hxxps://corpo-gestion[.]screenconnect[.]com/Bin/ScreenConnect[.]ClientSetup[.]exe?e=Access&y=Guest&c=ser5&c=dg4&c=ad&c=23s&c=&c=&c=&c=

Analysis

geolocation tags

eueuropelondonukunited-kingdom
user interaction
yes
max time kernel
898s
max time network
900s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/04/2026, 15:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://corpo-gestion.screenconnect.com/Bin/ScreenConnect.ClientSetup.exe?e=Access&y=Guest&c=ser5&c=dg4&c=ad&c=23s&c=&c=&c=&c=
Sample260424-talsvsdy2x

Score

8^/10

backdoor defense_evasion discovery persistence privilege_escalation ransomware rat

Malware Config

Signatures

Badlisted process makes network request 4 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
37	2504	msiexec.exe
38	4456	rundll32.exe
39	4456	rundll32.exe
41	4456	rundll32.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
6	4372	chrome.exe

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (2be711191a6d25be)\ImagePath = "\"C:\\Program Files (x86)\\ScreenConnect Client (2be711191a6d25be)\\ScreenConnect.ClientService.exe\" \"?e=Access&y=Guest&h=instance-eefr6a-relay.screenconnect.com&p=443&s=f60bd798-016d-4500-ba61-7a883318e2eb&k=BgIAAACkAABSU0ExAAgAAAEAAQAp3ZiMnmZZEn2UFMyW7ngJvQ9o8phKZq525p7mHexLvi0lYS%2f9FZQnaguvX9Baz7Z0Gy1M4%2fmfO%2bS%2bYmBQ5C1QnSWMS7frwvrxLo5GXJWbWS5mu1pCzREabr8oRaBkxaEkX4BH%2fXhWEysoZGAPmb%2fk0GASxfR8Iz%2f4eJ2%2fkIt32uclD2weE9bGw9nowSMMS%2ffR8qIOtXnplHYwqAA1m%2b%2fY%2bK9MpgTTuvUw8ieTOOsw5d%2bZLseBNU1o6xaihSNQKMzVHBphaG8dF5pAhMQbyMVEGUwaqrX%2bWFHBzxz1Yv9kIE9IZMKXEKwTApQJAU3eD1keBnHAJ%2fEAONRotPQYLkXR&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAAU9A2bKad60i5aIvNmeblOwAAAAACAAAAAAAQZgAAAAEAACAAAACdsyPhBG6JxNNQrC9Rd27im8%2fzynX41lbpwO%2fzNV01wgAAAAAOgAAAAAIAACAAAABsI5kk0snYyfsWukJOr5cJl9RmtTzi5tqxnRlqyrTWI6AEAADq8Me%2f5RVmwatVIXVi4RmybB6ne1DMtVTcuq%2b%2bHtHHo6tW6iFFYzS5p5yCe2VwiGGYiCjEbjBn%2bIdG4xRFGdxcIt8Du4gRzN7Am4SMqNqxD%2fU3bffjWfFR0xLBlgRr9971bSyuQZ1OvYvgF7eOfgFxzVwLr7j6KRJd6NRyH1caLhcJuUguVZ9Fd4EiN8lpSjAFu8Y2jDVJej1N57Fybku3eZnT2b3E9gdh4odIXfCLXL4S%2fVQZ2Q%2bUXMikqRP5mWmK5OLZe4TLCr4%2fdA4pXmpwM%2bMg44I7sKKyg1atSgVpgv5GT1XSOLS7vLm8ZF87FpLFBCp6M%2fyb%2bszMpBM%2b5MeYyEAdgqG2d2BfMrW0LxwWQXDHSzk1XL5rcKiIkuj%2b1b%2fL%2fw8t9%2f7d0z1xMcZ%2fJMzXpTXiQ7v0FdzBSWVQWfwGZ72zK5k2vfBUxdjH8ZUhezGZESmGwD4WNys%2fvKLl90G5wtOljEW3cJkHxtbP2GdhxpglHwSH7HMoRRnaj1e7UJ6wiWI5B8I8zEjhe8sLOGpdcmW6VwnnWva6iJbFeNxCdvbNRhL%2bwetw6PUph8JhSgjgZqwzI0HMy%2fbce%2fT3%2fOkKf2n2ujTJB9P5AyIaPkpjD2g8s7SbpdB34jQDiM25jBALjpw7KLcbV23v9tLxzheFu2O9TOMdnaLZpq7lRhWjByt92CHlLa7ibFLzfGZ1q%2b5xjF6vlDaw4g%2boNNIwDRgn%2bgh9CL9uzxwm60OrieEnyjVgcwQga6Nv8CLNO79Q4aDaI9%2fJm6OVXOBoGP1ipEko2%2fWAQGTkfcLMaGZJHzdd8EL6vOnxzhypouXN4IWCx0rLyyBWDuRUofGuK27O%2fMQb101depgUmmVcUJo8cT%2b7vdlPPE8Ad7ECJzQkmuA1TNe0OiUovsQNKIXrXhjYO%2fkzB%2fAqskq%2b7KNqznGq0%2b%2fWDWNnCujabUW0WiJIkVrkNVe0aHEEN8INfovFDfSBoYmDfZaqGrtxbO8O6x3jRob4YHPkoDxEXFyU73lS8kvUZaMbztxGMLt0ZqDQbxORKtjVqj8%2b1TyH0NWE0bxpOFaamfWVcWC%2b0eI%2bsG9gkCR1ixNW9YzdTALbiANnYJhCJjpVwdDaTVSVWBLeKPiP2CRHFkRNu9zy2DWNN6H6Zr5jDlWjaM0mUeVQtuBEJTE6zhSjqsNYrV03qW%2b1792eo14QZgUC1%2baAfHakHccb2Lu2EpGt0N3xPB56pfFT5tQZvY9WW52MorNVkbR1fYPlMusT%2b%2fNzTf%2b5qEDSpEb%2fhM5cdzF6iw3my15A10xJoVJLn6BYY4f7P4vRvRCf6beZNVodoIDuQRhnxO99JKtgPXts3KqNz5w0L8%2f9SQs0vVMWOetPLf2feErxbk%2bysEIApYTXt9E8gWC%2bBidpbJ48uFzGPZqaeWfShrT6t5sULOmg%2fOdZHGThqdHM1XrY7InGOaNnaZakEuMhdJkRC1vQuoTdwdBWMeRqoxMuZAweRhEADTcXb1mYWUcSSP0e84l5qdkNougqfJWEXRA2%2fYf0gMwl0jlUVE%2b8W6OuvEYMqzAB9mKnNT2FUHG%2fbmjMy0%2bldd7erEAAAAAeqID%2f%2bSzqj1sp%2bmBdzn9A5vvd%2flpHEOGLJX5cO9u70rH5tHojxCBp6Mg9pbNc2RXsQ9yri8KBFvofXlAovzni&c=ser5&c=dg4&c=ad&c=23s&c=&c=&c=&c=\""	ScreenConnect.ClientService.exe

ConnectWise ScreenConnect remote access tool
ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
backdoor rat
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 4 IoCs

pid	Process
3040	ScreenConnect.ClientSetup.exe
1952	ScreenConnect.ClientService.exe
1720	ScreenConnect.WindowsClient.exe
2880	ScreenConnect.WindowsClient.exe

Loads dropped DLL 42 IoCs

pid	Process
2736	MsiExec.exe
2168	rundll32.exe
2168	rundll32.exe
2168	rundll32.exe
2168	rundll32.exe
2168	rundll32.exe
2168	rundll32.exe
2168	rundll32.exe
2168	rundll32.exe
2168	rundll32.exe
2736	MsiExec.exe
4456	rundll32.exe
4456	rundll32.exe
4456	rundll32.exe
4456	rundll32.exe
4456	rundll32.exe
4456	rundll32.exe
4456	rundll32.exe
4456	rundll32.exe
4456	rundll32.exe
2736	MsiExec.exe
3336	rundll32.exe
3336	rundll32.exe
3336	rundll32.exe
3336	rundll32.exe
3336	rundll32.exe
3336	rundll32.exe
3336	rundll32.exe
3336	rundll32.exe
3336	rundll32.exe
3572	MsiExec.exe
384	MsiExec.exe
1952	ScreenConnect.ClientService.exe
1952	ScreenConnect.ClientService.exe
1952	ScreenConnect.ClientService.exe
1952	ScreenConnect.ClientService.exe
1952	ScreenConnect.ClientService.exe
1952	ScreenConnect.ClientService.exe
1952	ScreenConnect.ClientService.exe
1952	ScreenConnect.ClientService.exe
1952	ScreenConnect.ClientService.exe
1952	ScreenConnect.ClientService.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe

Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs

Suspicious Windows Authentication Registry Modification.

persistence privilege_escalation

Authentication Package

T1547.002

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\Authentication Packages = 6d007300760031005f003000000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800320062006500370031003100310039003100610036006400320035006200650029005c00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f0077007300410075007400680065006e007400690063006100740069006f006e005000610063006b006100670065002e0064006c006c0000000000	msiexec.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (2be711191a6d25be)\rqfha3kg.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (2be711191a6d25be)\rqfha3kg.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ScreenConnect.WindowsClient.exe.log	ScreenConnect.WindowsClient.exe

Drops file in Program Files directory 17 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ScreenConnect Client (2be711191a6d25be)\ScreenConnect.WindowsBackstageShell.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (2be711191a6d25be)\ScreenConnect.WindowsClient.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (2be711191a6d25be)\ScreenConnect.WindowsFileManager.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (2be711191a6d25be)\ScreenConnect.WindowsFileManager.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (2be711191a6d25be)\system.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (2be711191a6d25be)\ScreenConnect.ClientService.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (2be711191a6d25be)\ScreenConnect.WindowsAuthenticationPackage.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (2be711191a6d25be)\ScreenConnect.WindowsClient.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (2be711191a6d25be)\ScreenConnect.ClientService.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (2be711191a6d25be)\ScreenConnect.Client.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (2be711191a6d25be)\ScreenConnect.Windows.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (2be711191a6d25be)\ScreenConnect.WindowsCredentialProvider.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (2be711191a6d25be)\Client.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (2be711191a6d25be)\ScreenConnect.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (2be711191a6d25be)\ScreenConnect.WindowsBackstageShell.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (2be711191a6d25be)\app.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (2be711191a6d25be)\Client.resources	msiexec.exe

Drops file in Windows directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\e5dd544.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID64E.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF14DE27253C4DF216.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF66DF67D7B3200180.TMP	msiexec.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File created	C:\Windows\Installer\e5dd544.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFD5045A681B4BA404.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID66E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{F6B2A864-E6EC-0C82-BD84-EB68BC03248C}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID75A.tmp	msiexec.exe
File created	C:\Windows\Installer\e5dd546.msi	msiexec.exe
File created	C:\Windows\Installer\{F6B2A864-E6EC-0C82-BD84-EB68BC03248C}\DefaultIcon	msiexec.exe
File created	C:\Windows\SystemTemp\~DFE5CADE4928F3451F.TMP	msiexec.exe
File created	C:\Windows\Installer\wix{F6B2A864-E6EC-0C82-BD84-EB68BC03248C}.SchedServiceConfig.rmi	MsiExec.exe
File opened for modification	C:\Windows\Installer\{F6B2A864-E6EC-0C82-BD84-EB68BC03248C}\DefaultIcon	msiexec.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\ScreenConnect.ClientSetup.exe:Zone.Identifier	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenConnect.ClientSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenConnect.ClientService.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4372	chrome.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000d3137aa3aa466ad60000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000d3137aa30000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900d3137aa3000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1ad3137aa3000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dd3137aa3000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ScreenConnect.WindowsClient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ScreenConnect.WindowsClient.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.ClientService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134215195218231392"	chrome.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.ClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.WindowsClient.exe

Modifies registry class 43 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\468A2B6FCE6E28C0DB48BE86CB3042C8\Full	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\468A2B6FCE6E28C0DB48BE86CB3042C8\Version = "436273176"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-2be711191a6d25be\UseOriginalUrlEncoding = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-6906-9238D3BA6DFD}\InprocServer32\ = "C:\\Program Files (x86)\\ScreenConnect Client (2be711191a6d25be)\\ScreenConnect.WindowsCredentialProvider.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\468A2B6FCE6E28C0DB48BE86CB3042C8\PackageCode = "468A2B6FCE6E28C0DB48BE86CB3042C8"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-2be711191a6d25be	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-2be711191a6d25be\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-2be711191a6d25be\shell	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-6906-9238D3BA6DFD}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\E6E42AE0BF43E003B27E1191A1D652EB	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\468A2B6FCE6E28C0DB48BE86CB3042C8\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\468A2B6FCE6E28C0DB48BE86CB3042C8\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\26.1.24.9579\\2be711191a6d25be\\"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-6906-9238D3BA6DFD}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\468A2B6FCE6E28C0DB48BE86CB3042C8	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\468A2B6FCE6E28C0DB48BE86CB3042C8\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-2be711191a6d25be	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\468A2B6FCE6E28C0DB48BE86CB3042C8\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\468A2B6FCE6E28C0DB48BE86CB3042C8\ProductIcon = "C:\\Windows\\Installer\\{F6B2A864-E6EC-0C82-BD84-EB68BC03248C}\\DefaultIcon"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\468A2B6FCE6E28C0DB48BE86CB3042C8\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\468A2B6FCE6E28C0DB48BE86CB3042C8\SourceList\PackageName = "ScreenConnect.ClientSetup.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\468A2B6FCE6E28C0DB48BE86CB3042C8\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\468A2B6FCE6E28C0DB48BE86CB3042C8\SourceList\Media	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-2be711191a6d25be\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-6906-9238D3BA6DFD}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\468A2B6FCE6E28C0DB48BE86CB3042C8\ProductName = "ScreenConnect Client (2be711191a6d25be)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\E6E42AE0BF43E003B27E1191A1D652EB\468A2B6FCE6E28C0DB48BE86CB3042C8	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\468A2B6FCE6E28C0DB48BE86CB3042C8\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-2be711191a6d25be\URL Protocol	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-2be711191a6d25be\shell\open	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\468A2B6FCE6E28C0DB48BE86CB3042C8\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\468A2B6FCE6E28C0DB48BE86CB3042C8\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\468A2B6FCE6E28C0DB48BE86CB3042C8\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-6906-9238D3BA6DFD}\ = "ScreenConnect Client (2be711191a6d25be) Credential Provider"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\468A2B6FCE6E28C0DB48BE86CB3042C8\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\468A2B6FCE6E28C0DB48BE86CB3042C8\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\26.1.24.9579\\2be711191a6d25be\\"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-2be711191a6d25be\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (2be711191a6d25be)\\ScreenConnect.WindowsClient.exe\" \"%1\""	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\468A2B6FCE6E28C0DB48BE86CB3042C8	msiexec.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\ScreenConnect.ClientSetup.exe:Zone.Identifier	chrome.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3996	chrome.exe
3996	chrome.exe
3996	chrome.exe
3996	chrome.exe
4444	chrome.exe
4444	chrome.exe
2464	msiexec.exe
2464	msiexec.exe
1952	ScreenConnect.ClientService.exe
1952	ScreenConnect.ClientService.exe
1952	ScreenConnect.ClientService.exe
1952	ScreenConnect.ClientService.exe
1952	ScreenConnect.ClientService.exe
1952	ScreenConnect.ClientService.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
3996	chrome.exe
3996	chrome.exe
3996	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3996	chrome.exe
Token: SeCreatePagefilePrivilege	3996	chrome.exe
Token: SeShutdownPrivilege	3996	chrome.exe
Token: SeCreatePagefilePrivilege	3996	chrome.exe
Token: SeShutdownPrivilege	3996	chrome.exe
Token: SeCreatePagefilePrivilege	3996	chrome.exe
Token: SeShutdownPrivilege	3996	chrome.exe
Token: SeCreatePagefilePrivilege	3996	chrome.exe
Token: SeShutdownPrivilege	3996	chrome.exe
Token: SeCreatePagefilePrivilege	3996	chrome.exe
Token: SeShutdownPrivilege	3996	chrome.exe
Token: SeCreatePagefilePrivilege	3996	chrome.exe
Token: SeShutdownPrivilege	3996	chrome.exe
Token: SeCreatePagefilePrivilege	3996	chrome.exe
Token: SeShutdownPrivilege	3996	chrome.exe
Token: SeCreatePagefilePrivilege	3996	chrome.exe
Token: SeShutdownPrivilege	3996	chrome.exe
Token: SeCreatePagefilePrivilege	3996	chrome.exe
Token: SeShutdownPrivilege	3996	chrome.exe
Token: SeCreatePagefilePrivilege	3996	chrome.exe
Token: SeShutdownPrivilege	3996	chrome.exe
Token: SeCreatePagefilePrivilege	3996	chrome.exe
Token: SeShutdownPrivilege	3996	chrome.exe
Token: SeCreatePagefilePrivilege	3996	chrome.exe
Token: SeShutdownPrivilege	3996	chrome.exe
Token: SeCreatePagefilePrivilege	3996	chrome.exe
Token: SeShutdownPrivilege	3996	chrome.exe
Token: SeCreatePagefilePrivilege	3996	chrome.exe
Token: SeShutdownPrivilege	3996	chrome.exe
Token: SeCreatePagefilePrivilege	3996	chrome.exe
Token: SeShutdownPrivilege	3996	chrome.exe
Token: SeCreatePagefilePrivilege	3996	chrome.exe
Token: SeShutdownPrivilege	3996	chrome.exe
Token: SeCreatePagefilePrivilege	3996	chrome.exe
Token: SeShutdownPrivilege	3996	chrome.exe
Token: SeCreatePagefilePrivilege	3996	chrome.exe
Token: SeShutdownPrivilege	3996	chrome.exe
Token: SeCreatePagefilePrivilege	3996	chrome.exe
Token: SeShutdownPrivilege	3996	chrome.exe
Token: SeCreatePagefilePrivilege	3996	chrome.exe
Token: SeShutdownPrivilege	3996	chrome.exe
Token: SeCreatePagefilePrivilege	3996	chrome.exe
Token: SeShutdownPrivilege	3996	chrome.exe
Token: SeCreatePagefilePrivilege	3996	chrome.exe
Token: SeShutdownPrivilege	3996	chrome.exe
Token: SeCreatePagefilePrivilege	3996	chrome.exe
Token: SeShutdownPrivilege	3996	chrome.exe
Token: SeCreatePagefilePrivilege	3996	chrome.exe
Token: SeShutdownPrivilege	3996	chrome.exe
Token: SeCreatePagefilePrivilege	3996	chrome.exe
Token: SeShutdownPrivilege	3996	chrome.exe
Token: SeCreatePagefilePrivilege	3996	chrome.exe
Token: SeShutdownPrivilege	3996	chrome.exe
Token: SeCreatePagefilePrivilege	3996	chrome.exe
Token: SeShutdownPrivilege	3996	chrome.exe
Token: SeCreatePagefilePrivilege	3996	chrome.exe
Token: SeShutdownPrivilege	3996	chrome.exe
Token: SeCreatePagefilePrivilege	3996	chrome.exe
Token: SeShutdownPrivilege	3996	chrome.exe
Token: SeCreatePagefilePrivilege	3996	chrome.exe
Token: SeShutdownPrivilege	3996	chrome.exe
Token: SeCreatePagefilePrivilege	3996	chrome.exe
Token: SeShutdownPrivilege	3996	chrome.exe
Token: SeCreatePagefilePrivilege	3996	chrome.exe

Suspicious use of FindShellTrayWindow 52 IoCs

pid	Process
3996	chrome.exe
3996	chrome.exe
3996	chrome.exe
3996	chrome.exe
3996	chrome.exe
3996	chrome.exe
3996	chrome.exe
3996	chrome.exe
3996	chrome.exe
3996	chrome.exe
3996	chrome.exe
3996	chrome.exe
3996	chrome.exe
3996	chrome.exe
3996	chrome.exe
3996	chrome.exe
3996	chrome.exe
3996	chrome.exe
3996	chrome.exe
3996	chrome.exe
3996	chrome.exe
3996	chrome.exe
3996	chrome.exe
3996	chrome.exe
3996	chrome.exe
3996	chrome.exe
3996	chrome.exe
3996	chrome.exe
3996	chrome.exe
3996	chrome.exe
3996	chrome.exe
3996	chrome.exe
3996	chrome.exe
3996	chrome.exe
3996	chrome.exe
3996	chrome.exe
3996	chrome.exe
3996	chrome.exe
3996	chrome.exe
3996	chrome.exe
3996	chrome.exe
3996	chrome.exe
3996	chrome.exe
3996	chrome.exe
2504	msiexec.exe
3996	chrome.exe
2504	msiexec.exe
1720	ScreenConnect.WindowsClient.exe
1720	ScreenConnect.WindowsClient.exe
1720	ScreenConnect.WindowsClient.exe
1720	ScreenConnect.WindowsClient.exe
1720	ScreenConnect.WindowsClient.exe

Suspicious use of SendNotifyMessage 21 IoCs

pid	Process
3996	chrome.exe
3996	chrome.exe
3996	chrome.exe
3996	chrome.exe
3996	chrome.exe
3996	chrome.exe
3996	chrome.exe
3996	chrome.exe
3996	chrome.exe
3996	chrome.exe
3996	chrome.exe
3996	chrome.exe
3996	chrome.exe
3996	chrome.exe
3996	chrome.exe
3996	chrome.exe
1720	ScreenConnect.WindowsClient.exe
1720	ScreenConnect.WindowsClient.exe
1720	ScreenConnect.WindowsClient.exe
1720	ScreenConnect.WindowsClient.exe
1720	ScreenConnect.WindowsClient.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 3996 wrote to memory of 836	3996	chrome.exe	79
PID 3996 wrote to memory of 4784	3996	chrome.exe	80
PID 3996 wrote to memory of 4372	3996	chrome.exe	81
PID 3996 wrote to memory of 4784	3996	chrome.exe	80
PID 3996 wrote to memory of 2508	3996	chrome.exe	82
PID 3996 wrote to memory of 2508	3996	chrome.exe	82
PID 3996 wrote to memory of 2912	3996	chrome.exe	83
PID 3996 wrote to memory of 3432	3996	chrome.exe	84
PID 3996 wrote to memory of 2912	3996	chrome.exe	83
PID 3996 wrote to memory of 3432	3996	chrome.exe	84
PID 3996 wrote to memory of 4084	3996	chrome.exe	85
PID 3996 wrote to memory of 4084	3996	chrome.exe	85
PID 3996 wrote to memory of 944	3996	chrome.exe	88
PID 3996 wrote to memory of 436	3996	chrome.exe	90
PID 3996 wrote to memory of 4684	3996	chrome.exe	91
PID 3996 wrote to memory of 2868	3996	chrome.exe	92
PID 3996 wrote to memory of 4444	3996	chrome.exe	93
PID 3996 wrote to memory of 1892	3996	chrome.exe	94
PID 3996 wrote to memory of 1892	3996	chrome.exe	94
PID 3996 wrote to memory of 5060	3996	chrome.exe	95
PID 3040 wrote to memory of 2504	3040	ScreenConnect.ClientSetup.exe	98
PID 2464 wrote to memory of 2736	2464	msiexec.exe	100
PID 2736 wrote to memory of 2168	2736	MsiExec.exe	101
PID 2736 wrote to memory of 4456	2736	MsiExec.exe	102
PID 2736 wrote to memory of 3336	2736	MsiExec.exe	103
PID 2464 wrote to memory of 4860	2464	msiexec.exe	107
PID 2464 wrote to memory of 3572	2464	msiexec.exe	109
PID 2464 wrote to memory of 384	2464	msiexec.exe	110
PID 1952 wrote to memory of 1720	1952	ScreenConnect.ClientService.exe	112
PID 1952 wrote to memory of 2880	1952	ScreenConnect.ClientService.exe	113

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://corpo-gestion.screenconnect.com/Bin/ScreenConnect.ClientSetup.exe?e=Access&y=Guest&c=ser5&c=dg4&c=ad&c=23s&c=&c=&c=&c=
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9605bc728,0x7ff9605bc734,0x7ff9605bc740
  2⤵
  PID:836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1600,i,17167541932499674247,15096992353187300488,262144 --field-trial-handle=1924,i,13941113225446142770,18144279055859633957,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1916 /prefetch:2
  2⤵
  PID:4784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2068,i,6912953793301139026,11732686422166197604,524288 --field-trial-handle=1924,i,13941113225446142770,18144279055859633957,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2132 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2364,i,11550083791325749227,2362728230577785798,524288 --field-trial-handle=1924,i,13941113225446142770,18144279055859633957,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2376 /prefetch:13
  2⤵
  PID:2508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3144,i,8543019091246820326,12382460298200893890,2097152 --field-trial-handle=1924,i,13941113225446142770,18144279055859633957,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3180 /prefetch:1
  2⤵
  PID:2912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3148,i,16340890258601182790,15652853351766253992,2097152 --field-trial-handle=1924,i,13941113225446142770,18144279055859633957,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:3432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3984,i,16939853776559402221,16281798591943928005,2097152 --field-trial-handle=1924,i,13941113225446142770,18144279055859633957,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3996 /prefetch:9
  2⤵
  PID:4084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5428,i,6083174799897790870,7897983408580215153,524288 --field-trial-handle=1924,i,13941113225446142770,18144279055859633957,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5476 /prefetch:14
  2⤵
  PID:944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5576,i,103337541588113150,6470356850977851190,524288 --field-trial-handle=1924,i,13941113225446142770,18144279055859633957,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5760 /prefetch:14
  2⤵
  PID:436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5244,i,16613196818871918798,9824158165839816862,524288 --field-trial-handle=1924,i,13941113225446142770,18144279055859633957,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5468 /prefetch:14
  2⤵
  PID:4684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5736,i,11708019101891155970,17730083409440898716,524288 --field-trial-handle=1924,i,13941113225446142770,18144279055859633957,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5620 /prefetch:14
  2⤵
  PID:2868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5708,i,15345026981573833776,4955036168137600066,262144 --field-trial-handle=1924,i,13941113225446142770,18144279055859633957,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4716 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4884,i,9625394066049059288,9780400294873471568,524288 --field-trial-handle=1924,i,13941113225446142770,18144279055859633957,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2408 /prefetch:14
  2⤵
  PID:1892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4068,i,16319889747717557725,8086566812635110315,524288 --field-trial-handle=1924,i,13941113225446142770,18144279055859633957,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4040 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:5060

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2128

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:244

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2260

C:\Users\Admin\Downloads\ScreenConnect.ClientSetup.exe
"C:\Users\Admin\Downloads\ScreenConnect.ClientSetup.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\26.1.24.9579\2be711191a6d25be\ScreenConnect.ClientSetup.msi" SC_EXE_PATH="C:\Users\Admin\Downloads\ScreenConnect.ClientSetup.exe"
  2⤵
  - Badlisted process makes network request
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  PID:2504

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Boot or Logon Autostart Execution: Authentication Package
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2464
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 5A3A96D991333148873D1CDE73C46986 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2736
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIA2DF.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240952171 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2168
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIA62C.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240952875 11 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.CheckMsiMotw
    3⤵
    - Badlisted process makes network request
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:4456
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI9F23.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_241016750 16 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.CheckMsiFileName
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:3336
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4860
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 74A7AEF615602FEA18CDE533A1E746EB
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3572
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding F8717CA8410D368AAFE104C2978B9967 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:384

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:4312

C:\Program Files (x86)\ScreenConnect Client (2be711191a6d25be)\ScreenConnect.ClientService.exe
"C:\Program Files (x86)\ScreenConnect Client (2be711191a6d25be)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=instance-eefr6a-relay.screenconnect.com&p=443&s=f60bd798-016d-4500-ba61-7a883318e2eb&k=BgIAAACkAABSU0ExAAgAAAEAAQAp3ZiMnmZZEn2UFMyW7ngJvQ9o8phKZq525p7mHexLvi0lYS%2f9FZQnaguvX9Baz7Z0Gy1M4%2fmfO%2bS%2bYmBQ5C1QnSWMS7frwvrxLo5GXJWbWS5mu1pCzREabr8oRaBkxaEkX4BH%2fXhWEysoZGAPmb%2fk0GASxfR8Iz%2f4eJ2%2fkIt32uclD2weE9bGw9nowSMMS%2ffR8qIOtXnplHYwqAA1m%2b%2fY%2bK9MpgTTuvUw8ieTOOsw5d%2bZLseBNU1o6xaihSNQKMzVHBphaG8dF5pAhMQbyMVEGUwaqrX%2bWFHBzxz1Yv9kIE9IZMKXEKwTApQJAU3eD1keBnHAJ%2fEAONRotPQYLkXR&c=ser5&c=dg4&c=ad&c=23s&c=&c=&c=&c="
1⤵
- Sets service image path in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Program Files (x86)\ScreenConnect Client (2be711191a6d25be)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (2be711191a6d25be)\ScreenConnect.WindowsClient.exe" "RunRole" "fb5ebbaa-9dbe-4222-a28b-d2be791f970d" "User"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1720
- C:\Program Files (x86)\ScreenConnect Client (2be711191a6d25be)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (2be711191a6d25be)\ScreenConnect.WindowsClient.exe" "RunRole" "73bb4f4f-cb53-4493-acb0-3eb25b076df5" "System"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  PID:2880

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5dd545.rbs

Path C:\Config.Msi\e5dd545.rbs
Size 214KB
SHA256 e9aba541f5d9e3ffc17c923a031fc0180af52da3b5627fac33c50232b5084d80
MD5 0b4a5563f5d9238099895989646be354
SHA1 0ab9cf06bfb3509f19b2180008d4dfc5a7a5378a
SHA512 d75e1d7bcdfd5150693b747d3b7e52f7e917177c9e71776e9db2f61086500577b06b4c6015573fb88bc576a7108ed90eeeec34d3d51f49ddcd39d18e08f29bb7
SSDEEP 3072:+W9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMGn:+WuH2aCGw1ST1wQLdqvn
TLSH
T152248C217484807EE7FA1A32D93F9A617E7CF6281760C99E83848C1E5D604D06BF7B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Program Files (x86)\ScreenConnect Client (2be711191a6d25be)\ScreenConnect.ClientService.dll
Size 90KB
SHA256 9cf2c77df0a1a1e854ec1bbc6940d96f508bfb4b0555a07657c77314803a717e
MD5 cee388546abc6dfb7a766a33a8066ff5
SHA1 a41ffb64a859ff3bd32589ce58ac03a84c0b1955
SHA512 8c1d39bf142048a93c5388ebacc1a409c773ce7ec9f684127a97779a53c4914ef650f8d8474e4d999b12b848ca1ff4d3a697a0888dd1213d6414c703fc3c37f8
SSDEEP 1536:QtZxUAtbcOyfDNq9IxcBoSDW3ieKw/PM3ZRVQbV3l5EpSj/zJX+VugmCD74mGyN:Qa4CDIICCieKnVQbVDEkj/zJX+VugPD7
TLSH
T1BB935C0293AD993BC9DF4E34B461F1610AB1BA13D4E7E7D99D9864E62F063C11F043AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Program Files (x86)\ScreenConnect Client (2be711191a6d25be)\ScreenConnect.ClientService.exe
Size 93KB
SHA256 01341bd42426c3d110136cc94433df00dbad690a56593f7cca41a93f698f214a
MD5 751e8bcc20a49aeab090d99a6417919f
SHA1 c2a313826c8fd840e4583435f821229c25ac34bf
SHA512 91b278afa4ef8d917552a9da6f5df3e5c93319a7e69baedca3cfb1f68463f17f16e1649e027bc574136753cea2d77f7cf5dede7c1a3e02ebc1f9131e1245f9b0
SSDEEP 1536:vg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgUT0HMm7mT:YhbNDxZGXfdHrX7rAc6myJkgUT0H7iT
TLSH
T117935A13B5C28872D473093158E0DAB09A3FF9615E61DEAB3798022E4F742C1AE75E77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_59E89BCE9615F2B61F2F2C691688F111

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_59E89BCE9615F2B61F2F2C691688F111
Size 727B
SHA256 91d753f140351252586bdb9f09f863be874cac37ebf278b269d2711c940f912f
MD5 04018ef289a4ad2d70c9a4ea0593cb38
SHA1 999f0568009354c47463fa78cdaae400871ade9b
SHA512 89be2821ed6751e8ceac2d1b9f09cdc12f66106c063cf43c7ff44fae25a3d0a4750df29e40e026f4e5373de2dbce5d5e5c3b44d006a659498cb02425871c7c9c
TLSH
T18B01B553593C6800D7320C00CE72C7B878F409C222F84F7F237801C08AA93314C3A527
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 727B
SHA256 ee09d28a61cf6899ae48a0d7d18c0bc476ad048deb6912ebeb17394488be1025
MD5 a7c4adf9c1253497d873b11fa681311b
SHA1 be4b62cedb3c04b66b8ad0e759fe1f7a61674753
SHA512 3781523f972dcdcb1141149da989f3c537f0d122c0b18a6d0847c1d79702c3943b81b0b02dafaf5b1ed9df5b9f0549e709ad5dcf41de77cf3d8562c0605a0310
TLSH
T111012C1B742AAA407801DE409BEC1B717A3A2AD509B6977410FC228F098DBB4E84A684
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_59E89BCE9615F2B61F2F2C691688F111

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_59E89BCE9615F2B61F2F2C691688F111
Size 404B
SHA256 de528c409efc06ddaee216b7aed75674cfa1fc75ab07b38166e3f833a0eef1f3
MD5 d0f42c4cd53f3ffee455ebc48b2ac68e
SHA1 3b146ea60910be86238d3b22227fd98881fda152
SHA512 75d670fd47506b6849af28d3dd7e505e8de6cee55e1b32114b1194beb1a0e5ddcd2fae14ce23d4b4b771ef23b2c0cd5805928e8feea898d353073ac01a0345ea
TLSH
T1FCE0C63430FC88ADF1F4D83482F99E138889F2A60090EA7C10E21302AA00A008CA2A24
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 412B
SHA256 39263ecb7eed4d6885e29b5b29bece15e5ffd08be48560859b1daa9d43695eda
MD5 4338e6b9a507036228ee4b3488a3ec44
SHA1 93bb1a00752755704ce0c2253d31e1c719cdbee9
SHA512 c321e83a684dc51238af7ef4d043bb19d7a33f9d7897f184006adcc21c6872127f5d2f1b52df985aa69933cd407754068fe68ba4c8302f7859827966c7f82323
TLSH
T14FE06F2821EBA58EF0A0C93986E9E17A0E48E320102082BA20C84308BB1AE00AC10AB0
MD5 SHA1 SHA512 TLSH

Submit Download

22ca1c7f-f99e-468b-9626-7e4d38951719.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\22ca1c7f-f99e-468b-9626-7e4d38951719.tmp
Size 414B
SHA256 408502c0e8d968dbc8d63eb1c8539486f3056877f59969232f6eef3972342542
MD5 564065132b824243fb38c304898ec764
SHA1 bf6dacc42fa1328e0160a907dbe17875967d87ee
SHA512 2af1dea52587d45e1d385aff58db43cee95dc67c766718aea6a1126aea63ec7df6b76fbaba745b48f06c694e1b328c3a4324bcf4da4f5bbd5dcf28f2544f99fd
TLSH
T199E02BDDE921E82B08FE476961544F56F721135B2B40484F3F3C810C4FB053B498985C
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 eccfe652b59add42392816ab7d5b1955c432eb54adfeb151f1318f0c8d14e07a
MD5 1348e69e940f6121b9f86d981b07aeec
SHA1 642cb02298e24dade7951ee01b289755ea1edadb
SHA512 4dd3485ce250a38d0cc1afc885ffc5af6442a468091a787dcf4e5fe4f845a8a8b7ea854bdd8385302015d3423d48c0bf9b4319c8d0017c603ec7848f016f04ba
SSDEEP 3:MsEllllkEthXllkl2zEfln/:/M/xT02z
TLSH
T1244404057FC04415D50174305D51C3543370DCD14D31575334D504335CC75400C00100
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 73b48d2db33bb4423eb48a8cf7b1f22112706600e67ecd84e072a6cbe533a6a9
MD5 60490572e1fa0f1d85f0604845342d0a
SHA1 5fb926fe779b845faab5b53655975d7b28753796
SHA512 2de87b7cf7d9175bc837cccdb59deb9c90f2aa6d0c73464145d63fe815c6f110ee86970a1179b5f8039acfbc6fe5d3abc4d7f58054b997f8282218287cd573d8
TLSH
T15E41ACF793B4997E861192E4EA146E2FCE7D0624031C7CA2C9D4AE1B43F2972D20138F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 dc21775576ee3735c0e471c000a80e199a2217135e23359dd136f7847ed71477
MD5 78f2a111d7339a04a5897fee7ade2053
SHA1 be7ea1c7b937ddf2ccb0f1d7cbb7728094d165f9
SHA512 23e24eb99dbc73762970a230b58c7b06280cea7ff0834237a32569e8fd69b34370de5985148b94b43e876eef7b21ac79f64e84e2338e303e1595f8c041e8faf6
TLSH
T1EC418BF793B4997E861192E4EA156E2FDE7D0624031C7CA289D4AF1B43F2972D24138F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 519B
SHA256 5fc0abc224d9f304c21b08384c5220439ca085382902860e3ec0376da2774f57
MD5 ca45a17eeddafa25654b9254cc59975e
SHA1 b19db57834997195bff2ccb4296b704ad134b66a
SHA512 931345e2175080fc4c2228a4e1d7419afd78d528d091d50640e3b2cb493bb9e48c8cecb3dac090e410d2833a2a10904dd0a6c72bd32e84177d00285c8bbefad5
TLSH
T183F050EBE6BD782B70BD55AF1D14B80528B59835058118E4CED6427CA08A5F30B03407
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 901bd2967c49d16b7dafe79ed70c75a0fb86dcf586e59fa92d020194cc2a1dd3
MD5 ac480abadd114bd725a36f08a04e2e7a
SHA1 91e4113579aee93ec6529632787b36086a802858
SHA512 2d5b051bce934116302abc25f9463bab65f0997adae9c55526144330d7b95db4ae2e94a31fdbcee395c96fa8a791973d5e219fa7b7b813fdb4cba81d93fab13b
SSDEEP 192:2R49LwEZaf3auwv7ApVPRp9w9qHsb+WNnz/PLXe62Wd6atXm3PyIsnAUgE:2R49khss/XO4wTPf2M6aoE
TLSH
T11652E82EA914793B5CD7C619F961BB53E3F5102131942E88EBFC8B2C15E79CD221B02B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 80ac9abe48ba5764588796f61c8a427fc67e0e99bca66c0a297da508007df454
MD5 66a33ac8bf84ed9956bf61f79bf44556
SHA1 0b9b17439c68a496a954591774e8436c0fe6bc03
SHA512 f1471af856a7e5168fd952f4a1978261c9259d6a668cf4ebd890ea81a8a97eca2bb2bf58f2f1dc141479bf66b89152fdadcbbff16576d5797623485737fab356
SSDEEP 192:2R49nWY3aulv7ApAPRp2w9qHsb+WNnz/PPXe62Wd6atToVyIsnAUge:2R49WSVsUXz4wTPb2M6a6e
TLSH
T11C42D72EA914793B5CC7C219FA65B747E7F5102171D42E88EBFC8A2C15E79CD221B02B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 1008946f8d87896cc3f191cdc1fa6c55a838f9d0bc7ef70dfdf69575b5fdd515
MD5 79ea704cdcd37598e4b4f7928bde72b5
SHA1 1df91dc751355bfe8db81a1a86b3d8f5c9bbc7ae
SHA512 f4c7fd8bda6adf3948b6cce5f6a9a044b1d0fb3ad1a0fb999e4303ece2cc9f6260a2ee206b79c55e5401290f38306c867249bab5a7dc2ec795357978fa73ab8a
SSDEEP 192:2R49LwEZaf3aulv7ApAPRp2w9qHsb+WNnz/PEXe62Wd6athoVyIsnAUgE:2R49khVsUXz4wTPa2M6aEE
TLSH
T15842E82EA914793B5CCBC219FA61B757E7F5102131942D88EBFC8B2C15E79CD221B02B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 02fa3748cc960b0ed806669146286ae61d8f8c37c72e1c20fff625c9b568d7c5
MD5 e1d791f76039330e35fa0e1827d639ea
SHA1 a37e7b6749565fdef84e626eb8e8ab5cfd1eaf09
SHA512 4cd2d4ec371de591ed8fc49a3c9c69bf2d80c0d8879044f55af268ee4a35e216538e529304db502c0dc2822c3e20cfadd9949c623d30489800bbc0cdffa3ddcc
SSDEEP 384:2Mjqt7KxkXqKf/pUZNCgVLH2Hfgslo67pLuLcifklXODqt+ErU3sjHG9TDWxSal2:2Aqt7KxkXqKf/pUZNCgVLH2Hfgsq67pU
TLSH
T1B672E8676C0C9D7B0F94C58CD8267E4FADB9024B65ED886483FA582A03D5BDF110A1F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 f4cb99c94ac93860dc9766273650bb672f3f2c41aa83bb061865effecac03f4e
MD5 ea62d3c4fd645b118a94fd2e9a9a58e6
SHA1 4a46e241d76a9a5a01b38bc9a59f5306f5e4d9c3
SHA512 821b2aefe33b06cd2ad469d5146f4cd61a18c8e4de557d602489eaa05d3f7e53fc5813d2e89d86c8ae2c4d44f6f4e82fd7c0d345949875a3976702f00cbc9c74
TLSH
T1AEB012708842B502C00703F43186A88C71149F118B05130153E069719C262D08024190
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5849a6.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5849a6.TMP
Size 120B
SHA256 084b117273c6810c981873617bce7fc131c571742d00cad0b3c642b207c61a79
MD5 3ab42283eca4321248dc71af2ba20926
SHA1 43437d2cb8b2dceca861b4260a56591a22dcd1e4
SHA512 dff3d3ed7a2bfd58a218ccd7c73308f8e2c828986e3c67e91690b62cf95a3419ff5f292bb8d1224d6c6e86e6ebfcaeefd725e7dff539631cf14130251c8841ec
TLSH
T1F1B012D5C001D680C14102B41D01C4CC3004FF10D9020367B2F41702AC35590463C050
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 2419e0547ece306e3cfa91f60f32a3c1e9cc607a268139d21a246fff783cc66c
MD5 64e680f2b2a5d89cb2f11957b983f3c8
SHA1 0dedff9e8697af1e6cbfdbd6e33cc646ce560f1f
SHA512 4649d5b099d62ac700e2f5949161645882ce07c20d83b87a101b6826392a71a8550d8704046f7bd9cb17476cc17709abf3f2ca361847bbdec1f762263e782d43
SSDEEP 1536:EPdBP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNs:Sp++J3qUQm08KMWF0bFTcVHr6zT
TLSH
T1AF9302B9991E7D7913ABD696D0079CAC4CD3CCCE1518657C30C7AF1E04BA392A34B8A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 5e0a69007a29b70218046c89742c7cfecce9bb13f5b7047c83dc05d564ae5233
MD5 abe5a9cb118ceacfb9e2493ffa9611d5
SHA1 0a006176e5e9c657537dc339477edea4a67b5cb5
SHA512 f3a3d5858e9e2a17b1b6cf073c8c862b4394aa963c06ecc435ea7ab173885d5784348640b837b2a1b9a934abd0eec9abffcffbe71e5af701edbda664c54dbbe3
SSDEEP 1536:0PgDP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNs:db++J3qUQm08KMWF0bFTcVHr6zT
TLSH
T1409302B9981E7D7913ABD6D6D0079C9C4CE38CCE1518657C30C76F1E14BA392A34B8E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 b63eb55d0d7f1a6fa049bc100940383eb08b2add81c4ea969ae728f4c7526851
MD5 559b79d90cce27ace063fbbb637b4220
SHA1 5b6e7abb5e604ce4d689e6969fa9b17e08c8768d
SHA512 e679e693cc7d7042bd5536fee1334bd87e76f6094667d16218c6a13d64f42fc0cb98ef105289ed0663c7a0d11ec8cbf16e2534c388e4223111e78a7be6e3e5d8
SSDEEP 1536:rPPkP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNs:2++J3qUQm08KMWF0bFTcVHr6zT
TLSH
T1059312B99C1E7D3923ABD2A6D0079CAC8CE388CE1514557C31C76F1E04BA393A34B8E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 2d5b02d092820e88c1d51ecebc8307c84f151b2fdec0d2c9868c141690ecae3e
MD5 eab59e81c75f3e45c88c6ae3ca204f6d
SHA1 dd5bac554c3a0e98c463e4742db2e23abd3cb747
SHA512 2ad3361956b85b1067c098c0bd8e2648473549039ec1d1adce94cdfc8d6ed2beae1dddedca0f3fa310db6b95ef533023ade7f8e25f971c38eef77e4157854c0b
SSDEEP 1536:0PPkP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNs:7++J3qUQm08KMWF0bFTcVHr6zT
TLSH
T14C9312B99C1E7D3913ABD6A6D0079CAC4CE398CE1514557C31C76F1E04BA393A34B8A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 0290efe01edbeb6677c441bf086994d8d7211e18f23fb90555e53a15705a48a6
MD5 775e634a03cdbb7ea1ed4ca31282816b
SHA1 f3e4870a7dfe5f617c564504f79bd2b6c5a3a551
SHA512 91a6efdf2dc1a7d54a1e456761cd79755b48ed87a205b70763ed8dcfc6fab4e9fc1d1341ea7b0a1ad31cbe0ff0664c3ec158a5d3b944e84e01d35dea6bb46ac5
SSDEEP 1536:EPgDP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNs:tb++J3qUQm08KMWF0bFTcVHr6zT
TLSH
T1009302B9981E7D7953ABD6D6D0079CAC4CE38CCE1518657C30C76F1E04BA392A34B8E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 e18a50c6dea47209cb10af9a762a8b735d5f8194e4089314f65b38d63e627e31
MD5 2ffdbf739eaae2ea4ae86e2e0b9f1843
SHA1 0150be0d833d2149ea98a2ef901774dda9f5ff34
SHA512 8e4b248c5a3cbdc060b4c579ae71e6801b20e93e4839859e1278bf4d132e769c0da53570ef8961ac282ec4fba6f4483109e3eec1cef23414664a833db8d91023
SSDEEP 1536:hZeP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNs:M++J3qUQm08KMWF0bFTcVHr6zT
TLSH
T19A9312BA591E7D39536AC696D0079CAC8CE3CCCE1514557C30C7AB1E14BA393A30B8E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rundll32.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rundll32.exe.log
Size 746B
SHA256 76ced2c52d647683572ceac0687933e96e198b5a6f998457fa334763cc1ef978
MD5 26c503e0811477d4790fa3b9260e6bc3
SHA1 cd89a648ea30052b34d2ce993433967adfdf5b74
SHA512 125678cee78705f07e56d69ffbf08fd616dac3ea3f2ff34f4e703b0ec2329da575e5b30de4494639baa17d8e68343ceb9a4e99e9edcaf4cfad516a715a904874
TLSH
T1A4017B702231B5D948132F43085D66891BFF0755BAB8EE1CB599325EDC3A0176F222E3
MD5 SHA1 SHA512 TLSH

Submit Download

MSIA2DF.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSIA2DF.tmp
Size 1.1MB
SHA256 cd6bccce073b2a5205840ec31c91df0d443cc57c68756de2c03e21db8e3fc157
MD5 914db3d3a01cc102bfe18dbde54e56b3
SHA1 91246f683c6b78f67bf0eb7dd0043dc459f548cb
SHA512 58e60853dcd5cedfc83dca39e19a9c2a31d4ed6f230e393df9015f5e013189c9527db4e17e10f685c584b3c0e124573ac3ffd9ea24395e65b3a4eb681212ae7c
SSDEEP 24576:bUUGGakXrcMRzUH1YWmDqSPe+YPF0KkCNWUj2+bI4ie8tj3Nz:sGak7lQ1VmD3Pd0F0TCUU3bpiLvz
TLSH
T13935231537B8803AF1A62A306D3590621EFDB8B556F5C2992B99053D0FF2B81DB79333
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Deployment.WindowsInstaller.dll

Path C:\Users\Admin\AppData\Local\Temp\MSIA2DF.tmp-\Microsoft.Deployment.WindowsInstaller.dll
Size 172KB
SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
MD5 5ef88919012e4a3d8a1e2955dc8c8d81
SHA1 c0cfb830b8f1d990e3836e0bcc786e7972c9ed62
SHA512 4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684
SSDEEP 3072:FkfZS7FUguxN+77b1W5GR69UgoCaf8TpCnfKlRUjW01Ky4:x+c7b1W4R6joxfQE
TLSH
T14E045B2563FC473ECAEF87B4E2624251E7B2E2E97113DB0DDC8541AA2522780F792753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\MSIA2DF.tmp-\ScreenConnect.Core.dll
Size 562KB
SHA256 c51a2b5cb5054ec0136e332bf290c8af3392d7936b5137a07423df08ab33d264
MD5 d9ef4f245159eb7374677f603e18b9ec
SHA1 e7aa0b8bce504d31323d10dd987fa2d517649191
SHA512 c46494c811c828faffe9baea85cfb923a53ef088ee75d0798fea0482076b493c43ee4b2243a44e35e8e686423d108ee80ddad5546e723eb8ce9fb17f13041d80
SSDEEP 6144:GuPdHSnGdti7Bn2Bomiu7qTOGXwU6eISZl2JILinW5dQifdlb1QS/qhwDTax4kxC:Fd+McMYu7w1jXyadQmbb1QHM
TLSH
T171C47D11B39497F7C5AE037EE07053180272FA4564B6E78B65A8E4FA3C923C95D806FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.InstallerActions.dll

Path C:\Users\Admin\AppData\Local\Temp\MSIA2DF.tmp-\ScreenConnect.InstallerActions.dll
Size 24KB
SHA256 432abf3a198ff64fb2c660eb06b2bb33a16cf69fd28d836cfcb65c43d37dc462
MD5 80d4201dcb4e018aaff5fc1a5859da40
SHA1 f59cfd60eb1f56050d4f8439b6a5ddcf0a6d2883
SHA512 d3f4c28df23bf4beae556eb05e825fbeffe99dbecda47072267b5ec0142085fb95bbedbadb93de1a34c5d7bfcb0661c359bd56dde18c209498b0a2c3488c72a8
SSDEEP 384:VPJazzV1WTsaS8hQlL6QX4V7NaNeirM0dbMsFkjvZBPs0MY:VxazwQX4VMcLvXj
TLSH
T1B7B2C620678DE17AF9EE1634B563F7B002B3BDB3CCE9DA8665A410152D253E04FB5B06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\MSIA2DF.tmp-\ScreenConnect.Windows.dll
Size 1.7MB
SHA256 10933424536d53e397f651915f862c933199c50722943c236b020787b2e8f147
MD5 c261e034df63aca035d7914d354b9dca
SHA1 50e59350f4b524e55eec1a7ee0531bf9ad33a33b
SHA512 5c67ca36550bbe0dfb8c5f1f32c34045b42a72a6199802c4730694148eec630c345a42f99bf44f7a3a62bd19256ffdf170ec849b40bb976e48b601f2a15dac69
SSDEEP 24576:91/VFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUTM:7/VJkGYYpT0+TFiH7efP
TLSH
T1E985BD41E2C365F5D46B047888BF972AB6743C080365CAFB93D4AE366D33BC09A36756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CustomAction.config

Path C:\Users\Admin\AppData\Local\Temp\MSIA62C.tmp-\CustomAction.config
Size 234B
SHA256 7027b69ab6ebc9f3f7d2f6c800793fde2a057b76010d8cfd831cf440371b2b23
MD5 6f52ebea639fd7cefca18d9e5272463e
SHA1 b5e8387c2eb20dd37df8f4a3b9b0e875fa5415e3
SHA512 b5960066430ed40383d39365eadb3688cadadfeca382404924024c908e32c670afabd37ab41ff9e6ac97491a5eb8b55367d7199002bf8569cf545434ab2f271a
TLSH
T18CD0A70405D0FD1B5E231A2337524559FF34B1E290A44408B06F3A130A220CD4757317
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsInstaller.dll

Path C:\Users\Admin\AppData\Local\Temp\MSIA62C.tmp-\ScreenConnect.WindowsInstaller.dll
Size 137KB
SHA256 528242c7745783b3b4ae72fec13bb9bd49b17b0e00f60c027351147f21fdd359
MD5 dc1e764763d65555086850eba51af5c4
SHA1 66043dbac97f3b86c019c218e5b127bb7e4441b8
SHA512 175cdd4fdadd07afb6f54f0f909aadd74a579e069ea69dc96ceb9c07c14df2dcd1c929dc821e7f242ab39abadb91dd7c7bdf832e7b13416167200860caa0f8a1
SSDEEP 1536:M6PufIhTx7WsJU5Ds9ZrUP43IO6A16d2K7kvDutUVfh5U3KiQtlJRWq8qo0m1:RPufGKTJ44i+k1VfjRDn+
TLSH
T183D33A3463AC9A37E6EF5AB9E431B1440BF2B527B4A3F78D694864F81C127D14B20367
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientSetup.msi

Path C:\Users\Admin\AppData\Local\Temp\ScreenConnect\26.1.24.9579\2be711191a6d25be\ScreenConnect.ClientSetup.msi
Size 11.8MB
SHA256 de18838524d7b27b741fe1adeb96da078ded79365c5f15bb03a8428460779b8c
MD5 d8c9743367e29c1530e5a39da342ab87
SHA1 2858b1b4a9d3fadabafe96011167b752da2fdad1
SHA512 5d0e405cbeed8f4c78bd04ceb436ebca39eb89d53dd43d336b5a29cacbc2845f109339a97e65a7288896fcf119d97662fdbba83df0ff85ffc2c545f151b9005a
SSDEEP 196608:mnCtVYqI5MvbWEpKkqcIJqKHnCtVYqI5MvbWEpKkqXnCtVYqI5MvbWEpKkqBnCtz:KCXvI5MvHx0J9CXvI5MvHx4CXvI5MvH6
TLSH
T1E4C623216BF48174F1BB6A78E9BC80B14A36BC658B26C04F0774395E28B0F64D5B6737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientSetup.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\ScreenConnect.ClientSetup.exe:Zone.Identifier
Size 162B
SHA256 2f458204edd3b0e239ba34fcd10c2ebbfd03fba64e055437dd73e57b93427827
MD5 46706e84ff5a624551d778cb62cdf4fb
SHA1 0345cd0cd27a22dd5fa66673af2eb5916df76196
SHA512 d72976289190676f57c08de0510767e20cef23ee8018b9884ed38c7bd65028d5e4ccbd8cd107808c062ce90c92838c8e3a95954003e5fdedc63e27921c8596d2
TLSH
T182C080333F852490175212C4747942043C7E3C47190126C79943B069C6616C517B64D2
MD5 SHA1 SHA512 TLSH

Submit Download

Unconfirmed 282525.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 282525.crdownload
Size 14.2MB
SHA256 454279a9551088a6a795c5d0cb48f53be3ee7788ef0317e302c5ed0ba3060042
MD5 3c59a51334969845f13787ba39a6f670
SHA1 f1ba2efe6b3761bb46f6007ed417fee299f45eae
SHA512 07bcd6729657f24f34ce013653853ca9333226a51917ab57bab67bf0db863167dd422a5e33ed02bd94324664117f13dbbfacc0ebb7171c43694024ceaa12c8bb
SSDEEP 393216:2CXvI5MvHx0J9CXvI5MvHx4CXvI5MvHxCCXvI5MvHxfCXvI5MvHxv:2Z6HxIZ6Hx4Z6HxCZ6HxfZ6Hxv
TLSH
T177E62211B3E595B6D0BF1678E87D92658631FC144722C2AF53A4B96E2C32BC08E32777
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSID66E.tmp

Path C:\Windows\Installer\MSID66E.tmp
Size 202KB
SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
MD5 ba84dd4e0c1408828ccc1de09f585eda
SHA1 e8e10065d479f8f591b9885ea8487bc673301298
SHA512 7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290
SSDEEP 3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
TLSH
T129147C326494803EE7F91A36D93E9A61AE7DF6241760C99EC3848C0E5D604D06BF7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1720-424-0x000000001B9A0000-0x000000001BA34000-memory.dmp

Download

memory/1720-432-0x000000001BF30000-0x000000001C0B8000-memory.dmp

Download

memory/1720-435-0x0000000002C50000-0x0000000002C6A000-memory.dmp

Download

memory/1720-433-0x0000000002C10000-0x0000000002C2A000-memory.dmp

Download

memory/1720-443-0x0000000002AC0000-0x0000000002ACC000-memory.dmp

Download

memory/1720-442-0x00000000014A0000-0x00000000014D1000-memory.dmp

Download

memory/1720-426-0x000000001BBF0000-0x000000001BDA0000-memory.dmp

Download

memory/1720-418-0x000000001B560000-0x000000001B5CA000-memory.dmp

Download

memory/1720-417-0x0000000000930000-0x00000000009DA000-memory.dmp

Download

memory/1952-409-0x00000000043C0000-0x0000000004410000-memory.dmp

Download

memory/1952-413-0x0000000004780000-0x0000000004855000-memory.dmp

Download

memory/1952-439-0x0000000001200000-0x000000000120B000-memory.dmp

Download

memory/1952-440-0x0000000004180000-0x00000000041B7000-memory.dmp

Download

memory/1952-412-0x0000000004370000-0x00000000043B1000-memory.dmp

Download

memory/1952-406-0x0000000001820000-0x000000000183A000-memory.dmp

Download

memory/1952-411-0x0000000004590000-0x0000000004622000-memory.dmp

Download

memory/1952-407-0x0000000003F70000-0x0000000004004000-memory.dmp

Download

memory/1952-408-0x00000000041C0000-0x0000000004370000-memory.dmp

Download

memory/1952-410-0x0000000004480000-0x00000000044EA000-memory.dmp

Download

memory/2168-184-0x0000000004990000-0x00000000049BE000-memory.dmp

Download

memory/2168-188-0x00000000049C0000-0x00000000049CC000-memory.dmp

Download

memory/2168-192-0x0000000004A70000-0x0000000004B04000-memory.dmp

Download

memory/2168-196-0x0000000004CC0000-0x0000000004E70000-memory.dmp

Download

memory/2260-143-0x0000020173320000-0x0000020173351000-memory.dmp

Download

memory/2464-592-0x0000019F6EEB0000-0x0000019F6EEBC000-memory.dmp

Download

memory/2464-434-0x0000019F6EEB0000-0x0000019F6EEBC000-memory.dmp

Download

memory/2880-437-0x0000000000B40000-0x0000000000B71000-memory.dmp

Download

memory/2880-438-0x0000000002140000-0x000000000214C000-memory.dmp

Download

memory/3040-153-0x00000000061F0000-0x0000000006796000-memory.dmp

Download

memory/3040-149-0x0000000003380000-0x000000000338C000-memory.dmp

Download

memory/3040-148-0x0000000005980000-0x0000000005990000-memory.dmp

Download

memory/3040-147-0x0000000003350000-0x0000000003358000-memory.dmp

Download

memory/3040-150-0x0000000005A00000-0x0000000005A94000-memory.dmp

Download

memory/3040-151-0x0000000005940000-0x0000000005968000-memory.dmp

Download

memory/3040-152-0x0000000005A90000-0x0000000005C40000-memory.dmp

Download

memory/3040-146-0x0000000005980000-0x0000000005990000-memory.dmp

Download

memory/3040-154-0x0000000005980000-0x0000000005990000-memory.dmp

Download

memory/3040-157-0x0000000001A00000-0x0000000001A25000-memory.dmp

Download

memory/4456-228-0x0000000004990000-0x00000000049B8000-memory.dmp

Download