7e530a959a5d576f8c119f5801df3311c3fdafa9504a2d1e374d2b4c45298d45

Analysis

max time kernel
38s
max time network
40s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
20/04/2026, 12:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7e530a959a5d576f8c119f5801df3311c3fdafa9504a2d1e374d2b4c45298d45.exe
Size 305KB
Sample260420-psafbsav4m
SHA256 7e530a959a5d576f8c119f5801df3311c3fdafa9504a2d1e374d2b4c45298d45
MD5 2f8af02b096c3c75684861d0ef3c62cc
SHA1 a73a39faa2e970e5d6c1efe0d559e2b4b06e20a5
SHA512 dda5bde64004fb14c08d1b3e56fa323b4229a554db68019d396f72b7e4d6882adfb938eef3915c7ce106fc73d0bef4da62940f7812517ff3eb227341e60d4fd8
SSDEEP 6144:KmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFti9y:51iw7gryNkSV1hy1Z1u2JLI9
TLSH
T19E646C11B9C48432C673383107B4E2B28DBDB8302D655B9F57A81D7A9F741D0EA29B6F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery spyware trojan

Malware Config

Signatures

Downloads MZ/PE file 7 IoCs

flow	pid	Process
2	1108	dfsvc.exe
2	1108	dfsvc.exe
2	1108	dfsvc.exe
2	1108	dfsvc.exe
2	1108	dfsvc.exe
2	1108	dfsvc.exe
2	1108	dfsvc.exe

Manipulates Digital Signatures 1 TTPs 2 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C\Blob = 0300000001000000140000007b0f360b775f76c94a12ca48445aa2d2a875701c2000000001000000b4060000308206b030820498a003020102021008ad40b260d29c4c9f5ecda9bd93aed9300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3231303432393030303030305a170d3336303432383233353935395a3069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e6720525341343039362053484133383420323032312043413130820222300d06092a864886f70d01010105000382020f003082020a0282020100d5b42f42d028ad78b75dd539591bb18842f5338ceb3d819770c5bbc48526309fa48e68d85cf5eb342407e14b4fd37843f417d71edaf9d2d5671a524f0ea157fc8899c191cc81033e4d702464b38de2087d347d4c8057126b439a99f2c53b1ff2efcb475a13a64cb3012025f310d38bb2fb08f08ae09d09c065a7fa98804935873d5119e8902178452ea19f2ce118c21accc5ee93497042328ffbc6ea1cf3656891a24d4c8211485268de10bd14575de8181365c57fb24f852c48a4568435d6f92e9caa0015d137fe1a0694c27cc8ea1b32e6cac2f4a7a3030e74a5af39b6ab6012e3e8d6b9f731e1dcade418a0d8c1234747b3a10f6ea3ab6d9806831bb76a672dd2bd441a9210818fb03b09d7c79b325ac2ff6a60548b49c193ede1b45ce06feb26f98cd5b2f93810e6eace91f5bed3fb6f9361345cbc93452883362a66285fb073ce8b262506b283d45cf615194ced62e05e33f2e8e8ec0aa7b0032b91b23679bef7ad081e75a665ccbbe34850f377911afedb50a246c8615898f57c02163c8328ad3986ecd4b70d53d0f847e675308dec30937614a65b4b5d74614d3f129176debf58cb72102941f0d5c56d267668114113589adc262b01f4894d59db78cf814a3e40475fc98150738510232159608a6454c1cc211ae838197c661ccd78384530994fff634f4cbbaa0d0853417c583d47b3fab6ec8c320902cc6c3c0c56110203010001a38201593082015530120603551d130101ff040830060101ff020100301d0603551d0e041604146837e0ebb63bf85f1186fbfe617b088865f44e42301f0603551d23041830168014ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300e0603551d0f0101ff04040302018630130603551d25040c300a06082b06010505070303307706082b06010505070101046b3069302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304106082b060105050730028635687474703a2f2f636163657274732e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63727430430603551d1f043c303a3038a036a0348632687474703a2f2f63726c332e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63726c301c0603551d20041530133007060567810c01033008060667810c010401300d06092a864886f70d01010c050003820201003a23443d8d0876ee8fbc3a99d356e0021aa5f84834f32cb6e67466f79472b100caaf6c302713129e90449f4bfd9ea37c26d537bc3a5d486d95d53f49f427bb16814550fd9cbdb685e0767e3771cb22f75aaa90cff5936ae3eb20d1d55079889a8a8ac1b6bda148187edcd8801a111918cd61998156f6c9e376e7c4e41b5f43f83e94ff76393d9ed499cf4add28eb5f26a1955848d51afed7273ffd90d17686dd1cb0605cf30da8eee089a1bd39e1384eda6ebb369dfbe521535ac3cae96af1a23edb43b833c84f38149299f5ddce546dd95d02141f40337c03e295b2c221757352cb46d8c4341ca2a54b8dcd6f76372c853f1ace26e918be9007b0437f9588208270f0cccaeffd29355c1f893855f7378a8b09a1cb0be9311aff2e195c3971e1be9ca70a06d62667b792e64e5fde7aac49cf2ea47492addb3ca49c861fe3c1561b2b23ff8fb5ea887b706be6a0bafd3a3f45a6c4e81691528b41c048844b964dab4440e38df01528ceedf11856072a2f10c40c08643c338fae288c3ccb8f880b0dbf3bf4ce1e7b8eefb5ebcbb7f07713e6e7283fac12aea52f226c41f9825c1566cc6c0ecac586c3f626330c074ba0d307026a6a4030484b34a85120bbad1b8508e2590d6dca05502bea4a1c9ea5fda0a71f0674e7f2d65290fdaf854821f9573bb49c03ed8645f4b4616ebf68e2266086eac8afa9fe941de7631b3a8656784e	7e530a959a5d576f8c119f5801df3311c3fdafa9504a2d1e374d2b4c45298d45.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\FF8BFAFA697459874FB9843B1EFDA5C91871A44C\Blob = 030000000100000014000000ff8bfafa697459874fb9843b1efda5c91871a44c2000000001000000640700003082076030820548a00302010202100fc890218ebc1b3c4b8521f655979371300d06092a864886f70d01010b05003069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e67205253413430393620534841333834203230323120434131301e170d3232303731333030303030305a170d3235303731323233353935395a3065310b30090603550406130255533110300e06035504081307466c6f72696461310e300c0603550407130554616d706131193017060355040a1310436f6e6e656374776973652c204c4c433119301706035504031310436f6e6e656374776973652c204c4c4330820222300d06092a864886f70d01010105000382020f003082020a0282020100da5d7b6eb44d5d8c63f7c47c18a1bf98759158e061191810be4001b75443bd96e1de68459fd72f7fe20abcdab9d10541d5b333a191c8694e70eadeb590a46fbacc4bf1e580e3d49900107f31a44bb0761c26e95f32d3d2076fc1ce1550fcc9b80d3a9e126cf948f5d78907f82795bd1c5437f87f582a9cfa3c9adfb079d3af1b267a35c2fed12b99aa072db1a974d8b3704831f91c07c343f8bdfe52a88a5a9ba1ce87a957eed596ea5af8dc2821f8970898355d467621f188cda371cbf194625ac45e7682afc4a7687dfdf58fa12f67da9f8868f8f1bbafaa5455922fce755cceeee2c4caa8c74350420396f445e5b8e2340ddca227ce4846a787150ff50b982a02fac5722e2630da9e7f4f11f61d46c4a3a741834de00ba96fe8d0eec53b8d7332fc8567d59dae58c9da2b4cd394391f1a35c075ce76e4f58118f42cffd0f9d097d86e6e40e7174583b89ea38de2885b9aeed147efa57ddc17ad421b2c9323575a9e0194576825aed3b586a072b2f4dc6194a5566976865079ac988b1c0cadfd10851be62b1f79cad6a937f874eab8cb3651e29e862d5cafe9d1b42a83f335d2aba6ec4ef9d9aa115a069c24916d645de415844dc365c616628665ba45d57e5a4e9ac0a5b414e8833ed77e4591647937e6f496d5cb708e29e3ca60ed81d594c9954186e08e7dbf3555f0a0a4e56625b4dfdc46577d88321b4719cc21b0a7ad0203010001a382020630820202301f0603551d230418301680146837e0ebb63bf85f1186fbfe617b088865f44e42301d0603551d0e04160414294f9bff00edb7d66b2218307d77a83f5c2b0d85300e0603551d0f0101ff04040302078030130603551d25040c300a06082b060105050703033081b50603551d1f0481ad3081aa3053a051a04f864d687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c3053a051a04f864d687474703a2f2f63726c342e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c303e0603551d20043730353033060667810c0104013029302706082b06010505070201161b687474703a2f2f7777772e64696769636572742e636f6d2f43505330819406082b06010505070101048187308184302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d305c06082b060105050730028650687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e637274300c0603551d130101ff04023000300d06092a864886f70d01010b050003820201004e334e35453d2ec365082bd7e988392596a078b66cc91a7d52995886d9d2ef5eb1160e611ab54b00704e0cd7fdf1271871d56584ce06413b96e26d0396eb657cbbd5c12039d0130d52e31d1a7a186ca20878378c832655db9af8fc8e0672ca942d35fd13ee8803a7a747a502ff39ce8bbb6b054d78be49edb5a70f7c5c9a0edf3a6a7e3de78ac01b08a05198c6a4ccd6443ced8f4d9a65a23e67b09a93afe01c2e3f3d90581cf5138f931a3af8a15f27ce1a515a1a47f177392d6d3729bc62ce606793d202b89ff88531f035675680e405b49414971bf9f36528c1c44ed17ced9dee353c14465719a0391e3197d851df01ae8e36cb7918a26ca2eec0da555c4fa072f05a7ee59382e093a4edd2698645c04a17a3903ca9fdab62e033fec0f8653dd193b9050a78b0e1101b73ce2caf73a677373783d2a1ee3ce794055e0535ac1edc9eb133e043d16cb6f811f2d7cc855f098673920d0948c2f93a705eea762ca78afd8d4b47a5f4f5ec02b34d77defbbe7e854b50b26182dc05ba265fe3bde3fbd6a12f2aa9656d39361d93425789714323d74ffef6347a5ae3e44a6322d76e604bf759bee5f7a8023d55a2356fd9ed1041d584fed8c27697369a1be159c96722b21a92a6c4d9d17dac189b047538f099b1a3d1ef72882f0e09a767d622f371976cd4b95e6357c2c7b97499b81f04607c9fe72a0bd13f1c899107531d4785b7	7e530a959a5d576f8c119f5801df3311c3fdafa9504a2d1e374d2b4c45298d45.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\54JJXWEC.1P3\Y8BQNDD5.K2N\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7e530a959a5d576f8c119f5801df3311c3fdafa9504a2d1e374d2b4c45298d45.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_6acd6157af9d4abe_0019.0003_none_3b99cdd24116687d\Files\ScreenConnect.WindowsFileManager.exe.conf = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_6acd6157af9d4abe_0019.0003_2a7979a74537f033\scre..dows_4b14c015c87c1ad8_0019.0003_none_465eba246 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_6acd6157af9d4abe_0019.0003_2a7979a74537f033\scre..core_4b14c015c87c1ad8_0019.0003_none_41e6e2432	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications\scre..tion_6acd6157af9d4abe_0019.0003_2a7979a74537f033\PreparedForExecution = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0019.0003_none_a32dbb670e6536fe\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742c2056657273696f6e3d32352e332e342e393238382c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_6acd6157af9d4abe_0019.0003_615fae6aa1e194b0	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_6acd6157af9d4abe_0019.0003_none_3b99cdd24116687d\Files\ScreenConnect.WindowsClient.exe.config_f7 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\F_scre..tion_6acd6157af9d4abe_6e521f6d9f90a6ed	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_6acd6157af9d4 = 54007200750065000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0019.0003_none_d7fc401534d0a9f5\identity = 53637265656e436f6e6e6563742e436c69656e742c2056657273696f6e3d32352e332e342e393238382c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0019.0003_none_a32dbb670e6536fe	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_6acd6157af9d4abe_0019.0003_615fae6aa1e194b0\scre...exe_6acd6157af9d4abe_0019.0003_none_3b99cdd24	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_6acd6157af9d4abe_0019.0003_none_3b99cdd24116687d\Files\ScreenConnect.WindowsBackstageShell.exe.c = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_6acd6157af9d4abe_0019.0003_2a7979a74537f033\appid = 68747470733a2f2f64777373612e746f702f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e332e342e393238382c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d366163643631353761663964346162652c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32352e332e342e393238382c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d366163643631353761663964346162652c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_6acd6157af9d4abe_0019.0003_2a7979a74537f033	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}\scre..tion_6acd6157af9d4 = 68747470733a2f2f64777373612e746f702f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e332e342e393238382c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d366163643631353761663964346162652c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}\scre..tion_6acd6157af9d4 = 3c004100700070006c00690063006100740069006f006e00540072007500730074002000760065007200730069006f006e003d002200310022000d000a00460075006c006c004e0061006d0065003d002200680074007400700073003a002f002f00640077007300730061002e0074006f0070002f00420069006e002f00530063007200650065006e0043006f006e006e006500630074002e0043006c00690065006e0074002e006100700070006c00690063006100740069006f006e002300530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f007700730043006c00690065006e0074002e006100700070006c00690063006100740069006f006e002c002000560065007200730069006f006e003d00320035002e0033002e0034002e0039003200380038002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d0036006100630064003600310035003700610066003900640034006100620065002c002000700072006f0063006500730073006f0072004100720063006800690074006500630074007500720065003d006d00730069006c002f00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f007700730043006c00690065006e0074002e006500780065002c002000560065007200730069006f006e003d00320035002e0033002e0034002e0039003200380038002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d0036006100630064003600310035003700610066003900640034006100620065002c002000700072006f0063006500730073006f0072004100720063006800690074006500630074007500720065003d006d00730069006c002c00200074007900700065003d00770069006e003300320022000d000a00540072007500730074006500640054006f00520075006e003d002200740072007500650022000d000a0050006500720073006900730074003d002200740072007500650022003e000d000a003c00440065006600610075006c0074004700720061006e0074003e000d000a003c0050006f006c00690063007900530074006100740065006d0065006e0074002000760065007200730069006f006e003d002200310022003e000d000a003c005000650072006d0069007300730069006f006e00530065007400200063006c006100730073003d002200530079007300740065006d002e00530065006300750072006900740079002e005000650072006d0069007300730069006f006e0053006500740022000d000a00760065007200730069006f006e003d002200310022000d000a00490044003d00220043007500730074006f006d0022000d000a00530061006d00650053006900740065003d002200730069007400650022000d000a0055006e0072006500730074007200690063007400650064003d002200740072007500650022000d000a0078006d006c006e0073003a00610073006d00760031003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a00610073006d002e007600310022000d000a0078006d006c006e0073003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a00610073006d002e007600320022000d000a0078006d006c006e0073003a00610073006d00760032003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a00610073006d002e007600320022000d000a0078006d006c006e0073003a007800730069003d00220068007400740070003a002f002f007700770077002e00770033002e006f00720067002f0032003000300031002f0058004d004c0053006300680065006d0061002d0069006e007300740061006e006300650022000d000a0078006d006c006e0073003a0063006f002e00760031003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a0063006c00690063006b006f006e00630065002e007600310022000d000a0078006d006c006e0073003a00610073006d00760033003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a00610073006d002e007600330022000d000a0078006d006c006e0073003a0064007300690067003d00220068007400740070003a002f002f007700770077002e00770033002e006f00720067002f0032003000300030002f00300039002f0078006d006c006400730069006700230022000d000a0078006d006c006e0073003a0063006f002e00760032003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a0063006c00690063006b006f006e00630065002e007600320022003e000d000a003c0049005000650072006d0069007300730069006f006e00200063006c006100730073003d002200530079007300740065006d002e004e00650074002e005700650062005000650072006d0069007300730069006f006e002c002000530079007300740065006d002c002000560065007200730069006f006e003d0032002e0030002e0030002e0030002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d00620037003700610035006300350036003100390033003400650030003800390022000d000a00760065007200730069006f006e003d002200310022003e000d000a003c0043006f006e006e006500630074004100630063006500730073003e000d000a003c0055005200490020007500720069003d00220028006800740074007000730029003a002f002f00640077007300730061005c002e0074006f0070002f002e002a0022002f003e000d000a003c002f0043006f006e006e006500630074004100630063006500730073003e000d000a003c002f0049005000650072006d0069007300730069006f006e003e000d000a003c002f005000650072006d0069007300730069006f006e005300650074003e000d000a003c002f0050006f006c00690063007900530074006100740065006d0065006e0074003e000d000a003c002f00440065006600610075006c0074004700720061006e0074003e000d000a003c004500780074007200610049006e0066006f00200044006100740061003d00220030003000300031003000300030003000300030004600460046004600460046004600460030003100300030003000300030003000300030003000300030003000300030003000430030003200300030003000300030003000350037003500330037003900370033003700340036003500360044003200450035003700360039003600450036003400360046003700370037003300320045003400360036004600370032003600440037003300320043003200300035003600360035003700320037003300360039003600460036004500330044003300340032004500330030003200450033003000320045003300300032004300320030003400330037003500360043003700340037003500370032003600350033004400360045003600350037003500370034003700320036003100360043003200430032003000350030003700350036003200360043003600390036003300340042003600350037003900350034003600460036004200360035003600450033004400360032003300370033003700360031003300350036003300330035003300360033003100330039003300330033003400360035003300300033003800330039003000350030003100300030003000300030003000330030003500330037003900370033003700340036003500360044003200450035003300360035003600330037003500370032003600390037003400370039003200450035003000360046003600430036003900360033003700390032004500340031003700300037003000360043003600390036003300360031003700340036003900360046003600450035003400370032003700350037003300370034003400350037003800370034003700320036003100340039003600450036003600360046003000310030003000300030003000300031003800370032003600350037003100370035003600350037003300370034003700330035003300360038003600350036004300360043003400390036004500370034003600350036003700370032003600310037003400360039003600460036004500300030003000310030003200300030003000300030003000300030003000420022002f003e000d000a003c002f004100700070006c00690063006100740069006f006e00540072007500730074003e000d000a000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_4b14c015c87c1ad8_0019.0003_none_f33a7a8bbb40b75c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_6acd6157af9d4abe_0019.0003_2a7979a74537f033\scre..vice_4b14c015c87c1ad8_0019.0003_none_f33a7a8bb = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_4b14c015c87c1ad8_0019.0003_none_465eba2461cf6721\SizeOfStronglyNamedComponent = 447e1a0000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_6acd6157af9d4abe_0019.0003_none_3d690cd90d9c3660\lock!04000000b649580e54040000bc0d0000000000000000000 = 30303030303435342c30316463643063323233613061316635	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_6acd6157af9d4abe_0019.0003_none_3b99cdd24116687d\lock!01000000ac48580e54040000bc0d0000000000000000000 = 30303030303435342c30316463643063323233613061316635	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_6acd6157af9d4 = 460061006c00730065000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0019.0003_none_d7fc401534d0a9f5	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_4b14c015c87c1ad8_0019.0003_none_41e6e243258153f1\Transform = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_6acd6157af9d4 = 68747470733a2f2f64777373612e746f702f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e332e342e393238382c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d366163643631353761663964346162652c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32352e332e342e393238382c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d366163643631353761663964346162652c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_6acd6157af9d4abe_0019.0003_none_3b99cdd24116687d	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0003_none_d7fc401534d0a9f5\identity = 53637265656e436f6e6e6563742e436c69656e742c2056657273696f6e3d32352e332e342e393238382c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0003_none_d7fc401534d0a9f5\DigestMethod = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_4b14c015c87c1ad8_0019.0003_none_41e6e243258153f1\SizeOfStronglyNamedComponent = 3b7e080000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_4b14c015c87c1ad8_0019.0003_none_41e6e243258153f1\DigestValue = 322ddaf1cc80e5c392ae82ae9cb016cf0c5f01cf	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_6acd6157af9d4abe_0019.0003_none_3d690cd90d9c3660\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e332e342e393238382c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d366163643631353761663964346162652c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0003_none_a32dbb670e6536fe\DigestMethod = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_6acd6157af9d4abe_0019.0003_none_3d690cd90d9c3660	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_6acd6157af9d4abe_0019.0003_none_3b99cdd24116687d\Files\ScreenConnect.ClientService.exe_e781b1ee3 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_6acd6157af9d4abe_0019.0003_2a7979a74537f033\scre..ient_4b14c015c87c1ad8_0019.0003_none_a32dbb670	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_4b14c015c87c1ad8_0019.0003_none_465eba2461cf6721	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_6acd6157af9d4abe_0019.0003_2a7979a74537f033\scre...exe_6acd6157af9d4abe_0019.0003_none_3b99cdd24 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Assemblies	dfsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\StateStore_RandomString = "4TTWG1AK75H6D4TGRP1N7O00"	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_6acd6157af9d4abe_0019.0003_2a7979a74537f033	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_6acd6157af9d4abe_0019.0003_none_3b99cdd24116687d\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32352e332e342e393238382c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d366163643631353761663964346162652c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0003_none_a32dbb670e6536fe\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742c2056657273696f6e3d32352e332e342e393238382c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_6acd6157af9d4abe_0019.0003_2a7979a74537f033\scre..ient_4b14c015c87c1ad8_0019.0003_none_d7fc40153 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0003_none_d7fc401534d0a9f5\Files	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_6acd6157af9d4abe_0019.0003_2a7979a74537f033\scre..vice_4b14c015c87c1ad8_0019.0003_none_f33a7a8bb	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_6acd6157af9d4abe_0019.0003_2a7979a74537f033\scre..dows_4b14c015c87c1ad8_0019.0003_none_465eba246	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_6acd6157af9d4 = 0000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_6acd6157af9d4 = 680074007400700073003a002f002f00640077007300730061002e0074006f0070002f00420069006e002f00530063007200650065006e0043006f006e006e006500630074002e0043006c00690065006e0074002e006100700070006c00690063006100740069006f006e002300530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f007700730043006c00690065006e0074002e006100700070006c00690063006100740069006f006e002c002000560065007200730069006f006e003d00320035002e0033002e0034002e0039003200380038002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d0036006100630064003600310035003700610066003900640034006100620065002c002000700072006f0063006500730073006f0072004100720063006800690074006500630074007500720065003d006d00730069006c002f00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f007700730043006c00690065006e0074002e006500780065002c002000560065007200730069006f006e003d00320035002e0033002e0034002e0039003200380038002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d0036006100630064003600310035003700610066003900640034006100620065002c002000700072006f0063006500730073006f0072004100720063006800690074006500630074007500720065003d006d00730069006c002c00200074007900700065003d00770069006e00330032000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_6acd6157af9d4abe_0019.0003_615fae6aa1e194b0\pin!S_{3f471841-eef2-47d6-89c0-d028f03a4ad5}	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_6acd6157af9d4abe_0019.0003_none_3b99cdd24116687d\Files	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_4b14c015c87c1ad8_0019.0003_none_41e6e243258153f1\DigestMethod = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_6acd6157af9d4abe_0019.0003_2a7979a74537f033\scre..core_4b14c015c87c1ad8_0019.0003_none_41e6e2432 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications\scre..tion_6acd6157af9d4abe_0019.0003_2a7979a74537f033\identity = 68747470733a2f2f64777373612e746f702f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e332e342e393238382c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d366163643631353761663964346162652c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32352e332e342e393238382c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d366163643631353761663964346162652c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\ComponentStore_RandomString = "GJ22G0EZG6V8H17KV8P0C7KT"	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_4b14c015c87c1ad8_0019.0003_none_f33a7a8bbb40b75c\identity = 53637265656e436f6e6e6563742e436c69656e74536572766963652c2056657273696f6e3d32352e332e342e393238382c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_6acd6157af9d4abe_0019.0003_none_3b99cdd24116687d\implication!scre..tion_6acd6157af9d4abe_0019.0003_61 = 68747470733a2f2f64777373612e746f702f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e332e342e393238382c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d366163643631353761663964346162652c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0003_none_a32dbb670e6536fe\DigestValue = d72f163b9cd2ca20e913e64b69015217076e412f	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0003_none_a32dbb670e6536fe\Transform = 01	dfsvc.exe

Modifies system certificate store 2 TTPs 4 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C	7e530a959a5d576f8c119f5801df3311c3fdafa9504a2d1e374d2b4c45298d45.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C\Blob = 0300000001000000140000007b0f360b775f76c94a12ca48445aa2d2a875701c2000000001000000b4060000308206b030820498a003020102021008ad40b260d29c4c9f5ecda9bd93aed9300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3231303432393030303030305a170d3336303432383233353935395a3069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e6720525341343039362053484133383420323032312043413130820222300d06092a864886f70d01010105000382020f003082020a0282020100d5b42f42d028ad78b75dd539591bb18842f5338ceb3d819770c5bbc48526309fa48e68d85cf5eb342407e14b4fd37843f417d71edaf9d2d5671a524f0ea157fc8899c191cc81033e4d702464b38de2087d347d4c8057126b439a99f2c53b1ff2efcb475a13a64cb3012025f310d38bb2fb08f08ae09d09c065a7fa98804935873d5119e8902178452ea19f2ce118c21accc5ee93497042328ffbc6ea1cf3656891a24d4c8211485268de10bd14575de8181365c57fb24f852c48a4568435d6f92e9caa0015d137fe1a0694c27cc8ea1b32e6cac2f4a7a3030e74a5af39b6ab6012e3e8d6b9f731e1dcade418a0d8c1234747b3a10f6ea3ab6d9806831bb76a672dd2bd441a9210818fb03b09d7c79b325ac2ff6a60548b49c193ede1b45ce06feb26f98cd5b2f93810e6eace91f5bed3fb6f9361345cbc93452883362a66285fb073ce8b262506b283d45cf615194ced62e05e33f2e8e8ec0aa7b0032b91b23679bef7ad081e75a665ccbbe34850f377911afedb50a246c8615898f57c02163c8328ad3986ecd4b70d53d0f847e675308dec30937614a65b4b5d74614d3f129176debf58cb72102941f0d5c56d267668114113589adc262b01f4894d59db78cf814a3e40475fc98150738510232159608a6454c1cc211ae838197c661ccd78384530994fff634f4cbbaa0d0853417c583d47b3fab6ec8c320902cc6c3c0c56110203010001a38201593082015530120603551d130101ff040830060101ff020100301d0603551d0e041604146837e0ebb63bf85f1186fbfe617b088865f44e42301f0603551d23041830168014ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300e0603551d0f0101ff04040302018630130603551d25040c300a06082b06010505070303307706082b06010505070101046b3069302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304106082b060105050730028635687474703a2f2f636163657274732e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63727430430603551d1f043c303a3038a036a0348632687474703a2f2f63726c332e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63726c301c0603551d20041530133007060567810c01033008060667810c010401300d06092a864886f70d01010c050003820201003a23443d8d0876ee8fbc3a99d356e0021aa5f84834f32cb6e67466f79472b100caaf6c302713129e90449f4bfd9ea37c26d537bc3a5d486d95d53f49f427bb16814550fd9cbdb685e0767e3771cb22f75aaa90cff5936ae3eb20d1d55079889a8a8ac1b6bda148187edcd8801a111918cd61998156f6c9e376e7c4e41b5f43f83e94ff76393d9ed499cf4add28eb5f26a1955848d51afed7273ffd90d17686dd1cb0605cf30da8eee089a1bd39e1384eda6ebb369dfbe521535ac3cae96af1a23edb43b833c84f38149299f5ddce546dd95d02141f40337c03e295b2c221757352cb46d8c4341ca2a54b8dcd6f76372c853f1ace26e918be9007b0437f9588208270f0cccaeffd29355c1f893855f7378a8b09a1cb0be9311aff2e195c3971e1be9ca70a06d62667b792e64e5fde7aac49cf2ea47492addb3ca49c861fe3c1561b2b23ff8fb5ea887b706be6a0bafd3a3f45a6c4e81691528b41c048844b964dab4440e38df01528ceedf11856072a2f10c40c08643c338fae288c3ccb8f880b0dbf3bf4ce1e7b8eefb5ebcbb7f07713e6e7283fac12aea52f226c41f9825c1566cc6c0ecac586c3f626330c074ba0d307026a6a4030484b34a85120bbad1b8508e2590d6dca05502bea4a1c9ea5fda0a71f0674e7f2d65290fdaf854821f9573bb49c03ed8645f4b4616ebf68e2266086eac8afa9fe941de7631b3a8656784e	7e530a959a5d576f8c119f5801df3311c3fdafa9504a2d1e374d2b4c45298d45.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\FF8BFAFA697459874FB9843B1EFDA5C91871A44C	7e530a959a5d576f8c119f5801df3311c3fdafa9504a2d1e374d2b4c45298d45.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\FF8BFAFA697459874FB9843B1EFDA5C91871A44C\Blob = 030000000100000014000000ff8bfafa697459874fb9843b1efda5c91871a44c2000000001000000640700003082076030820548a00302010202100fc890218ebc1b3c4b8521f655979371300d06092a864886f70d01010b05003069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e67205253413430393620534841333834203230323120434131301e170d3232303731333030303030305a170d3235303731323233353935395a3065310b30090603550406130255533110300e06035504081307466c6f72696461310e300c0603550407130554616d706131193017060355040a1310436f6e6e656374776973652c204c4c433119301706035504031310436f6e6e656374776973652c204c4c4330820222300d06092a864886f70d01010105000382020f003082020a0282020100da5d7b6eb44d5d8c63f7c47c18a1bf98759158e061191810be4001b75443bd96e1de68459fd72f7fe20abcdab9d10541d5b333a191c8694e70eadeb590a46fbacc4bf1e580e3d49900107f31a44bb0761c26e95f32d3d2076fc1ce1550fcc9b80d3a9e126cf948f5d78907f82795bd1c5437f87f582a9cfa3c9adfb079d3af1b267a35c2fed12b99aa072db1a974d8b3704831f91c07c343f8bdfe52a88a5a9ba1ce87a957eed596ea5af8dc2821f8970898355d467621f188cda371cbf194625ac45e7682afc4a7687dfdf58fa12f67da9f8868f8f1bbafaa5455922fce755cceeee2c4caa8c74350420396f445e5b8e2340ddca227ce4846a787150ff50b982a02fac5722e2630da9e7f4f11f61d46c4a3a741834de00ba96fe8d0eec53b8d7332fc8567d59dae58c9da2b4cd394391f1a35c075ce76e4f58118f42cffd0f9d097d86e6e40e7174583b89ea38de2885b9aeed147efa57ddc17ad421b2c9323575a9e0194576825aed3b586a072b2f4dc6194a5566976865079ac988b1c0cadfd10851be62b1f79cad6a937f874eab8cb3651e29e862d5cafe9d1b42a83f335d2aba6ec4ef9d9aa115a069c24916d645de415844dc365c616628665ba45d57e5a4e9ac0a5b414e8833ed77e4591647937e6f496d5cb708e29e3ca60ed81d594c9954186e08e7dbf3555f0a0a4e56625b4dfdc46577d88321b4719cc21b0a7ad0203010001a382020630820202301f0603551d230418301680146837e0ebb63bf85f1186fbfe617b088865f44e42301d0603551d0e04160414294f9bff00edb7d66b2218307d77a83f5c2b0d85300e0603551d0f0101ff04040302078030130603551d25040c300a06082b060105050703033081b50603551d1f0481ad3081aa3053a051a04f864d687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c3053a051a04f864d687474703a2f2f63726c342e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c303e0603551d20043730353033060667810c0104013029302706082b06010505070201161b687474703a2f2f7777772e64696769636572742e636f6d2f43505330819406082b06010505070101048187308184302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d305c06082b060105050730028650687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e637274300c0603551d130101ff04023000300d06092a864886f70d01010b050003820201004e334e35453d2ec365082bd7e988392596a078b66cc91a7d52995886d9d2ef5eb1160e611ab54b00704e0cd7fdf1271871d56584ce06413b96e26d0396eb657cbbd5c12039d0130d52e31d1a7a186ca20878378c832655db9af8fc8e0672ca942d35fd13ee8803a7a747a502ff39ce8bbb6b054d78be49edb5a70f7c5c9a0edf3a6a7e3de78ac01b08a05198c6a4ccd6443ced8f4d9a65a23e67b09a93afe01c2e3f3d90581cf5138f931a3af8a15f27ce1a515a1a47f177392d6d3729bc62ce606793d202b89ff88531f035675680e405b49414971bf9f36528c1c44ed17ced9dee353c14465719a0391e3197d851df01ae8e36cb7918a26ca2eec0da555c4fa072f05a7ee59382e093a4edd2698645c04a17a3903ca9fdab62e033fec0f8653dd193b9050a78b0e1101b73ce2caf73a677373783d2a1ee3ce794055e0535ac1edc9eb133e043d16cb6f811f2d7cc855f098673920d0948c2f93a705eea762ca78afd8d4b47a5f4f5ec02b34d77defbbe7e854b50b26182dc05ba265fe3bde3fbd6a12f2aa9656d39361d93425789714323d74ffef6347a5ae3e44a6322d76e604bf759bee5f7a8023d55a2356fd9ed1041d584fed8c27697369a1be159c96722b21a92a6c4d9d17dac189b047538f099b1a3d1ef72882f0e09a767d622f371976cd4b95e6357c2c7b97499b81f04607c9fe72a0bd13f1c899107531d4785b7	7e530a959a5d576f8c119f5801df3311c3fdafa9504a2d1e374d2b4c45298d45.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\54JJXWEC.1P3\Y8BQNDD5.K2N\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe
File created	C:\Users\Admin\AppData\Local\Apps\2.0\E7G58V3Z.0D7\AB0BVXL1.XPW\scre..ient_4b14c015c87c1ad8_0019.0003_none_a32dbb670e6536fe\ScreenConnect.WindowsClient.exe\:Zone.Identifier:$DATA	dfsvc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1108	dfsvc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2632 wrote to memory of 1108	2632	7e530a959a5d576f8c119f5801df3311c3fdafa9504a2d1e374d2b4c45298d45.exe	79

C:\Users\Admin\AppData\Local\Temp\7e530a959a5d576f8c119f5801df3311c3fdafa9504a2d1e374d2b4c45298d45.exe
"C:\Users\Admin\AppData\Local\Temp\7e530a959a5d576f8c119f5801df3311c3fdafa9504a2d1e374d2b4c45298d45.exe"
1⤵
- Manipulates Digital Signatures
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:2632
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
  2⤵
  - Downloads MZ/PE file
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  PID:1108

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

scre...exe_6acd6157af9d4abe_0019.0003_none_3b99cdd24116687d.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\E7G58V3Z.0D7\AB0BVXL1.XPW\manifests\scre...exe_6acd6157af9d4abe_0019.0003_none_3b99cdd24116687d.cdf-ms
Size 24KB
SHA256 e4773ece0abc68d8bc81f0bebb1990c4e31f7e3bd9b36dc1690c33d08370349e
MD5 abf9afd1fb1312b6494487070804769a
SHA1 e07257c39b7a6b11a192313f700a0d7e9ce3ac3a
SHA512 a8a28013469a4da3814d2e9c53712ea72bfcc74264dfc190e6efe0cd9a8d1a148f325d534ecbfa4ef5cf886ec2715561aae6d38d66ccf5a8bb2a0f6cb47d8d6f
SSDEEP 192:VTiDqPzTGgs6mSNEB4gip5jx4gT2x2QP7/rImEDh7BqWovXjrerererSrZIQGV6e:VmqP3Gb6PEB3G3T/QP/FM7YH+++amtcG
TLSH
T12CB26F41B7D2E923E2466A33DCD6C3E57235FDD24EA6039B30413B2EAD307C95E22685
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..core_4b14c015c87c1ad8_0019.0003_none_41e6e243258153f1.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\E7G58V3Z.0D7\AB0BVXL1.XPW\manifests\scre..core_4b14c015c87c1ad8_0019.0003_none_41e6e243258153f1.cdf-ms
Size 3KB
SHA256 21ad6008de9d8b16b4de4a48fa6b0a3c93de50dbff599bda5aedbbaa471d9e1d
MD5 ce65c9edf041295a7fbfdd759b97a3ba
SHA1 3a9a9ef5d9ef5c9216a6b5bae458c081f15801cb
SHA512 fe5a6c85397808f41c4013215d72496a51b8c64dea42fdf5422c99c2700235aa664acef529bd3db6c0ca3e98194accad8b5b330b7e16ea6b8f368fcbad6937b5
TLSH
T10B619C02B644EA13C9A90633ACD6D6EE37747E83DF42460B74C4BF2F7A316F65612291
MD5 SHA1 SHA512 TLSH

Submit Download

scre..dows_4b14c015c87c1ad8_0019.0003_none_465eba2461cf6721.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\E7G58V3Z.0D7\AB0BVXL1.XPW\manifests\scre..dows_4b14c015c87c1ad8_0019.0003_none_465eba2461cf6721.cdf-ms
Size 5KB
SHA256 a27fd7814fa397c94375cdc9584089b406158605a8333ffc2531e27981481041
MD5 8ffbf2029e138462142d9ef7aa5d8fc1
SHA1 253d8482f4dc4b02d083beb2617d36360ff74561
SHA512 44186dd3cf614a40b9f9ef8de64ec2abb2492385b8b2d349540827d7248f6064096f83f8742b70a810c961a95b9ddf366c55907876f0d5c76b1221b73b792885
SSDEEP 96:Jm4+RzgvheV+Ww76kNpWGgyHmzSNp9QHAzjrwewnANbZF:uRzg2JANAMrvOALwJALF
TLSH
T170B1E0117304D917D5B906339CA9C7EE2B387D92CE42460B70D8BF6F76326FA4721295
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_4b14c015c87c1ad8_0019.0003_none_a32dbb670e6536fe.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\E7G58V3Z.0D7\AB0BVXL1.XPW\manifests\scre..ient_4b14c015c87c1ad8_0019.0003_none_a32dbb670e6536fe.cdf-ms
Size 6KB
SHA256 dff7a8da4953f455aa9c0f0896e28a32cad85daea421fe134496de99b80b58f3
MD5 88c2fdce334b2c1e357fb69c86750db8
SHA1 c86b8f4de5baa9d0da2cef93eaee167c8f31f957
SHA512 6106869df9feac69af815e04b1f99daaf744642e6d76018e813c95896729455fd365f131a207dbd29f23d539906ba6e9029816ed07d09af38212ecbdf3e2a2a3
SSDEEP 96:4wQPPypJIeV+Wwwg8Wp6l3XDp3uIEBvMYEwvL2ks6b/FK:aPPWJMpUdMj7FLRK
TLSH
T1B4D122127281EE57D1A90A33ACDAD2ED32797E86DF43070770C4BB2F7A312E61A22155
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_4b14c015c87c1ad8_0019.0003_none_d7fc401534d0a9f5.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\E7G58V3Z.0D7\AB0BVXL1.XPW\manifests\scre..ient_4b14c015c87c1ad8_0019.0003_none_d7fc401534d0a9f5.cdf-ms
Size 2KB
SHA256 74ce554077fe38c83baa026368cd97de4ed02119db5aefd7654a87e6efe543c4
MD5 4c6b761848995214246de758510824c9
SHA1 831da45e5e9a45719f5b9607e8b377d84f6d450b
SHA512 66cc1dbbf7b712ffc1347d813d225d4f00242a061a22d681ec8417f538125f815ffd06cebf69a4e33b9fe4e05238d89d63ee60c00e61debc6fca486299a3e431
TLSH
T11E511F013748D667DA2A0331ACA2C2CE7BB83E83CE95510BB0C0377F5E717E55A1A1A5
MD5 SHA1 SHA512 TLSH

Submit Download

scre..tion_6acd6157af9d4abe_0019.0003_none_3d690cd90d9c3660.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\E7G58V3Z.0D7\AB0BVXL1.XPW\manifests\scre..tion_6acd6157af9d4abe_0019.0003_none_3d690cd90d9c3660.cdf-ms
Size 14KB
SHA256 09e88e4a35048c52fd572ece8eae8ee2d217754c2468b407d83f1a0a8b727246
MD5 a2f3799d5b74dc6bb5f417914a1905c1
SHA1 fe3709ffb06a9f3224ee85a79f3825dd2dee3f3d
SHA512 2ac25e0f8cf64d53c6978e435786d2543b290d2346b0de047c798c2080e7429aa5e9968b11c9c62622f6db1a09478d3504e8c08b90b9f87be683c1106b763f86
SSDEEP 192:rWEJ9rsE6sZsP9gMe4g0ZKO14p3x4gT2x2QP7/rImEDh7BqWoTOp:rW09rsE6s+Pbe30ZL6pB3T/QP/FM7YTi
TLSH
T11C6207853791E927C2479A32ECD2C7E57239FD834ED2878B34407F1FAD30B855A22695
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..vice_4b14c015c87c1ad8_0019.0003_none_f33a7a8bbb40b75c.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\E7G58V3Z.0D7\AB0BVXL1.XPW\manifests\scre..vice_4b14c015c87c1ad8_0019.0003_none_f33a7a8bbb40b75c.cdf-ms
Size 4KB
SHA256 c78867aa08483433c4f066cc3cab05bfefaca4c8d90330f52e70f6270ebad6d9
MD5 6e6a067ed9c032599cb8b8b35c65edd2
SHA1 27ed87186c5249e87cae57170c2c3ced192e9146
SHA512 3a219c706b652eed98e140465bf5bd07e0b683b2388dbfc36d9b5c1e76b2b5ada8b7d9827bbe22afaa01a8d6f0b01c214c4ac7b23ad3eb6c2dc645c7126240f7
SSDEEP 48:lEAnCDvx+dgJe6S+9ow87gnW75uvs4yOuV49sQkH2Cf4fTY5ZTyA9UPCf:lleeV+Ww8g45uDyOj9sQkfITYfTyObf
TLSH
T1559175117280ED26D6A90633DCD6C2DD3A36BDC2DE43070BB0C4BB2F76716DA1B22196
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Users\Admin\AppData\Local\Apps\2.0\E7G58V3Z.0D7\AB0BVXL1.XPW\scre...exe_6acd6157af9d4abe_0019.0003_none_3b99cdd24116687d\ScreenConnect.ClientService.exe
Size 93KB
SHA256 8c7e1feb403442d3bc11a1945a9e0b3651a5095ca3acabe3f608da801dc8c2b7
MD5 b0d1b0112506eaf72c7154fef004225a
SHA1 3cb9cd6a9ceb37751ad16165865cb338be39bbee
SHA512 61505b015bb06ce935a5adaa55211a6b650cdb7cd60a6dcc2add8596fa674da11059763e965101ac3e59406f4bd54463f0c8555acf6b660f573a2cdccf0d5925
SSDEEP 1536:Dg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgEdU0HM17RA7:shbNDxZGXfdHrX7rAc6myJkgEU0H+NQ
TLSH
T1AE936B13B5C28872D573093158E0DAB09A3FF9615E21DEAB3798022E4F642C1BE75E77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsFileManager.exe

Path C:\Users\Admin\AppData\Local\Apps\2.0\E7G58V3Z.0D7\AB0BVXL1.XPW\scre...exe_6acd6157af9d4abe_0019.0003_none_3b99cdd24116687d\ScreenConnect.WindowsFileManager.exe
Size 79KB
SHA256 b814c00beb52143cd928a70703300254dd59421f969a94c7b61f673733e27c46
MD5 eabbe94e82ece42897fbe2f141675ab3
SHA1 13fc3d90537164796cd1c189decc5053c9d44936
SHA512 5e05c1372c0b7a380fb93ed741c8eb79a6113d3bdcafaa42a1157a5205fb68e4cd68a211117919b1e1848eadf8d8de82bc912397b26423313cf8697c80866e22
SSDEEP 1536:Ptytl44qzbYI5kLP+VVVVVVVVVVVVVVVVVVVVVVVVVC7Qx97RJc:M/jukLd49NW
TLSH
T18983E68235762631DF85C5379492C9B59C366F22133DC5BD2DA2FE7A69F03043A8ADB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe:Zone.Identifier

Path C:\Users\Admin\AppData\Local\Apps\2.0\E7G58V3Z.0D7\AB0BVXL1.XPW\scre..tion_6acd6157af9d4abe_0019.0003_2a7979a74537f033\ScreenConnect.WindowsClient.exe:Zone.Identifier
Size 26B
SHA256 eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
MD5 fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1 d59fc84cdd5217c6cf74785703655f78da6b582b
SHA512 aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98
MD5 SHA1 SHA512

Submit Download

ScreenConnect.Client.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\54JJXWEC.1P3\Y8BQNDD5.K2N\ScreenConnect.Client.dll
Size 192KB
SHA256 dd75f431bc27ae5cd60eabf0d705de194c72aa7c6897a7789981df620be5cc41
MD5 b25e25d654607d0ef84403f836017731
SHA1 03f92b570ce070dae7146a390041804375c718c0
SHA512 a9ae00cafd369dfeb21d8ba3f62787c98bc4798e6d6c8ce9631b0f8c9caaecc8fcda78c76df0b74838aabcb308c7893a69a97d0fc1a87a78e485798bd98d5de0
SSDEEP 3072:r5jDSMscgsVrgI7uyGhsqVFJRTcyzvDqSmzDvJXYk:9DSM1VsIRYPJukqSmG
TLSH
T15D144CA663685D2AEADF4973B0506030CA75ED25A423F3DE4E04F9F919B33818E553E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\54JJXWEC.1P3\Y8BQNDD5.K2N\ScreenConnect.Client.dll.genman
Size 1KB
SHA256 84780076495c67516e5059181e8d9ed24a17534e8d47efb7755c4d5f9d815d75
MD5 04cb3bb182262f142069967803419b9b
SHA1 6654f8403a764f4880894b904819fd6d3e539c3c
SHA512 294e2a395caf7ebb33faa55517b52cf6d2384cde9abd545786024cfb4fb10c3436578be10a6a159eb07f5dfd99b9da149c1d773c52664f7a2176d0153090aee0
TLSH
T1B5115C1181C8F9361F3301D2BEE7E021576D1B73048D1947B069696F8F29AE64347173
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\54JJXWEC.1P3\Y8BQNDD5.K2N\ScreenConnect.ClientService.dll
Size 67KB
SHA256 228c0f9be331a5fbce6711f6c72d7660419d7746da604168d6f4ad9a492b00aa
MD5 df724b974bf67241993a75cf80ebd098
SHA1 7ea91f2529bed8e16f3e65bfc50677e46c21f8ee
SHA512 bcc9038b3e3b7ab3cea30ffa62ebb4145bfc6bff11ebd2ff4e94f59ef44aced0eb7928620421324a2ab89ae76d3677b30fd84889c220a9ee3021425c028eba5d
SSDEEP 1536:POZLdn4uRt3p/V1gwk5GEPVQoV3l7jg8bdy:PEqUJgxNtQoV1c
TLSH
T131632C02A3BD8A36C9EF5A787465F1450B708E02E463FB9CADCDA4DB1B563E1190139F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\54JJXWEC.1P3\Y8BQNDD5.K2N\ScreenConnect.ClientService.dll.genman
Size 1KB
SHA256 cb26a8c4059cd1eef78bb6c91d5d3674e5f5cd495cacc6590858f0020e6d82a0
MD5 5e21aadec3a782d745f4f7c647f041c9
SHA1 6469b76d12bf12a4048ba647aeed22ab9549ebfb
SHA512 01f94dcdc5aff7c8f6c47df69338d6642549e54c65c0bd110dc815909fc665b43e7847d505e55c0bfa0e1b847112984e253582f16982f6a65e194ee243e60433
TLSH
T1BB31091650C4FA351F3301C2BEE7E020575D1B73148E1947709D599B8F2DAA6434B177
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\54JJXWEC.1P3\Y8BQNDD5.K2N\ScreenConnect.Core.dll
Size 539KB
SHA256 1e9eacd3c680b18f3bfee12a835a49d63fed76056aedb2b2ef312999eb6b4033
MD5 d254a2107a0ede952aa99f5a8feb5a04
SHA1 322ddaf1cc80e5c392ae82ae9cb016cf0c5f01cf
SHA512 ca9083b303cab7b08874284b388b7bab74063b4a034e5c95b8b72777e4527df2c4102fd066a164d4937bb98f285549b199203481ed5340eafd538f5615163ce2
SSDEEP 6144:SfWyDky4hmlTnSnyXn/4ZNkVQVyRb9bniIzs8vvk6aMhCJqgfwyYeMxq/J1e5Qal:SfxkyQIGogZAQcb9jzsO6Mx9OF2
TLSH
T197C48EC133D4CB2BC5BF47BAF42056690770EC107509E79B1AB5D8A8ADA335A4EC06ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\54JJXWEC.1P3\Y8BQNDD5.K2N\ScreenConnect.Core.dll.genman
Size 1KB
SHA256 4f64d5ec8f8684a9c6ceba3ddec8396b726607140023ed38c75b6c2aeee0972f
MD5 e9438a703eeb765f7f2b544a0b4a162f
SHA1 20212453c8a84289a6bac57e761f98838de56890
SHA512 4e888654024480ba3217ab6ea286f62323156bbbf384977764e076edd64574bca1d7e5d3ec371ad86bff6c1da652f9eb177f90b37f8b95de0cad7407e924954e
TLSH
T1CF21671181C8FA261F3302D2BEE7E421979E5B33188D194B74A9699FCB2DAD64747073
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\54JJXWEC.1P3\Y8BQNDD5.K2N\ScreenConnect.Windows.dll
Size 1.6MB
SHA256 f6e77233f0995581f3171ee92c5cab5b8052d177d333a4999e16e696616739a6
MD5 27d7995501d37a65912643493ec8f2c5
SHA1 3d3f37be1ff47568cf8b7ae3f28ceabbcdc1b009
SHA512 73751b468c82a2e77852932528946fdfbceae7cafc4175fd0d6d7d50771c78be4de0e916b226b0209beae067698a2355dfa656e3381f337778a5314a769f3057
SSDEEP 24576:yDtFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUTHs:yDtJkGYYpT0+TFiH7efP
TLSH
T1BA85BD41E2D364F5D46B047888BF571ABA743C040325CAFB97D4AE3A6D33BC09A36796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\54JJXWEC.1P3\Y8BQNDD5.K2N\ScreenConnect.Windows.dll.genman
Size 1KB
SHA256 2812598c3e94d284d506b81f5e55c18365a977979b19cec72fca129a706ed22e
MD5 41c9e5bd7b4649061816d367d6005711
SHA1 c17a6f4c5403e8f9d69de04e58a49280660d4a3f
SHA512 68417c9b7badec989ce198f4a16c17a336ce6f161bc1ebcb1769dc0539a23707507f14e3fdbb1f48bc2f66a1f82539ed432d7f4910a7666dbfa7239b1f33367f
TLSH
T14341D31281C8FA250F3301C27EEBE431979E5733158E194B7499AA9BCF29AE74747037
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsBackstageShell.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\54JJXWEC.1P3\Y8BQNDD5.K2N\ScreenConnect.WindowsBackstageShell.exe
Size 59KB
SHA256 a3e400824a622a094f5b75d3bd0ac6737f62537ce97a18a948b6876e8861a712
MD5 03547f425670dde601195bd601d1ba89
SHA1 64cdddbc8dc3132a9822cbc24295609727e15799
SHA512 66038dba18f47aea0bc717a55147d0fc8ba45625ba550d8dd6a2e37aa66efbaed57c4af72bf86e26d0d472eeef2afe6c5c3acde965f921d7a7e2966a7fa98297
SSDEEP 1536:5bHOH2MJv2vmDtyQXIE+TC4fIfXWbU017RjbvP:5buH2MJvyQEqa1N/
TLSH
T19A538C4163F80B16DDFE5E39B5E2A5240EB0EA039441E7AE1DCDA5D94E437806B603FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\54JJXWEC.1P3\Y8BQNDD5.K2N\ScreenConnect.WindowsClient.exe
Size 595KB
SHA256 da7697707b476046197af8d35c5a1df3cebd7153b7b48aab1079a6375bdca74a
MD5 e52d6ed40d9d4ae38f9a36af49eff819
SHA1 d72f163b9cd2ca20e913e64b69015217076e412f
SHA512 fe759aa56c5bbb0b5104102edd348c67a0420f7a9291348cf03ce31322d46dac52d4335e82a6eb415703a46d2b3c936452fab161535355a65458d95261b21846
SSDEEP 6144:GHv8AU89LWJ2dNq9jGyYSMCoI68zg/KWcA3rlz1vH5kqb1JCZ2cNI2/C4I159uvZ:ueCWEdNq4yP76wSPrlz1vHCqb10u9FK
TLSH
T1FDD46A62737CDA7AC5FF0779B0F11A2457B0E8226285E78F5804E5E90E963829D443FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Users\Admin\AppData\Local\Temp\Deployment\54JJXWEC.1P3\Y8BQNDD5.K2N\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
TLSH
T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\54JJXWEC.1P3\Y8BQNDD5.K2N\ScreenConnect.WindowsClient.exe.genman
Size 2KB
SHA256 4231e7a3546d04c60d9cfcc4b65b29b60baedf5839d0660c3b8dbd2850f9b6b3
MD5 15a5c08ff8c9af283bbf956dd00b8855
SHA1 c35e48a92aafbad77e958956ca9dd2e1c5309922
SHA512 40ae140c38f3722a66c069c16b29d2837471a9b441a6bac42b7ba1741bd8b9979bd60623ba860caa29b4eec6e14b8796b46eb20d0f080291fd8268f7a157a9a1
TLSH
T11251C31641C8FA250F3301C2BEEBE471979E5B32158E1947709D9A9BCF29AA7474B037
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.manifest

Path C:\Users\Admin\AppData\Local\Temp\Deployment\54JJXWEC.1P3\Y8BQNDD5.K2N\ScreenConnect.WindowsClient.exe.manifest
Size 17KB
SHA256 1a712c779287868716ac3fc1733e3cf86c05158a92ff1b7dca9ffcda1a4d9fb1
MD5 c05b5069724d567e3857f005c0aa9cbc
SHA1 efbb66ef9a6b38e0d35911c2dd5e8c7369b45d27
SHA512 ebd227b7d3de8794dd7a7bbe4e09af34ce02c1fd1a0de0d0d4a8e967635930d2afc19a27a2a17820c0a0b56dd4442adefde27edc48de299dce33874bd568d888
SSDEEP 384:5emh4h6Wt/EaXVf6nEi3D363T/QP/cM7Y7:5rs6E+zGT/QP/B07
TLSH
T19882D65A88C57C215332D4D0FEE38925BE097B2341FD04CA7C9D56AF9F2169987832EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ONLB5DJA.9PP.application

Path C:\Users\Admin\AppData\Local\Temp\Deployment\6L7E2JAP.YQ8\ONLB5DJA.9PP.application
Size 119KB
SHA256 79f2e760f8d46b0207d9398a88c297cc3075cd6dff21d9440c52f2151569da90
MD5 58ccdfea764d4d7b50956ccc6b082b1a
SHA1 f7e3e0b5ef6f0a812627d8c419ad7bd8e11f9e80
SHA512 b64436bfac19029bfd47f1a55a12eb239d307ec7e2039257441e38b28fe85c297376820a4eccfd2dffa833590356a9de89f303a83035c00b72077971961366b2
SSDEEP 1536:grSsJG6uyWVfI3XiuWrXAxBpKobw58so5v6Ppo/18Q08UVh5aILTvooBT53/rm2W:IfpJ3S7rX66PpQy5HX9Nm2o9HuzhJOvP
TLSH
T124C3082A8F30F4C0477DB020D1A52D6739811B97DB730FECDA1A186B4E69792EF5A64C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1108-16-0x000001CB7F330000-0x000001CB7F339000-memory.dmp

Download

memory/1108-48-0x000001CB7FDC0000-0x000001CB7FDF6000-memory.dmp

Download

memory/1108-42-0x000001CB7FE60000-0x000001CB7FEF8000-memory.dmp

Download

memory/1108-29-0x000001CB66A00000-0x000001CB66A10000-memory.dmp

Download

memory/1108-17-0x000001CB01F20000-0x000001CB01F32000-memory.dmp

Download

memory/1108-0-0x000001CB64DD0000-0x000001CB64DD8000-memory.dmp

Download

memory/1108-18-0x000001CB66A00000-0x000001CB66A10000-memory.dmp

Download

memory/1108-54-0x000001CB7F7A0000-0x000001CB7F7B8000-memory.dmp

Download

memory/1108-60-0x000001CB7FF70000-0x000001CB8011C000-memory.dmp

Download

memory/1108-66-0x000001CB7FE50000-0x000001CB7FEDE000-memory.dmp

Download

memory/1108-338-0x000001CB66A00000-0x000001CB66A10000-memory.dmp

Download

memory/1108-15-0x000001CB66A00000-0x000001CB66A10000-memory.dmp

Download

memory/1108-6-0x000001CB7F950000-0x000001CB7F9A0000-memory.dmp

Download

memory/1108-3-0x000001CB66A00000-0x000001CB66A10000-memory.dmp

Download

memory/1108-2-0x000001CB66A00000-0x000001CB66A10000-memory.dmp

Download

memory/1108-1-0x000001CB7F3A0000-0x000001CB7F528000-memory.dmp

Download

memory/2632-14-0x0000000001B90000-0x0000000001D3C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads