da3fd6ee9a00c393e2237cd264fae318351b8cfdce982510107cc38034bd047d

Analysis

max time kernel
110s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/06/2026, 18:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
support.client.exe
Size 305KB
Sample260623-wvpflae16t
SHA256 da3fd6ee9a00c393e2237cd264fae318351b8cfdce982510107cc38034bd047d
MD5 c37b66823272ad2020cbd4d34f2d6cef
SHA1 f8554c9324313ea7c35b63c33358bd5551b67026
SHA512 1b4d4f6acca8f0815057857c097b30d857cb8aa0c83a94c6d07824f867bfc326483ee3194c5f832e5f214ba02da951c205b0bbaf3cac4a497a489a485c26c3e4
SSDEEP 6144:imlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji95:h1iw7gryNkSV1hy1Z1u2JLu95
TLSH
T1DA646C11B9C48432C273383147B4E2B28DBDB8302D655B8F57A81D7A9F745D0EA29B6F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware defense_evasion discovery persistence ransomware revoked_codesign spyware trojan

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Downloads MZ/PE file 7 IoCs

flow	pid	Process
1	4852	dfsvc.exe
1	4852	dfsvc.exe
1	4852	dfsvc.exe
1	4852	dfsvc.exe
1	4852	dfsvc.exe
1	4852	dfsvc.exe
1	4852	dfsvc.exe

Manipulates Digital Signatures 1 TTPs 4 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C\Blob = 0300000001000000140000007b0f360b775f76c94a12ca48445aa2d2a875701c2000000001000000b4060000308206b030820498a003020102021008ad40b260d29c4c9f5ecda9bd93aed9300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3231303432393030303030305a170d3336303432383233353935395a3069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e6720525341343039362053484133383420323032312043413130820222300d06092a864886f70d01010105000382020f003082020a0282020100d5b42f42d028ad78b75dd539591bb18842f5338ceb3d819770c5bbc48526309fa48e68d85cf5eb342407e14b4fd37843f417d71edaf9d2d5671a524f0ea157fc8899c191cc81033e4d702464b38de2087d347d4c8057126b439a99f2c53b1ff2efcb475a13a64cb3012025f310d38bb2fb08f08ae09d09c065a7fa98804935873d5119e8902178452ea19f2ce118c21accc5ee93497042328ffbc6ea1cf3656891a24d4c8211485268de10bd14575de8181365c57fb24f852c48a4568435d6f92e9caa0015d137fe1a0694c27cc8ea1b32e6cac2f4a7a3030e74a5af39b6ab6012e3e8d6b9f731e1dcade418a0d8c1234747b3a10f6ea3ab6d9806831bb76a672dd2bd441a9210818fb03b09d7c79b325ac2ff6a60548b49c193ede1b45ce06feb26f98cd5b2f93810e6eace91f5bed3fb6f9361345cbc93452883362a66285fb073ce8b262506b283d45cf615194ced62e05e33f2e8e8ec0aa7b0032b91b23679bef7ad081e75a665ccbbe34850f377911afedb50a246c8615898f57c02163c8328ad3986ecd4b70d53d0f847e675308dec30937614a65b4b5d74614d3f129176debf58cb72102941f0d5c56d267668114113589adc262b01f4894d59db78cf814a3e40475fc98150738510232159608a6454c1cc211ae838197c661ccd78384530994fff634f4cbbaa0d0853417c583d47b3fab6ec8c320902cc6c3c0c56110203010001a38201593082015530120603551d130101ff040830060101ff020100301d0603551d0e041604146837e0ebb63bf85f1186fbfe617b088865f44e42301f0603551d23041830168014ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300e0603551d0f0101ff04040302018630130603551d25040c300a06082b06010505070303307706082b06010505070101046b3069302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304106082b060105050730028635687474703a2f2f636163657274732e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63727430430603551d1f043c303a3038a036a0348632687474703a2f2f63726c332e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63726c301c0603551d20041530133007060567810c01033008060667810c010401300d06092a864886f70d01010c050003820201003a23443d8d0876ee8fbc3a99d356e0021aa5f84834f32cb6e67466f79472b100caaf6c302713129e90449f4bfd9ea37c26d537bc3a5d486d95d53f49f427bb16814550fd9cbdb685e0767e3771cb22f75aaa90cff5936ae3eb20d1d55079889a8a8ac1b6bda148187edcd8801a111918cd61998156f6c9e376e7c4e41b5f43f83e94ff76393d9ed499cf4add28eb5f26a1955848d51afed7273ffd90d17686dd1cb0605cf30da8eee089a1bd39e1384eda6ebb369dfbe521535ac3cae96af1a23edb43b833c84f38149299f5ddce546dd95d02141f40337c03e295b2c221757352cb46d8c4341ca2a54b8dcd6f76372c853f1ace26e918be9007b0437f9588208270f0cccaeffd29355c1f893855f7378a8b09a1cb0be9311aff2e195c3971e1be9ca70a06d62667b792e64e5fde7aac49cf2ea47492addb3ca49c861fe3c1561b2b23ff8fb5ea887b706be6a0bafd3a3f45a6c4e81691528b41c048844b964dab4440e38df01528ceedf11856072a2f10c40c08643c338fae288c3ccb8f880b0dbf3bf4ce1e7b8eefb5ebcbb7f07713e6e7283fac12aea52f226c41f9825c1566cc6c0ecac586c3f626330c074ba0d307026a6a4030484b34a85120bbad1b8508e2590d6dca05502bea4a1c9ea5fda0a71f0674e7f2d65290fdaf854821f9573bb49c03ed8645f4b4616ebf68e2266086eac8afa9fe941de7631b3a8656784e	support.client.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4C2272FBA7A7380F55E2A424E9E624AEE1C14579\Blob = 0300000001000000140000004c2272fba7a7380f55e2a424e9e624aee1c145792000000001000000640700003082076030820548a00302010202100b9360051bccf66642998998d5ba97ce300d06092a864886f70d01010b05003069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e67205253413430393620534841333834203230323120434131301e170d3232303831373030303030305a170d3235303831353233353935395a3065310b30090603550406130255533110300e06035504081307466c6f72696461310e300c0603550407130554616d706131193017060355040a1310436f6e6e656374776973652c204c4c433119301706035504031310436f6e6e656374776973652c204c4c4330820222300d06092a864886f70d01010105000382020f003082020a0282020100ec489826d08d2c6de21b3cd3676db1e0e50cb1ff75ff564e9741f9574aa3640aa8297294a05b4db68abd0760b6b05b50ce92ff42a4e390be776a43e9961c722f6b3a4d5c880bcc6a61b4026f9137d36b2b7e9b86055876b9fa860dbcb164fe7f4b5b9de4799ae4e02dc1f0bee01e5d032933a2827388f8db0b482e76c441b1bd50909ef2023e1fb62196c994ce052266b28cd89253e6416044133139764db5fc45702529536bf82c775f9ec81fa27dc409530325f40cdef95b81b9ce0d42791cee72e7bd1b36c257b52257c65a28970e457513989434bfc239e2992b193e1b3cc3f11ccdd1d26d4ec9845099ab913906a42069af999c0071169b45a2ea1aa666f1904e8acb05e1823a359a291fd46b4ef7aed5935bb6ab17ebf077210726930c90f01761d6544a94e8fa614cc41d817eec734b1c3d3afb7c58fb256f0c09edc1459bddbff9940ed1958570265d67af79a9b6a16affd70fc6328c9810d5dc186e39af6fbcad49a270f237e6bcd5de0bc014bc3179cd79776591340311a42ca94f33416c2e01b59bd1d71de86ace6716bc90b2d7695d155039aa08fbac19a4d93fb784230a20a485287a16355645fc09142c602d140fa046b7bfd75328184ff7bdf8f9e0d65e6201c8d242931047f59bd328ac353777ccefa60408887b84fc3631301463461a1d73c0b5cc74d6d82905ddf923bdbab027a311cc38d3fa16f639a50203010001a382020630820202301f0603551d230418301680146837e0ebb63bf85f1186fbfe617b088865f44e42301d0603551d0e04160414338ce10a6e06d9c6ed0bc6cae736cefb8188646a300e0603551d0f0101ff04040302078030130603551d25040c300a06082b060105050703033081b50603551d1f0481ad3081aa3053a051a04f864d687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c3053a051a04f864d687474703a2f2f63726c342e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c303e0603551d20043730353033060667810c0104013029302706082b06010505070201161b687474703a2f2f7777772e64696769636572742e636f6d2f43505330819406082b06010505070101048187308184302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d305c06082b060105050730028650687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e637274300c0603551d130101ff04023000300d06092a864886f70d01010b050003820201000ad79f00cf4984864c8981ecce8718aa875647f6a74608c968e16568c7aa9d711ed7341676038067f01330c91621b27a2a8894c4108c268162a31f13f9757a7d6bb3c6f19bf27c3a29896d712d85873627d827cd6471761444fabf1d31e903f791143c5b4ce5e7444aacba36d759aeba3069d195226755cbc675aa747f77596c53c96e083c45bba24479d6845eea9f2b28ba29b4dcf0bcf14aa4ce176c24e2c1b8fec3ee16e1c086db6fda97388859e83be65c03f701395b78b842c6dd1533ef642cca6fe50f6337d3f2dfedd8b28f2b28e0c98edd2151392e7cc75489f48859f1de14c81b306eb50eed7bb78be30eaada76767c4ca523a11eec5a2372d6122926ab1801a6a6778e9504791487ee47d4577154988802070f80fc535957658f954cd083546c5afb5a6567b6761275f5db20f70ab86feef94c7cfc65369d325121b69a82399bc7dc1962416f0f05cf1eee64d495a3527e464e2c68da0187093f97b673e43dddbcc067e00713f1565fcff8c3772d44b40a04e600644f22a990345f9a6b5b52963e82c81a0ce91d43a230f67b37d8debda40ea3d59d305e18adc1976516c12a8ba2bca24143b12e9527b4dca58872aa9b3a8c6ac563fc2dc02bf51be889516d35a4ba9d062417b5bdcc50ba945fae26b60d6aec03984798a6a21d3ff793cc0849e81ed55b8027411c50db776ae8feef2fdc2dafb04345261dedc054	support.client.exe
Key deleted	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C	support.client.exe
Key deleted	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4C2272FBA7A7380F55E2A424E9E624AEE1C14579	support.client.exe

Signed with revoked ConnectWise certificate 4 IoCs

Binary is signed using a ConnectWise certificate revoked for key compromise.

revoked_codesign

resource	yara_rule
behavioral2/files/0x000c00000001c5cf-43.dat	revoked_cert_connectwise
behavioral2/files/0x000c00000001c5ce-191.dat	revoked_cert_connectwise
behavioral2/files/0x000d00000001c5c9-196.dat	revoked_cert_connectwise
behavioral2/files/0x000d00000001c5ca-195.dat	revoked_cert_connectwise

Executes dropped EXE 1 IoCs

pid	Process
4808	ScreenConnect.WindowsClient.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\Q0YL78D3.EKW\P5ZJD0Z9.TL4\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	support.client.exe

Checks SCSI registry key(s) 3 TTPs 62 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dfsvc.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_25b0fbb6ef7eb094_0019.0002_45d12952c94b485c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_4b14c015c87c1ad8_0019.0002_none_f33a7b65bb3fb52e\implication!scre..tion_25b0fbb6ef7eb094_0019.0002_a36e8 = 687474703a2f2f3134342e3137322e38342e37352f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_4b14c015c87c1ad8_0019.0002_none_41e6e31d258051c3\implication!scre..tion_25b0fbb6ef7eb094_0019.0002_a36e8 = 687474703a2f2f3134342e3137322e38342e37352f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0019.0002_none_2771bb27d0341a32\SizeOfStronglyNamedComponent = 095c020000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_25b0fbb6ef7eb094_0019.0002_45d12952c94b485c\lock!11000000f239590ef412000040150000000000000000000036a5dd3 = 30303030313266342c30316464303333633265343235353163	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0002_none_a32dbc410e6434d0\DigestValue = b46c4e4694783311e2c612ed7f0ca67a88e1e352	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_4b14c015c87c1ad8_0019.0002_none_f33a7b65bb3fb52e\DigestMethod = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_25b0fbb6ef7eb094_0019.0002_none_2771bb27d0341a32\implication!scre..tion_25b0fbb6ef7eb094_0019.0002_a36e8 = 687474703a2f2f3134342e3137322e38342e37352f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_4b14c015c87c1ad8_0019.0002_none_41e6e31d258051c3\identity = 53637265656e436f6e6e6563742e436f72652c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0019.0002_none_a32dbc410e6434d0\lock!0c000000e239590ef41200004015000000000000000000000e = 30303030313266342c30316464303333633265343235353163	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0019.0002_45d12952c94b485c\scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d819169b5	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0019.0002_none_d7fc40ef34cfa7c7\lock!06000000b73b590ec8120000641200000000000000000000a9 = 30303030313263382c30316464303333633336666166643439	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0019.0002_a36e83baeffbd607\scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d819169b5	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0002_none_a32dbc410e6434d0\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_4b14c015c87c1ad8_0019.0002_none_465ebafe61ce64f3\Transform = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_4b14c015c87c1ad8_0019.0002_none_41e6e31d258051c3\lock!0e000000e239590ef41200004015000000000000000000000e = 30303030313266342c30316464303333633265343235353163	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d819169b5504f\lock!04000000b73b590ec8120000641200000000000000000000a9 = 30303030313263382c30316464303333633336666166643439	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications\scre..tion_25b0fbb6ef7eb094_0019.0002_45d12952c94b485c	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d819169b5504f\SizeOfStronglyNamedComponent = c04f040000000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_4b14c015c87c1ad8_0019.0002_none_465ebafe61ce64f3	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}\scre..tion_25b0fbb6ef7eb094 = 3c004100700070006c00690063006100740069006f006e00540072007500730074002000760065007200730069006f006e003d002200310022000d000a00460075006c006c004e0061006d0065003d00220068007400740070003a002f002f003100340034002e003100370032002e00380034002e00370035002f00420069006e002f00530063007200650065006e0043006f006e006e006500630074002e0043006c00690065006e0074002e006100700070006c00690063006100740069006f006e002300530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f007700730043006c00690065006e0074002e006100700070006c00690063006100740069006f006e002c002000560065007200730069006f006e003d00320035002e0032002e0034002e0039003200320039002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d0032003500620030006600620062003600650066003700650062003000390034002c002000700072006f0063006500730073006f0072004100720063006800690074006500630074007500720065003d006d00730069006c002f00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f007700730043006c00690065006e0074002e006500780065002c002000560065007200730069006f006e003d00320035002e0032002e0034002e0039003200320039002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d0032003500620030006600620062003600650066003700650062003000390034002c002000700072006f0063006500730073006f0072004100720063006800690074006500630074007500720065003d006d00730069006c002c00200074007900700065003d00770069006e003300320022000d000a00540072007500730074006500640054006f00520075006e003d002200740072007500650022000d000a0050006500720073006900730074003d002200740072007500650022003e000d000a003c00440065006600610075006c0074004700720061006e0074003e000d000a003c0050006f006c00690063007900530074006100740065006d0065006e0074002000760065007200730069006f006e003d002200310022003e000d000a003c005000650072006d0069007300730069006f006e00530065007400200063006c006100730073003d002200530079007300740065006d002e00530065006300750072006900740079002e005000650072006d0069007300730069006f006e0053006500740022000d000a00760065007200730069006f006e003d002200310022000d000a00490044003d00220043007500730074006f006d0022000d000a00530061006d00650053006900740065003d002200730069007400650022000d000a0055006e0072006500730074007200690063007400650064003d002200740072007500650022000d000a0078006d006c006e0073003a00610073006d00760031003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a00610073006d002e007600310022000d000a0078006d006c006e0073003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a00610073006d002e007600320022000d000a0078006d006c006e0073003a00610073006d00760032003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a00610073006d002e007600320022000d000a0078006d006c006e0073003a007800730069003d00220068007400740070003a002f002f007700770077002e00770033002e006f00720067002f0032003000300031002f0058004d004c0053006300680065006d0061002d0069006e007300740061006e006300650022000d000a0078006d006c006e0073003a0063006f002e00760031003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a0063006c00690063006b006f006e00630065002e007600310022000d000a0078006d006c006e0073003a00610073006d00760033003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a00610073006d002e007600330022000d000a0078006d006c006e0073003a0064007300690067003d00220068007400740070003a002f002f007700770077002e00770033002e006f00720067002f0032003000300030002f00300039002f0078006d006c006400730069006700230022000d000a0078006d006c006e0073003a0063006f002e00760032003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a0063006c00690063006b006f006e00630065002e007600320022003e000d000a003c0049005000650072006d0069007300730069006f006e00200063006c006100730073003d002200530079007300740065006d002e004e00650074002e005700650062005000650072006d0069007300730069006f006e002c002000530079007300740065006d002c002000560065007200730069006f006e003d0032002e0030002e0030002e0030002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d00620037003700610035006300350036003100390033003400650030003800390022000d000a00760065007200730069006f006e003d002200310022003e000d000a003c0043006f006e006e006500630074004100630063006500730073003e000d000a003c0055005200490020007500720069003d002200280068007400740070007c006800740074007000730029003a002f002f003100340034005c002e003100370032005c002e00380034005c002e00370035002f002e002a0022002f003e000d000a003c002f0043006f006e006e006500630074004100630063006500730073003e000d000a003c002f0049005000650072006d0069007300730069006f006e003e000d000a003c002f005000650072006d0069007300730069006f006e005300650074003e000d000a003c002f0050006f006c00690063007900530074006100740065006d0065006e0074003e000d000a003c002f00440065006600610075006c0074004700720061006e0074003e000d000a003c004500780074007200610049006e0066006f00200044006100740061003d00220030003000300031003000300030003000300030004600460046004600460046004600460030003100300030003000300030003000300030003000300030003000300030003000430030003200300030003000300030003000350037003500330037003900370033003700340036003500360044003200450035003700360039003600450036003400360046003700370037003300320045003400360036004600370032003600440037003300320043003200300035003600360035003700320037003300360039003600460036004500330044003300340032004500330030003200450033003000320045003300300032004300320030003400330037003500360043003700340037003500370032003600350033004400360045003600350037003500370034003700320036003100360043003200430032003000350030003700350036003200360043003600390036003300340042003600350037003900350034003600460036004200360035003600450033004400360032003300370033003700360031003300350036003300330035003300360033003100330039003300330033003400360035003300300033003800330039003000350030003100300030003000300030003000330030003500330037003900370033003700340036003500360044003200450035003300360035003600330037003500370032003600390037003400370039003200450035003000360046003600430036003900360033003700390032004500340031003700300037003000360043003600390036003300360031003700340036003900360046003600450035003400370032003700350037003300370034003400350037003800370034003700320036003100340039003600450036003600360046003000310030003000300030003000300031003800370032003600350037003100370035003600350037003300370034003700330035003300360038003600350036004300360043003400390036004500370034003600350036003700370032003600310037003400360039003600460036004500300030003000310030003200300030003000300030003000300030003000420022002f003e000d000a003c002f004100700070006c00690063006100740069006f006e00540072007500730074003e000d000a000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_25b0fbb6ef7eb094_0019.0002_45d12952c94b485c\appid = 687474703a2f2f3134342e3137322e38342e37352f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d819169b5504f\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0019.0002_45d12952c94b485c\scre..vice_4b14c015c87c1ad8_0019.0002_none_f33a7b65bb3f = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_4b14c015c87c1ad8_0019.0002_none_f33a7b65bb3fb52e\lock!0e000000b73b590ec8120000641200000000000000000000a9 = 30303030313263382c30316464303333633336666166643439	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-28459746-3881314244-166055492-1000\{33011342-0FBD-421E-A13F-89F70BDFEE73}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications\scre..tion_25b0fbb6ef7eb094_0019.0002_45d12952c94b485c\PreparedForExecution = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Assemblies	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_25b0fbb6ef7eb094_0019.0002_none_2771bb27d0341a32\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0002_none_d7fc40ef34cfa7c7\Transform = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_25b0fbb6ef7eb094 = 32003000320036002f00300036002f00320033002000310038003a00310035003a00300033000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0019.0002_a36e83baeffbd607\scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d819169b5 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d819169b5504f\Files\ScreenConnect.WindowsClient.exe.config_f7f10 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_4b14c015c87c1ad8_0019.0002_none_f33a7b65bb3fb52e\DigestValue = 27d351219ad62fc914c6c34eed8373fee6de294d	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_4b14c015c87c1ad8_0019.0002_none_465ebafe61ce64f3\Files\ScreenConnect.Windows.dll_fc0d83aff7df0b5b = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\Gi_scre..tion_25b0fbb6ef7eb094_9edfe039055229dd\LastRunVersion = 687474703a2f2f3134342e3137322e38342e37352f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0019.0002_none_d7fc40ef34cfa7c7	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0002_none_a32dbc410e6434d0	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_4b14c015c87c1ad8_0019.0002_none_465ebafe61ce64f3\DigestValue = 48038f060a5042ff44a2d9a9be46368ecc8436fd	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0019.0002_none_d7fc40ef34cfa7c7	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}\scre..tion_25b0fbb6ef7eb094	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0019.0002_45d12952c94b485c\scre..vice_4b14c015c87c1ad8_0019.0002_none_f33a7b65bb3f	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_4b14c015c87c1ad8_0019.0002_none_41e6e31d258051c3\identity = 53637265656e436f6e6e6563742e436f72652c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d819169b5504f\implication!scre..tion_25b0fbb6ef7eb094_0019.0002_a36e8 = 687474703a2f2f3134342e3137322e38342e37352f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d819169b5504f\Files\ScreenConnect.WindowsFileManager.exe.config_ = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_4b14c015c87c1ad8_0019.0002_none_f33a7b65bb3fb52e	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_4b14c015c87c1ad8_0019.0002_none_465ebafe61ce64f3\DigestMethod = 01	dfsvc.exe

Modifies system certificate store 2 TTPs 6 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C\Blob = 0300000001000000140000007b0f360b775f76c94a12ca48445aa2d2a875701c2000000001000000b4060000308206b030820498a003020102021008ad40b260d29c4c9f5ecda9bd93aed9300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3231303432393030303030305a170d3336303432383233353935395a3069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e6720525341343039362053484133383420323032312043413130820222300d06092a864886f70d01010105000382020f003082020a0282020100d5b42f42d028ad78b75dd539591bb18842f5338ceb3d819770c5bbc48526309fa48e68d85cf5eb342407e14b4fd37843f417d71edaf9d2d5671a524f0ea157fc8899c191cc81033e4d702464b38de2087d347d4c8057126b439a99f2c53b1ff2efcb475a13a64cb3012025f310d38bb2fb08f08ae09d09c065a7fa98804935873d5119e8902178452ea19f2ce118c21accc5ee93497042328ffbc6ea1cf3656891a24d4c8211485268de10bd14575de8181365c57fb24f852c48a4568435d6f92e9caa0015d137fe1a0694c27cc8ea1b32e6cac2f4a7a3030e74a5af39b6ab6012e3e8d6b9f731e1dcade418a0d8c1234747b3a10f6ea3ab6d9806831bb76a672dd2bd441a9210818fb03b09d7c79b325ac2ff6a60548b49c193ede1b45ce06feb26f98cd5b2f93810e6eace91f5bed3fb6f9361345cbc93452883362a66285fb073ce8b262506b283d45cf615194ced62e05e33f2e8e8ec0aa7b0032b91b23679bef7ad081e75a665ccbbe34850f377911afedb50a246c8615898f57c02163c8328ad3986ecd4b70d53d0f847e675308dec30937614a65b4b5d74614d3f129176debf58cb72102941f0d5c56d267668114113589adc262b01f4894d59db78cf814a3e40475fc98150738510232159608a6454c1cc211ae838197c661ccd78384530994fff634f4cbbaa0d0853417c583d47b3fab6ec8c320902cc6c3c0c56110203010001a38201593082015530120603551d130101ff040830060101ff020100301d0603551d0e041604146837e0ebb63bf85f1186fbfe617b088865f44e42301f0603551d23041830168014ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300e0603551d0f0101ff04040302018630130603551d25040c300a06082b06010505070303307706082b06010505070101046b3069302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304106082b060105050730028635687474703a2f2f636163657274732e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63727430430603551d1f043c303a3038a036a0348632687474703a2f2f63726c332e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63726c301c0603551d20041530133007060567810c01033008060667810c010401300d06092a864886f70d01010c050003820201003a23443d8d0876ee8fbc3a99d356e0021aa5f84834f32cb6e67466f79472b100caaf6c302713129e90449f4bfd9ea37c26d537bc3a5d486d95d53f49f427bb16814550fd9cbdb685e0767e3771cb22f75aaa90cff5936ae3eb20d1d55079889a8a8ac1b6bda148187edcd8801a111918cd61998156f6c9e376e7c4e41b5f43f83e94ff76393d9ed499cf4add28eb5f26a1955848d51afed7273ffd90d17686dd1cb0605cf30da8eee089a1bd39e1384eda6ebb369dfbe521535ac3cae96af1a23edb43b833c84f38149299f5ddce546dd95d02141f40337c03e295b2c221757352cb46d8c4341ca2a54b8dcd6f76372c853f1ace26e918be9007b0437f9588208270f0cccaeffd29355c1f893855f7378a8b09a1cb0be9311aff2e195c3971e1be9ca70a06d62667b792e64e5fde7aac49cf2ea47492addb3ca49c861fe3c1561b2b23ff8fb5ea887b706be6a0bafd3a3f45a6c4e81691528b41c048844b964dab4440e38df01528ceedf11856072a2f10c40c08643c338fae288c3ccb8f880b0dbf3bf4ce1e7b8eefb5ebcbb7f07713e6e7283fac12aea52f226c41f9825c1566cc6c0ecac586c3f626330c074ba0d307026a6a4030484b34a85120bbad1b8508e2590d6dca05502bea4a1c9ea5fda0a71f0674e7f2d65290fdaf854821f9573bb49c03ed8645f4b4616ebf68e2266086eac8afa9fe941de7631b3a8656784e	support.client.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4C2272FBA7A7380F55E2A424E9E624AEE1C14579	support.client.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4C2272FBA7A7380F55E2A424E9E624AEE1C14579\Blob = 0300000001000000140000004c2272fba7a7380f55e2a424e9e624aee1c145792000000001000000640700003082076030820548a00302010202100b9360051bccf66642998998d5ba97ce300d06092a864886f70d01010b05003069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e67205253413430393620534841333834203230323120434131301e170d3232303831373030303030305a170d3235303831353233353935395a3065310b30090603550406130255533110300e06035504081307466c6f72696461310e300c0603550407130554616d706131193017060355040a1310436f6e6e656374776973652c204c4c433119301706035504031310436f6e6e656374776973652c204c4c4330820222300d06092a864886f70d01010105000382020f003082020a0282020100ec489826d08d2c6de21b3cd3676db1e0e50cb1ff75ff564e9741f9574aa3640aa8297294a05b4db68abd0760b6b05b50ce92ff42a4e390be776a43e9961c722f6b3a4d5c880bcc6a61b4026f9137d36b2b7e9b86055876b9fa860dbcb164fe7f4b5b9de4799ae4e02dc1f0bee01e5d032933a2827388f8db0b482e76c441b1bd50909ef2023e1fb62196c994ce052266b28cd89253e6416044133139764db5fc45702529536bf82c775f9ec81fa27dc409530325f40cdef95b81b9ce0d42791cee72e7bd1b36c257b52257c65a28970e457513989434bfc239e2992b193e1b3cc3f11ccdd1d26d4ec9845099ab913906a42069af999c0071169b45a2ea1aa666f1904e8acb05e1823a359a291fd46b4ef7aed5935bb6ab17ebf077210726930c90f01761d6544a94e8fa614cc41d817eec734b1c3d3afb7c58fb256f0c09edc1459bddbff9940ed1958570265d67af79a9b6a16affd70fc6328c9810d5dc186e39af6fbcad49a270f237e6bcd5de0bc014bc3179cd79776591340311a42ca94f33416c2e01b59bd1d71de86ace6716bc90b2d7695d155039aa08fbac19a4d93fb784230a20a485287a16355645fc09142c602d140fa046b7bfd75328184ff7bdf8f9e0d65e6201c8d242931047f59bd328ac353777ccefa60408887b84fc3631301463461a1d73c0b5cc74d6d82905ddf923bdbab027a311cc38d3fa16f639a50203010001a382020630820202301f0603551d230418301680146837e0ebb63bf85f1186fbfe617b088865f44e42301d0603551d0e04160414338ce10a6e06d9c6ed0bc6cae736cefb8188646a300e0603551d0f0101ff04040302078030130603551d25040c300a06082b060105050703033081b50603551d1f0481ad3081aa3053a051a04f864d687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c3053a051a04f864d687474703a2f2f63726c342e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c303e0603551d20043730353033060667810c0104013029302706082b06010505070201161b687474703a2f2f7777772e64696769636572742e636f6d2f43505330819406082b06010505070101048187308184302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d305c06082b060105050730028650687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e637274300c0603551d130101ff04023000300d06092a864886f70d01010b050003820201000ad79f00cf4984864c8981ecce8718aa875647f6a74608c968e16568c7aa9d711ed7341676038067f01330c91621b27a2a8894c4108c268162a31f13f9757a7d6bb3c6f19bf27c3a29896d712d85873627d827cd6471761444fabf1d31e903f791143c5b4ce5e7444aacba36d759aeba3069d195226755cbc675aa747f77596c53c96e083c45bba24479d6845eea9f2b28ba29b4dcf0bcf14aa4ce176c24e2c1b8fec3ee16e1c086db6fda97388859e83be65c03f701395b78b842c6dd1533ef642cca6fe50f6337d3f2dfedd8b28f2b28e0c98edd2151392e7cc75489f48859f1de14c81b306eb50eed7bb78be30eaada76767c4ca523a11eec5a2372d6122926ab1801a6a6778e9504791487ee47d4577154988802070f80fc535957658f954cd083546c5afb5a6567b6761275f5db20f70ab86feef94c7cfc65369d325121b69a82399bc7dc1962416f0f05cf1eee64d495a3527e464e2c68da0187093f97b673e43dddbcc067e00713f1565fcff8c3772d44b40a04e600644f22a990345f9a6b5b52963e82c81a0ce91d43a230f67b37d8debda40ea3d59d305e18adc1976516c12a8ba2bca24143b12e9527b4dca58872aa9b3a8c6ac563fc2dc02bf51be889516d35a4ba9d062417b5bdcc50ba945fae26b60d6aec03984798a6a21d3ff793cc0849e81ed55b8027411c50db776ae8feef2fdc2dafb04345261dedc054	support.client.exe
Key deleted	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C	support.client.exe
Key deleted	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4C2272FBA7A7380F55E2A424E9E624AEE1C14579	support.client.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C	support.client.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Apps\2.0\3W2C654C.Q7V\5O4BRWQ7.GQ0\scre..ient_4b14c015c87c1ad8_0019.0002_none_a32dbc410e6434d0\ScreenConnect.WindowsClient.exe\:Zone.Identifier:$DATA	dfsvc.exe
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\Q0YL78D3.EKW\P5ZJD0Z9.TL4\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3060	explorer.exe
3060	explorer.exe

Suspicious use of AdjustPrivilegeToken 29 IoCs

description	pid	Process
Token: SeDebugPrivilege	4852	dfsvc.exe
Token: SeShutdownPrivilege	3060	explorer.exe
Token: SeCreatePagefilePrivilege	3060	explorer.exe
Token: SeShutdownPrivilege	3060	explorer.exe
Token: SeCreatePagefilePrivilege	3060	explorer.exe
Token: SeShutdownPrivilege	3060	explorer.exe
Token: SeCreatePagefilePrivilege	3060	explorer.exe
Token: SeShutdownPrivilege	3060	explorer.exe
Token: SeCreatePagefilePrivilege	3060	explorer.exe
Token: SeShutdownPrivilege	3060	explorer.exe
Token: SeCreatePagefilePrivilege	3060	explorer.exe
Token: SeShutdownPrivilege	3060	explorer.exe
Token: SeCreatePagefilePrivilege	3060	explorer.exe
Token: SeShutdownPrivilege	3060	explorer.exe
Token: SeCreatePagefilePrivilege	3060	explorer.exe
Token: SeShutdownPrivilege	3060	explorer.exe
Token: SeCreatePagefilePrivilege	3060	explorer.exe
Token: SeShutdownPrivilege	3060	explorer.exe
Token: SeCreatePagefilePrivilege	3060	explorer.exe
Token: SeShutdownPrivilege	3060	explorer.exe
Token: SeCreatePagefilePrivilege	3060	explorer.exe
Token: SeShutdownPrivilege	3060	explorer.exe
Token: SeCreatePagefilePrivilege	3060	explorer.exe
Token: SeShutdownPrivilege	3060	explorer.exe
Token: SeCreatePagefilePrivilege	3060	explorer.exe
Token: SeShutdownPrivilege	3060	explorer.exe
Token: SeCreatePagefilePrivilege	3060	explorer.exe
Token: SeShutdownPrivilege	3060	explorer.exe
Token: SeCreatePagefilePrivilege	3060	explorer.exe

Suspicious use of FindShellTrayWindow 54 IoCs

pid	Process
6008	sihost.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2144	StartMenuExperienceHost.exe
2712	SearchHost.exe
3060	explorer.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1620 wrote to memory of 4852	1620	support.client.exe	88
PID 4852 wrote to memory of 4808	4852	dfsvc.exe	89
PID 6008 wrote to memory of 3060	6008	sihost.exe	95

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\support.client.exe
"C:\Users\Admin\AppData\Local\Temp\support.client.exe"
1⤵
- Manipulates Digital Signatures
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:1620
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
  2⤵
  - Downloads MZ/PE file
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4852
- - C:\Users\Admin\AppData\Local\Apps\2.0\3W2C654C.Q7V\5O4BRWQ7.GQ0\scre..tion_25b0fbb6ef7eb094_0019.0002_45d12952c94b485c\ScreenConnect.WindowsClient.exe
    "C:\Users\Admin\AppData\Local\Apps\2.0\3W2C654C.Q7V\5O4BRWQ7.GQ0\scre..tion_25b0fbb6ef7eb094_0019.0002_45d12952c94b485c\ScreenConnect.WindowsClient.exe"
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    PID:4808

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:6008
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:3060

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2712

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2144

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d819169b5504f.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\3W2C654C.Q7V\5O4BRWQ7.GQ0\manifests\scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d819169b5504f.cdf-ms
Size 24KB
SHA256 7b2a3cce579f24fa22bbab8cb586b7b83455b7600296508716044c51afd690ce
MD5 dab3ddb030b9d4fba45c8535d600ad38
SHA1 64426250564d30625f820ac3fae577e1455a6016
SHA512 29e3508ceeeed6ce5df3b5c7400905ac0efc9e9d796ee2683ad2709bc08759a60db6d44667e500277b2331f5d9e59fc0f3be67d1257ed5d5f1c7817295be5630
SSDEEP 384:/JqR1GTf6vBX95ZgMacc5X9R/QPIBM7Y3pzfm3YfIsHQU:/4Kf65X95+yc5X9R/QPI+0Zzf6YfHHN
TLSH
T1D7B20642BBD8E9F7D2528F329FB6C791F6157DAE0DA5408BB041333D453C698AE35288
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..core_4b14c015c87c1ad8_0019.0002_none_41e6e31d258051c3.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\3W2C654C.Q7V\5O4BRWQ7.GQ0\manifests\scre..core_4b14c015c87c1ad8_0019.0002_none_41e6e31d258051c3.cdf-ms
Size 3KB
SHA256 658eeefe699889494c3033744521857115a25884b3a3b4f31679629c3c346648
MD5 f6bad40e472d3fe1d9124b796aa18741
SHA1 2931e17e2e64cfe993775dacb985452fad17f680
SHA512 7fc272860c19226a1e2087a4057bb153848ae9ec73912d01c615eb55ed5ac66a087b758caa4132a279b116d8e02eb2e40c00717203b40b23a07085ba8ba5e950
TLSH
T1E16143027284DE17D9690633ACD2D2EE77757E83DF82430B74C4BB2F7A312E65612191
MD5 SHA1 SHA512 TLSH

Submit Download

scre..dows_4b14c015c87c1ad8_0019.0002_none_465ebafe61ce64f3.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\3W2C654C.Q7V\5O4BRWQ7.GQ0\manifests\scre..dows_4b14c015c87c1ad8_0019.0002_none_465ebafe61ce64f3.cdf-ms
Size 5KB
SHA256 f5c3b706be62fbcea08620fd229b39fe4da7e476f15c1e2031891fcb5e115692
MD5 cc8b81054eef464b11d2b6ef1f9d3449
SHA1 e13d07d3440d9a58412c88135f2f03db5e63ccf3
SHA512 82aa62faff642f707330548a27aa93ae570f59e4b5126c6c69018af1333e8b94838c934ba9263fefca052130dfdbf4050ffd3111213c51c7d3d744f44913ebe3
SSDEEP 96:9E4+RzgTheV+Ww7uk/WGgyHmzSNp9QHAz2xnaQHwnANb6F:0RzgiJgOMrvOAMaQAAMF
TLSH
T179B120217304D917D5B906339CA9D3EE2B687D92CE42460B70C4BF5F7A326FA8721295
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_4b14c015c87c1ad8_0019.0002_none_a32dbc410e6434d0.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\3W2C654C.Q7V\5O4BRWQ7.GQ0\manifests\scre..ient_4b14c015c87c1ad8_0019.0002_none_a32dbc410e6434d0.cdf-ms
Size 6KB
SHA256 faf48c77bb31ceeabebeb98f10ebc1142c14de5f0a9483bd8f88466a40b63bc8
MD5 944ff1bee69784531b777d91b8bfcab0
SHA1 fe4c23b4922decfe223dc3e964710efcefa4a65e
SHA512 895931cd4ebb168b3e0d049f2e3341aae5393b202c4e6d075c2608fc3602d5e0424b88aaefc968bbcfd0a2958785eea3280a5b47ae269b93e352775c6fc3387d
SSDEEP 96:VmQPPypJEeV+Wwws8WrML2WVfXUM3VBKa0ILB3jfQks6b/DrK:jPPaJornkYaBz7LzK
TLSH
T1E3D166127280EE16D5BD1A33AC9AD3ED37657E86DE43470730C4BB6F7B322EA1A12055
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_4b14c015c87c1ad8_0019.0002_none_d7fc40ef34cfa7c7.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\3W2C654C.Q7V\5O4BRWQ7.GQ0\manifests\scre..ient_4b14c015c87c1ad8_0019.0002_none_d7fc40ef34cfa7c7.cdf-ms
Size 2KB
SHA256 076a4a6f724c0c76dbb72de4795c880cbeb1a39330aa7fa70924aa3eaf8b2662
MD5 509f3705eb6a639a1643e7a7ae3e5973
SHA1 db521021a4c6c2bffe271e425d0977d6ea01a6a8
SHA512 0a8de207ce8cd0ed180a6a22aed5bd72faedee4995222d261e2cdf5741cd8004c240aa716de8f526843e069fee9c9f9a14025fe27c844799175f96a29bfe551d
TLSH
T1F75100053744E6A7DA2A0331ACA2C2CA7BB83D83CF91510BB0C0377F5E716D55A2A1A6
MD5 SHA1 SHA512 TLSH

Submit Download

scre..tion_25b0fbb6ef7eb094_0019.0002_none_2771bb27d0341a32.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\3W2C654C.Q7V\5O4BRWQ7.GQ0\manifests\scre..tion_25b0fbb6ef7eb094_0019.0002_none_2771bb27d0341a32.cdf-ms
Size 14KB
SHA256 e6c23837f7aa50ee8a5c472aba77f2e5b9eebf7f1040d7d1a046ca8c66dba674
MD5 b03832d85b3dfce0d91d54f34e70cccd
SHA1 b41a2276787b2ced4560a673a0a58cd9066c0159
SHA512 6849ecf2eb02b67e6e6d48495f9c6e6c20b5a7ae04320991f2476e7de3100867659d95a55efc929ba96aa3296d435de5947caa4819a4dd676644df2689679e2b
SSDEEP 192:89mJ9rw6GSR0a8s8oeR06pRm+N8s8oTN2x2QPIlFDLhEDh7BqWojOi:89a9rw6t1X9chRRX9R/QPIBM7Yj5
TLSH
T10862E6803760E923C1169733DDE2C7E13679FE934ED2879F74067B1F6978B845622292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..vice_4b14c015c87c1ad8_0019.0002_none_f33a7b65bb3fb52e.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\3W2C654C.Q7V\5O4BRWQ7.GQ0\manifests\scre..vice_4b14c015c87c1ad8_0019.0002_none_f33a7b65bb3fb52e.cdf-ms
Size 4KB
SHA256 3d69821be283c35c905c551a0eb09f54bbf93d1f0a90e34d635d0bdaea6bc21c
MD5 c3524bec4a13e46595e50fc560c01b8c
SHA1 a9484f8dc5d3487c4a1ea39aad378aed3fbe291c
SHA512 cccd59973175573dd8db5144cefa2eeaffa2ddd247d74ffc3213fbd19f0dae764a6088f781e7e836557ac2ebc4b99c5e9256842162a005c8299f245336033224
SSDEEP 96:Q/SeV+Ww8s45u6Or2SZriRATwrSCSdTyOZf:aJLu6lKiUuQyW
TLSH
T13D914311B200E927E5754633DCD6D2DE7B787D82CE86460B74C43B3F72312D64B20266
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a03ucf1r.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\3W2C654C.Q7V\5O4BRWQ7.GQ0\scre..tion_25b0fbb6ef7eb094_0019.0002_45d12952c94b485c\a03ucf1r.newcfg
Size 561B
SHA256 d5b7575e68f9e0ea345d1bcbdb5f4ee0ef0e719e8a8f27bf7c15c3e90fd2ea41
MD5 1677a384f1a5006b1651cf3f32691be1
SHA1 2376708e05bc2c328a221b4827881903ae506d07
SHA512 314c7252d6cf114e68b5d90209ae6861517df47492a6eb9f11a2802d5e943f668c61e904f537c63e731cb22bce6ec39ac0770d001c4428e0fb37c8256b08e7a0
TLSH
T125F024F930806E6A07631E23C5618745EE721BAB0455109838AF217AAF305DB03B32EE
MD5 SHA1 SHA512 TLSH

Submit Download

ahn4mewm.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\3W2C654C.Q7V\5O4BRWQ7.GQ0\scre..tion_25b0fbb6ef7eb094_0019.0002_45d12952c94b485c\ahn4mewm.newcfg
Size 561B
SHA256 055f257cec4eb4675f35e50afb2d3be4429f7b989919f6f4c2205198e9f59db8
MD5 47ca2cfaad9cb9090623e2cd77691370
SHA1 7364c29c44db8e10054a1d037a32096943549d16
SHA512 387f080905df4a1f7b2c37711ce63d2df1ea5e41a4e8b7a74beb2a3168f384e3774357a875d0be64b8ec0f69455231933b89937b989e6dc11a9530383795b55f
TLSH
T192F024F930806E6A07631E23C5628744EE721BAB0555109838AF617AAF305DB03B32EE
MD5 SHA1 SHA512 TLSH

Submit Download

app.config

Path C:\Users\Admin\AppData\Local\Apps\2.0\3W2C654C.Q7V\5O4BRWQ7.GQ0\scre..tion_25b0fbb6ef7eb094_0019.0002_45d12952c94b485c\app.config
Size 1KB
SHA256 15a0b6ed31df7ad031a0d9825fda4c83ccc3353f7c990acaa946d3ba910a9faf
MD5 4baa313d38b954771ec18e9e00fda45d
SHA1 53cc15a546f5380643c61cacd9f53b13e0e0fc11
SHA512 a011cae1e4677733c8289025ce0b61744182e9d7fbb9119efe13b7d0f616be8aa957f6bb073e2381fcfc4590ed06d05dbf02e2504f1c83b49f4db0a042cc66f7
TLSH
T15221561DB5C0AE9911725632EA3152C1FD70452311A5B0E078DE31779F70ADA0BF37E9
MD5 SHA1 SHA512 TLSH

Submit Download

bjewa355.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\3W2C654C.Q7V\5O4BRWQ7.GQ0\scre..tion_25b0fbb6ef7eb094_0019.0002_45d12952c94b485c\bjewa355.newcfg
Size 561B
SHA256 2d2c5f5b8e21a8ea771f53aba6c8c7c9cd8959d3293c07f20b7af76604bbf988
MD5 12ba5a6d4cca8c5fbaf1be9354ad53a9
SHA1 b2de916814e393a45ce7581c8136c8df5fa59cf6
SHA512 ad00bf3b141f0009ddefea58f70a6beb277ed70487285e2a0659d1c95bbf325c42a5b28ae64a379a6c4ad19af5cfc85a3b7bf5cb6a3fc91a166e0419c750654b
TLSH
T1E1F024F930806F6A07A31E23C5618744EE721BAB0455109838AF217AAF305DF03B32EE
MD5 SHA1 SHA512 TLSH

Submit Download

caj0irws.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\3W2C654C.Q7V\5O4BRWQ7.GQ0\scre..tion_25b0fbb6ef7eb094_0019.0002_45d12952c94b485c\caj0irws.newcfg
Size 561B
SHA256 c5cba30963dabcb8883084d327f5f86442c3725dea794d7ffa63d1fe859e2fc3
MD5 ffd737913cbd6d21163cc08113d63547
SHA1 1fd172bee7e88c7f42b38804c4f1e0fdd526ff5d
SHA512 6099ef271340415608c04c1c6d375bcbe34694f1b8caa0b8066f674d1d80e0b50e64cb7d370435f225b51cc304ba7fc2d5191ad92b272944df3386a7674c7f19
TLSH
T182F024F930806E6A07A31E23C5618744EE721BAB1455109878AF617AAF305DB03B32EE
MD5 SHA1 SHA512 TLSH

Submit Download

dc3a15ed.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\3W2C654C.Q7V\5O4BRWQ7.GQ0\scre..tion_25b0fbb6ef7eb094_0019.0002_45d12952c94b485c\dc3a15ed.newcfg
Size 561B
SHA256 a3c0859477b8a96e77bdba38190e57d311fb930bceb3a6bb6f509cf073c502b4
MD5 1d6ae7811b2a05f5af2d5c7f67aff822
SHA1 e2cfef8bb27e058715dd81c85084d6691f82cf50
SHA512 2871785ec9a8970ccb4b2bf264cfda52a6426386941cd2d1077938283915b6c669d22d2df0f724c532e01cf738e983e9f437a05d9d31a3151ffbf8ea5260cce1
TLSH
T1D0F02BF930806E6A07635D23C5618744EE711B9B04551098386F117AAF305DB03B32EE
MD5 SHA1 SHA512 TLSH

Submit Download

iy0oi0bp.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\3W2C654C.Q7V\5O4BRWQ7.GQ0\scre..tion_25b0fbb6ef7eb094_0019.0002_45d12952c94b485c\iy0oi0bp.newcfg
Size 561B
SHA256 9fe029956f72c379aed93cb139ca848c48a814fb867444b4a4fc9221882445cf
MD5 6f16c403c623edd7697ff53b8da4c60b
SHA1 bae86e950c629a10fc0c4608ab061dafc3e76b98
SHA512 8f92e50282023abce839d595f378acbd5331974d21932f1fdfc797d30ca47d989c20156dbdf05b92bd57efc39a360463fc26aad8e8fac54d3f1db258482bbb22
TLSH
T1E4F024F930806F6A07A31E23C5618744EE721BAB0455109838AF617AAF305DF03B32EE
MD5 SHA1 SHA512 TLSH

Submit Download

m42sc0vt.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\3W2C654C.Q7V\5O4BRWQ7.GQ0\scre..tion_25b0fbb6ef7eb094_0019.0002_45d12952c94b485c\m42sc0vt.newcfg
Size 561B
SHA256 c2fafc7d7c84c3bbce5ad530ecde92428a723d93eff1adcf5a3466c141e6b16f
MD5 3f947a2aa9b245e9768816f7f867bbac
SHA1 ce0095adf55c84337effb5e0074fb60f9f3b29d0
SHA512 040914bd3fb93c6edc14a6aaa713fe993aeae31108cf3c9e89e0751ab981ebfb4d8fceec76fa5ed84c27350d72f235ce1adaf69c2d7832462177c1f1a255bf64
TLSH
T101F02BF930806E5A07A31D23C5618744FD721B9B0455109838AF517AAF305DB03B32DE
MD5 SHA1 SHA512 TLSH

Submit Download

n3angztw.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\3W2C654C.Q7V\5O4BRWQ7.GQ0\scre..tion_25b0fbb6ef7eb094_0019.0002_45d12952c94b485c\n3angztw.newcfg
Size 561B
SHA256 67439388e2b312ade69f9b08c80f2cae853ee181546a6a1d25388cb139c22e16
MD5 2de348401dc02a46a80c5f561a9ce584
SHA1 29a5bb74c514f940a475321de3976eec9a22d9f6
SHA512 74d9e7051eca12da58a4e12e62fac1e38a8ca213f4c0124bbe6b39526a7c57dc8c347c7a768cbaa1ff7da9a197818f8411161f49d23ffc3e33ce49293a4653de
TLSH
T1ECF024F930806F6A07631E23C5618744EE722BAB0455109838AF217AAF305DF07B32EE
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Users\Admin\AppData\Local\Apps\2.0\3W2C654C.Q7V\5O4BRWQ7.GQ0\scre..tion_25b0fbb6ef7eb094_0019.0002_45d12952c94b485c\user.config
Size 561B
SHA256 d63c10ea25c6eeac16a396fa36bf2b71dc48e8322c4330cee71c42af4049b321
MD5 15a6dc9deaa7762c12b343d10d96aec2
SHA1 2cdd2c1ad39eb4b6a704a67b707321a2974ae757
SHA512 cc443acdfb4d2204bb503fc4e815e66babb017b9aeacb50f36943e395a0a846a74aafde6b50f77a2e40164379d58a4a34d11c88ba42c996c022af30959a9de2a
TLSH
T10CF024F930C06E6B07A35E23C5618744EE721BAB0455109838AF217AAF305DB03B32EE
MD5 SHA1 SHA512 TLSH

Submit Download

ybl35xbu.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\3W2C654C.Q7V\5O4BRWQ7.GQ0\scre..tion_25b0fbb6ef7eb094_0019.0002_45d12952c94b485c\ybl35xbu.newcfg
Size 561B
SHA256 a2bb3ed62fd5b6668fa801fa6262698b93d1c820f007d457da45883c4f58e953
MD5 da2a497bbf9ce5400ada32a63da9a4c6
SHA1 d56b12c988ef3dc21a523100272131e6a678682e
SHA512 333d2e74cf68f2234b81c4c7a61b86303ba8d7e13c537400c5ed97b807512351e4748c253784957cca6425e23d63529a97bdb93b1152ddfbc3a9adc608c1ec46
TLSH
T1FAF024F930806E6A07631E23C5618744EE721BAB0455109838AF217AAF305DB03B32EE
MD5 SHA1 SHA512 TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 595B
SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
MD5 4454c8e578515db43fadd90604ae7675
SHA1 3912ffa00c3a5c86fae6500a0074284d9f668976
SHA512 b17559d466cb6954554c4f879b396ff8431c730f837205547ab46329c6517cd35a719378efa55d78c01b739414dd320157f120feb12e28e1ae90ce7c53a0c75c
TLSH
T117F0DC47E7B15216C926123CC89724E1B730F5917DD1162341056F5D2C373101F17CB8
MD5 SHA1 SHA512 TLSH

Submit Download

4Z423TAG.ZW6.application

Path C:\Users\Admin\AppData\Local\Temp\Deployment\BHZ8JTAY.5XE\4Z423TAG.ZW6.application
Size 136KB
SHA256 9f10d0833c8b3ca02f9fd3156041b6fa246bc8768e4bfa800ce5c2d0440bf28e
MD5 3ffb42a41087aacfa43c6bc2a2d563c8
SHA1 b180bde93b574303e0e17d45ad5899faf3d01e44
SHA512 3d0adac243c27f8464a19ad34a5931ace1c1908e4ac6f62031cd7ea48d22b0b3ccf7a7d2e27ec65409a653a271a3dbaf955ad5108918f83f7018cb4b733c36fb
SSDEEP 3072:83SXNOs7Jnv56IRTL9j7/6m2o9HuzhJOvP:nXTVRVj7/6mt8vOvP
TLSH
T129D3083A8E30F4C0477DB021D1A52D673D811B97DBB30FECDA09186A4E69792EF5A64C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\Q0YL78D3.EKW\P5ZJD0Z9.TL4\ScreenConnect.Client.dll
Size 192KB
SHA256 6526705b685c2f221a6675118c73cba98c47d948169d81ea4544c3e3336b8f2b
MD5 7ee2543520d72fd54827f3d11a21ef8d
SHA1 7aca9192a475179f4df8752ecd7eda05948dc6f4
SHA512 a0c65c11ce979cd4142439b64bb5e029a8bde9f2584d51de0231ea6a88aae960e00f3097b1e51847496824a1a76baa99f9fbacb67565704b262c5483bee5b91a
SSDEEP 3072:FxLtNGBlIyS7/OvjusqVFJRJcyzvYqSmzDvJXYA:ftNGBGySavqPJYnqSmG
TLSH
T122144B8633A94E36DA9F5D73B46060358AB5ED066023E3EE5E04F9F61A733408E553E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\Q0YL78D3.EKW\P5ZJD0Z9.TL4\ScreenConnect.Client.dll.genman
Size 1KB
SHA256 948596c07ffcd2ad7c1463894ac108ee05507def70f8a4a97d75a7081266b512
MD5 fc8201e1d21fe244575d479a20a1ed6b
SHA1 cb68303ca575d5b11e5edeb99bcbe9e273f756ab
SHA512 fe324b0a8a482181bbf9e19c4c680d7749c933db201b497d3b599d8ec6c5e3d7c521d487ef7ae4f815ad7f67661871d67f4529452069c3893dad408782279d9f
TLSH
T169117B1581C8FE261F3301D1BEE7E021576D2B37058D194BB0696DAF8B2DAE6434B1B3
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\Q0YL78D3.EKW\P5ZJD0Z9.TL4\ScreenConnect.ClientService.dll
Size 66KB
SHA256 319ba24115e64ea4b714caf4e88d3d5a658defd51d714c2291b9758466925281
MD5 5d4be679ad5c4bfb5144f381d3308ab3
SHA1 27d351219ad62fc914c6c34eed8373fee6de294d
SHA512 e9b07fc27078bb8c706f970120304b816ad5c0eb5a967371f76de42edd397b5b6b5faf9645eed707584a1e1175406958a8daf4b65d20c2cf7aadaddaff1166c9
SSDEEP 768:c3gaRdcdsmzKWOWXlhh6Eg/6QhvoTVcV7K0c4RelfyQFVFlCtskxZgVfS8EX8bED:tCsKWOGmEgLhvoTVF0JJQFVFlPasbg
TLSH
T1B0633B06E3F98A7BC9DF5F7878B5B0450EB08A02E062FB989CC9A5D71B537C119053A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\Q0YL78D3.EKW\P5ZJD0Z9.TL4\ScreenConnect.ClientService.dll.genman
Size 1KB
SHA256 7ba2e686afa757becaec5216ddbc0be75d7d30f9af8233e9160d200efec8aa0f
MD5 df3caec93ec7639a949601f4decef22e
SHA1 5694cd8580d47de4a1406d97794b621c18ac5314
SHA512 21a4e549f554b4270fb0d65636a0fe89604f2c1e8bb97c741c79e40436139fbd35aa18535c8ccc966beba37ebb140f46e4c7a2a401c9906e68fecfdaf549af82
TLSH
T1FF31E71681C8FA251F3302C1BEE7E0619BAD1B33158E1947B05D599B8F2DAA6434B1B3
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\Q0YL78D3.EKW\P5ZJD0Z9.TL4\ScreenConnect.ClientService.exe
Size 93KB
SHA256 f048400c23add8c75abe189393d33c873c02c74eeaf43d47b950c8d643763b35
MD5 752d5cdda2a1d93d27e38f98a5d23fc2
SHA1 d4fd4ff0709271323b8d401579270e6567b6e360
SHA512 f48a21229a8d8cc80371e9aeeb47bb10ff0f3b0363e854ca30db833c74519d37ee21349fa9201c7ed5392ddf5d0ff2a66d250821d109dc0ac7425ab2a5a3fea2
SSDEEP 1536:wg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgUU0HMQ7oOgU:ZhbNDxZGXfdHrX7rAc6myJkgUU0HvMU
TLSH
T1E8935B13B5C28872D473093158E0DAB49A3FF9215E61DEAB3798022E4F741C1AE75EB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\Q0YL78D3.EKW\P5ZJD0Z9.TL4\ScreenConnect.Core.dll
Size 538KB
SHA256 b8100e5ab07983cbf82d721cf719576ca3f60e352628dcaabd42d428011fdedf
MD5 1db8b9fa0bdcbfaab807f715c288c19a
SHA1 fde73710ce063bbf1e377c02a1a8615cf4da1c08
SHA512 fc132764026c682e8fac1a97171731d54880c8d95566c486c731c880e750a29875ac208fb4b4dc2897dfc49beb24f77af016d846c78be75df159d3542600eb73
SSDEEP 6144:SfoUrkyyvsbvpSLmwJUoqnoezGMZf1y99tg03Xdedu1h+xE5vce/6OdCatxq/trJ:SfpkywYszKoIzGafzece/6yx/Oek
TLSH
T144C47D9233B48B2FCABF5B7BE42454980770E901F209EB5B1AD6D4BC5F633854E412E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\Q0YL78D3.EKW\P5ZJD0Z9.TL4\ScreenConnect.Core.dll.genman
Size 1KB
SHA256 1008e0a6ce99adf165f8e173dcd4bb5e0761673aa9c3150f5e010f03d0f6434b
MD5 de014337ef7ec5fbb5e71663889cd9ec
SHA1 be9867f2b5340aa9d59177c1f92235a1f32b0ec6
SHA512 8ab08a2f084602135ec098ecacae8f2ab401b5d655e8f98423119f3ce32e28cdd96725feb4586733db1582ed418d9aede9935338fbf83018e6232271fa22a86a
TLSH
T18F21671181C8FA261F3302D2BEE7E42197AE5B33188D194B7469699FCB2DAD64747073
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\Q0YL78D3.EKW\P5ZJD0Z9.TL4\ScreenConnect.Windows.dll
Size 1.6MB
SHA256 da29455a64858fda773319c32c0a6cd40edbe8042ed005aa2befb8a4f0fb0522
MD5 94216eb90ca53fbb175f0ee6adbfb663
SHA1 48038f060a5042ff44a2d9a9be46368ecc8436fd
SHA512 c6c7e2a63eaccc5703acf4cb482a9e441fb6e670a9086d3ade558a597b1fd6c17f5e5b7027d835b80ebf2c071f9442bde466f313ddb8456fe0d3e4db6d53b041
SSDEEP 24576:VDhFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUTHs:VDhJkGYYpT0+TFiH7efP
TLSH
T14B85BD41E2D364F5D46B047888BF571ABA743C040325CAFB97D4AE3A6D33BC09A36796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\Q0YL78D3.EKW\P5ZJD0Z9.TL4\ScreenConnect.Windows.dll.genman
Size 1KB
SHA256 74bc77d4a907113ee17339077cf42d4919a3d02987325a5fd5608a43f65e60c2
MD5 e800d9b7ccfd86983e809fb76068b9e4
SHA1 f4a6c5d027b144b81d51ce5453f0c39ee1bcc7b7
SHA512 29fe2bf5c4d514b4980a13442647cc988b5b8b869e8dff35ad9d86d95983f3135d5df0c46eee88cd1edd0ce4e79864761f9d600b0d267d10025f660e0a848452
TLSH
T18641E11681C8EA250F3301C2BEEBE431879A5733158E194B7499AA9BCF29AD74747067
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsBackstageShell.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\Q0YL78D3.EKW\P5ZJD0Z9.TL4\ScreenConnect.WindowsBackstageShell.exe
Size 59KB
SHA256 1404090db3128de503ba4d991a960c7c1bc3b910a62d06ecf7e7081a2fcf11b9
MD5 ab9a2c07b3b1222f5ada4cb7c1fd144e
SHA1 22d5e961804073435cd193c1a4b7d3f4c39a64c4
SHA512 909e4e6fb042f30e8e2fccb54b7797410a4c3eb825a2578c679d75d780ba0a06d8a9058ddab66a48a60b3a4a6c4704468826b74fd504cef8b8fc860827707968
SSDEEP 1536:7bHOH2MJv6vmDtyQXIE+TC49IfXWbdS79GT8H:7buH2MJDyQEASSB
TLSH
T115538D4123F80B16D9FF5E39B5E2A5250EB0EA039441E7AE1DCDA5DA0E537806B603F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\Q0YL78D3.EKW\P5ZJD0Z9.TL4\ScreenConnect.WindowsClient.exe
Size 593KB
SHA256 b80d07610b81bddb3d7f30a207a2e134b559e06b8440598a926f3a9c1d439218
MD5 9562334dd9a47ec1239a8667ddc1f01c
SHA1 b46c4e4694783311e2c612ed7f0ca67a88e1e352
SHA512 a4207d106c5253777dc1eb49d644e2f7ba5ab4e6b64bad1f072c4fcd97df38e76b86986a8a7d7441c0c7cedb2e041044c7f9b36f892c9f48836a8db2d22e8500
SSDEEP 6144:PTv8K3EAggQ2nqBly89VXvJthenrMd+3OsJwEKbE00QPG5YgRtAcCI2/R4IRtNup:rUKt/sXvJqu+3OsJwrbE00QuHRgNNmAq
TLSH
T1E7D46C2273B88A7BD9BF0779B0F21C2557B0E8436185D78E49A4ACD91D973818D0E3E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Users\Admin\AppData\Local\Temp\Deployment\Q0YL78D3.EKW\P5ZJD0Z9.TL4\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
TLSH
T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\Q0YL78D3.EKW\P5ZJD0Z9.TL4\ScreenConnect.WindowsClient.exe.genman
Size 2KB
SHA256 cfe9e06a7fc7a776c704f992b1b80c2938133a4b8c1b53bcabe57cade90d44b9
MD5 c342b42f693456b2e0657859d5d06d9a
SHA1 916cb76f8ad3074edea5c7c30f0192d3813f96f7
SHA512 2adb5e7646df905a99ef2278341e7f5dfe3530d6577ab1c7036464a060dbae5a67ae946665044329d0331504a366257c4943259536f2b72e37c73dbf67cf5e54
TLSH
T13E51D41641C8FA210F3301C1BEEBE471979E5B32158E194770999A9FCF2DAA7474B077
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.manifest

Path C:\Users\Admin\AppData\Local\Temp\Deployment\Q0YL78D3.EKW\P5ZJD0Z9.TL4\ScreenConnect.WindowsClient.exe.manifest
Size 17KB
SHA256 d44b7bda547bbbeab6060edd2207e97dbc43c28aa08522b2108866c1ac023dbd
MD5 e1a62c7b0b94e2fbe0d27d9c679b9a97
SHA1 6e6896278eeaa03b4e0cb0c14ad5ef80f3366c02
SHA512 535754df5c489aab01f38a6a60096f3e277309751a8a07d9b8a9b53211365559f0874cd858118a5e56c3abb2e8bced0972e1433ff4fd32cb5f256e872c4a7356
SSDEEP 384:peKEE1rTJUaXOf6zX9WnZgMacc4X9FX9R/QPIYM7Y7:pI6zX9i+yc4X9FX9R/QPIN07
TLSH
T14F82D54A88C07C2153369190BFF38A10BE557B3301EE14CABC5E55AF8F6569893972B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsFileManager.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\Q0YL78D3.EKW\P5ZJD0Z9.TL4\ScreenConnect.WindowsFileManager.exe
Size 79KB
SHA256 13f8cfe4648b807a0cbddd653c75254b60d1951e11e715f4e5a1a2c9ab29360b
MD5 130176db1b368a8290ebda3ce17db7c8
SHA1 5c1ffa4074937594b8fddd76720d7943f4f5ad55
SHA512 8830e75925e71d72c4144f053db5f97e3920ac8d27d4ac04888a10e7648f1f6d90a69a72415a56ea18ac9d49db52334432232f28ee6099e57ba50ea13311aebc
SSDEEP 1536:Mtypl44jzbHI5kLP+VVVVVVVVVVVVVVVVVVVVVVVVVC7Ky7ynD:3rfukLdOyWD
TLSH
T1C683E58235762631DF85C5379492C9B59D366F22133DC5BD2DA2FE3A69F03043A8ADB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2712-388-0x0000027D001E0000-0x0000027D002E0000-memory.dmp

Download

memory/2712-418-0x0000027D01C00000-0x0000027D01C20000-memory.dmp

Download

memory/2712-403-0x0000027D019A0000-0x0000027D019C0000-memory.dmp

Download

memory/2712-432-0x0000027D041E0000-0x0000027D04200000-memory.dmp

Download

memory/2712-404-0x0000027D01E20000-0x0000027D01F20000-memory.dmp

Download

memory/4808-288-0x00000000001B0000-0x0000000000248000-memory.dmp

Download

memory/4808-299-0x00000000023A0000-0x00000000023B8000-memory.dmp

Download

memory/4852-41-0x000001FA23960000-0x000001FA239F8000-memory.dmp

Download

memory/4852-65-0x000001FA23C20000-0x000001FA23DCC000-memory.dmp

Download

memory/4852-289-0x00007FFBEB330000-0x00007FFBEBCD4000-memory.dmp

Download

memory/4852-296-0x00007FFBEB330000-0x00007FFBEBCD4000-memory.dmp

Download

memory/4852-59-0x000001FA20FD0000-0x000001FA20FE8000-memory.dmp

Download

memory/4852-53-0x000001FA21010000-0x000001FA21046000-memory.dmp

Download

memory/4852-308-0x00007FFBEB330000-0x00007FFBEBCD4000-memory.dmp

Download

memory/4852-309-0x00007FFBEB330000-0x00007FFBEBCD4000-memory.dmp

Download

memory/4852-47-0x000001FA23950000-0x000001FA239DC000-memory.dmp

Download

memory/4852-2-0x000001FA1EE10000-0x000001FA1EF98000-memory.dmp

Download

memory/4852-31-0x00007FFBEB330000-0x00007FFBEBCD4000-memory.dmp

Download

memory/4852-24-0x00007FFBEB330000-0x00007FFBEBCD4000-memory.dmp

Download

memory/4852-14-0x00007FFBEB330000-0x00007FFBEBCD4000-memory.dmp

Download

memory/4852-13-0x000001FA20F80000-0x000001FA20FD0000-memory.dmp

Download

memory/4852-10-0x00007FFBEB330000-0x00007FFBEBCD4000-memory.dmp

Download

memory/4852-9-0x00007FFBEB330000-0x00007FFBEBCD4000-memory.dmp

Download

memory/4852-8-0x00007FFBEB330000-0x00007FFBEBCD4000-memory.dmp

Download

memory/4852-7-0x00007FFBEB330000-0x00007FFBEBCD4000-memory.dmp

Download

memory/4852-6-0x00007FFBEB330000-0x00007FFBEBCD4000-memory.dmp

Download

memory/4852-5-0x00007FFBEB330000-0x00007FFBEBCD4000-memory.dmp

Download

memory/4852-4-0x00007FFBEB330000-0x00007FFBEBCD4000-memory.dmp

Download

memory/4852-3-0x00007FFBEB330000-0x00007FFBEBCD4000-memory.dmp

Download

memory/4852-0-0x00007FFBEB4BF000-0x00007FFBEB4C0000-memory.dmp

Download

memory/4852-1-0x000001FA04690000-0x000001FA04698000-memory.dmp

Download