48df9179c55a2b8a795637832dcedf3107bc4d50b2ac5915b6a5840545af5e81

Analysis

user interaction
yes
max time kernel
1553s
max time network
1550s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
16/10/2026, 23:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ScreenConnect.ClientSetup.exe
Size 12.2MB
Sample261016-3tapdae16w
SHA256 48df9179c55a2b8a795637832dcedf3107bc4d50b2ac5915b6a5840545af5e81
MD5 3811ccc9b2ae031b7924aea6fa872b97
SHA1 8ddf59ec3590ac62ff30a518b7af6a2227edc67b
SHA512 d49e6bfe574683be7d0d8722793cb5f5477a4901906fdc938272bb3c4c982eb263a45b036482a366cc6df15d15366338b1c15cc501bd33a516b68a769a656418
SSDEEP 98304:03GF0s6efPLMn1Giy8E1PqhlG6ztZNK9aNGXMn1Giy8E1PqhAMn1Giy8E1PqhrM4:CGufefPqZWi9z3I96jZWijZWiKZWik
TLSH
T1F2D61211B3E691B5E0BF0638D87A62666631BC128751C7AF6794BE792D327C08E31373
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

backdoor discovery persistence privilege_escalation ransomware rat

Malware Config

Signatures

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
9	5480	msiexec.exe
10	5480	msiexec.exe
13	2432	rundll32.exe

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (c0e4b47567c6903c)\ImagePath = "\"C:\\Program Files (x86)\\ScreenConnect Client (c0e4b47567c6903c)\\ScreenConnect.ClientService.exe\" \"?e=Access&y=Guest&h=instance-evojh0-relay.screenconnect.com&p=443&s=a502dfa5-e40d-4b46-bd83-d1b5458b9497&k=BgIAAACkAABSU0ExAAgAAAEAAQCNbwo3bUiWg%2fsiQN61X43243MFPqFie%2fQNjyOXbyI0nEgRWT8HfCmcozTelk0X3L%2bJgEobOb0kqAh%2fY34Bdf35EEShe%2bTJxtG%2bwQcqxTfroDPYbVAQ46JTO9V3LmvRFDZzHDgzSkvanOfB55DRHbxG5IfQkkVGTaNt3k%2bEJuFnyB6Jbsv3GN1BAqrNL2Hk%2b4LB%2fJ%2bmOwsB2BgcYJPHvnOYx7a2qp2MRG051u7cmXAazxj37WsJjdw200NP6rDq2JLHr2ooiwXe7hffWdq6Kz5OcLG6IAQAeyGAdnOEY%2b31tEKI4cJxxINDpp1hkfwRR1NEPwuaB0UwhiwaK2e839qY&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAA5TIMGuH3d0epGBSbbZ13AwAAAAACAAAAAAAQZgAAAAEAACAAAACFtHeIRNPVDHkKbAUIC%2fHje%2b630%2fuoj%2bW6hqahoCIovwAAAAAOgAAAAAIAACAAAACB9om%2fpW1JCnZPd%2bx62nCmDFLwbuqZNr57b4SRqdDlx6AEAADJ2tvoAPkagStMT%2fh7aDPzsLAS0XFzUrLdDO1Uw%2fsl94TgsSH4SaQaH2w4Hx0Z3svzqKVk2qOpulA%2b1fa227wHgmCjFRrQoFt1YiMANu2RBWgQbPtUYh5VGXKk6HCYxylln4Ljs24yB0iLu9UmjEPNcMBACwjnGAYzlCzWdGxPVBDJtttWO6HF5pfU3w51duPA8o4x0Z0BUghXLxpWLBX1vGh3CQvk79no4LYeEM72aROe8IGvQd5tvLoP2o7LucP5GfFCOGBOlanP%2bBH1XVB6HFy4Gpa18Bp%2beq1RCyFK30zT6lvmchSuzLd2bX2G369mxak0TwZjdO63twl2OePggGpFi9v3wWYX5DxM4eOVA9sC8cNL%2f1HDknYmYVDAm0cGJaDGQJFEPKSFOmaGha0w%2bRadF5fmidaXiJ4MCNhci88T09nMIqcWNRsNGN05%2bzRy6eXulto5bkxiGIK0cPrS4g6Ikp5a5kyGTUuR8qcZMcyRKLgFhBk9crVCGAdvcOMU6UVlD7xvODsiLZJfSkncxh95cL2FVj8G2q54MFn2WteDYub00%2fSz9xJwMf%2fm1xzoamkBCvUyWrMSadxcV20R6kfeYGqmRbwppPCy9bEAw0UoDIJendkA%2fu07fDu1SIs6%2fD1DkP%2f6knRquRCDWSquOL0NSNiNghWrrdropLA0HN%2b129JpXwT7lOxn2YfxQ%2fVpRgWx7xyS8m%2bO%2btRrVKcoF8VR6ReVQ%2ffj9wShcSbpCrdNJsjbi8QLr75UUhRuiKA4HDgnqbrFtGzexPu9SR2yCGN%2fye6V1jWUcFBb6%2b60BwdEqhTMqxI8Cvh8Q3Ay91BbIv9yh62FwyRJPc0WaKyngnAiorghiPveVBL1gpcbo2%2bbwyHX5mQ6nWRZOODzTUc713j%2fGDr9i8ocVeIln9QkoCkM3xZ6vMNDF1EZPlhNMGJ%2bEVUnWpMOWJHrtiK1oZwqvjATlZ%2btDouVxC24fdpI0eTRxbA6c0v6llYn1VGR6M4fM%2bWexzv5H95E%2fupU4DLQagIhnHV22tsb5AZ7%2fju89Ik1dGH6IAtu4CM3BdxBQf01EKioXrh5n6tTOVJLoRStAgZ7NS%2fa3PHKUGrtNC2VRjDshCleD88Jdoq6GwLOhHbcaY9qUwfFxdtD2XKY3%2fzCZpRcZbyd8EhWQPnpu5OpPvuMOnqQXd7YYpBsE%2b1LeT18zEMF5ZP6y3zJp4hzoBu%2bXsJKuuhKj9lbv9hWLfNlFSnYzkdr4PVddD%2b7YCzXr0eNi%2feo90%2baASGsGlT%2fH3xRdI74r9n5RHun8Nt%2fA8essbj9nZQ3QIzCE5IdfYsc6girQdT5EjTG%2fWPd8LQ0VGswMsLF8UCtpcUvqW8KljrrA%2ffHP8IAB2dsDgvbt1Csql%2btjbPQQp%2bzPRvQ%2fjiIhNq0aeWD6zGbYV0%2brk9AITili%2fo%2fjDIEazaPqP2wtifq9dNL7zWHLYgcIFIBf6cuSeC82TEDNJJHxfnigbbqwZ6b0IgoqpJj4NEw1U4FRdJfCRYFO949ockVElYhLR25kAGXIfY%2fGDeu70bmmOm7y8SNsHFUHINMYX724Nmkmqoa%2bEAAAAAofIPP4NU9AHD34FKhq14i2FB3M3Op3sl%2b%2bpJxcLP84AeffyAXDWPZ%2bBlb2Zv0701aVpYpP3rhn6bM4Oq6bJpF\""	ScreenConnect.ClientService.exe

ConnectWise ScreenConnect remote access tool
ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
backdoor rat

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe

Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs

Suspicious Windows Authentication Registry Modification.

persistence privilege_escalation

Authentication Package

T1547.002

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\Authentication Packages = 6d007300760031005f003000000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800630030006500340062003400370035003600370063003600390030003300630029005c00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f0077007300410075007400680065006e007400690063006100740069006f006e005000610063006b006100670065002e0064006c006c0000000000	msiexec.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3353145205-3618084634-580274525-1000\Control Panel\International\Geo\Nation	ScreenConnect.ClientSetup.exe

Drops file in System32 directory 13 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (c0e4b47567c6903c)\1klguo1j.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ScreenConnect.WindowsClient.exe.log	ScreenConnect.WindowsClient.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (c0e4b47567c6903c)\h0k502er.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (c0e4b47567c6903c)\h0k502er.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (c0e4b47567c6903c)\3kie1mc1.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (c0e4b47567c6903c)\441k30br.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (c0e4b47567c6903c)\441k30br.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (c0e4b47567c6903c)\441k30br.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (c0e4b47567c6903c)\1klguo1j.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (c0e4b47567c6903c)\1klguo1j.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (c0e4b47567c6903c)\h0k502er.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (c0e4b47567c6903c)\3kie1mc1.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (c0e4b47567c6903c)\user.config	ScreenConnect.ClientService.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Drops file in Program Files directory 16 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ScreenConnect Client (c0e4b47567c6903c)\ScreenConnect.WindowsAuthenticationPackage.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (c0e4b47567c6903c)\ScreenConnect.WindowsBackstageShell.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (c0e4b47567c6903c)\ScreenConnect.WindowsClient.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (c0e4b47567c6903c)\ScreenConnect.WindowsClient.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (c0e4b47567c6903c)\Client.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (c0e4b47567c6903c)\Client.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (c0e4b47567c6903c)\ScreenConnect.WindowsBackstageShell.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (c0e4b47567c6903c)\ScreenConnect.WindowsCredentialProvider.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (c0e4b47567c6903c)\ScreenConnect.WindowsFileManager.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (c0e4b47567c6903c)\ScreenConnect.WindowsFileManager.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (c0e4b47567c6903c)\ScreenConnect.ClientService.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (c0e4b47567c6903c)\ScreenConnect.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (c0e4b47567c6903c)\ScreenConnect.Windows.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (c0e4b47567c6903c)\ScreenConnect.ClientService.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (c0e4b47567c6903c)\system.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (c0e4b47567c6903c)\ScreenConnect.Client.dll	msiexec.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e5900b2.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{189698CC-E32C-4BDE-4D56-23530D4D6E35}	msiexec.exe
File created	C:\Windows\Installer\wix{189698CC-E32C-4BDE-4D56-23530D4D6E35}.SchedServiceConfig.rmi	MsiExec.exe
File opened for modification	C:\Windows\Installer\{189698CC-E32C-4BDE-4D56-23530D4D6E35}\DefaultIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\e5900b2.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2A6.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2F5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI46D.tmp	msiexec.exe
File created	C:\Windows\Installer\e5900b4.msi	msiexec.exe
File created	C:\Windows\Installer\{189698CC-E32C-4BDE-4D56-23530D4D6E35}\DefaultIcon	msiexec.exe

Executes dropped EXE 4 IoCs

pid	Process
1144	ScreenConnect.ClientService.exe
2520	ScreenConnect.WindowsClient.exe
840	ScreenConnect.WindowsClient.exe
4160	ScreenConnect.WindowsClient.exe

Loads dropped DLL 42 IoCs

pid	Process
5896	MsiExec.exe
5240	rundll32.exe
5240	rundll32.exe
5240	rundll32.exe
5240	rundll32.exe
5240	rundll32.exe
5240	rundll32.exe
5240	rundll32.exe
5240	rundll32.exe
5240	rundll32.exe
5896	MsiExec.exe
2432	rundll32.exe
2432	rundll32.exe
2432	rundll32.exe
2432	rundll32.exe
2432	rundll32.exe
2432	rundll32.exe
2432	rundll32.exe
2432	rundll32.exe
2432	rundll32.exe
5896	MsiExec.exe
4100	rundll32.exe
4100	rundll32.exe
4100	rundll32.exe
4100	rundll32.exe
4100	rundll32.exe
4100	rundll32.exe
4100	rundll32.exe
4100	rundll32.exe
4100	rundll32.exe
5208	MsiExec.exe
3908	MsiExec.exe
1144	ScreenConnect.ClientService.exe
1144	ScreenConnect.ClientService.exe
1144	ScreenConnect.ClientService.exe
1144	ScreenConnect.ClientService.exe
1144	ScreenConnect.ClientService.exe
1144	ScreenConnect.ClientService.exe
1144	ScreenConnect.ClientService.exe
1144	ScreenConnect.ClientService.exe
1144	ScreenConnect.ClientService.exe
1144	ScreenConnect.ClientService.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ScreenConnect.ClientService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ScreenConnect.ClientService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ScreenConnect.WindowsClient.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ScreenConnect.WindowsClient.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ScreenConnect.WindowsClient.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ScreenConnect.WindowsClient.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenConnect.ClientService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenConnect.ClientSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1436	chrome.exe

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000004c4380864e6560650000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c01200000000ffffffff0000000027010100008838014c4380860000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d083020000000000c050dc000000ffffffff000000000700010000e841014c438086000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090d4de0000000000000005000000ffffffff000000000700010000486a6f4c43808600000000000090d4de000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090d4e30000000000000005000000ffffffff00000000070001000048ea714c43808600000000000090d4e300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ScreenConnect.WindowsClient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ScreenConnect.WindowsClient.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ScreenConnect.WindowsClient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ScreenConnect.WindowsClient.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 19 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.ClientService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.ClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	ScreenConnect.ClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.ClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.WindowsClient.exe

Modifies registry class 44 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC896981C23EEDB4D4653235D0D4E653\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC896981C23EEDB4D4653235D0D4E653\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3353145205-3618084634-580274525-1000\{AD407D45-A07C-44C2-83F1-36AC3B7BFCFB}	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-c0e4b47567c6903c\URL Protocol	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-c0e4b47567c6903c	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-c0e4b47567c6903c\shell\open	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-6FCD-46D09CDF0708}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC896981C23EEDB4D4653235D0D4E653\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC896981C23EEDB4D4653235D0D4E653\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC896981C23EEDB4D4653235D0D4E653\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\26.6.5.9742\\c0e4b47567c6903c\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC896981C23EEDB4D4653235D0D4E653\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-c0e4b47567c6903c\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CC896981C23EEDB4D4653235D0D4E653\Full	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC896981C23EEDB4D4653235D0D4E653	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC896981C23EEDB4D4653235D0D4E653\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC896981C23EEDB4D4653235D0D4E653\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3353145205-3618084634-580274525-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-6FCD-46D09CDF0708}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CC896981C23EEDB4D4653235D0D4E653	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC896981C23EEDB4D4653235D0D4E653\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC896981C23EEDB4D4653235D0D4E653\SourceList	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3353145205-3618084634-580274525-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3353145205-3618084634-580274525-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-6FCD-46D09CDF0708}\ = "ScreenConnect Client (c0e4b47567c6903c) Credential Provider"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC896981C23EEDB4D4653235D0D4E653\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\12A987B52BFAC7E60C4E4B57766C09C3	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3353145205-3618084634-580274525-1000_Classes\Local Settings	taskmgr.exe
Key created	\REGISTRY\USER\S-1-5-21-3353145205-3618084634-580274525-1000_Classes\Local Settings	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3353145205-3618084634-580274525-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-c0e4b47567c6903c	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC896981C23EEDB4D4653235D0D4E653\ProductName = "ScreenConnect Client (c0e4b47567c6903c)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC896981C23EEDB4D4653235D0D4E653\Version = "436600837"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-c0e4b47567c6903c\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (c0e4b47567c6903c)\\ScreenConnect.WindowsClient.exe\" \"%1\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC896981C23EEDB4D4653235D0D4E653\ProductIcon = "C:\\Windows\\Installer\\{189698CC-E32C-4BDE-4D56-23530D4D6E35}\\DefaultIcon"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\12A987B52BFAC7E60C4E4B57766C09C3\CC896981C23EEDB4D4653235D0D4E653	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC896981C23EEDB4D4653235D0D4E653\SourceList\PackageName = "ScreenConnect.ClientSetup.msi"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC896981C23EEDB4D4653235D0D4E653\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-c0e4b47567c6903c\shell	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-c0e4b47567c6903c\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC896981C23EEDB4D4653235D0D4E653\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\26.6.5.9742\\c0e4b47567c6903c\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-c0e4b47567c6903c\UseOriginalUrlEncoding = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-6FCD-46D09CDF0708}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-6FCD-46D09CDF0708}\InprocServer32\ = "C:\\Program Files (x86)\\ScreenConnect Client (c0e4b47567c6903c)\\ScreenConnect.WindowsCredentialProvider.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CC896981C23EEDB4D4653235D0D4E653\PackageCode = "CC896981C23EEDB4D4653235D0D4E653"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3456	msiexec.exe
3456	msiexec.exe
1144	ScreenConnect.ClientService.exe
1144	ScreenConnect.ClientService.exe
1144	ScreenConnect.ClientService.exe
1144	ScreenConnect.ClientService.exe
1144	ScreenConnect.ClientService.exe
1144	ScreenConnect.ClientService.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5224	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2988	chrome.exe
2988	chrome.exe
2988	chrome.exe
2988	chrome.exe
2988	chrome.exe
2988	chrome.exe
2988	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5944	ScreenConnect.ClientSetup.exe
Token: SeShutdownPrivilege	5480	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5480	msiexec.exe
Token: SeSecurityPrivilege	3456	msiexec.exe
Token: SeCreateTokenPrivilege	5480	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5480	msiexec.exe
Token: SeLockMemoryPrivilege	5480	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5480	msiexec.exe
Token: SeMachineAccountPrivilege	5480	msiexec.exe
Token: SeTcbPrivilege	5480	msiexec.exe
Token: SeSecurityPrivilege	5480	msiexec.exe
Token: SeTakeOwnershipPrivilege	5480	msiexec.exe
Token: SeLoadDriverPrivilege	5480	msiexec.exe
Token: SeSystemProfilePrivilege	5480	msiexec.exe
Token: SeSystemtimePrivilege	5480	msiexec.exe
Token: SeProfSingleProcessPrivilege	5480	msiexec.exe
Token: SeIncBasePriorityPrivilege	5480	msiexec.exe
Token: SeCreatePagefilePrivilege	5480	msiexec.exe
Token: SeCreatePermanentPrivilege	5480	msiexec.exe
Token: SeBackupPrivilege	5480	msiexec.exe
Token: SeRestorePrivilege	5480	msiexec.exe
Token: SeShutdownPrivilege	5480	msiexec.exe
Token: SeDebugPrivilege	5480	msiexec.exe
Token: SeAuditPrivilege	5480	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5480	msiexec.exe
Token: SeChangeNotifyPrivilege	5480	msiexec.exe
Token: SeRemoteShutdownPrivilege	5480	msiexec.exe
Token: SeUndockPrivilege	5480	msiexec.exe
Token: SeSyncAgentPrivilege	5480	msiexec.exe
Token: SeEnableDelegationPrivilege	5480	msiexec.exe
Token: SeManageVolumePrivilege	5480	msiexec.exe
Token: SeImpersonatePrivilege	5480	msiexec.exe
Token: SeCreateGlobalPrivilege	5480	msiexec.exe
Token: SeCreateTokenPrivilege	5480	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5480	msiexec.exe
Token: SeLockMemoryPrivilege	5480	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5480	msiexec.exe
Token: SeMachineAccountPrivilege	5480	msiexec.exe
Token: SeTcbPrivilege	5480	msiexec.exe
Token: SeSecurityPrivilege	5480	msiexec.exe
Token: SeTakeOwnershipPrivilege	5480	msiexec.exe
Token: SeLoadDriverPrivilege	5480	msiexec.exe
Token: SeSystemProfilePrivilege	5480	msiexec.exe
Token: SeSystemtimePrivilege	5480	msiexec.exe
Token: SeProfSingleProcessPrivilege	5480	msiexec.exe
Token: SeIncBasePriorityPrivilege	5480	msiexec.exe
Token: SeCreatePagefilePrivilege	5480	msiexec.exe
Token: SeCreatePermanentPrivilege	5480	msiexec.exe
Token: SeBackupPrivilege	5480	msiexec.exe
Token: SeRestorePrivilege	5480	msiexec.exe
Token: SeShutdownPrivilege	5480	msiexec.exe
Token: SeDebugPrivilege	5480	msiexec.exe
Token: SeAuditPrivilege	5480	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5480	msiexec.exe
Token: SeChangeNotifyPrivilege	5480	msiexec.exe
Token: SeRemoteShutdownPrivilege	5480	msiexec.exe
Token: SeUndockPrivilege	5480	msiexec.exe
Token: SeSyncAgentPrivilege	5480	msiexec.exe
Token: SeEnableDelegationPrivilege	5480	msiexec.exe
Token: SeManageVolumePrivilege	5480	msiexec.exe
Token: SeImpersonatePrivilege	5480	msiexec.exe
Token: SeCreateGlobalPrivilege	5480	msiexec.exe
Token: SeCreateTokenPrivilege	5480	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5480	msiexec.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5480	msiexec.exe
5480	msiexec.exe
2520	ScreenConnect.WindowsClient.exe
2520	ScreenConnect.WindowsClient.exe
2520	ScreenConnect.WindowsClient.exe
2520	ScreenConnect.WindowsClient.exe
2520	ScreenConnect.WindowsClient.exe
2520	ScreenConnect.WindowsClient.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2520	ScreenConnect.WindowsClient.exe
2520	ScreenConnect.WindowsClient.exe
2520	ScreenConnect.WindowsClient.exe
2520	ScreenConnect.WindowsClient.exe
2520	ScreenConnect.WindowsClient.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe
5224	taskmgr.exe

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
5992	OpenWith.exe
5992	OpenWith.exe
5992	OpenWith.exe
5992	OpenWith.exe
5992	OpenWith.exe
5992	OpenWith.exe
5992	OpenWith.exe
5992	OpenWith.exe
5992	OpenWith.exe
5992	OpenWith.exe
5992	OpenWith.exe
5992	OpenWith.exe
5992	OpenWith.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 5944 wrote to memory of 5480	5944	ScreenConnect.ClientSetup.exe	83
PID 3456 wrote to memory of 5896	3456	msiexec.exe	86
PID 5896 wrote to memory of 5240	5896	MsiExec.exe	87
PID 5896 wrote to memory of 2432	5896	MsiExec.exe	90
PID 5896 wrote to memory of 4100	5896	MsiExec.exe	93
PID 3456 wrote to memory of 3668	3456	msiexec.exe	100
PID 3456 wrote to memory of 5208	3456	msiexec.exe	102
PID 3456 wrote to memory of 3908	3456	msiexec.exe	103
PID 1144 wrote to memory of 2520	1144	ScreenConnect.ClientService.exe	105
PID 1144 wrote to memory of 840	1144	ScreenConnect.ClientService.exe	106
PID 5992 wrote to memory of 4152	5992	OpenWith.exe	120
PID 1144 wrote to memory of 4160	1144	ScreenConnect.ClientService.exe	121
PID 2988 wrote to memory of 4856	2988	chrome.exe	127
PID 2988 wrote to memory of 5820	2988	chrome.exe	128
PID 2988 wrote to memory of 5820	2988	chrome.exe	128
PID 2988 wrote to memory of 1436	2988	chrome.exe	129
PID 2988 wrote to memory of 2996	2988	chrome.exe	130
PID 2988 wrote to memory of 2996	2988	chrome.exe	130
PID 2988 wrote to memory of 5860	2988	chrome.exe	132
PID 2988 wrote to memory of 3800	2988	chrome.exe	133
PID 2988 wrote to memory of 5860	2988	chrome.exe	132
PID 2988 wrote to memory of 3800	2988	chrome.exe	133
PID 2988 wrote to memory of 4520	2988	chrome.exe	134
PID 2988 wrote to memory of 4520	2988	chrome.exe	134
PID 2988 wrote to memory of 3984	2988	chrome.exe	135
PID 2988 wrote to memory of 3984	2988	chrome.exe	135
PID 2988 wrote to memory of 3244	2988	chrome.exe	136
PID 2988 wrote to memory of 4664	2988	chrome.exe	141
PID 2988 wrote to memory of 4664	2988	chrome.exe	141
PID 2988 wrote to memory of 4608	2988	chrome.exe	142
PID 2988 wrote to memory of 4608	2988	chrome.exe	142
PID 2988 wrote to memory of 5868	2988	chrome.exe	143
PID 2988 wrote to memory of 5404	2988	chrome.exe	144
PID 2988 wrote to memory of 5404	2988	chrome.exe	144
PID 2988 wrote to memory of 2568	2988	chrome.exe	146
PID 2988 wrote to memory of 2568	2988	chrome.exe	146
PID 2988 wrote to memory of 5024	2988	chrome.exe	147
PID 2988 wrote to memory of 3652	2988	chrome.exe	148
PID 2988 wrote to memory of 5344	2988	chrome.exe	149
PID 2988 wrote to memory of 4876	2988	chrome.exe	151
PID 2988 wrote to memory of 5432	2988	chrome.exe	152
PID 2988 wrote to memory of 5432	2988	chrome.exe	152

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\ScreenConnect.ClientSetup.exe
"C:\Users\Admin\AppData\Local\Temp\ScreenConnect.ClientSetup.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5944
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\26.6.5.9742\c0e4b47567c6903c\ScreenConnect.ClientSetup.msi" SC_EXE_PATH="C:\Users\Admin\AppData\Local\Temp\ScreenConnect.ClientSetup.exe"
  2⤵
  - Badlisted process makes network request
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:5480

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Boot or Logon Autostart Execution: Authentication Package
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3456
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 757DE86652EB6CD24FB8C0FC8B44F2F4 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5896
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIBAB0.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240696078 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:5240
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIBEF7.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240697234 10 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.CheckMsiMotw
    3⤵
    - Badlisted process makes network request
    - Loads dropped DLL
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    PID:2432
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIC4E3.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240698609 17 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.CheckMsiFileName
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:4100
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:3668
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 7068EA98C75FC21C616BE8FC381837E3
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5208
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding B3E8635D298C2F66747C2C43F9DDED74 E Global\MSI0000
  2⤵
  - Drops file in Windows directory
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3908

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:2904

C:\Program Files (x86)\ScreenConnect Client (c0e4b47567c6903c)\ScreenConnect.ClientService.exe
"C:\Program Files (x86)\ScreenConnect Client (c0e4b47567c6903c)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=instance-evojh0-relay.screenconnect.com&p=443&s=a502dfa5-e40d-4b46-bd83-d1b5458b9497&k=BgIAAACkAABSU0ExAAgAAAEAAQCNbwo3bUiWg%2fsiQN61X43243MFPqFie%2fQNjyOXbyI0nEgRWT8HfCmcozTelk0X3L%2bJgEobOb0kqAh%2fY34Bdf35EEShe%2bTJxtG%2bwQcqxTfroDPYbVAQ46JTO9V3LmvRFDZzHDgzSkvanOfB55DRHbxG5IfQkkVGTaNt3k%2bEJuFnyB6Jbsv3GN1BAqrNL2Hk%2b4LB%2fJ%2bmOwsB2BgcYJPHvnOYx7a2qp2MRG051u7cmXAazxj37WsJjdw200NP6rDq2JLHr2ooiwXe7hffWdq6Kz5OcLG6IAQAeyGAdnOEY%2b31tEKI4cJxxINDpp1hkfwRR1NEPwuaB0UwhiwaK2e839qY"
1⤵
- Sets service image path in registry
- Drops file in System32 directory
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1144
- C:\Program Files (x86)\ScreenConnect Client (c0e4b47567c6903c)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (c0e4b47567c6903c)\ScreenConnect.WindowsClient.exe" "RunRole" "d5aed233-943b-44eb-8012-7282b13c0fb2" "User"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2520
- C:\Program Files (x86)\ScreenConnect Client (c0e4b47567c6903c)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (c0e4b47567c6903c)\ScreenConnect.WindowsClient.exe" "RunRole" "09ec3f75-b1ae-48dd-863f-63893b53024e" "System"
  2⤵
  - Drops file in System32 directory
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  PID:840
- C:\Program Files (x86)\ScreenConnect Client (c0e4b47567c6903c)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (c0e4b47567c6903c)\ScreenConnect.WindowsClient.exe" "RunRole" "2222e622-fe03-458d-88a0-f33024789bab" "System"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  PID:4160

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5224

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:388

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5992
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files (x86)\ScreenConnect Client (c0e4b47567c6903c)\system.config
  2⤵
  PID:4152

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
1⤵
PID:2348

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ffd7b44c728,0x7ffd7b44c734,0x7ffd7b44c740
  2⤵
  PID:4856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1720,i,8778932322185195543,15143081646140968299,262144 --field-trial-handle=2092,i,12781432737922497148,9182843306931636038,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:5820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1636,i,15343632449731447332,12648883922916628546,524288 --field-trial-handle=2092,i,12781432737922497148,9182843306931636038,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2404,i,11746508547876384117,13722638729602893635,524288 --field-trial-handle=2092,i,12781432737922497148,9182843306931636038,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2564 /prefetch:8
  2⤵
  PID:2996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3248,i,7971218412662691518,17063907209563171471,2097152 --field-trial-handle=2092,i,12781432737922497148,9182843306931636038,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:5860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3260,i,10600060555221806070,4204831371987589113,2097152 --field-trial-handle=2092,i,12781432737922497148,9182843306931636038,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:3800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3988,i,8544632842992610507,1536981327929944132,2097152 --field-trial-handle=2092,i,12781432737922497148,9182843306931636038,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4552 /prefetch:2
  2⤵
  PID:4520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4736,i,9256716677867976207,8576179859804978238,2097152 --field-trial-handle=2092,i,12781432737922497148,9182843306931636038,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:3984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5448,i,5301792798221935459,6460262834253584756,524288 --field-trial-handle=2092,i,12781432737922497148,9182843306931636038,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5456 /prefetch:8
  2⤵
  PID:3244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5620,i,4273728301937406059,17195150975949408592,2097152 --field-trial-handle=2092,i,12781432737922497148,9182843306931636038,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:4664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3388,i,2934900730418955389,2837363333888232962,2097152 --field-trial-handle=2092,i,12781432737922497148,9182843306931636038,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:4608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3328,i,16584769123188457676,16234159990170347583,524288 --field-trial-handle=2092,i,12781432737922497148,9182843306931636038,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  - Modifies registry class
  PID:5868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3472,i,12777553921666087542,9377344360301863466,524288 --field-trial-handle=2092,i,12781432737922497148,9182843306931636038,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  PID:5404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5728,i,16740619956023649482,5174280806798199012,2097152 --field-trial-handle=2092,i,12781432737922497148,9182843306931636038,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:2568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3500,i,8144032059392923126,3872428351278202198,524288 --field-trial-handle=2092,i,12781432737922497148,9182843306931636038,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5744 /prefetch:8
  2⤵
  PID:5024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4168,i,10216099371545480033,16618288440504604596,524288 --field-trial-handle=2092,i,12781432737922497148,9182843306931636038,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3324 /prefetch:8
  2⤵
  PID:3652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3484,i,8364232870719311411,12635784086041628662,524288 --field-trial-handle=2092,i,12781432737922497148,9182843306931636038,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=6036 /prefetch:8
  2⤵
  PID:5344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5024,i,290577594863813993,7863346991216841815,262144 --field-trial-handle=2092,i,12781432737922497148,9182843306931636038,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=1196 /prefetch:8
  2⤵
  PID:4876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=1252,i,1201480166115362826,2066916383839457136,524288 --field-trial-handle=2092,i,12781432737922497148,9182843306931636038,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5024 /prefetch:8
  2⤵
  PID:5432

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3304

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5792

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:4676

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5900b3.rbs

Path C:\Config.Msi\e5900b3.rbs
Size 214KB
SHA256 c7696837c217365f8f6e42714bb4af05f1b1ae0ea902a9759f9886fc8edfac47
MD5 0260ece712caad2678274fb14ccf1726
SHA1 3e2318bc237d7957b250f302ea3961734db05624
SHA512 261254e6c11120027b63f95001fc8d158e305305eeedefb4ac765c1983e50c7b1d0d3c63901b174f99b36bf028fa5e1d519ced8048353fcadc49e8c948880b5e
SSDEEP 3072:f09LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG3:f0uH2aCGw1ST1wQLdqv3
TLSH
T12C248C217484807EE7FA1A32D93E9A717E7DF6281760C59EC3888C1E5D604C06BF6B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.en-US.resources

Path C:\Program Files (x86)\ScreenConnect Client (c0e4b47567c6903c)\Client.en-US.resources
Size 64KB
SHA256 a90983b3d26f9e6bb472663b84d13254349f62b0ad4c667fd76b3edd270240b2
MD5 440efe703a19cdf7890efad27f5714a2
SHA1 a95e7d35f2d1b01c5f959756c1541daaf48f220f
SHA512 d37e65cffa3487ef0c6a7bdedff0374e0d5aac0d8cd060004700920b0da4c0750b0b4aeaeddf2dcc4fb655495ce53d737a161096e448062ed50841c6c9bd622c
SSDEEP 1536:Q5mcDzSbBYQdQ5Fe2rmcPpZfjZ8peFTp9EwILThIKC1IXpbLeMarA:Q5mszSbaQCe2rmcPpZfjZ8peFTp9EwI0
TLSH
T13D531E1277FD0A18F5F36F75BE7A94629937BC5A2E25C06E1028454E09B2F80C9B2773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.resources

Path C:\Program Files (x86)\ScreenConnect Client (c0e4b47567c6903c)\Client.resources
Size 6KB
SHA256 bd34378ad99f7609fa0c7c8edde6337c738a61d288863015629329806a1cc728
MD5 1e863134f29bcabe1ee571c91ac4fbe6
SHA1 57cc5966fcae49019da5f8f507c840cedfc103f4
SHA512 7e2640c4ddb8719230de0ddb0d18f9a4b1499a037247f12b142b1c16a2a989390abcb5ac7816a63dbce2d43c08510cec7cfc87cd24458bc2fa919c396b36d4f9
SSDEEP 192:rpDZHfbkqYvZJG293IIs1Z4EO/nM3ZWYijpo2YG:rRZjkqYxJ3JI/sMJ/ijp/p
TLSH
T1D8D13BC49BFEAC3CF05E51BE3A7692990275FF113AA3C3582460106A7F228856C56737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll

Path C:\Program Files (x86)\ScreenConnect Client (c0e4b47567c6903c)\ScreenConnect.Client.dll
Size 412KB
SHA256 27e873d0fceefdd1a12ca77e3bbecec2ece7acdba433b47dca102c35e1c5896c
MD5 495ae918d089b4846bd4a50bdc06b0b7
SHA1 d8457f6d5f37198a1d3aaddf286cb1c5293c9e9c
SHA512 8c4de18ae53c4858826e1dc17fc95293ab03dd30a12db29aaa4638c8e840ae5717c24b44d5d2f59ae99e4d8935fc260b336d084dcbc450b36593084256e0ba67
SSDEEP 6144:eS59LDc+cf1vp82Y5sD8ETEavHy+vd7JPYIYyqQni65/PTtR:lpcw2xDHTEavSW7OQniOb
TLSH
T13194CF8163E85D6EE9AF1F73F0A1A1344E76BC056182F2EA0D0475F41A7B7828B547E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Program Files (x86)\ScreenConnect Client (c0e4b47567c6903c)\ScreenConnect.ClientService.dll
Size 92KB
SHA256 78fa9cf69577f6990275c7c472f7114f9d0c85e660f3b9c81b085fc3cfbc8673
MD5 20b930dc08fde485186d7687a48779ab
SHA1 0142109ebe6b95d9704f0954c232fc8ad2f25630
SHA512 a5f612f7aa678cf37d7b2f7bd6c490d192397ea62f6dfe3ec798acef610fb6b252ca073bbda14d2f88c771a0a34260308132ba26de9cdf180a574c0310a83b87
SSDEEP 1536:Vzu1ewsuwDP/2ovANyI9xhpxZUuQOV+eGI0ZUazxvmVRo9dE7h:Vzc2j/BAkI9JXQOVAIAUazxvmVRoTE1
TLSH
T1F6935C4293ECA92BC9DF0E38B461F26106B1B913D9E6E7D46D8860DA2F527C11F1439F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Program Files (x86)\ScreenConnect Client (c0e4b47567c6903c)\ScreenConnect.ClientService.exe
Size 93KB
SHA256 5956f9afb3ba610c38b2cfda88dd15be98783963769a12020c93ce05e749b3c3
MD5 1973034f7b83f666cbd3264bade6e6e5
SHA1 51340eee61b2b3df88bc48060104a32c0f101b4b
SHA512 8a28d7a5e347fe7d7d9977b74eaaaa6ac03ac615ed236235a28d2edb5d2f123945c98b8ea5b7713d3e4d034db580fd530b82c40c98162a7bcb259c2c8b384243
SSDEEP 1536:Lg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgoU0HMB7R:EhbNDxZGXfdHrX7rAc6myJkgoU0Hk1
TLSH
T12B935B13B5C28872D473193158E0DAB09A3FF9615E21DEAB3788022E4F742C1AE75E77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Program Files (x86)\ScreenConnect Client (c0e4b47567c6903c)\ScreenConnect.Core.dll
Size 582KB
SHA256 4eab8752d05cd31bafd07edde7d18061cb63eea99af3132460e6dc08bb5f9e73
MD5 fb7b3b452a84b3c591abd35f1cf68eac
SHA1 b6750e1e287c36199294215d49e4613f43d8d271
SHA512 a20afb8d8cf1926d7bf9a05b71edf544f85bdeadb2b8733446b39d9f893bdad2659d023544e50f8bcd4fc8af4588aa8e0e60414ecfb7931e96895d8fac65da44
SSDEEP 6144:GobZO37pir0uomvrTk8AG2sTwR87HNSxyoiuHiWm9kzKY7vhNS/chwDTax4kzm7x:fZnAuhy7CsJlHiWKPYbhN4Ao
TLSH
T1DCC48D3073A4A776C5AE1B7AE072619503B0F413659AF34B7B85E5F92DC23C88F107A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Program Files (x86)\ScreenConnect Client (c0e4b47567c6903c)\ScreenConnect.Windows.dll
Size 1.7MB
SHA256 ec4de5e6e9c079a30a5780d79ee662e0a4c6d009f0e3f911edc560973fb17d1e
MD5 d55cdc5fcefe87de68c201bdc08967b1
SHA1 be13fc7f876f28eb388e8a446d369a963516e30c
SHA512 9df975e885af260ec2d14484852260be64b07e576fc5808181ac7638bf69a6fd7006f53aefeb9116da8d3604c27ccef99356fddc063120819255184ac11bd7bc
SSDEEP 24576:kkFuqFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUJ:xFuqJkGYYpT0+TFiH7efPU
TLSH
T14B85BE41E2C364F5D46B047888BF572ABA743C080365CAFB97D4AE366D33BC09A36756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsAuthenticationPackage.dll

Path C:\Program Files (x86)\ScreenConnect Client (c0e4b47567c6903c)\ScreenConnect.WindowsAuthenticationPackage.dll
Size 254KB
SHA256 a5b8f0070201e4f26260af6a25941ea38bd7042aefd48cd68b9acf951fa99ee5
MD5 5adcb5ae1a1690be69fd22bdf3c2db60
SHA1 09a802b06a4387b0f13bf2cda84f53ca5bdc3785
SHA512 812be742f26d0c42fdde20ab4a02f1b47389f8d1acaa6a5bb3409ba27c64be444ac06d4129981b48fa02d4c06b526cb5006219541b0786f8f37cf2a183a18a73
SSDEEP 3072:qJvChyA4m2zNGvxDd6Q6dtaVNVrlaHpFahvJ9ERnWtMG8Ff2lt9Bgcld5aaYxg:0IvxDdL6d8VNdlC3g0RCXh5D
TLSH
T1C5448E15B7A40CB4EC77823888535A06E776BC160760E6CF03E0825ADF6F7D1A63E762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsCredentialProvider.dll

Path C:\Program Files (x86)\ScreenConnect Client (c0e4b47567c6903c)\ScreenConnect.WindowsCredentialProvider.dll
Size 837KB
SHA256 7511e679597572782241ff989c065c02f9f5a12ab37290b69a27226eda57ce75
MD5 cf1fe9a7fb8bb34a1c61fd4ebbba8546
SHA1 74cdc08c167f312022184b311f71e245bdadddc2
SHA512 3f6f5202ee70e108d1b1a707df2d490ff4a2ca9f621585a83be200b024618857533a6a29da567609cc448e74cab0d93838607391334c579f01f6f37652bfb4e7
SSDEEP 12288:vhPu/v5a+Hq+Mu4VrDgKOxbPEYK/TVdHOJ:4vNH1Mu4VrDgK6byTVdHOJ
TLSH
T1CE055B1BE79444B9C0ADC2B5C35B9736ABF5F4864A14B68F0BD40A227E3BF509B1D384
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.config

Path C:\Program Files (x86)\ScreenConnect Client (c0e4b47567c6903c)\system.config
Size 966B
SHA256 5c2b6d24aafc58a4c8e48341e6b23f95f4e5c09549270ea001a234574b804bb2
MD5 e25a690da741865f304f4764c1c206a9
SHA1 6d07e1d403856171b522a7afdf3bc1d892f325a1
SHA512 20863d137f0a0512b78b1ae3f617ccbcdfdb913ba84b0cbd75718c7ff10e89e7ac9534abca29597714a7368b73c80095d413df4793d04d31f2b3e7ed60b8f83e
TLSH
T17D1100613384BD4B0BB31E13C522C384ED76261F0195148935FFA13AAB322DA03A72AE
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_59E89BCE9615F2B61F2F2C691688F111

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_59E89BCE9615F2B61F2F2C691688F111
Size 727B
SHA256 cdf7346b7958acdb9a4adb3e2cab54894f1b15768fede5a85e56ec95a63f37d7
MD5 96c64cbf62c287791761f28cdf30201a
SHA1 87ce81a744a34973f4fa25149f8b2b96593c1dc2
SHA512 998cdc8db14e5dcb50afad65d0336f6b130d48cc6fd39af70cd3332188971f24e8504727dbaeef223b70e0564d07b672c70d9cfa8fd0ef99b3c7e3a335baa91a
TLSH
T13101940B6138FC008F289C49AFF0A3BE35892011A0DCAAFF6BB8C4DC90C237B0D46010
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 727B
SHA256 65b22beb3b7c34c7c790ba6491c35cb7d1dd4040ff4c8c2d03b42e06f2150321
MD5 9c205575a9a60d9973e03c58fbbbe9d3
SHA1 7b84ef33f9a97f2c343c8fd2e2fab6bd56e65b79
SHA512 da37b89bbf128614f914110a30dee58b8a5ab03931205e00f2c04b03edd543bcbf0ef02e5a740b388b951dc16c043be6b684564e950a91b4482fefb5a39733a9
TLSH
T13201654FF0955E54E02448CACA5CC6DBB8B2DAF901C6C3291EE40CC706A6AE88F1194C
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_59E89BCE9615F2B61F2F2C691688F111

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_59E89BCE9615F2B61F2F2C691688F111
Size 404B
SHA256 60e63b4d39a783cfafe1e1527e7d67187f4c9bb3dd7fd786491b9573c38ade79
MD5 386bf56eaf9a39f1d1457931d849892c
SHA1 ae25a63dd554546113bd099954657b7b2b97cc16
SHA512 ccf91596ca68655a659d7011a05ba05c85ec6447ab90a0aca2b1074a0f5541a8627804d5b2099f973e896084782fc20f670ceda9454e214bbe1cd45606229cb8
TLSH
T129E0203431F5895DF5F1E83442F56822589DF2DA0581D769159016456F19B045CA2628
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 412B
SHA256 3ee1646dc8f18a9343ae9bea6398a68beb62edf90338b79600c10754e49b5cc5
MD5 24db5cb73b5d18231eb2c756b07cf2ad
SHA1 21be4b81d5d35445af1edea611ddfaa317aefe53
SHA512 fc9a15d76dca51eeda71a3273080d21c77857b3c8ef8a116657151a2fbfbe86b3c010c6c3ef57d2d74a44dc3b1d7d4093ab4d380bbf865ef74bbf7d1d10ee44e
TLSH
T1EFE06F2C22EBA50EF0A08E3A82FAA0760D48E3011000C3B80AE0030AFB8AF405C20AF0
MD5 SHA1 SHA512 TLSH

Submit Download

20e8b9c0-58b7-46e7-8c01-60778317cdac.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\20e8b9c0-58b7-46e7-8c01-60778317cdac.tmp
Size 267KB
SHA256 2b19afe5280118ea2da706626c4cfc9691e7435b358fd2f9eab1c9eb618a1603
MD5 b332ba2116ecaa4aa882b209c2005268
SHA1 c40275c3195a2f071e127584bec3579e8fab467e
SHA512 e53834bbdbd3b6573d80ad162b8306e559aa413bffd413c1deb17ee2c004306aef6d1269011f3f86e7d5f05e0766a069d3ddffbb667458bf440fb39860c5186c
SSDEEP 6144:XhGfRO/TARTtan2xW3aghAPtbmf1K49XLWbEPi4NTKlLzo:uRrXlCQofM49s4NTK9E
TLSH
T1C1442351BD427EA4D0AE9B22B154AD0DEBE5DD5F86782BEB0ECF3BD001E6990C304D60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2537a205-296e-4850-b4bb-7693e37a208b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\2537a205-296e-4850-b4bb-7693e37a208b.tmp
Size 267KB
SHA256 20df9977c46842e3b034e41d1bb8ab954ea77b1866cdde7b457cb976fba796e7
MD5 f36885f230d05ea3f136dc36f2840d21
SHA1 b844965424aef916662f0174987f3060d1613a05
SHA512 99177a99806d9681a22003699f4b7d60e8735ee558dd8ac5a88bd1b0e59ccf5b71d81de618745a6d115e55c2c75cd63560afd538dfb4b54379bfe66d0321efd4
SSDEEP 6144:0hGfRO/TARTtan2xW3aghAPtbmf1K49XLWbEPi4NTKlLzo:bRrXlCQofM49s4NTK9E
TLSH
T143441351BD427EA4D0AE9B22B154AD0DEBE5DD5F86792BEB0ECF3BD001E6990C304D60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

65f186a6-5367-41fb-8783-e9d8900f2ee7.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\65f186a6-5367-41fb-8783-e9d8900f2ee7.tmp
Size 268KB
SHA256 92c114c84e3e4a480a4028a9b9a8530e762a39b923a996d2a8168eb8d284e9bc
MD5 51ec2abbad01fab1a0f3d1d622b057b8
SHA1 9c1a83d3af1456a98811623dfb51a8493410dfbb
SHA512 d06c3d07c1c8f05965e1511430ce11f621ef8355e71af11c2505ffca7b4e2f4fe0f13b33d43e030e86a8bd3675f9edd87b32b5b352196f787efe528a357837c2
SSDEEP 6144:YOhGfRO/TARTtan2xW3aghAPtbmf1K49XLWbEPi4NTKlLzo:4RrXlCQofM49s4NTK9E
TLSH
T1FB441361BD423DA4D5AE9B217054AC09EEE4EE6F867C7FEA1DCE3FD041E6890C604D60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2f35ceab-c2e8-4e10-84ac-6acc08e8e333.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\2f35ceab-c2e8-4e10-84ac-6acc08e8e333.tmp
Size 13KB
SHA256 dc52a47a36a6d972c29b5d566f117762b9cc9c30765b861f3b078ef570b9ac74
MD5 9fea7709fe249eded65d47169c4e13ea
SHA1 0d42424b4b25103c3b12062abce1f1a8d56ff15e
SHA512 652c8572ed6ef8a6bd5246f328e9694c1de13a33bf1621866dd0994d4aa2f10e6b4e6faf69214cee8c1ce3988047f3e2fdc30c4429f9bdfe4b4f2110e5622d09
SSDEEP 192:rRPcBh93khvNWOv7FpyPRpoNbO9DHsb+WNnI445pemE3aR2VyIsnAUgraJ:rRPmh90Kqx6XXdwvQeZaUe
TLSH
T15B52C42EEC107A7BACDAC22AF9527B57D3F5103575942E84E6FC892C25E7ACC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

450db405-fc03-48b2-871b-8e0ea68ee646.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\450db405-fc03-48b2-871b-8e0ea68ee646.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00000a

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000a
Size 437KB
SHA256 a451b8791f9183f16a2b30959f9f69e20f35117f8ca6e34e463916869328f3c8
MD5 15d9ce7fe8b446c91cc0598983dde50a
SHA1 b2ad1e9b11a41f5176e3cc495dac68aa26e0955f
SHA512 39e14f23bbde8278b586057eeb648777afc1e6d11b71f3e5529688341f7868b61d0d7ef43cc925189a70def4a6b53e863a06fc8d36e7551c9a50745be6607529
SSDEEP 12288:9SyJNj5Vy52pw6eyroMIW3/dJhlzOH7pVUa0Uiku:9vJzV1pw/yroMfCIUfu
TLSH
T10B9423CFDB2108E7FE76C411CDAD9FE8049BA554056D8CB35BB6066D825A0808636FEF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000014

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000014
Size 24KB
SHA256 92f2e5453eb74806ef27599c8f7ece7628633063f0fbd5825fc1077d083315eb
MD5 0442eb53f075bcc2381912ca3434f555
SHA1 382518080d6d1923bb3c344f8cd2d07cdd309140
SHA512 2770cb81c32b8dc23549508f70850f88a0901544d596c49209ff859e5dc9385bab7e2b72788eca84128b7fb44bfd5b3e28215792834e4cb3addd781d17e90105
SSDEEP 384:iESPxEvnLGPVg92Y6lkUnRy5IQF4ZroBmGf5pTphhfNQ787dNf6:zSuzx92dQCZroBbNPfNXn6
TLSH
T1CDB2E1CF8203DC24591D1B66BB58E7FC71E2C7590664639EC96312D418A32272B3EBF0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00001f

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001f
Size 125KB
SHA256 b433fe969b7bc3c49fd6a15bc1743bdddcfc3d891bba7c1c83607884719ace36
MD5 8d71e5feee47e35c7bb04f3f5ed6991f
SHA1 e56532fcd7a1dce51b018b8a09c26434950d0f98
SHA512 8fb567f9bacde69fb6eb2675d1e2c888724f6c928b8659829a98850ea65ef186d56e7407100347d8460a7516f15ae255a9df1ea8eaf663be734da90811a43238
SSDEEP 3072:AUqwU/U9axmfzvY0in8mBWiuVEx99TNLzuc6iV:AjfIvY7njoiuKnNec6O
TLSH
T164C312BEBC247F1B9D677B5D74D200B3C3319C898940D4AB991379BE1C891B7A8CA4E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00002f

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002f
Size 342KB
SHA256 659a0971e578dd2f7060f2ba9377b6bd188b6266d88e3428384cb6456269e050
MD5 298d875bb163ec25ab057014a6ecaa20
SHA1 898f177ea4dc17e7b33c019a2baa3c208619adaf
SHA512 a669266b60f705b04911c74d2422064f291fcd42aa3e9ea88b875931bcb7767331407938a0e72b42a9c722ba5ce658591b2ee9468beb0dceeca5383927d1a06f
SSDEEP 6144:lBp3DINHm8A2BD7BQjDtCkTUKVIPd5kpIZWnenaO9Xl/CDI4iUsZv:3pzOHmcvBQ/QkgKVIPs21npPqDM
TLSH
T1F57423330849B132E7AD6361C1EC9B6D58C73666382FC77614FE76116E8B189B9B8C0D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 e1409e87be06116642cba13a50d4f176b64909ab24b7343d94120751d8b1673d
MD5 24e07c0c797c04d5ec3577744c2388c4
SHA1 c1fca3f03d4f28752f99cd25c238bde831e27c4c
SHA512 ca810d8b8dfa463e4b816dfa76c89ffac43c8e3af26ef852ddfa13a861d5f0acf9c3b58cb03a56edac65e50fa8ffcaac9ca6e595deaef2802b14689dd6b0b84c
TLSH
T13F41EB5EB122490DCFCBDFF23DAE049128D430B9DEDDA7591BE0B8A43C819B77281641
MD5 SHA1 SHA512 TLSH

Submit Download

3876aaa3-dab7-4289-b46e-64c42a0c9a37.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\3876aaa3-dab7-4289-b46e-64c42a0c9a37.tmp
Size 8KB
SHA256 1450005f22f00956c64f726783b0f0c7d2cf68ad6d858889392347bea6b98557
MD5 8f1340903c473a28b290ce9128b34c26
SHA1 384493dc1c3ff410c1f6693dae89c177c9b78f72
SHA512 bfeb0f22c4e00d0941cf1cb5af74000fe7b772417d402268c5b6c7193021f67bf7084edfc09aee2f55588ccd46194bdfce00288c9ce277af8889e20d01b843fe
SSDEEP 192:DIpgHLvJZMJeYvDRlIaamVHru1jaP3IIHluIIIvIDdvVfP6NPQlAR:DIpgHLvJZMJeYvDRlIaamVHru1jafIIp
TLSH
T10D02C0FBC7D8C52D885156F4AB257F2ECE2A0A18431D3D66C8D8AF5B93E2832D21534D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3ad52f6a-bab0-4acb-9b97-779df45c6623.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\3ad52f6a-bab0-4acb-9b97-779df45c6623.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 ffdc93ecba6a646ea4f9c6fc18410c248c5917bfc56f9898c7adf71eedc06631
MD5 9ea5f1dad067aa18274603fe05713016
SHA1 2d265fe195bdf9f9c03372f054eaa5520008056e
SHA512 a481a3b8e4b803a0e829fab81fad9e67a90f193af7244af99e36ecfc1204eb1d1120a5c909026a9724170e849806b1a25dd2283ecdadef88a7b5c56aa4345b74
SSDEEP 192:D0u9tlJJQ5JGMNMuuwWDaamVEdu1jaPitSqIzImdvqfPiNPiNIxcjh9K:D0u9tlJJQ5JGMNMuuwWDaamVEdu1jaqW
TLSH
T168E1BCF793E4C62DC94156F49B15AF2FCE290628032C3C7689D8AE1BD3E2472E25535E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b66ad978-dc5d-4169-a22b-9a67bcd64e25.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\b66ad978-dc5d-4169-a22b-9a67bcd64e25.tmp
Size 9KB
SHA256 7ac49a2c25ffc1afc2b426e023144ce2979b0d423b741afbb04ec3cfef6d1f72
MD5 2eb051ec96e9c849f5fbfd46f425c49e
SHA1 c960a260ff566361a95430965dee27e228a2593a
SHA512 d0cdebaef60e59937024267d758e9c7f43559d0685dabb60c29349d15daaed12d27c8427d1080df121c2b62da9626efa5a778d50fa48a9fd7ec97b36580a1c5c
SSDEEP 192:DIpgHLvJZMJeYvDRlMWDaamVHru1jaP3IIHluIIIvIDdvVfP6NPAALl+W:DIpgHLvJZMJeYvDRlMWDaamVHru1jafR
TLSH
T1C912B1F7C7D8C52DC85156F4AB257F1ECE2A0A28421D3C66C8D8AF4B93E2832D21534D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 120B
SHA256 b58d1053507a9405271e6d91b58cc8155b9c73e27aa51081c94647394322350f
MD5 62def460a3fbd631d57732c589c388d6
SHA1 db889d082e99c5f13e6f24268d84f041304777ae
SHA512 18a0eba661fd3bb6db5ac06a186ee2abb17667b7f1d8246ced5c76b726c447295a79c5ca6766e557073bbcc1f00e8f35d24cf08931ed5684c91b045b8360a19f
TLSH
T181B0121880415701C0C202F025A7148872989F12A605170142F01D43C8355A1B01B095
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 d187ed004c1bc6a746fa71e87f52f5e8f9d9420edb23b2c2e99583448ca878eb
MD5 72e0f9b57261b36fd4ede518dac5f0a9
SHA1 e0fd06c4262c642b84b0d2899bc9a2b0cafb59c7
SHA512 1f51fb6339cbae41a9b0651db8469bb6b9283c270c2070123305327a4e4ef67fae3adce7402803d80bc8416c98c6c0af7cf876e0cab7d6f25c4ee9bf36c544af
TLSH
T1C9B0220CC203A20BC0C20BB03A80A2C8B030CF3CC2230222C3E00E22EC20A300820030
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\temp-index
Size 96B
SHA256 09d75c261362c3865d4c5ba55d7f0cc317e043cedaa758a611868736ee8b3931
MD5 460718a375ad600a80f899dfae9b3b9b
SHA1 e3b398ad5615dfb85b5afd30bf8fcb41eddbb04a
SHA512 3aa3dd796c2bb2bab8e7a58bfc4b4be446102f76f272f272dbb14a81b211276f86692ebf787d1d44d96e2b9752dcffd732c9ff4ce98d2c27ecc28a4829c787de
TLSH
T10BB0220E20002B03EA0883B2A2C030C0333A3F382B83E0C303F030E880E22A3CB02203
MD5 SHA1 SHA512 TLSH

Submit Download

a9a40c53-ca37-42f1-8866-355102aa7bce.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\a9a40c53-ca37-42f1-8866-355102aa7bce.tmp
Size 13KB
SHA256 7d28d8daee53f2dce4404fe8d41e2473c60062038ffd390a1a2ce337abccf557
MD5 8be825b8770ee4bae01850ea19d0b31e
SHA1 364407eddff916af5b6c5ce209cf91c1967f0ce8
SHA512 c0c6992fd590423ad817e0a43cdd1b5cb2dc6364b057015574e5f4be42cd55d26168f69b9811eb6a971d3cec9d68ee47f207089d22c154a1a805568c6d0347f4
SSDEEP 192:rRPcBh9ukhvNWOv7FpAPRp2NbO9DHsb+WNnI445peIE3aRqVyIsnAUgraJ:rRPmh9JKqxUXddwvQe3aAe
TLSH
T1D852D52EED103A7BACDAC22AF9523B57D7F5103575842E84E6F8C92C25E7ACC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b1923778-9318-4559-afef-8deff61775c8.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\b1923778-9318-4559-afef-8deff61775c8.tmp
Size 13KB
SHA256 c34333e665696d9aaf2ff8cb889465c3180529d68db5d4939b4ed8542a2e89d2
MD5 1698b676c8f8030bd2394c96719ec536
SHA1 87dcdff433ee2f9ecfa0b8d8ffd8373de39692ca
SHA512 54a1f73b7bad2b3f99dca4b1fa37d78e91e57d818587c6237c89c28b60c3b5609f3c6cd1af0876d42553c26b566581cad138981de1db668a61ed6c5b00be8008
SSDEEP 192:rR8cBh9ukhvNWOv7FpAPRp2NbO9DHsb+WNnI445peIE3aRqVyIsnAUgraJ:rR8mh9JKqxUXddwvQe3aAe
TLSH
T17052D52EED103A7BACDAC22AF9523B57D7F5103575842E84E6F8C92C25E7ACC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cdd5c81d-4b4c-44be-adaf-8de505416979.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\cdd5c81d-4b4c-44be-adaf-8de505416979.tmp
Size 13KB
SHA256 ea5d39d188a58c7061cd9b1287a4d59c7670b5ff33444cf3198ae30e4e165110
MD5 c4b3b007ac094cf0404ef139717d7f60
SHA1 ea3cb394d8bddca88f669628c0dcbf989b138486
SHA512 85dbd7becbe00ff15081f71555e0b6d16655362ebd102d1f288dd9889873d5aab8a067b34be9a708e9c6191d1f45edf09c4c7761b40f770ff388c62d5c9f1997
SSDEEP 192:rR8cBz9ukhvNWOv7FpAPRp2Ns59DHsb+WNnI446G2/E3aReVyIsnAUgtaJ:rR8mz9JKqxUXfdwvQ2wak8
TLSH
T14A52E52EEC107A7B6CDAC22AF9623B57D7F5102575942E84E6F8C92C25E7ACC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cfe53a45-fa85-4446-b62e-dec438ab6e0e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\cfe53a45-fa85-4446-b62e-dec438ab6e0e.tmp
Size 414B
SHA256 dace678a9098046ec678b63483382615a5fde7555d3eb5cab57a0eac6fa63d7c
MD5 82e1f64470772153c1533c6889fd069b
SHA1 afa4b708eff30f65a3b206cd2871b6e7c43ca711
SHA512 83d118d0eaf808994db43d28061d3baf932b9309ebf43721476433acee9bb88f26679d154fc844f9ad2f38f3946e098d181386d827823a22cf84bcc530582eb8
TLSH
T191E02BAACC20EC2718FD071D70965A55E60113572B81950F773C811C8FF0636519681C
MD5 SHA1 SHA512 TLSH

Submit Download

f589e153-c127-4e6a-87d4-278826a01d21.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\f589e153-c127-4e6a-87d4-278826a01d21.tmp
Size 17KB
SHA256 97bc66b4f155b0c7d1c1155ae8d3954a623213984f10f23f42e9e1fb19904a17
MD5 2be92c7643ba48fb4aa831b67bdf1af3
SHA1 79be648a0d33bdda874579b35bc4130d1a99c838
SHA512 807a577b54aae138829b44e4a6f8d45c0e84793dd9d5979325f6c50c10138ab57dbf6926083a46c29ed6ca492c7a21eb9c9bcc6ee1ce6172001f1ab91694f4d2
SSDEEP 384:KkjuF7KxkXqKf/pUZNCgVLH2HfgslxH7pLuLceSsNXODuF+ErU38jHGPQB7IYjL:KouF7KxkXqKf/pUZNCgVLH2HfgszH7p6
TLSH
T109721A67BC4C9E7B0F94C68CC8177E4FACB5025B65E9886482FA982603D5BCF114A1F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d81d7fb4-0be2-44a6-b4a1-7d877732a564.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\d81d7fb4-0be2-44a6-b4a1-7d877732a564.tmp
Size 131KB
SHA256 442f10c0229b00d63ad40c02ea4547135b427b73ed627c8cf67530a471355d23
MD5 f6db619c894eba7adaa4215590185988
SHA1 70c27f7c22c679236e9ae385d99fd6306e5ba8a7
SHA512 73eed539fa15859ca1b167b8d99869ac10cc14a65caf2c671c0bae713973f67d678b5174edb264fccac13bef31f7548e65b4df5fef37be4348c9396b8c0d590f
SSDEEP 3072:AIvyBkjartaCS+uW8lH5W+f1K49XLWb9TBAPi4NXbHKji+ZLz5:cPtbmf1K49XLWbEPi4NTKlLz5
TLSH
T174D312217D01BCB8A9AEDB21A1901A15EAB8D94F953D7FE61CDE3F8C05A36D9C304C53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fe5d2c08-5810-42d1-9bd1-fdb015e2058a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\fe5d2c08-5810-42d1-9bd1-fdb015e2058a.tmp
Size 268KB
SHA256 7f806356df6a3fb847a5080edb1a8bf32a948154c284ecd329c48b63f75e43fb
MD5 15e1c72cf859ec92ee500b6c974d1bbf
SHA1 672c6581d930b34adacb76fecc1acabe89baadf6
SHA512 24a4dc0f6f2d8271c43162a93246118f2eebe0f3779f5e0763218f484decbcde5cac69c351b8483ce7e8c4fd81af5ac64158bd7dac45495efa769b89d4423c36
SSDEEP 6144:4OhGfRO/TARTtan2xW3aghAPtbmf1K49XLWbEPi4NTKlLzo:YRrXlCQofM49s4NTK9E
TLSH
T12D441361BD423DA4D5AE9B217054BC09EEE4EE6F867C7BEA1DCE3FD041E6890C604D60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rundll32.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rundll32.exe.log
Size 746B
SHA256 707c0e90ab433305fb10151c93aed7664319ba55ec59b7304d38481af4f5a4a2
MD5 4120a9b92f238fb49739d695b67fed65
SHA1 1151a9c25533be5b1d497076db8228ab6c97ec59
SHA512 feaffad013d229b8d7395dc9bdcad5b948183b16ac41c41c5f5d923f1512e0dc24b56073f10eb88b0a5e2a41980c16d04ea4a8877f47035732fa317d165804d8
TLSH
T162017B302272B1D549022F53191C2A8907BF43957968BE1C79A9225FD92B05B6F222E3
MD5 SHA1 SHA512 TLSH

Submit Download

MSIBAB0.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSIBAB0.tmp
Size 1.1MB
SHA256 400ff5b9a4439339876282909b23c397ffa208f4bcf64460fa2521284acf0b6e
MD5 44c34653e3a134ae0477da3063fd2ba4
SHA1 d1c872aa0b4a098d71153f5a0f526404590e385c
SHA512 63c937dafe933c1b65e9b82c77205788693752ddec6b7f9d6153e89b1242bcee2dc24bd17704b0cd99702a3d0b4ab29e3f312e0399fb9554de413cd736c3fba0
SSDEEP 24576:bUUGGa/LkG02xsOx2sk77KuR0KYFze9qB6qxyp+8lkmhihP:sGa/LW2aOcs47CvFK9DwvNhP
TLSH
T14235231033A54579F2A537714D74B3B139BE75722DB0804E7B8E49B90EA0BC2E9B8723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Deployment.WindowsInstaller.dll

Path C:\Users\Admin\AppData\Local\Temp\MSIBAB0.tmp-\Microsoft.Deployment.WindowsInstaller.dll
Size 172KB
SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
MD5 5ef88919012e4a3d8a1e2955dc8c8d81
SHA1 c0cfb830b8f1d990e3836e0bcc786e7972c9ed62
SHA512 4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684
SSDEEP 3072:FkfZS7FUguxN+77b1W5GR69UgoCaf8TpCnfKlRUjW01Ky4:x+c7b1W4R6joxfQE
TLSH
T14E045B2563FC473ECAEF87B4E2624251E7B2E2E97113DB0DDC8541AA2522780F792753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\MSIBAB0.tmp-\ScreenConnect.Core.dll
Size 572KB
SHA256 74f2d225b492eb77a5654bcaafec5162d0c5f72de884daa4c32daf54e2bff3d7
MD5 b759084c5614aacb33fec8faccd0c5ad
SHA1 d9a6c9802092d9ec4e7e9eb0872127d74db4bfd4
SHA512 5fc322836cfbf4cc93ac0b5c4d9a64a68507d372ad0bb731902a50b07bd6fbf0f40fab1a77028cc9c63b0f0f93158f82d274fe7abaa64a01a74b8879213d80ae
SSDEEP 6144:SobZO37pir0uomvrTk8AG2sTwR87HNSxyoiuHiWm9kzKY7vhNS/chwDTax4kzm7c:DZnAuhy7CsJlHiWKPYbhN4A
TLSH
T16AC48D3073A4A776C5AE1B7AE472619103B0F413659AF35B7B85E5F92DC23C88F107A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.InstallerActions.dll

Path C:\Users\Admin\AppData\Local\Temp\MSIBAB0.tmp-\ScreenConnect.InstallerActions.dll
Size 24KB
SHA256 2022f13b1f562d3cbef3a3926f0370a2de64e57ff281a121f90001a47499a356
MD5 8cc4a6f44f2afd49b9e8810daad0ebf7
SHA1 022165dae77ac02c8b20e43c4aeefe9566f98171
SHA512 491eb66bbcfe521cae8e2c2811fe013b23d6f2787f7075c625987769eb9f92d984615f5c12c9ae21df57f4f25ffe59a3670bb5e9f57934054ce8edf1c36ffdd7
SSDEEP 384:MCazzV1VTsaS8hQlLkmoAEV7NaNeirM0dbMsFkjvZB720Wi2X:FazC9EVMcLv14
TLSH
T1C7B2D620678DE27AF9EA1634B563FBB001B37DB3CCE9DA8565A420153D253E04FB5B06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\MSIBAB0.tmp-\ScreenConnect.Windows.dll
Size 1.7MB
SHA256 93f910f732855000861c1b4e6c55a2dee0a8cbb2172d89c7a2bc99053746c193
MD5 9edc01ae0bafe0a1c610d9c8014ad563
SHA1 5fbf0ba61aaaae5b506d78ca862286a676a61fbf
SHA512 366acaf50cef7626e6644dfd2e8a3c878de533be51f03e4ac205139bcf210615f5a0b0ee40d5fc4fe562eae7ee7d025e45b9ccc3279901ce400578441ba45928
SSDEEP 24576:okFuqFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUw:NFuqJkGYYpT0+TFiH7efP
TLSH
T16085BD41E2C364F5D46B047888BF572ABA743C080365CAFB97D4AE366D33BC09A36756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CustomAction.config

Path C:\Users\Admin\AppData\Local\Temp\MSIBEF7.tmp-\CustomAction.config
Size 234B
SHA256 7027b69ab6ebc9f3f7d2f6c800793fde2a057b76010d8cfd831cf440371b2b23
MD5 6f52ebea639fd7cefca18d9e5272463e
SHA1 b5e8387c2eb20dd37df8f4a3b9b0e875fa5415e3
SHA512 b5960066430ed40383d39365eadb3688cadadfeca382404924024c908e32c670afabd37ab41ff9e6ac97491a5eb8b55367d7199002bf8569cf545434ab2f271a
TLSH
T18CD0A70405D0FD1B5E231A2337524559FF34B1E290A44408B06F3A130A220CD4757317
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsInstaller.dll

Path C:\Users\Admin\AppData\Local\Temp\MSIBEF7.tmp-\ScreenConnect.WindowsInstaller.dll
Size 137KB
SHA256 361bbc692084841e4c8d22c89ca89c711d0fe17bc8759241736531a2f28de25b
MD5 72899e40e3d32282fd63c34b87b9385c
SHA1 5ad8f5020613acfaa84259809c373cc144af9076
SHA512 d2ac73c6b7b093fa209e78f3a8e95e7b9487fa1ff802f9928ad10fa2178cbfd545afe3f7644dc67a4d988280a4814955a46d1984d755aea7409836813f0de2e3
SSDEEP 1536:fU7AWOVH+oj12lAW5SDVzdi43b12vPDKukpQBhX6dhloZDutUVfh5U3KiQtlJxMg:fUADVZ12l4L12v2ukpQQWVfj2H6oG
TLSH
T18BD3393463AC9A77F6EF5ABDE470B1440BF2B527B4D2F78E594864F818127D04A2036B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientSetup.msi

Path C:\Users\Admin\AppData\Local\Temp\ScreenConnect\26.6.5.9742\c0e4b47567c6903c\ScreenConnect.ClientSetup.msi
Size 9.8MB
SHA256 7fa22f7be2077e4c6bcdf2d74d89a251a27334a5a03804914020c35400a9f1af
MD5 fa338917ff663e842b8f29392dafbf32
SHA1 14bebeae4936f1f1ca8c824bd72125980ba8a685
SHA512 07b53acb81304f8e05dc79c4a9ba63c6c3961f0836bba199971c7b38838279215d11a3d4db25422034c40f9cb4f8660965f5b50e9f737ff498133b607bb328db
SSDEEP 98304:1Mn1Giy8E1PqhlG6ztZNK9aNGXMn1Giy8E1PqhAMn1Giy8E1PqhrMn1Giy8E1Pqh:0ZWi9z3I96jZWijZWiKZWi
TLSH
T166A6232123FAC168F1B61B35D93965B56936BD12DA22C04F1364BE6E3C31F949A72333
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_fmdekgcw.yc1.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fmdekgcw.yc1.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

MSI2F5.tmp

Path C:\Windows\Installer\MSI2F5.tmp
Size 202KB
SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
MD5 ba84dd4e0c1408828ccc1de09f585eda
SHA1 e8e10065d479f8f591b9885ea8487bc673301298
SHA512 7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290
SSDEEP 3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
TLSH
T129147C326494803EE7F91A36D93E9A61AE7DF6241760C99EC3848C0E5D604D06BF7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1klguo1j.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (c0e4b47567c6903c)\1klguo1j.newcfg
Size 885B
SHA256 2ddc61cbca4ea00418c2898bd77388949b01a5a8c0de18507fa52a1a9717d358
MD5 b0e46de1f98361139ebe97640c857d0e
SHA1 5f1c3df2d6545f2e68d477d6ea06bca8e0e2c0f6
SHA512 ac03d6c6866dec975889439d9f6224732ed636046e4a5e5e477b8a847dbf06acc1edc1e3791fb4f30ad58072c39bb5b6b11a94b834d09c056999de8b49c2e39b
TLSH
T1EC11BD9872D49E4B0AB72A33E1314385FE711657017560D474EE62376F305DB07E32EA
MD5 SHA1 SHA512 TLSH

Submit Download

441k30br.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (c0e4b47567c6903c)\441k30br.newcfg
Size 683B
SHA256 1658fd1d1423a566a2f25c363bc3921d9f5f22e489a6103eb2eefcaeae6bc8bc
MD5 7d1134131f92550bf724ae87a5334d09
SHA1 c259b57d971368a6c146804c43b6928fe9b8146a
SHA512 194d5b795e94c1e1b9ca7dc979989fadf71e5c50685b5e47c732d1afae4f2571114b67fa917f72fe000e78f19626443884d82e33278b755dc0ffd62df888c238
TLSH
T1010128A571C4AE5707B32E33D6218385FE72165B026520D874AE627B6F305CB07E36DE
MD5 SHA1 SHA512 TLSH

Submit Download

h0k502er.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (c0e4b47567c6903c)\h0k502er.newcfg
Size 885B
SHA256 230b6aa8d5083e601da0429ee8e7e35573aff93440f9b383b361f8ea2792f738
MD5 a60b33ff6d961c1ea7c65ea13bf7d119
SHA1 1d4660ef7832a9dfba859a329b7ff1dedd589899
SHA512 641f78e79c2363500f5e43f76bcabbc2ec733f1e4fc5c8f65897ceffee19740100131c0f678b5ca23d00e85d9e2371db0f9ca84076419a8e5cf3097e4a7096e4
TLSH
T19711899872D4AE570AB72A33E1214385FE711657016560D474AE62376F305DB07E32EA
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (c0e4b47567c6903c)\user.config
Size 520B
SHA256 87dffdce0e3aba9b46c28ee943059a2513a20b9327ffb59d56062a3dcb4a6176
MD5 f58e9fbd6c2364beb0a033eb921f76d9
SHA1 3e1fc437edf5d274119202a689a68b8474abbdb5
SHA512 4de30b99311415d2fc35b6ac1cef0859dd55eabd27ff3db496ebd696e9ce0bc98619e17291b82b1e0fba43ad63440bfb0c2aa0897d65395f88d0d98b653c7fd6
TLSH
T140F0E9A131846E4703636E23C5114745FE72569B0551209874AF627A5F315CE07A31CE
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1144-170-0x00000000036F0000-0x0000000003786000-memory.dmp

Download

memory/1144-195-0x0000000003AF0000-0x0000000003B5C000-memory.dmp

Download

memory/1144-207-0x0000000003B60000-0x0000000003BF2000-memory.dmp

Download

memory/1144-209-0x0000000003870000-0x00000000038B1000-memory.dmp

Download

memory/1144-211-0x0000000003D40000-0x0000000003E16000-memory.dmp

Download

memory/1144-176-0x0000000003820000-0x0000000003870000-memory.dmp

Download

memory/1144-174-0x0000000003940000-0x0000000003AF0000-memory.dmp

Download

memory/1144-164-0x0000000003610000-0x000000000362A000-memory.dmp

Download

memory/2348-670-0x0000023742E10000-0x0000023742E20000-memory.dmp

Download

memory/2348-671-0x0000023742E90000-0x0000023742EAA000-memory.dmp

Download

memory/2348-280-0x0000023742F10000-0x0000023742F86000-memory.dmp

Download

memory/2348-705-0x0000023742EE0000-0x0000023742F0A000-memory.dmp

Download

memory/2348-706-0x0000023742EE0000-0x0000023742F04000-memory.dmp

Download

memory/2348-278-0x00000237291D0000-0x00000237291F2000-memory.dmp

Download

memory/2348-279-0x0000023742E40000-0x0000023742E84000-memory.dmp

Download

memory/2432-83-0x0000000005430000-0x0000000005458000-memory.dmp

Download

memory/2520-231-0x0000000000A50000-0x0000000000A6A000-memory.dmp

Download

memory/2520-230-0x000000001B3D0000-0x000000001B580000-memory.dmp

Download

memory/2520-228-0x0000000002510000-0x000000000257C000-memory.dmp

Download

memory/2520-227-0x00000000001E0000-0x0000000000290000-memory.dmp

Download

memory/2520-229-0x000000001B180000-0x000000001B216000-memory.dmp

Download

memory/2520-232-0x000000001C390000-0x000000001C518000-memory.dmp

Download

memory/5224-245-0x0000017E34930000-0x0000017E34931000-memory.dmp

Download

memory/5224-241-0x0000017E34930000-0x0000017E34931000-memory.dmp

Download

memory/5224-249-0x0000017E34930000-0x0000017E34931000-memory.dmp

Download

memory/5224-250-0x0000017E34930000-0x0000017E34931000-memory.dmp

Download

memory/5224-240-0x0000017E34930000-0x0000017E34931000-memory.dmp

Download

memory/5224-248-0x0000017E34930000-0x0000017E34931000-memory.dmp

Download

memory/5224-246-0x0000017E34930000-0x0000017E34931000-memory.dmp

Download

memory/5224-239-0x0000017E34930000-0x0000017E34931000-memory.dmp

Download

memory/5224-247-0x0000017E34930000-0x0000017E34931000-memory.dmp

Download

memory/5224-251-0x0000017E34930000-0x0000017E34931000-memory.dmp

Download

memory/5240-43-0x0000000005BC0000-0x0000000005BCC000-memory.dmp

Download

memory/5240-51-0x0000000005ED0000-0x0000000006080000-memory.dmp

Download

memory/5240-39-0x0000000005B90000-0x0000000005BBE000-memory.dmp

Download

memory/5240-47-0x0000000005C70000-0x0000000005D06000-memory.dmp

Download

memory/5944-3-0x0000000006280000-0x000000000628C000-memory.dmp

Download

memory/5944-8-0x0000000003C70000-0x0000000003C80000-memory.dmp

Download

memory/5944-7-0x0000000006B50000-0x00000000070F6000-memory.dmp

Download

memory/5944-0-0x0000000003C70000-0x0000000003C80000-memory.dmp

Download

memory/5944-6-0x00000000063E0000-0x0000000006590000-memory.dmp

Download

memory/5944-5-0x00000000063B0000-0x00000000063D8000-memory.dmp

Download

memory/5944-4-0x0000000006300000-0x0000000006396000-memory.dmp

Download

memory/5944-2-0x0000000003C70000-0x0000000003C80000-memory.dmp

Download

memory/5944-1-0x0000000003C60000-0x0000000003C68000-memory.dmp

Download