1da3b9d89c8932b5597e752fe1468ebe236d21328a2453769624f69becf05656

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/08/2026, 12:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
support.client.exe
Size 83KB
Sample260820-pf4teazvcs
SHA256 1da3b9d89c8932b5597e752fe1468ebe236d21328a2453769624f69becf05656
MD5 2f6b5f2fd13471519adb8d74b0715479
SHA1 006c04308a62f31a603460c2687eccd9f391fc98
SHA512 3b7083f93dd1012af40f3a613082d9e8709ae3c7b803f693aa2066a650d8395672b366578832aef3d49ba3ece452e05ea88c9be3957cb43b39e0eae75e4f3c7b
SSDEEP 1536:LoG6KpY6Qi3yj2wyq4HwiMO10HVLCJRpsWr6cdaWPBJYY179fJn:lenkyfPAwiMq0RqRfbaWZJYY13n
TLSH
T18A836C43B5D184B5E9720E3118B1D9F4593FBE110E648EAB3398426E0F352D19E3AE7B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery revoked_codesign spyware trojan

Malware Config

Signatures

Downloads MZ/PE file 6 IoCs

flow	pid	Process
6	2780	dfsvc.exe
6	2780	dfsvc.exe
6	2780	dfsvc.exe
6	2780	dfsvc.exe
6	2780	dfsvc.exe
6	2780	dfsvc.exe

Manipulates Digital Signatures 1 TTPs 1 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\C6F3A56E194FDC3DFA0D2D80039C870CDAAF8D68\Blob = 030000000100000014000000c6f3a56e194fdc3dfa0d2d80039c870cdaaf8d682000000001000000aa040000308204a63082038ea00302010202145fbd242cb0a6812a0ddb14e6200422b1fd0fd7d7300d06092a864886f70d01010b050030818b310b300906035504061302555331193017060355040a1310436c6f7564466c6172652c20496e632e31343032060355040b132b436c6f7564466c617265204f726967696e2053534c20436572746966696361746520417574686f72697479311630140603550407130d53616e204672616e636973636f311330110603550408130a43616c69666f726e6961301e170d3236303830373139343930305a170d3431303830333139343930305a306231193017060355040a1310436c6f7564466c6172652c20496e632e311d301b060355040b1314436c6f7564466c617265204f726967696e204341312630240603550403131d436c6f7564466c617265204f726967696e20436572746966696361746530820122300d06092a864886f70d01010105000382010f003082010a0282010100d01f6e38bb3eb885d0cbece59554a9a71f1a86707d2c4080e25133e370a00fba95e463a8109f02c5faec1b56234e201ade60fd83e4371103e955079013303baae05297179a16928285dcb4333a444ed86e9e6cf06446baf0f7d5507f391ca913299dea7493e5b49b53ed4c544e6e533b61ebe0849ced2cde20b980b8787b89796fd0c2aa274c8da3f0c5b98839767d82557ea77885eaba4dda5a280a1ea80fb19a53368db0e0065344e207c75556326477076b4b77559010da6cddb95f5d2e1ca41138ab769a962790593b45001e85a255856a0498bad4ceb39907585aae4185f5cbd633199354ba271fbd1d24e3567da206487d78198695c685f465a180d0830203010001a382012830820124300e0603551d0f0101ff0404030205a0301d0603551d250416301406082b0601050507030206082b06010505070301300c0603551d130101ff04023000301d0603551d0e04160414d9ae781f75b12e7da250de54c1ee9b78d39459ad301f0603551d2304183016801424e853575d7c344087a9eb94dbbae11678fc29a4304006082b0601050507010104343032303006082b060105050730018624687474703a2f2f6f6373702e636c6f7564666c6172652e636f6d2f6f726967696e5f636130290603551d1104223020820f2a2e736164616d756c612e73686f70820d736164616d756c612e73686f7030380603551d1f0431302f302da02ba0298627687474703a2f2f63726c2e636c6f7564666c6172652e636f6d2f6f726967696e5f63612e63726c300d06092a864886f70d01010b05000382010100861e5cce43466ffbceb3f6a3b2d59f708de9c8f5859e3101da21e3c78478d671e52edeb53cf6edbd22e9b7235f8a09536b4b8daca9acd97ba8abd100ac51dde4f949060f384b56c88d7f176e0bd444217039d340783b37cc2554d9e6ca50c726d2c6cbdc8826ea9555b5a84e94c46c1b081a98dca69ff72f7773245e8a68febffee69b442b6270374a88aea5b05e55060ac02aee685443ebce39b283adffbecc7fbf5fb3120e845d79abf8e24509141c5631e6bcf65f73907c2fa6249916ed5a38c08b3a74bfd0f3e42566ae2e5a8091a2538465c24f5c81e9125f43e3925edcda2ade1793734006cdd4accf826c64322cf64d8cfcd34ec8b94bb164435de7fd	support.client.exe

Signed with revoked ConnectWise certificate 4 IoCs

Binary is signed using a ConnectWise certificate revoked for key compromise.

revoked_codesign

resource	yara_rule
behavioral1/files/0x000200000001e738-46.dat	revoked_cert_connectwise
behavioral1/files/0x0007000000024576-124.dat	revoked_cert_connectwise
behavioral1/files/0x0007000000024561-130.dat	revoked_cert_connectwise
behavioral1/files/0x0007000000024568-150.dat	revoked_cert_connectwise

Executes dropped EXE 1 IoCs

pid	Process
936	ScreenConnect.WindowsClient.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\8P38OV8D.E2W\O5VOTBTH.4MN\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4376	4124	WerFault.exe	85

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	support.client.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_4b14c015c87c1ad8_0018.0003_none_57acc9dd3adfc036\identity = 53637265656e436f6e6e6563742e57696e646f77732c2056657273696f6e3d32342e332e372e393036372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_4b14c015c87c1ad8_0018.0003_none_57acc9dd3adfc036\SizeOfStronglyNamedComponent = 44621a0000000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_4b14c015c87c1ad8_0018.0003_none_57acc9dd3adfc036\Files	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0018.0003_none_e94a4fce0de1030a\identity = 53637265656e436f6e6e6563742e436c69656e742c2056657273696f6e3d32342e332e372e393036372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0018.0003_none_e94a4fce0de1030a\SizeOfStronglyNamedComponent = e711030000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0018.0003_dc2e9ccfa6fe95f2\scre...exe_25b0fbb6ef7eb094_0018.0003_none_97cb907042c6 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_4b14c015c87c1ad8_0018.0003_none_5334f1fbfe91ad06\identity = 53637265656e436f6e6e6563742e436f72652c2056657273696f6e3d32342e332e372e393036372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0018.0003_dc2e9ccfa6fe95f2\scre..core_4b14c015c87c1ad8_0018.0003_none_5334f1fbfe91 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_4b14c015c87c1ad8_0018.0003_none_5334f1fbfe91ad06\implication!scre..tion_25b0fbb6ef7eb094_0018.0003_c3d73 = 68747470733a2f2f6b696b616b752e736164616d756c612e73686f702f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32342e332e372e393036372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_4b14c015c87c1ad8_0018.0003_none_04888a4494511071	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\VisibilityRoots	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}\NonCanonicalData	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_4b14c015c87c1ad8_0018.0003_none_57acc9dd3adfc036	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_25b0fbb6ef7eb094_0018.0003_none_38bfca06a9457575	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0018.0003_dc2e9ccfa6fe95f2	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_4b14c015c87c1ad8_0018.0003_none_5334f1fbfe91ad06	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_25b0fbb6ef7eb094 = 460061006c00730065000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0018.0003_none_b47bcb1fe7759013\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742c2056657273696f6e3d32342e332e372e393036372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_4b14c015c87c1ad8_0018.0003_none_5334f1fbfe91ad06\identity = 53637265656e436f6e6e6563742e436f72652c2056657273696f6e3d32342e332e372e393036372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_4b14c015c87c1ad8_0018.0003_none_5334f1fbfe91ad06\Files\ScreenConnect.Core.dll_b96889d378047e27 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\VisibilityRoots	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_4b14c015c87c1ad8_0018.0003_none_5334f1fbfe91ad06\lock!0e000000e2eb580ea80300002c0f0000000000000000000032 = 30303030303361382c30316464333039646566623434356630	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0018.0003_none_38bfca06a9457575\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32342e332e372e393036372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_4b14c015c87c1ad8_0018.0003_none_57acc9dd3adfc036\DigestMethod = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0018.0003_none_b47bcb1fe7759013	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0018.0003_dc2e9ccfa6fe95f2\scre..ient_4b14c015c87c1ad8_0018.0003_none_b47bcb1fe775 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\Gc_scre..tion_59a2f4d4d8d73d8d\LastRunVersion = 68747470733a2f2f6b696b616b752e736164616d756c612e73686f702f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32342e332e372e393036372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32342e332e372e393036372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_25b0fbb6ef7eb094_0018.0003_none_97cb907042c6ab92\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32342e332e372e393036372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0018.0003_c3d738667c9d39da\scre...exe_25b0fbb6ef7eb094_0018.0003_none_97cb907042c6	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0018.0003_none_b47bcb1fe7759013\SizeOfStronglyNamedComponent = d954090000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0018.0003_none_b47bcb1fe7759013\Transform = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0018.0003_none_b47bcb1fe7759013\Files	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0018.0003_none_e94a4fce0de1030a	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0018.0003_none_e94a4fce0de1030a\lock!06000000e2eb580ea80300002c0f0000000000000000000032 = 30303030303361382c30316464333039646566623434356630	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Software	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}\scre..tion_25b0fbb6ef7eb094 = 68747470733a2f2f6b696b616b752e736164616d756c612e73686f702f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32342e332e372e393036372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_25b0fbb6ef7eb094_0018.0003_c3d738667c9d39da\pin!S_{3f471841-eef2-47d6-89c0-d028f03a4ad5}	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_25b0fbb6ef7eb094_0018.0003_none_38bfca06a9457575\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32342e332e372e393036372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_4b14c015c87c1ad8_0018.0003_none_04888a4494511071\Transform = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_4b14c015c87c1ad8_0018.0003_none_5334f1fbfe91ad06\Files	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_4b14c015c87c1ad8_0018.0003_none_5334f1fbfe91ad06\lock!1000000032e9580edc0a000010130000000000000000000094 = 30303030306164632c30316464333039646531323333653330	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0018.0003_dc2e9ccfa6fe95f2\scre...exe_25b0fbb6ef7eb094_0018.0003_none_97cb907042c6	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_25b0fbb6ef7eb094 = 0000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_25b0fbb6ef7eb094 = 30003000300031002f00300031002f00300031002000300030003a00300030003a00300030000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0018.0003_none_38bfca06a9457575	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0018.0003_dc2e9ccfa6fe95f2\scre..ient_4b14c015c87c1ad8_0018.0003_none_b47bcb1fe775	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_4b14c015c87c1ad8_0018.0003_none_04888a4494511071\lock!0c00000032e9580edc0a000010130000000000000000000094 = 30303030306164632c30316464333039646531323333653330	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0018.0003_none_b47bcb1fe7759013	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0018.0003_none_b47bcb1fe7759013\lock!0c000000e2eb580ea80300002c0f0000000000000000000032 = 30303030303361382c30316464333039646566623434356630	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide	dfsvc.exe
Key deleted	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\NonCanonicalData	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_25b0fbb6ef7eb094_0018.0003_none_97cb907042c6ab92\Files\ScreenConnect.WindowsFileManager.exe_0e21f87 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0018.0003_none_b47bcb1fe7759013\DigestMethod = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0018.0003_none_e94a4fce0de1030a	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0018.0003_dc2e9ccfa6fe95f2\scre..vice_4b14c015c87c1ad8_0018.0003_none_04888a449451 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_4b14c015c87c1ad8_0018.0003_none_5334f1fbfe91ad06\DigestMethod = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Software\Microsoft	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0018.0003_dc2e9ccfa6fe95f2\scre..dows_4b14c015c87c1ad8_0018.0003_none_57acc9dd3adf = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0018.0003_none_e94a4fce0de1030a\Files	dfsvc.exe

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\C6F3A56E194FDC3DFA0D2D80039C870CDAAF8D68	support.client.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\C6F3A56E194FDC3DFA0D2D80039C870CDAAF8D68\Blob = 030000000100000014000000c6f3a56e194fdc3dfa0d2d80039c870cdaaf8d682000000001000000aa040000308204a63082038ea00302010202145fbd242cb0a6812a0ddb14e6200422b1fd0fd7d7300d06092a864886f70d01010b050030818b310b300906035504061302555331193017060355040a1310436c6f7564466c6172652c20496e632e31343032060355040b132b436c6f7564466c617265204f726967696e2053534c20436572746966696361746520417574686f72697479311630140603550407130d53616e204672616e636973636f311330110603550408130a43616c69666f726e6961301e170d3236303830373139343930305a170d3431303830333139343930305a306231193017060355040a1310436c6f7564466c6172652c20496e632e311d301b060355040b1314436c6f7564466c617265204f726967696e204341312630240603550403131d436c6f7564466c617265204f726967696e20436572746966696361746530820122300d06092a864886f70d01010105000382010f003082010a0282010100d01f6e38bb3eb885d0cbece59554a9a71f1a86707d2c4080e25133e370a00fba95e463a8109f02c5faec1b56234e201ade60fd83e4371103e955079013303baae05297179a16928285dcb4333a444ed86e9e6cf06446baf0f7d5507f391ca913299dea7493e5b49b53ed4c544e6e533b61ebe0849ced2cde20b980b8787b89796fd0c2aa274c8da3f0c5b98839767d82557ea77885eaba4dda5a280a1ea80fb19a53368db0e0065344e207c75556326477076b4b77559010da6cddb95f5d2e1ca41138ab769a962790593b45001e85a255856a0498bad4ceb39907585aae4185f5cbd633199354ba271fbd1d24e3567da206487d78198695c685f465a180d0830203010001a382012830820124300e0603551d0f0101ff0404030205a0301d0603551d250416301406082b0601050507030206082b06010505070301300c0603551d130101ff04023000301d0603551d0e04160414d9ae781f75b12e7da250de54c1ee9b78d39459ad301f0603551d2304183016801424e853575d7c344087a9eb94dbbae11678fc29a4304006082b0601050507010104343032303006082b060105050730018624687474703a2f2f6f6373702e636c6f7564666c6172652e636f6d2f6f726967696e5f636130290603551d1104223020820f2a2e736164616d756c612e73686f70820d736164616d756c612e73686f7030380603551d1f0431302f302da02ba0298627687474703a2f2f63726c2e636c6f7564666c6172652e636f6d2f6f726967696e5f63612e63726c300d06092a864886f70d01010b05000382010100861e5cce43466ffbceb3f6a3b2d59f708de9c8f5859e3101da21e3c78478d671e52edeb53cf6edbd22e9b7235f8a09536b4b8daca9acd97ba8abd100ac51dde4f949060f384b56c88d7f176e0bd444217039d340783b37cc2554d9e6ca50c726d2c6cbdc8826ea9555b5a84e94c46c1b081a98dca69ff72f7773245e8a68febffee69b442b6270374a88aea5b05e55060ac02aee685443ebce39b283adffbecc7fbf5fb3120e845d79abf8e24509141c5631e6bcf65f73907c2fa6249916ed5a38c08b3a74bfd0f3e42566ae2e5a8091a2538465c24f5c81e9125f43e3925edcda2ade1793734006cdd4accf826c64322cf64d8cfcd34ec8b94bb164435de7fd	support.client.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\8P38OV8D.E2W\O5VOTBTH.4MN\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe
File created	C:\Users\Admin\AppData\Local\Apps\2.0\DVKP1H3T.7AX\PK0R8Z9Z.BKX\scre..ient_4b14c015c87c1ad8_0018.0003_none_b47bcb1fe7759013\ScreenConnect.WindowsClient.exe\:Zone.Identifier:$DATA	dfsvc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2780	dfsvc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4124 wrote to memory of 2780	4124	support.client.exe	86
PID 2780 wrote to memory of 936	2780	dfsvc.exe	99

C:\Users\Admin\AppData\Local\Temp\support.client.exe
"C:\Users\Admin\AppData\Local\Temp\support.client.exe"
1⤵
- Manipulates Digital Signatures
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:4124
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
  2⤵
  - Downloads MZ/PE file
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2780
- - C:\Users\Admin\AppData\Local\Apps\2.0\DVKP1H3T.7AX\PK0R8Z9Z.BKX\scre..tion_25b0fbb6ef7eb094_0018.0003_dc2e9ccfa6fe95f2\ScreenConnect.WindowsClient.exe
    "C:\Users\Admin\AppData\Local\Apps\2.0\DVKP1H3T.7AX\PK0R8Z9Z.BKX\scre..tion_25b0fbb6ef7eb094_0018.0003_dc2e9ccfa6fe95f2\ScreenConnect.WindowsClient.exe"
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    PID:936
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4124 -s 308
  2⤵
  - Program crash
  PID:4376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4124 -ip 4124
1⤵
PID:2860

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

scre...exe_25b0fbb6ef7eb094_0018.0003_none_97cb907042c6ab92.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\DVKP1H3T.7AX\PK0R8Z9Z.BKX\manifests\scre...exe_25b0fbb6ef7eb094_0018.0003_none_97cb907042c6ab92.cdf-ms
Size 24KB
SHA256 13f22c8f7a701359ed06fdac5d215572e5bbcb18a0e6d47ea7ef3dda2cc1338a
MD5 01f0fd4de73470decbd8730e19f00b75
SHA1 6b39d3545324a28113fc73979412a239e2e04c8a
SHA512 229ba41adb9c5917522a8cce9137c2141e1969fab398fc5c9873db3fd2e35d22fcb324610d143c614d9538cde8fbab31bb3b5a6c70fb8cee8f8475401fd33be9
SSDEEP 384:qOrqgIiGnph6SOX9jX9R/QPIBM7YALCN1XYFobjfu3+fhlt1u3P:qn3zn6SOX9jX9R/QPI+0ALvxo1u3P
TLSH
T12DB22851BB08E533D1679B32DDB6DBE12728BEA20CF0508BB082732D48359996F357D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..core_4b14c015c87c1ad8_0018.0003_none_5334f1fbfe91ad06.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\DVKP1H3T.7AX\PK0R8Z9Z.BKX\manifests\scre..core_4b14c015c87c1ad8_0018.0003_none_5334f1fbfe91ad06.cdf-ms
Size 3KB
SHA256 df553f047ebfa0a3282d0e1f1f7280e7dc1776e18497e883bde22d4112a34ff9
MD5 44fcce615926912d4e3b8089fe769dbd
SHA1 77166f4aa16fc9648cd3a51f62b4d3035a878445
SHA512 74ff193df05f415e88e60ffe52bcc37c195369526e43d43eceb5777cf9ac13c1d38c6ed51c366035079f1cc055fddc77e6e6e22c9cf435c3034d5685468b124f
TLSH
T1E961EC527204EA27D9A902325CE1D2EE6BB43D83CE81910FB4C47F2F75722F556112A5
MD5 SHA1 SHA512 TLSH

Submit Download

scre..dows_4b14c015c87c1ad8_0018.0003_none_57acc9dd3adfc036.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\DVKP1H3T.7AX\PK0R8Z9Z.BKX\manifests\scre..dows_4b14c015c87c1ad8_0018.0003_none_57acc9dd3adfc036.cdf-ms
Size 5KB
SHA256 96a051ae74167e5c53406068e6d107a50ae3bd44078825edde773eadafee733e
MD5 6e9a148e57a24951a2f37f2c22498157
SHA1 82e4977f4058d5fe9cb4543a16140a70217b4160
SHA512 931a63ee443497326dd5cf495e312bee8a43a2db2c3c7f6b0bb88b58f2024f9ccb8f6a675d7e2dfd39d553ca012dc87b8efe88d75061026769eb97cdc9928166
SSDEEP 96:0aSP+RxlyheV+Ww7NkJ7ANWUCe3ECWe44EhxngnsRK:0ORxlTJxpBArgQv
TLSH
T166B18741B258EA17D4B80633DC96D2ED2B257D42CF83470B31E4BB7F76327E65221199
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_4b14c015c87c1ad8_0018.0003_none_b47bcb1fe7759013.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\DVKP1H3T.7AX\PK0R8Z9Z.BKX\manifests\scre..ient_4b14c015c87c1ad8_0018.0003_none_b47bcb1fe7759013.cdf-ms
Size 6KB
SHA256 9d25404e0850e86e64be7687f4d34a5e7cc7fe4af98fd1a852023c586e254546
MD5 b88d46f7f9d3ed4c547ecb0389d98d16
SHA1 b7cea6b9673440866463cc787c51803c828210c2
SHA512 d4c9fb45c14011efcc0d910b4dde3d74eb5cca6c1e94da7b60e86dcc6101f7bb06521b3f3bed5b23f179efb2284a9b119fced80c5c7773ba826a497b431f8169
SSDEEP 96:h4GBPPbpvKeV+Wwwx8Wpm2TOtPO6gb6OL6vyOuZ2zn6qB/B:TPPnJxpmZPQb6OO+8z6k
TLSH
T15CD1CB527300EE57D5B90A33AC9AD3ED23683D56DE42570B70C4BF2F7A322A61722195
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_4b14c015c87c1ad8_0018.0003_none_e94a4fce0de1030a.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\DVKP1H3T.7AX\PK0R8Z9Z.BKX\manifests\scre..ient_4b14c015c87c1ad8_0018.0003_none_e94a4fce0de1030a.cdf-ms
Size 2KB
SHA256 d1e33ebd8057847b33651df76710d236e5ba267b101339057b8482b59433a49c
MD5 01e7a66eb758f1a904cea92fb4241297
SHA1 45713ed0ee490cc02c4b49d20bca56e1cc32368f
SHA512 535d60948bf107ed9e5df6ce3add48c4c95a3fd2301ca2e38a985ea7a3c14d9bc874c1aa41ba93bd4b1a212b9874dfc0aa134edf4292fc7d77ae1297b0867a54
TLSH
T1165121013748D667D9360331ACA2C2CE7BB83D43CE91110BB0C0377F5A726D55A1A1A5
MD5 SHA1 SHA512 TLSH

Submit Download

scre..tion_25b0fbb6ef7eb094_0018.0003_none_38bfca06a9457575.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\DVKP1H3T.7AX\PK0R8Z9Z.BKX\manifests\scre..tion_25b0fbb6ef7eb094_0018.0003_none_38bfca06a9457575.cdf-ms
Size 14KB
SHA256 f6df2cfada96c3d8825c67cf1b3d29ee727a37e620506a3508f9087b53a6e3d8
MD5 fd2e66671bbdea2711ccb08e4f8b8f4a
SHA1 07219ef5db15c6ac3039a142a28dd92ac7251866
SHA512 0fc6740c2b3b699e77e580a1dcd3d0e740d9592595021520677de132e6945f1933ce6d011c3bdefa4b509d87d5d915fcf030cedfe420ab0fc798e0b592f3c47f
SSDEEP 192:1M6I9rf6h9o8s8owwSzN8s8oTN2x2QPIlFDLhEDh7BqWojOl:1Mb9rf6QX9mxX9R/QPIBM7YjW
TLSH
T1776205847B50EA13C1069633CCE3C7E53679FE934ED3879B74427B1F6978B845A22292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..vice_4b14c015c87c1ad8_0018.0003_none_04888a4494511071.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\DVKP1H3T.7AX\PK0R8Z9Z.BKX\manifests\scre..vice_4b14c015c87c1ad8_0018.0003_none_04888a4494511071.cdf-ms
Size 4KB
SHA256 fec74074021b587c89c65c34398c77ed678bdff07769c90926acf2ae1768befe
MD5 678cac9f0e40039b13c6b8f85bcf6e6b
SHA1 1ecf19ac38474ac6c2b8f4eee56e6abd252f3997
SHA512 5402475eda905533ab6e2f04eec46b490aff8a4e6cafafe0e43a5c2de339facf4f5b6ded38d27a26a854f4062e49ddd52f32416273305e824380976a05c8f8cc
SSDEEP 48:ma3CDVxQ1goXe6S+9ow87gWW75uvsDqSOPVxwdIyi4Nhnw9GUjdLf:ma3TeV+Ww8x45umqnwm8zn6GyVf
TLSH
T1F491DB11B280EA66D5A90633EC86C2DD36767DC2DF42470BB1C0BF3F76316E65721196
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Users\Admin\AppData\Local\Apps\2.0\DVKP1H3T.7AX\PK0R8Z9Z.BKX\scre...exe_25b0fbb6ef7eb094_0018.0003_none_97cb907042c6ab92\ScreenConnect.ClientService.exe
Size 93KB
SHA256 f1b5c000794f046259121c63ed37f9eff0cfe1258588eca6fd85e16d3922767e
MD5 75b21d04c69128a7230a0998086b61aa
SHA1 244bd68a722cfe41d1f515f5e40c3742be2b3d1d
SHA512 8d51b2cd5f21c211eb8fea4b69dc9f91dffa7bb004d9780c701de35eac616e02ca30ef3882d73412f7eab1211c5aa908338f3fa10fdf05b110f62b8ecd9d24c2
SSDEEP 1536:Eg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkggU0HMx790K:dhbNDxZGXfdHrX7rAc6myJkggU0HqB
TLSH
T1B7935B13B5C28872D473093158E0DAB49A3FF9215E61DEAB3798022E4F741C1AE75EB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe:Zone.Identifier

Path C:\Users\Admin\AppData\Local\Apps\2.0\DVKP1H3T.7AX\PK0R8Z9Z.BKX\scre..tion_25b0fbb6ef7eb094_0018.0003_dc2e9ccfa6fe95f2\ScreenConnect.WindowsClient.exe:Zone.Identifier
Size 26B
SHA256 eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
MD5 fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1 d59fc84cdd5217c6cf74785703655f78da6b582b
SHA512 aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98
MD5 SHA1 SHA512

Submit Download

app.config

Path C:\Users\Admin\AppData\Local\Apps\2.0\DVKP1H3T.7AX\PK0R8Z9Z.BKX\scre..tion_25b0fbb6ef7eb094_0018.0003_dc2e9ccfa6fe95f2\app.config
Size 1KB
SHA256 805e6e9447a4838d874d84e6b2cdff93723641b06726d8ee58d51e8b651cd226
MD5 2744e91bb44e575ad8e147e06f8199e3
SHA1 6795c6b8f0f2dc6d8bd39f9cf971bab81556b290
SHA512 586edc48a71fa17cdf092a95d27fce2341c023b8ea4d93fa2c86ca9b3b3e056fd69bd3644edbad1224297bce9646419036ea442c93778985f839e14776f51498
TLSH
T1B441601DB5C0AF9915B25631E73152D1EC6009335266B0E0B8DE316B9F70ECA4BF32EA
MD5 SHA1 SHA512 TLSH

Submit Download

atih35z1.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\DVKP1H3T.7AX\PK0R8Z9Z.BKX\scre..tion_25b0fbb6ef7eb094_0018.0003_dc2e9ccfa6fe95f2\atih35z1.newcfg
Size 574B
SHA256 357c8cb69caeae677555a8219255043649a35a50b8da9a83c59bd132a2ab3fa2
MD5 f406ac849a76c6405550a0d9787a6325
SHA1 01fb5d0ef605e2bf28632f625514afe6c17703ab
SHA512 3090d4897996e4d0db0064dd7f2c6da5984a3efce95f4b2fd4e2615a3e6e88a1f60d572c08b409d5c4a42e94771abab437a6000efe7644ff33d11ee66aeda26a
TLSH
T132F0F6A531807A5A03636D23C5124744AE721B9B0555209874AF613B5F315DA07A31DA
MD5 SHA1 SHA512 TLSH

Submit Download

blo0mgvv.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\DVKP1H3T.7AX\PK0R8Z9Z.BKX\scre..tion_25b0fbb6ef7eb094_0018.0003_dc2e9ccfa6fe95f2\blo0mgvv.newcfg
Size 574B
SHA256 cbb27425990673dbd23ada875833e506a27bd5dc1d5fb89ab8e22f0844274ea1
MD5 e474ccf5dd16cacce741fb0f5002f450
SHA1 d6cc36b9ee881ad8d168f894d7e0ee12b5ce57df
SHA512 4e29d8af78779db05d9a0e70b0c03443d84d4a2cd1ee6766649da3e0cf7fcabc713797c4132d664dc452afc5aa434a008965e8da7d25db405ece39634bf7c695
TLSH
T1C5F0F6A931807A5A03636D23C5124744AD721B9B0555209874AF613B5F315DA07A31DA
MD5 SHA1 SHA512 TLSH

Submit Download

dnn1k4yu.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\DVKP1H3T.7AX\PK0R8Z9Z.BKX\scre..tion_25b0fbb6ef7eb094_0018.0003_dc2e9ccfa6fe95f2\dnn1k4yu.newcfg
Size 574B
SHA256 4fbbee343c253b890503c1922ab2c01ff7d5db5a56df3351baa21a778c337370
MD5 731725f3c344b881d03c1e97bb895aa4
SHA1 cd7dde9b53faf2149741ca067eb6b0a0ee7fcd6f
SHA512 8a6c1280c2603bb56013009a469fe4468f204a2a8f69f6a71537b8aad1d9a855473cb1b3d9bd1b4b4b3efad25f4901be7fe6c922f22f705db7bb7e4c98173288
TLSH
T1ECF02BA531807E5A03736D33C5124744ED722BDB0555209874BF613B5F315DB07A31DE
MD5 SHA1 SHA512 TLSH

Submit Download

ohcvpaal.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\DVKP1H3T.7AX\PK0R8Z9Z.BKX\scre..tion_25b0fbb6ef7eb094_0018.0003_dc2e9ccfa6fe95f2\ohcvpaal.newcfg
Size 574B
SHA256 2c30ddd1c345d0f83e69a0a1b3a58b3e669ec0f3fef765f7f62f985c313f7af2
MD5 a45606192834cf16ef478636df206e1c
SHA1 79599635e4dadbc2bc41862734192079c97aded6
SHA512 cec26f11350d2d8dce9b9cfa57dd14c0389c889ca73960c6871d8e61ba577d54f61aef7e0bf24699463fe581f69071c104c8fc271a6f5ebf995f46733c70ed49
TLSH
T138F02BA531807E6A03736D33C5124744EE721BDB0555209874BF613B5F315DB07A31DE
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Users\Admin\AppData\Local\Apps\2.0\DVKP1H3T.7AX\PK0R8Z9Z.BKX\scre..tion_25b0fbb6ef7eb094_0018.0003_dc2e9ccfa6fe95f2\user.config
Size 574B
SHA256 e6620880d69a17a57fab31ec8c97abd7223300538eac0a618b505dcb208997a9
MD5 66eb41c382cc5111e722b22621617167
SHA1 7df84156a6e41b8b60b0098a36dc14c1905bcd5d
SHA512 f3f33243739f755dbf49498508f854ff9716d8d9632802c8c2899bfb19fbc698ad9b3988f9b9018c661cafff5e96b6b497df3ac76c53a3310002158c8d9e6446
TLSH
T125F02BA531807E5A03736D33C5124744ED721BDB0555209874BF613B5F315DB07A31DE
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Users\Admin\AppData\Local\Apps\2.0\DVKP1H3T.7AX\PK0R8Z9Z.BKX\scre..tion_25b0fbb6ef7eb094_0018.0003_dc2e9ccfa6fe95f2\user.config
Size 574B
SHA256 01be609e4573abbdacd4c201141719b11be742650cb270d0e7f17760ace13d33
MD5 ee58cf6420fab7935eeb2edd52c5fd8c
SHA1 f04d176c43395f651a8098225a014ef6c9c5fd71
SHA512 0b85b1634a7d211d9ea88310dbc9425c28e43405d96c0da944579d3620ec833635c951d66d9968f1d80585f31c8e426de403ff397298df51ef843be8c888171d
TLSH
T1FBF02BA931807E5A07B36D33C5124744EE722BDB0555209874BF613B5F315DB07A31DE
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Users\Admin\AppData\Local\Apps\2.0\DVKP1H3T.7AX\PK0R8Z9Z.BKX\scre..tion_25b0fbb6ef7eb094_0018.0003_dc2e9ccfa6fe95f2\user.config
Size 574B
SHA256 08bc2955207a175c8593263fe09de8fa6530b148e8941cf1e67b483a9f390f98
MD5 59b98303bdbe04e6e8b655663e232786
SHA1 c02d66b5f86ab3144a3b9b5bb8755dddb69bfdb7
SHA512 bfa44c2f259c73bd4d33921c56c8e60057a435fb8e75ec1bcb2966c8e4b64114600a00607a63bbf70a69439bad2541bed22c4be82c8c0095a08362395adb7a6a
TLSH
T193F0F6A531806A5A03636D23C5124744ED721B9B0555209874AF613B5F315DA07A31DA
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Users\Admin\AppData\Local\Apps\2.0\DVKP1H3T.7AX\PK0R8Z9Z.BKX\scre..tion_25b0fbb6ef7eb094_0018.0003_dc2e9ccfa6fe95f2\user.config
Size 574B
SHA256 8147aa1de51ab0db45b8ee3096eb1f8b0597e0b44ed158c9d614dc490525a589
MD5 6c340e50ee9f3c9b1ac60d557b7e3c79
SHA1 4d4dfa5b39f2ea891ad6f92815ae08f6de7e8ff8
SHA512 416838632889abce79b0e6d8217886e190cce1fa98628cd6928373c5c6bb1dca341819e1a7926f5316d8b2e465d894239325ab20937f7449a4a681dab072bbac
TLSH
T1D9F0F6A53180AA5A03636D23C5124744ED721B9B0555209874AF623B5F315DB07A31DA
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Users\Admin\AppData\Local\Apps\2.0\DVKP1H3T.7AX\PK0R8Z9Z.BKX\scre..tion_25b0fbb6ef7eb094_0018.0003_dc2e9ccfa6fe95f2\user.config
Size 574B
SHA256 e2855aa274e314d44dbbd489afcf0a47d3838bc5888d1b62d8522bd7bd46b7e3
MD5 0dd12695567a4461a4b489be01df2a81
SHA1 d8b09eec21b7c050d5f6e1774a3459d41e9410ba
SHA512 3b8e5b735a871330cc898d3a2b583f1a359482546f795117a175cabfea7caf48264b51f45af5acfa32fd157ac8e228e9025836f2aa61e7a7c1f37b81df5e7eaf
TLSH
T141F0F6A531807E5A03636D23C5124744AD722B9B0555209874AF613B5F315DA07A32EA
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Client.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\8P38OV8D.E2W\O5VOTBTH.4MN\ScreenConnect.Client.dll
Size 192KB
SHA256 ea0a545f40ff491d02172228c1a39ae68344c4340a6094486a47be746952e64f
MD5 3724f06f3422f4e42b41e23acb39b152
SHA1 1220987627782d3c3397d4abf01ac3777999e01c
SHA512 509d9a32179a700ad76471b4cd094b8eb6d5d4ae7ad15b20fd76c482ed6d68f44693fc36bcb3999da9346ae9e43375cd8fe02b61edeabe4e78c4e2e44bf71d42
SSDEEP 3072:/xLtNGTlIyS7/ObjusqVFJRJcyzvYqSmzDvJXYF:FtNGTGySabqPJYbqSmG
TLSH
T1DD144B8633A94E36DA9F5D73B46060358AB5ED066023E3EE5E04F9F61A733408E553E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\8P38OV8D.E2W\O5VOTBTH.4MN\ScreenConnect.Client.dll.genman
Size 1KB
SHA256 f1bf5014656d836a4c5c42e7ed67ff368d1706c41082e1e4f33abf9cda09d647
MD5 618dc5f6c85a2057bc7a86c5f498e2f1
SHA1 5073b2c3a117985e8f26ed5bea8c93a5bb202eea
SHA512 a8ed838573ef9a4119a4d32335543ea5074250d47212068ef2c4b470a451eb0154bceb8b3bf8b0722d4250122f6b5a196383576f715fd938d3ccb6cbde7c2799
TLSH
T14A11590181C8FA361F3301D1BEE7E02157AE1B33058D194BB0A968AFCB2DAE643471B3
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\8P38OV8D.E2W\O5VOTBTH.4MN\ScreenConnect.ClientService.dll
Size 66KB
SHA256 fd5818dcdf5fc76316b8f7f96630ec66bb1cb5b5a8127cf300e5842f2c74ffca
MD5 5db908c12d6e768081bced0e165e36f8
SHA1 f2d3160f15cfd0989091249a61132a369e44dea4
SHA512 8400486cadb7c07c08338d8876bc14083b6f7de8a8237f4fe866f4659139acc0b587eb89289d281106e5baf70187b3b5e86502a2e340113258f03994d959328d
SSDEEP 1536:+A0ZscQ5V6TsQqoSD6h6+39QFVIl1zJhb8gq:p0Zy3gUOQFVQzJq
TLSH
T1C2634A45A3E95E77C9DF5F7C7865B1410FB08A02E462FB989CC9A8D71A537C12E003AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\8P38OV8D.E2W\O5VOTBTH.4MN\ScreenConnect.ClientService.dll.genman
Size 1KB
SHA256 276b0232a7c76292d34207f916966ea1bcd5cd7e1e1d9a2751c663f06e45b63c
MD5 4e77158d54337b51a6368d7d094397c4
SHA1 3a029b30b95786adf97fb3c0b1c37b11154e0344
SHA512 69d7a90b2802575555e68991d157885253a72f5ed5181af5795e52bb6165b979542f482bac1e3cc164013133a4b812e1ec10bbcd39aa1166318099abc267ed95
TLSH
T1C831E90651C4FA351F3301C1BEE7E0619BAE1B33158E1947709969ABCF2DAA64347173
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\8P38OV8D.E2W\O5VOTBTH.4MN\ScreenConnect.Core.dll
Size 536KB
SHA256 a2e9752de49d18e885cbd61b29905983d44b4bc0379a244bfabdaa3188c01f0a
MD5 14e7489ffebbb5a2ea500f796d881ad9
SHA1 0323ee0e1faa4aa0e33fb6c6147290aa71637ebd
SHA512 2110113240b7d803d8271139e0a2439dbc86ae8719ecd8b132bbda2520f22dc3f169598c8e966ac9c0a40e617219cb8fe8aac674904f6a1ae92d4ac1e20627cd
SSDEEP 12288:xC2YKhQCNc6kVTplfWL/YTHUYCBdySISYz:HhE6O7WL/EC
TLSH
T12BC47D2233AC9A2EC56E133BB072915DC5F0E906351AF79F76C5E5BC2EC27450E112EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\8P38OV8D.E2W\O5VOTBTH.4MN\ScreenConnect.Core.dll.genman
Size 1KB
SHA256 ac3c489c02264ff1918fc0b79083a7754b98542a6cc4e2af67eafdbf76c6232e
MD5 293c100b1896e7532d241dac2b32dcb3
SHA1 1e14b49c9af799da0371474bf712f3ac3e5b6ebc
SHA512 ed3935d90f48043be2bf7a60cacbb47964672eab0c9ebfc2eeac8ebc4341383f32f55901601de56698eef6aec6399e77eb8dec6f5158d1b3761d5f25adfc3499
TLSH
T1AE216A0181C8FA261F3302D2BEE7E421979E5B3314CD194B7469689FCB2DAD64747173
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\8P38OV8D.E2W\O5VOTBTH.4MN\ScreenConnect.Windows.dll
Size 1.6MB
SHA256 84a09ed81afc5ff9a17f81763c044c82a2d9e26f852de528112153ee9ab041d0
MD5 9ad3964ba3ad24c42c567e47f88c82b2
SHA1 6b4b581fc4e3ecb91b24ec601daa0594106bcc5d
SHA512 ce557a89c0fe6de59046116c1e262a36bbc3d561a91e44dcda022bef72cb75742c8b01bedcc5b9b999e07d8de1f94c665dd85d277e981b27b6bfebeaf9e58097
SSDEEP 24576:dx5xeYkYFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPo:dx5xTkYJkGYYpT0+TFiH7efP
TLSH
T1DC85BD41E2C365F5D46B047888BF572ABA743C080315CAFB97D4AE396D33BC09A36756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\8P38OV8D.E2W\O5VOTBTH.4MN\ScreenConnect.Windows.dll.genman
Size 1KB
SHA256 d48afb709e61b86eb6eef67b41d0fa7ec780c4536f5cf9aca7a0b440aed98ef0
MD5 88ecd545bdbe3ed49c6a2b87589102ec
SHA1 e72949af66b0a20e50474d2005e320ba63ba9b2b
SHA512 7ed19ed32e02348abc8a64ca0a21e05496a6595a8b94d3f960cf3f6a6c6445d30aad7aec09ce76776023f9e5f4b40df032408deffba102026247099879cb95de
TLSH
T17F41D01281C8FA250F3302C2BEEBE431979E5723158E194B7499A99BCF29AE74747137
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsBackstageShell.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\8P38OV8D.E2W\O5VOTBTH.4MN\ScreenConnect.WindowsBackstageShell.exe
Size 59KB
SHA256 e25f32ba3fa32fd0ddd99eb65b26835e30829b5e4b58573690aa717e093a5d8f
MD5 afa97caf20f3608799e670e9d6253247
SHA1 7e410fde0ca1350aa68ef478e48274888688f8ee
SHA512 fe0b378651783ef4add3851e12291c82edccde1dbd1fa0b76d7a2c2dcd181e013b9361bbdae4dae946c0d45fb4bf6f75dc027f217326893c906e47041e3039b0
SSDEEP 1536:kW/+lo6MOc8IoiKWjrNv8DtyQ4RE+TC6WAhVbb57bP8:kLlo6dccldyQGWy5s
TLSH
T1DE537D4063F84A26C9FE5E3AB4F1D2250AF1AA426451E7AE0ECD51E94E137C16F603F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\8P38OV8D.E2W\O5VOTBTH.4MN\ScreenConnect.WindowsClient.exe
Size 588KB
SHA256 600cf10e27311e60d32722654ef184c031a77b5ae1f8abae8891732710afee31
MD5 1778204a8c3bc2b8e5e4194edbaf7135
SHA1 0203b65e92d2d1200dd695fe4c334955befbddd3
SHA512 a902080ff8ee0d9aeffa0b86e7980457a4e3705789529c82679766580df0dc17535d858fbe50731e00549932f6d49011868dee4181c6716c36379ad194b0ed69
SSDEEP 6144:fybAk1FVMVTZL/4TvqpU0pSdRW3akod1sI5mgve8mZXuRFtSc4q2/R4IEyxuV5AN:qbAOwJ/MvIFptJoR5NmtiFsxsFE
TLSH
T168D46D2677B8DB6BC9EF073AB0B15E2457B0E8036686D78E48A4B5D90DC738149093F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Users\Admin\AppData\Local\Temp\Deployment\8P38OV8D.E2W\O5VOTBTH.4MN\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
TLSH
T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\8P38OV8D.E2W\O5VOTBTH.4MN\ScreenConnect.WindowsClient.exe.genman
Size 2KB
SHA256 8aa9dacc29faef7be40d54b45fba75afc13bf25638d9a46dc4b516529ae74619
MD5 6a1c3ff3e8f5e23698453b4ccda2fd12
SHA1 c7eed4383b7f1982222e663a0b8850d09b6b20ef
SHA512 c9f09c968d71f4d7481c1aadbf8337fbce052f71aa168795daf374d53cc827ba9e7f1cf9adc50fc423cf68ee500bfc931dd2e14648626ed7d688f1a41447dccc
TLSH
T19951B40641C8FA210F3301C1BEEBE471979E5B32158E19477099A99FCF2DAA74747137
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.manifest

Path C:\Users\Admin\AppData\Local\Temp\Deployment\8P38OV8D.E2W\O5VOTBTH.4MN\ScreenConnect.WindowsClient.exe.manifest
Size 17KB
SHA256 2e0e46f395d5a6440f179b61c4008abf3d72cfcda705a543c8ee18b41d37b025
MD5 7f68a01c2fea1c80a75e287bb36d6b43
SHA1 f271ebc2542397e59c3d57d30cc54bf1d9db4f69
SHA512 c6c1c9d6d9c50f94c9bc8c8a422cd00397ee184b6f6113ea19f9209c0e2339b540ee92d35bcce81f242d6fdc3c720ec2e56675e702e90c91533a07fa9f9db753
SSDEEP 384:rexTuzvdu98aXVEf6/DX9mX9FX9R/QPIYM7Y7:rn6/DX9mX9FX9R/QPIN07
TLSH
T1EB82C54A88C17C11433691D0FFF38920BE556B2341FE048ABC4E55AF8F6569993972F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsFileManager.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\8P38OV8D.E2W\O5VOTBTH.4MN\ScreenConnect.WindowsFileManager.exe
Size 79KB
SHA256 ebd04a4540d6e76776bd58deea627345d0f8fba2c04cc65be5e979a8a67a62a1
MD5 1aee526dc110e24d1399affccd452ab3
SHA1 04db0e8772933bc57364615d0d104dc2550bd064
SHA512 482a8ee35d53be907be39dbd6c46d1f45656046baca95630d1f07ac90a66f0e61d41f940fb166677ac4d5a48cf66c28e76d89912aed3d673a80737732e863851
SSDEEP 1536:Ety9l44Kzb1I5kLP+VVVVVVVVVVVVVVVVVVVVVVVVVC7j27Vy:PvqukLdn2s
TLSH
T18883E68235762631DF85C5379492C9B59D366F22133DC5BD2DA2FE3A69F03043A8ADB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ZDOKANP6.G1Y.application

Path C:\Users\Admin\AppData\Local\Temp\Deployment\ENWTNLT2.XJ5\ZDOKANP6.G1Y.application
Size 114KB
SHA256 89eb055f32184dfe333494a271ed865958d5adc1521043c6d81098f541cc0b3f
MD5 fe06c5e9c53ab451368667d3e3b1504b
SHA1 7c76334bb2bc0d1e444a1fcaa484b642572cad1e
SHA512 b0c6570f937582b1072491506992ad077bd271b7301c26624a9418baf77bbe5496d30ef3522d63d60ef8beecc2ca113788b4a91833b99d931c841bac0d051caa
SSDEEP 3072:xNIcT51/FXvMVNWfCXq9ym7m2o9HuzhJOvP:gcfiVIpmt8vOvP
TLSH
T12CB3E82ACF30F4C4877DB021D1652D6735811B57DBB30FACDA0A286B0E69792EF5A64C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/936-341-0x0000000000D50000-0x0000000000DE6000-memory.dmp

Download

memory/936-352-0x00000000015C0000-0x00000000015D8000-memory.dmp

Download

memory/2780-38-0x00000273BF3C0000-0x00000273BF56A000-memory.dmp

Download

memory/2780-62-0x00000273BF0F0000-0x00000273BF17C000-memory.dmp

Download

memory/2780-50-0x00000273BF060000-0x00000273BF096000-memory.dmp

Download

memory/2780-44-0x00000273BF100000-0x00000273BF196000-memory.dmp

Download

memory/2780-0-0x00000273A3300000-0x00000273A3308000-memory.dmp

Download

memory/2780-56-0x00000273BEF40000-0x00000273BEF58000-memory.dmp

Download

memory/2780-31-0x00000273BD7C0000-0x00000273BD7D0000-memory.dmp

Download

memory/2780-27-0x00000273BD7C0000-0x00000273BD7D0000-memory.dmp

Download

memory/2780-26-0x00000273BD7C0000-0x00000273BD7D0000-memory.dmp

Download

memory/2780-6-0x00000273C1840000-0x00000273C1890000-memory.dmp

Download

memory/2780-3-0x00000273BD7C0000-0x00000273BD7D0000-memory.dmp

Download

memory/2780-2-0x00000273BD7C0000-0x00000273BD7D0000-memory.dmp

Download

memory/2780-1-0x00000273BD8A0000-0x00000273BDA26000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads