90b02fc1648f573e811cb98e48e632b5adb37434ffa53c3e6b0d7c9786149a79

Analysis

max time kernel
149s
max time network
95s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
05/06/2026, 12:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup-RemoteAppClient.exe
Size 14.2MB
Sample260605-pc72naf18p
SHA256 90b02fc1648f573e811cb98e48e632b5adb37434ffa53c3e6b0d7c9786149a79
MD5 5e9ba67f72848051e0f9b90364565692
SHA1 870baebe39a84eafe3af2feb8c56c550889211c2
SHA512 b59cb31068c8d93f47332e210078c57faeba35bd1f18cb25b294905704c8749d564d82a11679c5c2ca0a2d924c5ee726a5e49af5e1183a9099f7f11f84fbdd6b
SSDEEP 196608:4ra5DUfRkdtt6kFkKcBXaQYzLrtqMQZVnSvNdP5qcbeWuTwOlyzu93kpiTfy+DHV:4WGfRktpFkKSULnfNHIWujmuRQi2+DlH
TLSH
T1EBE6336372CBE43EE46E1B3B05B2A63458FB7E216527AC1786E4906CCE360601D7E747
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution installer

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	3800	powershell.exe
3	3200	powershell.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Executes dropped EXE 1 IoCs

pid	Process
4216	Setup-RemoteAppClient.tmp

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4568	powershell.exe
3200	powershell.exe
2264	powershell.exe
3800	powershell.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup-RemoteAppClient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup-RemoteAppClient.tmp

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/2532-1-0x00000000000F0000-0x00000000001E7000-memory.dmp	innosetup
behavioral2/memory/2532-33-0x00000000000F0000-0x00000000001E7000-memory.dmp	innosetup
behavioral2/memory/2532-180-0x00000000000F0000-0x00000000001E7000-memory.dmp	innosetup

Kills process with taskkill 6 IoCs

defense_evasion

pid	Process
2916	taskkill.exe
5092	taskkill.exe
1040	taskkill.exe
5024	taskkill.exe
1520	taskkill.exe
1544	taskkill.exe

Modifies registry class 24 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\ConnectionClient	Setup-RemoteAppClient.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\remoteapp\ = "URL:RemoteApp Protocol"	Setup-RemoteAppClient.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\remoteapp\URL Protocol	Setup-RemoteAppClient.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\remoteapp\shell\open\command\ = "\"C:\\Users\\Admin\\RemoteApp\\RemoteAppClient.exe\" \"%1\""	Setup-RemoteAppClient.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\remoteapps\ = "URL:RemoteApp Secure Protocol"	Setup-RemoteAppClient.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\remoteapps\URL Protocol	Setup-RemoteAppClient.tmp
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\remoteapps\shell\open\command	Setup-RemoteAppClient.tmp
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\.connect	Setup-RemoteAppClient.tmp
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\ConnectionClient\DefaultIcon	Setup-RemoteAppClient.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\ConnectionClient\DefaultIcon\ = "C:\\Users\\Admin\\RDP6\\ConnectLauncher.exe,0"	Setup-RemoteAppClient.tmp
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\ConnectionClient\shell\open	Setup-RemoteAppClient.tmp
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\remoteapp	Setup-RemoteAppClient.tmp
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\remoteapp\shell\open	Setup-RemoteAppClient.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\remoteapps\shell\open\command\ = "\"C:\\Users\\Admin\\RemoteApp\\RemoteAppClient.exe\" \"%1\""	Setup-RemoteAppClient.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\.connect\ = "ConnectionClient"	Setup-RemoteAppClient.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\ConnectionClient\ = "Connection Client File"	Setup-RemoteAppClient.tmp
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\ConnectionClient\shell\open\command	Setup-RemoteAppClient.tmp
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\ConnectionClient\shell	Setup-RemoteAppClient.tmp
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\remoteapp\shell	Setup-RemoteAppClient.tmp
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\remoteapp\shell\open\command	Setup-RemoteAppClient.tmp
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\remoteapps	Setup-RemoteAppClient.tmp
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\remoteapps\shell	Setup-RemoteAppClient.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\ConnectionClient\shell\open\command\ = "\"C:\\Users\\Admin\\RDP6\\ConnectLauncher.exe\" \"%1\""	Setup-RemoteAppClient.tmp
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\remoteapps\shell\open	Setup-RemoteAppClient.tmp

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3800	powershell.exe
3800	powershell.exe
4568	powershell.exe
4568	powershell.exe
4216	Setup-RemoteAppClient.tmp
4216	Setup-RemoteAppClient.tmp
3200	powershell.exe
3200	powershell.exe
2264	powershell.exe
2264	powershell.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	3800	powershell.exe
Token: SeDebugPrivilege	4568	powershell.exe
Token: SeDebugPrivilege	2916	taskkill.exe
Token: SeDebugPrivilege	5092	taskkill.exe
Token: SeDebugPrivilege	1040	taskkill.exe
Token: SeDebugPrivilege	5024	taskkill.exe
Token: SeDebugPrivilege	1520	taskkill.exe
Token: SeDebugPrivilege	1544	taskkill.exe
Token: SeDebugPrivilege	3200	powershell.exe
Token: SeDebugPrivilege	2264	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4216	Setup-RemoteAppClient.tmp

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 4216	2532	Setup-RemoteAppClient.exe	80
PID 4216 wrote to memory of 3800	4216	Setup-RemoteAppClient.tmp	81
PID 4216 wrote to memory of 4568	4216	Setup-RemoteAppClient.tmp	83
PID 4216 wrote to memory of 1980	4216	Setup-RemoteAppClient.tmp	85
PID 1980 wrote to memory of 2916	1980	cmd.exe	87
PID 4216 wrote to memory of 3628	4216	Setup-RemoteAppClient.tmp	89
PID 3628 wrote to memory of 5092	3628	cmd.exe	91
PID 4216 wrote to memory of 3204	4216	Setup-RemoteAppClient.tmp	92
PID 3204 wrote to memory of 1040	3204	cmd.exe	94
PID 4216 wrote to memory of 1204	4216	Setup-RemoteAppClient.tmp	95
PID 1204 wrote to memory of 5024	1204	cmd.exe	97
PID 4216 wrote to memory of 1584	4216	Setup-RemoteAppClient.tmp	98
PID 1584 wrote to memory of 1520	1584	cmd.exe	100
PID 4216 wrote to memory of 4616	4216	Setup-RemoteAppClient.tmp	101
PID 4616 wrote to memory of 1544	4616	cmd.exe	103
PID 4216 wrote to memory of 3200	4216	Setup-RemoteAppClient.tmp	104
PID 4216 wrote to memory of 2264	4216	Setup-RemoteAppClient.tmp	106

C:\Users\Admin\AppData\Local\Temp\Setup-RemoteAppClient.exe
"C:\Users\Admin\AppData\Local\Temp\Setup-RemoteAppClient.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Users\Admin\AppData\Local\Temp\is-4L04D.tmp\Setup-RemoteAppClient.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-4L04D.tmp\Setup-RemoteAppClient.tmp" /SL5="$90056,13811656,953344,C:\Users\Admin\AppData\Local\Temp\Setup-RemoteAppClient.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4216
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\is-DSCA2.tmp\connection-client-signer.ps1"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3800
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\is-DSCA2.tmp\connection-client-signer.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4568
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /C taskkill /im mstsc.exe /f /t
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1980
  - - C:\Windows\system32\taskkill.exe
      taskkill /im mstsc.exe /f /t
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2916
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /C taskkill /im ConnectionClient.exe /f /t
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3628
  - - C:\Windows\system32\taskkill.exe
      taskkill /im ConnectionClient.exe /f /t
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5092
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /C taskkill /im UniversalPrinterClient.exe /f /t
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3204
  - - C:\Windows\system32\taskkill.exe
      taskkill /im UniversalPrinterClient.exe /f /t
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1040
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /C taskkill /im MyRemoteApp.exe /f /t
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1204
  - - C:\Windows\system32\taskkill.exe
      taskkill /im MyRemoteApp.exe /f /t
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5024
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /C taskkill /im SumatraPDF.exe /f /t
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1584
  - - C:\Windows\system32\taskkill.exe
      taskkill /im SumatraPDF.exe /f /t
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1520
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /C taskkill /im RemoteAppClient.exe /f /t
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4616
  - - C:\Windows\system32\taskkill.exe
      taskkill /im RemoteAppClient.exe /f /t
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1544
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\is-DSCA2.tmp\connection-client-signer.ps1"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3200
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\is-DSCA2.tmp\connection-client-signer.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2264

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 d69b7d84970cb04cd069299fd8aa9cef8394999588bead979104dc3cb743b4f2
MD5 5f4c933102a824f41e258078e34165a7
SHA1 d2f9e997b2465d3ae7d91dad8d99b77a2332b6ee
SHA512 a7556b2be1a69dbc1f7ff4c1c25581a28cb885c7e1116632c535fee5facaa99067bcead8f02499980f1d999810157d0fc2f9e45c200dee7d379907ef98a6f034
TLSH
T15651CF323375B1D489163F07192C59C463BF8355FA94AF4CB698624ED92700B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 1081c6b484e3ce0572ea539029bc598ee7870cf099c5585bd52fbeee220c56b7
MD5 8117d1162c008cf731fe668d81f95ac0
SHA1 1fdce919b160546d65f946726794b3331de06938
SHA512 711cc338d15b6b36cad3e8ca1a57b0595991f060d24f39faa2b24a2c4ca08c07c82497ed8b1bfbc998452778d75fb24558d72062ef5ee6848d99e35068c5f188
TLSH
T11B117A33B79CC135C8D9157A1089AD01B2B4C3C7049EDE8B7A84C509E57F58ADB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 cca996ce3a1fb9cc44bcacc9002798fc66eab27146004d38e65ef98539510f66
MD5 be40db6c8fd0d8b32dd97d14f10f8d1c
SHA1 b0f3a526f60d03ca3e0e6ecd5340358b0d345768
SHA512 0c595146fef4919951f9f04b2f13a03094d51c87063882ffe9beb1f1b0e36fb08ca3ff53bdf0bf1c234e02ac7f878fe5bf185ec8db2c437651e74a9a47414f4f
TLSH
T1B9117A33B79CC135C8D9117A1089AD01B2B4C3C7049EDE8F7A84C509E57F58ADB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_2ahy3www.jyi.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2ahy3www.jyi.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

Setup-RemoteAppClient.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-4L04D.tmp\Setup-RemoteAppClient.tmp
Size 3.4MB
SHA256 d5ee4ca19aff73952d7036f0053372dca544537e802ae9b451f7a027c001febb
MD5 2b78f9463e02fff7648c6e604527a259
SHA1 951dc7a200bc6f68e960ae5311c14290b59c6cc7
SHA512 c1c8dc33270ab95a4fdff4655e0d796573a70db63cbc66b1bbc9472683be4c4f1343a4ecf84c5563de229e3d5962fda5eb082d8e44a95bce66e09e848aaf8551
SSDEEP 49152:RiE8NvQCX7lF4RQSxPodbxsl7IwDksRinJwj9LaDjppz0oohe333y6g:RiE8OQMlIwDkZqBLK333yX
TLSH
T1B6F56C23F34D603EF06A1A3ADD379658583B7A606916CC5797FC3A4C8F361402E2A75B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

connection-client-signer-thumbprint.txt

Path C:\Users\Admin\AppData\Local\Temp\is-DSCA2.tmp\connection-client-signer-thumbprint.txt
Size 40B
SHA256 d6d3a95263b4c95211ca175f6005df97e6b5b22e73b3a73221b532228737af82
MD5 77641c72b83b620035e4074205341d0a
SHA1 b947c08270c4500e7aaea37340d97deef0716dcb
SHA512 9697537c39d00ed91e96fd595d6107e2b8ba57a00a34b21b461937afafa11fd049650cc0b7871e63adab6b7ea6aeb500097d2d375f4aa33ccaf7f91fc999e5e0
MD5 SHA1 SHA512

Submit Download

connection-client-signer.ps1

Path C:\Users\Admin\AppData\Local\Temp\is-DSCA2.tmp\connection-client-signer.ps1
Size 292B
SHA256 efd9681c9e9dab20bfe7ff9c83e2b89b2b67ff8393f189676055257e9341675a
MD5 b809fee73ee8f9164912e2cf42a4205c
SHA1 b6041a3ab0a5a74765b0482ebca4f6e9ac993ef1
SHA512 0d87b0413192aa66be6a2816153135c177348d887d4571f23fd89ae36a192cd8a360171e743196b5848d339f2c802a22f2f0b644cd8d1d1e33e39a16a3807a65
TLSH
T197E0EB93A18A43AC4A0A22E2CC64EBCCC5080F0542CB2D3213B0C04CB4C2BDCDAC86C5
MD5 SHA1 SHA512 TLSH

Submit Download

connection-client-signer.ps1

Path C:\Users\Admin\AppData\Local\Temp\is-DSCA2.tmp\connection-client-signer.ps1
Size 447B
SHA256 f10f6e8cb5fc40990cca48e98b4a98e97fd807f3c03a04130e273408c14a3da7
MD5 734f8242496547b03bb5e960eb5762fd
SHA1 ed7235265c82ea1dc0fdedc6eb9fcf9342455517
SHA512 4c6ba81257df1601795de591af0433c6b155d7fe54ecdff5a504e809d351c9ff2422ba8c34b08e63a566e00adeb57ffc353ef61ef942f112b93706c2df6178ee
TLSH
T1A1F054407BC5ED2219205617C521D05CEEFD8B0B25C17444A3CCD1CC5616E9BD77E157
MD5 SHA1 SHA512 TLSH

Submit Download

connection-client-signer.ps1

Path C:\Users\Admin\AppData\Local\Temp\is-DSCA2.tmp\connection-client-signer.ps1
Size 308B
SHA256 4b348a52530d32ed4e6bfb58fb10e733958ca428ec36f6cb6788ced7f8efc12b
MD5 faf56f1fdc626e40869e63c79d1ad180
SHA1 49e7a8d187ebd1ee9886546f96b0969466da2bb3
SHA512 c8d82396500ce8c0bfd4d88c91db466a841f0fcdaf2eb4d0bf12321b23f19bfb542918aeb25af219c13db1c47dddf885573b951942d074ff2751a76d74af6384
TLSH
T182E07D93514A436D551A72A2CC64EBCCC5040E4551C72A7112B0C14CB5C27DD95C4AC5
MD5 SHA1 SHA512 TLSH

Submit Download

connection-client-signer.ps1

Path C:\Users\Admin\AppData\Local\Temp\is-DSCA2.tmp\connection-client-signer.ps1
Size 501B
SHA256 1e5fd369ddda731ad8c2c517adef722588f5f59196490becfd9ab8943567e230
MD5 690c34520b1484ee9f5e1aa181e8c77f
SHA1 98d9d33a612f0fd4830bc0f780990f1b73f56da9
SHA512 e19555e072e4f62df2962491d1ea30a9b1ed80668e6ff6db50940b066000147a63380ef3ef79ddd22990c98f4d62f80df5d01ffad1a7a4c96cba66907a7d16cb
TLSH
T1A0F050407BC6ED221A206612C961E19CEEFD8B0B25C27540A2CCD18C6616E9BE77E597
MD5 SHA1 SHA512 TLSH

Submit Download

downloaded-signer-for-policy-page.crt

Path C:\Users\Admin\AppData\Local\Temp\is-DSCA2.tmp\downloaded-signer-for-policy-page.crt
Size 1KB
SHA256 7587e16c0813f3da69cd50f753c741f93acefd37e582d799307812fc8459e369
MD5 f02f335930db3f06e6d9f95e2fac4dbf
SHA1 08b60d87821cb06703d912ba4a6c8fb79094ce2e
SHA512 dc2d373368030f4a475b2a2965125bd24a0b9e4fb98836180649c8223b3fcd05463cac950dbe4c130cc0d3c832b17fd4769eccd4d2bf2a2d489dc9e09081821d
TLSH
T133219A9B5C04F7ED3D43D0722FFD55AF0CFC0504847D70150936A5A195A551D46ADCEA
MD5 SHA1 SHA512 TLSH

Submit Download

is-22H6D.tmp

Path C:\Users\Admin\RDP6\is-22H6D.tmp
Size 95KB
SHA256 7acd2e8f32235743d25b48d9b679b553e60a6348e13edd4f7eab6aee79fefe2c
MD5 9ec3d89978c9a2ea2a7454d2913d79d2
SHA1 178f6491b30329f7946d0ba2c9d484e7d363ec6d
SHA512 0d06435bcf7b5e1b7cb4d13ecff8048e8ed90dda953dab9ba5fddb7467d6474ca57a3d070feb5162b55e070ead2087ba4ab39ef4b0989ed0684bda84275c8f9b
SSDEEP 1536:6iysMsz9FI3Fs6Z4HLN72NBNhFaaDvsoAKQ3XDk/wXiv:ssMs5W3u6yHWBVU/nY/wk
TLSH
T1BAA36C82B690C4B2D47D4A3068B7D6A1193F7C52BA70521F36BEB36D1FB2392147931B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svcr.exe

Path C:\Users\Admin\RemoteApp\svcr.exe
Size 941KB
SHA256 5927b9420278f760ff44b87a43f29dc9ad942ae4fbf917267a51f254fab42980
MD5 7083857f38536c1c4dfc59f9e7439382
SHA1 8ae4d6dccb6a7fcedf3bffa5986347ec5d721549
SHA512 b829672af1b39f762416d7c4a48a550b0dbe5e05d66ff9b0f890b931e86d97d614ac9c9a933b31cd5c2f13b1166706fd34ee7ef1d2eefcaaae39850ae39d52c6
SSDEEP 24576:vSmEH7kpRArkvBz1oxovFDVeAj2HoB3a33rKPKGn4:v27kpRA4R1oGDVeQXsrmK5
TLSH
T15A259E0273D18062FFA39A734E57F7115ABCAD25012385AF23D819B9FE705B14B2E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

version.dat

Path C:\Users\Admin\RemoteApp\version.dat
Size 4B
SHA256 743c7850cccfba5e53a9002663ec1ddd1079315a98bdbfdde10e6044f56abefe
MD5 52ee216e7ea72db74e87cc1819fc6c59
SHA1 0bfc02733432df28874e29899ef1938837f57b83
SHA512 34c670a55bbe8f45e0011562ea7eda2ba9c6cf51afce58825c98976a1c49a2143fd5c34275c34c6b15c01f346fc3efd74725fb4c32c39cb054b53a076ca4965a
MD5 SHA1 SHA512

Submit Download

memory/2532-180-0x00000000000F0000-0x00000000001E7000-memory.dmp

Download

memory/2532-1-0x00000000000F0000-0x00000000001E7000-memory.dmp

Download

memory/2532-33-0x00000000000F0000-0x00000000001E7000-memory.dmp

Download

memory/3800-16-0x0000021E69F50000-0x0000021E69F72000-memory.dmp

Download

memory/3800-18-0x0000021E6B6D0000-0x0000021E6B6E0000-memory.dmp

Download

memory/3800-8-0x0000021E6B6D0000-0x0000021E6B6E0000-memory.dmp

Download

memory/3800-9-0x0000021E6B6D0000-0x0000021E6B6E0000-memory.dmp

Download

memory/4216-34-0x0000000000F80000-0x00000000012FE000-memory.dmp

Download

memory/4216-5-0x0000000003470000-0x0000000003471000-memory.dmp

Download

memory/4216-175-0x0000000000F80000-0x00000000012FE000-memory.dmp

Download

memory/4216-177-0x0000000000F80000-0x00000000012FE000-memory.dmp

Download

memory/4216-179-0x0000000000F80000-0x00000000012FE000-memory.dmp

Download

memory/4216-10-0x0000000003470000-0x0000000003471000-memory.dmp

Download