d8feba8e2e6900fb8594f913
- MD5 65347ef4f71b2ace31173d19936e66a1
- SHA1 cfe7bedffd19d44dc3575b904757a3c5db8a7fcb
- SHA512 e177de8031be4034368e160288d6d0161f11b6d0e213acbcc84643920caf87f40d10ad8dc871192a630421db040b3add92e055afe1b547bae3a4aae704d24e61
- SSDEEP 393216:A/R1iUAXOR7HVNtoAaRu+A25vzLfSYRMCCNP:A/R1ci71NtoLRlAuvyY4
- TLSH T154D633073C8A8257C42B5D310DBFDB586A79BC181C611D17BB91BB6CCAF26C04ABADC5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4392_1589712758\manifest.json
- Size 1005B
- SHA256 1cc15465230ffb75fd028ee3b2189c8774f56bc7dee8dd17b952e6ca92144004
- MD5 58954048e70c81669675d4f87ab50af1
- SHA1 8ab675ea31801bbb91c33fd381f4c202bfd7882e
- SHA512 f9b8c236c9404936b93ba92550c21a0344b657c42cd98e091cda32e33fed860d59ac0cb97451ca61b2d8e6a943a983ded569b1d7ecd541e832e3ca87b39ecbd0
- TLSH T161115E00DD384DD326D4B6A21CC6580957661DAF5CC27E54379E161D4F1C8AB927376C
- MD5 SHA1 SHA512 TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 49a5fd5f84ff26c154326998ec2a61b5e9cd2376e6cfc6f49eeef05a42a156f9
- MD5 dbba36540c6f96cf3a8cecf54c07e9af
- SHA1 5ac5ab0329a36fa262fc2488c127e0c911236203
- SHA512 f600c4ed631dbae3604cf02a5ae7ea1659021f1a1bcd52afff6b8e7107bc1c330086e0d5d3d36985518f4075e30b848ddfdb44552eeb48a472ae521769452e66
- SSDEEP 24576:/Fo3DMPgdoO/vvTL/CgQQyFAv7Oqbr3DUt2id9O4mFea5HRQc4BmwJKR0uK:+Ho
- TLSH T11757B51836F92100E7F79F3CA8F46A63493A7D579C1ADE8D45411B4E0821FB1E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{0a1bed32-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{eb2b6b01-ba0c-477e-b3cf-1d45494e1911}_OnDiskSnapshotProp
- Size 6KB
- SHA256 58120f1210552b21df47e0bc6c6ac9bb49a1a7c47a19eab22bdcae2b14dd4371
- MD5 b5e9f4feb22e7f38a27a50979ba80915
- SHA1 cb9362b7131c470e4cd80a3003a1a080acfeb927
- SHA512 0fcc7fec9e974776307dc703dfddcbd2b8b04084c82cb50ed08f1a8a3fc2f9e954f9dfb13a4f3ffc8ed2d3725963745502461ef36914817f868e7c79660876c1
- SSDEEP 96:F4IqkRsvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpuN:ugRgb++uVmN
- TLSH T1CFD1881C5AF54711E2B3AB3129F18557A877B811EF33CB8E0198638E6670A10F835F6B
- MD5 SHA1 SHA512 SSDEEP TLSH