24d9129085c6f33b3ad8434a39c252bcc3718a430dae4f32c4bc73487c9644b9

Analysis

user interaction
yes
max time kernel
61s
max time network
39s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
25/09/2026, 11:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ScreenConnect.ClientSetup.exe
Size 5.4MB
Sample260925-n5eedadh26
SHA256 24d9129085c6f33b3ad8434a39c252bcc3718a430dae4f32c4bc73487c9644b9
MD5 c049065c7fd7b943c759305ae894228b
SHA1 8c87b7a45000b90ce55a78ef019571c2eb1faefa
SHA512 1571112a922024d8ed35fd0839892cc39b59d5c647feff9f8159bf7e71b05e5c2b370faf3fb075ec9a161a65c1b8db3c9907e4cc42a05165c237605e337cd7ac
SSDEEP 98304:7zIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:7hfefPtHxcp9ym3nltDUJV
TLSH
T1FD46E101B3D695B6D1BF1638D87A52696774BC048316CBBF5394BD392E32BC04E323A6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

backdoor discovery persistence privilege_escalation ransomware rat revoked_codesign

Malware Config

Signatures

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (39421e627e08cafb)\ImagePath = "\"C:\\Program Files (x86)\\ScreenConnect Client (39421e627e08cafb)\\ScreenConnect.ClientService.exe\" \"?e=Access&y=Guest&h=instance-xycqcn-relay.screenconnect.com&p=443&s=e6b0ff64-4ca5-4803-84ef-e48f7c7744f8&k=BgIAAACkAABSU0ExAAgAAAEAAQB1IawkQzBkg%2bceM9b5%2fPOoVW3B1dUNedHTLVT%2bZj7AWCzz9COdP2mnEZNYPJ7oZtuae%2bvzLHzsjzEHBCx0s6U2LwS%2fWeOTMI357Qt8yYhJ2vCXboy%2f4AY%2b%2fxT5GweJKTrYHpKShbfmc3y9yEYyF7ja7jHMZM3APTZZgJt9ocVGTLSl3ExKhd68Kn%2f97I08HGp9UHYQmnuFD0NxTTqbZ2pDaLIJU9mmSf8y5lw8CUcoi52DkWJErTagucyrJM3I6vzIIpR%2bvOZPtdHW8iI%2ffWAXm%2bUG%2fltQLNezCE3i4DT8krC%2btvEbD4lw9sg%2bMfaTrKVGF%2bIErHHDmciSxoyAf4ai&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAA9v26Kue0%2bEOJbImEv2UqmAAAAAACAAAAAAAQZgAAAAEAACAAAACH62CTf2cwV70ZewoRRxzGTDHxqQW47MXoXG%2bop2THPwAAAAAOgAAAAAIAACAAAADY3q0utBhk4W6PTCH1RlJPKY5aEtxBGEt9wPY%2f1Q9nhaAEAAADDZNb0jAEuOcKgHw2ubwtwibB5Dy5AkatHhs8om30ZKST1iqO9kDUBtOmXVHzAOK0D1GRTD9flGvjNkLkM740EvUY8%2bHjhbCwjSjAr6GciJb8QSlUNsrOu2vSkjrc07A1sbzPU1eWJjmukwOdLsRaGKQMJBhjOURmgA4%2bLLS5y0Ghrvo2XLEi7%2bBFus3J4L7XHcbezTiZCfuphPoIPrd5O7CT63kYsBKlunAZ2Bsiw7GOWzZ%2bmo9rQIEPaeq7uHXejyIjTzNIpFNQgfleAeXxrqrKY2heGmnTd5cPgJJ3%2f7RGr4rlKUL73I52gJrITt%2fosLf05lSi%2b5GPLQ%2fNsvfGad4ByyeWmXKUPPAvPKQYLr8SSgq8AwbcQyPIJKiLsRb4luQ09QRiY%2bwDnQss2O8NxyzCGoTFiSqz1EJ6yvq0Th2OQYRnelMjRgFBOgG9Z60%2b%2bezgdQq1k%2fN9zzizW3G6V5LC8vWt7i27xbQFy8HVbIA9qPRXk3J%2bgLOOFhdvu5wB%2bhcGzvIpMY6rHQkI6OctNUVzIHsvE24bfZ8biXLUg7WjaSN0F%2fs6uhTpBvlEQungkFcY8xPEwzyr2gAk%2fQj5sB0PgpZxdVc61pPQcryygH80kkK9vFrx6RE0%2bMo0TVat%2fvkmbPKKGGsXHddW1S4zHccjPcIgas8kYJ7GcBgEhJUh%2bZsuE7iPUukXoZ75%2bF7qxEPIBGPVDmxEImqO0hyPSgdWEQXoKAeYRyeTxI3DWy8Z18hHjKxC24S5%2fdktFCx0iOZfIjDmEAlKHTFOFRtUpgCHtUG44taoZ7otuQ%2fDknUnTcTsk0ni1MLzE3MFSCRby3d9kxtznvTyOGJhRHsZYPJPhXEN88BId0nWv0eny2LudzgLgAjJbxdGMvMVXvIF9togZ%2bufLqwTr%2bGotxd4UKYpEPdXn%2bm1RO%2fQqBi1pVB6L16WqRJphD2Eet1t0UI4WUcE259JM916fPuXLw4hV%2f%2b1jrH1I86CiDzS3Z8i2JWAZQulJ%2bp4QvBWr5BbWAquYDBtJnHDvIPGZ%2bLqnD4lyf1fUq1wdHu9Th55z50psrn7myNwJAf3e4ny07SawCGgv3ArkUGDrz9s8T439D%2fNG9lalvfNaw8l1f1CHMxwZNnoGDPgEIngTfAacZt5jSIqGzNEL9zbtBrJuqnEYHyxa8m94E7ny%2b8MlfUgH0BmhgqOMbwZSdKD453saA1oGiiN636TXL2KiryMGhK7jp%2bv3zXXZ5WwShyc%2b78lNr8xZRJD%2f7TMJVovtohyFNwVe5nhHMQhaDuwsu5ZZSWjT4W4SDlbimWXL4fDQrIx9zpDlbLx3pzuGyCdYKHdZclCgNLHk%2bfV05Bh2Gvutbev%2fMFPNfFHnya31UbGhwiXHX6kJM5QKcy6CA3T0Eb7cCYxOwgE8ANpEKOpEZRGo7UGMBMfHGj6MToXG%2fFgIrr%2bXaqNHG9tYTnG1kWkU0SQwea0EWgQDw%2fxed04O4JkbogPWV1dRVHLAfz0NA9jTqF97BkPTa0TgReii4Y1J6R8xioeBi7V6FDHwaekI%2fyS0Flhu5vA62wyy7ux%2bZ8ZnT8SioD%2bXEAAAACX4BBIGy39j%2ffhw91%2f4nxsAroXrm0IwbfhJPAH9gFg3xdhA%2fCX2WRmDVn3hLA8gVfGDqKcHi42HlPwKt6ZMHrC\""	ScreenConnect.ClientService.exe

Signed with revoked ConnectWise certificate 7 IoCs

Binary is signed using a ConnectWise certificate revoked for key compromise.

revoked_codesign

resource	yara_rule
behavioral1/memory/4324-4-0x0000000005C80000-0x0000000005F72000-memory.dmp	revoked_cert_connectwise
behavioral1/files/0x001700000002b755-81.dat	revoked_cert_connectwise
behavioral1/memory/5908-106-0x0000000004790000-0x0000000004865000-memory.dmp	revoked_cert_connectwise
behavioral1/files/0x001700000002b752-105.dat	revoked_cert_connectwise
behavioral1/files/0x001700000002b750-111.dat	revoked_cert_connectwise
behavioral1/files/0x001700000002b753-207.dat	revoked_cert_connectwise
behavioral1/files/0x001700000002b74e-199.dat	revoked_cert_connectwise

ConnectWise ScreenConnect remote access tool
ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
backdoor rat
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 7 IoCs

pid	Process
5908	ScreenConnect.ClientService.exe
2524	ScreenConnect.WindowsClient.exe
4116	ScreenConnect.WindowsClient.exe
5544	ScreenConnect.ClientSetup.exe
2004	ScreenConnect.ClientService.exe
5576	ScreenConnect.WindowsClient.exe
5212	ScreenConnect.WindowsClient.exe

Loads dropped DLL 44 IoCs

pid	Process
4836	MsiExec.exe
3908	rundll32.exe
3908	rundll32.exe
3908	rundll32.exe
3908	rundll32.exe
3908	rundll32.exe
3908	rundll32.exe
3908	rundll32.exe
3908	rundll32.exe
3908	rundll32.exe
1916	MsiExec.exe
1292	MsiExec.exe
5908	ScreenConnect.ClientService.exe
5908	ScreenConnect.ClientService.exe
5908	ScreenConnect.ClientService.exe
5908	ScreenConnect.ClientService.exe
5908	ScreenConnect.ClientService.exe
5908	ScreenConnect.ClientService.exe
5908	ScreenConnect.ClientService.exe
5908	ScreenConnect.ClientService.exe
5908	ScreenConnect.ClientService.exe
5908	ScreenConnect.ClientService.exe
4012	MsiExec.exe
1716	rundll32.exe
1716	rundll32.exe
1716	rundll32.exe
1716	rundll32.exe
1716	rundll32.exe
1716	rundll32.exe
1716	rundll32.exe
1716	rundll32.exe
1716	rundll32.exe
4012	MsiExec.exe
4012	MsiExec.exe
2004	ScreenConnect.ClientService.exe
2004	ScreenConnect.ClientService.exe
2004	ScreenConnect.ClientService.exe
2004	ScreenConnect.ClientService.exe
2004	ScreenConnect.ClientService.exe
2004	ScreenConnect.ClientService.exe
2004	ScreenConnect.ClientService.exe
2004	ScreenConnect.ClientService.exe
2004	ScreenConnect.ClientService.exe
2004	ScreenConnect.ClientService.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe

Boot or Logon Autostart Execution: Authentication Package 1 TTPs 2 IoCs

Suspicious Windows Authentication Registry Modification.

persistence privilege_escalation

Authentication Package

T1547.002

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\Authentication Packages = 6d007300760031005f00300000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\Authentication Packages = 6d007300760031005f003000000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800330039003400320031006500360032003700650030003800630061006600620029005c00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f0077007300410075007400680065006e007400690063006100740069006f006e005000610063006b006100670065002e0064006c006c0000000000	msiexec.exe

Drops file in System32 directory 16 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ScreenConnect.ClientService.exe.log	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (39421e627e08cafb)\3h10qa15.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (39421e627e08cafb)\3h10qa15.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (39421e627e08cafb)\wk1tzzca.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (39421e627e08cafb)\o5fafszf.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (39421e627e08cafb)\3h10qa15.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (39421e627e08cafb)\nmtghnk0.tmp	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (39421e627e08cafb)\user.config	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (39421e627e08cafb)\wk1tzzca.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (39421e627e08cafb)\o5fafszf.tmp	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (39421e627e08cafb)\o5fafszf.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (39421e627e08cafb)\nmtghnk0.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ScreenConnect.WindowsClient.exe.log	ScreenConnect.WindowsClient.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (39421e627e08cafb)\wk1tzzca.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ScreenConnect.ClientSetup.exe.log	ScreenConnect.ClientSetup.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rundll32.exe.log	rundll32.exe

Drops file in Program Files directory 34 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\ScreenConnect Client (39421e627e08cafb)\ScreenConnect.ClientService.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\ScreenConnect Client (39421e627e08cafb)\app.config	msiexec.exe
File opened for modification	C:\Program Files (x86)\ScreenConnect Client (39421e627e08cafb)\ScreenConnect.WindowsBackstageShell.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (39421e627e08cafb)\ScreenConnect.ClientService.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (39421e627e08cafb)\ScreenConnect.WindowsAuthenticationPackage.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (39421e627e08cafb)\app.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (39421e627e08cafb)\Client.en-US.resources	msiexec.exe
File opened for modification	C:\Program Files (x86)\ScreenConnect Client (39421e627e08cafb)\ScreenConnect.WindowsClient.exe	msiexec.exe
File opened for modification	C:\Program Files (x86)\ScreenConnect Client (39421e627e08cafb)\Client.resources	msiexec.exe
File opened for modification	C:\Program Files (x86)\ScreenConnect Client (39421e627e08cafb)\ScreenConnect.WindowsBackstageShell.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (39421e627e08cafb)\ScreenConnect.Client.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (39421e627e08cafb)\ScreenConnect.WindowsFileManager.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (39421e627e08cafb)\ScreenConnect.WindowsFileManager.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (39421e627e08cafb)\system.config	msiexec.exe
File opened for modification	C:\Program Files (x86)\ScreenConnect Client (39421e627e08cafb)\Client.en-US.resources	msiexec.exe
File opened for modification	C:\Program Files (x86)\ScreenConnect Client (39421e627e08cafb)\ScreenConnect.WindowsFileManager.exe	msiexec.exe
File opened for modification	C:\Program Files (x86)\ScreenConnect Client (39421e627e08cafb)\ScreenConnect.ClientService.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (39421e627e08cafb)\ScreenConnect.WindowsCredentialProvider.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (39421e627e08cafb)\ScreenConnect.ClientService.exe	msiexec.exe
File opened for modification	C:\Program Files (x86)\ScreenConnect Client (39421e627e08cafb)\ScreenConnect.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (39421e627e08cafb)\ScreenConnect.Windows.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (39421e627e08cafb)\ScreenConnect.WindowsBackstageShell.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (39421e627e08cafb)\Client.resources	msiexec.exe
File opened for modification	C:\Program Files (x86)\ScreenConnect Client (39421e627e08cafb)\ScreenConnect.WindowsAuthenticationPackage.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (39421e627e08cafb)\ScreenConnect.Core.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\ScreenConnect Client (39421e627e08cafb)\ScreenConnect.Windows.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\ScreenConnect Client (39421e627e08cafb)\system.config	msiexec.exe
File opened for modification	C:\Program Files (x86)\ScreenConnect Client (39421e627e08cafb)\ScreenConnect.WindowsCredentialProvider.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (39421e627e08cafb)\ScreenConnect.WindowsBackstageShell.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (39421e627e08cafb)\ScreenConnect.WindowsClient.exe.config	msiexec.exe
File opened for modification	C:\Program Files (x86)\ScreenConnect Client (39421e627e08cafb)\ScreenConnect.Client.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\ScreenConnect Client (39421e627e08cafb)\ScreenConnect.WindowsClient.exe.config	msiexec.exe
File opened for modification	C:\Program Files (x86)\ScreenConnect Client (39421e627e08cafb)\ScreenConnect.WindowsFileManager.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (39421e627e08cafb)\ScreenConnect.WindowsClient.exe	msiexec.exe

Drops file in Windows directory 58 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\~DF0023C55E69B05D2C.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\{6C86999F-EC0A-5CA9-9F76-672E6515537C}\DefaultIcon	msiexec.exe
File created	C:\Windows\Installer\SourceHash{6765D5BD-D313-BE5E-4864-73A810568FC1}	msiexec.exe
File created	C:\Windows\SystemTemp\~DFCC4DA66C185C9164.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFAE82CB43B6649F25.TMP	msiexec.exe
File created	C:\Windows\Installer\e58b4b7.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\{6765D5BD-D313-BE5E-4864-73A810568FC1}\DefaultIcon	msiexec.exe
File created	C:\Windows\SystemTemp\~DFEF60CD77E040AAE3.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB59F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEC52.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEC52.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File created	C:\Windows\SystemTemp\~DF52E830E4FAC1948F.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB5DF.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF1891F2A0F6EDF298.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEC52.tmp-\Microsoft.Deployment.Compression.Cab.dll	rundll32.exe
File created	C:\Windows\SystemTemp\~DF662211AC6A8A4CD2.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB6DA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e58b4b8.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFA1E.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF551AB459D2A6F167.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFA4E7AF76AA716562.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFE755BAB97B76F5A0.TMP	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\wix{6765D5BD-D313-BE5E-4864-73A810568FC1}.SchedServiceConfig.rmi	MsiExec.exe
File created	C:\Windows\SystemTemp\ScreenConnect\26.6.5.9742\39421e627e08cafb\ScreenConnect.ClientSetup.msi	ScreenConnect.ClientSetup.exe
File opened for modification	C:\Windows\Installer\MSIEC52.tmp-\Microsoft.Deployment.WindowsInstaller.Package.dll	rundll32.exe
File created	C:\Windows\Installer\SourceHash{6C86999F-EC0A-5CA9-9F76-672E6515537C}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF9B355857D23E8235.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFC35.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF1B0BFBDB16AAFA33.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e58b4b5.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFB0A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFB3A.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF51C14411023762C1.TMP	msiexec.exe
File created	C:\Windows\Installer\{6C86999F-EC0A-5CA9-9F76-672E6515537C}\DefaultIcon	msiexec.exe
File created	C:\Windows\SystemTemp\~DF8A55FA5115DE1D02.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFCDE26A75849C2F20.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEC52.tmp-\ScreenConnect.Windows.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIEC52.tmp-\ScreenConnect.WindowsInstaller.dll	rundll32.exe
File created	C:\Windows\SystemTemp\ScreenConnect\25.2.4.9229\ScreenConnect.ClientSetup.exe	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\Installer\MSIEC52.tmp-\Microsoft.Deployment.Compression.dll	rundll32.exe
File created	C:\Windows\SystemTemp\~DFDECE288D7470E720.TMP	msiexec.exe
File created	C:\Windows\Installer\e58b4d0.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF037D51580C519827.TMP	msiexec.exe
File created	C:\Windows\Installer\e58b4b5.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\SystemTemp\~DF5645AC201AEDA578.TMP	msiexec.exe
File created	C:\Windows\Installer\e58b4b8.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF717121B3EF07F236.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF51B4EF04F1E9F34B.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFA620FB20B5E53823.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEC52.tmp-\ScreenConnect.Core.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIEC52.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\{6765D5BD-D313-BE5E-4864-73A810568FC1}\DefaultIcon	msiexec.exe
File created	C:\Windows\SystemTemp\~DF198F0ED40AC21CF3.TMP	msiexec.exe
File created	C:\Windows\Installer\wix{6C86999F-EC0A-5CA9-9F76-672E6515537C}.SchedServiceConfig.rmi	MsiExec.exe
File opened for modification	C:\Windows\Installer\MSIEC52.tmp-\ScreenConnect.InstallerActions.dll	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenConnect.ClientSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenConnect.ClientService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenConnect.ClientSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenConnect.ClientService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000460a485937509c200000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000460a48590000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900460a4859000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a460a4859000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d460a4859000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ScreenConnect.WindowsClient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ScreenConnect.WindowsClient.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ScreenConnect.WindowsClient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ScreenConnect.WindowsClient.exe

Modifies data under HKEY_USERS 62 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0001\SessionHash = 805819bc7bb7686d633d885db90ba8b346153eb3ac7d58d9a8d63683911334a5	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0001\Sequence = "1"	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.ClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0001\Sequence = "2"	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.ClientSetup.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.ClientSetup.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.ClientSetup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	msiexec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0001\RegProcs0000 = 300030003000300030003900640063003a00300031006400640034006300650035003a00330064006400300066003500350039000000300030003000300031003700310034003a00300031006400640034006300650035003a003300640030006300370033003500650000000000	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0001	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0002\Sequence = "1"	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.ClientSetup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Sequence = "1"	msiexec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0001\RegProcsHash = 840544f84ec42ebd63be3d7bb0a6788719cb518d91c78fc90d13430b73a3c5e4	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0001\RegProcs0000 = 300030003000300030003900640063003a00300031006400640034006300650035003a003300640064003000660035003500390000000000	msiexec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0001\RegProcsHash = 4fc34df88f4763654961d8f4bddd5ec0f8818fdf2ddf43646ac18476cdfc0769	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0002	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0002	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.WindowsClient.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	msiexec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Owner = 100e0000a0085834e54cdd01	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0001\Sequence = "3"	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.ClientService.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0002\SessionHash = 32c0ff2ac626db8b9e09643fa1dd7d61539825785d072c30015cb343f26417c6	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Sequence = "3"	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.ClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager	msiexec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 36fd6d307bc62ff92865dd59790348fc5fd6664a2cec1be5d2cf336def92b32e	msiexec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800330039003400320031006500360032003700650030003800630061006600620029005c00530063007200650065006e0043006f006e006e006500630074002e0043006c00690065006e00740053006500720076006900630065002e0064006c006c00000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800330039003400320031006500360032003700650030003800630061006600620029005c00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f007700730043006c00690065006e0074002e00650078006500000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800330039003400320031006500360032003700650030003800630061006600620029005c00530063007200650065006e0043006f006e006e006500630074002e0043006c00690065006e0074002e0064006c006c00000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800330039003400320031006500360032003700650030003800630061006600620029005c00530063007200650065006e0043006f006e006e006500630074002e0043006f00720065002e0064006c006c00000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800330039003400320031006500360032003700650030003800630061006600620029005c00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f00770073002e0064006c006c00000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800330039003400320031006500360032003700650030003800630061006600620029005c00530063007200650065006e0043006f006e006e006500630074002e0043006c00690065006e00740053006500720076006900630065002e0065007800650000000000	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Sequence = "2"	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.ClientService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0001	msiexec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 7d25cb11772d3f287c0166a01fb2d548e52e4ee9bf6ca8513bbfca44436373aa	msiexec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0001\Owner = c804000064c51b45e54cdd01	msiexec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0002\Owner = 100e0000a0085834e54cdd01	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.ClientService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0001	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.ClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.ClientSetup.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.WindowsClient.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DB5D5676313DE5EB8446378A0165F81C\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DB5D5676313DE5EB8446378A0165F81C\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DB5D5676313DE5EB8446378A0165F81C\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F99968C6A0CE9AC5F96776E2565135C7\ProductIcon = "C:\\Windows\\Installer\\{6C86999F-EC0A-5CA9-9F76-672E6515537C}\\DefaultIcon"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F99968C6A0CE9AC5F96776E2565135C7\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F99968C6A0CE9AC5F96776E2565135C7\PackageCode = "F99968C6A0CE9AC5F96776E2565135C7"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-B823-6D7E5DA0EB76}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-39421e627e08cafb	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-B823-6D7E5DA0EB76}\ = "ScreenConnect Client (39421e627e08cafb) Credential Provider"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DB5D5676313DE5EB8446378A0165F81C\Assignment = "1"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DB5D5676313DE5EB8446378A0165F81C	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-B823-6D7E5DA0EB76}\InprocServer32	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\8BE99F859A595F869324E126E780ACBF	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F99968C6A0CE9AC5F96776E2565135C7\ProductName = "ScreenConnect Client (39421e627e08cafb)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DB5D5676313DE5EB8446378A0165F81C\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-B823-6D7E5DA0EB76}\InprocServer32\ = "C:\\Program Files (x86)\\ScreenConnect Client (39421e627e08cafb)\\ScreenConnect.WindowsCredentialProvider.dll"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-39421e627e08cafb\UseOriginalUrlEncoding = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-39421e627e08cafb\shell\open	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DB5D5676313DE5EB8446378A0165F81C\Version = "419561476"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F99968C6A0CE9AC5F96776E2565135C7\SourceList\Net\1 = "C:\\Windows\\SystemTemp\\ScreenConnect\\26.6.5.9742\\39421e627e08cafb\\"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DB5D5676313DE5EB8446378A0165F81C\SourceList\Media	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F99968C6A0CE9AC5F96776E2565135C7\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DB5D5676313DE5EB8446378A0165F81C\ProductName = "ScreenConnect Client (39421e627e08cafb)"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DB5D5676313DE5EB8446378A0165F81C\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F99968C6A0CE9AC5F96776E2565135C7\SourceList\Media	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F99968C6A0CE9AC5F96776E2565135C7\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-B823-6D7E5DA0EB76}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DB5D5676313DE5EB8446378A0165F81C\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DB5D5676313DE5EB8446378A0165F81C\SourceList\PackageName = "ScreenConnect.ClientSetup.msi"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DB5D5676313DE5EB8446378A0165F81C\SourceList\Net	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\DB5D5676313DE5EB8446378A0165F81C	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F99968C6A0CE9AC5F96776E2565135C7\Full	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F99968C6A0CE9AC5F96776E2565135C7	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\8BE99F859A595F869324E126E780ACBF	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-39421e627e08cafb\shell\open\command	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-39421e627e08cafb	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F99968C6A0CE9AC5F96776E2565135C7\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F99968C6A0CE9AC5F96776E2565135C7\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DB5D5676313DE5EB8446378A0165F81C\PackageCode = "DB5D5676313DE5EB8446378A0165F81C"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F99968C6A0CE9AC5F96776E2565135C7\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F99968C6A0CE9AC5F96776E2565135C7\SourceList\PackageName = "ScreenConnect.ClientSetup.msi"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F99968C6A0CE9AC5F96776E2565135C7\Version = "436600837"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-39421e627e08cafb	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-39421e627e08cafb\shell	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-39421e627e08cafb\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (39421e627e08cafb)\\ScreenConnect.WindowsClient.exe\" \"%1\""	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DB5D5676313DE5EB8446378A0165F81C\Language = "1033"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-39421e627e08cafb\shell\open\command	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-B823-6D7E5DA0EB76}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F99968C6A0CE9AC5F96776E2565135C7	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\DB5D5676313DE5EB8446378A0165F81C	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\8BE99F859A595F869324E126E780ACBF\DB5D5676313DE5EB8446378A0165F81C	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-39421e627e08cafb\shell\open	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F99968C6A0CE9AC5F96776E2565135C7\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F99968C6A0CE9AC5F96776E2565135C7\SourceList\Net	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-39421e627e08cafb\shell	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DB5D5676313DE5EB8446378A0165F81C\ProductIcon = "C:\\Windows\\Installer\\{6765D5BD-D313-BE5E-4864-73A810568FC1}\\DefaultIcon"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DB5D5676313DE5EB8446378A0165F81C\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DB5D5676313DE5EB8446378A0165F81C\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\25.2.4.9229\\39421e627e08cafb\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F99968C6A0CE9AC5F96776E2565135C7\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F99968C6A0CE9AC5F96776E2565135C7\SourceList\LastUsedSource = "n;1;C:\\Windows\\SystemTemp\\ScreenConnect\\26.6.5.9742\\39421e627e08cafb\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\DB5D5676313DE5EB8446378A0165F81C\Full	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F99968C6A0CE9AC5F96776E2565135C7\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DB5D5676313DE5EB8446378A0165F81C\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DB5D5676313DE5EB8446378A0165F81C\SourceList\Media\1 = ";"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3600	msiexec.exe
3600	msiexec.exe
5908	ScreenConnect.ClientService.exe
5908	ScreenConnect.ClientService.exe
5908	ScreenConnect.ClientService.exe
5908	ScreenConnect.ClientService.exe
5908	ScreenConnect.ClientService.exe
5908	ScreenConnect.ClientService.exe
3600	msiexec.exe
3600	msiexec.exe
3600	msiexec.exe
3600	msiexec.exe
3600	msiexec.exe
3600	msiexec.exe
3600	msiexec.exe
3600	msiexec.exe
3600	msiexec.exe
3600	msiexec.exe
1224	msiexec.exe
1224	msiexec.exe
1224	msiexec.exe
1224	msiexec.exe
1224	msiexec.exe
1224	msiexec.exe
1224	msiexec.exe
1224	msiexec.exe
1224	msiexec.exe
1224	msiexec.exe
3600	msiexec.exe
3600	msiexec.exe
3600	msiexec.exe
3600	msiexec.exe
3600	msiexec.exe
3600	msiexec.exe
3600	msiexec.exe
3600	msiexec.exe
3600	msiexec.exe
3600	msiexec.exe
1224	msiexec.exe
1224	msiexec.exe
1224	msiexec.exe
1224	msiexec.exe
1224	msiexec.exe
1224	msiexec.exe
1224	msiexec.exe
1224	msiexec.exe
1224	msiexec.exe
1224	msiexec.exe
3600	msiexec.exe
3600	msiexec.exe
2004	ScreenConnect.ClientService.exe
2004	ScreenConnect.ClientService.exe
2004	ScreenConnect.ClientService.exe
2004	ScreenConnect.ClientService.exe
2004	ScreenConnect.ClientService.exe
2004	ScreenConnect.ClientService.exe
3600	msiexec.exe
3600	msiexec.exe
3600	msiexec.exe
3600	msiexec.exe
3600	msiexec.exe
3600	msiexec.exe
3600	msiexec.exe
3600	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4324	ScreenConnect.ClientSetup.exe
Token: SeShutdownPrivilege	5028	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5028	msiexec.exe
Token: SeSecurityPrivilege	3600	msiexec.exe
Token: SeCreateTokenPrivilege	5028	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5028	msiexec.exe
Token: SeLockMemoryPrivilege	5028	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5028	msiexec.exe
Token: SeMachineAccountPrivilege	5028	msiexec.exe
Token: SeTcbPrivilege	5028	msiexec.exe
Token: SeSecurityPrivilege	5028	msiexec.exe
Token: SeTakeOwnershipPrivilege	5028	msiexec.exe
Token: SeLoadDriverPrivilege	5028	msiexec.exe
Token: SeSystemProfilePrivilege	5028	msiexec.exe
Token: SeSystemtimePrivilege	5028	msiexec.exe
Token: SeProfSingleProcessPrivilege	5028	msiexec.exe
Token: SeIncBasePriorityPrivilege	5028	msiexec.exe
Token: SeCreatePagefilePrivilege	5028	msiexec.exe
Token: SeCreatePermanentPrivilege	5028	msiexec.exe
Token: SeBackupPrivilege	5028	msiexec.exe
Token: SeRestorePrivilege	5028	msiexec.exe
Token: SeShutdownPrivilege	5028	msiexec.exe
Token: SeDebugPrivilege	5028	msiexec.exe
Token: SeAuditPrivilege	5028	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5028	msiexec.exe
Token: SeChangeNotifyPrivilege	5028	msiexec.exe
Token: SeRemoteShutdownPrivilege	5028	msiexec.exe
Token: SeUndockPrivilege	5028	msiexec.exe
Token: SeSyncAgentPrivilege	5028	msiexec.exe
Token: SeEnableDelegationPrivilege	5028	msiexec.exe
Token: SeManageVolumePrivilege	5028	msiexec.exe
Token: SeImpersonatePrivilege	5028	msiexec.exe
Token: SeCreateGlobalPrivilege	5028	msiexec.exe
Token: SeCreateTokenPrivilege	5028	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5028	msiexec.exe
Token: SeLockMemoryPrivilege	5028	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5028	msiexec.exe
Token: SeMachineAccountPrivilege	5028	msiexec.exe
Token: SeTcbPrivilege	5028	msiexec.exe
Token: SeSecurityPrivilege	5028	msiexec.exe
Token: SeTakeOwnershipPrivilege	5028	msiexec.exe
Token: SeLoadDriverPrivilege	5028	msiexec.exe
Token: SeSystemProfilePrivilege	5028	msiexec.exe
Token: SeSystemtimePrivilege	5028	msiexec.exe
Token: SeProfSingleProcessPrivilege	5028	msiexec.exe
Token: SeIncBasePriorityPrivilege	5028	msiexec.exe
Token: SeCreatePagefilePrivilege	5028	msiexec.exe
Token: SeCreatePermanentPrivilege	5028	msiexec.exe
Token: SeBackupPrivilege	5028	msiexec.exe
Token: SeRestorePrivilege	5028	msiexec.exe
Token: SeShutdownPrivilege	5028	msiexec.exe
Token: SeDebugPrivilege	5028	msiexec.exe
Token: SeAuditPrivilege	5028	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5028	msiexec.exe
Token: SeChangeNotifyPrivilege	5028	msiexec.exe
Token: SeRemoteShutdownPrivilege	5028	msiexec.exe
Token: SeUndockPrivilege	5028	msiexec.exe
Token: SeSyncAgentPrivilege	5028	msiexec.exe
Token: SeEnableDelegationPrivilege	5028	msiexec.exe
Token: SeManageVolumePrivilege	5028	msiexec.exe
Token: SeImpersonatePrivilege	5028	msiexec.exe
Token: SeCreateGlobalPrivilege	5028	msiexec.exe
Token: SeCreateTokenPrivilege	5028	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5028	msiexec.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
5028	msiexec.exe
5028	msiexec.exe
5576	ScreenConnect.WindowsClient.exe
5576	ScreenConnect.WindowsClient.exe
5576	ScreenConnect.WindowsClient.exe
5576	ScreenConnect.WindowsClient.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
5576	ScreenConnect.WindowsClient.exe
5576	ScreenConnect.WindowsClient.exe
5576	ScreenConnect.WindowsClient.exe
5576	ScreenConnect.WindowsClient.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4324 wrote to memory of 5028	4324	ScreenConnect.ClientSetup.exe	80
PID 3600 wrote to memory of 4836	3600	msiexec.exe	82
PID 4836 wrote to memory of 3908	4836	MsiExec.exe	83
PID 3600 wrote to memory of 1780	3600	msiexec.exe	87
PID 3600 wrote to memory of 1916	3600	msiexec.exe	89
PID 3600 wrote to memory of 1292	3600	msiexec.exe	90
PID 5908 wrote to memory of 2524	5908	ScreenConnect.ClientService.exe	92
PID 5908 wrote to memory of 4116	5908	ScreenConnect.ClientService.exe	93
PID 5908 wrote to memory of 5544	5908	ScreenConnect.ClientService.exe	95
PID 5544 wrote to memory of 1224	5544	ScreenConnect.ClientSetup.exe	96
PID 3600 wrote to memory of 4012	3600	msiexec.exe	97
PID 4012 wrote to memory of 1716	4012	MsiExec.exe	98
PID 2004 wrote to memory of 5576	2004	ScreenConnect.ClientService.exe	100
PID 2004 wrote to memory of 5212	2004	ScreenConnect.ClientService.exe	101

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\ScreenConnect.ClientSetup.exe
"C:\Users\Admin\AppData\Local\Temp\ScreenConnect.ClientSetup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4324
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\25.2.4.9229\39421e627e08cafb\ScreenConnect.ClientSetup.msi"
  2⤵
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:5028

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Boot or Logon Autostart Execution: Authentication Package
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3600
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding DC890BF500DC62BE180E3C30C7B1B63D C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4836
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI7F2E.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240680921 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:3908
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:1780
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 6DCF8AE06791BDCD1C1586B5F8E2E124
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1916
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding B67BF70C7C33280136A63AC72252DDC4 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:1292
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 2D870E07C5485BF0BE9A2BF958685637 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4012
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIEC52.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240708718 12 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    - Loads dropped DLL
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:1716

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:2432

C:\Program Files (x86)\ScreenConnect Client (39421e627e08cafb)\ScreenConnect.ClientService.exe
"C:\Program Files (x86)\ScreenConnect Client (39421e627e08cafb)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=instance-xycqcn-relay.screenconnect.com&p=443&s=e6b0ff64-4ca5-4803-84ef-e48f7c7744f8&k=BgIAAACkAABSU0ExAAgAAAEAAQB1IawkQzBkg%2bceM9b5%2fPOoVW3B1dUNedHTLVT%2bZj7AWCzz9COdP2mnEZNYPJ7oZtuae%2bvzLHzsjzEHBCx0s6U2LwS%2fWeOTMI357Qt8yYhJ2vCXboy%2f4AY%2b%2fxT5GweJKTrYHpKShbfmc3y9yEYyF7ja7jHMZM3APTZZgJt9ocVGTLSl3ExKhd68Kn%2f97I08HGp9UHYQmnuFD0NxTTqbZ2pDaLIJU9mmSf8y5lw8CUcoi52DkWJErTagucyrJM3I6vzIIpR%2bvOZPtdHW8iI%2ffWAXm%2bUG%2fltQLNezCE3i4DT8krC%2btvEbD4lw9sg%2bMfaTrKVGF%2bIErHHDmciSxoyAf4ai"
1⤵
- Sets service image path in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5908
- C:\Program Files (x86)\ScreenConnect Client (39421e627e08cafb)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (39421e627e08cafb)\ScreenConnect.WindowsClient.exe" "RunRole" "5cc3f67c-c178-4985-813c-143d011430cf" "User"
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Program Files (x86)\ScreenConnect Client (39421e627e08cafb)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (39421e627e08cafb)\ScreenConnect.WindowsClient.exe" "RunRole" "c622b7a5-3ccb-40b7-9fba-03df5e8b8003" "System"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  PID:4116
- C:\Windows\SystemTemp\ScreenConnect\25.2.4.9229\ScreenConnect.ClientSetup.exe
  "C:\Windows\SystemTemp\ScreenConnect\25.2.4.9229\ScreenConnect.ClientSetup.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious use of WriteProcessMemory
  PID:5544
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Windows\SystemTemp\ScreenConnect\26.6.5.9742\39421e627e08cafb\ScreenConnect.ClientSetup.msi" SC_EXE_PATH="C:\Windows\SystemTemp\ScreenConnect\25.2.4.9229\ScreenConnect.ClientSetup.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:1224

C:\Program Files (x86)\ScreenConnect Client (39421e627e08cafb)\ScreenConnect.ClientService.exe
"C:\Program Files (x86)\ScreenConnect Client (39421e627e08cafb)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=instance-xycqcn-relay.screenconnect.com&p=443&s=e6b0ff64-4ca5-4803-84ef-e48f7c7744f8&k=BgIAAACkAABSU0ExAAgAAAEAAQB1IawkQzBkg%2bceM9b5%2fPOoVW3B1dUNedHTLVT%2bZj7AWCzz9COdP2mnEZNYPJ7oZtuae%2bvzLHzsjzEHBCx0s6U2LwS%2fWeOTMI357Qt8yYhJ2vCXboy%2f4AY%2b%2fxT5GweJKTrYHpKShbfmc3y9yEYyF7ja7jHMZM3APTZZgJt9ocVGTLSl3ExKhd68Kn%2f97I08HGp9UHYQmnuFD0NxTTqbZ2pDaLIJU9mmSf8y5lw8CUcoi52DkWJErTagucyrJM3I6vzIIpR%2bvOZPtdHW8iI%2ffWAXm%2bUG%2fltQLNezCE3i4DT8krC%2btvEbD4lw9sg%2bMfaTrKVGF%2bIErHHDmciSxoyAf4ai&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAA9v26Kue0%2bEOJbImEv2UqmAAAAAACAAAAAAAQZgAAAAEAACAAAACH62CTf2cwV70ZewoRRxzGTDHxqQW47MXoXG%2bop2THPwAAAAAOgAAAAAIAACAAAADY3q0utBhk4W6PTCH1RlJPKY5aEtxBGEt9wPY%2f1Q9nhaAEAAADDZNb0jAEuOcKgHw2ubwtwibB5Dy5AkatHhs8om30ZKST1iqO9kDUBtOmXVHzAOK0D1GRTD9flGvjNkLkM740EvUY8%2bHjhbCwjSjAr6GciJb8QSlUNsrOu2vSkjrc07A1sbzPU1eWJjmukwOdLsRaGKQMJBhjOURmgA4%2bLLS5y0Ghrvo2XLEi7%2bBFus3J4L7XHcbezTiZCfuphPoIPrd5O7CT63kYsBKlunAZ2Bsiw7GOWzZ%2bmo9rQIEPaeq7uHXejyIjTzNIpFNQgfleAeXxrqrKY2heGmnTd5cPgJJ3%2f7RGr4rlKUL73I52gJrITt%2fosLf05lSi%2b5GPLQ%2fNsvfGad4ByyeWmXKUPPAvPKQYLr8SSgq8AwbcQyPIJKiLsRb4luQ09QRiY%2bwDnQss2O8NxyzCGoTFiSqz1EJ6yvq0Th2OQYRnelMjRgFBOgG9Z60%2b%2bezgdQq1k%2fN9zzizW3G6V5LC8vWt7i27xbQFy8HVbIA9qPRXk3J%2bgLOOFhdvu5wB%2bhcGzvIpMY6rHQkI6OctNUVzIHsvE24bfZ8biXLUg7WjaSN0F%2fs6uhTpBvlEQungkFcY8xPEwzyr2gAk%2fQj5sB0PgpZxdVc61pPQcryygH80kkK9vFrx6RE0%2bMo0TVat%2fvkmbPKKGGsXHddW1S4zHccjPcIgas8kYJ7GcBgEhJUh%2bZsuE7iPUukXoZ75%2bF7qxEPIBGPVDmxEImqO0hyPSgdWEQXoKAeYRyeTxI3DWy8Z18hHjKxC24S5%2fdktFCx0iOZfIjDmEAlKHTFOFRtUpgCHtUG44taoZ7otuQ%2fDknUnTcTsk0ni1MLzE3MFSCRby3d9kxtznvTyOGJhRHsZYPJPhXEN88BId0nWv0eny2LudzgLgAjJbxdGMvMVXvIF9togZ%2bufLqwTr%2bGotxd4UKYpEPdXn%2bm1RO%2fQqBi1pVB6L16WqRJphD2Eet1t0UI4WUcE259JM916fPuXLw4hV%2f%2b1jrH1I86CiDzS3Z8i2JWAZQulJ%2bp4QvBWr5BbWAquYDBtJnHDvIPGZ%2bLqnD4lyf1fUq1wdHu9Th55z50psrn7myNwJAf3e4ny07SawCGgv3ArkUGDrz9s8T439D%2fNG9lalvfNaw8l1f1CHMxwZNnoGDPgEIngTfAacZt5jSIqGzNEL9zbtBrJuqnEYHyxa8m94E7ny%2b8MlfUgH0BmhgqOMbwZSdKD453saA1oGiiN636TXL2KiryMGhK7jp%2bv3zXXZ5WwShyc%2b78lNr8xZRJD%2f7TMJVovtohyFNwVe5nhHMQhaDuwsu5ZZSWjT4W4SDlbimWXL4fDQrIx9zpDlbLx3pzuGyCdYKHdZclCgNLHk%2bfV05Bh2Gvutbev%2fMFPNfFHnya31UbGhwiXHX6kJM5QKcy6CA3T0Eb7cCYxOwgE8ANpEKOpEZRGo7UGMBMfHGj6MToXG%2fFgIrr%2bXaqNHG9tYTnG1kWkU0SQwea0EWgQDw%2fxed04O4JkbogPWV1dRVHLAfz0NA9jTqF97BkPTa0TgReii4Y1J6R8xioeBi7V6FDHwaekI%2fyS0Flhu5vA62wyy7ux%2bZ8ZnT8SioD%2bXEAAAACX4BBIGy39j%2ffhw91%2f4nxsAroXrm0IwbfhJPAH9gFg3xdhA%2fCX2WRmDVn3hLA8gVfGDqKcHi42HlPwKt6ZMHrC"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Program Files (x86)\ScreenConnect Client (39421e627e08cafb)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (39421e627e08cafb)\ScreenConnect.WindowsClient.exe" "RunRole" "5f6f35de-cea2-4eb3-adb0-562cda299218" "User"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:5576
- C:\Program Files (x86)\ScreenConnect Client (39421e627e08cafb)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (39421e627e08cafb)\ScreenConnect.WindowsClient.exe" "RunRole" "51960775-d501-442f-9882-de99012d41a3" "System"
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  PID:5212

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e58b4b6.rbs

Path C:\Config.Msi\e58b4b6.rbs
Size 214KB
SHA256 47d2bf4054d564eb9874b3cc41686f6f2ae0463c81e82dc50759ffd36583c351
MD5 c16e3105553c293fc6de072639ee3248
SHA1 c800e45225dad0203b5416d24f5318a6e30e7682
SHA512 66fdac36161082a74e82bddcbaf2ad0bccd46ca3a0b0c5a39225d297e1de316150f7b3a02dc7a59ddeac51ce7b29a81203a8aa06356eaa6c5c9b94e16a0492bc
SSDEEP 3072:LM9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMGL:LMuH2aCGw1ST1wQLdqvL
TLSH
T179248D227490807EE7FA1A32D93F9A717E3DF6641760C59E83848C1E5D604C06BF6B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58b4bd.rbs

Path C:\Config.Msi\e58b4bd.rbs
Size 18KB
SHA256 837a10c23d23c78593ffc74d92486dce21d45b55e5018bb2db827de5608dcd19
MD5 97442048c00fc839ce0c58622598d53e
SHA1 dad3e020512ded536733b88d4ccf20c842d32e2e
SHA512 388b692f0f6f5268c5f7398e9ea42425571fdd04fc9cd9bd3a174d107c774c46a3559e282e9a5f3b537d449bcee8350cc897b77ca02844b04363eca39595790b
SSDEEP 192:tMRAhMRVhKg9S4xdA/3RTnM9ZGSqybL0X0g5PKX4lWqHp:tMRAaRVIBQtqyOHp
TLSH
T1519202536344A1E2E6921F31EA530F263F339EE45311429F51AC953C8DB2BC92BBD5CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58b4cf.rbs

Path C:\Config.Msi\e58b4cf.rbs
Size 214KB
SHA256 1c8e46422847b2a5300203b65c37d59cd92d400b334aefc6778f0c25e479e82c
MD5 8ae5c531aca2aa25bfefd8e9f280e8a7
SHA1 30c961d0a1e962c3463e2a3f38f2590f5a294ee4
SHA512 d4b55ed6ef004b415c7be324fe2f00916d988fc83b5fed0af75d134cc05b53ff5363034f42abe4f257720ed70fa3df738ac6125c719c50c05e725b6e5c722fa0
SSDEEP 3072:3M9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMGO:3MuH2aCGw1ST1wQLdqvO
TLSH
T102248C227484807EE7FA1A32DA3FD6617E7DF6640760C59E83888C1E5D604C06BF6B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.en-US.resources

Path C:\Program Files (x86)\ScreenConnect Client (39421e627e08cafb)\Client.en-US.resources
Size 48KB
SHA256 6a000a67799a071883b6e25f86d91c2c513aae0b34b3643be77e5b889335fb95
MD5 12868948cb5f1d8aafda0fece898c59c
SHA1 0283e03200016208bccb56a5bce70ca4c4d30e26
SHA512 8d44dd88ee5fbe631ce64387c0bc03bfd1ae4cfe360954cd9af98d61fd3e26a849e66e586055adde3d7d3eae18a2ac21a0aaf7cbedb2590ad4911552fddea1f3
SSDEEP 1536:p1Oa22xQvG6Hk6+BilJi41sJkF0Z9UwYLDhYKS1BrJKekmrg9:p1Oa22xQJHk6+BilJi41sJkF0Z9UwYL7
TLSH
T16B331D1277FD1A18F5F36F45BE7A94619937BC6A2E25C06F1028815E09B2F80C9B2773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.resources

Path C:\Program Files (x86)\ScreenConnect Client (39421e627e08cafb)\Client.resources
Size 28KB
SHA256 95b299c8c163731707e8134946059a28c668c2b65b48f57eac2847dbe4beb63e
MD5 ed9f87bcf99cda39c847a5ebe755a4b9
SHA1 c7cd54935424494b50f132e016d448ecac6b58c3
SHA512 ef4194b7d0173056953e0a94544108b6c3634c1e0a6088a481fd663ad4d34db1f219d9f4cdb82c7116911c4d360cc6d2d9bb4fa57db9d4af68ab65abadba1ad1
SSDEEP 768:Mcfv39mCOVPZrXgTf6vEVm6zjpGYUElerG49:PfP4COVPZrXgTf6v0fzNGqn49
TLSH
T1CFD2E0CE33BAECADE67E6F7E39D94070123B6F022C625212B8061415243748D2B68F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll

Path C:\Program Files (x86)\ScreenConnect Client (39421e627e08cafb)\ScreenConnect.Client.dll
Size 192KB
SHA256 6526705b685c2f221a6675118c73cba98c47d948169d81ea4544c3e3336b8f2b
MD5 7ee2543520d72fd54827f3d11a21ef8d
SHA1 7aca9192a475179f4df8752ecd7eda05948dc6f4
SHA512 a0c65c11ce979cd4142439b64bb5e029a8bde9f2584d51de0231ea6a88aae960e00f3097b1e51847496824a1a76baa99f9fbacb67565704b262c5483bee5b91a
SSDEEP 3072:FxLtNGBlIyS7/OvjusqVFJRJcyzvYqSmzDvJXYA:ftNGBGySavqPJYnqSmG
TLSH
T122144B8633A94E36DA9F5D73B46060358AB5ED066023E3EE5E04F9F61A733408E553E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Program Files (x86)\ScreenConnect Client (39421e627e08cafb)\ScreenConnect.ClientService.dll
Size 66KB
SHA256 319ba24115e64ea4b714caf4e88d3d5a658defd51d714c2291b9758466925281
MD5 5d4be679ad5c4bfb5144f381d3308ab3
SHA1 27d351219ad62fc914c6c34eed8373fee6de294d
SHA512 e9b07fc27078bb8c706f970120304b816ad5c0eb5a967371f76de42edd397b5b6b5faf9645eed707584a1e1175406958a8daf4b65d20c2cf7aadaddaff1166c9
SSDEEP 768:c3gaRdcdsmzKWOWXlhh6Eg/6QhvoTVcV7K0c4RelfyQFVFlCtskxZgVfS8EX8bED:tCsKWOGmEgLhvoTVF0JJQFVFlPasbg
TLSH
T1B0633B06E3F98A7BC9DF5F7878B5B0450EB08A02E062FB989CC9A5D71B537C119053A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Program Files (x86)\ScreenConnect Client (39421e627e08cafb)\ScreenConnect.ClientService.exe
Size 93KB
SHA256 f048400c23add8c75abe189393d33c873c02c74eeaf43d47b950c8d643763b35
MD5 752d5cdda2a1d93d27e38f98a5d23fc2
SHA1 d4fd4ff0709271323b8d401579270e6567b6e360
SHA512 f48a21229a8d8cc80371e9aeeb47bb10ff0f3b0363e854ca30db833c74519d37ee21349fa9201c7ed5392ddf5d0ff2a66d250821d109dc0ac7425ab2a5a3fea2
SSDEEP 1536:wg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgUU0HMQ7oOgU:ZhbNDxZGXfdHrX7rAc6myJkgUU0HvMU
TLSH
T1E8935B13B5C28872D473093158E0DAB49A3FF9215E61DEAB3798022E4F741C1AE75EB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Program Files (x86)\ScreenConnect Client (39421e627e08cafb)\ScreenConnect.ClientService.exe
Size 93KB
SHA256 5956f9afb3ba610c38b2cfda88dd15be98783963769a12020c93ce05e749b3c3
MD5 1973034f7b83f666cbd3264bade6e6e5
SHA1 51340eee61b2b3df88bc48060104a32c0f101b4b
SHA512 8a28d7a5e347fe7d7d9977b74eaaaa6ac03ac615ed236235a28d2edb5d2f123945c98b8ea5b7713d3e4d034db580fd530b82c40c98162a7bcb259c2c8b384243
SSDEEP 1536:Lg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgoU0HMB7R:EhbNDxZGXfdHrX7rAc6myJkgoU0Hk1
TLSH
T12B935B13B5C28872D473193158E0DAB09A3FF9615E21DEAB3788022E4F742C1AE75E77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsAuthenticationPackage.dll

Path C:\Program Files (x86)\ScreenConnect Client (39421e627e08cafb)\ScreenConnect.WindowsAuthenticationPackage.dll
Size 254KB
SHA256 a5b8f0070201e4f26260af6a25941ea38bd7042aefd48cd68b9acf951fa99ee5
MD5 5adcb5ae1a1690be69fd22bdf3c2db60
SHA1 09a802b06a4387b0f13bf2cda84f53ca5bdc3785
SHA512 812be742f26d0c42fdde20ab4a02f1b47389f8d1acaa6a5bb3409ba27c64be444ac06d4129981b48fa02d4c06b526cb5006219541b0786f8f37cf2a183a18a73
SSDEEP 3072:qJvChyA4m2zNGvxDd6Q6dtaVNVrlaHpFahvJ9ERnWtMG8Ff2lt9Bgcld5aaYxg:0IvxDdL6d8VNdlC3g0RCXh5D
TLSH
T1C5448E15B7A40CB4EC77823888535A06E776BC160760E6CF03E0825ADF6F7D1A63E762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsBackstageShell.exe

Path C:\Program Files (x86)\ScreenConnect Client (39421e627e08cafb)\ScreenConnect.WindowsBackstageShell.exe
Size 59KB
SHA256 1404090db3128de503ba4d991a960c7c1bc3b910a62d06ecf7e7081a2fcf11b9
MD5 ab9a2c07b3b1222f5ada4cb7c1fd144e
SHA1 22d5e961804073435cd193c1a4b7d3f4c39a64c4
SHA512 909e4e6fb042f30e8e2fccb54b7797410a4c3eb825a2578c679d75d780ba0a06d8a9058ddab66a48a60b3a4a6c4704468826b74fd504cef8b8fc860827707968
SSDEEP 1536:7bHOH2MJv6vmDtyQXIE+TC49IfXWbdS79GT8H:7buH2MJDyQEASSB
TLSH
T115538D4123F80B16D9FF5E39B5E2A5250EB0EA039441E7AE1DCDA5DA0E537806B603F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Program Files (x86)\ScreenConnect Client (39421e627e08cafb)\ScreenConnect.WindowsClient.exe
Size 593KB
SHA256 b80d07610b81bddb3d7f30a207a2e134b559e06b8440598a926f3a9c1d439218
MD5 9562334dd9a47ec1239a8667ddc1f01c
SHA1 b46c4e4694783311e2c612ed7f0ca67a88e1e352
SHA512 a4207d106c5253777dc1eb49d644e2f7ba5ab4e6b64bad1f072c4fcd97df38e76b86986a8a7d7441c0c7cedb2e041044c7f9b36f892c9f48836a8db2d22e8500
SSDEEP 6144:PTv8K3EAggQ2nqBly89VXvJthenrMd+3OsJwEKbE00QPG5YgRtAcCI2/R4IRtNup:rUKt/sXvJqu+3OsJwrbE00QuHRgNNmAq
TLSH
T1E7D46C2273B88A7BD9BF0779B0F21C2557B0E8436185D78E49A4ACD91D973818D0E3E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Program Files (x86)\ScreenConnect Client (39421e627e08cafb)\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
TLSH
T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsCredentialProvider.dll

Path C:\Program Files (x86)\ScreenConnect Client (39421e627e08cafb)\ScreenConnect.WindowsCredentialProvider.dll
Size 837KB
SHA256 36ad3b4858ee84fd2a73522a9ad25d177f492a65e1cbc6630169dc820dc2b63d
MD5 a81497b417d4f67ea6cab399bd3a71f8
SHA1 5738c90789e62bf046024ceea96cbf2665bccd9d
SHA512 a43dbf305579b193d2897af0bd8cff528ea93b9fb93448b5cc6b43a6763ac16abb0752cf83d9b4ebbfc0a9d92084d12db3c69655f8ff424e53a4baa7fad4b781
SSDEEP 12288:tMYkEC5OqMuIyZiBP+6EEKNPQXnRHb+mZ:tfQ5ZMuIyZiBW61KSXRHb+I
TLSH
T138055B1BE79440BAC0ADC2B5C35BA736BBF6F4864514B28F07D40A227E6BF506B1D784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsFileManager.exe

Path C:\Program Files (x86)\ScreenConnect Client (39421e627e08cafb)\ScreenConnect.WindowsFileManager.exe
Size 79KB
SHA256 13f8cfe4648b807a0cbddd653c75254b60d1951e11e715f4e5a1a2c9ab29360b
MD5 130176db1b368a8290ebda3ce17db7c8
SHA1 5c1ffa4074937594b8fddd76720d7943f4f5ad55
SHA512 8830e75925e71d72c4144f053db5f97e3920ac8d27d4ac04888a10e7648f1f6d90a69a72415a56ea18ac9d49db52334432232f28ee6099e57ba50ea13311aebc
SSDEEP 1536:Mtypl44jzbHI5kLP+VVVVVVVVVVVVVVVVVVVVVVVVVC7Ky7ynD:3rfukLdOyWD
TLSH
T1C683E58235762631DF85C5379492C9B59D366F22133DC5BD2DA2FE3A69F03043A8ADB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.config

Path C:\Program Files (x86)\ScreenConnect Client (39421e627e08cafb)\app.config
Size 781B
SHA256 a93c2dbe39d809966bb24fba67fc5ba800612f78bb21cc9bf4469b67b64bc27d
MD5 976ba6ef7f2633f39845be33ca310f0e
SHA1 9cab66d06dab7c057b1e72fa81df5fc49f36e005
SHA512 88af839677197eb012dc85c33b43054eae2a773f021b4c6801698755df8c2aaa2d2bb54997dcc6159bebd72cb2eb1efb85ddc82c90d896243189411d89f33e8b
TLSH
T1D101922D71C4BE5A16631E32E6234240FDB08D63121674A974EE213BDB71AD517F32D6
MD5 SHA1 SHA512 TLSH

Submit Download

system.config

Path C:\Program Files (x86)\ScreenConnect Client (39421e627e08cafb)\system.config
Size 976B
SHA256 f8cf8a34a5f1650f80c80852a14e864d24a4f566b3230b443dc6809a1dbaae38
MD5 5e7cbaeadefb697ea4da255aa53999f2
SHA1 c93180f0609471fa4ef1d267fb036a6690c769c7
SHA512 bd1dfc817fa65b85dae6f6c9a9d9bd1465a729e9449c75b4ba47b461180420f50cd2ee1e7bfcb3aceccdd63c7310d1de60c0f2143a4eaa6a9d9f1d285decc96b
TLSH
T1BA1110A121843F0607E35D63C6159784BFB76B5B115120C871AE227E7F359AB03C3699
MD5 SHA1 SHA512 TLSH

Submit Download

MSI7F2E.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI7F2E.tmp
Size 1.0MB
SHA256 a45ba86c5d13aa8e814e4cb0860b5b2a39ce9677b0d980947f6fe31676051cb2
MD5 81f945dabc576ca389348a4e7147463f
SHA1 1876786194d49de92fff0b523f0c6280bdf94e22
SHA512 3f72d5a6f482757484b0c06cb5c1e6e018a4051fe43086f77f6ea8e61ee0d08afc0ec96eac5cb01e2d8dfdabe9115d7c277cd87b7ccf9bb02bd8da0e9556504a
SSDEEP 24576:QUUGG4DlIQMi4CJXxCHzCrvPfU8GWng+A2tuHt+pbW/aU0r1d:jG4DlItQ5xJrvPfU8VgJwW/zAd
TLSH
T19D35234832E58439E2A73A320CB6A6B125BC74773670D45FA78B4A1D5FB0AD1DE31327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Deployment.WindowsInstaller.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI7F2E.tmp-\Microsoft.Deployment.WindowsInstaller.dll
Size 172KB
SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
MD5 5ef88919012e4a3d8a1e2955dc8c8d81
SHA1 c0cfb830b8f1d990e3836e0bcc786e7972c9ed62
SHA512 4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684
SSDEEP 3072:FkfZS7FUguxN+77b1W5GR69UgoCaf8TpCnfKlRUjW01Ky4:x+c7b1W4R6joxfQE
TLSH
T14E045B2563FC473ECAEF87B4E2624251E7B2E2E97113DB0DDC8541AA2522780F792753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI7F2E.tmp-\ScreenConnect.Core.dll
Size 538KB
SHA256 b8100e5ab07983cbf82d721cf719576ca3f60e352628dcaabd42d428011fdedf
MD5 1db8b9fa0bdcbfaab807f715c288c19a
SHA1 fde73710ce063bbf1e377c02a1a8615cf4da1c08
SHA512 fc132764026c682e8fac1a97171731d54880c8d95566c486c731c880e750a29875ac208fb4b4dc2897dfc49beb24f77af016d846c78be75df159d3542600eb73
SSDEEP 6144:SfoUrkyyvsbvpSLmwJUoqnoezGMZf1y99tg03Xdedu1h+xE5vce/6OdCatxq/trJ:SfpkywYszKoIzGafzece/6yx/Oek
TLSH
T144C47D9233B48B2FCABF5B7BE42454980770E901F209EB5B1AD6D4BC5F633854E412E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.InstallerActions.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI7F2E.tmp-\ScreenConnect.InstallerActions.dll
Size 11KB
SHA256 c79a22accadb1f8a716669ca68c6d6f4e9a21c0d639e2846f288b60bc8adc770
MD5 454b489378d49d17021b3e85f86ae843
SHA1 8a208ddbcd5609b2a8d2dad34a6894396e806d51
SHA512 24ee8ed25df1d43169e9c762b5e1cbaa1e0150bb07387ac5ebeda6f19b83ecbe38342fe01259ca373bcfccb653ea6533395b88a4bce29aee7354815d5253538b
SSDEEP 192:b8/Qp6lCJuV3j/XtyVNamVNG1YZfCrMmbfHJ7kjvLHbuLd9NEFb5lZ:I/cBJaDXt2NaheUrMmb/FkjvLHbuZslZ
TLSH
T1A132D50077DC533AE8BE0F789EB762910A71FB64A011DF2E18CC91569C36744AEA07B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI7F2E.tmp-\ScreenConnect.Windows.dll
Size 1.6MB
SHA256 da29455a64858fda773319c32c0a6cd40edbe8042ed005aa2befb8a4f0fb0522
MD5 94216eb90ca53fbb175f0ee6adbfb663
SHA1 48038f060a5042ff44a2d9a9be46368ecc8436fd
SHA512 c6c7e2a63eaccc5703acf4cb482a9e441fb6e670a9086d3ade558a597b1fd6c17f5e5b7027d835b80ebf2c071f9442bde466f313ddb8456fe0d3e4db6d53b041
SSDEEP 24576:VDhFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUTHs:VDhJkGYYpT0+TFiH7efP
TLSH
T14B85BD41E2D364F5D46B047888BF571ABA743C040325CAFB97D4AE3A6D33BC09A36796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientSetup.msi

Path C:\Users\Admin\AppData\Local\Temp\ScreenConnect\25.2.4.9229\39421e627e08cafb\ScreenConnect.ClientSetup.msi
Size 9.5MB
SHA256 0a09fcbce1b1b72c25efb87c7ee1990fe41adc555173e74825aa86333e885db6
MD5 75f7c32698f1fe8108ea50a6d5fcf48e
SHA1 766b7a02f5f3c11eff1cc2ec96e7e98a52560409
SHA512 2318de58bd285806d43c73ef1ecfb884a042ab374a2215b505063ba20b1bb1a0f931e298aac0f66b1c5676797812ad87defc857a89a107408cfe1cc03ddbc5bd
SSDEEP 196608:gHxcp9ym3nltDUJViHxcp9ym3aHxcp9ym3RHxcp9ym3XHxcp9ym3:OGplpFGpoGpDGpBGp
TLSH
T1CCA623116BF8D278F1F22A39D876A0B1A5367D119E23D12E2324791E2C75EC0CA63777
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIB5DF.tmp

Path C:\Windows\Installer\MSIB5DF.tmp
Size 202KB
SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
MD5 ba84dd4e0c1408828ccc1de09f585eda
SHA1 e8e10065d479f8f591b9885ea8487bc673301298
SHA512 7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290
SSDEEP 3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
TLSH
T129147C326494803EE7F91A36D93E9A61AE7DF6241760C99EC3848C0E5D604D06BF7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIEC52.tmp

Path C:\Windows\Installer\MSIEC52.tmp
Size 1.1MB
SHA256 400ff5b9a4439339876282909b23c397ffa208f4bcf64460fa2521284acf0b6e
MD5 44c34653e3a134ae0477da3063fd2ba4
SHA1 d1c872aa0b4a098d71153f5a0f526404590e385c
SHA512 63c937dafe933c1b65e9b82c77205788693752ddec6b7f9d6153e89b1242bcee2dc24bd17704b0cd99702a3d0b4ab29e3f312e0399fb9554de413cd736c3fba0
SSDEEP 24576:bUUGGa/LkG02xsOx2sk77KuR0KYFze9qB6qxyp+8lkmhihP:sGa/LW2aOcs47CvFK9DwvNhP
TLSH
T14235231033A54579F2A537714D74B3B139BE75722DB0804E7B8E49B90EA0BC2E9B8723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CustomAction.config

Path C:\Windows\Installer\MSIEC52.tmp-\CustomAction.config
Size 234B
SHA256 7027b69ab6ebc9f3f7d2f6c800793fde2a057b76010d8cfd831cf440371b2b23
MD5 6f52ebea639fd7cefca18d9e5272463e
SHA1 b5e8387c2eb20dd37df8f4a3b9b0e875fa5415e3
SHA512 b5960066430ed40383d39365eadb3688cadadfeca382404924024c908e32c670afabd37ab41ff9e6ac97491a5eb8b55367d7199002bf8569cf545434ab2f271a
TLSH
T18CD0A70405D0FD1B5E231A2337524559FF34B1E290A44408B06F3A130A220CD4757317
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Windows\Installer\MSIEC52.tmp-\ScreenConnect.Core.dll
Size 572KB
SHA256 74f2d225b492eb77a5654bcaafec5162d0c5f72de884daa4c32daf54e2bff3d7
MD5 b759084c5614aacb33fec8faccd0c5ad
SHA1 d9a6c9802092d9ec4e7e9eb0872127d74db4bfd4
SHA512 5fc322836cfbf4cc93ac0b5c4d9a64a68507d372ad0bb731902a50b07bd6fbf0f40fab1a77028cc9c63b0f0f93158f82d274fe7abaa64a01a74b8879213d80ae
SSDEEP 6144:SobZO37pir0uomvrTk8AG2sTwR87HNSxyoiuHiWm9kzKY7vhNS/chwDTax4kzm7c:DZnAuhy7CsJlHiWKPYbhN4A
TLSH
T16AC48D3073A4A776C5AE1B7AE472619103B0F413659AF35B7B85E5F92DC23C88F107A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.InstallerActions.dll

Path C:\Windows\Installer\MSIEC52.tmp-\ScreenConnect.InstallerActions.dll
Size 24KB
SHA256 2022f13b1f562d3cbef3a3926f0370a2de64e57ff281a121f90001a47499a356
MD5 8cc4a6f44f2afd49b9e8810daad0ebf7
SHA1 022165dae77ac02c8b20e43c4aeefe9566f98171
SHA512 491eb66bbcfe521cae8e2c2811fe013b23d6f2787f7075c625987769eb9f92d984615f5c12c9ae21df57f4f25ffe59a3670bb5e9f57934054ce8edf1c36ffdd7
SSDEEP 384:MCazzV1VTsaS8hQlLkmoAEV7NaNeirM0dbMsFkjvZB720Wi2X:FazC9EVMcLv14
TLSH
T1C7B2D620678DE27AF9EA1634B563FBB001B37DB3CCE9DA8565A420153D253E04FB5B06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Windows\Installer\MSIEC52.tmp-\ScreenConnect.Windows.dll
Size 1.7MB
SHA256 93f910f732855000861c1b4e6c55a2dee0a8cbb2172d89c7a2bc99053746c193
MD5 9edc01ae0bafe0a1c610d9c8014ad563
SHA1 5fbf0ba61aaaae5b506d78ca862286a676a61fbf
SHA512 366acaf50cef7626e6644dfd2e8a3c878de533be51f03e4ac205139bcf210615f5a0b0ee40d5fc4fe562eae7ee7d025e45b9ccc3279901ce400578441ba45928
SSDEEP 24576:okFuqFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUw:NFuqJkGYYpT0+TFiH7efP
TLSH
T16085BD41E2C364F5D46B047888BF572ABA743C080365CAFB97D4AE366D33BC09A36756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DefaultIcon

Path C:\Windows\Installer\{6765D5BD-D313-BE5E-4864-73A810568FC1}\DefaultIcon
Size 1KB
SHA256 87bed2d86c91b9f7d19adca1829df20881cbe9cc44638e073684d09c9b7cf11c
MD5 a8b8f09d92363e54230bd83bb6e6f553
SHA1 3c02161fa71951d60533cec49403fd7c199d06f8
SHA512 1c6aeac8a83e3457606f8e52fce03d1afc3cc4f3e50c0dea828a74f8eb95b6751a4b9b6b2196422a421257df17798ed2aef2d37012de7a7d5fccfa7e74677222
TLSH
T1421175DF26906C7DC43D1DB245878A68F8BF4CD914D7A1D370A1103A15602CA43283EE
MD5 SHA1 SHA512 TLSH

Submit Download

o5fafszf.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (39421e627e08cafb)\o5fafszf.newcfg
Size 883B
SHA256 d75c8ce059c6941eed5a6cebeac52e00e00ddb47bb9de4da5be7ba1c97d8b27a
MD5 2e6b150c8580e144db19170d5010f0d1
SHA1 f968818f46084df3589c0875ebf5bca12cd69e65
SHA512 718bdca95ee833ad841af86a6c23299ff6d9427cb5753453eaa14e38031613ad20cc0e82d568be51c112500ab21271725bf2f52ec334efbd5ab110ee6a03033c
TLSH
T17611896872C4AE5A03B72933C6224349FE72169741A530D874AE21375F305DB03E36EB
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (39421e627e08cafb)\user.config
Size 720B
SHA256 44b510f110e3fe29d963663ae3f5b95cc5f13f325bc4741fe562e679204aba24
MD5 63d457e6f2619472568903e837b884d1
SHA1 86d7e8c75abebe573208195e5d2a719c6b592240
SHA512 965478e26c49077b056c78c88a9cc95faa848a76b8d34983ed369f75d996c001df0f6be5ec5b21de77a7215075f2b95a87be7a31fc7a9eb0d0020c10401b70f5
TLSH
T15A0126A532C0AE5B03A36E33C6224349FE7616DB446520D874AE213A5F315DF03A36EE
MD5 SHA1 SHA512 TLSH

Submit Download

wk1tzzca.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (39421e627e08cafb)\wk1tzzca.newcfg
Size 883B
SHA256 daa79f5661f2285d3d5f809fd2ea37980059beabad8736fde0efe6a04fc871b7
MD5 18e83902721ca7ff882ff22a9bfae634
SHA1 b4b6367c02d79a8521de91da77b5df59aa5e73ed
SHA512 7c697deb63fb890d8d832c2a766465928cba311170572a439cb5f573e7a4028c8061a1af0f8114d573e6fecc8a3b3dd7d71847f6f6116b36b7da47b075440caa
TLSH
T1A811896972C4AE5B03B72D33C6224349FE721697416520D874AE21375F305DB03E36EB
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.ClientSetup.exe

Path C:\Windows\SystemTemp\ScreenConnect\25.2.4.9229\ScreenConnect.ClientSetup.exe
Size 14.3MB
SHA256 93e4e9ccc470610216ef958c0c4b7e04c8d03ade3bca699a15b21b527ef56e24
MD5 6d802e0aba2730eec1cdad414c99454e
SHA1 8283c8cb80a2c97bc0d3bb485982848fcfcb55f7
SHA512 b7e59fd42873a4e670c7deb39992ba44241d260a36738ad824bb38dbfa1303b9c73c8e24b3c5f316e4283ca07189705942bbea16c6640ae5ade8e38fde4852bb
SSDEEP 196608:TGufefPRZWiez3I96wZWi2ZWiBZWi6ZWiq:ilgfwgvgYglgR
TLSH
T17FE61211B3E691B5E0BF0734D87A6266A631BC028751C6AF6794BE792D327C09E31373
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientSetup.msi

Path C:\Windows\SystemTemp\ScreenConnect\26.6.5.9742\39421e627e08cafb\ScreenConnect.ClientSetup.msi
Size 11.8MB
SHA256 63cf18ed16cd9a94ca29c8a1ca62e6fe7880e84ce2008b6f2f94ab7687057ffd
MD5 2028e9782962c9655d0f11f84e0e1bc4
SHA1 0be3524afd67c951a726840eb637d27e658a6833
SHA512 6d840ebfde8e0eab901fff6d38186188c5aee02417f2463996b2927c33deb6e401d2449f97ee12212076f430b8ce58a8f63603ac4b38a5937301d2017814ce4c
SSDEEP 98304:5Mn1Giy8E1PqhYG6ztZNK9aNGGMn1Giy8E1Pqh3Mn1Giy8E1Pqh2Mn1Giy8E1Pqk:oZWiez3I96wZWi2ZWiBZWi6ZWi
TLSH
T164C6232117FAC0A8F1B61B71D93C65B5A936BD12D622844F1354BE6E3C32F949A32373
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.6MB
SHA256 40be07c17843ef2e78f38d11179b6cd904dc9e76818b2e50289e0f81d464f60d
MD5 778e14342f349affd74fc3d6b17e16aa
SHA1 f959c2f3650bac220269d697e7f1bff7a394d03c
SHA512 78d20c70efc3e6e9aa3a4a35ae3ced836a89ed58bf7694bd44f58932c84062d665f2920cbfabb9f57146d3bf0d5a4e63ca5945266f21a0bb25ece7789ca39bf0
SSDEEP 24576:72gmSp1VdoO/vvTL2mdeR036/6p2wY5H22eNXJkdkma4Ex5oIGcK7Q3aR:f
TLSH
T11647052436F92210E7F79E3CA8F4AA23893D7D579C15DE8C45411B8D0921BB1E8B2F5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{a5bcfe23-231d-4121-a0a4-b1bbf38ed64e}_OnDiskSnapshotProp

Path \??\Volume{59480a46-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{a5bcfe23-231d-4121-a0a4-b1bbf38ed64e}_OnDiskSnapshotProp
Size 6KB
SHA256 92c86893e355e3fa4779800cb2d8f73da913e803121aebc4b4dd7693c1eaf8a9
MD5 3ebffab66d44d89354720cadf32d610b
SHA1 00a55a4866c8cf6bfab133e44ac49cc1bfe0f23f
SHA512 3293acce636c405f52dd5c49523dfef47fc677c81e81f8db5cd5ce9b39c84d63ecc6d606d548939fdf061a5052c3b6bb5c86f63623f1d71524affb36123002ec
SSDEEP 96:FJHk06vc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:TSb++ZVm
TLSH
T1A9D189085AF54711E2B3AB3129F14557A877B811EF33CB8E0298238E6670910F975F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1716-183-0x0000000004F10000-0x0000000004FA6000-memory.dmp

Download

memory/1716-187-0x0000000005160000-0x0000000005310000-memory.dmp

Download

memory/1716-179-0x0000000004E60000-0x0000000004E6C000-memory.dmp

Download

memory/2004-270-0x0000000003830000-0x000000000384A000-memory.dmp

Download

memory/2004-293-0x0000000003F80000-0x0000000004056000-memory.dmp

Download

memory/2004-271-0x00000000038F0000-0x0000000003986000-memory.dmp

Download

memory/2004-272-0x0000000003B40000-0x0000000003CF0000-memory.dmp

Download

memory/2004-291-0x0000000003AA0000-0x0000000003B0C000-memory.dmp

Download

memory/2004-292-0x0000000003A60000-0x0000000003AA1000-memory.dmp

Download

memory/2524-133-0x0000000002E60000-0x0000000002EA1000-memory.dmp

Download

memory/2524-132-0x0000000002E40000-0x0000000002E58000-memory.dmp

Download

memory/2524-129-0x000000001D4D0000-0x000000001D67C000-memory.dmp

Download

memory/2524-131-0x0000000001500000-0x0000000001518000-memory.dmp

Download

memory/2524-130-0x000000001E8C0000-0x000000001EA48000-memory.dmp

Download

memory/2524-128-0x000000001D290000-0x000000001D31C000-memory.dmp

Download

memory/2524-126-0x0000000000C40000-0x0000000000CD8000-memory.dmp

Download

memory/2524-127-0x0000000002DF0000-0x0000000002E26000-memory.dmp

Download

memory/3908-31-0x0000000002700000-0x000000000272E000-memory.dmp

Download

memory/3908-35-0x0000000002740000-0x000000000274A000-memory.dmp

Download

memory/3908-43-0x0000000004E60000-0x000000000500C000-memory.dmp

Download

memory/3908-39-0x0000000004C20000-0x0000000004CAC000-memory.dmp

Download

memory/4116-135-0x0000000002C50000-0x0000000002C91000-memory.dmp

Download

memory/4324-9-0x0000000005970000-0x0000000005980000-memory.dmp

Download

memory/4324-7-0x0000000005AA0000-0x0000000005C4C000-memory.dmp

Download

memory/4324-1-0x0000000005930000-0x0000000005938000-memory.dmp

Download

memory/4324-3-0x0000000005970000-0x0000000005980000-memory.dmp

Download

memory/4324-0-0x0000000005970000-0x0000000005980000-memory.dmp

Download

memory/4324-2-0x0000000005970000-0x0000000005980000-memory.dmp

Download

memory/4324-8-0x0000000006520000-0x0000000006AC6000-memory.dmp

Download

memory/4324-4-0x0000000005C80000-0x0000000005F72000-memory.dmp

Download

memory/4324-5-0x00000000059F0000-0x0000000005A7C000-memory.dmp

Download

memory/4324-6-0x0000000005A80000-0x0000000005AA2000-memory.dmp

Download

memory/5212-341-0x0000000002800000-0x0000000002841000-memory.dmp

Download

memory/5544-151-0x00000000026F0000-0x0000000002718000-memory.dmp

Download

memory/5544-150-0x0000000004B70000-0x0000000004C06000-memory.dmp

Download

memory/5544-152-0x0000000004CC0000-0x0000000004E70000-memory.dmp

Download

memory/5544-149-0x0000000002650000-0x000000000265C000-memory.dmp

Download

memory/5576-309-0x000000001CC70000-0x000000001CCDC000-memory.dmp

Download

memory/5576-308-0x0000000000990000-0x0000000000A40000-memory.dmp

Download

memory/5576-310-0x000000001D080000-0x000000001D116000-memory.dmp

Download

memory/5576-316-0x0000000001400000-0x000000000141A000-memory.dmp

Download

memory/5576-315-0x000000001D2D0000-0x000000001D480000-memory.dmp

Download

memory/5576-319-0x0000000002B80000-0x0000000002BC1000-memory.dmp

Download

memory/5908-102-0x00000000045A0000-0x0000000004632000-memory.dmp

Download

memory/5908-86-0x0000000004000000-0x0000000004018000-memory.dmp

Download

memory/5908-104-0x0000000004300000-0x0000000004341000-memory.dmp

Download

memory/5908-106-0x0000000004790000-0x0000000004865000-memory.dmp

Download

memory/5908-101-0x00000000042C0000-0x00000000042F6000-memory.dmp

Download

memory/5908-97-0x0000000004270000-0x00000000042C0000-memory.dmp

Download