ScreenConnect

ScreenConnect Data (now known as ConnectWise Control)

AppsCompound
7 paths from 1 artifacts
Version 1
Drew Ervin

Paths on disk

7 paths from 2 targets

Includes 1 targets

Each one is collected with this target

ApplicationEvents4 paths

References

1 link

youtu.be/0qSWfbti4yM(opens in new tab)

Collect it

KAPE command line for ScreenConnect

Source

Destination

--vss--vhdx

kape.exe --tsource C: --tdest D:\Evidence --target ScreenConnect

Note: This is a compound target that references 1 other target. The KAPE command resolves them natively; the PowerShell/Batch/WSL scripts flatten every referenced path into explicit copy commands.

Run with administrator privileges. KAPE Documentation

Part of these collections

3 collections collect this target

SANS_Triage
KapeTriage
RemoteAdmin