4e9f935612a8f60fafd3aff6815e75465b50a51ea6fd81813acb485d04416284

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/11/2026, 12:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ScreenConnect.ClientSetup.msi
Size 9.8MB
Sample261113-pc26eaad75
SHA256 4e9f935612a8f60fafd3aff6815e75465b50a51ea6fd81813acb485d04416284
MD5 a8b5cffe23b44b060e4b0c8dbad5b1db
SHA1 f60d1c752f54d5e151a6515898c60e017fbfb6a9
SHA512 e6962ce2d621c69f5f23e2e370b0f4669ea1f44f3b01c99e2d193d1ff948ed11edb2a6c6bb98cf973ac820525af783aac5a444b0354c6a6448e4f871f496f85c
SSDEEP 196608:IMOo/K6Sdr3t+iCFKpj10qMOo/K6Sdr3t+MOo/K6Sdr3tnMOo/K6Sdr3t:IyK6cc1K70qyK6cUyK6cJyK6c
TLSH
T194A6232027F99129F1FA0739EE3992B529767D109B23D06F53693D0E1A71E40D7A23B3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

backdoor discovery persistence privilege_escalation ransomware rat

Malware Config

Signatures

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	3160	msiexec.exe
7	3160	msiexec.exe
14	3884	rundll32.exe

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (83c98c656a2e2ef3)\ImagePath = "\"C:\\Program Files (x86)\\ScreenConnect Client (83c98c656a2e2ef3)\\ScreenConnect.ClientService.exe\" \"?e=Access&y=Guest&h=instance-ghwuiv-relay.screenconnect.com&p=443&s=92d8a2d0-0f62-4ada-b4d3-b7c18fc18e3f&k=BgIAAACkAABSU0ExAAgAAAEAAQDthRgStADE4nkAIOjEw3RohOwqXwivcvDf3vcVGYaZFCWXPdC4%2f7E1xIObDPfFr9xQu9HAh%2b3K2E%2fmIGV7j1JJZpN65Lq262Z2Hfmq162uRF91XJsWVOFPFbbWieceENCqlPA4yaHOotRttTj9Pw1hXs%2fsUHMg3jSI0LRC344B8sKU5t3NbjZjWRAdxcylWoeaKrJr0Ik2hoTjIT0Tjq1yr699Do3q3EPoteIEj0gvDJ07uzklmMR7fGZuSA%2fHW3MNh1gdcRDJysAs2J7LRE9BOACGuo5SohILBIroG5yLd0K3sRWme5RSzgYKW%2fZ9znVlEaqaosQ9%2bTxllUNK1YWu&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAALm8Ant7Wk0CkQYJlewX1egAAAAACAAAAAAAQZgAAAAEAACAAAAAhrLgaNn1DO35XtejD9yX2BxFDy0u5Tv4NgoesgDtTxAAAAAAOgAAAAAIAACAAAADtS7ODTl4sXTCYB2kzEHMoeqE4YCwE%2bxRAjkvrju4K0KAEAACT2Y8mnsFHxVySaGWtN9UW0H9c7QnyVPFOG9TbUU7s5pO9KFffjMqM8eEx2ILfzXm5gJKPC6CoOziTOHOkx89xo7gHLo0HvdMZRaQoOBtG%2f0DqS%2femHdc6C9VVME540Tpl%2bu2Rx1BDboxJOy0Z8lIP4D2vHABGTo2ih0HuPoKjpzE5slgmNbUw1QKG9U50FjYKP1y1uGc5wvT%2bskmz8x62s%2ftMa3xrACdNMz6YTuFCN%2bEBYn1yShriwjJfKPuNfK97goWevakHiafYl0J0B0OeHCqAix8YFisb%2f%2b8CouBc9aB2w9PWLzJNECTjDogTquYK4go2KuyPovqJXNmkGyqbGRB434VK%2fjWQF%2fCvYrjXghTftBkA3JUH%2btn2lWvI4D4L%2fVK7hh3SYXsJSM%2fusuiSuhlYpWM7FKvhQNi7zFaaSmyxQXYcywNtwhQlyFR8NVEiu3mdBrFXqjFt9TCGvVc7XYllsdIcS05hRAmR8N3LyuSIzUprtG2BA3AQBfCZ3GXvSK1hmDuEl05CJKIzJLw6lsCOQ7zn9mSvaqxUSzAv3GGnXlWO8PQ94hrfnBXK7gDDlDhW4bb77vnnQxAePjiYriyPW5KzMcGogfao4i1NS6XYslN6pDezZP7CLq8DKmOF2KZELA3NVAWfg%2b%2fNPxfl63Q6nxUpVXcL8yIRp1m6hbjCQYdFgR8yF40UQq%2fBztH2luypJGgBBXwNUXyhcs1MN8omsL7An6d8AbDZMkwsXnXv%2bSVXO73qtwS7a19stk1OvSmeCtclL4YAYLP5lVyhq%2bF%2bUPESSLzsESdGE00IpEybbEZUuHGuTRorWwzB3CmPrbITd2DqW5bTsiB2ooyoje7qo3b0J5zulFzT3UOilCx7kcMzMt0WcsO7jjpKHnRKeTvE%2fVQq8HpPMG9Oig1UeuQIfr6h5%2f6zhQclk%2fa38DqwC4HUgYVu%2bONapeE4huIgb8TkGF5knU69O9s99We%2fQdQz0d23cddKMQ9p6m06ohmDgttKwr%2b2PYJdGCFJ37HZwkE3hT9b4%2bO4uMVhKbuqciZ3BcVHdntr9x8xwiftnpjIRgngZIklT%2bDMMjBmjvouy%2bfsPh3wHmp21z1o1X7%2bIRXHCu5xMQDtJ4xHAHk7um44q5ZX5ZYjZDrEwB1Asu2b%2fixVLnUVFNEQJ6xoRjkuPd9a0tkOY7f%2f7YgaC7zUC8OHRg1ZW7rReEr1Eyao0hv%2b6OjGlGB89tJWa0drAg6Tzb9n4S267dQGJRxxKmjh5AvQuJAdjBeJPDLj9EoYeJjYo1vS%2fSxoCr0CMdShgO%2b%2fUSdhCKODO1E2LWd51%2bZ7JaJgjeAnFaY4AGT4J0rJ%2f6%2bODvJSKh3wMVtk2laVr%2b%2fmmwcs%2bt%2faYqdmpRBdnfm10kK%2f%2bWcX1PbqMGcvmNS1PpWJBkc2e5K8KmDC4DxPP1swJFm90LkgUQGrvZfSD%2b0d0d4kvW1lylngaig4f5uHMiijmYUuJfGEqAPiayvMwFshCxGttxrD6xnhgjaPdWrQCIBEbEdaXUrIAQTJGopAULELwsdkghlcgly5yRVRw0CW74o3tSfwjzX00kWVNNv6D0AAAACkwnBO2lLE48U%2be%2blcsGJnWFRmdiJmGCJB4f0UHg4wS83ll045exmkmpdI5AGA0nQ02eMN%2fY%2buQJjYEnn6GLPx&t=wesley.doc\""	ScreenConnect.ClientService.exe

ConnectWise ScreenConnect remote access tool
ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
backdoor rat

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe

Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs

Suspicious Windows Authentication Registry Modification.

persistence privilege_escalation

Authentication Package

T1547.002

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\Authentication Packages = 6d007300760031005f003000000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800380033006300390038006300360035003600610032006500320065006600330029005c00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f0077007300410075007400680065006e007400690063006100740069006f006e005000610063006b006100670065002e0064006c006c0000000000	msiexec.exe

Drops file in System32 directory 10 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ScreenConnect.WindowsClient.exe.log	ScreenConnect.WindowsClient.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (83c98c656a2e2ef3)\niyj2cov.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (83c98c656a2e2ef3)\niyj2cov.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (83c98c656a2e2ef3)\srvhwplj.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (83c98c656a2e2ef3)\srvhwplj.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (83c98c656a2e2ef3)\user.config	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (83c98c656a2e2ef3)\niyj2cov.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (83c98c656a2e2ef3)\rbmctzbt.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (83c98c656a2e2ef3)\rbmctzbt.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (83c98c656a2e2ef3)\rbmctzbt.newcfg	ScreenConnect.ClientService.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Drops file in Program Files directory 16 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ScreenConnect Client (83c98c656a2e2ef3)\ScreenConnect.WindowsBackstageShell.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (83c98c656a2e2ef3)\ScreenConnect.WindowsFileManager.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (83c98c656a2e2ef3)\Client.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (83c98c656a2e2ef3)\ScreenConnect.ClientService.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (83c98c656a2e2ef3)\ScreenConnect.WindowsAuthenticationPackage.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (83c98c656a2e2ef3)\ScreenConnect.WindowsClient.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (83c98c656a2e2ef3)\system.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (83c98c656a2e2ef3)\ScreenConnect.ClientService.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (83c98c656a2e2ef3)\ScreenConnect.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (83c98c656a2e2ef3)\ScreenConnect.Windows.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (83c98c656a2e2ef3)\ScreenConnect.WindowsClient.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (83c98c656a2e2ef3)\ScreenConnect.WindowsCredentialProvider.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (83c98c656a2e2ef3)\ScreenConnect.WindowsFileManager.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (83c98c656a2e2ef3)\Client.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (83c98c656a2e2ef3)\ScreenConnect.Client.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (83c98c656a2e2ef3)\ScreenConnect.WindowsBackstageShell.exe	msiexec.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e596e21.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e596e21.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI724A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{2C29314F-2057-6452-3978-D772B1EA159B}\DefaultIcon	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{2C29314F-2057-6452-3978-D772B1EA159B}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6F98.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6FF7.tmp	msiexec.exe
File created	C:\Windows\Installer\wix{2C29314F-2057-6452-3978-D772B1EA159B}.SchedServiceConfig.rmi	MsiExec.exe
File created	C:\Windows\Installer\e596e23.msi	msiexec.exe
File created	C:\Windows\Installer\{2C29314F-2057-6452-3978-D772B1EA159B}\DefaultIcon	msiexec.exe

Executes dropped EXE 3 IoCs

pid	Process
3368	ScreenConnect.ClientService.exe
2784	ScreenConnect.WindowsClient.exe
5032	ScreenConnect.WindowsClient.exe

Loads dropped DLL 42 IoCs

pid	Process
3776	MsiExec.exe
4132	rundll32.exe
4132	rundll32.exe
4132	rundll32.exe
4132	rundll32.exe
4132	rundll32.exe
4132	rundll32.exe
4132	rundll32.exe
4132	rundll32.exe
4132	rundll32.exe
3776	MsiExec.exe
3884	rundll32.exe
3884	rundll32.exe
3884	rundll32.exe
3884	rundll32.exe
3884	rundll32.exe
3884	rundll32.exe
3884	rundll32.exe
3884	rundll32.exe
3884	rundll32.exe
3776	MsiExec.exe
2976	rundll32.exe
2976	rundll32.exe
2976	rundll32.exe
2976	rundll32.exe
2976	rundll32.exe
2976	rundll32.exe
2976	rundll32.exe
2976	rundll32.exe
2976	rundll32.exe
3544	MsiExec.exe
4204	MsiExec.exe
3368	ScreenConnect.ClientService.exe
3368	ScreenConnect.ClientService.exe
3368	ScreenConnect.ClientService.exe
3368	ScreenConnect.ClientService.exe
3368	ScreenConnect.ClientService.exe
3368	ScreenConnect.ClientService.exe
3368	ScreenConnect.ClientService.exe
3368	ScreenConnect.ClientService.exe
3368	ScreenConnect.ClientService.exe
3368	ScreenConnect.ClientService.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
3160	msiexec.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ScreenConnect.ClientService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ScreenConnect.ClientService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ScreenConnect.WindowsClient.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ScreenConnect.WindowsClient.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenConnect.ClientService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000298171ba54d972bf0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000298171ba0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900298171ba000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a298171ba000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d298171ba000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ScreenConnect.WindowsClient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ScreenConnect.WindowsClient.exe

Modifies data under HKEY_USERS 13 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.ClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.ClientService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.WindowsClient.exe

Modifies registry class 37 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F41392C27502254693877D271BAE51B9\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-98EF-DF2B3A9551C7}\ = "ScreenConnect Client (83c98c656a2e2ef3) Credential Provider"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-98EF-DF2B3A9551C7}\InprocServer32\ = "C:\\Program Files (x86)\\ScreenConnect Client (83c98c656a2e2ef3)\\ScreenConnect.WindowsCredentialProvider.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F41392C27502254693877D271BAE51B9\ProductIcon = "C:\\Windows\\Installer\\{2C29314F-2057-6452-3978-D772B1EA159B}\\DefaultIcon"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F41392C27502254693877D271BAE51B9\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-83c98c656a2e2ef3	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F41392C27502254693877D271BAE51B9	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F41392C27502254693877D271BAE51B9\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F41392C27502254693877D271BAE51B9\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F41392C27502254693877D271BAE51B9\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F41392C27502254693877D271BAE51B9\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-83c98c656a2e2ef3\URL Protocol	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-83c98c656a2e2ef3\shell	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-83c98c656a2e2ef3\shell\open	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-98EF-DF2B3A9551C7}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F41392C27502254693877D271BAE51B9\PackageCode = "F41392C27502254693877D271BAE51B9"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F41392C27502254693877D271BAE51B9\SourceList\Media	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-83c98c656a2e2ef3\UseOriginalUrlEncoding = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-83c98c656a2e2ef3\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-98EF-DF2B3A9551C7}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F41392C27502254693877D271BAE51B9\ProductName = "ScreenConnect Client (83c98c656a2e2ef3)"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F41392C27502254693877D271BAE51B9\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F41392C27502254693877D271BAE51B9\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-83c98c656a2e2ef3\shell\open\command	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F41392C27502254693877D271BAE51B9\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-83c98c656a2e2ef3	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-98EF-DF2B3A9551C7}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F41392C27502254693877D271BAE51B9	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\E8FC704CA34547F3389CC856A6E2E23F\F41392C27502254693877D271BAE51B9	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F41392C27502254693877D271BAE51B9\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\E8FC704CA34547F3389CC856A6E2E23F	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-83c98c656a2e2ef3\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (83c98c656a2e2ef3)\\ScreenConnect.WindowsClient.exe\" \"%1\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F41392C27502254693877D271BAE51B9\Full	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F41392C27502254693877D271BAE51B9\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F41392C27502254693877D271BAE51B9\SourceList\Net	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F41392C27502254693877D271BAE51B9\Version = "436666377"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F41392C27502254693877D271BAE51B9\SourceList\PackageName = "ScreenConnect.ClientSetup.msi"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3768	msiexec.exe
3768	msiexec.exe
3368	ScreenConnect.ClientService.exe
3368	ScreenConnect.ClientService.exe
3368	ScreenConnect.ClientService.exe
3368	ScreenConnect.ClientService.exe
3368	ScreenConnect.ClientService.exe
3368	ScreenConnect.ClientService.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3160	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3160	msiexec.exe
Token: SeSecurityPrivilege	3768	msiexec.exe
Token: SeCreateTokenPrivilege	3160	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3160	msiexec.exe
Token: SeLockMemoryPrivilege	3160	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3160	msiexec.exe
Token: SeMachineAccountPrivilege	3160	msiexec.exe
Token: SeTcbPrivilege	3160	msiexec.exe
Token: SeSecurityPrivilege	3160	msiexec.exe
Token: SeTakeOwnershipPrivilege	3160	msiexec.exe
Token: SeLoadDriverPrivilege	3160	msiexec.exe
Token: SeSystemProfilePrivilege	3160	msiexec.exe
Token: SeSystemtimePrivilege	3160	msiexec.exe
Token: SeProfSingleProcessPrivilege	3160	msiexec.exe
Token: SeIncBasePriorityPrivilege	3160	msiexec.exe
Token: SeCreatePagefilePrivilege	3160	msiexec.exe
Token: SeCreatePermanentPrivilege	3160	msiexec.exe
Token: SeBackupPrivilege	3160	msiexec.exe
Token: SeRestorePrivilege	3160	msiexec.exe
Token: SeShutdownPrivilege	3160	msiexec.exe
Token: SeDebugPrivilege	3160	msiexec.exe
Token: SeAuditPrivilege	3160	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3160	msiexec.exe
Token: SeChangeNotifyPrivilege	3160	msiexec.exe
Token: SeRemoteShutdownPrivilege	3160	msiexec.exe
Token: SeUndockPrivilege	3160	msiexec.exe
Token: SeSyncAgentPrivilege	3160	msiexec.exe
Token: SeEnableDelegationPrivilege	3160	msiexec.exe
Token: SeManageVolumePrivilege	3160	msiexec.exe
Token: SeImpersonatePrivilege	3160	msiexec.exe
Token: SeCreateGlobalPrivilege	3160	msiexec.exe
Token: SeCreateTokenPrivilege	3160	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3160	msiexec.exe
Token: SeLockMemoryPrivilege	3160	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3160	msiexec.exe
Token: SeMachineAccountPrivilege	3160	msiexec.exe
Token: SeTcbPrivilege	3160	msiexec.exe
Token: SeSecurityPrivilege	3160	msiexec.exe
Token: SeTakeOwnershipPrivilege	3160	msiexec.exe
Token: SeLoadDriverPrivilege	3160	msiexec.exe
Token: SeSystemProfilePrivilege	3160	msiexec.exe
Token: SeSystemtimePrivilege	3160	msiexec.exe
Token: SeProfSingleProcessPrivilege	3160	msiexec.exe
Token: SeIncBasePriorityPrivilege	3160	msiexec.exe
Token: SeCreatePagefilePrivilege	3160	msiexec.exe
Token: SeCreatePermanentPrivilege	3160	msiexec.exe
Token: SeBackupPrivilege	3160	msiexec.exe
Token: SeRestorePrivilege	3160	msiexec.exe
Token: SeShutdownPrivilege	3160	msiexec.exe
Token: SeDebugPrivilege	3160	msiexec.exe
Token: SeAuditPrivilege	3160	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3160	msiexec.exe
Token: SeChangeNotifyPrivilege	3160	msiexec.exe
Token: SeRemoteShutdownPrivilege	3160	msiexec.exe
Token: SeUndockPrivilege	3160	msiexec.exe
Token: SeSyncAgentPrivilege	3160	msiexec.exe
Token: SeEnableDelegationPrivilege	3160	msiexec.exe
Token: SeManageVolumePrivilege	3160	msiexec.exe
Token: SeImpersonatePrivilege	3160	msiexec.exe
Token: SeCreateGlobalPrivilege	3160	msiexec.exe
Token: SeCreateTokenPrivilege	3160	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3160	msiexec.exe
Token: SeLockMemoryPrivilege	3160	msiexec.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
3160	msiexec.exe
3160	msiexec.exe
2784	ScreenConnect.WindowsClient.exe
2784	ScreenConnect.WindowsClient.exe
2784	ScreenConnect.WindowsClient.exe
2784	ScreenConnect.WindowsClient.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
2784	ScreenConnect.WindowsClient.exe
2784	ScreenConnect.WindowsClient.exe
2784	ScreenConnect.WindowsClient.exe
2784	ScreenConnect.WindowsClient.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3768 wrote to memory of 3776	3768	msiexec.exe	87
PID 3776 wrote to memory of 4132	3776	MsiExec.exe	88
PID 3776 wrote to memory of 3884	3776	MsiExec.exe	89
PID 3776 wrote to memory of 2976	3776	MsiExec.exe	92
PID 3768 wrote to memory of 4276	3768	msiexec.exe	101
PID 3768 wrote to memory of 3544	3768	msiexec.exe	103
PID 3768 wrote to memory of 4204	3768	msiexec.exe	104
PID 3368 wrote to memory of 2784	3368	ScreenConnect.ClientService.exe	106
PID 3368 wrote to memory of 5032	3368	ScreenConnect.ClientService.exe	107

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\ScreenConnect.ClientSetup.msi
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3160

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Boot or Logon Autostart Execution: Authentication Package
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3768
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 34FD3CFC6BDC8F70D4575B94779A407A C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3776
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI1FF2.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240722078 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:4132
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI264C.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240723625 11 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.CheckMsiMotw
    3⤵
    - Badlisted process makes network request
    - Loads dropped DLL
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    PID:3884
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI2CE4.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240725234 18 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.CheckMsiFileName
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2976
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4276
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 67E0E083A70743094E0B134F5058340F
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3544
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 5F69AA9C097C875156D2AB26952BED90 E Global\MSI0000
  2⤵
  - Drops file in Windows directory
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4204

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:2268

C:\Program Files (x86)\ScreenConnect Client (83c98c656a2e2ef3)\ScreenConnect.ClientService.exe
"C:\Program Files (x86)\ScreenConnect Client (83c98c656a2e2ef3)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=instance-ghwuiv-relay.screenconnect.com&p=443&s=92d8a2d0-0f62-4ada-b4d3-b7c18fc18e3f&k=BgIAAACkAABSU0ExAAgAAAEAAQDthRgStADE4nkAIOjEw3RohOwqXwivcvDf3vcVGYaZFCWXPdC4%2f7E1xIObDPfFr9xQu9HAh%2b3K2E%2fmIGV7j1JJZpN65Lq262Z2Hfmq162uRF91XJsWVOFPFbbWieceENCqlPA4yaHOotRttTj9Pw1hXs%2fsUHMg3jSI0LRC344B8sKU5t3NbjZjWRAdxcylWoeaKrJr0Ik2hoTjIT0Tjq1yr699Do3q3EPoteIEj0gvDJ07uzklmMR7fGZuSA%2fHW3MNh1gdcRDJysAs2J7LRE9BOACGuo5SohILBIroG5yLd0K3sRWme5RSzgYKW%2fZ9znVlEaqaosQ9%2bTxllUNK1YWu&t=wesley.doc"
1⤵
- Sets service image path in registry
- Drops file in System32 directory
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3368
- C:\Program Files (x86)\ScreenConnect Client (83c98c656a2e2ef3)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (83c98c656a2e2ef3)\ScreenConnect.WindowsClient.exe" "RunRole" "8be0ca63-fe76-4475-b79e-1ab7ef4fc340" "User"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2784
- C:\Program Files (x86)\ScreenConnect Client (83c98c656a2e2ef3)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (83c98c656a2e2ef3)\ScreenConnect.WindowsClient.exe" "RunRole" "4dd01504-0f37-46dc-b077-c6ff0f2458be" "System"
  2⤵
  - Drops file in System32 directory
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  PID:5032

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Installer Packages

T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e596e22.rbs

Path C:\Config.Msi\e596e22.rbs
Size 214KB
SHA256 8b337f5c40db07bd798c5b5beb7cb8f5bf7b0d0f9872b24d244e352809acab18
MD5 db5216d3167dee95cbd3acda0388291e
SHA1 0564cf17915fcb0fd8d1c8079ac2955afd3c8faf
SHA512 b381560257ca848a856142e5a14b9a7a73a210b8a2bc3c22271fe1303878feb60d11aceab01347f7c17d815d0a9de80ac8edd782ff6bda96d16facfff4d21a63
SSDEEP 3072:skxuCeSPeKW89LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMGe:G8uH2aCGw1ST1wQLdqve
TLSH
T161248C227484807EE7FA1A32D93F9671BE3CF6641760C59E83848C1E9D604C16BF6B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.en-US.resources

Path C:\Program Files (x86)\ScreenConnect Client (83c98c656a2e2ef3)\Client.en-US.resources
Size 65KB
SHA256 bd8901dd3666277f6d7aa1f4118ad53f5d4229c5d9f67f94e635bf2add3731dd
MD5 7596549052e6f60e5a50b72fbabbbc52
SHA1 b79c87fba66c4256b2bd8dbfa4e28f7e164b127a
SHA512 33d628e724a74a903c83fc830fa60e70bf2ddd89de8071184a5079cd601a354bbf2f50756ee7348bbbfcaed2f10fe0d1fd21ab547147fc13f142b4b27ba2b714
SSDEEP 1536:391nDzSbBYQdQ5Fe2rmcPpZfjZ8peFTp9EwILThIKC1QzpbLeMarw:391DzSbaQCe2rmcPpZfjZ8peFTp9EwII
TLSH
T10C531D1277FD0A18F5F36F75BE7A94619937BC5A2E25C06E1028854E0972F80C9B2773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.resources

Path C:\Program Files (x86)\ScreenConnect Client (83c98c656a2e2ef3)\Client.resources
Size 6KB
SHA256 bd34378ad99f7609fa0c7c8edde6337c738a61d288863015629329806a1cc728
MD5 1e863134f29bcabe1ee571c91ac4fbe6
SHA1 57cc5966fcae49019da5f8f507c840cedfc103f4
SHA512 7e2640c4ddb8719230de0ddb0d18f9a4b1499a037247f12b142b1c16a2a989390abcb5ac7816a63dbce2d43c08510cec7cfc87cd24458bc2fa919c396b36d4f9
SSDEEP 192:rpDZHfbkqYvZJG293IIs1Z4EO/nM3ZWYijpo2YG:rRZjkqYxJ3JI/sMJ/ijp/p
TLSH
T1D8D13BC49BFEAC3CF05E51BE3A7692990275FF113AA3C3582460106A7F228856C56737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll

Path C:\Program Files (x86)\ScreenConnect Client (83c98c656a2e2ef3)\ScreenConnect.Client.dll
Size 413KB
SHA256 fc4fd565a761c1cbc2ca41c52034067768a1f550811a7870f7dd5a4e935adcc2
MD5 8a97b09acdf5dfaa39d45dcb48601089
SHA1 0f56f698d2081f8d979dfcde3a4b96fdf4147b2e
SHA512 5a09b634014b05ca3707ba924f9bbc6182c5f7c2f1ce02fd665eb0772da03a25398c547a0fe36bc35d489c5faa5122ba5136c7b245b8852406252ada599aa178
SSDEEP 6144:WOHlsimlvvKGuYXCD8ETEavHy+vd7JPYIYyqQni65/PTJ:WeQ3udDHTEavSW7OQniOJ
TLSH
T1D194CF8663E8596EED9F0673F0A161284EB6BC05A152F3E94D0475F51E7B3C28780BE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Program Files (x86)\ScreenConnect Client (83c98c656a2e2ef3)\ScreenConnect.ClientService.dll
Size 92KB
SHA256 b927c1c3ce76613153782b3bee3b4b16499b1dd49abb80403cf9b0fb8eb47d2a
MD5 a680beba45594b10dcbaa1df20e3e99f
SHA1 3f6f2f26411441e5dd6fd98c8cb758754ff6450b
SHA512 7e9da8befa19aa3fc734310b44a74ff788c655d75db142c9cf78be2bb50ca2091a6d2af26bb4ff9ae76f56ff02d1fda90a31b7a0a6389ef22c48f42970647ee3
SSDEEP 1536:lzu1ewsuwDP/2ovANyI9xNpxZUuQOV+eGI0ZUazxvmVRo92p7y1pm:lzc2j/BAkI9FXQOVAIAUazxvmVRospO6
TLSH
T144935C4293FCA92BC9DF0E387061F26106B1BA13D9E6E7D46D8860DA2E527C15F1439F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Program Files (x86)\ScreenConnect Client (83c98c656a2e2ef3)\ScreenConnect.ClientService.exe
Size 93KB
SHA256 fc7de50a245b04940fc028a781fa5df6b6bebe0f0e9668cb1318eb9ca9548588
MD5 01549abf69c0a12bbbaa0f40decd0e60
SHA1 08b7f125b6a3eb9898c99856d8c02d0cfa640dec
SHA512 ec787df23b996aa75768664505d09d00ca6aeacc70d12bd24e2283f9804ccbb589acf1b1aeed16a91e488ebd2866382c923ff01b177936a1c2d0db9ca31862b8
SSDEEP 1536:pg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgsU0HMs7XDmt:KhbNDxZGXfdHrX7rAc6myJkgsU0H5Xu
TLSH
T1C7935B13B5C28872E573093158E0DAB09A7FF9615E21DEAB3798022E4F341C1AE75E77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Program Files (x86)\ScreenConnect Client (83c98c656a2e2ef3)\ScreenConnect.Core.dll
Size 583KB
SHA256 dff5b501a73eca3e042364659a5c0e90ee31af633fe20e9242f537e1e57d0fc8
MD5 87b68dfdca363662a48021bde667b0e0
SHA1 397f34af528791ba69027bf7e7bdbbab903ea7d7
SHA512 4e20577dda89e1d9b0b3aaa7102e1cc610f84c219fb4b184584c2ee20839bf7b63c96177fce564d50e7f6cfbf155331cb0dc094b292783175dca45ae9858c26d
SSDEEP 6144:bqphefLh1hWOcIl4hootKghzI9nR3DIagtqXyH4wFB0/chwDHax4kpmIlmYL6T:YhHiwVehRTIxtqeBaT
TLSH
T18FC48C1037A8877AC5EE17BBE073B6128771F417615AE79BB684E4A92CC23C64F103E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Program Files (x86)\ScreenConnect Client (83c98c656a2e2ef3)\ScreenConnect.Windows.dll
Size 1.7MB
SHA256 bd1bd1aba8065866b8f49022be1fc561e980a9b6ef1c438ce761beea034d5160
MD5 737250015f084f2cc0ca6a83074744db
SHA1 fe8944b9d51aee18922641cb62101da1a56c6cbe
SHA512 0736e4d27c56bab0ef03731106bda406eed2541a09391243f55308355d19a2fb3d16e49c734cf9034e163a4df0352a741985086146324bb3cb8efa4b6cde0402
SSDEEP 24576:887jFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUTa:57jJkGYYpT0+TFiH7efPv
TLSH
T10E85AD41E2C364F5D46B047888BF576ABA743C080365CAFB93D4AE366D33BC09A36756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsAuthenticationPackage.dll

Path C:\Program Files (x86)\ScreenConnect Client (83c98c656a2e2ef3)\ScreenConnect.WindowsAuthenticationPackage.dll
Size 254KB
SHA256 a5b8f0070201e4f26260af6a25941ea38bd7042aefd48cd68b9acf951fa99ee5
MD5 5adcb5ae1a1690be69fd22bdf3c2db60
SHA1 09a802b06a4387b0f13bf2cda84f53ca5bdc3785
SHA512 812be742f26d0c42fdde20ab4a02f1b47389f8d1acaa6a5bb3409ba27c64be444ac06d4129981b48fa02d4c06b526cb5006219541b0786f8f37cf2a183a18a73
SSDEEP 3072:qJvChyA4m2zNGvxDd6Q6dtaVNVrlaHpFahvJ9ERnWtMG8Ff2lt9Bgcld5aaYxg:0IvxDdL6d8VNdlC3g0RCXh5D
TLSH
T1C5448E15B7A40CB4EC77823888535A06E776BC160760E6CF03E0825ADF6F7D1A63E762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Program Files (x86)\ScreenConnect Client (83c98c656a2e2ef3)\ScreenConnect.WindowsClient.exe
Size 689KB
SHA256 6de7ff9bd32ceb79232ed76849225283d46aabd07cbc3bc52ca76912b4d807e4
MD5 90e46fd69c0fcbd484e305ec72ac4142
SHA1 2d20f58659adf829190ec4b54d55dfb0567d26fe
SHA512 4bd650462db27492ff5e84bad69f8b32b5ffd51c68452d35a4f7b749d3e74b09a3d969a48f6e7c5f487748460fd968e7086f57b256397943a32be8763d58da9d
SSDEEP 12288:1lZR6ub39KaePHLB0vS2REpSYg5F2iWz6CzDKos9:3rTbEdB0PGnQPW7k
TLSH
T1CBE47D133BAC9B3BD8BF0F396173192477B4F8096685DB9EE54090F70DA23906A453A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsCredentialProvider.dll

Path C:\Program Files (x86)\ScreenConnect Client (83c98c656a2e2ef3)\ScreenConnect.WindowsCredentialProvider.dll
Size 837KB
SHA256 ea2d2c8354c1ee47e8bae366fcd5afa75455000df9562f3cba366bebf2c2eda6
MD5 a10ba6f843066ee7a895536f7a03b24f
SHA1 fd15f875edab5ff5a51a14559984c57d699676eb
SHA512 6fd958c51497292f6bd22c45dda4966c3b7db9741f138b02383a931666d4f12866fc80e3f6e62ad90f1173e7abdbc4114531def0c4c1838490301fd385388423
SSDEEP 12288:3hPu/v5a+Hq+Mu4VrDgKOxbPEYK/TVdHOs:gvNH1Mu4VrDgK6byTVdHOs
TLSH
T17E054B1BE79444B9C0ADC2B5C35B9736ABF5F4864A14B68F0BD40A227E3BF509B1D384
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.config

Path C:\Program Files (x86)\ScreenConnect Client (83c98c656a2e2ef3)\system.config
Size 958B
SHA256 5a39b3927e4635f3e11da15a5b2931d20881d289a926f025d7d05d600538820e
MD5 44af022ba6720523faf40339f407fd9b
SHA1 07da5cd25a85e9883c4fd63258c43c4b885d4ce7
SHA512 9db5f66c3c6a493c453fbedc1f57869d7f74a119a89ec0b6faedf15a9c6abe64e216a5f43bc98dd965bbbdcea0ddaea25305b24009e7ce8e964bbc04d485c571
TLSH
T14F11101171C02E6703732A22D9154385ED766A5E168820C4315E62BD9B7268F03B31AB
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_59E89BCE9615F2B61F2F2C691688F111

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_59E89BCE9615F2B61F2F2C691688F111
Size 727B
SHA256 3f36f3cef83c271d25c175cbec0162a9b1e6500e1626aa1ab06685b1cec19b72
MD5 06e2747421a8734b57c6c8eede9675fa
SHA1 4c20a33481f50480b9e70af350329f8a83a75903
SHA512 df65b0bc43b61fcb451f8d6f0b32d50d7dc17cd8605879374c13d33ab37aed5eeaaae7e9f51de4cd4b8ace69098b43d1073020a3fb143e93aee951980a6a1c19
TLSH
T154014412073DB3C0CF688F5C8D3F27187AEA84A078EA442A373A425DE1C5796ADD7035
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 727B
SHA256 1e416c31c090fe83a8eae7588a7301d1d9b7f8d1a9878ec5aeb23bf2028a2bbf
MD5 1d4aba02cff9567ae3340f89aa3b08f3
SHA1 fa4a5edc5c6d199092469990a73048b87e5a309b
SHA512 a1f2153664108635c9cf1dbb6a99fe660e201ded9716bfa6f5dabd467271dd91f53e362a998a946454056498a3010f10df50f39b6e232bc04b26f1e87b715542
TLSH
T1120194E74C6DBC12F4432BE1D6EC457C327B402335C28792B321CFD9509E217D612408
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_59E89BCE9615F2B61F2F2C691688F111

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_59E89BCE9615F2B61F2F2C691688F111
Size 404B
SHA256 5b09099e8ce1c86b4c8bbb282de15dfc5d78ca96a4732d855e1dc2a8b9855c4b
MD5 aa20ecd83230812d02212643c7456672
SHA1 c507947946e28dc7a1a654aabf426a02123869cf
SHA512 f657f63178f4824c60ac0328bc89a1dc9183a1ba79507e8e05951b4eec00ca087da76180a532bb9b915a1cb9b5ccdf9e01b2f05eec68c5d99e02ab574ff3feca
TLSH
T163E0C63421F88A9EF1A0D83542FAEC220C8DF38E0881C2BE06402252AA09B00ACA2624
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 412B
SHA256 02b05191ff7f6ba8548d2c2e1dedea05a55243adb30e4b45c359fde33f1b351c
MD5 ec8d5883dbe77b3b63c12ef35f4aee61
SHA1 126631049dca70323c9fb3bf9a645630342d0c66
SHA512 1ddd9add01d69b33d6e84a0058690bcafc14009a8330dec3fd9aeb932816e96a79b23a1c9ee8761a4edb6d545b039eff3cb297c9210d5dc1803c4f4aee7c92e3
TLSH
T1E0E06F2826EFE10EF094983142FAE0772D49E30968849BB806D0430EBB0AF409C10AB0
MD5 SHA1 SHA512 TLSH

Submit Download

rundll32.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rundll32.exe.log
Size 746B
SHA256 ddebb6b1094dbef9e96754a74ebd4761d857864c9bd0b5f20a97259a6d7c8fe0
MD5 768929616b943159a05e24024951fa13
SHA1 56bbd9a00695ab7aa25180fe31dff0c254aa9df3
SHA512 f078e880106f93eb86cf66f77e9425fc3cfb82aaf7c7a354b9d55bb8a6a0d87b4326289f2ab6861dad6122f1fcc560125b813b366f84184ee71ac54078ccbbb5
TLSH
T10F017B703322F5D589032F430C5D6A9507FF0769A664FE1CB96E225ED82A1276B322E3
MD5 SHA1 SHA512 TLSH

Submit Download

MSI1FF2.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI1FF2.tmp
Size 1.1MB
SHA256 f751ccdd41a060c1609813602f7d87cf7fcd36743a30ed64c8489ac4e674545d
MD5 58288004df8018de58ff21b6445ae62b
SHA1 135c1c9f2fcafc8fd14fe842181791b460e0f1ba
SHA512 48f9448662b097c773aa196e11da747dc6d3bde544d1875477e8b90feee482b89946dbd9eaa1583374d27fea8d8102973654d1a42324dbd3e9140dffbf702fee
SSDEEP 24576:TUUGGe6tZZlRtiKr/1BnSBqG7Uog6g7nc+M1nYLo2BL18bIWrH9P/x7jqLd9T:UGe6tZbjFr/O/e9c+MdKdtebTT1xCpF
TLSH
T1C045232233E48036F2B67A70AA3471646DFD39A52BFDC14E3B95151C8EE1F82D678352
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Deployment.WindowsInstaller.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI1FF2.tmp-\Microsoft.Deployment.WindowsInstaller.dll
Size 172KB
SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
MD5 5ef88919012e4a3d8a1e2955dc8c8d81
SHA1 c0cfb830b8f1d990e3836e0bcc786e7972c9ed62
SHA512 4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684
SSDEEP 3072:FkfZS7FUguxN+77b1W5GR69UgoCaf8TpCnfKlRUjW01Ky4:x+c7b1W4R6joxfQE
TLSH
T14E045B2563FC473ECAEF87B4E2624251E7B2E2E97113DB0DDC8541AA2522780F792753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI1FF2.tmp-\ScreenConnect.Core.dll
Size 573KB
SHA256 27f353041637adcdb1e73ccf895ec1b09bdca8ad392e00e56147a0a724ee345a
MD5 1dd976925b80e79060bf59729955a75c
SHA1 beb8f96c491f673540ae00062157f37d3c05067e
SHA512 78a5c0ea39d5206b8b9dc8bc74699d66d84cd07016af23fbd327ee50554d6ebcebfd02a2a5367836f7bef77e8f1c5efe4cc45aa7e7030fe8c7cd6b131294bc01
SSDEEP 6144:EqphefLh1hWOcIl4hootKghzI9nR3DIagtqXyH4wFB0/chwDHax4kpmIlmYL6:1hHiwVehRTIxtqeBa
TLSH
T1E4C47C1037B8877AC5EE17BBE073B6128771F417615AE79BB684A4E92C823C64F103E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.InstallerActions.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI1FF2.tmp-\ScreenConnect.InstallerActions.dll
Size 24KB
SHA256 f76e37b09b6b403e1e03cf3f0641866d6e239bdeb4f2cfeadbedc91d65cee0ed
MD5 46a27d44dd7219d731e491300199c3ec
SHA1 5d8e9c48c28471dd5e7a5854fcee07c3369f4ed5
SHA512 6fd5189f951e30f6eb500a5b3f926e955adef87b02a5bc4922b09f70bbf8f8c1d744947224846242f788b30ba5713f323cd935654cbd87d271824008f23a1e3c
SSDEEP 384:nmazzV1VTsaS8hQlLkmoAcV7NaNeirM0dbMsFkjvZBm204hn:mazC9cVMcLv2W
TLSH
T1C4B2C620674DE17AF9EA1634B563FBB002B3BDB3CCE9DA8565A420153D253E04FB5B06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI1FF2.tmp-\ScreenConnect.Windows.dll
Size 1.7MB
SHA256 a5191e82c924733b8a131d7f479c7b7e11755e3e6e996b325f9c0758c0587f33
MD5 1ca2fb835928ee9bb06230bf0318b3f9
SHA1 0ac33b4415746ba3a237a9c39649d2cf414b20f5
SHA512 cd627b53bda4c3be04361909ba55d1e391b11b931aacd1471dd0e27ac434090b9bb0462f972783ee6e96ac0d4b82c7187cef2dcbe3d5bbd5b9cd360d09b12554
SSDEEP 24576:v87jFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUTM:k7jJkGYYpT0+TFiH7efP
TLSH
T13B85AD41E2C364F5D46B047888BF576ABA743C080365CAFB93D4AE366D33BC09A36756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CustomAction.config

Path C:\Users\Admin\AppData\Local\Temp\MSI264C.tmp-\CustomAction.config
Size 234B
SHA256 7027b69ab6ebc9f3f7d2f6c800793fde2a057b76010d8cfd831cf440371b2b23
MD5 6f52ebea639fd7cefca18d9e5272463e
SHA1 b5e8387c2eb20dd37df8f4a3b9b0e875fa5415e3
SHA512 b5960066430ed40383d39365eadb3688cadadfeca382404924024c908e32c670afabd37ab41ff9e6ac97491a5eb8b55367d7199002bf8569cf545434ab2f271a
TLSH
T18CD0A70405D0FD1B5E231A2337524559FF34B1E290A44408B06F3A130A220CD4757317
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsInstaller.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI264C.tmp-\ScreenConnect.WindowsInstaller.dll
Size 137KB
SHA256 11d45353da749c175b3f31d1ddc0480d83196d5115323da829ae4e693b287380
MD5 081381ac3857b86e216b38ea2d10dd55
SHA1 450bc8fe3c6aac1a27ed5172f0ec1d0cd1670fb8
SHA512 839f238b23d47e40550fea7e5ade4c99113a607815485b942f823d3470139a7be6630d444e9801c20dbbab0cab0e19bdf988b28bf2f59e006ed32b6aa56765ac
SSDEEP 1536:4U7AWOVH+oj12lAW5SDVzdi43b12vPDKukpQBhX6dhlo2DutUVfh5U3KiQtlJHMP:4UADVZ12l4L12v2ukpQQvVfjsH6od
TLSH
T1B0D3393463AC9A77E6EF5ABDE470B1400BF2B527B4D3F78E594864F818127D14A2036B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI6FF7.tmp

Path C:\Windows\Installer\MSI6FF7.tmp
Size 202KB
SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
MD5 ba84dd4e0c1408828ccc1de09f585eda
SHA1 e8e10065d479f8f591b9885ea8487bc673301298
SHA512 7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290
SSDEEP 3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
TLSH
T129147C326494803EE7F91A36D93E9A61AE7DF6241760C99EC3848C0E5D604D06BF7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e596e23.msi

Path C:\Windows\Installer\e596e23.msi
Size 9.8MB
SHA256 4e9f935612a8f60fafd3aff6815e75465b50a51ea6fd81813acb485d04416284
MD5 a8b5cffe23b44b060e4b0c8dbad5b1db
SHA1 f60d1c752f54d5e151a6515898c60e017fbfb6a9
SHA512 e6962ce2d621c69f5f23e2e370b0f4669ea1f44f3b01c99e2d193d1ff948ed11edb2a6c6bb98cf973ac820525af783aac5a444b0354c6a6448e4f871f496f85c
SSDEEP 196608:IMOo/K6Sdr3t+iCFKpj10qMOo/K6Sdr3t+MOo/K6Sdr3tnMOo/K6Sdr3t:IyK6cc1K70qyK6cUyK6cJyK6c
TLSH
T194A6232027F99129F1FA0739EE3992B529767D109B23D06F53693D0E1A71E40D7A23B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

niyj2cov.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (83c98c656a2e2ef3)\niyj2cov.newcfg
Size 683B
SHA256 1e2da1ef4f2a25ec71ae27c4ab947af3f9d5668d14a0ad85069c9ae74f801a14
MD5 ab98b248147c2edc9f1dbee2bd1fc766
SHA1 24213257e73f9a4018a1e01691ad3cb6e78a745e
SHA512 bd1a74008c4bb149aacac82e7636030982077a2ab5cae5f107331e6c75f0de4cce3cd70cbe9d5ad1e46335e48d0372bd231876bc0f122a0bc154117d22f626fa
TLSH
T129012D9972C46D5B02731E33D9214745FE71565B056560D874AE213B9F306CB07E32DF
MD5 SHA1 SHA512 TLSH

Submit Download

rbmctzbt.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (83c98c656a2e2ef3)\rbmctzbt.newcfg
Size 881B
SHA256 0c0f59dc956867dcb0a647fb5a43a71438d4ca8fecfda591899c687646713f2c
MD5 b36f7205ebdb930a6ed6ca040f325c59
SHA1 e257fb495f42b47680f5cb0de45c92e8d56622b2
SHA512 3cf55ddc7e897329bf9a05bf68dc0d733c68b31529cb78ce9b9bc0a3d74aeb56d0e22f936f61ce75d1d7032043897249aa372a37982e6d1e2e561567f37932c7
TLSH
T196114E5972C0AE5A06775932D5314385FD72265B056960E434DE21379F305DB07E32DB
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (83c98c656a2e2ef3)\user.config
Size 520B
SHA256 6141bdc49a5c144eecff0e501810a911a8467a7b5eaaa83e381c5bdcac699e14
MD5 5c6535bd25134392cb665213e999db6f
SHA1 b729136aaa774be36624b8f4c12302e7ea166944
SHA512 fdba3758d0ce477b33faaf7763d6369af172806643f6addf170835b409fcd8496821ad0feaaf0bcbe4abf208665b416cc057c0421bce3efb13c0f7ae8802a7ac
TLSH
T122F0E9A531846D4B03635E23C9124741FE72669B0551249874AF623A9F316CE03A31CE
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2784-225-0x00000000022D0000-0x00000000022EA000-memory.dmp

Download

memory/2784-226-0x000000001C8F0000-0x000000001CA76000-memory.dmp

Download

memory/2784-221-0x00000000001B0000-0x0000000000260000-memory.dmp

Download

memory/2784-224-0x000000001B500000-0x000000001B6B0000-memory.dmp

Download

memory/2784-223-0x000000001B2B0000-0x000000001B346000-memory.dmp

Download

memory/2784-222-0x000000001AEA0000-0x000000001AF0C000-memory.dmp

Download

memory/3368-155-0x0000000003D60000-0x0000000003D7A000-memory.dmp

Download

memory/3368-161-0x0000000003FD0000-0x0000000004066000-memory.dmp

Download

memory/3368-202-0x0000000004650000-0x0000000004726000-memory.dmp

Download

memory/3368-198-0x0000000004470000-0x0000000004502000-memory.dmp

Download

memory/3368-200-0x0000000004110000-0x0000000004151000-memory.dmp

Download

memory/3368-171-0x00000000040C0000-0x0000000004110000-memory.dmp

Download

memory/3368-165-0x0000000004220000-0x00000000043D0000-memory.dmp

Download

memory/3368-197-0x0000000004180000-0x00000000041EC000-memory.dmp

Download

memory/3884-74-0x0000000005310000-0x0000000005338000-memory.dmp

Download

memory/4132-42-0x0000000005400000-0x00000000059A4000-memory.dmp

Download

memory/4132-29-0x00000000025B0000-0x00000000025DE000-memory.dmp

Download

memory/4132-33-0x00000000025E0000-0x00000000025EC000-memory.dmp

Download

memory/4132-37-0x0000000002690000-0x0000000002726000-memory.dmp

Download

memory/4132-41-0x0000000004CA0000-0x0000000004E50000-memory.dmp

Download

memory/5032-227-0x0000000003140000-0x0000000003181000-memory.dmp

Download