082c34d5ff4cc9268a700a57b1c3604bf0051e09be704549bb18876e7047f28b

Analysis

max time kernel
149s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/06/2026, 12:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
_082c34d5ff4cc9268a700a57b1c3604bf0051e09be704549bb18876e7047f28b.exe
Size 305KB
Sample260623-p2t64acy8j
SHA256 082c34d5ff4cc9268a700a57b1c3604bf0051e09be704549bb18876e7047f28b
MD5 da6350db6be2cdc4ccdb5577e36f8b33
SHA1 f690480f7a7dd6b747aee36f2489601a80de501e
SHA512 eb373aa7eff1bfb17bdc0488b057b51753cc603880862eaa6605418de9c219c7f5d688adfbd7153abef08b046a1af0bc729aa239e7bf5a50bd2194f43b35c743
SSDEEP 6144:6mlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9:J1iw7gryNkSV1hy1Z1u2JLu9
TLSH
T189646D11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery revoked_codesign spyware trojan

Malware Config

Signatures

Downloads MZ/PE file 7 IoCs

flow	pid	Process
1	6412	dfsvc.exe
1	6412	dfsvc.exe
1	6412	dfsvc.exe
1	6412	dfsvc.exe
1	6412	dfsvc.exe
1	6412	dfsvc.exe
1	6412	dfsvc.exe

Manipulates Digital Signatures 1 TTPs 4 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C\Blob = 0300000001000000140000007b0f360b775f76c94a12ca48445aa2d2a875701c2000000001000000b4060000308206b030820498a003020102021008ad40b260d29c4c9f5ecda9bd93aed9300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3231303432393030303030305a170d3336303432383233353935395a3069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e6720525341343039362053484133383420323032312043413130820222300d06092a864886f70d01010105000382020f003082020a0282020100d5b42f42d028ad78b75dd539591bb18842f5338ceb3d819770c5bbc48526309fa48e68d85cf5eb342407e14b4fd37843f417d71edaf9d2d5671a524f0ea157fc8899c191cc81033e4d702464b38de2087d347d4c8057126b439a99f2c53b1ff2efcb475a13a64cb3012025f310d38bb2fb08f08ae09d09c065a7fa98804935873d5119e8902178452ea19f2ce118c21accc5ee93497042328ffbc6ea1cf3656891a24d4c8211485268de10bd14575de8181365c57fb24f852c48a4568435d6f92e9caa0015d137fe1a0694c27cc8ea1b32e6cac2f4a7a3030e74a5af39b6ab6012e3e8d6b9f731e1dcade418a0d8c1234747b3a10f6ea3ab6d9806831bb76a672dd2bd441a9210818fb03b09d7c79b325ac2ff6a60548b49c193ede1b45ce06feb26f98cd5b2f93810e6eace91f5bed3fb6f9361345cbc93452883362a66285fb073ce8b262506b283d45cf615194ced62e05e33f2e8e8ec0aa7b0032b91b23679bef7ad081e75a665ccbbe34850f377911afedb50a246c8615898f57c02163c8328ad3986ecd4b70d53d0f847e675308dec30937614a65b4b5d74614d3f129176debf58cb72102941f0d5c56d267668114113589adc262b01f4894d59db78cf814a3e40475fc98150738510232159608a6454c1cc211ae838197c661ccd78384530994fff634f4cbbaa0d0853417c583d47b3fab6ec8c320902cc6c3c0c56110203010001a38201593082015530120603551d130101ff040830060101ff020100301d0603551d0e041604146837e0ebb63bf85f1186fbfe617b088865f44e42301f0603551d23041830168014ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300e0603551d0f0101ff04040302018630130603551d25040c300a06082b06010505070303307706082b06010505070101046b3069302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304106082b060105050730028635687474703a2f2f636163657274732e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63727430430603551d1f043c303a3038a036a0348632687474703a2f2f63726c332e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63726c301c0603551d20041530133007060567810c01033008060667810c010401300d06092a864886f70d01010c050003820201003a23443d8d0876ee8fbc3a99d356e0021aa5f84834f32cb6e67466f79472b100caaf6c302713129e90449f4bfd9ea37c26d537bc3a5d486d95d53f49f427bb16814550fd9cbdb685e0767e3771cb22f75aaa90cff5936ae3eb20d1d55079889a8a8ac1b6bda148187edcd8801a111918cd61998156f6c9e376e7c4e41b5f43f83e94ff76393d9ed499cf4add28eb5f26a1955848d51afed7273ffd90d17686dd1cb0605cf30da8eee089a1bd39e1384eda6ebb369dfbe521535ac3cae96af1a23edb43b833c84f38149299f5ddce546dd95d02141f40337c03e295b2c221757352cb46d8c4341ca2a54b8dcd6f76372c853f1ace26e918be9007b0437f9588208270f0cccaeffd29355c1f893855f7378a8b09a1cb0be9311aff2e195c3971e1be9ca70a06d62667b792e64e5fde7aac49cf2ea47492addb3ca49c861fe3c1561b2b23ff8fb5ea887b706be6a0bafd3a3f45a6c4e81691528b41c048844b964dab4440e38df01528ceedf11856072a2f10c40c08643c338fae288c3ccb8f880b0dbf3bf4ce1e7b8eefb5ebcbb7f07713e6e7283fac12aea52f226c41f9825c1566cc6c0ecac586c3f626330c074ba0d307026a6a4030484b34a85120bbad1b8508e2590d6dca05502bea4a1c9ea5fda0a71f0674e7f2d65290fdaf854821f9573bb49c03ed8645f4b4616ebf68e2266086eac8afa9fe941de7631b3a8656784e	_082c34d5ff4cc9268a700a57b1c3604bf0051e09be704549bb18876e7047f28b.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4C2272FBA7A7380F55E2A424E9E624AEE1C14579\Blob = 0300000001000000140000004c2272fba7a7380f55e2a424e9e624aee1c145792000000001000000640700003082076030820548a00302010202100b9360051bccf66642998998d5ba97ce300d06092a864886f70d01010b05003069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e67205253413430393620534841333834203230323120434131301e170d3232303831373030303030305a170d3235303831353233353935395a3065310b30090603550406130255533110300e06035504081307466c6f72696461310e300c0603550407130554616d706131193017060355040a1310436f6e6e656374776973652c204c4c433119301706035504031310436f6e6e656374776973652c204c4c4330820222300d06092a864886f70d01010105000382020f003082020a0282020100ec489826d08d2c6de21b3cd3676db1e0e50cb1ff75ff564e9741f9574aa3640aa8297294a05b4db68abd0760b6b05b50ce92ff42a4e390be776a43e9961c722f6b3a4d5c880bcc6a61b4026f9137d36b2b7e9b86055876b9fa860dbcb164fe7f4b5b9de4799ae4e02dc1f0bee01e5d032933a2827388f8db0b482e76c441b1bd50909ef2023e1fb62196c994ce052266b28cd89253e6416044133139764db5fc45702529536bf82c775f9ec81fa27dc409530325f40cdef95b81b9ce0d42791cee72e7bd1b36c257b52257c65a28970e457513989434bfc239e2992b193e1b3cc3f11ccdd1d26d4ec9845099ab913906a42069af999c0071169b45a2ea1aa666f1904e8acb05e1823a359a291fd46b4ef7aed5935bb6ab17ebf077210726930c90f01761d6544a94e8fa614cc41d817eec734b1c3d3afb7c58fb256f0c09edc1459bddbff9940ed1958570265d67af79a9b6a16affd70fc6328c9810d5dc186e39af6fbcad49a270f237e6bcd5de0bc014bc3179cd79776591340311a42ca94f33416c2e01b59bd1d71de86ace6716bc90b2d7695d155039aa08fbac19a4d93fb784230a20a485287a16355645fc09142c602d140fa046b7bfd75328184ff7bdf8f9e0d65e6201c8d242931047f59bd328ac353777ccefa60408887b84fc3631301463461a1d73c0b5cc74d6d82905ddf923bdbab027a311cc38d3fa16f639a50203010001a382020630820202301f0603551d230418301680146837e0ebb63bf85f1186fbfe617b088865f44e42301d0603551d0e04160414338ce10a6e06d9c6ed0bc6cae736cefb8188646a300e0603551d0f0101ff04040302078030130603551d25040c300a06082b060105050703033081b50603551d1f0481ad3081aa3053a051a04f864d687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c3053a051a04f864d687474703a2f2f63726c342e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c303e0603551d20043730353033060667810c0104013029302706082b06010505070201161b687474703a2f2f7777772e64696769636572742e636f6d2f43505330819406082b06010505070101048187308184302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d305c06082b060105050730028650687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e637274300c0603551d130101ff04023000300d06092a864886f70d01010b050003820201000ad79f00cf4984864c8981ecce8718aa875647f6a74608c968e16568c7aa9d711ed7341676038067f01330c91621b27a2a8894c4108c268162a31f13f9757a7d6bb3c6f19bf27c3a29896d712d85873627d827cd6471761444fabf1d31e903f791143c5b4ce5e7444aacba36d759aeba3069d195226755cbc675aa747f77596c53c96e083c45bba24479d6845eea9f2b28ba29b4dcf0bcf14aa4ce176c24e2c1b8fec3ee16e1c086db6fda97388859e83be65c03f701395b78b842c6dd1533ef642cca6fe50f6337d3f2dfedd8b28f2b28e0c98edd2151392e7cc75489f48859f1de14c81b306eb50eed7bb78be30eaada76767c4ca523a11eec5a2372d6122926ab1801a6a6778e9504791487ee47d4577154988802070f80fc535957658f954cd083546c5afb5a6567b6761275f5db20f70ab86feef94c7cfc65369d325121b69a82399bc7dc1962416f0f05cf1eee64d495a3527e464e2c68da0187093f97b673e43dddbcc067e00713f1565fcff8c3772d44b40a04e600644f22a990345f9a6b5b52963e82c81a0ce91d43a230f67b37d8debda40ea3d59d305e18adc1976516c12a8ba2bca24143b12e9527b4dca58872aa9b3a8c6ac563fc2dc02bf51be889516d35a4ba9d062417b5bdcc50ba945fae26b60d6aec03984798a6a21d3ff793cc0849e81ed55b8027411c50db776ae8feef2fdc2dafb04345261dedc054	_082c34d5ff4cc9268a700a57b1c3604bf0051e09be704549bb18876e7047f28b.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C	_082c34d5ff4cc9268a700a57b1c3604bf0051e09be704549bb18876e7047f28b.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4C2272FBA7A7380F55E2A424E9E624AEE1C14579	_082c34d5ff4cc9268a700a57b1c3604bf0051e09be704549bb18876e7047f28b.exe

Signed with revoked ConnectWise certificate 4 IoCs

Binary is signed using a ConnectWise certificate revoked for key compromise.

revoked_codesign

resource	yara_rule
behavioral2/files/0x000c00000001c6d5-40.dat	revoked_cert_connectwise
behavioral2/files/0x000c00000001c6cf-195.dat	revoked_cert_connectwise
behavioral2/files/0x000c00000001c6d0-194.dat	revoked_cert_connectwise
behavioral2/files/0x000c00000001c6d4-190.dat	revoked_cert_connectwise

Executes dropped EXE 1 IoCs

pid	Process
4452	ScreenConnect.WindowsClient.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\194CB3ER.D6H\3Q5O9CWP.KXX\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	_082c34d5ff4cc9268a700a57b1c3604bf0051e09be704549bb18876e7047f28b.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dfsvc.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0002_none_d7fc40ef34cfa7c7\DigestMethod = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications\scre..tion_25b0fbb6ef7eb094_0019.0002_db1124d2b9f1fc21\identity = 687474703a2f2f3134342e3137322e3130352e32392f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\NonCanonicalData	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_25b0fbb6ef7eb094_0019.0002_38ae7f3ae0a289cc\pin!S_{3f471841-eef2-47d6-89c0-d028f03a4ad5}	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0019.0002_none_d7fc40ef34cfa7c7\implication!scre..tion_25b0fbb6ef7eb094_0019.0002_38a = 687474703a2f2f3134342e3137322e3130352e32392f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d819169b5504f\SizeOfStronglyNamedComponent = c04f040000000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_4b14c015c87c1ad8_0019.0002_none_41e6e31d258051c3	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0002_none_d7fc40ef34cfa7c7\DigestValue = 7aca9192a475179f4df8752ecd7eda05948dc6f4	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_4b14c015c87c1ad8_0019.0002_none_f33a7b65bb3fb52e\Files	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications\scre..tion_25b0fbb6ef7eb094_0019.0002_db1124d2b9f1fc21	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_4b14c015c87c1ad8_0019.0002_none_41e6e31d258051c3	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0019.0002_db1124d2b9f1fc21\scre..dows_4b14c015c87c1ad8_0019.0002_none_465ebafe61 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Installations	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000_Classes\Software	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_4b14c015c87c1ad8_0019.0002_none_41e6e31d258051c3\SizeOfStronglyNamedComponent = 3b7a080000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0019.0002_db1124d2b9f1fc21\scre..vice_4b14c015c87c1ad8_0019.0002_none_f33a7b65bb = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\VisibilityRoots	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_4b14c015c87c1ad8_0019.0002_none_f33a7b65bb3fb52e	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0019.0002_none_d7fc40ef34cfa7c7	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d819169b5504f\implication!scre..tion_25b0fbb6ef7eb094_0019.0002_38a = 687474703a2f2f3134342e3137322e3130352e32392f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0019.0002_db1124d2b9f1fc21\scre..core_4b14c015c87c1ad8_0019.0002_none_41e6e31d25	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_4b14c015c87c1ad8_0019.0002_none_465ebafe61ce64f3\Transform = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d819169b5504f\lock!06000000ffcc580e0c190000001700000000000000000000 = 30303030313930632c30316464303330656364313661633938	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_25b0fbb6ef7eb0 = 32003000320036002f00300036002f00320033002000310032003a00350030003a00320034000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_4b14c015c87c1ad8_0019.0002_none_41e6e31d258051c3\lock!1a000000cbcd580e64110000ac0400000000000000000000 = 30303030313136342c30316464303330656463326132376364	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_25b0fbb6ef7eb094_0019.0002_db1124d2b9f1fc21	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\Gi_scre..tion_25b0fbb6ef7eb094_9edfe039055229dd\LastRunVersion = 687474703a2f2f3134342e3137322e3130352e32392f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_25b0fbb6ef7eb0 = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000_Classes\Software\Microsoft\Windows\CurrentVersion	dfsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\ComponentStore_RandomString = "WHRLNK2Q7HDG8QNNGMM5W3AV"	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_4b14c015c87c1ad8_0019.0002_none_41e6e31d258051c3\identity = 53637265656e436f6e6e6563742e436f72652c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\Gc_scre..tion_1f8ebd92036502fc\LastRunVersion = 687474703a2f2f3134342e3137322e3130352e32392f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications\scre..tion_25b0fbb6ef7eb094_0019.0002_db1124d2b9f1fc21\HasRunBefore = 01	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d819169b5504f\lock!0100000044cc580e0c190000001700000000000000000000 = 30303030313930632c30316464303330656364313661633938	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_25b0fbb6ef7eb0 = 0000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0019.0002_none_d7fc40ef34cfa7c7	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0019.0002_db1124d2b9f1fc21	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_4b14c015c87c1ad8_0019.0002_none_41e6e31d258051c3\Files\ScreenConnect.Core.dll_b96889d378047e27 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_4b14c015c87c1ad8_0019.0002_none_f33a7b65bb3fb52e\lock!1c000000cbcd580e64110000ac0400000000000000000000 = 30303030313136342c30316464303330656463326132376364	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\F_scre..tion_25b0fbb6ef7eb094_676980738ef0415b	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d819169b5504f	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_25b0fbb6ef7eb094_0019.0002_none_2771bb27d0341a32	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_25b0fbb6ef7eb094_0019.0002_none_2771bb27d0341a32\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0002_none_d7fc40ef34cfa7c7\Files	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_4b14c015c87c1ad8_0019.0002_none_f33a7b65bb3fb52e\DigestValue = 27d351219ad62fc914c6c34eed8373fee6de294d	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_4b14c015c87c1ad8_0019.0002_none_465ebafe61ce64f3\SizeOfStronglyNamedComponent = 447e1a0000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_4b14c015c87c1ad8_0019.0002_none_f33a7b65bb3fb52e\lock!10000000ffcc580e0c190000001700000000000000000000 = 30303030313930632c30316464303330656364313661633938	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0019.0002_db1124d2b9f1fc21\SubstructureCreated = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}\scre..tion_25b0fbb6ef7eb0 = 3c004100700070006c00690063006100740069006f006e00540072007500730074002000760065007200730069006f006e003d002200310022000d000a00460075006c006c004e0061006d0065003d00220068007400740070003a002f002f003100340034002e003100370032002e003100300035002e00320039002f00420069006e002f00530063007200650065006e0043006f006e006e006500630074002e0043006c00690065006e0074002e006100700070006c00690063006100740069006f006e002300530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f007700730043006c00690065006e0074002e006100700070006c00690063006100740069006f006e002c002000560065007200730069006f006e003d00320035002e0032002e0034002e0039003200320039002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d0032003500620030006600620062003600650066003700650062003000390034002c002000700072006f0063006500730073006f0072004100720063006800690074006500630074007500720065003d006d00730069006c002f00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f007700730043006c00690065006e0074002e006500780065002c002000560065007200730069006f006e003d00320035002e0032002e0034002e0039003200320039002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d0032003500620030006600620062003600650066003700650062003000390034002c002000700072006f0063006500730073006f0072004100720063006800690074006500630074007500720065003d006d00730069006c002c00200074007900700065003d00770069006e003300320022000d000a00540072007500730074006500640054006f00520075006e003d002200740072007500650022000d000a0050006500720073006900730074003d002200740072007500650022003e000d000a003c00440065006600610075006c0074004700720061006e0074003e000d000a003c0050006f006c00690063007900530074006100740065006d0065006e0074002000760065007200730069006f006e003d002200310022003e000d000a003c005000650072006d0069007300730069006f006e00530065007400200063006c006100730073003d002200530079007300740065006d002e00530065006300750072006900740079002e005000650072006d0069007300730069006f006e0053006500740022000d000a00760065007200730069006f006e003d002200310022000d000a00490044003d00220043007500730074006f006d0022000d000a00530061006d00650053006900740065003d002200730069007400650022000d000a0055006e0072006500730074007200690063007400650064003d002200740072007500650022000d000a0078006d006c006e0073003a00610073006d00760031003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a00610073006d002e007600310022000d000a0078006d006c006e0073003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a00610073006d002e007600320022000d000a0078006d006c006e0073003a00610073006d00760032003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a00610073006d002e007600320022000d000a0078006d006c006e0073003a007800730069003d00220068007400740070003a002f002f007700770077002e00770033002e006f00720067002f0032003000300031002f0058004d004c0053006300680065006d0061002d0069006e007300740061006e006300650022000d000a0078006d006c006e0073003a0063006f002e00760031003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a0063006c00690063006b006f006e00630065002e007600310022000d000a0078006d006c006e0073003a00610073006d00760033003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a00610073006d002e007600330022000d000a0078006d006c006e0073003a0064007300690067003d00220068007400740070003a002f002f007700770077002e00770033002e006f00720067002f0032003000300030002f00300039002f0078006d006c006400730069006700230022000d000a0078006d006c006e0073003a0063006f002e00760032003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a0063006c00690063006b006f006e00630065002e007600320022003e000d000a003c0049005000650072006d0069007300730069006f006e00200063006c006100730073003d002200530079007300740065006d002e004e00650074002e005700650062005000650072006d0069007300730069006f006e002c002000530079007300740065006d002c002000560065007200730069006f006e003d0032002e0030002e0030002e0030002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d00620037003700610035006300350036003100390033003400650030003800390022000d000a00760065007200730069006f006e003d002200310022003e000d000a003c0043006f006e006e006500630074004100630063006500730073003e000d000a003c0055005200490020007500720069003d002200280068007400740070007c006800740074007000730029003a002f002f003100340034005c002e003100370032005c002e003100300035005c002e00320039002f002e002a0022002f003e000d000a003c002f0043006f006e006e006500630074004100630063006500730073003e000d000a003c002f0049005000650072006d0069007300730069006f006e003e000d000a003c002f005000650072006d0069007300730069006f006e005300650074003e000d000a003c002f0050006f006c00690063007900530074006100740065006d0065006e0074003e000d000a003c002f00440065006600610075006c0074004700720061006e0074003e000d000a003c004500780074007200610049006e0066006f00200044006100740061003d00220030003000300031003000300030003000300030004600460046004600460046004600460030003100300030003000300030003000300030003000300030003000300030003000430030003200300030003000300030003000350037003500330037003900370033003700340036003500360044003200450035003700360039003600450036003400360046003700370037003300320045003400360036004600370032003600440037003300320043003200300035003600360035003700320037003300360039003600460036004500330044003300340032004500330030003200450033003000320045003300300032004300320030003400330037003500360043003700340037003500370032003600350033004400360045003600350037003500370034003700320036003100360043003200430032003000350030003700350036003200360043003600390036003300340042003600350037003900350034003600460036004200360035003600450033004400360032003300370033003700360031003300350036003300330035003300360033003100330039003300330033003400360035003300300033003800330039003000350030003100300030003000300030003000330030003500330037003900370033003700340036003500360044003200450035003300360035003600330037003500370032003600390037003400370039003200450035003000360046003600430036003900360033003700390032004500340031003700300037003000360043003600390036003300360031003700340036003900360046003600450035003400370032003700350037003300370034003400350037003800370034003700320036003100340039003600450036003600360046003000310030003000300030003000300031003800370032003600350037003100370035003600350037003300370034003700330035003300360038003600350036004300360043003400390036004500370034003600350036003700370032003600310037003400360039003600460036004500300030003000310030003200300030003000300030003000300030003000420022002f003e000d000a003c002f004100700070006c00690063006100740069006f006e00540072007500730074003e000d000a000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d819169b5504f\Files\ScreenConnect.ClientService.exe_e781b1ee36 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_4b14c015c87c1ad8_0019.0002_none_f33a7b65bb3fb52e\Transform = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_4b14c015c87c1ad8_0019.0002_none_41e6e31d258051c3	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000_Classes\Software	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_25b0fbb6ef7eb0 = 30000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0019.0002_none_2771bb27d0341a32\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0019.0002_38ae7f3ae0a289cc\scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d819169 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d819169b5504f\Files	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0002_none_a32dbc410e6434d0\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe

Modifies system certificate store 2 TTPs 6 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4C2272FBA7A7380F55E2A424E9E624AEE1C14579\Blob = 0300000001000000140000004c2272fba7a7380f55e2a424e9e624aee1c145792000000001000000640700003082076030820548a00302010202100b9360051bccf66642998998d5ba97ce300d06092a864886f70d01010b05003069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e67205253413430393620534841333834203230323120434131301e170d3232303831373030303030305a170d3235303831353233353935395a3065310b30090603550406130255533110300e06035504081307466c6f72696461310e300c0603550407130554616d706131193017060355040a1310436f6e6e656374776973652c204c4c433119301706035504031310436f6e6e656374776973652c204c4c4330820222300d06092a864886f70d01010105000382020f003082020a0282020100ec489826d08d2c6de21b3cd3676db1e0e50cb1ff75ff564e9741f9574aa3640aa8297294a05b4db68abd0760b6b05b50ce92ff42a4e390be776a43e9961c722f6b3a4d5c880bcc6a61b4026f9137d36b2b7e9b86055876b9fa860dbcb164fe7f4b5b9de4799ae4e02dc1f0bee01e5d032933a2827388f8db0b482e76c441b1bd50909ef2023e1fb62196c994ce052266b28cd89253e6416044133139764db5fc45702529536bf82c775f9ec81fa27dc409530325f40cdef95b81b9ce0d42791cee72e7bd1b36c257b52257c65a28970e457513989434bfc239e2992b193e1b3cc3f11ccdd1d26d4ec9845099ab913906a42069af999c0071169b45a2ea1aa666f1904e8acb05e1823a359a291fd46b4ef7aed5935bb6ab17ebf077210726930c90f01761d6544a94e8fa614cc41d817eec734b1c3d3afb7c58fb256f0c09edc1459bddbff9940ed1958570265d67af79a9b6a16affd70fc6328c9810d5dc186e39af6fbcad49a270f237e6bcd5de0bc014bc3179cd79776591340311a42ca94f33416c2e01b59bd1d71de86ace6716bc90b2d7695d155039aa08fbac19a4d93fb784230a20a485287a16355645fc09142c602d140fa046b7bfd75328184ff7bdf8f9e0d65e6201c8d242931047f59bd328ac353777ccefa60408887b84fc3631301463461a1d73c0b5cc74d6d82905ddf923bdbab027a311cc38d3fa16f639a50203010001a382020630820202301f0603551d230418301680146837e0ebb63bf85f1186fbfe617b088865f44e42301d0603551d0e04160414338ce10a6e06d9c6ed0bc6cae736cefb8188646a300e0603551d0f0101ff04040302078030130603551d25040c300a06082b060105050703033081b50603551d1f0481ad3081aa3053a051a04f864d687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c3053a051a04f864d687474703a2f2f63726c342e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c303e0603551d20043730353033060667810c0104013029302706082b06010505070201161b687474703a2f2f7777772e64696769636572742e636f6d2f43505330819406082b06010505070101048187308184302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d305c06082b060105050730028650687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e637274300c0603551d130101ff04023000300d06092a864886f70d01010b050003820201000ad79f00cf4984864c8981ecce8718aa875647f6a74608c968e16568c7aa9d711ed7341676038067f01330c91621b27a2a8894c4108c268162a31f13f9757a7d6bb3c6f19bf27c3a29896d712d85873627d827cd6471761444fabf1d31e903f791143c5b4ce5e7444aacba36d759aeba3069d195226755cbc675aa747f77596c53c96e083c45bba24479d6845eea9f2b28ba29b4dcf0bcf14aa4ce176c24e2c1b8fec3ee16e1c086db6fda97388859e83be65c03f701395b78b842c6dd1533ef642cca6fe50f6337d3f2dfedd8b28f2b28e0c98edd2151392e7cc75489f48859f1de14c81b306eb50eed7bb78be30eaada76767c4ca523a11eec5a2372d6122926ab1801a6a6778e9504791487ee47d4577154988802070f80fc535957658f954cd083546c5afb5a6567b6761275f5db20f70ab86feef94c7cfc65369d325121b69a82399bc7dc1962416f0f05cf1eee64d495a3527e464e2c68da0187093f97b673e43dddbcc067e00713f1565fcff8c3772d44b40a04e600644f22a990345f9a6b5b52963e82c81a0ce91d43a230f67b37d8debda40ea3d59d305e18adc1976516c12a8ba2bca24143b12e9527b4dca58872aa9b3a8c6ac563fc2dc02bf51be889516d35a4ba9d062417b5bdcc50ba945fae26b60d6aec03984798a6a21d3ff793cc0849e81ed55b8027411c50db776ae8feef2fdc2dafb04345261dedc054	_082c34d5ff4cc9268a700a57b1c3604bf0051e09be704549bb18876e7047f28b.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C	_082c34d5ff4cc9268a700a57b1c3604bf0051e09be704549bb18876e7047f28b.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4C2272FBA7A7380F55E2A424E9E624AEE1C14579	_082c34d5ff4cc9268a700a57b1c3604bf0051e09be704549bb18876e7047f28b.exe
Key created	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C	_082c34d5ff4cc9268a700a57b1c3604bf0051e09be704549bb18876e7047f28b.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C\Blob = 0300000001000000140000007b0f360b775f76c94a12ca48445aa2d2a875701c2000000001000000b4060000308206b030820498a003020102021008ad40b260d29c4c9f5ecda9bd93aed9300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3231303432393030303030305a170d3336303432383233353935395a3069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e6720525341343039362053484133383420323032312043413130820222300d06092a864886f70d01010105000382020f003082020a0282020100d5b42f42d028ad78b75dd539591bb18842f5338ceb3d819770c5bbc48526309fa48e68d85cf5eb342407e14b4fd37843f417d71edaf9d2d5671a524f0ea157fc8899c191cc81033e4d702464b38de2087d347d4c8057126b439a99f2c53b1ff2efcb475a13a64cb3012025f310d38bb2fb08f08ae09d09c065a7fa98804935873d5119e8902178452ea19f2ce118c21accc5ee93497042328ffbc6ea1cf3656891a24d4c8211485268de10bd14575de8181365c57fb24f852c48a4568435d6f92e9caa0015d137fe1a0694c27cc8ea1b32e6cac2f4a7a3030e74a5af39b6ab6012e3e8d6b9f731e1dcade418a0d8c1234747b3a10f6ea3ab6d9806831bb76a672dd2bd441a9210818fb03b09d7c79b325ac2ff6a60548b49c193ede1b45ce06feb26f98cd5b2f93810e6eace91f5bed3fb6f9361345cbc93452883362a66285fb073ce8b262506b283d45cf615194ced62e05e33f2e8e8ec0aa7b0032b91b23679bef7ad081e75a665ccbbe34850f377911afedb50a246c8615898f57c02163c8328ad3986ecd4b70d53d0f847e675308dec30937614a65b4b5d74614d3f129176debf58cb72102941f0d5c56d267668114113589adc262b01f4894d59db78cf814a3e40475fc98150738510232159608a6454c1cc211ae838197c661ccd78384530994fff634f4cbbaa0d0853417c583d47b3fab6ec8c320902cc6c3c0c56110203010001a38201593082015530120603551d130101ff040830060101ff020100301d0603551d0e041604146837e0ebb63bf85f1186fbfe617b088865f44e42301f0603551d23041830168014ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300e0603551d0f0101ff04040302018630130603551d25040c300a06082b06010505070303307706082b06010505070101046b3069302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304106082b060105050730028635687474703a2f2f636163657274732e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63727430430603551d1f043c303a3038a036a0348632687474703a2f2f63726c332e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63726c301c0603551d20041530133007060567810c01033008060667810c010401300d06092a864886f70d01010c050003820201003a23443d8d0876ee8fbc3a99d356e0021aa5f84834f32cb6e67466f79472b100caaf6c302713129e90449f4bfd9ea37c26d537bc3a5d486d95d53f49f427bb16814550fd9cbdb685e0767e3771cb22f75aaa90cff5936ae3eb20d1d55079889a8a8ac1b6bda148187edcd8801a111918cd61998156f6c9e376e7c4e41b5f43f83e94ff76393d9ed499cf4add28eb5f26a1955848d51afed7273ffd90d17686dd1cb0605cf30da8eee089a1bd39e1384eda6ebb369dfbe521535ac3cae96af1a23edb43b833c84f38149299f5ddce546dd95d02141f40337c03e295b2c221757352cb46d8c4341ca2a54b8dcd6f76372c853f1ace26e918be9007b0437f9588208270f0cccaeffd29355c1f893855f7378a8b09a1cb0be9311aff2e195c3971e1be9ca70a06d62667b792e64e5fde7aac49cf2ea47492addb3ca49c861fe3c1561b2b23ff8fb5ea887b706be6a0bafd3a3f45a6c4e81691528b41c048844b964dab4440e38df01528ceedf11856072a2f10c40c08643c338fae288c3ccb8f880b0dbf3bf4ce1e7b8eefb5ebcbb7f07713e6e7283fac12aea52f226c41f9825c1566cc6c0ecac586c3f626330c074ba0d307026a6a4030484b34a85120bbad1b8508e2590d6dca05502bea4a1c9ea5fda0a71f0674e7f2d65290fdaf854821f9573bb49c03ed8645f4b4616ebf68e2266086eac8afa9fe941de7631b3a8656784e	_082c34d5ff4cc9268a700a57b1c3604bf0051e09be704549bb18876e7047f28b.exe
Key created	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4C2272FBA7A7380F55E2A424E9E624AEE1C14579	_082c34d5ff4cc9268a700a57b1c3604bf0051e09be704549bb18876e7047f28b.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\194CB3ER.D6H\3Q5O9CWP.KXX\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe
File created	C:\Users\Admin\AppData\Local\Apps\2.0\56O3YRZ3.CDE\Z5KEA6ZK.YDH\scre..ient_4b14c015c87c1ad8_0019.0002_none_a32dbc410e6434d0\ScreenConnect.WindowsClient.exe\:Zone.Identifier:$DATA	dfsvc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	6412	dfsvc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 6692 wrote to memory of 6412	6692	_082c34d5ff4cc9268a700a57b1c3604bf0051e09be704549bb18876e7047f28b.exe	89
PID 6412 wrote to memory of 4452	6412	dfsvc.exe	90

C:\Users\Admin\AppData\Local\Temp\_082c34d5ff4cc9268a700a57b1c3604bf0051e09be704549bb18876e7047f28b.exe
"C:\Users\Admin\AppData\Local\Temp\_082c34d5ff4cc9268a700a57b1c3604bf0051e09be704549bb18876e7047f28b.exe"
1⤵
- Manipulates Digital Signatures
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:6692
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
  2⤵
  - Downloads MZ/PE file
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:6412
- - C:\Users\Admin\AppData\Local\Apps\2.0\56O3YRZ3.CDE\Z5KEA6ZK.YDH\scre..tion_25b0fbb6ef7eb094_0019.0002_db1124d2b9f1fc21\ScreenConnect.WindowsClient.exe
    "C:\Users\Admin\AppData\Local\Apps\2.0\56O3YRZ3.CDE\Z5KEA6ZK.YDH\scre..tion_25b0fbb6ef7eb094_0019.0002_db1124d2b9f1fc21\ScreenConnect.WindowsClient.exe"
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    PID:4452

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d819169b5504f.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\56O3YRZ3.CDE\Z5KEA6ZK.YDH\manifests\scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d819169b5504f.cdf-ms
Size 24KB
SHA256 a460e9f91b3da9e60147f1ef58e3204e987124635a33323ebd4ee27441e8feea
MD5 a43b6c9c1799cc5557adb120f878c969
SHA1 c457b812c6923f546a3ee73cb89b7aa9e465f809
SHA512 445b9da65291d7e464813af9b263b1fa15940373f0b58c5d47c0ec23dbe998ffa0a9bdc284bfd3d9cd29f454e767959fb2f6125008c93acea24c6219e7aa1aa9
SSDEEP 384:bJq0GFGTf6vNX95ZgMacc5X9R/QPIBM7YV+++amtfU:b40Bf61X95+yc5X9R/QPI+0V+++amts
TLSH
T196B26E01BBE1E923D1466733DCE6C3E57236FD924F92179B70023B2EA9703D95A32685
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..core_4b14c015c87c1ad8_0019.0002_none_41e6e31d258051c3.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\56O3YRZ3.CDE\Z5KEA6ZK.YDH\manifests\scre..core_4b14c015c87c1ad8_0019.0002_none_41e6e31d258051c3.cdf-ms
Size 3KB
SHA256 7a0071fe77c2c1c96bd9aebe1107c52298f540a3b96d7f64fa77a2373fd26d02
MD5 328e2034ba8240f4734eed4f9460167f
SHA1 1d7f5406664df9b4c6759a91482a16ac2551c6de
SHA512 36a40b07f9e1f32ad8ac6b42f75319689cfb1b64e9a7882bb2a551f0f3aebe6d029f45730424976431ec4ded3d19dab8a354df1a3cb5c02efcc709c2c1f67de4
TLSH
T1C1615307B208DA03D97D06326CE1D6EF7B683E43DE85910BB0C0377F3A325E65611256
MD5 SHA1 SHA512 TLSH

Submit Download

scre..dows_4b14c015c87c1ad8_0019.0002_none_465ebafe61ce64f3.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\56O3YRZ3.CDE\Z5KEA6ZK.YDH\manifests\scre..dows_4b14c015c87c1ad8_0019.0002_none_465ebafe61ce64f3.cdf-ms
Size 5KB
SHA256 7fa6cfba43dcb5c4cb480c141b348ad80ac2e8207736307e2af69b90cff75ba7
MD5 3be83de12e6be6761ebdd5895ce4f397
SHA1 df04c330f4e1973ccbef3f5a44d61872b4d691ee
SHA512 1a58e1e26f0b8162f96dfb78ec9dc0c7cdfdc34c5a516e813022a9466ecce82039dcb2bb020fa5d6c0653ca9d291ed401ac5bae6f2ccf2015a74710133331539
SSDEEP 96:8E4+RzgTheV+Ww7uk/WGgyHmzSNp9QHAzjrwKwnANb6F:tRzgiJgOMrvOALwFAMF
TLSH
T105B1EF117304D917D5B906339CA9C3EE2B687D93CE82460B70D8BF6F7A326FA4721295
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_4b14c015c87c1ad8_0019.0002_none_a32dbc410e6434d0.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\56O3YRZ3.CDE\Z5KEA6ZK.YDH\manifests\scre..ient_4b14c015c87c1ad8_0019.0002_none_a32dbc410e6434d0.cdf-ms
Size 6KB
SHA256 eecebe4f3a469b21e822a5b678888cec408174df212da3915743089e8cd4bdb0
MD5 80a94631ee524507f3ea23f4a5d111ca
SHA1 1a797a201febbeb32f43d61ec3b5bbd338e96ccc
SHA512 8840c26fcf2e43e36ae96e381cd78111f5436b542be480b308f3d2a1d68a0d5c48f6f35331add6b347f62d44c4e7bc06e3be8192b68c5a48254054fa82359a67
SSDEEP 96:ZmQPPypJEeV+Wwws8WihX2d1CkMK2jKks6b/DrK:/PPaJoihmdYjpLzK
TLSH
T182D1A812B354EA53D6A906339C9BD2DD26347E86DF42570730C4BF2F7A323AB1B21195
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_4b14c015c87c1ad8_0019.0002_none_d7fc40ef34cfa7c7.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\56O3YRZ3.CDE\Z5KEA6ZK.YDH\manifests\scre..ient_4b14c015c87c1ad8_0019.0002_none_d7fc40ef34cfa7c7.cdf-ms
Size 2KB
SHA256 222b07f66b772eb884bbfc805c53391db76242857dab6a2b87f100989751f822
MD5 02d6569bd28e4325e0532a486674cc6c
SHA1 01a11ae1f178a761f398a2f847c942f7d8f03d17
SHA512 78e7e013a4dae6b560e499c23eb45704e7c68f8f85da66b29774befed0207ad73a3f7640b22235aa1135a6b866856dbc44938a50dc23a79ebefbf758549dbbe3
TLSH
T10F51DD057648EA67D67A0633AC95C2DA72357D82DF460707B1C07FBF3A357D58B220A2
MD5 SHA1 SHA512 TLSH

Submit Download

scre..tion_25b0fbb6ef7eb094_0019.0002_none_2771bb27d0341a32.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\56O3YRZ3.CDE\Z5KEA6ZK.YDH\manifests\scre..tion_25b0fbb6ef7eb094_0019.0002_none_2771bb27d0341a32.cdf-ms
Size 14KB
SHA256 999b8b78dee55a12347dc956141589383677ffe9c17932f04630e1313ed93365
MD5 19f12562999d4caddbe48814854da7ec
SHA1 c404693726dfd4c8d51dd88afd1196c22adc446c
SHA512 dfa758ba0351d5fbba151d88124f24ceaac019775795c2851c3112c3740e0484234fa2fe1dbbdc3b3949a919c77d3723be96650140b9c4c806217bbc5e91da9a
SSDEEP 192:39HJ9rw6GSR0a8s8oeR06pRm+N8s8oTN2x2QPIlFDLhEDh7BqWoKzJ:39p9rw6t1X9chRRX9R/QPIBM7YK9
TLSH
T18C6218803B50EA13C1169733DDE6C7E13778BE934ED2879F74427B1F6878B849622692
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..vice_4b14c015c87c1ad8_0019.0002_none_f33a7b65bb3fb52e.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\56O3YRZ3.CDE\Z5KEA6ZK.YDH\manifests\scre..vice_4b14c015c87c1ad8_0019.0002_none_f33a7b65bb3fb52e.cdf-ms
Size 4KB
SHA256 0e131893e08ca66a495c5d24e8be66e4055c6940e03c2d59e5d55c2ba8818e45
MD5 53a72bd19305cdd6aa0d38920aa8050a
SHA1 f57e58721d1e40fa24b89fc6068ca9f2c02f930b
SHA512 d60a80a69ecbcaf70956afa1b645fc32b383a6e1e7cdbbe510f952cd4f7845cff33998527149b7d4b720126571942a27eab3958ba53bc439761d995ba961cf13
SSDEEP 48:S/CDvx+dgJe6S+9ow87gnW75uvs/vObV42cAvf1fTO5cTyA9UZCf:S/SeV+Ww8s45ueO22cAvFTOOTyOZf
TLSH
T10B9154117280ED66D6A90633DCD6C2DD3A76BD82DF43070BB0C4BB2F76712DA5722196
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0ycc1qat.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\56O3YRZ3.CDE\Z5KEA6ZK.YDH\scre..tion_25b0fbb6ef7eb094_0019.0002_db1124d2b9f1fc21\0ycc1qat.newcfg
Size 564B
SHA256 49b537424107b002e55dee26c1c9e2d80cf0edefdc2692ee95574edd3d41b563
MD5 ad636caaf2d82baf81118923b879e042
SHA1 a0555839d6457ece2b78b83bc270b93532878f77
SHA512 0f0880566ff6c770a7410d1cc968233bf02e3b8e007bba2a544bacb388986a21fa40053c9ca0b348e3ac618a90f4738d6e125cf6a9a9aeaa6b3b9ab0f4ccf330
TLSH
T108F024A530806E5A07B36E23C5114740FE721B9B046611D878AF613BAF305DB07B32EA
MD5 SHA1 SHA512 TLSH

Submit Download

1ks3tnvv.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\56O3YRZ3.CDE\Z5KEA6ZK.YDH\scre..tion_25b0fbb6ef7eb094_0019.0002_db1124d2b9f1fc21\1ks3tnvv.newcfg
Size 564B
SHA256 1113e4b854e9207051ee32a7cda966f7604b6421c826ee0674cd1103d8fe62b8
MD5 4e5c381760abed0fc5de2306cb025ca9
SHA1 ca2a876aa11b484b3aea242aa97a3a7cc7414142
SHA512 d57dc69f91b9e75bbc1a36e38d6980f0289137497fb92c8cd05ded8e4076d463b1a7b60754f00e72085cca4ca51e48873d88c7d757b1188e20c0522d8c6ea1e4
TLSH
T1D4F02BA530806E5A0BB31D23C5114740FE711B9B149620D874AF61779F301DB07B32DA
MD5 SHA1 SHA512 TLSH

Submit Download

app.config

Path C:\Users\Admin\AppData\Local\Apps\2.0\56O3YRZ3.CDE\Z5KEA6ZK.YDH\scre..tion_25b0fbb6ef7eb094_0019.0002_db1124d2b9f1fc21\app.config
Size 1KB
SHA256 e2b60a8b4d858a47d7f05da551fe8ecb757a06e2c9364eb68c194863ac3ed47e
MD5 4fb7df1fe20d27251ac10a36c26d1d6a
SHA1 fdd466ff7b3d67c050d066ad6873de524cf85f2e
SHA512 f3bf98b73781884d16d94e73989f54a65902784e8114308c60cccb3ecceff82510a1813a2a2864de995924429ca49e4ecfeb7678adafd77fd42dfffd6a181415
TLSH
T16B41800DB5C0AF9911A26735E63112C1EC70492312A6F0E478DE31679F70BCA5AF32EA
MD5 SHA1 SHA512 TLSH

Submit Download

bhuxzsij.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\56O3YRZ3.CDE\Z5KEA6ZK.YDH\scre..tion_25b0fbb6ef7eb094_0019.0002_db1124d2b9f1fc21\bhuxzsij.newcfg
Size 564B
SHA256 b748e1ae7cc2d1308a359921b227af7ef8b89f3f2fa2bcace95afc3363a8d6c5
MD5 c90f19a1123e5c7aa3766a347572be26
SHA1 a2242c561474d6645f5a85216d8c039c90bc6831
SHA512 961c8df94ad11cb92f1112a1ab7714eea50fc67435e085608d91ae226223fa6764731ebec8d4e3d5d19caf7f4614952ca51f3202500cbb7d707410a9307251e0
TLSH
T1F6F02BA530806E5A07B36D23C5114740FE711B9B145610D874AF61379F301DB07B32EA
MD5 SHA1 SHA512 TLSH

Submit Download

bm4nzifb.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\56O3YRZ3.CDE\Z5KEA6ZK.YDH\scre..tion_25b0fbb6ef7eb094_0019.0002_db1124d2b9f1fc21\bm4nzifb.newcfg
Size 564B
SHA256 a803165c0317ee6d0e7ad06f9f671632c3940c621e9f05c640fc7b2652623b52
MD5 2dcec9cb159a1cd278c62d12db46237b
SHA1 2ebe3e460cfa6fd0c6b18cfd28eba9ca2116b70e
SHA512 926ef4fc3bb3c765efcf78c6418a571b48c742d92ad8d795110772675b9abd7df131c617fc42becd15e79c9107ae134e2fa82db3cfe2eafd5d77454fc5ac58b5
TLSH
T18AF024A530806E5A07B36E23C5114740FE721B9B046610D878AF617BAF305DB07B32EA
MD5 SHA1 SHA512 TLSH

Submit Download

ij3wryks.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\56O3YRZ3.CDE\Z5KEA6ZK.YDH\scre..tion_25b0fbb6ef7eb094_0019.0002_db1124d2b9f1fc21\ij3wryks.newcfg
Size 564B
SHA256 e151fa40fb4c8d97a3cc3af5c7c5ce1f587635a4255a7ab97a0bf49f208d35d8
MD5 be04db08c0a982df1ed8bc288bf38c84
SHA1 b5e0349bca175af3af2cbe4dfb539dc1dae12a2d
SHA512 b0d4949d9b875fa5f8ace83cfd3c29574bce2773bd380d778befe328218fa41745c8126a4596d8f957619110815a85a3cb6873ea504bafca6548f23ad951f560
TLSH
T11AF024A530806E5A07B36E23C5114740FE721B9B086610D878AF613BAF305EB07B32EA
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Users\Admin\AppData\Local\Apps\2.0\56O3YRZ3.CDE\Z5KEA6ZK.YDH\scre..tion_25b0fbb6ef7eb094_0019.0002_db1124d2b9f1fc21\user.config
Size 564B
SHA256 63574e175fe58c34f3dae183a86f731e29a57884ff98077252c38bfb482c309f
MD5 c2c277f2914cd79be651a9325480d574
SHA1 354cbe4ace88baae7c1016e9c88627d0daa8b98b
SHA512 5dfbb5a227077ad25988e88ad01290843d55aa95dfc6750d841f62735b3a835ff394511aee577b2ff43815eb08672a60fa6e46ccd745c9184fb455c368cf67c3
TLSH
T1B3F024A530806E5A07B36E23C5114744FE721B9B046610D878AF617BAF305DB07B32DA
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Users\Admin\AppData\Local\Apps\2.0\56O3YRZ3.CDE\Z5KEA6ZK.YDH\scre..tion_25b0fbb6ef7eb094_0019.0002_db1124d2b9f1fc21\user.config
Size 564B
SHA256 520edae43a82f4303d938c109ff18100b6c8278a01144ab46272574cb17776c2
MD5 e1c5effefd81a9f93e435e0da5b96086
SHA1 e90486d7c8dd19e194e9c6f30fb7f17440daddc2
SHA512 e2fca1652fcdd73e0b29a3ac32e736035e658af7d6647017a5d04c970f2e5548d89ac3300c94951cde0497c5ac33f3f88da1b73a989cd3dd93070617097d43e0
TLSH
T17FF02BA530806E5A0BB31D23C5114744FE711B9B145610D878AF61379F301DB07B32DA
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Users\Admin\AppData\Local\Apps\2.0\56O3YRZ3.CDE\Z5KEA6ZK.YDH\scre..tion_25b0fbb6ef7eb094_0019.0002_db1124d2b9f1fc21\user.config
Size 564B
SHA256 309b7095cd14a1df73bb50d10527655afbfef50033d19a7c6cf86b32e6ac5f85
MD5 4b4a78cbbd77bdd41ecdb32365191f8c
SHA1 370c1c08be8df76fbc13b4bc665e98d10a28bdc6
SHA512 8dff5bbd306ec829ca37bad616b1f49839d442251137529572f56dd91758bd76ffb4114cb674f3e6058395b38f3491bf9a14b0a889394d42970d246fc086a0df
TLSH
T1E4F024A53080AE5A07B36E23C5114744FE721B9B046610D878AF617BAF301DB07B32DA
MD5 SHA1 SHA512 TLSH

Submit Download

uu3cmtge.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\56O3YRZ3.CDE\Z5KEA6ZK.YDH\scre..tion_25b0fbb6ef7eb094_0019.0002_db1124d2b9f1fc21\uu3cmtge.newcfg
Size 564B
SHA256 b241ddf9d061c09ce8c19741dfa069e4ba94fa3d277b0a7baff0815f10d80595
MD5 ded6e47802f09c82539be0210076c956
SHA1 b9c0592f935d0000217247103b2513fbbb469e4f
SHA512 8497ff78cdb4b09645d89bc3b0566eaee3b6256b347d2769888c8c7d1bc36837fd7348b575cb54e149d5e4246e863b6ea240f7265190787a5d2742f572fbe560
TLSH
T1C9F024A530816E5A07B32E23C5114740FE721B9B046611D878AF613BAF305DB07B32DA
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Client.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\194CB3ER.D6H\3Q5O9CWP.KXX\ScreenConnect.Client.dll
Size 192KB
SHA256 6526705b685c2f221a6675118c73cba98c47d948169d81ea4544c3e3336b8f2b
MD5 7ee2543520d72fd54827f3d11a21ef8d
SHA1 7aca9192a475179f4df8752ecd7eda05948dc6f4
SHA512 a0c65c11ce979cd4142439b64bb5e029a8bde9f2584d51de0231ea6a88aae960e00f3097b1e51847496824a1a76baa99f9fbacb67565704b262c5483bee5b91a
SSDEEP 3072:FxLtNGBlIyS7/OvjusqVFJRJcyzvYqSmzDvJXYA:ftNGBGySavqPJYnqSmG
TLSH
T122144B8633A94E36DA9F5D73B46060358AB5ED066023E3EE5E04F9F61A733408E553E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\194CB3ER.D6H\3Q5O9CWP.KXX\ScreenConnect.Client.dll.genman
Size 1KB
SHA256 948596c07ffcd2ad7c1463894ac108ee05507def70f8a4a97d75a7081266b512
MD5 fc8201e1d21fe244575d479a20a1ed6b
SHA1 cb68303ca575d5b11e5edeb99bcbe9e273f756ab
SHA512 fe324b0a8a482181bbf9e19c4c680d7749c933db201b497d3b599d8ec6c5e3d7c521d487ef7ae4f815ad7f67661871d67f4529452069c3893dad408782279d9f
TLSH
T169117B1581C8FE261F3301D1BEE7E021576D2B37058D194BB0696DAF8B2DAE6434B1B3
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\194CB3ER.D6H\3Q5O9CWP.KXX\ScreenConnect.ClientService.dll
Size 66KB
SHA256 319ba24115e64ea4b714caf4e88d3d5a658defd51d714c2291b9758466925281
MD5 5d4be679ad5c4bfb5144f381d3308ab3
SHA1 27d351219ad62fc914c6c34eed8373fee6de294d
SHA512 e9b07fc27078bb8c706f970120304b816ad5c0eb5a967371f76de42edd397b5b6b5faf9645eed707584a1e1175406958a8daf4b65d20c2cf7aadaddaff1166c9
SSDEEP 768:c3gaRdcdsmzKWOWXlhh6Eg/6QhvoTVcV7K0c4RelfyQFVFlCtskxZgVfS8EX8bED:tCsKWOGmEgLhvoTVF0JJQFVFlPasbg
TLSH
T1B0633B06E3F98A7BC9DF5F7878B5B0450EB08A02E062FB989CC9A5D71B537C119053A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\194CB3ER.D6H\3Q5O9CWP.KXX\ScreenConnect.ClientService.dll.genman
Size 1KB
SHA256 7ba2e686afa757becaec5216ddbc0be75d7d30f9af8233e9160d200efec8aa0f
MD5 df3caec93ec7639a949601f4decef22e
SHA1 5694cd8580d47de4a1406d97794b621c18ac5314
SHA512 21a4e549f554b4270fb0d65636a0fe89604f2c1e8bb97c741c79e40436139fbd35aa18535c8ccc966beba37ebb140f46e4c7a2a401c9906e68fecfdaf549af82
TLSH
T1FF31E71681C8FA251F3302C1BEE7E0619BAD1B33158E1947B05D599B8F2DAA6434B1B3
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\194CB3ER.D6H\3Q5O9CWP.KXX\ScreenConnect.ClientService.exe
Size 93KB
SHA256 f048400c23add8c75abe189393d33c873c02c74eeaf43d47b950c8d643763b35
MD5 752d5cdda2a1d93d27e38f98a5d23fc2
SHA1 d4fd4ff0709271323b8d401579270e6567b6e360
SHA512 f48a21229a8d8cc80371e9aeeb47bb10ff0f3b0363e854ca30db833c74519d37ee21349fa9201c7ed5392ddf5d0ff2a66d250821d109dc0ac7425ab2a5a3fea2
SSDEEP 1536:wg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgUU0HMQ7oOgU:ZhbNDxZGXfdHrX7rAc6myJkgUU0HvMU
TLSH
T1E8935B13B5C28872D473093158E0DAB49A3FF9215E61DEAB3798022E4F741C1AE75EB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\194CB3ER.D6H\3Q5O9CWP.KXX\ScreenConnect.Core.dll
Size 538KB
SHA256 b8100e5ab07983cbf82d721cf719576ca3f60e352628dcaabd42d428011fdedf
MD5 1db8b9fa0bdcbfaab807f715c288c19a
SHA1 fde73710ce063bbf1e377c02a1a8615cf4da1c08
SHA512 fc132764026c682e8fac1a97171731d54880c8d95566c486c731c880e750a29875ac208fb4b4dc2897dfc49beb24f77af016d846c78be75df159d3542600eb73
SSDEEP 6144:SfoUrkyyvsbvpSLmwJUoqnoezGMZf1y99tg03Xdedu1h+xE5vce/6OdCatxq/trJ:SfpkywYszKoIzGafzece/6yx/Oek
TLSH
T144C47D9233B48B2FCABF5B7BE42454980770E901F209EB5B1AD6D4BC5F633854E412E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\194CB3ER.D6H\3Q5O9CWP.KXX\ScreenConnect.Core.dll.genman
Size 1KB
SHA256 1008e0a6ce99adf165f8e173dcd4bb5e0761673aa9c3150f5e010f03d0f6434b
MD5 de014337ef7ec5fbb5e71663889cd9ec
SHA1 be9867f2b5340aa9d59177c1f92235a1f32b0ec6
SHA512 8ab08a2f084602135ec098ecacae8f2ab401b5d655e8f98423119f3ce32e28cdd96725feb4586733db1582ed418d9aede9935338fbf83018e6232271fa22a86a
TLSH
T18F21671181C8FA261F3302D2BEE7E42197AE5B33188D194B7469699FCB2DAD64747073
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\194CB3ER.D6H\3Q5O9CWP.KXX\ScreenConnect.Windows.dll
Size 1.6MB
SHA256 da29455a64858fda773319c32c0a6cd40edbe8042ed005aa2befb8a4f0fb0522
MD5 94216eb90ca53fbb175f0ee6adbfb663
SHA1 48038f060a5042ff44a2d9a9be46368ecc8436fd
SHA512 c6c7e2a63eaccc5703acf4cb482a9e441fb6e670a9086d3ade558a597b1fd6c17f5e5b7027d835b80ebf2c071f9442bde466f313ddb8456fe0d3e4db6d53b041
SSDEEP 24576:VDhFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUTHs:VDhJkGYYpT0+TFiH7efP
TLSH
T14B85BD41E2D364F5D46B047888BF571ABA743C040325CAFB97D4AE3A6D33BC09A36796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\194CB3ER.D6H\3Q5O9CWP.KXX\ScreenConnect.Windows.dll.genman
Size 1KB
SHA256 74bc77d4a907113ee17339077cf42d4919a3d02987325a5fd5608a43f65e60c2
MD5 e800d9b7ccfd86983e809fb76068b9e4
SHA1 f4a6c5d027b144b81d51ce5453f0c39ee1bcc7b7
SHA512 29fe2bf5c4d514b4980a13442647cc988b5b8b869e8dff35ad9d86d95983f3135d5df0c46eee88cd1edd0ce4e79864761f9d600b0d267d10025f660e0a848452
TLSH
T18641E11681C8EA250F3301C2BEEBE431879A5733158E194B7499AA9BCF29AD74747067
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsBackstageShell.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\194CB3ER.D6H\3Q5O9CWP.KXX\ScreenConnect.WindowsBackstageShell.exe
Size 59KB
SHA256 1404090db3128de503ba4d991a960c7c1bc3b910a62d06ecf7e7081a2fcf11b9
MD5 ab9a2c07b3b1222f5ada4cb7c1fd144e
SHA1 22d5e961804073435cd193c1a4b7d3f4c39a64c4
SHA512 909e4e6fb042f30e8e2fccb54b7797410a4c3eb825a2578c679d75d780ba0a06d8a9058ddab66a48a60b3a4a6c4704468826b74fd504cef8b8fc860827707968
SSDEEP 1536:7bHOH2MJv6vmDtyQXIE+TC49IfXWbdS79GT8H:7buH2MJDyQEASSB
TLSH
T115538D4123F80B16D9FF5E39B5E2A5250EB0EA039441E7AE1DCDA5DA0E537806B603F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\194CB3ER.D6H\3Q5O9CWP.KXX\ScreenConnect.WindowsClient.exe
Size 593KB
SHA256 b80d07610b81bddb3d7f30a207a2e134b559e06b8440598a926f3a9c1d439218
MD5 9562334dd9a47ec1239a8667ddc1f01c
SHA1 b46c4e4694783311e2c612ed7f0ca67a88e1e352
SHA512 a4207d106c5253777dc1eb49d644e2f7ba5ab4e6b64bad1f072c4fcd97df38e76b86986a8a7d7441c0c7cedb2e041044c7f9b36f892c9f48836a8db2d22e8500
SSDEEP 6144:PTv8K3EAggQ2nqBly89VXvJthenrMd+3OsJwEKbE00QPG5YgRtAcCI2/R4IRtNup:rUKt/sXvJqu+3OsJwrbE00QuHRgNNmAq
TLSH
T1E7D46C2273B88A7BD9BF0779B0F21C2557B0E8436185D78E49A4ACD91D973818D0E3E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Users\Admin\AppData\Local\Temp\Deployment\194CB3ER.D6H\3Q5O9CWP.KXX\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
TLSH
T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\194CB3ER.D6H\3Q5O9CWP.KXX\ScreenConnect.WindowsClient.exe.genman
Size 2KB
SHA256 cfe9e06a7fc7a776c704f992b1b80c2938133a4b8c1b53bcabe57cade90d44b9
MD5 c342b42f693456b2e0657859d5d06d9a
SHA1 916cb76f8ad3074edea5c7c30f0192d3813f96f7
SHA512 2adb5e7646df905a99ef2278341e7f5dfe3530d6577ab1c7036464a060dbae5a67ae946665044329d0331504a366257c4943259536f2b72e37c73dbf67cf5e54
TLSH
T13E51D41641C8FA210F3301C1BEEBE471979E5B32158E194770999A9FCF2DAA7474B077
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.manifest

Path C:\Users\Admin\AppData\Local\Temp\Deployment\194CB3ER.D6H\3Q5O9CWP.KXX\ScreenConnect.WindowsClient.exe.manifest
Size 17KB
SHA256 d44b7bda547bbbeab6060edd2207e97dbc43c28aa08522b2108866c1ac023dbd
MD5 e1a62c7b0b94e2fbe0d27d9c679b9a97
SHA1 6e6896278eeaa03b4e0cb0c14ad5ef80f3366c02
SHA512 535754df5c489aab01f38a6a60096f3e277309751a8a07d9b8a9b53211365559f0874cd858118a5e56c3abb2e8bced0972e1433ff4fd32cb5f256e872c4a7356
SSDEEP 384:peKEE1rTJUaXOf6zX9WnZgMacc4X9FX9R/QPIYM7Y7:pI6zX9i+yc4X9FX9R/QPIN07
TLSH
T14F82D54A88C07C2153369190BFF38A10BE557B3301EE14CABC5E55AF8F6569893972B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsFileManager.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\194CB3ER.D6H\3Q5O9CWP.KXX\ScreenConnect.WindowsFileManager.exe
Size 79KB
SHA256 13f8cfe4648b807a0cbddd653c75254b60d1951e11e715f4e5a1a2c9ab29360b
MD5 130176db1b368a8290ebda3ce17db7c8
SHA1 5c1ffa4074937594b8fddd76720d7943f4f5ad55
SHA512 8830e75925e71d72c4144f053db5f97e3920ac8d27d4ac04888a10e7648f1f6d90a69a72415a56ea18ac9d49db52334432232f28ee6099e57ba50ea13311aebc
SSDEEP 1536:Mtypl44jzbHI5kLP+VVVVVVVVVVVVVVVVVVVVVVVVVC7Ky7ynD:3rfukLdOyWD
TLSH
T1C683E58235762631DF85C5379492C9B59D366F22133DC5BD2DA2FE3A69F03043A8ADB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8W5LTBCT.E88.application

Path C:\Users\Admin\AppData\Local\Temp\Deployment\VWL8LE5K.XRV\8W5LTBCT.E88.application
Size 130KB
SHA256 4c444547a310786097211ba508653c0d7711adc56de7a8e533a7cac308daaf3b
MD5 dfb444eac85470a405ef12213e8e5223
SHA1 5300b0b809ffb9acd92d6acaa81bb6ffd4292753
SHA512 941f6e69cca1709b501a5ee94b083eb829e73dbafaac2799037b2b1d9328be175938b155ae7af6b903be4b3e5b7e73370a59e7f6c6725d7882937854484f9e2c
SSDEEP 3072:8NMXNOs7Jnv56IRTL9ub6m2o9HuzhJOvP:bXTVRVub6mt8vOvP
TLSH
T17CD3083A8E30F8C0877DB421D1A52D573D811B97CBB31BECDE06186A0E69391EF5A65C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4452-287-0x0000000000A60000-0x0000000000AF8000-memory.dmp

Download

memory/4452-295-0x0000000001290000-0x00000000012A8000-memory.dmp

Download

memory/6412-14-0x00007FFF34440000-0x00007FFF34DE4000-memory.dmp

Download

memory/6412-64-0x00000230FEE90000-0x00000230FF03C000-memory.dmp

Download

memory/6412-44-0x00000230FE690000-0x00000230FE71C000-memory.dmp

Download

memory/6412-38-0x00000230FE690000-0x00000230FE728000-memory.dmp

Download

memory/6412-28-0x00007FFF34440000-0x00007FFF34DE4000-memory.dmp

Download

memory/6412-24-0x00007FFF34440000-0x00007FFF34DE4000-memory.dmp

Download

memory/6412-18-0x00007FFF34440000-0x00007FFF34DE4000-memory.dmp

Download

memory/6412-15-0x00000230FDA90000-0x00000230FDAE0000-memory.dmp

Download

memory/6412-1-0x00000230FB1D0000-0x00000230FB1D8000-memory.dmp

Download

memory/6412-11-0x00007FFF34440000-0x00007FFF34DE4000-memory.dmp

Download

memory/6412-56-0x00000230FCF10000-0x00000230FCF28000-memory.dmp

Download

memory/6412-50-0x00000230FD870000-0x00000230FD8A6000-memory.dmp

Download

memory/6412-10-0x00007FFF34440000-0x00007FFF34DE4000-memory.dmp

Download

memory/6412-9-0x00007FFF34440000-0x00007FFF34DE4000-memory.dmp

Download

memory/6412-8-0x00007FFF34440000-0x00007FFF34DE4000-memory.dmp

Download

memory/6412-318-0x00007FFF34440000-0x00007FFF34DE4000-memory.dmp

Download

memory/6412-7-0x00007FFF34440000-0x00007FFF34DE4000-memory.dmp

Download

memory/6412-6-0x00007FFF34440000-0x00007FFF34DE4000-memory.dmp

Download

memory/6412-5-0x00007FFF34440000-0x00007FFF34DE4000-memory.dmp

Download

memory/6412-4-0x00007FFF34440000-0x00007FFF34DE4000-memory.dmp

Download

memory/6412-3-0x00007FFF34440000-0x00007FFF34DE4000-memory.dmp

Download

memory/6412-2-0x00000230FD900000-0x00000230FDA88000-memory.dmp

Download

memory/6412-0-0x00007FFF345CF000-0x00007FFF345D0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads