Analysis
- geolocation tags
nanew-jerseynorth-americaunited-statesususa - max time kernel
899s - max time network
893s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/09/2026, 13:33
Static task
static1
Behavioral task
behavioral1
Sample
ScreenConnect.ClientSetup.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
25 signatures
900 seconds
Behavioral task
behavioral2
Sample
ScreenConnect.ClientSetup.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
30 signatures
900 seconds
General
- Target ScreenConnect.ClientSetup.exe
- Size 23.3MB
- Sample260930-qthnrsgd89
- SHA256 b8c6e3871c3cdb9934ed49aaca9aa4ff105da75220946601d8335b5fea4652c4
- MD5 7ff12f322b9ff2a70e7e6bf9f55cac7a
- SHA1 5ce2f8b301546c57979178e69d2270892cc7ad0a
- SHA512 98a81c8d1cfd39c44705dc1f422fb2f8b1ad0887c59889d05762c2397e06548b2f56afe8c78d5b9668bada2617e1383f9c64f5136bacc641d6c35253ff51d6ab
- SSDEEP 393216:fx6ohU+8bjJ8JQj9ySZ8Ed6ohU+8bjJ8o6ohU+8bjJ816ohU+8bjJ876ohU+8bj7:Qoh0bjn9ySZzUoh0bj+oh0bjVoh0bj15
- TLSH T1DD372301BBC6A966D87F0735987AA3106771BC414B12C7AF27E47B3D1D327C05E623AA
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 7 2012 rundll32.exe - Sets service image path in registry 3 TTPs 1 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (b84d28617c3984ca)\ImagePath = "\"C:\\Program Files (x86)\\ScreenConnect Client (b84d28617c3984ca)\\ScreenConnect.ClientService.exe\" \"?e=Access&y=Guest&h=instance-szc6yp-relay.screenconnect.com&p=443&s=6dbce467-13e3-49b3-858c-02fdd3166dbe&k=BgIAAACkAABSU0ExAAgAAAEAAQCdgBUqDr355ZP0h0vdmA%2fviyLxCFC62i9NqY3zs7%2bTqN7y%2fm%2b52NvDTr1uHD2XVj9Zw4g5YMbAz7K%2fYhD1zIF%2bHwL92%2bYCVx7lsdd3ftSaSWWqaTLHDTqahB2TEkPEFC1NXqOphUuhr7ojo48sLKnXLrkOW7CRbVkHjOPPE4eg4nyIaUUiAhOltpOZ2a89we1VG50kVqayA%2bxUcJ%2fsmq4dlBQJWXhqdHCCGzDxTS9OggvKSKMZkSQzReueNvJpu2kZqg1Fb9qJ4eCYKnwdewPUkkCbpynFEbw1AhnSO6%2fwefg06iBw4UIvU39Q5KsU0aZnFx0A8I%2b8spSIuYXetZKh&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAA%2bBJjC92wnE%2bs5StMxOxXDQAAAAACAAAAAAAQZgAAAAEAACAAAADjA6vos%2fPY6w5dDqlMSR4cpFsuRP8609PKI2tNhMZ8QAAAAAAOgAAAAAIAACAAAABDFGmAmryp7Eth8hTgqIMnAgqD3FcoJlyFMfpin%2bdKJaAEAACJjDJSQRXo%2boF3omv%2bj%2bNRCkF%2fYJXbUE0CLwHp%2fuzwRPEBe0vB%2fHhmmAQQKbeyAKdQUg0VWpHdQla%2buuzxCn1X52fRYEASwdoAl931DV2Afoo4OR7mHmGWXS5%2fE%2b%2b66bMVuEp7M0Yh1VydsTxLJnpQaclMi6kIJJS%2fiN5R8Jo%2b3qaT5tbFte57IP9CM8dQbY4IgfYY17ziE4b6Oq3vZy8UzSSC18%2f17f1wCjWAdkxHEpp%2fgUqv0BxtQUY0ixWRApN7sUGLkZzygvbdjoU2xr8cLnEjs3PPC6FnO%2bXmz9Khyje%2b4t%2f0u6XXBzHVy5yya02PK6L5R73AbMGeoa6qiNyMpq%2fGz%2bM5cBO9zLAA4Y7NDCwj8Xlh1pe0vm6Iz6%2fI1wnZJGdckodrc8lffQkbLPzBPC4AymMYUsCWhP2oS3FMNNmCMI5aY0Ed%2fOaUZ26fnE8my%2fjGa3l4bXysXYW954Ylxx%2bvxDcbGMf0qg3aR17cO05d1C6JFQh4wqUjuWRiwZmKuZ86bXWYWkCFEB6wEHbuvSdI6o61eD12053%2fgq58d7%2foqfe4l5i%2bsi3AITIvQ0l6soLGowunv2UHifqwjjrh8T%2bBuyM%2fzv4dexoKop5mGPXzaw0qxUgznL6lwGiO2Qnepe01Y2B8LaVW52kRHmE1LVCesXA5TegBhrHgIjgCu6D2Y2J0JuUtoAuVx%2bbIwFYUkeJcO0pvZOy83i0EBFTqKcCEvLQ84v84U7%2fhp3MOCKO%2b9lYAotHXexHIbEhlJtcaz9kuESnteJyYOWnNcVMO5Ws4prm3Er7fCddhnWb3KNYOz%2bai1gmkX%2bAw0%2bT0VjQ%2f55Z6v0s99nBq0kFLBfWCg%2bX8vtrMfFf1trzay25wYIrmLPnd2N6169KNHm7txr6ZRRRwqpuZZ36G6e2ZjzJLGNIuvCG4QtfCD2VInqqTTWigilqGjT1NJBR3KyZ5DwWsqgA7XnSrzZoAV3u07kaauZDDrkZFmgASaJn4CGIFgP8M4KVX6n2XpgcMIBPw2Y2m%2fkWPO%2bgL0l2ohpgIpahYQJyWJ4Hy86AJgm%2ffozAegrSznO6PzLpSWnE4gCSgL9pOoDQRYOFrc29VvRkCkUJZDbAMxBu4ol44XpKlE7%2fDbRAnDoB6C8H0sGtSiX31h7zTMi9vnuj7xy8FvTqx%2bh1DJPEoJNZOLTdPMwXNdelG3RSpJgBJlnKsX%2bzG%2ftrt8MjE5L7Suduk%2bSISpJOfiI1B1PoUqoc46pdBMsCwrghKkgsMQcUV7dZyfG7hD65%2fDZYbx7waX6pP%2bdQw4MZK9pk6daQautkU4%2bn4JGkhdDAdTmeQTyQGcfYmV0G2fbYnDRP7%2f8H1rCbtDupUF4OLdBl69WjMz4z1i%2fS34ckAH1qghbmCEQ0odityBXcjFQGxYlOpBO0QyZfyEg6BBLed%2fqR8%2f3hloMmb3D4%2fFAL50%2bgypsr8m3HQOCNQlTCTqw%2bEKRjsI0LfLSb4h%2fnC%2fwVPBQjThxelm0USTS9PWC662x9skuPFZ3Ge%2bhCJDRGvxEUNSN5Z0sGYFHZf3mAeRcWUso1OPTMvRUs6v4qN5QQgRbo9OkAAAABHpopIir5U0DAKJpeNDInqKFeNkBHQH1kVOl0UPQkL5cP8yAvkHGRrEOGlUDETD4EV7jhw%2bxaCGWFEwDsVJuOa&c=neww%20invite%20page&c=&c=&c=&c=&c=&c=&c=\"" ScreenConnect.ClientService.exe - Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe - Enumerates connected drives 3 TTPs 51 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\F: explorer.exe \??\F:\ explorer.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe \??\F:\ msiexec.exe \??\E:\ explorer.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\E: explorer.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: msiexec.exe - Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs
Suspicious Windows Authentication Registry Modification.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\Authentication Packages = 6d007300760031005f003000000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800620038003400640032003800360031003700630033003900380034006300610029005c00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f0077007300410075007400680065006e007400690063006100740069006f006e005000610063006b006100670065002e0064006c006c0000000000 msiexec.exe - Drops file in System32 directory 9 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (b84d28617c3984ca)\qous3xuh.newcfg ScreenConnect.ClientService.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (b84d28617c3984ca)\rx0o0a2y.newcfg ScreenConnect.ClientService.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (b84d28617c3984ca)\fqa5345v.tmp ScreenConnect.ClientService.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (b84d28617c3984ca)\fqa5345v.newcfg ScreenConnect.ClientService.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (b84d28617c3984ca)\fqa5345v.newcfg ScreenConnect.ClientService.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (b84d28617c3984ca)\rx0o0a2y.tmp ScreenConnect.ClientService.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (b84d28617c3984ca)\user.config ScreenConnect.ClientService.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (b84d28617c3984ca)\qous3xuh.tmp ScreenConnect.ClientService.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (b84d28617c3984ca)\qous3xuh.newcfg ScreenConnect.ClientService.exe - Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Drops file in Program Files directory 17 IoCs
description ioc Process File created C:\Program Files (x86)\ScreenConnect Client (b84d28617c3984ca)\ScreenConnect.WindowsClient.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (b84d28617c3984ca)\ScreenConnect.WindowsClient.exe.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (b84d28617c3984ca)\ScreenConnect.WindowsFileManager.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (b84d28617c3984ca)\ScreenConnect.Client.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (b84d28617c3984ca)\ScreenConnect.Core.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (b84d28617c3984ca)\ScreenConnect.WindowsAuthenticationPackage.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (b84d28617c3984ca)\ScreenConnect.WindowsBackstageShell.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (b84d28617c3984ca)\ScreenConnect.WindowsBackstageShell.exe.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (b84d28617c3984ca)\Client.en-US.resources msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (b84d28617c3984ca)\Client.resources msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (b84d28617c3984ca)\system.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (b84d28617c3984ca)\ScreenConnect.ClientService.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (b84d28617c3984ca)\ScreenConnect.Windows.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (b84d28617c3984ca)\ScreenConnect.WindowsFileManager.exe.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (b84d28617c3984ca)\ScreenConnect.WindowsCredentialProvider.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (b84d28617c3984ca)\ScreenConnect.ClientService.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (b84d28617c3984ca)\app.config msiexec.exe - Drops file in Windows directory 17 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\SystemTemp\~DFD6479C9302541E85.TMP msiexec.exe File opened for modification C:\Windows\Installer\{3F4FB54D-C431-0A48-74EE-07E2FE82DB35}\DefaultIcon msiexec.exe File created C:\Windows\SystemTemp\~DFEC1EC3A8DA422B5B.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF418F00B87E3D4EEF.TMP msiexec.exe File opened for modification C:\Windows\Installer\e5a86d5.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\SystemTemp\~DF5A823400736EAC16.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI8F41.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI94A2.tmp msiexec.exe File created C:\Windows\Installer\{3F4FB54D-C431-0A48-74EE-07E2FE82DB35}\DefaultIcon msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{3F4FB54D-C431-0A48-74EE-07E2FE82DB35} msiexec.exe File created C:\Windows\Installer\wix{3F4FB54D-C431-0A48-74EE-07E2FE82DB35}.SchedServiceConfig.rmi MsiExec.exe File created C:\Windows\Installer\e5a86d7.msi msiexec.exe File created C:\Windows\Installer\e5a86d5.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI8F90.tmp msiexec.exe - Executes dropped EXE 4 IoCs
pid Process 2544 ScreenConnect.ClientService.exe 4268 ScreenConnect.ClientService.exe 2984 ScreenConnect.WindowsClient.exe 1304 ScreenConnect.WindowsClient.exe - Loads dropped DLL 50 IoCs
pid Process 3580 MsiExec.exe 3712 rundll32.exe 3712 rundll32.exe 3712 rundll32.exe 3712 rundll32.exe 3712 rundll32.exe 3712 rundll32.exe 3712 rundll32.exe 3712 rundll32.exe 3712 rundll32.exe 3580 MsiExec.exe 2012 rundll32.exe 2012 rundll32.exe 2012 rundll32.exe 2012 rundll32.exe 2012 rundll32.exe 2012 rundll32.exe 2012 rundll32.exe 2012 rundll32.exe 2012 rundll32.exe 3580 MsiExec.exe 4664 rundll32.exe 4664 rundll32.exe 4664 rundll32.exe 4664 rundll32.exe 4664 rundll32.exe 4664 rundll32.exe 4664 rundll32.exe 4664 rundll32.exe 4664 rundll32.exe 3144 MsiExec.exe 4044 MsiExec.exe 4268 ScreenConnect.ClientService.exe 4268 ScreenConnect.ClientService.exe 2544 ScreenConnect.ClientService.exe 2544 ScreenConnect.ClientService.exe 4268 ScreenConnect.ClientService.exe 4268 ScreenConnect.ClientService.exe 2544 ScreenConnect.ClientService.exe 2544 ScreenConnect.ClientService.exe 4268 ScreenConnect.ClientService.exe 4268 ScreenConnect.ClientService.exe 2544 ScreenConnect.ClientService.exe 2544 ScreenConnect.ClientService.exe 4268 ScreenConnect.ClientService.exe 4268 ScreenConnect.ClientService.exe 2544 ScreenConnect.ClientService.exe 2544 ScreenConnect.ClientService.exe 4268 ScreenConnect.ClientService.exe 4268 ScreenConnect.ClientService.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
pid pid_target Process procid_target 3316 2544 WerFault.exe 105 - Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain rundll32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname rundll32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname ScreenConnect.ClientService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain ScreenConnect.ClientService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname ScreenConnect.WindowsClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain ScreenConnect.WindowsClient.exe - System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ScreenConnect.ClientSetup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ScreenConnect.ClientService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ScreenConnect.ClientService.exe - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID explorer.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000027445be3350784180000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380127445be30000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410127445be3000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e327445be300000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e627445be300000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ScreenConnect.WindowsClient.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ScreenConnect.WindowsClient.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Main explorer.exe - Modifies data under HKEY_USERS 13 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ ScreenConnect.WindowsClient.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" ScreenConnect.WindowsClient.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" ScreenConnect.WindowsClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ ScreenConnect.ClientService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" ScreenConnect.ClientService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" ScreenConnect.ClientService.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" ScreenConnect.WindowsClient.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" ScreenConnect.WindowsClient.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" ScreenConnect.ClientService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" ScreenConnect.ClientService.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-b84d28617c3984ca\URL Protocol msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-00C4-E465226ED992}\ = "ScreenConnect Client (b84d28617c3984ca) Credential Provider" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4154726816-2055034831-2297277433-1000\{583A54CD-BC17-48F1-8FAB-F51FF4EC7029} explorer.exe Key created \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-b84d28617c3984ca msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-b84d28617c3984ca\shell\open msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D45BF4F3134C84A047EE702EEF28BD53\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\26.6.6.9747\\b84d28617c3984ca\\" msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\MuiCache SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56" SearchHost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D45BF4F3134C84A047EE702EEF28BD53\InstanceType = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-b84d28617c3984ca\shell msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-b84d28617c3984ca\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (b84d28617c3984ca)\\ScreenConnect.WindowsClient.exe\" \"%1\"" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D45BF4F3134C84A047EE702EEF28BD53\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\26.6.6.9747\\b84d28617c3984ca\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs SearchHost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-00C4-E465226ED992}\InprocServer32\ThreadingModel = "Apartment" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D45BF4F3134C84A047EE702EEF28BD53\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-00C4-E465226ED992} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D45BF4F3134C84A047EE702EEF28BD53\ProductName = "ScreenConnect Client (b84d28617c3984ca)" msiexec.exe Set value (int) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23" SearchHost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D45BF4F3134C84A047EE702EEF28BD53\Language = "1033" msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" StartMenuExperienceHost.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4154726816-2055034831-2297277433-1000\{D097D524-01F6-4E06-877E-17FAF5CBA5D9} explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix StartMenuExperienceHost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D45BF4F3134C84A047EE702EEF28BD53\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D45BF4F3134C84A047EE702EEF28BD53\PackageCode = "D45BF4F3134C84A047EE702EEF28BD53" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\5544532A4F6B79BB8BD48216C79348AC\D45BF4F3134C84A047EE702EEF28BD53 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D45BF4F3134C84A047EE702EEF28BD53\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23" SearchHost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-00C4-E465226ED992}\InprocServer32\ = "C:\\Program Files (x86)\\ScreenConnect Client (b84d28617c3984ca)\\ScreenConnect.WindowsCredentialProvider.dll" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-b84d28617c3984ca\UseOriginalUrlEncoding = "1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-b84d28617c3984ca\shell\open\command msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D45BF4F3134C84A047EE702EEF28BD53 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D45BF4F3134C84A047EE702EEF28BD53\Full msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D45BF4F3134C84A047EE702EEF28BD53 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D45BF4F3134C84A047EE702EEF28BD53\Version = "436600838" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D45BF4F3134C84A047EE702EEF28BD53\SourceList\PackageName = "ScreenConnect.ClientSetup.msi" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D45BF4F3134C84A047EE702EEF28BD53\AdvertiseFlags = "388" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D45BF4F3134C84A047EE702EEF28BD53\SourceList\Media msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ explorer.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D45BF4F3134C84A047EE702EEF28BD53\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs SearchHost.exe Key created \REGISTRY\MACHINE\Software\Classes\sc-b84d28617c3984ca msiexec.exe Set value (data) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2380 msiexec.exe 2380 msiexec.exe 4268 ScreenConnect.ClientService.exe 4268 ScreenConnect.ClientService.exe 4268 ScreenConnect.ClientService.exe 4268 ScreenConnect.ClientService.exe 4268 ScreenConnect.ClientService.exe 4268 ScreenConnect.ClientService.exe 3420 explorer.exe 3420 explorer.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4928 ScreenConnect.ClientSetup.exe Token: SeShutdownPrivilege 3068 msiexec.exe Token: SeIncreaseQuotaPrivilege 3068 msiexec.exe Token: SeSecurityPrivilege 2380 msiexec.exe Token: SeCreateTokenPrivilege 3068 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3068 msiexec.exe Token: SeLockMemoryPrivilege 3068 msiexec.exe Token: SeIncreaseQuotaPrivilege 3068 msiexec.exe Token: SeMachineAccountPrivilege 3068 msiexec.exe Token: SeTcbPrivilege 3068 msiexec.exe Token: SeSecurityPrivilege 3068 msiexec.exe Token: SeTakeOwnershipPrivilege 3068 msiexec.exe Token: SeLoadDriverPrivilege 3068 msiexec.exe Token: SeSystemProfilePrivilege 3068 msiexec.exe Token: SeSystemtimePrivilege 3068 msiexec.exe Token: SeProfSingleProcessPrivilege 3068 msiexec.exe Token: SeIncBasePriorityPrivilege 3068 msiexec.exe Token: SeCreatePagefilePrivilege 3068 msiexec.exe Token: SeCreatePermanentPrivilege 3068 msiexec.exe Token: SeBackupPrivilege 3068 msiexec.exe Token: SeRestorePrivilege 3068 msiexec.exe Token: SeShutdownPrivilege 3068 msiexec.exe Token: SeDebugPrivilege 3068 msiexec.exe Token: SeAuditPrivilege 3068 msiexec.exe Token: SeSystemEnvironmentPrivilege 3068 msiexec.exe Token: SeChangeNotifyPrivilege 3068 msiexec.exe Token: SeRemoteShutdownPrivilege 3068 msiexec.exe Token: SeUndockPrivilege 3068 msiexec.exe Token: SeSyncAgentPrivilege 3068 msiexec.exe Token: SeEnableDelegationPrivilege 3068 msiexec.exe Token: SeManageVolumePrivilege 3068 msiexec.exe Token: SeImpersonatePrivilege 3068 msiexec.exe Token: SeCreateGlobalPrivilege 3068 msiexec.exe Token: SeCreateTokenPrivilege 3068 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3068 msiexec.exe Token: SeLockMemoryPrivilege 3068 msiexec.exe Token: SeIncreaseQuotaPrivilege 3068 msiexec.exe Token: SeMachineAccountPrivilege 3068 msiexec.exe Token: SeTcbPrivilege 3068 msiexec.exe Token: SeSecurityPrivilege 3068 msiexec.exe Token: SeTakeOwnershipPrivilege 3068 msiexec.exe Token: SeLoadDriverPrivilege 3068 msiexec.exe Token: SeSystemProfilePrivilege 3068 msiexec.exe Token: SeSystemtimePrivilege 3068 msiexec.exe Token: SeProfSingleProcessPrivilege 3068 msiexec.exe Token: SeIncBasePriorityPrivilege 3068 msiexec.exe Token: SeCreatePagefilePrivilege 3068 msiexec.exe Token: SeCreatePermanentPrivilege 3068 msiexec.exe Token: SeBackupPrivilege 3068 msiexec.exe Token: SeRestorePrivilege 3068 msiexec.exe Token: SeShutdownPrivilege 3068 msiexec.exe Token: SeDebugPrivilege 3068 msiexec.exe Token: SeAuditPrivilege 3068 msiexec.exe Token: SeSystemEnvironmentPrivilege 3068 msiexec.exe Token: SeChangeNotifyPrivilege 3068 msiexec.exe Token: SeRemoteShutdownPrivilege 3068 msiexec.exe Token: SeUndockPrivilege 3068 msiexec.exe Token: SeSyncAgentPrivilege 3068 msiexec.exe Token: SeEnableDelegationPrivilege 3068 msiexec.exe Token: SeManageVolumePrivilege 3068 msiexec.exe Token: SeImpersonatePrivilege 3068 msiexec.exe Token: SeCreateGlobalPrivilege 3068 msiexec.exe Token: SeCreateTokenPrivilege 3068 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3068 msiexec.exe - Suspicious use of FindShellTrayWindow 61 IoCs
pid Process 3068 msiexec.exe 3068 msiexec.exe 2984 ScreenConnect.WindowsClient.exe 2984 ScreenConnect.WindowsClient.exe 2984 ScreenConnect.WindowsClient.exe 2984 ScreenConnect.WindowsClient.exe 2984 ScreenConnect.WindowsClient.exe 4020 sihost.exe 3420 explorer.exe 3420 explorer.exe 3420 explorer.exe 3420 explorer.exe 3420 explorer.exe 3420 explorer.exe 3420 explorer.exe 3420 explorer.exe 3420 explorer.exe 3420 explorer.exe 3420 explorer.exe 3420 explorer.exe 3420 explorer.exe 3420 explorer.exe 3420 explorer.exe 3420 explorer.exe 3420 explorer.exe 3420 explorer.exe 3420 explorer.exe 3420 explorer.exe 3420 explorer.exe 3420 explorer.exe 3420 explorer.exe 3420 explorer.exe 3420 explorer.exe 3420 explorer.exe 3420 explorer.exe 3420 explorer.exe 3420 explorer.exe 3420 explorer.exe 2984 ScreenConnect.WindowsClient.exe 3420 explorer.exe 3420 explorer.exe 3420 explorer.exe 3420 explorer.exe 3420 explorer.exe 3420 explorer.exe 3420 explorer.exe 3420 explorer.exe 3420 explorer.exe 3420 explorer.exe 3420 explorer.exe 3420 explorer.exe 3420 explorer.exe 3420 explorer.exe 3420 explorer.exe 3420 explorer.exe 3420 explorer.exe 3420 explorer.exe 3420 explorer.exe 3420 explorer.exe 3420 explorer.exe 3420 explorer.exe - Suspicious use of SendNotifyMessage 46 IoCs
pid Process 2984 ScreenConnect.WindowsClient.exe 2984 ScreenConnect.WindowsClient.exe 2984 ScreenConnect.WindowsClient.exe 2984 ScreenConnect.WindowsClient.exe 2984 ScreenConnect.WindowsClient.exe 3420 explorer.exe 3420 explorer.exe 3420 explorer.exe 3420 explorer.exe 3420 explorer.exe 3420 explorer.exe 3420 explorer.exe 3420 explorer.exe 3420 explorer.exe 3420 explorer.exe 3420 explorer.exe 3420 explorer.exe 3420 explorer.exe 3420 explorer.exe 3420 explorer.exe 3420 explorer.exe 3420 explorer.exe 3420 explorer.exe 3420 explorer.exe 3420 explorer.exe 3420 explorer.exe 3420 explorer.exe 2984 ScreenConnect.WindowsClient.exe 3420 explorer.exe 3420 explorer.exe 3420 explorer.exe 3420 explorer.exe 3420 explorer.exe 3420 explorer.exe 3420 explorer.exe 3420 explorer.exe 3420 explorer.exe 3420 explorer.exe 3420 explorer.exe 3420 explorer.exe 3420 explorer.exe 3420 explorer.exe 3420 explorer.exe 3420 explorer.exe 3420 explorer.exe 3420 explorer.exe - Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 3068 msiexec.exe 2380 msiexec.exe 3580 MsiExec.exe 3144 MsiExec.exe 4044 MsiExec.exe 3800 StartMenuExperienceHost.exe 2552 SearchHost.exe 3420 explorer.exe - Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 4928 wrote to memory of 3068 4928 ScreenConnect.ClientSetup.exe 88 PID 2380 wrote to memory of 3580 2380 msiexec.exe 90 PID 3580 wrote to memory of 3712 3580 MsiExec.exe 91 PID 3580 wrote to memory of 2012 3580 MsiExec.exe 92 PID 3580 wrote to memory of 4664 3580 MsiExec.exe 93 PID 2380 wrote to memory of 1144 2380 msiexec.exe 99 PID 2380 wrote to memory of 3144 2380 msiexec.exe 101 PID 2380 wrote to memory of 4044 2380 msiexec.exe 102 PID 4268 wrote to memory of 2984 4268 ScreenConnect.ClientService.exe 109 PID 4268 wrote to memory of 1304 4268 ScreenConnect.ClientService.exe 110 PID 4020 wrote to memory of 3420 4020 sihost.exe 124 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ScreenConnect.ClientSetup.exe"C:\Users\Admin\AppData\Local\Temp\ScreenConnect.ClientSetup.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\26.6.6.9747\b84d28617c3984ca\ScreenConnect.ClientSetup.msi" SC_EXE_PATH="C:\Users\Admin\AppData\Local\Temp\ScreenConnect.ClientSetup.exe"2⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3068
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Boot or Logon Autostart Execution: Authentication Package
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding C655474367D40F264327ECBD44AFECA6 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3580 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI1BF5.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240786718 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3712
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI202D.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240788093 11 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.CheckMsiMotw3⤵
- Badlisted process makes network request
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:2012
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI2A6F.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240790453 18 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.CheckMsiFileName3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4664
-
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:1144
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 083EEC26F5E47CC7219C482AB8C417BE2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3144
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 986DF84C90527D1BF6E91DFC56AD58C1 E Global\MSI00002⤵
- Drops file in Windows directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4044
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:1008
-
C:\Program Files (x86)\ScreenConnect Client (b84d28617c3984ca)\ScreenConnect.ClientService.exe"C:\Program Files (x86)\ScreenConnect Client (b84d28617c3984ca)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=instance-szc6yp-relay.screenconnect.com&p=443&s=6dbce467-13e3-49b3-858c-02fdd3166dbe&k=BgIAAACkAABSU0ExAAgAAAEAAQCdgBUqDr355ZP0h0vdmA%2fviyLxCFC62i9NqY3zs7%2bTqN7y%2fm%2b52NvDTr1uHD2XVj9Zw4g5YMbAz7K%2fYhD1zIF%2bHwL92%2bYCVx7lsdd3ftSaSWWqaTLHDTqahB2TEkPEFC1NXqOphUuhr7ojo48sLKnXLrkOW7CRbVkHjOPPE4eg4nyIaUUiAhOltpOZ2a89we1VG50kVqayA%2bxUcJ%2fsmq4dlBQJWXhqdHCCGzDxTS9OggvKSKMZkSQzReueNvJpu2kZqg1Fb9qJ4eCYKnwdewPUkkCbpynFEbw1AhnSO6%2fwefg06iBw4UIvU39Q5KsU0aZnFx0A8I%2b8spSIuYXetZKh&c=neww%20invite%20page&c=&c=&c=&c=&c=&c=&c="1⤵
- Sets service image path in registry
- Drops file in System32 directory
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Program Files (x86)\ScreenConnect Client (b84d28617c3984ca)\ScreenConnect.WindowsClient.exe"C:\Program Files (x86)\ScreenConnect Client (b84d28617c3984ca)\ScreenConnect.WindowsClient.exe" "RunRole" "bb1a6f6f-0133-4d2a-82dd-ca33bb0ad04e" "User"2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2984
-
-
C:\Program Files (x86)\ScreenConnect Client (b84d28617c3984ca)\ScreenConnect.WindowsClient.exe"C:\Program Files (x86)\ScreenConnect Client (b84d28617c3984ca)\ScreenConnect.WindowsClient.exe" "RunRole" "c95ad0f9-4977-4033-970a-cde0fbf4e75a" "System"2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Modifies data under HKEY_USERS
PID:1304
-
-
C:\Program Files (x86)\ScreenConnect Client (b84d28617c3984ca)\ScreenConnect.ClientService.exe"C:\Program Files (x86)\ScreenConnect Client (b84d28617c3984ca)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=instance-szc6yp-relay.screenconnect.com&p=443&s=6dbce467-13e3-49b3-858c-02fdd3166dbe&k=BgIAAACkAABSU0ExAAgAAAEAAQCdgBUqDr355ZP0h0vdmAfviyLxCFC62i9NqY3zs7bTqN7yfmb52NvDTr1uHD2XVj9Zw4g5YMbAz7KfYhD1zIFbHwL92bYCVx7lsdd3ftSaSWWqaTLHDTqahB2TEkPEFC1NXqOphUuhr7ojo48sLKnXLrkOW7CRbVkHjOPPE4eg4nyIaUUiAhOltpOZ2a89we1VG50kVqayAbxUcJfsmq4dlBQJWXhqdHCCGzDxTS9OggvKSKMZkSQzReueNvJpu2kZqg1Fb9qJ4eCYKnwdewPUkkCbpynFEbw1AhnSO6fwefg06iBw4UIvU39Q5KsU0aZnFx0A8Ib8spSIuYXetZKh&c=neww0invite0page&c=&c=&c=&c=&c=&c=&c="1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2544 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2544 -s 13082⤵
- Program crash
PID:3316
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2544 -ip 25441⤵PID:5276
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:3204
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4020 -
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3420
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2552
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3800
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵PID:1528
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Authentication Package
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Authentication Package
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Component Object Model Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e5a86d6.rbs
- Size 214KB
- SHA256 c4605df0f21382e4069652fc9bcce011ad7ef80de21c20a10661fddaa8df68fd
- MD5 accbae74ff82e5ce10efebeb77397a6a
- SHA1 4ac2d98c750028b684677a20088960ad9873e079
- SHA512 838354fc2ba156da42d57e07d5ba941461d3a44c8f3dbdbd3dc1ba60d00511aaeba2226ab9326c4e64a0736ebe754aa14a549928e329c83f26f34e67ba6a408f
- SSDEEP 3072:bA9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMGV:bAuH2aCGw1ST1wQLdqvV
- TLSH T1D1248C227480807EE7FA1A32D93F9A61BE7DF6241760C59EC3848C1E5D604D06BF6B67
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (b84d28617c3984ca)\ScreenConnect.Client.dll
- Size 615KB
- SHA256 787a02b1938e8c1ce52448b8779d2c9c47029664f97185177c2584e8f980abc4
- MD5 149a7707446fdcf50836db69b917d602
- SHA1 d27de72fe7d69335597dd9f00df008c15dc3b03d
- SHA512 b768682ca47a070028a0abec11b401830ee97ec978fe6cb69544930d91f109fb615c05dbadc5e1bb0789ca2363d77189f84a08f186d8374b94d18d995962dfb8
- SSDEEP 12288:UkkXZravRRa5nmDPzHTEavSW7OQniuHJ2eh:0XrQDbzEn8quHZh
- TLSH T136D4D14DB7919A1DED1E0B33E6902350EBB16CCA9883E32F2C68767D1E723C5658D1D2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (b84d28617c3984ca)\ScreenConnect.ClientService.dll
- Size 176KB
- SHA256 579fa008b8c96612163fd8a89a978140a652b3739867772df0711fca148705aa
- MD5 7eeb9a886eea2fc5550942f0dc0aacb8
- SHA1 a9449ca9a4982be5ab5010f181328d13d00c0215
- SHA512 0406959756206affcde7e44b689e6ff0278330d7ae90433c32a17f05f778625e37b0908e56e25b47ba0a08cb338918affea298c9a53cfb765811a658076006d7
- SSDEEP 3072:QRqGKbTNcBswQmqPYGi0raTb7pD/leN6Qa2ICpy4QOVD6W0XtZR8H:QRNKbBgtcY6raTb7FNQawf6W0u
- TLSH T1C404AE497B99D526D49E0E32B851B3204FF1B0A2C9E6C78F6D9832EB1E167C16F442CD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (b84d28617c3984ca)\ScreenConnect.ClientService.exe
- Size 93KB
- SHA256 d887f20ec383d7ce3a5727856bf7fa68ceb972108b6d0a5dd9924707e820dc24
- MD5 794a92f5abba00c91b2b0c6e55bd1ec4
- SHA1 dc253d76c2349971fdf1f5fc8ef5af25a621c5ff
- SHA512 55223912e1dfe85af33a1d1d28fa0dcc93495324d4834b0416b836f7241c18296a9f55791d9794d909cdd845bfc863f10b89b55a095cb26698f234f62398e656
- SSDEEP 1536:Jg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgoU0HMC7N0:qhbNDxZGXfdHrX7rAc6myJkgoU0Hjx0
- TLSH T1DD935B13B5C28872D573093158A0DAB09A7FF9615E61DEEB3788022E4F341C1AE75EB7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (b84d28617c3984ca)\ScreenConnect.Core.dll
- Size 1.3MB
- SHA256 5b2d14e237485c0164d865d8a94f8a8bed28ab0db52c6a7ef99f7ebb9648d324
- MD5 ec05dfb0dceee252de12c22b68ebbfa5
- SHA1 720000e4bd6fb9dd64c55da607c2a5cebb052c7d
- SHA512 236cfecc032c3bf8aaa9804b817f901b0d79decc516e6df5b749dd65c2e8945bbd346957f16f68b642932d68ec4f3daea55e2b3ce2f9581604788a8b6f8a1fc0
- SSDEEP 24576:kpIxpRkVYVdqvM2Dj5AmhstUJQf72OmswiC6EHspN6TSZsyPX3UO:EIxpW9j5bhUp2sEH4HPnUO
- TLSH T126558E4ABFC6AB17CD7D0633586163005BB0D0909AA7D75F39B8A73D5D863C82E881ED
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (b84d28617c3984ca)\ScreenConnect.Windows.dll
- Size 1.9MB
- SHA256 88dd22f6f0ca70d10c64ca919b0d8b6d73e84c1d567d4b8d15b6e9a9b60d6d8f
- MD5 5a583d792741dc86740248508bca1f48
- SHA1 85ff8c972fad01e29044f014e680a30658e83acc
- SHA512 a4ff0c9bb808ac1dd8f26f77bc60fcc01e8a1bd474628f3dd6563f048fb159fdf0e6e61c6a4a46de9573cf1f4134cc1b723c265950cf39b67202ae59bc86e86a
- SSDEEP 24576:v5wRfUFj+Ifz3zvnXj/zXzvAAkGz8mvgt379S+2bfR+RfmTk1krT1iH4SqfKPTsz:vsUJkGYYZTk+T1iH7efPDpB
- TLSH T1F995AE45F6C365F6D42F047888BE632AB6743C040315CAFB97D4AA3A6D33BC09A36795
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (b84d28617c3984ca)\app.config
- Size 1KB
- SHA256 db9839578d5b4f782ed5a6fed51596f356fec000d4c6ac411b5390e18338f1ce
- MD5 1acac15129c920e591caacc3789234b4
- SHA1 f9f6f5579c4f89db084df64cd3833f312d6c8067
- SHA512 da0636b1fb42b628de3d3f09ae547b26216b8020b55fc5b06d14eef4e0eb1672f5dc1967e61e3f897de4433f83e4e21dc18bf286dfa7321aa9af87cf8ce5e743
- TLSH T12E21921974C0AF5916B36636E63102D1EC7049631266A0E478EE31779F30BC947F32EA
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (b84d28617c3984ca)\system.config
- Size 966B
- SHA256 ec04701675be1a60152b975bad15569d505889c12bf62c0e477256487956df87
- MD5 f9dc8e23025e84882786e1b01aa46cb0
- SHA1 df658a3fd68e79378094e2ad51d0e5ace0a19f34
- SHA512 0aa0e546b238a4ff9443ca6348191227a3f97ad006a00a5d76c8e4be0a0c5c4cd8111587d4255093afcc8bb0d2d3fe9937fa9109f9ba289eac73b7178c0895cc
- TLSH T18111046135C47E8A17A33D33C8048744DE72175E15491094789F52BF6B716DF07A39FA
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
- Size 607B
- SHA256 be6b74e52e5eef1f1c27c0976bf3bf1bfa99958c00bbef2898a602f691be6dae
- MD5 76b78ed7ff6273215b134d6a6488035d
- SHA1 9e7a11ffb68d027036302eccd4c22315054843a9
- SHA512 9919504cd4d8c0757abff8da4bbad1c4b6532f81d290c736fc5624ef66de45e6a9e29a8290854ae554d5bdfc5291f1ea81ae62d1b25846bfbcf1515e2ec3e4f1
- TLSH T174F0DC53CBD6536BD527223CC8E207E1FA70E2719E81212386106F2D6CB77241E474B4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI1BF5.tmp
- Size 1.9MB
- SHA256 1dabfa60015c186a4315f16d46d9e53435dc259c52843e73dac0d04be92f9a84
- MD5 efa3cd7e5bdd04fe37a130e51fdf950c
- SHA1 bce97de0f0a7c985c3a29db0b7dfe734470a6d0c
- SHA512 04a3f21ffd6e01c1b215d7378527d2d51b9c76faa8960e32da3bf06bf54aafa71dbf607745d77f2c9f198355d7d9c05806f7d8fe09d6bdbf60dccc1dc88d75e6
- SSDEEP 49152:CGItINWG7/6NfA3BF5h/rvK7e4devyryUpEHLM:CGUQHUI3rK7eyevZUpEHI
- TLSH T18995236037FD9574D6E63B312AA889A412FFB0317674C38866841AAD0FF1F85DB60367
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI1BF5.tmp-\Microsoft.Deployment.WindowsInstaller.dll
- Size 172KB
- SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
- MD5 5ef88919012e4a3d8a1e2955dc8c8d81
- SHA1 c0cfb830b8f1d990e3836e0bcc786e7972c9ed62
- SHA512 4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684
- SSDEEP 3072:FkfZS7FUguxN+77b1W5GR69UgoCaf8TpCnfKlRUjW01Ky4:x+c7b1W4R6joxfQE
- TLSH T14E045B2563FC473ECAEF87B4E2624251E7B2E2E97113DB0DDC8541AA2522780F792753
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI1BF5.tmp-\ScreenConnect.Core.dll
- Size 1.3MB
- SHA256 e5fd82d18c2dcaadbfc4b72b56573e819cc3e8ee6406f2edb982cc073dc607bb
- MD5 9e220b9cd7ecb714c101c2b07a039b8a
- SHA1 23aee367b77a5da5ff356df0f998deec625d25d6
- SHA512 73ac4fe50fbbf1ce8dd6907161ce0f17fdb13af8de773a1999e9768312f63223683badc0542fb5f68113367f617aa8552de95f6b812adf7898edacf68feaa824
- SSDEEP 24576:OpIxpRkVYVdqvM2Dj5AmhstUJQf72OmswiC6EHspN6TSZsyPX3U:qIxpW9j5bhUp2sEH4HPnU
- TLSH T125558E4ABFC6AB17CD7D0633586163005BB0D0909AA7D71F39B8A73D5D863D82E881ED
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI1BF5.tmp-\ScreenConnect.InstallerActions.dll
- Size 24KB
- SHA256 cf8505204b1458dac9cb3002fd5bbd5fac43c5b4702aa0153fb4b9a2cfcf954a
- MD5 c060e1dcf5402d3bda57c00fa2fd56fb
- SHA1 45b319fe4fdb0d546368487c758ac4a0c60737c5
- SHA512 4941965012aa81ac02c1bc161d6e3f4aad195a8bc47094afdd192252478eb530bba744ab4f8d615fcb867fe1a8bc91623dfb1ad70491d83e2ff05aaa25dfe5a4
- SSDEEP 384:cSazzV1VTsaS8hQlLkmoAAV7NaNeirM0dbMsFkjvZBN20dN5:hazC9AVMcLv/d
- TLSH T126B2E720674CE27AF9EA1634B563FBB011B3BDB3CCE9DA8565A420153D253E04FB5B06
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI1BF5.tmp-\ScreenConnect.Windows.dll
- Size 1.8MB
- SHA256 ed1b4eb6c24c85392f692bf5863d9ccb76575051bb605360961b9d7624a371c6
- MD5 58aa4d11a9e686a21fcd5cf8f29141bb
- SHA1 20710c94635ff8184ab7779aeb572d73dd39bc2a
- SHA512 801b4ddd92ca2071e3f21c3bbdfadc8a5e2bf01a0428cda3b656cefe4f854b4d5618e2c060e5a90e2985febb404cbc8adf5b4e56c377f5b31407c9f47d2e09f0
- SSDEEP 24576:n5wRfUFj+Ifz3zvnXj/zXzvAAkGz8mvgt379S+2bfR+RfmTk1krT1iH4SqfKPTsF:nsUJkGYYZTk+T1iH7efPDp
- TLSH T1AB95AD45F6C365F6D42F047888BE632AB6743C040315CAFB97D4AA3A6D33BC09A36795
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI202D.tmp-\CustomAction.config
- Size 234B
- SHA256 7027b69ab6ebc9f3f7d2f6c800793fde2a057b76010d8cfd831cf440371b2b23
- MD5 6f52ebea639fd7cefca18d9e5272463e
- SHA1 b5e8387c2eb20dd37df8f4a3b9b0e875fa5415e3
- SHA512 b5960066430ed40383d39365eadb3688cadadfeca382404924024c908e32c670afabd37ab41ff9e6ac97491a5eb8b55367d7199002bf8569cf545434ab2f271a
- TLSH T18CD0A70405D0FD1B5E231A2337524559FF34B1E290A44408B06F3A130A220CD4757317
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI202D.tmp-\ScreenConnect.WindowsInstaller.dll
- Size 390KB
- SHA256 c469358d585fa9f1637a02d194e162e454d90b8dc7e4939f88b36e09b04a7a96
- MD5 36c8faf3c581775494a6da38ef9dd60e
- SHA1 2f3d1a846ca64c1bd920af00a77dee6e40aed4ec
- SHA512 0574311206d6aa6d0366fa1279e2f1bc0efacafbf6730b60410d038db7d8f36f82ad797f15896a03ad3cbe33645ea57343acef9e2d00880d6a1f67c63b7c0c65
- SSDEEP 6144:zvB99Oa9QoYB9au52um2kJ1BqJW71/DSirthZcyqzYWHOU5J/vz5v6qG:v9ZGo09p5fi1B/ReotAb7/vp
- TLSH T1C7849D2CBF5EB716EA1E0B73C065B200A7F0A0E3599BC35F6D85257D6C04BD42BA52C6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ScreenConnect\26.6.6.9747\b84d28617c3984ca\ScreenConnect.ClientSetup.msi
- Size 19.6MB
- SHA256 decef834adcd2e009ad5649a350bd68287dbbeef18b8bcd19692a4fcdf51b74c
- MD5 62f09638b1b7aa147b0f88c0dd7a747e
- SHA1 664854e734525f69e2bb837f962c2efb0425a899
- SHA512 ba64c9e57d923154f64051b0b451d036a221ba3ca64671fe9ab7c4e1a1e73cacab7b8e370d623865a0dfb1aecb3b3bb4c3c3f6e9375b53197393078c9baec53e
- SSDEEP 393216:+6ohU+8bjJ8JQj9ySZ8Ed6ohU+8bjJ8o6ohU+8bjJ816ohU+8bjJ876ohU+8bjJ8:5oh0bjn9ySZzUoh0bj+oh0bjVoh0bj1l
- TLSH T1742733211BF8D855EAB30B75FA7787B44637BC51B911A05F13A03A0D1A32E829E93377
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI8F90.tmp
- Size 202KB
- SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
- MD5 ba84dd4e0c1408828ccc1de09f585eda
- SHA1 e8e10065d479f8f591b9885ea8487bc673301298
- SHA512 7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290
- SSDEEP 3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
- TLSH T129147C326494803EE7F91A36D93E9A61AE7DF6241760C99EC3848C0E5D604D06BF7B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (b84d28617c3984ca)\fqa5345v.newcfg
- Size 683B
- SHA256 14b15dfeffea3766763340d8154ba4834d9305e5c397ab73c62059f08a546368
- MD5 840fa51bdefc58b0be08b53d4ae45e1d
- SHA1 260173d0df54d615292910dd816f79f95a36ae49
- SHA512 7c4f6d529f966b6e7e3588334035f60c5f275cb971776e5c23f010b52e1961e02995b121dadc6a7cdde2b3e470c708c84b09a77c156592d488a6b693e896815c
- TLSH T13C01F4A971C0AE5A02B76A32D9218345FE715A5B066520D874AE223B5F305CB07E36DB
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (b84d28617c3984ca)\qous3xuh.newcfg
- Size 881B
- SHA256 079914a16319c62c59d304093bb1a11aa34158c5c65429a222825816cf4b057b
- MD5 592ffd3f7bdfe3606cbd19301fcdd1a8
- SHA1 af6201d76fb3dcc998ca43abc8a3197090573284
- SHA512 326a774b16fc6568697407ce6281cd438c8966903382fa7565366a33b1f5321b684674bc579cab7a42f56bc82f3fde5bfda91c160baaec665a0b710ad49dd9e3
- TLSH T10811495871C0AF5A07B72932D9315385FDB11A5B016520E434AE21375F309DF07E36EB
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (b84d28617c3984ca)\user.config
- Size 520B
- SHA256 5293af1d5b2d1b8fe95f4d04a8350c36a4b134f41bcf0465605574a4c81973a4
- MD5 2cf7fa5d75c708db8db32fda0284e3c0
- SHA1 9523865071cb550db58c4d84c7db15c1dd0a3d85
- SHA512 e0dbe5c029bdf66a91c4fa6f89b55253611d5946907261d2c76a946930b7c9c1c02060f77190bf4416ecb3bc6a985e9550022842786d0ae7558a5e847c3a1643
- TLSH T104F0E2A531806E5B03A36E23C5128745EE726B9B0561209878AF223B9F315CE07A32CF
- MD5 SHA1 SHA512 TLSH