e8138e2cd06e85a73dd8993cfe4a86d14e96583a372df10aa7aeed7dca810201

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240708-en
resource tags

arch:x64arch:x86image:win10v2004-20240708-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2024, 14:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
XML_00000S1D4S555555S4D111111S.exe
Size 5.4MB
Sample240709-rdahwsxdpk
SHA256 e8138e2cd06e85a73dd8993cfe4a86d14e96583a372df10aa7aeed7dca810201
MD5 afbf0c5d79f9d9bd1b0561beb261a593
SHA1 534ae6515c3ae3a1e04bca35f02a6a3152165215
SHA512 aa9e01dc24eb7ee3ddc9bbab645d28d86da3f43b7219c76835555c91377ddc67872ff6295901f474c611812eb4d68ada4081ea7b7e95f275b971e5fdd088a9c9
SSDEEP 98304:/4s6efPOEnXkHywo+EVhaecMUzG4uc96ob2:gfefPFZs6Uruc9Xb
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

execution persistence privilege_escalation

Malware Config

Signatures

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (7e83ca7fd57c5b3c)\ImagePath = "\"C:\\Program Files (x86)\\ScreenConnect Client (7e83ca7fd57c5b3c)\\ScreenConnect.ClientService.exe\" \"?e=Access&y=Guest&h=instance-cd0t6w-relay.screenconnect.com&p=443&s=940c90d6-8601-43b2-a739-e91495b73d92&k=BgIAAACkAABSU0ExAAgAAAEAAQDVZI9kSjK%2f54LXPZ9FKsay04RE4khdBsPLarOPut1YGRVEY9ECyKPHIIJMiaiU0axUm3ezwYJznlj81CFhwxAouBhlUzP%2bJOezmldQBOWa5L2ggOj8Ag24O3%2fvb5JzF6fYGxp8SmBG6MlSMxeS8V6%2b%2f%2b9ZCYaHMlb7DLJtt343rt%2bcPprTLYW7ZqYSVaL%2f6skDJAr%2bjkEfZOWYkiNKIgJI7dv1LcB6ZOX8Jax7uX90y7R%2bY3Kp%2bQyn6xk0qjV4mPs8L4DG8UKztHRzJJDlLfHrnwd7bKTlgI5HsZqJZm%2fpn5TrAJrK4n19PUQMseZZiMSMmRUsKIBsAwfn1cDeyDq7&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAAAcdK0XaRkU6cTIgjnAsJpQAAAAACAAAAAAAQZgAAAAEAACAAAABoJpRhUav4MKGH%2f%2fQLheAmLiWT9QDtFQja5UsdgH3nkQAAAAAOgAAAAAIAACAAAAC7CEHj3eSOe%2fXAmVSm%2fwU%2bGw9lcruLE0j0Y6AK1nlLCKAEAADs%2bnnOGttW7t6WLzgCxfNX0NRznJYQYyZGmwIBWMWoUpRVy4oSX%2fQO2hTCWGRmBp3lpHgAfolCaJHFqAUlrrjsltyfA%2fn2E7KLBJCn8oxFLhlncDjhrvKOYGQZYyVwbDLcfAZy12bx6Kg4js9ATuqB980%2btFSPM5paW9ok1XaHA6dA%2bd714stHdOhBmiqi12P%2b7tJN79HfxS9LxEBqxz3hubuQltDj7icD3X0pQZCKLQsE7%2f04HxiSs76pEiDTeXRPVbkZO5l27yT52E2VPFvn4AQedc3%2fdg3XgH4EpsysNbJfxbjPSjMcBBj3TdMD50URojtxiS41jVhb4JTdii8IVWxDPBtqsKqK5pANo%2bo1ZDFT6B7mTvwtsQ8x6UejwN2jlRbin%2bpEr%2bHv%2fO4xoehe77i%2b%2bHN4vhNnV1fGeNIoruDkYevxZZMAf2dT6rhz0SJUkbP7mmXRdfdXlPe1pleyoK2edDIOu0beZM0gv58aoepqSi7Ro7WzeIjP5%2fATLnDFpIEpZFSPxEOgtMrvWAxmEYhflpmszuGbfvGM1sixqfHxiN7Y%2fa896OwcyY9PvPNQr%2be61GVMjXktsgdpiupncQDKhtkIwHxIT8drNOj5LRd8xWa5TwPLY1MX3YjHruow1AL18Dg0J2PLrcEmTD3K8pLipNnm7vR3XtInSC9YQVHpVKGQrBaSS0QgKIMn%2fEOnF4kbI2XQPHpO9RiGARmYgCgluBrJ7SqrAPPxPVc26lvAc0KBSICez%2fE0VFNP%2bTVnyN7Aj8%2fjjvSU2t4uwkqXztCjqtqQ1BtsR5ctY1HAdt0JJosTjxD7MjJNvD2IwzQ5qA0%2fBy7%2bzwsMGOUh1Fhq8vdnhQDKa%2fBQ10hon5WNEhLKoVC4s1%2bnKYaK1EFLAcWxsUXE1XHmTAG8qcUj2TxFbOkxXmAZX0hc092CwfjON4pyw2WXadx8qUG0CPYdhFcZVb4CaUxGbXKUFk9%2fJHihkB1Pver5qDD30edlOGIj%2flBybvgoaZ%2fKwGYAaENwsceBbD6pnhv4s3fEJs7eTJj2bychu%2fXd640BWcwOw6ur7zARrv%2bSQoFwivVCQhXzaM5chXvUUo0m8TYHIwAaF1KY10BUxWARYRMoV4fnOwuWhqk2p9AYbd8kxogxJFJ%2b7t3888c7CLmDl42RqHOX0cRxj30aAyYmBcUNP1E2rH4fylnuNEkuMOUefWMbOVO2xdMi1PdCSRANdAMlmNCNcTNK8DAQvBsZpA0bxEPXfpY3A0OFCkUouHB2RgQDhBchUZ7WfN5u1fn6LeKdDR1o8ouXDRN%2brzu%2fkCaHGaD7TMn1xq2QMc%2bjZoYUwEHFFrIE4%2ff9GaINWWGQGq1bvh%2f0C%2bsPqKDKtr3wp1E88RbA3Uo2TJ8XjEwGVSBycoFRgJhVkGMlhUIqKOZgQvhRSQzceRAWoCXyJeVLZ%2bpxiVfp403opasjk0Xo5R6bhmLGygujFlKkKHZhb5Zaq0fIDxmBcbTPePuA%2fTH5bjHLCh9jsb7rzx26HrddEa2YKReJZZUJ54p8VqPhBK75B4IIqWNmwzi%2bdaoWSK0iMgseki0yjQBv4EAAAAAIGPBdBtde6QHHIdVnuBqhxjMgTSA3omHiS%2bOQJRL%2bfwBusIX96z2Q4eCd5mJvJUohmicY7aTs6wJZPsCAuY8X\""	ScreenConnect.ClientService.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3310979990-555183016-1244931625-1000\Control Panel\International\Geo\Nation	XML_00000S1D4S555555S4D111111S.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (7e83ca7fd57c5b3c)\0ohobqvp.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (7e83ca7fd57c5b3c)\0ohobqvp.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ScreenConnect.WindowsClient.exe.log	ScreenConnect.WindowsClient.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Drops file in Program Files directory 16 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ScreenConnect Client (7e83ca7fd57c5b3c)\ScreenConnect.Client.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (7e83ca7fd57c5b3c)\ScreenConnect.WindowsAuthenticationPackage.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (7e83ca7fd57c5b3c)\ScreenConnect.WindowsCredentialProvider.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (7e83ca7fd57c5b3c)\ScreenConnect.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (7e83ca7fd57c5b3c)\ScreenConnect.Windows.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (7e83ca7fd57c5b3c)\ScreenConnect.WindowsBackstageShell.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (7e83ca7fd57c5b3c)\ScreenConnect.WindowsClient.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (7e83ca7fd57c5b3c)\ScreenConnect.WindowsFileManager.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (7e83ca7fd57c5b3c)\ScreenConnect.WindowsClient.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (7e83ca7fd57c5b3c)\ScreenConnect.ClientService.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (7e83ca7fd57c5b3c)\Client.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (7e83ca7fd57c5b3c)\ScreenConnect.ClientService.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (7e83ca7fd57c5b3c)\ScreenConnect.WindowsBackstageShell.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (7e83ca7fd57c5b3c)\ScreenConnect.WindowsFileManager.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (7e83ca7fd57c5b3c)\Client.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (7e83ca7fd57c5b3c)\system.config	msiexec.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSIB75.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{F4D2041D-9ADC-AFBC-44F0-2CF70D9377E1}	msiexec.exe
File created	C:\Windows\Installer\{F4D2041D-9ADC-AFBC-44F0-2CF70D9377E1}\DefaultIcon	msiexec.exe
File created	C:\Windows\Installer\e580a9c.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\{F4D2041D-9ADC-AFBC-44F0-2CF70D9377E1}\DefaultIcon	msiexec.exe
File created	C:\Windows\Installer\e580a9a.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e580a9a.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBA4.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID1C.tmp	msiexec.exe
File created	C:\Windows\Installer\wix{F4D2041D-9ADC-AFBC-44F0-2CF70D9377E1}.SchedServiceConfig.rmi	MsiExec.exe

Executes dropped EXE 3 IoCs

pid	Process
4332	ScreenConnect.ClientService.exe
4544	ScreenConnect.WindowsClient.exe
4180	ScreenConnect.WindowsClient.exe

Loads dropped DLL 22 IoCs

pid	Process
112	MsiExec.exe
4952	rundll32.exe
4952	rundll32.exe
4952	rundll32.exe
4952	rundll32.exe
4952	rundll32.exe
4952	rundll32.exe
4952	rundll32.exe
4952	rundll32.exe
4952	rundll32.exe
4128	MsiExec.exe
3292	MsiExec.exe
4332	ScreenConnect.ClientService.exe
4332	ScreenConnect.ClientService.exe
4332	ScreenConnect.ClientService.exe
4332	ScreenConnect.ClientService.exe
4332	ScreenConnect.ClientService.exe
4332	ScreenConnect.ClientService.exe
4332	ScreenConnect.ClientService.exe
4332	ScreenConnect.ClientService.exe
4332	ScreenConnect.ClientService.exe
4332	ScreenConnect.ClientService.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4060	powershell.exe
4712	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000043fa3596377bb7d70000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000043fa35960000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff00000000070001000068090043fa3596000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d43fa3596000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000043fa359600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ScreenConnect.WindowsClient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ScreenConnect.WindowsClient.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.ClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.ClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\fveui.dll,-844 = "BitLocker Data Recovery Agent"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.ClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\ci.dll,-101 = "Enclave"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\wuaueng.dll,-400 = "Windows Update"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe

Modifies registry class 37 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D1402D4FCDA9CBFA440FC27FD039771E\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\7e83ca7fd57c5b3c\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D1402D4FCDA9CBFA440FC27FD039771E\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\7e83ca7fd57c5b3c\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-C434-A191F529B5CC}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D1402D4FCDA9CBFA440FC27FD039771E\ProductName = "ScreenConnect Client (7e83ca7fd57c5b3c)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D1402D4FCDA9CBFA440FC27FD039771E\PackageCode = "D1402D4FCDA9CBFA440FC27FD039771E"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D1402D4FCDA9CBFA440FC27FD039771E\Version = "402718729"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D1402D4FCDA9CBFA440FC27FD039771E\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-7e83ca7fd57c5b3c	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-7e83ca7fd57c5b3c	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D1402D4FCDA9CBFA440FC27FD039771E\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D1402D4FCDA9CBFA440FC27FD039771E\Full	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D1402D4FCDA9CBFA440FC27FD039771E\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D1402D4FCDA9CBFA440FC27FD039771E\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D1402D4FCDA9CBFA440FC27FD039771E\SourceList\PackageName = "setup.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D1402D4FCDA9CBFA440FC27FD039771E\SourceList\Media\1 = ";"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D1402D4FCDA9CBFA440FC27FD039771E\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D1402D4FCDA9CBFA440FC27FD039771E\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-7e83ca7fd57c5b3c\shell\open	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-7e83ca7fd57c5b3c\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-C434-A191F529B5CC}\ = "ScreenConnect Client (7e83ca7fd57c5b3c) Credential Provider"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D1402D4FCDA9CBFA440FC27FD039771E\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D1402D4FCDA9CBFA440FC27FD039771E\ProductIcon = "C:\\Windows\\Installer\\{F4D2041D-9ADC-AFBC-44F0-2CF70D9377E1}\\DefaultIcon"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-7e83ca7fd57c5b3c\URL Protocol	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D1402D4FCDA9CBFA440FC27FD039771E	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\BE3B409905592EAAE738ACF75DC7B5C3\D1402D4FCDA9CBFA440FC27FD039771E	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-C434-A191F529B5CC}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-C434-A191F529B5CC}\InprocServer32\ = "C:\\Program Files (x86)\\ScreenConnect Client (7e83ca7fd57c5b3c)\\ScreenConnect.WindowsCredentialProvider.dll"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D1402D4FCDA9CBFA440FC27FD039771E\AdvertiseFlags = "388"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D1402D4FCDA9CBFA440FC27FD039771E\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-7e83ca7fd57c5b3c\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-7e83ca7fd57c5b3c\shell	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-7e83ca7fd57c5b3c\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (7e83ca7fd57c5b3c)\\ScreenConnect.WindowsClient.exe\" \"%1\""	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D1402D4FCDA9CBFA440FC27FD039771E	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-7e83ca7fd57c5b3c\UseOriginalUrlEncoding = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-C434-A191F529B5CC}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\BE3B409905592EAAE738ACF75DC7B5C3	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D1402D4FCDA9CBFA440FC27FD039771E\SourceList	msiexec.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3708	msiexec.exe
3708	msiexec.exe
4332	ScreenConnect.ClientService.exe
4332	ScreenConnect.ClientService.exe
4332	ScreenConnect.ClientService.exe
4332	ScreenConnect.ClientService.exe
4332	ScreenConnect.ClientService.exe
4332	ScreenConnect.ClientService.exe
4060	powershell.exe
4060	powershell.exe
4712	powershell.exe
4712	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5036	XML_00000S1D4S555555S4D111111S.exe
Token: SeShutdownPrivilege	1592	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1592	msiexec.exe
Token: SeSecurityPrivilege	3708	msiexec.exe
Token: SeCreateTokenPrivilege	1592	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1592	msiexec.exe
Token: SeLockMemoryPrivilege	1592	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1592	msiexec.exe
Token: SeMachineAccountPrivilege	1592	msiexec.exe
Token: SeTcbPrivilege	1592	msiexec.exe
Token: SeSecurityPrivilege	1592	msiexec.exe
Token: SeTakeOwnershipPrivilege	1592	msiexec.exe
Token: SeLoadDriverPrivilege	1592	msiexec.exe
Token: SeSystemProfilePrivilege	1592	msiexec.exe
Token: SeSystemtimePrivilege	1592	msiexec.exe
Token: SeProfSingleProcessPrivilege	1592	msiexec.exe
Token: SeIncBasePriorityPrivilege	1592	msiexec.exe
Token: SeCreatePagefilePrivilege	1592	msiexec.exe
Token: SeCreatePermanentPrivilege	1592	msiexec.exe
Token: SeBackupPrivilege	1592	msiexec.exe
Token: SeRestorePrivilege	1592	msiexec.exe
Token: SeShutdownPrivilege	1592	msiexec.exe
Token: SeDebugPrivilege	1592	msiexec.exe
Token: SeAuditPrivilege	1592	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1592	msiexec.exe
Token: SeChangeNotifyPrivilege	1592	msiexec.exe
Token: SeRemoteShutdownPrivilege	1592	msiexec.exe
Token: SeUndockPrivilege	1592	msiexec.exe
Token: SeSyncAgentPrivilege	1592	msiexec.exe
Token: SeEnableDelegationPrivilege	1592	msiexec.exe
Token: SeManageVolumePrivilege	1592	msiexec.exe
Token: SeImpersonatePrivilege	1592	msiexec.exe
Token: SeCreateGlobalPrivilege	1592	msiexec.exe
Token: SeCreateTokenPrivilege	1592	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1592	msiexec.exe
Token: SeLockMemoryPrivilege	1592	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1592	msiexec.exe
Token: SeMachineAccountPrivilege	1592	msiexec.exe
Token: SeTcbPrivilege	1592	msiexec.exe
Token: SeSecurityPrivilege	1592	msiexec.exe
Token: SeTakeOwnershipPrivilege	1592	msiexec.exe
Token: SeLoadDriverPrivilege	1592	msiexec.exe
Token: SeSystemProfilePrivilege	1592	msiexec.exe
Token: SeSystemtimePrivilege	1592	msiexec.exe
Token: SeProfSingleProcessPrivilege	1592	msiexec.exe
Token: SeIncBasePriorityPrivilege	1592	msiexec.exe
Token: SeCreatePagefilePrivilege	1592	msiexec.exe
Token: SeCreatePermanentPrivilege	1592	msiexec.exe
Token: SeBackupPrivilege	1592	msiexec.exe
Token: SeRestorePrivilege	1592	msiexec.exe
Token: SeShutdownPrivilege	1592	msiexec.exe
Token: SeDebugPrivilege	1592	msiexec.exe
Token: SeAuditPrivilege	1592	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1592	msiexec.exe
Token: SeChangeNotifyPrivilege	1592	msiexec.exe
Token: SeRemoteShutdownPrivilege	1592	msiexec.exe
Token: SeUndockPrivilege	1592	msiexec.exe
Token: SeSyncAgentPrivilege	1592	msiexec.exe
Token: SeEnableDelegationPrivilege	1592	msiexec.exe
Token: SeManageVolumePrivilege	1592	msiexec.exe
Token: SeImpersonatePrivilege	1592	msiexec.exe
Token: SeCreateGlobalPrivilege	1592	msiexec.exe
Token: SeCreateTokenPrivilege	1592	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1592	msiexec.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
1592	msiexec.exe
1592	msiexec.exe
4544	ScreenConnect.WindowsClient.exe
4544	ScreenConnect.WindowsClient.exe
4544	ScreenConnect.WindowsClient.exe
4544	ScreenConnect.WindowsClient.exe
4544	ScreenConnect.WindowsClient.exe

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
4544	ScreenConnect.WindowsClient.exe
4544	ScreenConnect.WindowsClient.exe
4544	ScreenConnect.WindowsClient.exe
4544	ScreenConnect.WindowsClient.exe
4544	ScreenConnect.WindowsClient.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 5036 wrote to memory of 1592	5036	XML_00000S1D4S555555S4D111111S.exe	84
PID 5036 wrote to memory of 1592	5036	XML_00000S1D4S555555S4D111111S.exe	84
PID 5036 wrote to memory of 1592	5036	XML_00000S1D4S555555S4D111111S.exe	84
PID 3708 wrote to memory of 112	3708	msiexec.exe	87
PID 3708 wrote to memory of 112	3708	msiexec.exe	87
PID 3708 wrote to memory of 112	3708	msiexec.exe	87
PID 112 wrote to memory of 4952	112	MsiExec.exe	88
PID 112 wrote to memory of 4952	112	MsiExec.exe	88
PID 112 wrote to memory of 4952	112	MsiExec.exe	88
PID 3708 wrote to memory of 4772	3708	msiexec.exe	92
PID 3708 wrote to memory of 4772	3708	msiexec.exe	92
PID 3708 wrote to memory of 4128	3708	msiexec.exe	94
PID 3708 wrote to memory of 4128	3708	msiexec.exe	94
PID 3708 wrote to memory of 4128	3708	msiexec.exe	94
PID 3708 wrote to memory of 3292	3708	msiexec.exe	95
PID 3708 wrote to memory of 3292	3708	msiexec.exe	95
PID 3708 wrote to memory of 3292	3708	msiexec.exe	95
PID 4332 wrote to memory of 4544	4332	ScreenConnect.ClientService.exe	97
PID 4332 wrote to memory of 4544	4332	ScreenConnect.ClientService.exe	97
PID 4332 wrote to memory of 4180	4332	ScreenConnect.ClientService.exe	98
PID 4332 wrote to memory of 4180	4332	ScreenConnect.ClientService.exe	98
PID 4332 wrote to memory of 4060	4332	ScreenConnect.ClientService.exe	106
PID 4332 wrote to memory of 4060	4332	ScreenConnect.ClientService.exe	106
PID 4332 wrote to memory of 4712	4332	ScreenConnect.ClientService.exe	108
PID 4332 wrote to memory of 4712	4332	ScreenConnect.ClientService.exe	108

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\XML_00000S1D4S555555S4D111111S.exe
"C:\Users\Admin\AppData\Local\Temp\XML_00000S1D4S555555S4D111111S.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5036
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\7e83ca7fd57c5b3c\setup.msi"
  2⤵
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:1592

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3708
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 56CEB7C1888E6D42D33600F5F5F45801 C
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:112
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSID09E.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240636234 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    - Loads dropped DLL
    PID:4952
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4772
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding CB94D6720B0F18FB8AD9BAEBFE008AFB
  2⤵
  - Loads dropped DLL
  PID:4128
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 9B180C16EEB053A159B234A15A3745A0 E Global\MSI0000
  2⤵
  - Drops file in Windows directory
  - Loads dropped DLL
  PID:3292

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:2960

C:\Program Files (x86)\ScreenConnect Client (7e83ca7fd57c5b3c)\ScreenConnect.ClientService.exe
"C:\Program Files (x86)\ScreenConnect Client (7e83ca7fd57c5b3c)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=instance-cd0t6w-relay.screenconnect.com&p=443&s=940c90d6-8601-43b2-a739-e91495b73d92&k=BgIAAACkAABSU0ExAAgAAAEAAQDVZI9kSjK%2f54LXPZ9FKsay04RE4khdBsPLarOPut1YGRVEY9ECyKPHIIJMiaiU0axUm3ezwYJznlj81CFhwxAouBhlUzP%2bJOezmldQBOWa5L2ggOj8Ag24O3%2fvb5JzF6fYGxp8SmBG6MlSMxeS8V6%2b%2f%2b9ZCYaHMlb7DLJtt343rt%2bcPprTLYW7ZqYSVaL%2f6skDJAr%2bjkEfZOWYkiNKIgJI7dv1LcB6ZOX8Jax7uX90y7R%2bY3Kp%2bQyn6xk0qjV4mPs8L4DG8UKztHRzJJDlLfHrnwd7bKTlgI5HsZqJZm%2fpn5TrAJrK4n19PUQMseZZiMSMmRUsKIBsAwfn1cDeyDq7"
1⤵
- Sets service image path in registry
- Drops file in System32 directory
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4332
- C:\Program Files (x86)\ScreenConnect Client (7e83ca7fd57c5b3c)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (7e83ca7fd57c5b3c)\ScreenConnect.WindowsClient.exe" "RunRole" "176a2e81-cbac-4ea1-b9ff-b6d1d5f2019f" "User"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:4544
- C:\Program Files (x86)\ScreenConnect Client (7e83ca7fd57c5b3c)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (7e83ca7fd57c5b3c)\ScreenConnect.WindowsClient.exe" "RunRole" "d6a53954-abef-48d9-ae61-49cac25a32f1" "System"
  2⤵
  - Drops file in System32 directory
  - Executes dropped EXE
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  PID:4180
- C:\Windows\system32\WindowsPowershell\v1.0\powershell.exe
  "WindowsPowershell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -File "C:\Windows\TEMP\ScreenConnect\24.1.9.8915\cd15155f-2c1f-4936-9551-f12ba98513c8run.ps1"
  2⤵
  - Drops file in System32 directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4060
- C:\Windows\system32\WindowsPowershell\v1.0\powershell.exe
  "WindowsPowershell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -File "C:\Windows\TEMP\ScreenConnect\24.1.9.8915\c9dc14d2-df4a-4173-8632-2d576cff8c56run.ps1"
  2⤵
  - Drops file in System32 directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e580a9b.rbs

Path C:\Config.Msi\e580a9b.rbs
Size 214KB
SHA256 40b7738e37d66d4b5171de2879c7c7e2be0f06cf1bbbf6746f9c00522270b44f
MD5 369abba9306f30dc5c48167731ba8671
SHA1 f2c83cc8751e2b08f257fa6f04a89bbc08c10e03
SHA512 da337b85da9d01b800cd5f45aac4b6dd95432049209d06b229f5834cacf949a0f0e4fce13cd434076735b01d4c63479602c105194e9cefbe77d8d903f86bbad3
SSDEEP 3072:Sc9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMGn:ScuH2aCGw1ST1wQLdqvn
MD5 SHA1 SHA512 SSDEEP

Submit Download

Client.en-US.resources

Path C:\Program Files (x86)\ScreenConnect Client (7e83ca7fd57c5b3c)\Client.en-US.resources
Size 48KB
SHA256 f8398a235b29af6569f2b116e0299b95512d042f5a4cd38c98c79729a5fbdb9d
MD5 511202ed0ba32d7f09eab394c917d067
SHA1 dbd611720fd1730198f72dec09e8e23e6d6488f8
SHA512 f04b08938f3ebf8cfa1a1157a94da3ae4699494bdce566619afa5b13a8f6ebe556d522c064e5ea02e343b59a489343f77e3ea2bb2ea390aae35a626f41cadc77
SSDEEP 1536:sdr6QF+gQpAfqiErOmOCqZUWi+JgJ0FQi9zwHLAhDKZ1HtRKekmrg9:sdr1F+gQOlErOmPqZUWi+JgJ0FQi9zw2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Client.resources

Path C:\Program Files (x86)\ScreenConnect Client (7e83ca7fd57c5b3c)\Client.resources
Size 26KB
SHA256 de185ee5d433e6cfbb2e5fcc903dbd60cc833a3ca5299f2862b253a41e7aa08c
MD5 5cd580b22da0c33ec6730b10a6c74932
SHA1 0b6bded7936178d80841b289769c6ff0c8eead2d
SHA512 c2494533b26128fbf8149f7d20257d78d258abffb30e4e595cb9c6a742f00f1bf31b1ee202d4184661b98793b9909038cf03c04b563ce4eca1e2ee2dec3bf787
SSDEEP 384:rAClIRkKxFCQPZhNAmutHcRIfvVf6yMt+FRVoSVCdcDk6jO0n/uTYUq5ZplYKlBy:MV3PZrXgTf6vEVm6zjpGYUElerG49
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScreenConnect.Client.dll

Path C:\Program Files (x86)\ScreenConnect Client (7e83ca7fd57c5b3c)\ScreenConnect.Client.dll
Size 192KB
SHA256 032450cd037d9e0eec49e0b4ff44073d539775633fb4af6fd76d4cb19116aac9
MD5 f311a8217807f6c85817058522e234a2
SHA1 ceb586b3cf7b0ee86ea8242d9b3d8641c9444cd1
SHA512 5ef1f6b595af9cc7f788680ac3f3e9b8b12baafe734a8e2f675baa57f5ef2c69806492911bda54f11c5a4b8cf3cced82cfc6e0ecf214e45083e9f9aa6a83d039
SSDEEP 3072:TS77Zz8NtrNOuJTaFs2VUXEWcyzvXqu5zDvJXYt:E7OrJOuJE4Xawqu5G
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScreenConnect.ClientService.dll

Path C:\Program Files (x86)\ScreenConnect Client (7e83ca7fd57c5b3c)\ScreenConnect.ClientService.dll
Size 66KB
SHA256 d17cf13612039f6a4ca17b56c32399ccbe279a499c8d2f8e910b1fd6f4fff2b1
MD5 3ff07c657068430ef677181d1f67066d
SHA1 37f7e9d2ccb65b4ea2733393015635ea1b43393e
SHA512 5552208b5649ceac2b32510ea12d409a85643d27e6a9c335e049195a507ae9211aee77574376fde059747998b60ae041e191635a67c3461585aba7f9b877b095
SSDEEP 1536:XxgIAw8rVbpcgOswatz8Bn2yRIZMmQ9VIlxnBVb8ER:Xw31b4f0Q9VAnNR
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScreenConnect.ClientService.exe

Path C:\Program Files (x86)\ScreenConnect Client (7e83ca7fd57c5b3c)\ScreenConnect.ClientService.exe
Size 93KB
SHA256 e54963cb63c9e471e2d3d59e55e4c7aeedccafdd616b99c4b3af230608e4bcc9
MD5 826314610d9e854477b08666330940b5
SHA1 65b601d60042cf6f263cd38ac2f63cd06a9de159
SHA512 5c01d6de25d60eb6b1eb72b7fa6401b71153c2a740c41aeeb2bd302cc4e80f5c1a388b647ee16da196705ac8edbc60abda49b9a531517bb85959cc018fb5d1fb
SSDEEP 1536:jg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgIU0HMm7/xK:MhbNDxZGXfdHrX7rAc6myJkgIU0HVY
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScreenConnect.WindowsAuthenticationPackage.dll

Path C:\Program Files (x86)\ScreenConnect Client (7e83ca7fd57c5b3c)\ScreenConnect.WindowsAuthenticationPackage.dll
Size 254KB
SHA256 a5b8f0070201e4f26260af6a25941ea38bd7042aefd48cd68b9acf951fa99ee5
MD5 5adcb5ae1a1690be69fd22bdf3c2db60
SHA1 09a802b06a4387b0f13bf2cda84f53ca5bdc3785
SHA512 812be742f26d0c42fdde20ab4a02f1b47389f8d1acaa6a5bb3409ba27c64be444ac06d4129981b48fa02d4c06b526cb5006219541b0786f8f37cf2a183a18a73
SSDEEP 3072:qJvChyA4m2zNGvxDd6Q6dtaVNVrlaHpFahvJ9ERnWtMG8Ff2lt9Bgcld5aaYxg:0IvxDdL6d8VNdlC3g0RCXh5D
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Program Files (x86)\ScreenConnect Client (7e83ca7fd57c5b3c)\ScreenConnect.WindowsClient.exe
Size 584KB
SHA256 316bbf433f1f803d113adf060c528ccc636656cee26b90f5fea011c1c73c7d16
MD5 ab5fa8d90645878d587f386d0e276c02
SHA1 a602a20735a1104851f293965f1fe4ab678bf627
SHA512 a181e23c8fa01bc1d9f0f9f95a5ca6112e2b61f34f4c1da696d3ccabbbd942bcc81a3f4a60921328a6020d28aed8711c22be33761cb685921d50fea8b1d7b986
SSDEEP 6144:0ya9pDzjhf+YMojz3cZRzyyUs0Ny2rOfQyEAlVw72191BVi1NnfEQcYF2/R4IrNC:jajDzNZFjLcZRzyyh5/EA3wv1lSYGXk
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Program Files (x86)\ScreenConnect Client (7e83ca7fd57c5b3c)\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
MD5 SHA1 SHA512

Submit Download

ScreenConnect.WindowsCredentialProvider.dll

Path C:\Program Files (x86)\ScreenConnect Client (7e83ca7fd57c5b3c)\ScreenConnect.WindowsCredentialProvider.dll
Size 822KB
SHA256 7a80e8f654b9ddb15dda59ac404d83dbaf4f6eafafa7ecbefc55506279de553d
MD5 be74ab7a848a2450a06de33d3026f59e
SHA1 21568dcb44df019f9faf049d6676a829323c601e
SHA512 2643d649a642220ceee121038fe24ea0b86305ed8232a7e5440dffc78270e2bda578a619a76c5bb5a5a6fe3d9093e29817c5df6c5dd7a8fbc2832f87aa21f0cc
SSDEEP 12288:q9vy8YABMuiAoPyEIrJs7jBjaau+EAaMVtw:P8Y4MuiAoPyZrJ8jrvDVtw
MD5 SHA1 SHA512 SSDEEP

Submit Download

system.config

Path C:\Program Files (x86)\ScreenConnect Client (7e83ca7fd57c5b3c)\system.config
Size 968B
SHA256 ab7f6abcdb327542fa97c88f40d9fad495b9929f6da3a25a27395d1c6279a6cd
MD5 9b02225b098cc9b0f8bf9ccd254ef862
SHA1 58fc87e5be79c0852eb569e3e6c3b612e55c69a1
SHA512 3961d9ffb56e8377fa59f2efe8dc0781fe9504f30f0b7055a2c43231b14ee3feb2742c5a45ee75f31cc002fe99dbbaabe7a996d6262a6edc7fd1141d9059b436
MD5 SHA1 SHA512

Submit Download

MSID09E.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSID09E.tmp
Size 1.1MB
SHA256 4da6c507c746cd07ca4546e723d0d145bbf4d26ff8de13f1a0750ef323a89a2e
MD5 845b0569d54305e62c6e8ffe198d217c
SHA1 cd06c3d1554fe08099ada4f4448a23a6422e6234
SHA512 af45bb8199f2af323b9954da0d11eed51459708608d356bc40bd9d9189c02c2c902f533077724dd7c6a7068e564b5c8f621ef1032098cef26ed26d5bf26e23fe
SSDEEP 24576:QUUGGVA5kuQ7Ye80NncfI59+5lwXoTl2cx:jGVyk7cer5IIvXobx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft.Deployment.WindowsInstaller.dll

Path C:\Users\Admin\AppData\Local\Temp\MSID09E.tmp-\Microsoft.Deployment.WindowsInstaller.dll
Size 172KB
SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
MD5 5ef88919012e4a3d8a1e2955dc8c8d81
SHA1 c0cfb830b8f1d990e3836e0bcc786e7972c9ed62
SHA512 4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684
SSDEEP 3072:FkfZS7FUguxN+77b1W5GR69UgoCaf8TpCnfKlRUjW01Ky4:x+c7b1W4R6joxfQE
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\MSID09E.tmp-\ScreenConnect.Core.dll
Size 533KB
SHA256 a843b3a4549c43ef5bd8470cacf5d2f0f3b3c8110441fcc10079facc7db3de29
MD5 3b1ba4bebefdc8a95b0f2f0b4e50c527
SHA1 15551d2e8bfb829f3a96d161b43de820c0d417ce
SHA512 f41595586cd5330537f5f02b392310b028e36f618e2583d125430ecd103ebbf6d2cf6befcfb1b32279eeb9fd7ef018f49131e3906fb61bc324da85d93a9a18c7
SSDEEP 6144:hAUz5UEsIXxk3QCLKSkGEexE77VcYbUinCLrDfElYzMsdqe1J6tMznSAiOUfw8qg:hK67tEshnkDfyt9MznZd8PTIP8
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScreenConnect.InstallerActions.dll

Path C:\Users\Admin\AppData\Local\Temp\MSID09E.tmp-\ScreenConnect.InstallerActions.dll
Size 21KB
SHA256 588d3a5e1b91d3756f74ea61c9c1b5f7871af924fab469cebb579f8aeb2fc135
MD5 9260afe4bbde2549fc0b92f657c2e50a
SHA1 5580778a62b06d7b56d3f788727514551de31647
SHA512 afce644ee04813e1e323b719e8ad3cfefe6e20ad0aa821f1325b8e0ae0144a7cff4e0f1f4b6f45df33f060392f94bcfd88d62b2218fd0bc573d65a20d80e968b
SSDEEP 384:SBHH+yElQjHVPioy4cDphaC/GeXczrMRbx1kjvdNU5yYoJ37dbr9DO:hrCtPcDCyXcMJ5yp7dbtO
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\MSID09E.tmp-\ScreenConnect.Windows.dll
Size 1.6MB
SHA256 a1edd67a131505cc84d76601474c53874a56b5437b835838e4a866e20f6cd264
MD5 d196174cf03f86c8776e717f07d5d19f
SHA1 bbd2c6a59229b3e4ec7c5742248f3f55a61dd216
SHA512 cf4d159bcb42a1a7ea03f8877736cace109ae79998906b9178c74f7a9b63030cddc2bc94ef6c5f718e99c2d0039cf3589f8c4f2bf5b67db94b3b96d2c988b45b
SSDEEP 24576:jQNtbLFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTs5:jebLJkGYYpT0+TFiH7efP
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.msi

Path C:\Users\Admin\AppData\Local\Temp\ScreenConnect\7e83ca7fd57c5b3c\setup.msi
Size 7.9MB
SHA256 c79948a91d94b8552371bc9bb45575bf8ae08910f735faa90f2178d59dc7f1e6
MD5 4b8d25395f763377e4bda5ef349e5fa3
SHA1 537ec47cb56c715d46679803a40a147991024679
SHA512 3d3a04b3e8e7d0d3f983e9a4fad679fec3bafa3a9585e7e082059c6c278ac939a0bc469f6ad3c298d6009ed07da0ece597daa3ce6a787972f13708c628425a71
SSDEEP 98304:YEnXkHywo+EVhaecMUzG4uc96ob2OEnXkHywo+EVhaecMUCEnXkHywo+EVhaecMM:zZs6Uruc9XbsZs6UJZs6UYZs6U
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSIBA4.tmp

Path C:\Windows\Installer\MSIBA4.tmp
Size 202KB
SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
MD5 ba84dd4e0c1408828ccc1de09f585eda
SHA1 e8e10065d479f8f591b9885ea8487bc673301298
SHA512 7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290
SSDEEP 3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
MD5 SHA1 SHA512 SSDEEP

Submit Download

cd15155f-2c1f-4936-9551-f12ba98513c8run.ps1

Path C:\Windows\TEMP\ScreenConnect\24.1.9.8915\cd15155f-2c1f-4936-9551-f12ba98513c8run.ps1
Size 861B
SHA256 d04e7e776ea28af69381e346a1bf86be5f5e4715003f7048783e7d1f049b1bd2
MD5 3df36fb3a469cfe6172a65ed8cf7c8f3
SHA1 93a2cae74fc883b88049c6c1f92bfd9a45b5881d
SHA512 f5bcf2bad11eab66815d3c525fcea7c0ad4b05f6f11c3bfc086e9893aff89a89cf113589a4ebc278baf4aa7ab55d554b2c5653092f30af90adb25749fe775a6f
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_anunmxqs.0os.ps1

Path C:\Windows\Temp\__PSScriptPolicyTest_anunmxqs.0os.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 88cc4f40f0eb08ff5c487d6db341b046cc63b22534980aca66a9f8480692f3a8
MD5 556084f2c6d459c116a69d6fedcc4105
SHA1 633e89b9a1e77942d822d14de6708430a3944dbc
SHA512 0f6557027b098e45556af93e0be1db9a49c6416dc4afcff2cc2135a8a1ad4f1cf7185541ddbe6c768aefaf2c1a8e52d5282a538d15822d19932f22316edd283e
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 9d5367afff64011b621c73c310c4b8bda206ec02726aadc0b17572d90888b25d
MD5 8e7a623fcc311b5017c82b1181911569
SHA1 048d36afc6481760c53cff348c05744d98f3cce7
SHA512 3848945ad50086a6af42f9640bcebf3fecac3d8a6f2012eeb786a2def1a68f94848350bfec9115687b98f4e0bba643e807fbf1efd715d676e0d634f158e5d231
MD5 SHA1 SHA512

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 23.7MB
SHA256 2bc4b39ec05341460955d8bf0f322bbf9179c79809ecae09d7bf08fe7d7a9dc2
MD5 739bf3b512d00607b985d0089e879acc
SHA1 b12ac450fc05476227060343c88745b1c709d727
SHA512 46fc361a782f8695c9340ac66842d030c8aa7de36be185fd408299c646fbd32c97dac0454fe3600ca483aa9f87c85dd4fe0f9a5946b9eacb62a23583be4410ee
SSDEEP 24576:oSqm41xpdoO/vvTLkYY+fHmYr7H56gaaczYdJDQWa2akZbU24RFXrqo9/:I
MD5 SHA1 SHA512 SSDEEP

Submit Download

{75857a26-368c-4a82-bd22-b1289e60aeb1}_OnDiskSnapshotProp

Path \??\Volume{9635fa43-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{75857a26-368c-4a82-bd22-b1289e60aeb1}_OnDiskSnapshotProp
Size 6KB
SHA256 10fc76942a9ea672888100f30d188289770561fd8412fb1c0c457b8b3cade01d
MD5 ab0e39db130b3ec208db527c639d786d
SHA1 c567df77cc7f0f92c6610afd1c485bb6c489ef95
SHA512 968ff42822374bfa2c1911ab97373771cab2634706330df3a6a39d2e55416e15357353a4907bfc5212a09089243eb04589a353af871cb41cf3f555d53e4de876
SSDEEP 96:FX+66ZbGLM4HZDD84LTHzbOHXOHBlBRQL8Sc9XE56tOSVQpuN:JpMIb++2VmN
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4060-175-0x0000013CFA8B0000-0x0000013CFA8D2000-memory.dmp

Download

memory/4332-135-0x0000000003E50000-0x0000000003F22000-memory.dmp

Download

memory/4332-130-0x0000000003B20000-0x0000000003B56000-memory.dmp

Download

memory/4332-131-0x0000000003C00000-0x0000000003C92000-memory.dmp

Download

memory/4332-133-0x0000000003B60000-0x0000000003BA1000-memory.dmp

Download

memory/4332-126-0x0000000003910000-0x0000000003960000-memory.dmp

Download

memory/4332-116-0x0000000003620000-0x0000000003638000-memory.dmp

Download

memory/4544-162-0x000000001B820000-0x000000001B9A6000-memory.dmp

Download

memory/4544-160-0x000000001B2A0000-0x000000001B32C000-memory.dmp

Download

memory/4544-161-0x000000001B4E0000-0x000000001B68A000-memory.dmp

Download

memory/4544-159-0x000000001AED0000-0x000000001AF06000-memory.dmp

Download

memory/4544-156-0x00000000003B0000-0x0000000000446000-memory.dmp

Download

memory/4544-164-0x000000001B230000-0x000000001B248000-memory.dmp

Download

memory/4544-163-0x00000000025C0000-0x00000000025D8000-memory.dmp

Download

memory/4952-45-0x00000000023C0000-0x00000000023CC000-memory.dmp

Download

memory/4952-53-0x0000000004A30000-0x0000000004BDA000-memory.dmp

Download

memory/4952-49-0x00000000047F0000-0x000000000487C000-memory.dmp

Download

memory/4952-41-0x0000000004730000-0x000000000475E000-memory.dmp

Download

memory/5036-6-0x00000000054B0000-0x00000000054D2000-memory.dmp

Download

memory/5036-1-0x0000000002E10000-0x0000000002E18000-memory.dmp

Download

memory/5036-3-0x00000000057B0000-0x0000000005AA4000-memory.dmp

Download

memory/5036-2-0x00000000747A0000-0x0000000074F50000-memory.dmp

Download

memory/5036-9-0x00000000747A0000-0x0000000074F50000-memory.dmp

Download

memory/5036-4-0x00000000747A0000-0x0000000074F50000-memory.dmp

Download

memory/5036-13-0x00000000747A0000-0x0000000074F50000-memory.dmp

Download

memory/5036-5-0x0000000005410000-0x000000000549C000-memory.dmp

Download

memory/5036-0-0x00000000747AE000-0x00000000747AF000-memory.dmp

Download

memory/5036-7-0x00000000054D0000-0x000000000567A000-memory.dmp

Download

memory/5036-8-0x0000000006060000-0x0000000006604000-memory.dmp

Download