4e9f935612a8f60fafd3aff6815e75465b50a51ea6fd81813acb485d04416284

Analysis

max time kernel
148s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/11/2026, 12:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ScreenConnect.ClientSetup.msi
Size 9.8MB
Sample261113-pc26eaad75
SHA256 4e9f935612a8f60fafd3aff6815e75465b50a51ea6fd81813acb485d04416284
MD5 a8b5cffe23b44b060e4b0c8dbad5b1db
SHA1 f60d1c752f54d5e151a6515898c60e017fbfb6a9
SHA512 e6962ce2d621c69f5f23e2e370b0f4669ea1f44f3b01c99e2d193d1ff948ed11edb2a6c6bb98cf973ac820525af783aac5a444b0354c6a6448e4f871f496f85c
SSDEEP 196608:IMOo/K6Sdr3t+iCFKpj10qMOo/K6Sdr3t+MOo/K6Sdr3tnMOo/K6Sdr3t:IyK6cc1K70qyK6cUyK6cJyK6c
TLSH
T194A6232027F99129F1FA0739EE3992B529767D109B23D06F53693D0E1A71E40D7A23B3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

backdoor discovery persistence privilege_escalation ransomware rat

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	4896	msiexec.exe
9	3240	rundll32.exe

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (83c98c656a2e2ef3)\ImagePath = "\"C:\\Program Files (x86)\\ScreenConnect Client (83c98c656a2e2ef3)\\ScreenConnect.ClientService.exe\" \"?e=Access&y=Guest&h=instance-ghwuiv-relay.screenconnect.com&p=443&s=ab402613-33f7-4b90-a3d6-4f39a6ab69f8&k=BgIAAACkAABSU0ExAAgAAAEAAQDthRgStADE4nkAIOjEw3RohOwqXwivcvDf3vcVGYaZFCWXPdC4%2f7E1xIObDPfFr9xQu9HAh%2b3K2E%2fmIGV7j1JJZpN65Lq262Z2Hfmq162uRF91XJsWVOFPFbbWieceENCqlPA4yaHOotRttTj9Pw1hXs%2fsUHMg3jSI0LRC344B8sKU5t3NbjZjWRAdxcylWoeaKrJr0Ik2hoTjIT0Tjq1yr699Do3q3EPoteIEj0gvDJ07uzklmMR7fGZuSA%2fHW3MNh1gdcRDJysAs2J7LRE9BOACGuo5SohILBIroG5yLd0K3sRWme5RSzgYKW%2fZ9znVlEaqaosQ9%2bTxllUNK1YWu&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAAIVnt%2bEEtRkSIvz%2flO2wgrgAAAAACAAAAAAAQZgAAAAEAACAAAAC1YvNGgaHJSYwjpc3XJAp%2fGQQ4thJrb4LeiHEVGCLtbAAAAAAOgAAAAAIAACAAAACWUbF1KX%2boELpLXE1dUeeFc4OUXi3MQPq5gNoJiCbs3aAEAACrjJf%2fRlgfhR5MDs9J%2bJ4BjaRzlnFnuga29aWCjr1e%2bkwAKgp14vRy3MfoJxbmMfIX6Gm%2fr1hmlom5h1r%2f%2bsfrswc7oJ6RL0OmcGOOOgjNyhHzm6o2VtECdzrCjYFZv28XxXLHJRbkRNhhM%2bAC9DRrW8gKnNn2aCZP4D4%2b2ZlZoludeGwNNsDiHsueq12dfbYcFncRJLrw%2fhzAPQ5yJYWVhHKBzSYJEOVi7MQjOY6F0RfC7qG8oi7Aq%2bzW4y0BylXKbHf3xGN3Y64kScOYq0YWdcmABVIWDIuib41KawsmKAWaxMsRoy7RlvWjCgE5%2fhSNEGSSuD%2b64zHOO4N%2fjUKXusVi89a5%2f5UE7uuuuam0Vxkt0TYcONzoE%2bBOgsHf%2feqdHsbl6asXE3Qb4PHkC2bsgNTWNVKeQAUMGhyW%2b6KUrNZZp8WKd%2bmbhAnbyDRHXlW%2fGZoAH0L6UYAWQLTm4%2bYIL2m2QtRvocl60RT4zNCCrYM5RNze7B%2fyjb3MLYETBiAYfbfIqfHk8u9Ez%2ber82Zc3gxLAvsFIKZzZ9FXs7e5oUxdlRMWMmmklKJOqSh9316H%2fJHM5NHsaRqcTASzWgwVfpE0H6JSxjpgjwf3IzrkL%2fMfXNOYujbQI%2bbZtSByuuAYL7uSA%2fXpG8uNqgZHHg0pzmU%2bIvzMPxKDPMlg8L8cet4DetNIKpQZwAmY4vP25VAQ%2fZT%2fwj20KZb30sPacbh9usCh7qA4tIuKH5DpRF%2fx9zWyR%2flLCS3HnS5L6RUn1s%2bK3747wiK44BnoX95kCVPQ7Qc9%2f%2bWFoFFJx%2blAuqvtEndZwWHXZgDHh6Kxvr5b%2bomFMzMF%2fgvNMfM3H8U2vqdwOpxmcI1Yrd6hqNVBycoKh6WhvTaKOQmOZFiBdwdxVHGxlBHlshB1KkJKM2ayE3iVrebQfBiMwzlJmSWi%2f9VpdMiP3TLCcM4Kuw4FMmV7ecMtSwvGZ1pwivhu9ucDDr0MFbTn2r%2b2OqtrL8SIWH2WC17oky5SV5rLfNs7IZXrIDUIP%2bt9QUuxKmr8yv2%2fqqX%2bfZmhTL%2fP4TXwMQxFQYXlssClf2oA7Ck3Tg2pmPI8I%2bGngPgIgQULvJGn%2beQMvhpoFyPHj2lMBCk3ZWf7adULeh%2b%2bUMsjZM2SjoD00CCFSIUI0HB3UHRsK1mp%2bKvLRAbB93TAYgEwm%2bK1VvN5m%2fQmcLwDP56ud%2fvcvTLrEegOw194e8gLZhZ0eSKZHRLPb3YcIL7xsBfk1weLyhXiwFJPkHXMZj0ZyCNzUg1%2bbO16qdSKax6eyQQS%2f%2bP7UNZQeipPCXc%2bLDKWAnFqfooagJNd6gH1%2f3UO7uXQ1XXFa7S4qO%2bQ4SirEtXxNX%2fFULViWpVF36e2tgWCnsarAoK%2bVrKfD0NzRo5yhZd%2fGrQ5e8ylYxMyCku3vws6x1BC6X0nOmYtIhquGBV0iWkCqbcQpDic4U%2fmHW2mNf72sRPaSHhr%2bXn3DSI9LJkKKdgGucA8QdOQZx1D6FV7yhU7xWrewRML7o4n9GXnPH3Kefsnk%2fIc%2fykQkE1Mz9i%2bDjnhZpMeLI9CVKOCqFPAGCxrXQGcyz2SMUAAAADBhaBRdW7utgvid3WQc7ZGYy8D5oWM7fs1QoKynraDWA9s1ZpqzMKQ%2b2LtNw39y3YGqoUzkTN8rk3cvY8oGmfH&t=wesley.doc\""	ScreenConnect.ClientService.exe

ConnectWise ScreenConnect remote access tool
ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
backdoor rat

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe

Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs

Suspicious Windows Authentication Registry Modification.

persistence privilege_escalation

Authentication Package

T1547.002

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\Authentication Packages = 6d007300760031005f003000000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800380033006300390038006300360035003600610032006500320065006600330029005c00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f0077007300410075007400680065006e007400690063006100740069006f006e005000610063006b006100670065002e0064006c006c0000000000	msiexec.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (83c98c656a2e2ef3)\rva03fmm.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (83c98c656a2e2ef3)\rva03fmm.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (83c98c656a2e2ef3)\rva03fmm.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (83c98c656a2e2ef3)\na2tb5pm.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (83c98c656a2e2ef3)\na2tb5pm.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (83c98c656a2e2ef3)\na2tb5pm.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (83c98c656a2e2ef3)\bgw25ybn.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (83c98c656a2e2ef3)\bgw25ybn.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (83c98c656a2e2ef3)\user.config	ScreenConnect.ClientService.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Drops file in Program Files directory 16 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ScreenConnect Client (83c98c656a2e2ef3)\ScreenConnect.WindowsCredentialProvider.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (83c98c656a2e2ef3)\ScreenConnect.WindowsFileManager.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (83c98c656a2e2ef3)\ScreenConnect.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (83c98c656a2e2ef3)\ScreenConnect.Windows.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (83c98c656a2e2ef3)\ScreenConnect.ClientService.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (83c98c656a2e2ef3)\Client.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (83c98c656a2e2ef3)\system.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (83c98c656a2e2ef3)\ScreenConnect.WindowsFileManager.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (83c98c656a2e2ef3)\ScreenConnect.Client.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (83c98c656a2e2ef3)\ScreenConnect.ClientService.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (83c98c656a2e2ef3)\ScreenConnect.WindowsAuthenticationPackage.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (83c98c656a2e2ef3)\ScreenConnect.WindowsBackstageShell.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (83c98c656a2e2ef3)\ScreenConnect.WindowsClient.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (83c98c656a2e2ef3)\ScreenConnect.WindowsClient.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (83c98c656a2e2ef3)\Client.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (83c98c656a2e2ef3)\ScreenConnect.WindowsBackstageShell.exe.config	msiexec.exe

Drops file in Windows directory 17 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\~DF4F55A643C4B07615.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA08C.tmp	msiexec.exe
File created	C:\Windows\Installer\e599979.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e599977.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{2C29314F-2057-6452-3978-D772B1EA159B}	msiexec.exe
File created	C:\Windows\Installer\{2C29314F-2057-6452-3978-D772B1EA159B}\DefaultIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\{2C29314F-2057-6452-3978-D772B1EA159B}\DefaultIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA0BC.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA39B.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFFD25E33EF46A9FA0.TMP	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\~DFF329603F3F540ADF.TMP	msiexec.exe
File created	C:\Windows\Installer\wix{2C29314F-2057-6452-3978-D772B1EA159B}.SchedServiceConfig.rmi	MsiExec.exe
File created	C:\Windows\SystemTemp\~DF71F886E85640CABD.TMP	msiexec.exe
File created	C:\Windows\Installer\e599977.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe

Executes dropped EXE 3 IoCs

pid	Process
6092	ScreenConnect.ClientService.exe
1512	ScreenConnect.WindowsClient.exe
788	ScreenConnect.WindowsClient.exe

Loads dropped DLL 42 IoCs

pid	Process
4868	MsiExec.exe
2576	rundll32.exe
2576	rundll32.exe
2576	rundll32.exe
2576	rundll32.exe
2576	rundll32.exe
2576	rundll32.exe
2576	rundll32.exe
2576	rundll32.exe
2576	rundll32.exe
4868	MsiExec.exe
3240	rundll32.exe
3240	rundll32.exe
3240	rundll32.exe
3240	rundll32.exe
3240	rundll32.exe
3240	rundll32.exe
3240	rundll32.exe
3240	rundll32.exe
3240	rundll32.exe
4868	MsiExec.exe
3664	rundll32.exe
3664	rundll32.exe
3664	rundll32.exe
3664	rundll32.exe
3664	rundll32.exe
3664	rundll32.exe
3664	rundll32.exe
3664	rundll32.exe
3664	rundll32.exe
3152	MsiExec.exe
1540	MsiExec.exe
6092	ScreenConnect.ClientService.exe
6092	ScreenConnect.ClientService.exe
6092	ScreenConnect.ClientService.exe
6092	ScreenConnect.ClientService.exe
6092	ScreenConnect.ClientService.exe
6092	ScreenConnect.ClientService.exe
6092	ScreenConnect.ClientService.exe
6092	ScreenConnect.ClientService.exe
6092	ScreenConnect.ClientService.exe
6092	ScreenConnect.ClientService.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
4896	msiexec.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ScreenConnect.ClientService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ScreenConnect.WindowsClient.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ScreenConnect.WindowsClient.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ScreenConnect.ClientService.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenConnect.ClientService.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000002fc1fe242d8ae0d60000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c01200000000000000000000000027010100008838012fc1fe240000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e841012fc1fe24000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e32fc1fe2400000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e62fc1fe2400000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ScreenConnect.WindowsClient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ScreenConnect.WindowsClient.exe

Modifies data under HKEY_USERS 13 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.ClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.ClientService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.WindowsClient.exe

Modifies registry class 37 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-98EF-DF2B3A9551C7}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-83c98c656a2e2ef3\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (83c98c656a2e2ef3)\\ScreenConnect.WindowsClient.exe\" \"%1\""	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F41392C27502254693877D271BAE51B9\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F41392C27502254693877D271BAE51B9\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-98EF-DF2B3A9551C7}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F41392C27502254693877D271BAE51B9\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F41392C27502254693877D271BAE51B9\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-83c98c656a2e2ef3\URL Protocol	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-83c98c656a2e2ef3\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-83c98c656a2e2ef3\shell	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-83c98c656a2e2ef3\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-98EF-DF2B3A9551C7}\InprocServer32\ = "C:\\Program Files (x86)\\ScreenConnect Client (83c98c656a2e2ef3)\\ScreenConnect.WindowsCredentialProvider.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-83c98c656a2e2ef3\shell\open	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-98EF-DF2B3A9551C7}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F41392C27502254693877D271BAE51B9	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F41392C27502254693877D271BAE51B9\ProductName = "ScreenConnect Client (83c98c656a2e2ef3)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F41392C27502254693877D271BAE51B9\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F41392C27502254693877D271BAE51B9\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\E8FC704CA34547F3389CC856A6E2E23F	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F41392C27502254693877D271BAE51B9\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-98EF-DF2B3A9551C7}\ = "ScreenConnect Client (83c98c656a2e2ef3) Credential Provider"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F41392C27502254693877D271BAE51B9\PackageCode = "F41392C27502254693877D271BAE51B9"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F41392C27502254693877D271BAE51B9\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-83c98c656a2e2ef3	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F41392C27502254693877D271BAE51B9\Full	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F41392C27502254693877D271BAE51B9\Version = "436666377"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F41392C27502254693877D271BAE51B9\SourceList\PackageName = "ScreenConnect.ClientSetup.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-83c98c656a2e2ef3	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F41392C27502254693877D271BAE51B9\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F41392C27502254693877D271BAE51B9\ProductIcon = "C:\\Windows\\Installer\\{2C29314F-2057-6452-3978-D772B1EA159B}\\DefaultIcon"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\E8FC704CA34547F3389CC856A6E2E23F\F41392C27502254693877D271BAE51B9	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F41392C27502254693877D271BAE51B9\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F41392C27502254693877D271BAE51B9\SourceList\Media	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-83c98c656a2e2ef3\UseOriginalUrlEncoding = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F41392C27502254693877D271BAE51B9	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F41392C27502254693877D271BAE51B9\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F41392C27502254693877D271BAE51B9\SourceList\Media\1 = ";"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1652	msiexec.exe
1652	msiexec.exe
6092	ScreenConnect.ClientService.exe
6092	ScreenConnect.ClientService.exe
6092	ScreenConnect.ClientService.exe
6092	ScreenConnect.ClientService.exe
6092	ScreenConnect.ClientService.exe
6092	ScreenConnect.ClientService.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4896	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4896	msiexec.exe
Token: SeSecurityPrivilege	1652	msiexec.exe
Token: SeCreateTokenPrivilege	4896	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4896	msiexec.exe
Token: SeLockMemoryPrivilege	4896	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4896	msiexec.exe
Token: SeMachineAccountPrivilege	4896	msiexec.exe
Token: SeTcbPrivilege	4896	msiexec.exe
Token: SeSecurityPrivilege	4896	msiexec.exe
Token: SeTakeOwnershipPrivilege	4896	msiexec.exe
Token: SeLoadDriverPrivilege	4896	msiexec.exe
Token: SeSystemProfilePrivilege	4896	msiexec.exe
Token: SeSystemtimePrivilege	4896	msiexec.exe
Token: SeProfSingleProcessPrivilege	4896	msiexec.exe
Token: SeIncBasePriorityPrivilege	4896	msiexec.exe
Token: SeCreatePagefilePrivilege	4896	msiexec.exe
Token: SeCreatePermanentPrivilege	4896	msiexec.exe
Token: SeBackupPrivilege	4896	msiexec.exe
Token: SeRestorePrivilege	4896	msiexec.exe
Token: SeShutdownPrivilege	4896	msiexec.exe
Token: SeDebugPrivilege	4896	msiexec.exe
Token: SeAuditPrivilege	4896	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4896	msiexec.exe
Token: SeChangeNotifyPrivilege	4896	msiexec.exe
Token: SeRemoteShutdownPrivilege	4896	msiexec.exe
Token: SeUndockPrivilege	4896	msiexec.exe
Token: SeSyncAgentPrivilege	4896	msiexec.exe
Token: SeEnableDelegationPrivilege	4896	msiexec.exe
Token: SeManageVolumePrivilege	4896	msiexec.exe
Token: SeImpersonatePrivilege	4896	msiexec.exe
Token: SeCreateGlobalPrivilege	4896	msiexec.exe
Token: SeCreateTokenPrivilege	4896	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4896	msiexec.exe
Token: SeLockMemoryPrivilege	4896	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4896	msiexec.exe
Token: SeMachineAccountPrivilege	4896	msiexec.exe
Token: SeTcbPrivilege	4896	msiexec.exe
Token: SeSecurityPrivilege	4896	msiexec.exe
Token: SeTakeOwnershipPrivilege	4896	msiexec.exe
Token: SeLoadDriverPrivilege	4896	msiexec.exe
Token: SeSystemProfilePrivilege	4896	msiexec.exe
Token: SeSystemtimePrivilege	4896	msiexec.exe
Token: SeProfSingleProcessPrivilege	4896	msiexec.exe
Token: SeIncBasePriorityPrivilege	4896	msiexec.exe
Token: SeCreatePagefilePrivilege	4896	msiexec.exe
Token: SeCreatePermanentPrivilege	4896	msiexec.exe
Token: SeBackupPrivilege	4896	msiexec.exe
Token: SeRestorePrivilege	4896	msiexec.exe
Token: SeShutdownPrivilege	4896	msiexec.exe
Token: SeDebugPrivilege	4896	msiexec.exe
Token: SeAuditPrivilege	4896	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4896	msiexec.exe
Token: SeChangeNotifyPrivilege	4896	msiexec.exe
Token: SeRemoteShutdownPrivilege	4896	msiexec.exe
Token: SeUndockPrivilege	4896	msiexec.exe
Token: SeSyncAgentPrivilege	4896	msiexec.exe
Token: SeEnableDelegationPrivilege	4896	msiexec.exe
Token: SeManageVolumePrivilege	4896	msiexec.exe
Token: SeImpersonatePrivilege	4896	msiexec.exe
Token: SeCreateGlobalPrivilege	4896	msiexec.exe
Token: SeCreateTokenPrivilege	4896	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4896	msiexec.exe
Token: SeLockMemoryPrivilege	4896	msiexec.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
4896	msiexec.exe
4896	msiexec.exe
1512	ScreenConnect.WindowsClient.exe
1512	ScreenConnect.WindowsClient.exe
1512	ScreenConnect.WindowsClient.exe
1512	ScreenConnect.WindowsClient.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
1512	ScreenConnect.WindowsClient.exe
1512	ScreenConnect.WindowsClient.exe
1512	ScreenConnect.WindowsClient.exe
1512	ScreenConnect.WindowsClient.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4896	msiexec.exe
1652	msiexec.exe
4868	MsiExec.exe
3152	MsiExec.exe
1540	MsiExec.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 4868	1652	msiexec.exe	90
PID 4868 wrote to memory of 2576	4868	MsiExec.exe	91
PID 4868 wrote to memory of 3240	4868	MsiExec.exe	92
PID 4868 wrote to memory of 3664	4868	MsiExec.exe	93
PID 1652 wrote to memory of 6100	1652	msiexec.exe	98
PID 1652 wrote to memory of 3152	1652	msiexec.exe	100
PID 1652 wrote to memory of 1540	1652	msiexec.exe	101
PID 6092 wrote to memory of 1512	6092	ScreenConnect.ClientService.exe	105
PID 6092 wrote to memory of 788	6092	ScreenConnect.ClientService.exe	106

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\ScreenConnect.ClientSetup.msi
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4896

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Boot or Logon Autostart Execution: Authentication Package
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 039CEC547441BF999DD04CC224EAC243 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4868
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI3BB7.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240729453 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2576
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI4108.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240730406 11 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.CheckMsiMotw
    3⤵
    - Badlisted process makes network request
    - Loads dropped DLL
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    PID:3240
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI47CF.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240732203 18 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.CheckMsiFileName
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:3664
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:6100
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding C112F92C32A91195A418CBBC32AE7303
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3152
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 3CA6748703E9991B25C507E28644E8FE E Global\MSI0000
  2⤵
  - Drops file in Windows directory
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1540

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:5440

C:\Program Files (x86)\ScreenConnect Client (83c98c656a2e2ef3)\ScreenConnect.ClientService.exe
"C:\Program Files (x86)\ScreenConnect Client (83c98c656a2e2ef3)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=instance-ghwuiv-relay.screenconnect.com&p=443&s=ab402613-33f7-4b90-a3d6-4f39a6ab69f8&k=BgIAAACkAABSU0ExAAgAAAEAAQDthRgStADE4nkAIOjEw3RohOwqXwivcvDf3vcVGYaZFCWXPdC4%2f7E1xIObDPfFr9xQu9HAh%2b3K2E%2fmIGV7j1JJZpN65Lq262Z2Hfmq162uRF91XJsWVOFPFbbWieceENCqlPA4yaHOotRttTj9Pw1hXs%2fsUHMg3jSI0LRC344B8sKU5t3NbjZjWRAdxcylWoeaKrJr0Ik2hoTjIT0Tjq1yr699Do3q3EPoteIEj0gvDJ07uzklmMR7fGZuSA%2fHW3MNh1gdcRDJysAs2J7LRE9BOACGuo5SohILBIroG5yLd0K3sRWme5RSzgYKW%2fZ9znVlEaqaosQ9%2bTxllUNK1YWu&t=wesley.doc"
1⤵
- Sets service image path in registry
- Drops file in System32 directory
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:6092
- C:\Program Files (x86)\ScreenConnect Client (83c98c656a2e2ef3)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (83c98c656a2e2ef3)\ScreenConnect.WindowsClient.exe" "RunRole" "822e15da-bdd2-4591-a0ac-75e08d65c826" "User"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1512
- C:\Program Files (x86)\ScreenConnect Client (83c98c656a2e2ef3)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (83c98c656a2e2ef3)\ScreenConnect.WindowsClient.exe" "RunRole" "d3fc2839-0bef-4ac4-8470-89bb525e99df" "System"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  PID:788

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Installer Packages

T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e599978.rbs

Path C:\Config.Msi\e599978.rbs
Size 214KB
SHA256 f7ec166fc418a67daca3e8376c9afa6d254ecf900f56012a00f44c088deddb0d
MD5 943011c51e677a85a84dc158cf75e6b9
SHA1 bdeb6bf85d319fabb6567fb7f492976f01157f8d
SHA512 87dd99e551d31885b365c025cc9f2e172da926de90387d69709abc718590c9f3f5dad46e33349ea7dbc8283082b4e4d224942edc3a3bffa5a9e7aea9d63d35ca
SSDEEP 3072:2kcuCeSPeKKO9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG4:5OuH2aCGw1ST1wQLdqv4
TLSH
T165248C227484807EE7FA1A32D93F9671BE3CF6641760C59E83848C1E9D604C16BF6B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.en-US.resources

Path C:\Program Files (x86)\ScreenConnect Client (83c98c656a2e2ef3)\Client.en-US.resources
Size 65KB
SHA256 bd8901dd3666277f6d7aa1f4118ad53f5d4229c5d9f67f94e635bf2add3731dd
MD5 7596549052e6f60e5a50b72fbabbbc52
SHA1 b79c87fba66c4256b2bd8dbfa4e28f7e164b127a
SHA512 33d628e724a74a903c83fc830fa60e70bf2ddd89de8071184a5079cd601a354bbf2f50756ee7348bbbfcaed2f10fe0d1fd21ab547147fc13f142b4b27ba2b714
SSDEEP 1536:391nDzSbBYQdQ5Fe2rmcPpZfjZ8peFTp9EwILThIKC1QzpbLeMarw:391DzSbaQCe2rmcPpZfjZ8peFTp9EwII
TLSH
T10C531D1277FD0A18F5F36F75BE7A94619937BC5A2E25C06E1028854E0972F80C9B2773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.resources

Path C:\Program Files (x86)\ScreenConnect Client (83c98c656a2e2ef3)\Client.resources
Size 6KB
SHA256 bd34378ad99f7609fa0c7c8edde6337c738a61d288863015629329806a1cc728
MD5 1e863134f29bcabe1ee571c91ac4fbe6
SHA1 57cc5966fcae49019da5f8f507c840cedfc103f4
SHA512 7e2640c4ddb8719230de0ddb0d18f9a4b1499a037247f12b142b1c16a2a989390abcb5ac7816a63dbce2d43c08510cec7cfc87cd24458bc2fa919c396b36d4f9
SSDEEP 192:rpDZHfbkqYvZJG293IIs1Z4EO/nM3ZWYijpo2YG:rRZjkqYxJ3JI/sMJ/ijp/p
TLSH
T1D8D13BC49BFEAC3CF05E51BE3A7692990275FF113AA3C3582460106A7F228856C56737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll

Path C:\Program Files (x86)\ScreenConnect Client (83c98c656a2e2ef3)\ScreenConnect.Client.dll
Size 413KB
SHA256 fc4fd565a761c1cbc2ca41c52034067768a1f550811a7870f7dd5a4e935adcc2
MD5 8a97b09acdf5dfaa39d45dcb48601089
SHA1 0f56f698d2081f8d979dfcde3a4b96fdf4147b2e
SHA512 5a09b634014b05ca3707ba924f9bbc6182c5f7c2f1ce02fd665eb0772da03a25398c547a0fe36bc35d489c5faa5122ba5136c7b245b8852406252ada599aa178
SSDEEP 6144:WOHlsimlvvKGuYXCD8ETEavHy+vd7JPYIYyqQni65/PTJ:WeQ3udDHTEavSW7OQniOJ
TLSH
T1D194CF8663E8596EED9F0673F0A161284EB6BC05A152F3E94D0475F51E7B3C28780BE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Program Files (x86)\ScreenConnect Client (83c98c656a2e2ef3)\ScreenConnect.ClientService.dll
Size 92KB
SHA256 b927c1c3ce76613153782b3bee3b4b16499b1dd49abb80403cf9b0fb8eb47d2a
MD5 a680beba45594b10dcbaa1df20e3e99f
SHA1 3f6f2f26411441e5dd6fd98c8cb758754ff6450b
SHA512 7e9da8befa19aa3fc734310b44a74ff788c655d75db142c9cf78be2bb50ca2091a6d2af26bb4ff9ae76f56ff02d1fda90a31b7a0a6389ef22c48f42970647ee3
SSDEEP 1536:lzu1ewsuwDP/2ovANyI9xNpxZUuQOV+eGI0ZUazxvmVRo92p7y1pm:lzc2j/BAkI9FXQOVAIAUazxvmVRospO6
TLSH
T144935C4293FCA92BC9DF0E387061F26106B1BA13D9E6E7D46D8860DA2E527C15F1439F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Program Files (x86)\ScreenConnect Client (83c98c656a2e2ef3)\ScreenConnect.ClientService.exe
Size 93KB
SHA256 fc7de50a245b04940fc028a781fa5df6b6bebe0f0e9668cb1318eb9ca9548588
MD5 01549abf69c0a12bbbaa0f40decd0e60
SHA1 08b7f125b6a3eb9898c99856d8c02d0cfa640dec
SHA512 ec787df23b996aa75768664505d09d00ca6aeacc70d12bd24e2283f9804ccbb589acf1b1aeed16a91e488ebd2866382c923ff01b177936a1c2d0db9ca31862b8
SSDEEP 1536:pg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgsU0HMs7XDmt:KhbNDxZGXfdHrX7rAc6myJkgsU0H5Xu
TLSH
T1C7935B13B5C28872E573093158E0DAB09A7FF9615E21DEAB3798022E4F341C1AE75E77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Program Files (x86)\ScreenConnect Client (83c98c656a2e2ef3)\ScreenConnect.Core.dll
Size 583KB
SHA256 dff5b501a73eca3e042364659a5c0e90ee31af633fe20e9242f537e1e57d0fc8
MD5 87b68dfdca363662a48021bde667b0e0
SHA1 397f34af528791ba69027bf7e7bdbbab903ea7d7
SHA512 4e20577dda89e1d9b0b3aaa7102e1cc610f84c219fb4b184584c2ee20839bf7b63c96177fce564d50e7f6cfbf155331cb0dc094b292783175dca45ae9858c26d
SSDEEP 6144:bqphefLh1hWOcIl4hootKghzI9nR3DIagtqXyH4wFB0/chwDHax4kpmIlmYL6T:YhHiwVehRTIxtqeBaT
TLSH
T18FC48C1037A8877AC5EE17BBE073B6128771F417615AE79BB684E4A92CC23C64F103E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Program Files (x86)\ScreenConnect Client (83c98c656a2e2ef3)\ScreenConnect.Windows.dll
Size 1.7MB
SHA256 bd1bd1aba8065866b8f49022be1fc561e980a9b6ef1c438ce761beea034d5160
MD5 737250015f084f2cc0ca6a83074744db
SHA1 fe8944b9d51aee18922641cb62101da1a56c6cbe
SHA512 0736e4d27c56bab0ef03731106bda406eed2541a09391243f55308355d19a2fb3d16e49c734cf9034e163a4df0352a741985086146324bb3cb8efa4b6cde0402
SSDEEP 24576:887jFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUTa:57jJkGYYpT0+TFiH7efPv
TLSH
T10E85AD41E2C364F5D46B047888BF576ABA743C080365CAFB93D4AE366D33BC09A36756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsAuthenticationPackage.dll

Path C:\Program Files (x86)\ScreenConnect Client (83c98c656a2e2ef3)\ScreenConnect.WindowsAuthenticationPackage.dll
Size 254KB
SHA256 a5b8f0070201e4f26260af6a25941ea38bd7042aefd48cd68b9acf951fa99ee5
MD5 5adcb5ae1a1690be69fd22bdf3c2db60
SHA1 09a802b06a4387b0f13bf2cda84f53ca5bdc3785
SHA512 812be742f26d0c42fdde20ab4a02f1b47389f8d1acaa6a5bb3409ba27c64be444ac06d4129981b48fa02d4c06b526cb5006219541b0786f8f37cf2a183a18a73
SSDEEP 3072:qJvChyA4m2zNGvxDd6Q6dtaVNVrlaHpFahvJ9ERnWtMG8Ff2lt9Bgcld5aaYxg:0IvxDdL6d8VNdlC3g0RCXh5D
TLSH
T1C5448E15B7A40CB4EC77823888535A06E776BC160760E6CF03E0825ADF6F7D1A63E762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Program Files (x86)\ScreenConnect Client (83c98c656a2e2ef3)\ScreenConnect.WindowsClient.exe
Size 689KB
SHA256 6de7ff9bd32ceb79232ed76849225283d46aabd07cbc3bc52ca76912b4d807e4
MD5 90e46fd69c0fcbd484e305ec72ac4142
SHA1 2d20f58659adf829190ec4b54d55dfb0567d26fe
SHA512 4bd650462db27492ff5e84bad69f8b32b5ffd51c68452d35a4f7b749d3e74b09a3d969a48f6e7c5f487748460fd968e7086f57b256397943a32be8763d58da9d
SSDEEP 12288:1lZR6ub39KaePHLB0vS2REpSYg5F2iWz6CzDKos9:3rTbEdB0PGnQPW7k
TLSH
T1CBE47D133BAC9B3BD8BF0F396173192477B4F8096685DB9EE54090F70DA23906A453A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Program Files (x86)\ScreenConnect Client (83c98c656a2e2ef3)\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
TLSH
T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsCredentialProvider.dll

Path C:\Program Files (x86)\ScreenConnect Client (83c98c656a2e2ef3)\ScreenConnect.WindowsCredentialProvider.dll
Size 837KB
SHA256 ea2d2c8354c1ee47e8bae366fcd5afa75455000df9562f3cba366bebf2c2eda6
MD5 a10ba6f843066ee7a895536f7a03b24f
SHA1 fd15f875edab5ff5a51a14559984c57d699676eb
SHA512 6fd958c51497292f6bd22c45dda4966c3b7db9741f138b02383a931666d4f12866fc80e3f6e62ad90f1173e7abdbc4114531def0c4c1838490301fd385388423
SSDEEP 12288:3hPu/v5a+Hq+Mu4VrDgKOxbPEYK/TVdHOs:gvNH1Mu4VrDgK6byTVdHOs
TLSH
T17E054B1BE79444B9C0ADC2B5C35B9736ABF5F4864A14B68F0BD40A227E3BF509B1D384
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.config

Path C:\Program Files (x86)\ScreenConnect Client (83c98c656a2e2ef3)\system.config
Size 958B
SHA256 5a39b3927e4635f3e11da15a5b2931d20881d289a926f025d7d05d600538820e
MD5 44af022ba6720523faf40339f407fd9b
SHA1 07da5cd25a85e9883c4fd63258c43c4b885d4ce7
SHA512 9db5f66c3c6a493c453fbedc1f57869d7f74a119a89ec0b6faedf15a9c6abe64e216a5f43bc98dd965bbbdcea0ddaea25305b24009e7ce8e964bbc04d485c571
TLSH
T14F11101171C02E6703732A22D9154385ED766A5E168820C4315E62BD9B7268F03B31AB
MD5 SHA1 SHA512 TLSH

Submit Download

MSI3BB7.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI3BB7.tmp
Size 1.1MB
SHA256 f751ccdd41a060c1609813602f7d87cf7fcd36743a30ed64c8489ac4e674545d
MD5 58288004df8018de58ff21b6445ae62b
SHA1 135c1c9f2fcafc8fd14fe842181791b460e0f1ba
SHA512 48f9448662b097c773aa196e11da747dc6d3bde544d1875477e8b90feee482b89946dbd9eaa1583374d27fea8d8102973654d1a42324dbd3e9140dffbf702fee
SSDEEP 24576:TUUGGe6tZZlRtiKr/1BnSBqG7Uog6g7nc+M1nYLo2BL18bIWrH9P/x7jqLd9T:UGe6tZbjFr/O/e9c+MdKdtebTT1xCpF
TLSH
T1C045232233E48036F2B67A70AA3471646DFD39A52BFDC14E3B95151C8EE1F82D678352
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Deployment.WindowsInstaller.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI3BB7.tmp-\Microsoft.Deployment.WindowsInstaller.dll
Size 172KB
SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
MD5 5ef88919012e4a3d8a1e2955dc8c8d81
SHA1 c0cfb830b8f1d990e3836e0bcc786e7972c9ed62
SHA512 4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684
SSDEEP 3072:FkfZS7FUguxN+77b1W5GR69UgoCaf8TpCnfKlRUjW01Ky4:x+c7b1W4R6joxfQE
TLSH
T14E045B2563FC473ECAEF87B4E2624251E7B2E2E97113DB0DDC8541AA2522780F792753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI3BB7.tmp-\ScreenConnect.Core.dll
Size 573KB
SHA256 27f353041637adcdb1e73ccf895ec1b09bdca8ad392e00e56147a0a724ee345a
MD5 1dd976925b80e79060bf59729955a75c
SHA1 beb8f96c491f673540ae00062157f37d3c05067e
SHA512 78a5c0ea39d5206b8b9dc8bc74699d66d84cd07016af23fbd327ee50554d6ebcebfd02a2a5367836f7bef77e8f1c5efe4cc45aa7e7030fe8c7cd6b131294bc01
SSDEEP 6144:EqphefLh1hWOcIl4hootKghzI9nR3DIagtqXyH4wFB0/chwDHax4kpmIlmYL6:1hHiwVehRTIxtqeBa
TLSH
T1E4C47C1037B8877AC5EE17BBE073B6128771F417615AE79BB684A4E92C823C64F103E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.InstallerActions.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI3BB7.tmp-\ScreenConnect.InstallerActions.dll
Size 24KB
SHA256 f76e37b09b6b403e1e03cf3f0641866d6e239bdeb4f2cfeadbedc91d65cee0ed
MD5 46a27d44dd7219d731e491300199c3ec
SHA1 5d8e9c48c28471dd5e7a5854fcee07c3369f4ed5
SHA512 6fd5189f951e30f6eb500a5b3f926e955adef87b02a5bc4922b09f70bbf8f8c1d744947224846242f788b30ba5713f323cd935654cbd87d271824008f23a1e3c
SSDEEP 384:nmazzV1VTsaS8hQlLkmoAcV7NaNeirM0dbMsFkjvZBm204hn:mazC9cVMcLv2W
TLSH
T1C4B2C620674DE17AF9EA1634B563FBB002B3BDB3CCE9DA8565A420153D253E04FB5B06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI3BB7.tmp-\ScreenConnect.Windows.dll
Size 1.7MB
SHA256 a5191e82c924733b8a131d7f479c7b7e11755e3e6e996b325f9c0758c0587f33
MD5 1ca2fb835928ee9bb06230bf0318b3f9
SHA1 0ac33b4415746ba3a237a9c39649d2cf414b20f5
SHA512 cd627b53bda4c3be04361909ba55d1e391b11b931aacd1471dd0e27ac434090b9bb0462f972783ee6e96ac0d4b82c7187cef2dcbe3d5bbd5b9cd360d09b12554
SSDEEP 24576:v87jFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUTM:k7jJkGYYpT0+TFiH7efP
TLSH
T13B85AD41E2C364F5D46B047888BF576ABA743C080365CAFB93D4AE366D33BC09A36756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CustomAction.config

Path C:\Users\Admin\AppData\Local\Temp\MSI4108.tmp-\CustomAction.config
Size 234B
SHA256 7027b69ab6ebc9f3f7d2f6c800793fde2a057b76010d8cfd831cf440371b2b23
MD5 6f52ebea639fd7cefca18d9e5272463e
SHA1 b5e8387c2eb20dd37df8f4a3b9b0e875fa5415e3
SHA512 b5960066430ed40383d39365eadb3688cadadfeca382404924024c908e32c670afabd37ab41ff9e6ac97491a5eb8b55367d7199002bf8569cf545434ab2f271a
TLSH
T18CD0A70405D0FD1B5E231A2337524559FF34B1E290A44408B06F3A130A220CD4757317
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsInstaller.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI4108.tmp-\ScreenConnect.WindowsInstaller.dll
Size 137KB
SHA256 11d45353da749c175b3f31d1ddc0480d83196d5115323da829ae4e693b287380
MD5 081381ac3857b86e216b38ea2d10dd55
SHA1 450bc8fe3c6aac1a27ed5172f0ec1d0cd1670fb8
SHA512 839f238b23d47e40550fea7e5ade4c99113a607815485b942f823d3470139a7be6630d444e9801c20dbbab0cab0e19bdf988b28bf2f59e006ed32b6aa56765ac
SSDEEP 1536:4U7AWOVH+oj12lAW5SDVzdi43b12vPDKukpQBhX6dhlo2DutUVfh5U3KiQtlJHMP:4UADVZ12l4L12v2ukpQQvVfjsH6od
TLSH
T1B0D3393463AC9A77E6EF5ABDE470B1400BF2B527B4D3F78E594864F818127D14A2036B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIA0BC.tmp

Path C:\Windows\Installer\MSIA0BC.tmp
Size 202KB
SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
MD5 ba84dd4e0c1408828ccc1de09f585eda
SHA1 e8e10065d479f8f591b9885ea8487bc673301298
SHA512 7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290
SSDEEP 3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
TLSH
T129147C326494803EE7F91A36D93E9A61AE7DF6241760C99EC3848C0E5D604D06BF7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e599979.msi

Path C:\Windows\Installer\e599979.msi
Size 9.8MB
SHA256 4e9f935612a8f60fafd3aff6815e75465b50a51ea6fd81813acb485d04416284
MD5 a8b5cffe23b44b060e4b0c8dbad5b1db
SHA1 f60d1c752f54d5e151a6515898c60e017fbfb6a9
SHA512 e6962ce2d621c69f5f23e2e370b0f4669ea1f44f3b01c99e2d193d1ff948ed11edb2a6c6bb98cf973ac820525af783aac5a444b0354c6a6448e4f871f496f85c
SSDEEP 196608:IMOo/K6Sdr3t+iCFKpj10qMOo/K6Sdr3t+MOo/K6Sdr3tnMOo/K6Sdr3t:IyK6cc1K70qyK6cUyK6cJyK6c
TLSH
T194A6232027F99129F1FA0739EE3992B529767D109B23D06F53693D0E1A71E40D7A23B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

na2tb5pm.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (83c98c656a2e2ef3)\na2tb5pm.newcfg
Size 881B
SHA256 a2a59d84e851ebe04a2a596d994bcfd975df5afe42180e1e2c515dddcf96b746
MD5 c1d4f717f810b630afe8201d408f8a79
SHA1 4c3bcefeaa476f574b10af5be000465eff0dda25
SHA512 1df4c29bc6d8afde4cfb31490d0f28f6135f4e311ad68f33c2b2aa0058919188c761640f734825d116fe157876c0c427cc14339fa18525dee05da80ce20b511a
TLSH
T13D118E5972C09D5A02735932C5314385FD32165B056960E434DE21379F305DB07E32DB
MD5 SHA1 SHA512 TLSH

Submit Download

rva03fmm.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (83c98c656a2e2ef3)\rva03fmm.newcfg
Size 683B
SHA256 1e2da1ef4f2a25ec71ae27c4ab947af3f9d5668d14a0ad85069c9ae74f801a14
MD5 ab98b248147c2edc9f1dbee2bd1fc766
SHA1 24213257e73f9a4018a1e01691ad3cb6e78a745e
SHA512 bd1a74008c4bb149aacac82e7636030982077a2ab5cae5f107331e6c75f0de4cce3cd70cbe9d5ad1e46335e48d0372bd231876bc0f122a0bc154117d22f626fa
TLSH
T129012D9972C46D5B02731E33D9214745FE71565B056560D874AE213B9F306CB07E32DF
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (83c98c656a2e2ef3)\user.config
Size 520B
SHA256 6141bdc49a5c144eecff0e501810a911a8467a7b5eaaa83e381c5bdcac699e14
MD5 5c6535bd25134392cb665213e999db6f
SHA1 b729136aaa774be36624b8f4c12302e7ea166944
SHA512 fdba3758d0ce477b33faaf7763d6369af172806643f6addf170835b409fcd8496821ad0feaaf0bcbe4abf208665b416cc057c0421bce3efb13c0f7ae8802a7ac
TLSH
T122F0E9A531846D4B03635E23C9124741FE72669B0551249874AF623A9F316CE03A31CE
MD5 SHA1 SHA512 TLSH

Submit Download

{0f89f793-4c21-48c3-b903-63e0a5e72973}_OnDiskSnapshotProp

Path \??\Volume{24fec12f-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{0f89f793-4c21-48c3-b903-63e0a5e72973}_OnDiskSnapshotProp
Size 6KB
SHA256 b0083b1570f12b39cce93b01819838b63b5fd9dd6708c80a916019961f6382e6
MD5 ac2e951d295ffa6391d13c65dc1cc885
SHA1 f8e92d754e2c47f6fd513cc44258e9e8ac1f9498
SHA512 2ec472f6c8b470b09287e22eba9ae4943be5d44b38525a517488204895a8db9a52e273f3390b07a18377cd75caa6cff368ec0f1dd6437dee75be295e1ca0e18d
SSDEEP 96:FkLk20vc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:uMb++uVm
TLSH
T10ED1890C5AF54311E2B3AB7229F18557A877B911EF33CB8E0198238E2630910F875F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1512-209-0x000000001AFA0000-0x000000001B00C000-memory.dmp

Download

memory/1512-212-0x0000000002460000-0x000000000247A000-memory.dmp

Download

memory/1512-211-0x000000001B620000-0x000000001B7D0000-memory.dmp

Download

memory/1512-210-0x000000001B3D0000-0x000000001B466000-memory.dmp

Download

memory/1512-206-0x0000000000380000-0x0000000000430000-memory.dmp

Download

memory/1512-213-0x000000001B960000-0x000000001BAE8000-memory.dmp

Download

memory/2576-25-0x0000000003720000-0x000000000372C000-memory.dmp

Download

memory/2576-29-0x0000000005870000-0x0000000005906000-memory.dmp

Download

memory/2576-33-0x0000000005AC0000-0x0000000005C70000-memory.dmp

Download

memory/2576-21-0x0000000003730000-0x000000000375E000-memory.dmp

Download

memory/2576-34-0x0000000006230000-0x00000000067EA000-memory.dmp

Download

memory/3240-64-0x0000000003FE0000-0x0000000004008000-memory.dmp

Download

memory/6092-184-0x0000000003F60000-0x0000000003FF2000-memory.dmp

Download

memory/6092-188-0x0000000004150000-0x0000000004226000-memory.dmp

Download

memory/6092-186-0x0000000003DE0000-0x0000000003E21000-memory.dmp

Download

memory/6092-183-0x0000000003E50000-0x0000000003EBC000-memory.dmp

Download

memory/6092-164-0x0000000003BD0000-0x0000000003C20000-memory.dmp

Download

memory/6092-151-0x0000000003C30000-0x0000000003DE0000-memory.dmp

Download

memory/6092-147-0x00000000039E0000-0x0000000003A76000-memory.dmp

Download

memory/6092-141-0x00000000038C0000-0x00000000038DA000-memory.dmp

Download