0b6ee0ce1266e4d0c4efb665b746af863994920293d1afc136a07a1f44e88b43

Analysis

max time kernel
122s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/07/2026, 12:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
support.client.exe
Size 305KB
Sample260703-pfsfdady5n
SHA256 0b6ee0ce1266e4d0c4efb665b746af863994920293d1afc136a07a1f44e88b43
MD5 d12aaf47b06eb2871df151bcc9f03179
SHA1 a609ea2a07db62254a07b4fa959eae5d2fb03bc5
SHA512 305da30548e3c4c8691402c09b8d04a4d9f463249fe69940eb3388a61c3942d3a1ba9f956288762668d65769b73324ba7bc870fc12a51585ac106b9f6cda79a2
SSDEEP 6144:amlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9:p1iw7gryNkSV1hy1Z1u2JLu9
TLSH
T1D9646C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware defense_evasion discovery persistence ransomware revoked_codesign spyware trojan

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Manipulates Digital Signatures 1 TTPs 4 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C\Blob = 0300000001000000140000007b0f360b775f76c94a12ca48445aa2d2a875701c2000000001000000b4060000308206b030820498a003020102021008ad40b260d29c4c9f5ecda9bd93aed9300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3231303432393030303030305a170d3336303432383233353935395a3069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e6720525341343039362053484133383420323032312043413130820222300d06092a864886f70d01010105000382020f003082020a0282020100d5b42f42d028ad78b75dd539591bb18842f5338ceb3d819770c5bbc48526309fa48e68d85cf5eb342407e14b4fd37843f417d71edaf9d2d5671a524f0ea157fc8899c191cc81033e4d702464b38de2087d347d4c8057126b439a99f2c53b1ff2efcb475a13a64cb3012025f310d38bb2fb08f08ae09d09c065a7fa98804935873d5119e8902178452ea19f2ce118c21accc5ee93497042328ffbc6ea1cf3656891a24d4c8211485268de10bd14575de8181365c57fb24f852c48a4568435d6f92e9caa0015d137fe1a0694c27cc8ea1b32e6cac2f4a7a3030e74a5af39b6ab6012e3e8d6b9f731e1dcade418a0d8c1234747b3a10f6ea3ab6d9806831bb76a672dd2bd441a9210818fb03b09d7c79b325ac2ff6a60548b49c193ede1b45ce06feb26f98cd5b2f93810e6eace91f5bed3fb6f9361345cbc93452883362a66285fb073ce8b262506b283d45cf615194ced62e05e33f2e8e8ec0aa7b0032b91b23679bef7ad081e75a665ccbbe34850f377911afedb50a246c8615898f57c02163c8328ad3986ecd4b70d53d0f847e675308dec30937614a65b4b5d74614d3f129176debf58cb72102941f0d5c56d267668114113589adc262b01f4894d59db78cf814a3e40475fc98150738510232159608a6454c1cc211ae838197c661ccd78384530994fff634f4cbbaa0d0853417c583d47b3fab6ec8c320902cc6c3c0c56110203010001a38201593082015530120603551d130101ff040830060101ff020100301d0603551d0e041604146837e0ebb63bf85f1186fbfe617b088865f44e42301f0603551d23041830168014ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300e0603551d0f0101ff04040302018630130603551d25040c300a06082b06010505070303307706082b06010505070101046b3069302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304106082b060105050730028635687474703a2f2f636163657274732e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63727430430603551d1f043c303a3038a036a0348632687474703a2f2f63726c332e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63726c301c0603551d20041530133007060567810c01033008060667810c010401300d06092a864886f70d01010c050003820201003a23443d8d0876ee8fbc3a99d356e0021aa5f84834f32cb6e67466f79472b100caaf6c302713129e90449f4bfd9ea37c26d537bc3a5d486d95d53f49f427bb16814550fd9cbdb685e0767e3771cb22f75aaa90cff5936ae3eb20d1d55079889a8a8ac1b6bda148187edcd8801a111918cd61998156f6c9e376e7c4e41b5f43f83e94ff76393d9ed499cf4add28eb5f26a1955848d51afed7273ffd90d17686dd1cb0605cf30da8eee089a1bd39e1384eda6ebb369dfbe521535ac3cae96af1a23edb43b833c84f38149299f5ddce546dd95d02141f40337c03e295b2c221757352cb46d8c4341ca2a54b8dcd6f76372c853f1ace26e918be9007b0437f9588208270f0cccaeffd29355c1f893855f7378a8b09a1cb0be9311aff2e195c3971e1be9ca70a06d62667b792e64e5fde7aac49cf2ea47492addb3ca49c861fe3c1561b2b23ff8fb5ea887b706be6a0bafd3a3f45a6c4e81691528b41c048844b964dab4440e38df01528ceedf11856072a2f10c40c08643c338fae288c3ccb8f880b0dbf3bf4ce1e7b8eefb5ebcbb7f07713e6e7283fac12aea52f226c41f9825c1566cc6c0ecac586c3f626330c074ba0d307026a6a4030484b34a85120bbad1b8508e2590d6dca05502bea4a1c9ea5fda0a71f0674e7f2d65290fdaf854821f9573bb49c03ed8645f4b4616ebf68e2266086eac8afa9fe941de7631b3a8656784e	support.client.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4C2272FBA7A7380F55E2A424E9E624AEE1C14579\Blob = 0300000001000000140000004c2272fba7a7380f55e2a424e9e624aee1c145792000000001000000640700003082076030820548a00302010202100b9360051bccf66642998998d5ba97ce300d06092a864886f70d01010b05003069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e67205253413430393620534841333834203230323120434131301e170d3232303831373030303030305a170d3235303831353233353935395a3065310b30090603550406130255533110300e06035504081307466c6f72696461310e300c0603550407130554616d706131193017060355040a1310436f6e6e656374776973652c204c4c433119301706035504031310436f6e6e656374776973652c204c4c4330820222300d06092a864886f70d01010105000382020f003082020a0282020100ec489826d08d2c6de21b3cd3676db1e0e50cb1ff75ff564e9741f9574aa3640aa8297294a05b4db68abd0760b6b05b50ce92ff42a4e390be776a43e9961c722f6b3a4d5c880bcc6a61b4026f9137d36b2b7e9b86055876b9fa860dbcb164fe7f4b5b9de4799ae4e02dc1f0bee01e5d032933a2827388f8db0b482e76c441b1bd50909ef2023e1fb62196c994ce052266b28cd89253e6416044133139764db5fc45702529536bf82c775f9ec81fa27dc409530325f40cdef95b81b9ce0d42791cee72e7bd1b36c257b52257c65a28970e457513989434bfc239e2992b193e1b3cc3f11ccdd1d26d4ec9845099ab913906a42069af999c0071169b45a2ea1aa666f1904e8acb05e1823a359a291fd46b4ef7aed5935bb6ab17ebf077210726930c90f01761d6544a94e8fa614cc41d817eec734b1c3d3afb7c58fb256f0c09edc1459bddbff9940ed1958570265d67af79a9b6a16affd70fc6328c9810d5dc186e39af6fbcad49a270f237e6bcd5de0bc014bc3179cd79776591340311a42ca94f33416c2e01b59bd1d71de86ace6716bc90b2d7695d155039aa08fbac19a4d93fb784230a20a485287a16355645fc09142c602d140fa046b7bfd75328184ff7bdf8f9e0d65e6201c8d242931047f59bd328ac353777ccefa60408887b84fc3631301463461a1d73c0b5cc74d6d82905ddf923bdbab027a311cc38d3fa16f639a50203010001a382020630820202301f0603551d230418301680146837e0ebb63bf85f1186fbfe617b088865f44e42301d0603551d0e04160414338ce10a6e06d9c6ed0bc6cae736cefb8188646a300e0603551d0f0101ff04040302078030130603551d25040c300a06082b060105050703033081b50603551d1f0481ad3081aa3053a051a04f864d687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c3053a051a04f864d687474703a2f2f63726c342e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c303e0603551d20043730353033060667810c0104013029302706082b06010505070201161b687474703a2f2f7777772e64696769636572742e636f6d2f43505330819406082b06010505070101048187308184302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d305c06082b060105050730028650687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e637274300c0603551d130101ff04023000300d06092a864886f70d01010b050003820201000ad79f00cf4984864c8981ecce8718aa875647f6a74608c968e16568c7aa9d711ed7341676038067f01330c91621b27a2a8894c4108c268162a31f13f9757a7d6bb3c6f19bf27c3a29896d712d85873627d827cd6471761444fabf1d31e903f791143c5b4ce5e7444aacba36d759aeba3069d195226755cbc675aa747f77596c53c96e083c45bba24479d6845eea9f2b28ba29b4dcf0bcf14aa4ce176c24e2c1b8fec3ee16e1c086db6fda97388859e83be65c03f701395b78b842c6dd1533ef642cca6fe50f6337d3f2dfedd8b28f2b28e0c98edd2151392e7cc75489f48859f1de14c81b306eb50eed7bb78be30eaada76767c4ca523a11eec5a2372d6122926ab1801a6a6778e9504791487ee47d4577154988802070f80fc535957658f954cd083546c5afb5a6567b6761275f5db20f70ab86feef94c7cfc65369d325121b69a82399bc7dc1962416f0f05cf1eee64d495a3527e464e2c68da0187093f97b673e43dddbcc067e00713f1565fcff8c3772d44b40a04e600644f22a990345f9a6b5b52963e82c81a0ce91d43a230f67b37d8debda40ea3d59d305e18adc1976516c12a8ba2bca24143b12e9527b4dca58872aa9b3a8c6ac563fc2dc02bf51be889516d35a4ba9d062417b5bdcc50ba945fae26b60d6aec03984798a6a21d3ff793cc0849e81ed55b8027411c50db776ae8feef2fdc2dafb04345261dedc054	support.client.exe
Key deleted	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C	support.client.exe
Key deleted	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4C2272FBA7A7380F55E2A424E9E624AEE1C14579	support.client.exe

Signed with revoked ConnectWise certificate 4 IoCs

Binary is signed using a ConnectWise certificate revoked for key compromise.

revoked_codesign

resource	yara_rule
behavioral2/files/0x000e00000001c4a7-41.dat	revoked_cert_connectwise
behavioral2/files/0x000d00000001c4a2-193.dat	revoked_cert_connectwise
behavioral2/files/0x000d00000001c4a1-194.dat	revoked_cert_connectwise
behavioral2/files/0x000e00000001c4a6-189.dat	revoked_cert_connectwise

Executes dropped EXE 1 IoCs

pid	Process
2808	ScreenConnect.WindowsClient.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\JM6BBPTM.4KZ\06G6E3ZQ.7GT\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	support.client.exe

Checks SCSI registry key(s) 3 TTPs 62 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dfsvc.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_25b0fbb6ef7eb0 = 32003000320036002f00300037002f00300033002000310032003a00310036003a00350034000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0019.0002_none_a32dbc410e6434d0\implication!scre..tion_25b0fbb6ef7eb094_0019.0002_42d = 68747470733a2f2f6f6a757269746f73632e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0002_none_a32dbc410e6434d0\DigestMethod = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0002_none_a32dbc410e6434d0\Files	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_4b14c015c87c1ad8_0019.0002_none_41e6e31d258051c3\DigestMethod = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications\scre..tion_25b0fbb6ef7eb094_0019.0002_e53f9ad5b47ea481\identity = 68747470733a2f2f6f6a757269746f73632e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_4b14c015c87c1ad8_0019.0002_none_465ebafe61ce64f3	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_4b14c015c87c1ad8_0019.0002_none_465ebafe61ce64f3	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\ComponentStore_RandomString = "0QTDC4ORAG5WQCO54YR1Y1QA"	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\NonCanonicalData	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0002_none_a32dbc410e6434d0\Transform = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_4b14c015c87c1ad8_0019.0002_none_f33a7b65bb3fb52e\DigestValue = 27d351219ad62fc914c6c34eed8373fee6de294d	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0019.0002_none_d7fc40ef34cfa7c7\lock!06000000e8ea580ef80a0000841200000000000000000000 = 30303030306166382c30316464306165356436376466323962	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_25b0fbb6ef7eb0 = 30000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_4b14c015c87c1ad8_0019.0002_none_41e6e31d258051c3\identity = 53637265656e436f6e6e6563742e436f72652c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d819169b5504f\SizeOfStronglyNamedComponent = c04f040000000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d819169b5504f\Files	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0019.0002_e53f9ad5b47ea481\scre..ient_4b14c015c87c1ad8_0019.0002_none_a32dbc410e	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0019.0002_e53f9ad5b47ea481\scre..ient_4b14c015c87c1ad8_0019.0002_none_a32dbc410e = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0019.0002_e53f9ad5b47ea481\scre..ient_4b14c015c87c1ad8_0019.0002_none_d7fc40ef34	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0019.0002_none_a32dbc410e6434d0	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d819169b5504f\DigestMethod = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_4b14c015c87c1ad8_0019.0002_none_f33a7b65bb3fb52e\Transform = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Assemblies	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_25b0fbb6ef7eb0 = 680074007400700073003a002f002f006f006a0075007200690074006f00730063002e0063006f006d002f00420069006e002f00530063007200650065006e0043006f006e006e006500630074002e0043006c00690065006e0074002e006100700070006c00690063006100740069006f006e002300530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f007700730043006c00690065006e0074002e006100700070006c00690063006100740069006f006e002c002000560065007200730069006f006e003d00320035002e0032002e0034002e0039003200320039002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d0032003500620030006600620062003600650066003700650062003000390034002c002000700072006f0063006500730073006f0072004100720063006800690074006500630074007500720065003d006d00730069006c002f00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f007700730043006c00690065006e0074002e006500780065002c002000560065007200730069006f006e003d00320035002e0032002e0034002e0039003200320039002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d0032003500620030006600620062003600650066003700650062003000390034002c002000700072006f0063006500730073006f0072004100720063006800690074006500630074007500720065003d006d00730069006c002c00200074007900700065003d00770069006e00330032000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Categories	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d819169b5504f\Files\ScreenConnect.ClientService.exe_e781b1ee36 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_4b14c015c87c1ad8_0019.0002_none_f33a7b65bb3fb52e\identity = 53637265656e436f6e6e6563742e436c69656e74536572766963652c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0019.0002_42dcf53ddb2f322c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications\scre..tion_25b0fbb6ef7eb094_0019.0002_e53f9ad5b47ea481	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_25b0fbb6ef7eb0 = 0000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_4b14c015c87c1ad8_0019.0002_none_465ebafe61ce64f3\DigestMethod = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0002_none_d7fc40ef34cfa7c7	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0019.0002_e53f9ad5b47ea481\scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d819169	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_25b0fbb6ef7eb094_0019.0002_none_2771bb27d0341a32	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0019.0002_e53f9ad5b47ea481\scre..core_4b14c015c87c1ad8_0019.0002_none_41e6e31d25	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_4b14c015c87c1ad8_0019.0002_none_465ebafe61ce64f3\DigestValue = 48038f060a5042ff44a2d9a9be46368ecc8436fd	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\Gi_scre..tion_25b0fbb6ef7eb094_9edfe039055229dd\LastRunVersion = 68747470733a2f2f6f6a757269746f73632e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications\scre..tion_25b0fbb6ef7eb094_0019.0002_e53f9ad5b47ea481\HasRunBefore = 01	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_4b14c015c87c1ad8_0019.0002_none_465ebafe61ce64f3\implication!scre..tion_25b0fbb6ef7eb094_0019.0002_42d = 68747470733a2f2f6f6a757269746f73632e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0002_none_d7fc40ef34cfa7c7\DigestValue = 7aca9192a475179f4df8752ecd7eda05948dc6f4	dfsvc.exe
Key deleted	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0002_none_a32dbc410e6434d0\SizeOfStronglyNamedComponent = d96a090000000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_4b14c015c87c1ad8_0019.0002_none_f33a7b65bb3fb52e	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_25b0fbb6ef7eb094_0019.0002_none_2771bb27d0341a32\lock!02000000e8ea580ef80a0000841200000000000000000000 = 30303030306166382c30316464306165356436376466323962	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_25b0fbb6ef7eb094_0019.0002_42dcf53ddb2f322c\pin!S_{3f471841-eef2-47d6-89c0-d028f03a4ad5}	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0002_none_a32dbc410e6434d0	dfsvc.exe

Modifies system certificate store 2 TTPs 6 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C	support.client.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C\Blob = 0300000001000000140000007b0f360b775f76c94a12ca48445aa2d2a875701c2000000001000000b4060000308206b030820498a003020102021008ad40b260d29c4c9f5ecda9bd93aed9300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3231303432393030303030305a170d3336303432383233353935395a3069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e6720525341343039362053484133383420323032312043413130820222300d06092a864886f70d01010105000382020f003082020a0282020100d5b42f42d028ad78b75dd539591bb18842f5338ceb3d819770c5bbc48526309fa48e68d85cf5eb342407e14b4fd37843f417d71edaf9d2d5671a524f0ea157fc8899c191cc81033e4d702464b38de2087d347d4c8057126b439a99f2c53b1ff2efcb475a13a64cb3012025f310d38bb2fb08f08ae09d09c065a7fa98804935873d5119e8902178452ea19f2ce118c21accc5ee93497042328ffbc6ea1cf3656891a24d4c8211485268de10bd14575de8181365c57fb24f852c48a4568435d6f92e9caa0015d137fe1a0694c27cc8ea1b32e6cac2f4a7a3030e74a5af39b6ab6012e3e8d6b9f731e1dcade418a0d8c1234747b3a10f6ea3ab6d9806831bb76a672dd2bd441a9210818fb03b09d7c79b325ac2ff6a60548b49c193ede1b45ce06feb26f98cd5b2f93810e6eace91f5bed3fb6f9361345cbc93452883362a66285fb073ce8b262506b283d45cf615194ced62e05e33f2e8e8ec0aa7b0032b91b23679bef7ad081e75a665ccbbe34850f377911afedb50a246c8615898f57c02163c8328ad3986ecd4b70d53d0f847e675308dec30937614a65b4b5d74614d3f129176debf58cb72102941f0d5c56d267668114113589adc262b01f4894d59db78cf814a3e40475fc98150738510232159608a6454c1cc211ae838197c661ccd78384530994fff634f4cbbaa0d0853417c583d47b3fab6ec8c320902cc6c3c0c56110203010001a38201593082015530120603551d130101ff040830060101ff020100301d0603551d0e041604146837e0ebb63bf85f1186fbfe617b088865f44e42301f0603551d23041830168014ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300e0603551d0f0101ff04040302018630130603551d25040c300a06082b06010505070303307706082b06010505070101046b3069302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304106082b060105050730028635687474703a2f2f636163657274732e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63727430430603551d1f043c303a3038a036a0348632687474703a2f2f63726c332e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63726c301c0603551d20041530133007060567810c01033008060667810c010401300d06092a864886f70d01010c050003820201003a23443d8d0876ee8fbc3a99d356e0021aa5f84834f32cb6e67466f79472b100caaf6c302713129e90449f4bfd9ea37c26d537bc3a5d486d95d53f49f427bb16814550fd9cbdb685e0767e3771cb22f75aaa90cff5936ae3eb20d1d55079889a8a8ac1b6bda148187edcd8801a111918cd61998156f6c9e376e7c4e41b5f43f83e94ff76393d9ed499cf4add28eb5f26a1955848d51afed7273ffd90d17686dd1cb0605cf30da8eee089a1bd39e1384eda6ebb369dfbe521535ac3cae96af1a23edb43b833c84f38149299f5ddce546dd95d02141f40337c03e295b2c221757352cb46d8c4341ca2a54b8dcd6f76372c853f1ace26e918be9007b0437f9588208270f0cccaeffd29355c1f893855f7378a8b09a1cb0be9311aff2e195c3971e1be9ca70a06d62667b792e64e5fde7aac49cf2ea47492addb3ca49c861fe3c1561b2b23ff8fb5ea887b706be6a0bafd3a3f45a6c4e81691528b41c048844b964dab4440e38df01528ceedf11856072a2f10c40c08643c338fae288c3ccb8f880b0dbf3bf4ce1e7b8eefb5ebcbb7f07713e6e7283fac12aea52f226c41f9825c1566cc6c0ecac586c3f626330c074ba0d307026a6a4030484b34a85120bbad1b8508e2590d6dca05502bea4a1c9ea5fda0a71f0674e7f2d65290fdaf854821f9573bb49c03ed8645f4b4616ebf68e2266086eac8afa9fe941de7631b3a8656784e	support.client.exe
Key created	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4C2272FBA7A7380F55E2A424E9E624AEE1C14579	support.client.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4C2272FBA7A7380F55E2A424E9E624AEE1C14579\Blob = 0300000001000000140000004c2272fba7a7380f55e2a424e9e624aee1c145792000000001000000640700003082076030820548a00302010202100b9360051bccf66642998998d5ba97ce300d06092a864886f70d01010b05003069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e67205253413430393620534841333834203230323120434131301e170d3232303831373030303030305a170d3235303831353233353935395a3065310b30090603550406130255533110300e06035504081307466c6f72696461310e300c0603550407130554616d706131193017060355040a1310436f6e6e656374776973652c204c4c433119301706035504031310436f6e6e656374776973652c204c4c4330820222300d06092a864886f70d01010105000382020f003082020a0282020100ec489826d08d2c6de21b3cd3676db1e0e50cb1ff75ff564e9741f9574aa3640aa8297294a05b4db68abd0760b6b05b50ce92ff42a4e390be776a43e9961c722f6b3a4d5c880bcc6a61b4026f9137d36b2b7e9b86055876b9fa860dbcb164fe7f4b5b9de4799ae4e02dc1f0bee01e5d032933a2827388f8db0b482e76c441b1bd50909ef2023e1fb62196c994ce052266b28cd89253e6416044133139764db5fc45702529536bf82c775f9ec81fa27dc409530325f40cdef95b81b9ce0d42791cee72e7bd1b36c257b52257c65a28970e457513989434bfc239e2992b193e1b3cc3f11ccdd1d26d4ec9845099ab913906a42069af999c0071169b45a2ea1aa666f1904e8acb05e1823a359a291fd46b4ef7aed5935bb6ab17ebf077210726930c90f01761d6544a94e8fa614cc41d817eec734b1c3d3afb7c58fb256f0c09edc1459bddbff9940ed1958570265d67af79a9b6a16affd70fc6328c9810d5dc186e39af6fbcad49a270f237e6bcd5de0bc014bc3179cd79776591340311a42ca94f33416c2e01b59bd1d71de86ace6716bc90b2d7695d155039aa08fbac19a4d93fb784230a20a485287a16355645fc09142c602d140fa046b7bfd75328184ff7bdf8f9e0d65e6201c8d242931047f59bd328ac353777ccefa60408887b84fc3631301463461a1d73c0b5cc74d6d82905ddf923bdbab027a311cc38d3fa16f639a50203010001a382020630820202301f0603551d230418301680146837e0ebb63bf85f1186fbfe617b088865f44e42301d0603551d0e04160414338ce10a6e06d9c6ed0bc6cae736cefb8188646a300e0603551d0f0101ff04040302078030130603551d25040c300a06082b060105050703033081b50603551d1f0481ad3081aa3053a051a04f864d687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c3053a051a04f864d687474703a2f2f63726c342e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c303e0603551d20043730353033060667810c0104013029302706082b06010505070201161b687474703a2f2f7777772e64696769636572742e636f6d2f43505330819406082b06010505070101048187308184302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d305c06082b060105050730028650687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e637274300c0603551d130101ff04023000300d06092a864886f70d01010b050003820201000ad79f00cf4984864c8981ecce8718aa875647f6a74608c968e16568c7aa9d711ed7341676038067f01330c91621b27a2a8894c4108c268162a31f13f9757a7d6bb3c6f19bf27c3a29896d712d85873627d827cd6471761444fabf1d31e903f791143c5b4ce5e7444aacba36d759aeba3069d195226755cbc675aa747f77596c53c96e083c45bba24479d6845eea9f2b28ba29b4dcf0bcf14aa4ce176c24e2c1b8fec3ee16e1c086db6fda97388859e83be65c03f701395b78b842c6dd1533ef642cca6fe50f6337d3f2dfedd8b28f2b28e0c98edd2151392e7cc75489f48859f1de14c81b306eb50eed7bb78be30eaada76767c4ca523a11eec5a2372d6122926ab1801a6a6778e9504791487ee47d4577154988802070f80fc535957658f954cd083546c5afb5a6567b6761275f5db20f70ab86feef94c7cfc65369d325121b69a82399bc7dc1962416f0f05cf1eee64d495a3527e464e2c68da0187093f97b673e43dddbcc067e00713f1565fcff8c3772d44b40a04e600644f22a990345f9a6b5b52963e82c81a0ce91d43a230f67b37d8debda40ea3d59d305e18adc1976516c12a8ba2bca24143b12e9527b4dca58872aa9b3a8c6ac563fc2dc02bf51be889516d35a4ba9d062417b5bdcc50ba945fae26b60d6aec03984798a6a21d3ff793cc0849e81ed55b8027411c50db776ae8feef2fdc2dafb04345261dedc054	support.client.exe
Key deleted	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C	support.client.exe
Key deleted	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4C2272FBA7A7380F55E2A424E9E624AEE1C14579	support.client.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\JM6BBPTM.4KZ\06G6E3ZQ.7GT\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe
File created	C:\Users\Admin\AppData\Local\Apps\2.0\0QTDC4OR.AG5\WQCO54YR.1Y1\scre..ient_4b14c015c87c1ad8_0019.0002_none_a32dbc410e6434d0\ScreenConnect.WindowsClient.exe\:Zone.Identifier:$DATA	dfsvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1372	explorer.exe
1372	explorer.exe

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeDebugPrivilege	5904	dfsvc.exe
Token: SeShutdownPrivilege	1372	explorer.exe
Token: SeCreatePagefilePrivilege	1372	explorer.exe
Token: SeShutdownPrivilege	1372	explorer.exe
Token: SeCreatePagefilePrivilege	1372	explorer.exe
Token: SeShutdownPrivilege	1372	explorer.exe
Token: SeCreatePagefilePrivilege	1372	explorer.exe
Token: SeShutdownPrivilege	1372	explorer.exe
Token: SeCreatePagefilePrivilege	1372	explorer.exe
Token: SeShutdownPrivilege	1372	explorer.exe
Token: SeCreatePagefilePrivilege	1372	explorer.exe
Token: SeShutdownPrivilege	1372	explorer.exe
Token: SeCreatePagefilePrivilege	1372	explorer.exe
Token: SeShutdownPrivilege	1372	explorer.exe
Token: SeCreatePagefilePrivilege	1372	explorer.exe
Token: SeShutdownPrivilege	1372	explorer.exe
Token: SeCreatePagefilePrivilege	1372	explorer.exe
Token: SeShutdownPrivilege	1372	explorer.exe
Token: SeCreatePagefilePrivilege	1372	explorer.exe
Token: SeShutdownPrivilege	1372	explorer.exe
Token: SeCreatePagefilePrivilege	1372	explorer.exe
Token: SeShutdownPrivilege	1372	explorer.exe
Token: SeCreatePagefilePrivilege	1372	explorer.exe
Token: SeShutdownPrivilege	1372	explorer.exe
Token: SeCreatePagefilePrivilege	1372	explorer.exe
Token: SeShutdownPrivilege	1372	explorer.exe
Token: SeCreatePagefilePrivilege	1372	explorer.exe
Token: SeShutdownPrivilege	1372	explorer.exe
Token: SeCreatePagefilePrivilege	1372	explorer.exe
Token: SeShutdownPrivilege	1372	explorer.exe
Token: SeCreatePagefilePrivilege	1372	explorer.exe
Token: SeShutdownPrivilege	1372	explorer.exe
Token: SeCreatePagefilePrivilege	1372	explorer.exe
Token: SeShutdownPrivilege	1372	explorer.exe
Token: SeCreatePagefilePrivilege	1372	explorer.exe
Token: SeShutdownPrivilege	1372	explorer.exe
Token: SeCreatePagefilePrivilege	1372	explorer.exe
Token: SeShutdownPrivilege	1372	explorer.exe
Token: SeCreatePagefilePrivilege	1372	explorer.exe
Token: SeShutdownPrivilege	1372	explorer.exe
Token: SeCreatePagefilePrivilege	1372	explorer.exe
Token: SeShutdownPrivilege	1372	explorer.exe
Token: SeCreatePagefilePrivilege	1372	explorer.exe
Token: SeShutdownPrivilege	1372	explorer.exe
Token: SeCreatePagefilePrivilege	1372	explorer.exe

Suspicious use of FindShellTrayWindow 53 IoCs

pid	Process
5400	sihost.exe
1372	explorer.exe
1372	explorer.exe
1372	explorer.exe
1372	explorer.exe
1372	explorer.exe
1372	explorer.exe
1372	explorer.exe
1372	explorer.exe
1372	explorer.exe
1372	explorer.exe
1372	explorer.exe
1372	explorer.exe
1372	explorer.exe
1372	explorer.exe
1372	explorer.exe
1372	explorer.exe
1372	explorer.exe
1372	explorer.exe
1372	explorer.exe
1372	explorer.exe
1372	explorer.exe
1372	explorer.exe
1372	explorer.exe
1372	explorer.exe
1372	explorer.exe
1372	explorer.exe
1372	explorer.exe
1372	explorer.exe
1372	explorer.exe
1372	explorer.exe
1372	explorer.exe
1372	explorer.exe
1372	explorer.exe
1372	explorer.exe
1372	explorer.exe
1372	explorer.exe
1372	explorer.exe
1372	explorer.exe
1372	explorer.exe
1372	explorer.exe
1372	explorer.exe
1372	explorer.exe
1372	explorer.exe
1372	explorer.exe
1372	explorer.exe
1372	explorer.exe
1372	explorer.exe
1372	explorer.exe
1372	explorer.exe
1372	explorer.exe
1372	explorer.exe
1372	explorer.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
1372	explorer.exe
1372	explorer.exe
1372	explorer.exe
1372	explorer.exe
1372	explorer.exe
1372	explorer.exe
1372	explorer.exe
1372	explorer.exe
1372	explorer.exe
1372	explorer.exe
1372	explorer.exe
1372	explorer.exe
1372	explorer.exe
1372	explorer.exe
1372	explorer.exe
1372	explorer.exe
1372	explorer.exe
1372	explorer.exe
1372	explorer.exe
1372	explorer.exe
1372	explorer.exe
1372	explorer.exe
1372	explorer.exe
1372	explorer.exe
1372	explorer.exe
1372	explorer.exe
1372	explorer.exe
1372	explorer.exe
1372	explorer.exe
1372	explorer.exe
1372	explorer.exe
1372	explorer.exe
1372	explorer.exe
1372	explorer.exe
1372	explorer.exe
1372	explorer.exe
1372	explorer.exe
1372	explorer.exe
1372	explorer.exe
1372	explorer.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1992	StartMenuExperienceHost.exe
6136	SearchHost.exe
1372	explorer.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4932 wrote to memory of 5904	4932	support.client.exe	88
PID 5904 wrote to memory of 2808	5904	dfsvc.exe	89
PID 5400 wrote to memory of 1372	5400	sihost.exe	95

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\support.client.exe
"C:\Users\Admin\AppData\Local\Temp\support.client.exe"
1⤵
- Manipulates Digital Signatures
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:4932
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5904
- - C:\Users\Admin\AppData\Local\Apps\2.0\0QTDC4OR.AG5\WQCO54YR.1Y1\scre..tion_25b0fbb6ef7eb094_0019.0002_e53f9ad5b47ea481\ScreenConnect.WindowsClient.exe
    "C:\Users\Admin\AppData\Local\Apps\2.0\0QTDC4OR.AG5\WQCO54YR.1Y1\scre..tion_25b0fbb6ef7eb094_0019.0002_e53f9ad5b47ea481\ScreenConnect.WindowsClient.exe"
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    PID:2808

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5400
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:1372

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:6136

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1992

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d819169b5504f.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\0QTDC4OR.AG5\WQCO54YR.1Y1\manifests\scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d819169b5504f.cdf-ms
Size 24KB
SHA256 5fe4472b011b82a0aef571c5d0a4bf2a07beca4aef97edde9b8c2555a615c375
MD5 95758445c22c6283925d6827b394d9da
SHA1 b0be0a7f367447cb280ffa14c77a178369b23306
SHA512 c67a3dc0bd048aa9c81b50ad5dea0a2e69db3b05edc39f213c9eab8215b4f8e5bceb70e337693e70cec130d69f62fba0fb9bb9f8ad0c29b9d5cc59f3e7ba6a43
SSDEEP 384:xJqVPGTf6vNX95ZgMacc5X9R/QPIBM7Y3Zm94gslnQU:x44f61X95+yc5X9R/QPI+03Zm94gslnN
TLSH
T10EB26F01BBE1E923D1466733CCA6C3E57636FD924F92179B30423B2EA9703D95A33685
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..core_4b14c015c87c1ad8_0019.0002_none_41e6e31d258051c3.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\0QTDC4OR.AG5\WQCO54YR.1Y1\manifests\scre..core_4b14c015c87c1ad8_0019.0002_none_41e6e31d258051c3.cdf-ms
Size 3KB
SHA256 737edf301e74e2091296bff738db4ff95edbd9fdf836aa3914e00cde0f6589e7
MD5 8785242a23db80977ea5974a5cd7a58b
SHA1 7fa1bff2186cb28176b474a075118941e9ad4d48
SHA512 d6a5a9cf4c528712fbeb76f7e4af2d768fa0d4f77b22ecb9cd66ae5375479eac79d27c3fe83f0e96a5ea4416d46fe9fe2950b714e3e2fe86e3614a767fd83077
TLSH
T1956110027744DA13DA790732ACF2C2DE7FA87E43CE82810BB4C43B5F75364E556212A1
MD5 SHA1 SHA512 TLSH

Submit Download

scre..dows_4b14c015c87c1ad8_0019.0002_none_465ebafe61ce64f3.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\0QTDC4OR.AG5\WQCO54YR.1Y1\manifests\scre..dows_4b14c015c87c1ad8_0019.0002_none_465ebafe61ce64f3.cdf-ms
Size 5KB
SHA256 d1feee1bab028d40f5eec1daa8f59533816dd593fa92509b22b446f12210cbaa
MD5 d03829d9ff93b20e0f7c6f79003b8164
SHA1 effca78fd576d8f43fa2dee90a08b648afd91e02
SHA512 b1a88c9d28ee06660b5f2d13f01ce2ef248c2b168bd6c8fa8026250caf2650bd11ba2e310e319689c1572e59b19ef9fc818424775571678b55eb1cd22b487fe3
SSDEEP 96:NE4+RzgTheV+Ww7uk/WGgyHmzSNp9QHAzpPPwnANb6F:ERzgiJgOMrvOANYAMF
TLSH
T1EAB11F227304D957D57906335CA9C3EE2B787D52CE82460B30C8BF6F7A322FA8721295
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_4b14c015c87c1ad8_0019.0002_none_a32dbc410e6434d0.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\0QTDC4OR.AG5\WQCO54YR.1Y1\manifests\scre..ient_4b14c015c87c1ad8_0019.0002_none_a32dbc410e6434d0.cdf-ms
Size 6KB
SHA256 7bb4e0eab56eccdfc3b9e3db15ee0e6ff71703162df6f3a8dce04a3c7525fa5c
MD5 8cd2fdf47baf725798918bfae767235e
SHA1 b36eed04b75bb2b55161779e36b731849d3a1baa
SHA512 fbca76d026afeed17a03698c41b244c6bc09191c5c647d38af3a2cb9e372cff927ad3cabca5749d5493f4fd7e7292d50d6b863efb507b8058d0ee640b55d644c
SSDEEP 96:5mQPPypJEeV+Wwws8WYM7rXl2qHSAxt3e335z3nUVvXSY3Dv4ZCUks6b/DrK:fPPaJoYMP1THZKmtCA0GLzK
TLSH
T120D1561272D1EE26D17905379C9AD3DD3635FE96CE4A030734C4BF6F76362EA0A220A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_4b14c015c87c1ad8_0019.0002_none_d7fc40ef34cfa7c7.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\0QTDC4OR.AG5\WQCO54YR.1Y1\manifests\scre..ient_4b14c015c87c1ad8_0019.0002_none_d7fc40ef34cfa7c7.cdf-ms
Size 2KB
SHA256 68592a931c1434669fcea16e51da0b272b5b6b380fbee093dbea759b5df1cf58
MD5 9df5c8b378a355cce797081a07bdd48a
SHA1 07a2bf2abf54293adc6cf56cbfb884585975d466
SHA512 7b864c4bcf9353852a676296f22889bfa54cc7568b8a19c517ee0d67823bb5b400672f543808064ac2178cc2cdeab0cbfdf7592b367dc8d714f09220d332e52f
TLSH
T11651DD053B48EA67DA6A0232AC96C2DA72757D82DF460307B1C07F7F2E726E54B16092
MD5 SHA1 SHA512 TLSH

Submit Download

scre..tion_25b0fbb6ef7eb094_0019.0002_none_2771bb27d0341a32.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\0QTDC4OR.AG5\WQCO54YR.1Y1\manifests\scre..tion_25b0fbb6ef7eb094_0019.0002_none_2771bb27d0341a32.cdf-ms
Size 14KB
SHA256 f83a2eb40b24e3a67f97c93653c7a7fb735fc657e2440aa5ef1d661059f376d4
MD5 81a12a9d00ad16e557265f45aa704e03
SHA1 49d0e069192b1965381c2a3dfff9c58cb677f7e4
SHA512 a83e6a50c7d53c0b98eea887b3fbcad380a13e410bf37d8971502767a2e269d4904b571f6d85cb2cacc33d68d0707f15ac0c68192caa3930bf9198b6d02a923d
SSDEEP 192:n9vJ9rw6GSR0a8s8oeR06pRm+N8s8oTN2x2QPIlFDLhEDh7BqWod2ZrYmI:n9x9rw6t1X9chRRX9R/QPIBM7YUZkmI
TLSH
T1BD625C853B00E613D1178B32DCB2C7D12779FE534DD1469F7882BB2F29386949632296
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..vice_4b14c015c87c1ad8_0019.0002_none_f33a7b65bb3fb52e.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\0QTDC4OR.AG5\WQCO54YR.1Y1\manifests\scre..vice_4b14c015c87c1ad8_0019.0002_none_f33a7b65bb3fb52e.cdf-ms
Size 4KB
SHA256 0a1aceae77ccfbaeba4a72366cb9bcf9254a802a73f089b27d59b719e60dc91e
MD5 42646d851fc9175e58a31845c32bfef2
SHA1 c9936337c11896502454f0cf8d01b2ce581d7723
SHA512 dc8a6e0f601ed00f5c173964778691a2dc456ebd6dbf3b839161a434e86395e751c46767f5935229ec2f87d81049a69cd9a81651d17fdf590d0cbdcca5f6a575
SSDEEP 48:W/CDvx+dgJe6S+9ow87gnW75uv+YCSsHNp+DU9e5M+Cs7cQTyA9UZCf:W/SeV+Ww8s45u/CS6Np+o9yM+fjTyOZf
TLSH
T1609110127340E922D6B506339CA6C2DE3F747D82DE82160BB0C47F7F76342D61B251A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2o2nibm4.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\0QTDC4OR.AG5\WQCO54YR.1Y1\scre..tion_25b0fbb6ef7eb094_0019.0002_e53f9ad5b47ea481\2o2nibm4.newcfg
Size 559B
SHA256 1a4ad0856fb64464c8f9ec118e384e5d0ea2dc87db0d157e12f5499a987dc9cf
MD5 466cec1200e23320bbb8b23531035350
SHA1 ff17396657089eb03b45a138ee897f3d9a0104ff
SHA512 4f0e873241c09f70f30cbb75e0e55e68e7638738b6b139ea59076c25104b9a8f660031791785eb5406ff1dc3bdd9688fe7ad8c3a76cf72c3be6e01ad5a03ff90
TLSH
T10CF024A53084AE5A13736E23C5158740EE326B9B0519509874BF627BAF315DF07B32EA
MD5 SHA1 SHA512 TLSH

Submit Download

app.config

Path C:\Users\Admin\AppData\Local\Apps\2.0\0QTDC4OR.AG5\WQCO54YR.1Y1\scre..tion_25b0fbb6ef7eb094_0019.0002_e53f9ad5b47ea481\app.config
Size 1KB
SHA256 436a0d25de4dc7c7b7004e142bd2c8827ddd254caee3c268cd9b298358646f98
MD5 fe1ed6310f3e8d2fc807dbdbea97ea6d
SHA1 7680ba8671187e4e9d5f00c2d869723b351684f2
SHA512 e4aa4ab3f08e90534e47fd25fd5e93b4dc274557724f26ea1ab3d597aea2e8a380519be30f9a33d7d7205169947d6e7a3764bb00fd7723b1c81463782c43c98a
TLSH
T13031721CB5C0BE9915725631E6325580EDB019335266B0E478EE326B9F70ED907F33A6
MD5 SHA1 SHA512 TLSH

Submit Download

duniac2z.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\0QTDC4OR.AG5\WQCO54YR.1Y1\scre..tion_25b0fbb6ef7eb094_0019.0002_e53f9ad5b47ea481\duniac2z.newcfg
Size 559B
SHA256 7eae2e119134f68d80aadd97bf0fa37e0cf4458616c43beb0251ff987c835198
MD5 89686070ff41e78de9176bac1bd40581
SHA1 f69b194a0bcea505b5ca710466791136f1cea2c4
SHA512 ef26ec8f2b749cd4a2147bde0f321c08b544098b684a6deb5f0de0ae5247a320b91fa24315b2c05993785d2543801e915096aca227dde5628476455d8d332df8
TLSH
T12DF024A93084AE9A13736E23C5128740EE325B9B0415109874BF627BAF315DB03B31DB
MD5 SHA1 SHA512 TLSH

Submit Download

hktq40cz.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\0QTDC4OR.AG5\WQCO54YR.1Y1\scre..tion_25b0fbb6ef7eb094_0019.0002_e53f9ad5b47ea481\hktq40cz.newcfg
Size 559B
SHA256 015cfaa8672e9e0394f583b478c75c79fdb009d235d0675089d86c250408f622
MD5 80e9f0272429c715afad098682176c65
SHA1 e99d95b02141b2d5fd6898944ead573c6bf95b76
SHA512 c5aabf4a8fa03d6c560a8fa8f45cf23ee3bf33a5d6130c7d037c6fc6643078b44713bc927cc80a6096dfd2e3b176dd99527f0518cc16bdcd399e8821bac2bb61
TLSH
T16AF024A53084AE5A13736E23C5158740EE725B9B0419119874BF627BAF315DB03B32EB
MD5 SHA1 SHA512 TLSH

Submit Download

ky0cjahw.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\0QTDC4OR.AG5\WQCO54YR.1Y1\scre..tion_25b0fbb6ef7eb094_0019.0002_e53f9ad5b47ea481\ky0cjahw.newcfg
Size 559B
SHA256 13f283188a492471196b049caf0c3c954fcf4491f33b5f20630170532c175bda
MD5 1ffd248d8ca1eeab81a1ed2c40f492f1
SHA1 a2e3f522eb027c7bfa23588994b6daef89b76019
SHA512 37f3a01c2aa907af6cc31ca4d8d7b29b04f44f27cf4e9707d990b0d9819d6b36cb7ccded0addb3a8888000cbe112a57f4b42cd5e93550842cc1876121a66b37a
TLSH
T125F024A53084AE5A13736E23C5118740EE326B9B0415109874BF627BAF315DF07B32EE
MD5 SHA1 SHA512 TLSH

Submit Download

ta1vsdsi.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\0QTDC4OR.AG5\WQCO54YR.1Y1\scre..tion_25b0fbb6ef7eb094_0019.0002_e53f9ad5b47ea481\ta1vsdsi.newcfg
Size 559B
SHA256 7a74e974c1df8cbc6c40aed05542b10c9d618b9b6522ba3f07882f12a1339e76
MD5 6fc06547217dd25bc0ebb539ea041563
SHA1 23633374d9d63a068ba369ceae79442f3dd364eb
SHA512 0b26bcf1ba771716924ad66757e854950bf2e6ed0ec6c1089cabb76768e1fe5e5254253a8aab02cc26c9f05b8d13982a2a7e70061b669c0f92d010c4b5d30042
TLSH
T1BDF024A53084BE9A13736E23C5128740EE325B9B0415109874BF627BAF315DB03B32EA
MD5 SHA1 SHA512 TLSH

Submit Download

uqa5uqbl.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\0QTDC4OR.AG5\WQCO54YR.1Y1\scre..tion_25b0fbb6ef7eb094_0019.0002_e53f9ad5b47ea481\uqa5uqbl.newcfg
Size 559B
SHA256 960354006fc8330c453378ccb76df0be6362777fa48dfe9d3e39da482c67bb6c
MD5 9294b0297fad7916c2623dded3932257
SHA1 b911b4bb4eef2ef22bfdce780d7e361db4e6acae
SHA512 8911fa511de2d098e28ab0a8dcbe9d3b5321cc19fcec38db53462a38b307bbf75ceb61d42f8a0835c86232da17209a9d64dc5784685ddb2c0c19a0e1a9027041
TLSH
T156F024A53084AE5A13B36E23C5118744EE326B9B0415109874BF627BAF315DF07B32EA
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Users\Admin\AppData\Local\Apps\2.0\0QTDC4OR.AG5\WQCO54YR.1Y1\scre..tion_25b0fbb6ef7eb094_0019.0002_e53f9ad5b47ea481\user.config
Size 559B
SHA256 e4f4607df30c705ea92a06dbb0f6788f28126ea18b72ee7a8d390c52e880f9b9
MD5 3e4756ed1930a5cb3d59c3f9fbcbd20a
SHA1 e7d077304600a62d29b2b696de0245cf613c98ea
SHA512 b4f7aded515f8bb5eb266b43867ead8490f58600991ffcbc1c14b6e649b6ad621396e3c0e1a9eba06e284c58cf8cdc9aceda8574b6afeaf87d417c2655d26705
TLSH
T141F024A53084AE5A13736E23C5118740EE325B9B0419119874BF627BAF315DB03B32DB
MD5 SHA1 SHA512 TLSH

Submit Download

v2jniqt3.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\0QTDC4OR.AG5\WQCO54YR.1Y1\scre..tion_25b0fbb6ef7eb094_0019.0002_e53f9ad5b47ea481\v2jniqt3.newcfg
Size 559B
SHA256 cba7fb8f638fedd74e7810782ff3d3c2d14fe6b4a754a8dd465eb8528736a752
MD5 e9f29739b98ae2f198aadcbaea6f5dbd
SHA1 29251ba82c4b0307192129186a170432fc004cc1
SHA512 e095a14f4b2aad081ddaaf40195adcb22d54997f22033de082624fadc6dd7d87cc514d63f4274a287ef6892b17d5583a387c2f154c65cfef2bc41f64d0930490
TLSH
T14BF024A93084BE5A13736E23C5528740EE326B9B0415109874BF627BAF315DF07B32EB
MD5 SHA1 SHA512 TLSH

Submit Download

zi4fli1g.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\0QTDC4OR.AG5\WQCO54YR.1Y1\scre..tion_25b0fbb6ef7eb094_0019.0002_e53f9ad5b47ea481\zi4fli1g.newcfg
Size 559B
SHA256 c25c0aab82f004d98780d65746bc622c8bfdd5e6bdd6910c9821a313571042f9
MD5 3416529429183115be7a56fc1251f807
SHA1 f1419338a750ff1ed53f37dc092a79cb5edb98db
SHA512 19ee05029c64dda7ce3ab6bbd2b3756415248edac84d36bf7fe0620885bcfa086f39b75070632131877325978d4c1214f29955f6788423c7e0bf33f298ff600c
TLSH
T16EF024A53084AE5A13736E23C5118740EE326B9B0415109874BF627BAF315DF07B32EB
MD5 SHA1 SHA512 TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 595B
SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
MD5 4454c8e578515db43fadd90604ae7675
SHA1 3912ffa00c3a5c86fae6500a0074284d9f668976
SHA512 b17559d466cb6954554c4f879b396ff8431c730f837205547ab46329c6517cd35a719378efa55d78c01b739414dd320157f120feb12e28e1ae90ce7c53a0c75c
TLSH
T117F0DC47E7B15216C926123CC89724E1B730F5917DD1162341056F5D2C373101F17CB8
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Client.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\JM6BBPTM.4KZ\06G6E3ZQ.7GT\ScreenConnect.Client.dll
Size 192KB
SHA256 6526705b685c2f221a6675118c73cba98c47d948169d81ea4544c3e3336b8f2b
MD5 7ee2543520d72fd54827f3d11a21ef8d
SHA1 7aca9192a475179f4df8752ecd7eda05948dc6f4
SHA512 a0c65c11ce979cd4142439b64bb5e029a8bde9f2584d51de0231ea6a88aae960e00f3097b1e51847496824a1a76baa99f9fbacb67565704b262c5483bee5b91a
SSDEEP 3072:FxLtNGBlIyS7/OvjusqVFJRJcyzvYqSmzDvJXYA:ftNGBGySavqPJYnqSmG
TLSH
T122144B8633A94E36DA9F5D73B46060358AB5ED066023E3EE5E04F9F61A733408E553E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\JM6BBPTM.4KZ\06G6E3ZQ.7GT\ScreenConnect.Client.dll.genman
Size 1KB
SHA256 948596c07ffcd2ad7c1463894ac108ee05507def70f8a4a97d75a7081266b512
MD5 fc8201e1d21fe244575d479a20a1ed6b
SHA1 cb68303ca575d5b11e5edeb99bcbe9e273f756ab
SHA512 fe324b0a8a482181bbf9e19c4c680d7749c933db201b497d3b599d8ec6c5e3d7c521d487ef7ae4f815ad7f67661871d67f4529452069c3893dad408782279d9f
TLSH
T169117B1581C8FE261F3301D1BEE7E021576D2B37058D194BB0696DAF8B2DAE6434B1B3
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\JM6BBPTM.4KZ\06G6E3ZQ.7GT\ScreenConnect.ClientService.dll
Size 66KB
SHA256 319ba24115e64ea4b714caf4e88d3d5a658defd51d714c2291b9758466925281
MD5 5d4be679ad5c4bfb5144f381d3308ab3
SHA1 27d351219ad62fc914c6c34eed8373fee6de294d
SHA512 e9b07fc27078bb8c706f970120304b816ad5c0eb5a967371f76de42edd397b5b6b5faf9645eed707584a1e1175406958a8daf4b65d20c2cf7aadaddaff1166c9
SSDEEP 768:c3gaRdcdsmzKWOWXlhh6Eg/6QhvoTVcV7K0c4RelfyQFVFlCtskxZgVfS8EX8bED:tCsKWOGmEgLhvoTVF0JJQFVFlPasbg
TLSH
T1B0633B06E3F98A7BC9DF5F7878B5B0450EB08A02E062FB989CC9A5D71B537C119053A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\JM6BBPTM.4KZ\06G6E3ZQ.7GT\ScreenConnect.ClientService.dll.genman
Size 1KB
SHA256 7ba2e686afa757becaec5216ddbc0be75d7d30f9af8233e9160d200efec8aa0f
MD5 df3caec93ec7639a949601f4decef22e
SHA1 5694cd8580d47de4a1406d97794b621c18ac5314
SHA512 21a4e549f554b4270fb0d65636a0fe89604f2c1e8bb97c741c79e40436139fbd35aa18535c8ccc966beba37ebb140f46e4c7a2a401c9906e68fecfdaf549af82
TLSH
T1FF31E71681C8FA251F3302C1BEE7E0619BAD1B33158E1947B05D599B8F2DAA6434B1B3
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\JM6BBPTM.4KZ\06G6E3ZQ.7GT\ScreenConnect.ClientService.exe
Size 93KB
SHA256 f048400c23add8c75abe189393d33c873c02c74eeaf43d47b950c8d643763b35
MD5 752d5cdda2a1d93d27e38f98a5d23fc2
SHA1 d4fd4ff0709271323b8d401579270e6567b6e360
SHA512 f48a21229a8d8cc80371e9aeeb47bb10ff0f3b0363e854ca30db833c74519d37ee21349fa9201c7ed5392ddf5d0ff2a66d250821d109dc0ac7425ab2a5a3fea2
SSDEEP 1536:wg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgUU0HMQ7oOgU:ZhbNDxZGXfdHrX7rAc6myJkgUU0HvMU
TLSH
T1E8935B13B5C28872D473093158E0DAB49A3FF9215E61DEAB3798022E4F741C1AE75EB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\JM6BBPTM.4KZ\06G6E3ZQ.7GT\ScreenConnect.Core.dll
Size 538KB
SHA256 b8100e5ab07983cbf82d721cf719576ca3f60e352628dcaabd42d428011fdedf
MD5 1db8b9fa0bdcbfaab807f715c288c19a
SHA1 fde73710ce063bbf1e377c02a1a8615cf4da1c08
SHA512 fc132764026c682e8fac1a97171731d54880c8d95566c486c731c880e750a29875ac208fb4b4dc2897dfc49beb24f77af016d846c78be75df159d3542600eb73
SSDEEP 6144:SfoUrkyyvsbvpSLmwJUoqnoezGMZf1y99tg03Xdedu1h+xE5vce/6OdCatxq/trJ:SfpkywYszKoIzGafzece/6yx/Oek
TLSH
T144C47D9233B48B2FCABF5B7BE42454980770E901F209EB5B1AD6D4BC5F633854E412E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\JM6BBPTM.4KZ\06G6E3ZQ.7GT\ScreenConnect.Core.dll.genman
Size 1KB
SHA256 1008e0a6ce99adf165f8e173dcd4bb5e0761673aa9c3150f5e010f03d0f6434b
MD5 de014337ef7ec5fbb5e71663889cd9ec
SHA1 be9867f2b5340aa9d59177c1f92235a1f32b0ec6
SHA512 8ab08a2f084602135ec098ecacae8f2ab401b5d655e8f98423119f3ce32e28cdd96725feb4586733db1582ed418d9aede9935338fbf83018e6232271fa22a86a
TLSH
T18F21671181C8FA261F3302D2BEE7E42197AE5B33188D194B7469699FCB2DAD64747073
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\JM6BBPTM.4KZ\06G6E3ZQ.7GT\ScreenConnect.Windows.dll
Size 1.6MB
SHA256 da29455a64858fda773319c32c0a6cd40edbe8042ed005aa2befb8a4f0fb0522
MD5 94216eb90ca53fbb175f0ee6adbfb663
SHA1 48038f060a5042ff44a2d9a9be46368ecc8436fd
SHA512 c6c7e2a63eaccc5703acf4cb482a9e441fb6e670a9086d3ade558a597b1fd6c17f5e5b7027d835b80ebf2c071f9442bde466f313ddb8456fe0d3e4db6d53b041
SSDEEP 24576:VDhFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUTHs:VDhJkGYYpT0+TFiH7efP
TLSH
T14B85BD41E2D364F5D46B047888BF571ABA743C040325CAFB97D4AE3A6D33BC09A36796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\JM6BBPTM.4KZ\06G6E3ZQ.7GT\ScreenConnect.Windows.dll.genman
Size 1KB
SHA256 74bc77d4a907113ee17339077cf42d4919a3d02987325a5fd5608a43f65e60c2
MD5 e800d9b7ccfd86983e809fb76068b9e4
SHA1 f4a6c5d027b144b81d51ce5453f0c39ee1bcc7b7
SHA512 29fe2bf5c4d514b4980a13442647cc988b5b8b869e8dff35ad9d86d95983f3135d5df0c46eee88cd1edd0ce4e79864761f9d600b0d267d10025f660e0a848452
TLSH
T18641E11681C8EA250F3301C2BEEBE431879A5733158E194B7499AA9BCF29AD74747067
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsBackstageShell.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\JM6BBPTM.4KZ\06G6E3ZQ.7GT\ScreenConnect.WindowsBackstageShell.exe
Size 59KB
SHA256 1404090db3128de503ba4d991a960c7c1bc3b910a62d06ecf7e7081a2fcf11b9
MD5 ab9a2c07b3b1222f5ada4cb7c1fd144e
SHA1 22d5e961804073435cd193c1a4b7d3f4c39a64c4
SHA512 909e4e6fb042f30e8e2fccb54b7797410a4c3eb825a2578c679d75d780ba0a06d8a9058ddab66a48a60b3a4a6c4704468826b74fd504cef8b8fc860827707968
SSDEEP 1536:7bHOH2MJv6vmDtyQXIE+TC49IfXWbdS79GT8H:7buH2MJDyQEASSB
TLSH
T115538D4123F80B16D9FF5E39B5E2A5250EB0EA039441E7AE1DCDA5DA0E537806B603F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\JM6BBPTM.4KZ\06G6E3ZQ.7GT\ScreenConnect.WindowsClient.exe
Size 593KB
SHA256 b80d07610b81bddb3d7f30a207a2e134b559e06b8440598a926f3a9c1d439218
MD5 9562334dd9a47ec1239a8667ddc1f01c
SHA1 b46c4e4694783311e2c612ed7f0ca67a88e1e352
SHA512 a4207d106c5253777dc1eb49d644e2f7ba5ab4e6b64bad1f072c4fcd97df38e76b86986a8a7d7441c0c7cedb2e041044c7f9b36f892c9f48836a8db2d22e8500
SSDEEP 6144:PTv8K3EAggQ2nqBly89VXvJthenrMd+3OsJwEKbE00QPG5YgRtAcCI2/R4IRtNup:rUKt/sXvJqu+3OsJwrbE00QuHRgNNmAq
TLSH
T1E7D46C2273B88A7BD9BF0779B0F21C2557B0E8436185D78E49A4ACD91D973818D0E3E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Users\Admin\AppData\Local\Temp\Deployment\JM6BBPTM.4KZ\06G6E3ZQ.7GT\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
TLSH
T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\JM6BBPTM.4KZ\06G6E3ZQ.7GT\ScreenConnect.WindowsClient.exe.genman
Size 2KB
SHA256 cfe9e06a7fc7a776c704f992b1b80c2938133a4b8c1b53bcabe57cade90d44b9
MD5 c342b42f693456b2e0657859d5d06d9a
SHA1 916cb76f8ad3074edea5c7c30f0192d3813f96f7
SHA512 2adb5e7646df905a99ef2278341e7f5dfe3530d6577ab1c7036464a060dbae5a67ae946665044329d0331504a366257c4943259536f2b72e37c73dbf67cf5e54
TLSH
T13E51D41641C8FA210F3301C1BEEBE471979E5B32158E194770999A9FCF2DAA7474B077
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.manifest

Path C:\Users\Admin\AppData\Local\Temp\Deployment\JM6BBPTM.4KZ\06G6E3ZQ.7GT\ScreenConnect.WindowsClient.exe.manifest
Size 17KB
SHA256 d44b7bda547bbbeab6060edd2207e97dbc43c28aa08522b2108866c1ac023dbd
MD5 e1a62c7b0b94e2fbe0d27d9c679b9a97
SHA1 6e6896278eeaa03b4e0cb0c14ad5ef80f3366c02
SHA512 535754df5c489aab01f38a6a60096f3e277309751a8a07d9b8a9b53211365559f0874cd858118a5e56c3abb2e8bced0972e1433ff4fd32cb5f256e872c4a7356
SSDEEP 384:peKEE1rTJUaXOf6zX9WnZgMacc4X9FX9R/QPIYM7Y7:pI6zX9i+yc4X9FX9R/QPIN07
TLSH
T14F82D54A88C07C2153369190BFF38A10BE557B3301EE14CABC5E55AF8F6569893972B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsFileManager.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\JM6BBPTM.4KZ\06G6E3ZQ.7GT\ScreenConnect.WindowsFileManager.exe
Size 79KB
SHA256 13f8cfe4648b807a0cbddd653c75254b60d1951e11e715f4e5a1a2c9ab29360b
MD5 130176db1b368a8290ebda3ce17db7c8
SHA1 5c1ffa4074937594b8fddd76720d7943f4f5ad55
SHA512 8830e75925e71d72c4144f053db5f97e3920ac8d27d4ac04888a10e7648f1f6d90a69a72415a56ea18ac9d49db52334432232f28ee6099e57ba50ea13311aebc
SSDEEP 1536:Mtypl44jzbHI5kLP+VVVVVVVVVVVVVVVVVVVVVVVVVC7Ky7ynD:3rfukLdOyWD
TLSH
T1C683E58235762631DF85C5379492C9B59D366F22133DC5BD2DA2FE3A69F03043A8ADB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8Y03KEWP.291.application

Path C:\Users\Admin\AppData\Local\Temp\Deployment\WQOTXNJH.2OV\8Y03KEWP.291.application
Size 118KB
SHA256 8f7c1bf58787a966cdb4222827c1da22ad74d01a0b7d78bb2abfad3af71292d7
MD5 ed1739e67b67b00632fc4297092b0f5d
SHA1 8fe6678631f4aad6fd2f1c2bdafaa0ca0c2af365
SHA512 6b6068687adc4272e40f6bbd3410e39de67a175c0e45c0b5336be0cadf84e6e51ba45a26bc27542e6d62e60f12c8dfac5a1bbad68881de440136a05d421950db
SSDEEP 1536:gN0XwNFNzaC8Xaay9mol5XAxBipaGN9RnegfD/4uOnOxQ08UVh6CKrVJRzooFerv:8V8q9Xza44uO8dqJRgm2o9HuzhJOvM
TLSH
T134C3F82A8F30F8C0477DB021D1A52D6735811B57DBB30FECDA0A186B0E69792EF5A65C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1992-605-0x0000019C831A0000-0x0000019C83831000-memory.dmp

Download

memory/1992-568-0x0000019C831A0000-0x0000019C83831000-memory.dmp

Download

memory/2808-293-0x000000001BA90000-0x000000001BAA8000-memory.dmp

Download

memory/2808-286-0x0000000000EA0000-0x0000000000F38000-memory.dmp

Download

memory/5904-301-0x00007FFDDE020000-0x00007FFDDE9C4000-memory.dmp

Download

memory/5904-2-0x000001ECFA380000-0x000001ECFA508000-memory.dmp

Download

memory/5904-5-0x00007FFDDE020000-0x00007FFDDE9C4000-memory.dmp

Download

memory/5904-6-0x00007FFDDE020000-0x00007FFDDE9C4000-memory.dmp

Download

memory/5904-7-0x00007FFDDE020000-0x00007FFDDE9C4000-memory.dmp

Download

memory/5904-4-0x00007FFDDE020000-0x00007FFDDE9C4000-memory.dmp

Download

memory/5904-300-0x00007FFDDE020000-0x00007FFDDE9C4000-memory.dmp

Download

memory/5904-11-0x00007FFDDE020000-0x00007FFDDE9C4000-memory.dmp

Download

memory/5904-63-0x000001ECFF250000-0x000001ECFF3FC000-memory.dmp

Download

memory/5904-3-0x00007FFDDE020000-0x00007FFDDE9C4000-memory.dmp

Download

memory/5904-317-0x00007FFDDE020000-0x00007FFDDE9C4000-memory.dmp

Download

memory/5904-0-0x00007FFDDE1AF000-0x00007FFDDE1B0000-memory.dmp

Download

memory/5904-57-0x000001ECFE880000-0x000001ECFE898000-memory.dmp

Download

memory/5904-29-0x00007FFDDE020000-0x00007FFDDE9C4000-memory.dmp

Download

memory/5904-51-0x000001ECFEDF0000-0x000001ECFEE26000-memory.dmp

Download

memory/5904-20-0x00007FFDDE020000-0x00007FFDDE9C4000-memory.dmp

Download

memory/5904-1-0x000001ECF7D00000-0x000001ECF7D08000-memory.dmp

Download

memory/5904-39-0x000001ECFEF90000-0x000001ECFF028000-memory.dmp

Download

memory/5904-45-0x000001ECFEF80000-0x000001ECFF00C000-memory.dmp

Download

memory/5904-10-0x000001ECFA940000-0x000001ECFA990000-memory.dmp

Download

memory/5904-18-0x00007FFDDE020000-0x00007FFDDE9C4000-memory.dmp

Download

memory/6136-379-0x0000020A801E0000-0x0000020A802E0000-memory.dmp

Download

memory/6136-401-0x0000020A81A00000-0x0000020A81A20000-memory.dmp

Download

memory/6136-410-0x0000020A81EE0000-0x0000020A81F00000-memory.dmp

Download

memory/6136-380-0x0000020A801E0000-0x0000020A802E0000-memory.dmp

Download

memory/6136-402-0x0000020A94000000-0x0000020A94100000-memory.dmp

Download

memory/6136-437-0x0000020A94320000-0x0000020A94340000-memory.dmp

Download