Overview

overview

8

Static

static

1

ScreenConn...up.exe

windows10-2004-x64

8

ScreenConn...up.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    129s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/11/2026, 18:17

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    ScreenConnect.ClientSetup.exe
  • Size 12.2MB
  • Sample261102-ww55qset5p
  • SHA256 fd29c0c8055e7924802396152c394192fc6f6b1a0a78a6727eb600a6ddf2ea75
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
backdoordiscoveryexecutionpersistenceprivilege_escalationransomwarerat

Malware Config

Signatures

  • Badlisted process makes network request 1 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Sets service image path in registry 3 TTPs 1 IoCs

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence
  • ConnectWise ScreenConnect remote access tool

    ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.

    backdoorrat
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Boot or Logon Autostart Execution: Authentication Package 1 TTPs 2 IoCs

    Suspicious Windows Authentication Registry Modification.

    persistenceprivilege_escalation
  • Drops file in System32 directory 9 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
    execution
  • Drops file in Program Files directory 32 IoCs
  • Drops file in Windows directory 40 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 52 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 51 IoCs
  • Modifies registry class 49 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of SendNotifyMessage 6 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\ScreenConnect.ClientSetup.exe
    "C:\Users\Admin\AppData\Local\Temp\ScreenConnect.ClientSetup.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5872
    • C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\26.7.6.9783\4a274c4b459d3342\ScreenConnect.ClientSetup.msi" SC_EXE_PATH="C:\Users\Admin\AppData\Local\Temp\ScreenConnect.ClientSetup.exe"
      2⤵
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      PID:1308
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Boot or Logon Autostart Execution: Authentication Package
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4844
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 0DF28E723265E9AEA4CFD465D9A41A28 C
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:5372
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI9C84.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240754125 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:4616
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIA10A.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240754984 11 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.CheckMsiMotw
        3⤵
        • Badlisted process makes network request
        • Loads dropped DLL
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        PID:4696
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIAA42.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240757343 18 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.CheckMsiFileName
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:5976
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:1892
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 2CC7FBC6E6EAF960CE7EF23A2D222E31
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1376
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding B4EEA31C06B410614D14614D56EF39CD E Global\MSI0000
        2⤵
        • Drops file in Windows directory
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:5132
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 88D1CC8EE0D6D97218C58D897F76DB5B E Global\MSI0000
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:5940
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSIC46E.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240829671 12 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.TerminateProcesses
          3⤵
          • Drops file in Windows directory
          • Loads dropped DLL
          • Reads the TCP/IP host and domain name from the registry
          • System Location Discovery: System Language Discovery
          PID:2900
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      PID:1036
    • C:\Program Files (x86)\ScreenConnect Client (4a274c4b459d3342)\ScreenConnect.ClientService.exe
      "C:\Program Files (x86)\ScreenConnect Client (4a274c4b459d3342)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=instance-w2k9f7-relay.screenconnect.com&p=443&s=e4cb7231-c14c-4879-aaab-bd726a7a4a0c&k=BgIAAACkAABSU0ExAAgAAAEAAQBt7WlPK5kEXd9i5HijASi5sF7Wo1QEbu7dmhNPwEiMUWI0Aj%2fHzgBKSYxrmT8CJxDhZbVqsmzkULGDZVpeUhETzfuDHMlKqiSFMtlx6izTG7E7imYGHSUZHGyPsvC%2bj824Xw%2bLZNXCHioFDiTelBHnZU5f2IiaCluc2eWp8mFDkB0pNu%2bVceQ5J5rIkjifePtfUIOKFz2cQxKfZq%2fgv7ii%2bIaL%2fbsA0HJwVoKty9XVhdT9yMu8k4hX8F%2fth8w2Z1tjPSLcvfGq8IbpZOPXo%2bdv19yC5RCTIwoTdRDVvlm5ZLAoGHsXkM%2bq%2fexKGh9ef2yWXwsbtF1fJLLzTnKYI7S6&c=DDLSC&c=&c=&c=&c=&c=&c=&c="
      1⤵
      • Sets service image path in registry
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Executes dropped EXE
      • Loads dropped DLL
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:5716
      • C:\Program Files (x86)\ScreenConnect Client (4a274c4b459d3342)\ScreenConnect.WindowsClient.exe
        "C:\Program Files (x86)\ScreenConnect Client (4a274c4b459d3342)\ScreenConnect.WindowsClient.exe" "RunRole" "ac071d7a-f857-4f28-97b6-7ec7814d223c" "User"
        2⤵
        • Executes dropped EXE
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:4152
      • C:\Program Files (x86)\ScreenConnect Client (4a274c4b459d3342)\ScreenConnect.WindowsClient.exe
        "C:\Program Files (x86)\ScreenConnect Client (4a274c4b459d3342)\ScreenConnect.WindowsClient.exe" "RunRole" "85d89014-df54-4755-80de-1088faa29806" "System"
        2⤵
        • Executes dropped EXE
        • Reads the TCP/IP host and domain name from the registry
        • Checks processor information in registry
        • Modifies data under HKEY_USERS
        PID:2228
      • C:\Windows\SysWOW64\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Windows\SystemTemp\ScreenConnect\26.7.6.9783\ScreenConnect.ClientUninstall.vbs"
        2⤵
        • Executes a VBScript file via the Windows Script Host.
        • System Location Discovery: System Language Discovery
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        PID:5672

    Network

          MITRE ATT&CK Enterprise v16

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Command and Scripting Interpreter

          1
          T1059

          Visual Basic

          1
          T1059.005

          Persistence

          Boot or Logon Autostart Execution

          2
          T1547

          Authentication Package

          1
          T1547.002

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Create or Modify System Process

          1
          T1543

          Windows Service

          1
          T1543.003

          Event Triggered Execution

          1
          T1546

          Component Object Model Hijacking

          1
          T1546.015

          Privilege Escalation

          Boot or Logon Autostart Execution

          2
          T1547

          Authentication Package

          1
          T1547.002

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Create or Modify System Process

          1
          T1543

          Windows Service

          1
          T1543.003

          Event Triggered Execution

          1
          T1546

          Component Object Model Hijacking

          1
          T1546.015

          Defense Evasion

          Modify Registry

          1
          T1112

          Credential Access

          Discovery

          Peripheral Device Discovery

          2
          T1120

          Query Registry

          3
          T1012

          System Information Discovery

          4
          T1082

          System Location Discovery

          1
          T1614

          System Language Discovery

          1
          T1614.001

          System Network Configuration Discovery

          1
          T1016

          Lateral Movement

          Collection

          Command and Control

          Exfiltration

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          e59fe7c.rbs
          • Path C:\Config.Msi\e59fe7c.rbs
          • Size 214KB
          • SHA256 6963e70dbe2da86790a37571f345e1c84e249c85e7f64b0ff615ae5bbff00c27
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          e59fe80.rbs
          • Path C:\Config.Msi\e59fe80.rbs
          • Size 18KB
          • SHA256 a3c11cc685e59d0dc58f279e9c298a103b46f5f981030c134829cdf933b6e043
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          e59fe82.rbf
          • Path C:\Config.Msi\e59fe82.rbf
          • Size 71KB
          • SHA256 0f6f89308bfca67a9ea15751125e30f9d3b25bd9c32e3bb99c1102c3f9a1128b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          e59fe83.rbf
          • Path C:\Config.Msi\e59fe83.rbf
          • Size 91KB
          • SHA256 2ebb4c48e5f411d95332996c6c141278c42fafbd44cd226c82fc4a483106050f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Client.en-US.resources
          • Path C:\Program Files (x86)\ScreenConnect Client (4a274c4b459d3342)\Client.en-US.resources
          • Size 65KB
          • SHA256 bd8901dd3666277f6d7aa1f4118ad53f5d4229c5d9f67f94e635bf2add3731dd
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Client.resources
          • Path C:\Program Files (x86)\ScreenConnect Client (4a274c4b459d3342)\Client.resources
          • Size 6KB
          • SHA256 bd34378ad99f7609fa0c7c8edde6337c738a61d288863015629329806a1cc728
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ScreenConnect.Client.dll
          • Path C:\Program Files (x86)\ScreenConnect Client (4a274c4b459d3342)\ScreenConnect.Client.dll
          • Size 413KB
          • SHA256 be1e3522a20c244b3e20b4f7bc2fc736b6103c930d6cf8366e0bb97cb82d5241
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ScreenConnect.ClientService.dll
          • Path C:\Program Files (x86)\ScreenConnect Client (4a274c4b459d3342)\ScreenConnect.ClientService.dll
          • Size 92KB
          • SHA256 67f75a75bc19288cac0071e19e7af4463f2ecf4bb75fe13af80a4f0f57144253
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ScreenConnect.ClientService.exe
          • Path C:\Program Files (x86)\ScreenConnect Client (4a274c4b459d3342)\ScreenConnect.ClientService.exe
          • Size 93KB
          • SHA256 bc19602c59b0ba4a7a99f791c87298df76d8d62f86a928e112dca285a88a5a77
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ScreenConnect.Core.dll
          • Path C:\Program Files (x86)\ScreenConnect Client (4a274c4b459d3342)\ScreenConnect.Core.dll
          • Size 583KB
          • SHA256 91ae86fd5439c7d8a54b75cbb60c2ff9bdff84657b962d340d48cdf656c4928d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ScreenConnect.Windows.dll
          • Path C:\Program Files (x86)\ScreenConnect Client (4a274c4b459d3342)\ScreenConnect.Windows.dll
          • Size 1.7MB
          • SHA256 9ddaf17f7f802e58c645d42184e0ac33dc755a885bc3637a7d837a4f6ae5fdea
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ScreenConnect.WindowsAuthenticationPackage.dll
          • Path C:\Program Files (x86)\ScreenConnect Client (4a274c4b459d3342)\ScreenConnect.WindowsAuthenticationPackage.dll
          • Size 254KB
          • SHA256 a5b8f0070201e4f26260af6a25941ea38bd7042aefd48cd68b9acf951fa99ee5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ScreenConnect.WindowsClient.exe
          • Path C:\Program Files (x86)\ScreenConnect Client (4a274c4b459d3342)\ScreenConnect.WindowsClient.exe
          • Size 689KB
          • SHA256 24671116eab5a97c5d15c4d7b434adff9ad2119db9b487490f4b251f28167069
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ScreenConnect.WindowsClient.exe.config
          • Path C:\Program Files (x86)\ScreenConnect Client (4a274c4b459d3342)\ScreenConnect.WindowsClient.exe.config
          • Size 266B
          • SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          ScreenConnect.WindowsCredentialProvider.dll
          • Path C:\Program Files (x86)\ScreenConnect Client (4a274c4b459d3342)\ScreenConnect.WindowsCredentialProvider.dll
          • Size 837KB
          • SHA256 89fd40ccc2e2be1bf140e748212922aa4010a7ef4b0465aca958c9d3417e0bdd
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          system.config
          • Path C:\Program Files (x86)\ScreenConnect Client (4a274c4b459d3342)\system.config
          • Size 966B
          • SHA256 624f3ca1906b0de092fbadbf0e5ab65bfa2b56bce5560f7df46cede9592e3191
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          MSI9C84.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\MSI9C84.tmp
          • Size 1.1MB
          • SHA256 d39e53d74c6840d331b91b9c949db26f7c93a824e9fb104c532346a8c465b6e2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Microsoft.Deployment.WindowsInstaller.dll
          • Path C:\Users\Admin\AppData\Local\Temp\MSI9C84.tmp-\Microsoft.Deployment.WindowsInstaller.dll
          • Size 172KB
          • SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ScreenConnect.Core.dll
          • Path C:\Users\Admin\AppData\Local\Temp\MSI9C84.tmp-\ScreenConnect.Core.dll
          • Size 573KB
          • SHA256 399ab0c1bcf2bf0c7618066d676b6958c2a5f4fed2d8f769f0eeea5492720e4f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ScreenConnect.InstallerActions.dll
          • Path C:\Users\Admin\AppData\Local\Temp\MSI9C84.tmp-\ScreenConnect.InstallerActions.dll
          • Size 24KB
          • SHA256 f35f007dcb154d0346745309630b8cc21fe49638e76dc8dd77a3c62cb0aa754a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ScreenConnect.Windows.dll
          • Path C:\Users\Admin\AppData\Local\Temp\MSI9C84.tmp-\ScreenConnect.Windows.dll
          • Size 1.7MB
          • SHA256 4c281797c351fed77890634006a51bc3a6c60efa4c831fe21934353f304cdf61
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          CustomAction.config
          • Path C:\Users\Admin\AppData\Local\Temp\MSIA10A.tmp-\CustomAction.config
          • Size 234B
          • SHA256 7027b69ab6ebc9f3f7d2f6c800793fde2a057b76010d8cfd831cf440371b2b23
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          ScreenConnect.WindowsInstaller.dll
          • Path C:\Users\Admin\AppData\Local\Temp\MSIA10A.tmp-\ScreenConnect.WindowsInstaller.dll
          • Size 137KB
          • SHA256 7fcba418fd772a38e420238d49e8301f23caf47eadcef400ecab8738813d9694
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ScreenConnect.ClientSetup.msi
          • Path C:\Users\Admin\AppData\Local\Temp\ScreenConnect\26.7.6.9783\4a274c4b459d3342\ScreenConnect.ClientSetup.msi
          • Size 9.8MB
          • SHA256 68c31d1a298eec1237bd7445a3eb7a02a22ed0ffa55e0b68f31f2837f1c69213
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MSI580.tmp
          • Path C:\Windows\Installer\MSI580.tmp
          • Size 202KB
          • SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Microsoft.Deployment.Compression.Cab.dll
          • Path C:\Windows\Installer\MSIC46E.tmp-\Microsoft.Deployment.Compression.Cab.dll
          • Size 48KB
          • SHA256 9d32032109ffc217b7dc49390bd01a067a49883843459356ebfb4d29ba696bf8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Microsoft.Deployment.Compression.dll
          • Path C:\Windows\Installer\MSIC46E.tmp-\Microsoft.Deployment.Compression.dll
          • Size 36KB
          • SHA256 e04de7988a2a39931831977fa22d2a4c39cf3f70211b77b618cae9243170f1a7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Microsoft.Deployment.WindowsInstaller.Package.dll
          • Path C:\Windows\Installer\MSIC46E.tmp-\Microsoft.Deployment.WindowsInstaller.Package.dll
          • Size 56KB
          • SHA256 548c551f6ebc5d829158a1e9ad1948d301d7c921906c3d8d6b6d69925fc624a1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          a0foafvb.newcfg
          • Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (4a274c4b459d3342)\a0foafvb.newcfg
          • Size 883B
          • SHA256 30c9ceb67cff39c51aa965d09996aec356b8008e041d4b4fb8723bd8997b130f
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          hglf04zg.newcfg
          • Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (4a274c4b459d3342)\hglf04zg.newcfg
          • Size 683B
          • SHA256 70af1fefa08c4b57ba4c70361bb2157d74e471a793dfa93d16f2697937543a9f
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          user.config
          • Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (4a274c4b459d3342)\user.config
          • Size 520B
          • SHA256 b012e6211a834d80955b53b2192df8933fe511672475b487439d386bcab54b59
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          ScreenConnect.ClientUninstall.vbs
          • Path C:\Windows\SystemTemp\ScreenConnect\26.7.6.9783\ScreenConnect.ClientUninstall.vbs
          • Size 533B
          • SHA256 6c04d3f3a7c74ecc4a5a73f89e3b8a74c9c4aef202df98139b209213a3a8e7a3
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          memory/2900-258-0x0000000005520000-0x0000000005586000-memory.dmp
          Download

          memory/4152-226-0x000000001C3B0000-0x000000001C538000-memory.dmp
          Download

          memory/4152-219-0x0000000000DA0000-0x0000000000E50000-memory.dmp
          Download

          memory/4152-220-0x000000001BA10000-0x000000001BA7C000-memory.dmp
          Download

          memory/4152-221-0x000000001BE20000-0x000000001BEB6000-memory.dmp
          Download

          memory/4152-224-0x000000001C070000-0x000000001C220000-memory.dmp
          Download

          memory/4152-225-0x0000000003090000-0x00000000030AA000-memory.dmp
          Download

          memory/4616-33-0x0000000003F10000-0x0000000003F3E000-memory.dmp
          Download

          memory/4616-45-0x00000000062B0000-0x0000000006460000-memory.dmp
          Download

          memory/4616-41-0x0000000006020000-0x00000000060B6000-memory.dmp
          Download

          memory/4616-37-0x0000000003EF0000-0x0000000003EFC000-memory.dmp
          Download

          memory/4696-75-0x0000000003340000-0x0000000003368000-memory.dmp
          Download

          memory/5716-197-0x0000000003F80000-0x0000000004012000-memory.dmp
          Download

          memory/5716-199-0x0000000003C30000-0x0000000003C71000-memory.dmp
          Download

          memory/5716-196-0x0000000003CA0000-0x0000000003D0C000-memory.dmp
          Download

          memory/5716-201-0x0000000004170000-0x0000000004246000-memory.dmp
          Download

          memory/5716-175-0x0000000003BE0000-0x0000000003C30000-memory.dmp
          Download

          memory/5716-162-0x0000000003D30000-0x0000000003EE0000-memory.dmp
          Download

          memory/5716-158-0x0000000003AE0000-0x0000000003B76000-memory.dmp
          Download

          memory/5716-152-0x0000000001430000-0x000000000144A000-memory.dmp
          Download

          memory/5872-0-0x0000000074A02000-0x0000000074A03000-memory.dmp
          Download

          memory/5872-13-0x00000000749F0000-0x00000000751AC000-memory.dmp
          Download

          memory/5872-11-0x00000000749F0000-0x00000000751AC000-memory.dmp
          Download

          memory/5872-9-0x0000000006030000-0x00000000065EA000-memory.dmp
          Download

          memory/5872-7-0x00000000058C0000-0x0000000005A70000-memory.dmp
          Download

          memory/5872-8-0x00000000749F0000-0x00000000751AC000-memory.dmp
          Download

          memory/5872-6-0x0000000005800000-0x0000000005828000-memory.dmp
          Download

          memory/5872-5-0x00000000749F0000-0x00000000751AC000-memory.dmp
          Download

          memory/5872-4-0x00000000749F0000-0x00000000751AC000-memory.dmp
          Download

          memory/5872-3-0x0000000005760000-0x00000000057F6000-memory.dmp
          Download

          memory/5872-2-0x0000000001940000-0x000000000194C000-memory.dmp
          Download

          memory/5872-1-0x0000000001900000-0x0000000001908000-memory.dmp
          Download