349e78de0fe66d1616890e835ede0d18580abe8830c549973d7df8a2a7ffdcecSHA-256 hash

Reported by 1 independent source · first reported 19 Mar 2026 by Elastic Security Labs · last reported 19 Mar 2026

Last reported 7 months ago

What the reports say

1 report, newest first · the exact sentence from each

“| 349e78de0fe66d1616890e835ede0d18580abe8830c549973d7df8a2a7ffdcec | SHA-256 | ViewDocs.exe | Syncro Installer |”

Elastic Security LabsVendor19 Mar 2026
From Invitation to Infection: How SILENTCONNECT Delivers ScreenConnect

Indicators reported together

named in the same reports

hxxps://drive.google[.]com/uc?id=1ohZxxT-h7xWVgclB1kvpvwkF0AGWoUtq&export=downloadin 1 report
from[.]netin 1 report
hxxps://bumptobabeco[.]top/Bin/ScreenConnect.ClientSetup.msi?e=Access&y=Guestin 1 report
bumptobabeco[.]topin 1 report
checkfirst.net[.]auin 1 report
imansport[.]irin 1 report
solpru[.]comin 1 report
8bab731ac2f7d015…98cf70b557dbin 1 report
281226ca0203537f…0d75f968f2a3in 1 report
adc1cf894cd35a7d…6c0004723c37in 1 report
81956d08c8efd2f0…226958c30d03in 1 report
c3d4361939d3f6cf…5d0c66aa29c7in 1 report
86.38.225[.]59in 1 report

Copy these 13 indicators · defanged

13 indicators, defanged, one per line

hxxps://drive.google[.]com/uc?id=1ohZxxT-h7xWVgclB1kvpvwkF0AGWoUtq&export=download
from[.]net
hxxps://bumptobabeco[.]top/Bin/ScreenConnect.ClientSetup.msi?e=Access&y=Guest
bumptobabeco[.]top
checkfirst.net[.]au
imansport[.]ir
solpru[.]com
8bab731ac2f7d015b81c2002f518fff06ea751a34a711907e80e98cf70b557db
281226ca0203537fa422b17102047dac314bc0c466ec71b2e6350d75f968f2a3
adc1cf894cd35a7d7176ac5dab005bea55516bc9998d0c96223b6c0004723c37
81956d08c8efd2f0e29fd3962bcf9559c73b1591081f14a6297e226958c30d03
c3d4361939d3f6cf2fe798fef68d4713141c48dce7dd29d3838a5d0c66aa29c7
86.38.225[.]59

Thanks — we review every report.

Report a wrong value