b4f73c85e92211bc86134c8ca4731983a42ed901fafe16e59640018281ce4d15

Analysis

max time kernel
149s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/06/2026, 14:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
support.client.exe
Size 306KB
Sample260619-rmybbagx2q
SHA256 b4f73c85e92211bc86134c8ca4731983a42ed901fafe16e59640018281ce4d15
MD5 e04024b78d295389fd13e0579cae0d41
SHA1 f66fb3b1337c7d4329ab9fa0889171176ebed36f
SHA512 74b258e3faf6435c196fe42f38b47b3bc3d8cc8114f485134a7d897975cc0e8e9d5aff5ed184d4f698e6dfbc4e4168af017bd45cbb4bf0dce8dc71f95f336464
SSDEEP 6144:gmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9c:r1iw7gryNkSV1hy1Z1u2JLu9c
TLSH
T11C647C11B9C48432C673383147B8E2B28DBDB8301D655B8F57A81D7A9F741D0EA29B6F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery revoked_codesign spyware trojan

Malware Config

Signatures

Manipulates Digital Signatures 1 TTPs 2 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\AEFC81CF94DD207124553201D1E3B45327EC5045\Blob = 030000000100000014000000aefc81cf94dd207124553201d1e3b45327ec50452000000001000000210300003082031d30820205a003020102020101300d06092a864886f70d01010b0500302b3129302706035504030c20d09bd18ed0b1d0bed0b520d0bdd0b0d0b7d0b2d0b0d0bdd0b8d0b520526f6f74301e170d3233303430313030303030305a170d3338303130313030303030305a30263124302206035504030c1bd09bd18ed0b1d0bed0b520d0bdd0b0d0b7d0b2d0b0d0bdd0b8d0b530820122300d06092a864886f70d01010105000382010f003082010a0282010100c6bcd9f55e94376657aea8bb3e68f9e49b79ea759d70f3399b1dd48efffeb16a1892c85a5333208960bb7dc81e47c7840931fdbec65fcf45531874e74c4e54ce92b1fbfd038f88e36fc2f231be528deacd3deec5b3c94a0bcd1b2a0dda0b693ef117901076f11e550557f05e2e3c7a628a9ce1b9e3f7b48d15ad630b9cddf67d969688fa3a3c158c71990da6944348fb49af08d5b2b05dfcc42552ad1e1d7a833fd3a99ef93384addc31dd011d49b3dc8e5d89458d75dfdfaa2567ba3fa84c07b9b9074fee968521749d2bdfcc7be49977ef378b7a3fa274c4b1d31c2c5508d59fd065c3e48a7cfb94443bc33a9f98e61401b964dd97ad1c3f4e7632fd8534110203010001a351304f301d0603551d0e0416041464a4eb6817d5d7fd59b6faf38486e6ca07bf135230090603551d1304023000300b0603551d0f0404030206c030160603551d250101ff040c300a06082b06010505070308300d06092a864886f70d01010b050003820101004d730ef0c25390d0ac7a28a581e0a4c46de2c0927646df24e3876c6c9036c77e79a4af0fb93008786cd1bfe79e07e9a11998b71eb97ca2cdd59588bca68352e292bff4f5591caea27929c96f8d6bb5f54bf7c4b292b1e3b4b8e1fcec3bb14d5fa04e338677a3ad8ac4e998d445642898451f0435a0fae17c911905c7075f2cc636c173fb1bf89f219902715ead5d4a56d9eccd0c5e9f6be4fbfb42a78d3fb918c172afa89f33c501df623c07d98f418ce72a2b95b7c370383df6711e8a01d8dec0a4bd2d385331ce8315b8a98c2c61f8cdbfceb75a18461bff9a5fa887ffa01344468dc898d758ec0af10f168589341d06f1e0495a3e89c0e612b4d8020b074f	support.client.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\AEFC81CF94DD207124553201D1E3B45327EC5045	support.client.exe

Signed with revoked ConnectWise certificate 4 IoCs

Binary is signed using a ConnectWise certificate revoked for key compromise.

revoked_codesign

resource	yara_rule
behavioral2/files/0x000d00000001c5c5-46.dat	revoked_cert_connectwise
behavioral2/files/0x000d00000001c5bf-201.dat	revoked_cert_connectwise
behavioral2/files/0x000d00000001c5c0-200.dat	revoked_cert_connectwise
behavioral2/files/0x000d00000001c5c4-196.dat	revoked_cert_connectwise

Executes dropped EXE 1 IoCs

pid	Process
3916	ScreenConnect.WindowsClient.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\ZJ3LLTY6.PHG\5R85537G.XB3\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	support.client.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dfsvc.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0019.0002_e0398dd367581242	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_4b14c015c87c1ad8_0019.0002_none_f33a7b65bb3fb52e\Transform = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_4b14c015c87c1ad8_0019.0002_none_465ebafe61ce64f3\DigestValue = 48038f060a5042ff44a2d9a9be46368ecc8436fd	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d819169b5504f\lock!12000000e239590e4c0f000044160000000000000000000 = 30303030306634632c30316463666666366134633731346162	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications\scre..tion_25b0fbb6ef7eb094_0019.0002_829c336b40a78497\HasRunBefore = 01	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Categories	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_25b0fbb6ef7eb = 30000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d819169b5504f\Files\ScreenConnect.ClientService.exe_e781b1ee3 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_4b14c015c87c1ad8_0019.0002_none_465ebafe61ce64f3\Transform = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0019.0002_829c336b40a78497\scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d81916	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0019.0002_none_a32dbc410e6434d0\lock!18000000e239590e4c0f000044160000000000000000000 = 30303030306634632c30316463666666366134633731346162	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_4b14c015c87c1ad8_0019.0002_none_41e6e31d258051c3\identity = 53637265656e436f6e6e6563742e436f72652c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_25b0fbb6ef7eb = 68747470733a2f2f6c696f6e732d73637265656e322e746f702f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_25b0fbb6ef7eb = 680074007400700073003a002f002f006c0069006f006e0073002d00730063007200650065006e0032002e0074006f0070002f00420069006e002f00530063007200650065006e0043006f006e006e006500630074002e0043006c00690065006e0074002e006d0061006e00690066006500730074000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0019.0002_none_a32dbc410e6434d0\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\OnlineAppQuotaUsageEstimate = "3640628"	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0019.0002_none_a32dbc410e6434d0\lock!0c000000c037590ee00b00006c0e0000000000000000000 = 30303030306265302c30316463666666363964303735656632	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d819169b5504f\lock!06000000c037590ee00b00006c0e0000000000000000000 = 30303030306265302c30316463666666363964303735656632	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d819169b5504f\implication!scre..tion_25b0fbb6ef7eb094_0019.0002_e0 = 68747470733a2f2f6c696f6e732d73637265656e322e746f702f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d819169b5504f	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0002_none_a32dbc410e6434d0\SizeOfStronglyNamedComponent = d96a090000000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_4b14c015c87c1ad8_0019.0002_none_465ebafe61ce64f3	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications\scre..tion_25b0fbb6ef7eb094_0019.0002_829c336b40a78497	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0019.0002_none_d7fc40ef34cfa7c7	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_25b0fbb6ef7eb094_0019.0002_829c336b40a78497	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d819169b5504f\Files\ScreenConnect.WindowsFileManager.exe.conf = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0019.0002_829c336b40a78497	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_4b14c015c87c1ad8_0019.0002_none_465ebafe61ce64f3\identity = 53637265656e436f6e6e6563742e57696e646f77732c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications\scre..tion_25b0fbb6ef7eb094_0019.0002_829c336b40a78497	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_25b0fbb6ef7eb = 30003000300031002f00300031002f00300031002000300030003a00300030003a00300030000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d819169b5504f\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0019.0002_e0398dd367581242\scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d81916	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0002_none_d7fc40ef34cfa7c7\DigestValue = 7aca9192a475179f4df8752ecd7eda05948dc6f4	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_4b14c015c87c1ad8_0019.0002_none_f33a7b65bb3fb52e\SizeOfStronglyNamedComponent = ac21010000000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_4b14c015c87c1ad8_0019.0002_none_41e6e31d258051c3	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\Gi_scre..tion_25b0fbb6ef7eb094_9edfe039055229dd\LastRunVersion = 68747470733a2f2f6c696f6e732d73637265656e322e746f702f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_4b14c015c87c1ad8_0019.0002_none_41e6e31d258051c3\DigestValue = fde73710ce063bbf1e377c02a1a8615cf4da1c08	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\NonCanonicalData	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_4b14c015c87c1ad8_0019.0002_none_f33a7b65bb3fb52e	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_4b14c015c87c1ad8_0019.0002_none_f33a7b65bb3fb52e\identity = 53637265656e436f6e6e6563742e436c69656e74536572766963652c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0002_none_a32dbc410e6434d0\DigestValue = b46c4e4694783311e2c612ed7f0ca67a88e1e352	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Assemblies	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0002_none_d7fc40ef34cfa7c7\SizeOfStronglyNamedComponent = e711030000000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0019.0002_829c336b40a78497\scre..dows_4b14c015c87c1ad8_0019.0002_none_465ebafe6	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_4b14c015c87c1ad8_0019.0002_none_465ebafe61ce64f3	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d819169b5504f\lock!04000000e239590e4c0f000044160000000000000000000 = 30303030306634632c30316463666666366134633731346162	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_25b0fbb6ef7eb094_0019.0002_none_2771bb27d0341a32\lock!02000000e239590e4c0f000044160000000000000000000 = 30303030306634632c30316463666666366134633731346162	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}\scre..tion_25b0fbb6ef7eb	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_25b0fbb6ef7eb = 0000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0019.0002_829c336b40a78497\scre..core_4b14c015c87c1ad8_0019.0002_none_41e6e31d2	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_25b0fbb6ef7eb094_0019.0002_none_2771bb27d0341a32\lock!10000000e239590e4c0f000044160000000000000000000 = 30303030306634632c30316463666666366134633731346162	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}\scre..tion_25b0fbb6ef7eb = 3c004100700070006c00690063006100740069006f006e00540072007500730074002000760065007200730069006f006e003d002200310022000d000a00460075006c006c004e0061006d0065003d002200680074007400700073003a002f002f006c0069006f006e0073002d00730063007200650065006e0032002e0074006f0070002f00420069006e002f00530063007200650065006e0043006f006e006e006500630074002e0043006c00690065006e0074002e006100700070006c00690063006100740069006f006e002300530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f007700730043006c00690065006e0074002e006100700070006c00690063006100740069006f006e002c002000560065007200730069006f006e003d00320035002e0032002e0034002e0039003200320039002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d0032003500620030006600620062003600650066003700650062003000390034002c002000700072006f0063006500730073006f0072004100720063006800690074006500630074007500720065003d006d00730069006c002f00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f007700730043006c00690065006e0074002e006500780065002c002000560065007200730069006f006e003d00320035002e0032002e0034002e0039003200320039002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d0032003500620030006600620062003600650066003700650062003000390034002c002000700072006f0063006500730073006f0072004100720063006800690074006500630074007500720065003d006d00730069006c002c00200074007900700065003d00770069006e003300320022000d000a00540072007500730074006500640054006f00520075006e003d002200740072007500650022000d000a0050006500720073006900730074003d002200740072007500650022003e000d000a003c00440065006600610075006c0074004700720061006e0074003e000d000a003c0050006f006c00690063007900530074006100740065006d0065006e0074002000760065007200730069006f006e003d002200310022003e000d000a003c005000650072006d0069007300730069006f006e00530065007400200063006c006100730073003d002200530079007300740065006d002e00530065006300750072006900740079002e005000650072006d0069007300730069006f006e0053006500740022000d000a00760065007200730069006f006e003d002200310022000d000a00490044003d00220043007500730074006f006d0022000d000a00530061006d00650053006900740065003d002200730069007400650022000d000a0055006e0072006500730074007200690063007400650064003d002200740072007500650022000d000a0078006d006c006e0073003a00610073006d00760031003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a00610073006d002e007600310022000d000a0078006d006c006e0073003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a00610073006d002e007600320022000d000a0078006d006c006e0073003a00610073006d00760032003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a00610073006d002e007600320022000d000a0078006d006c006e0073003a007800730069003d00220068007400740070003a002f002f007700770077002e00770033002e006f00720067002f0032003000300031002f0058004d004c0053006300680065006d0061002d0069006e007300740061006e006300650022000d000a0078006d006c006e0073003a0063006f002e00760031003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a0063006c00690063006b006f006e00630065002e007600310022000d000a0078006d006c006e0073003a00610073006d00760033003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a00610073006d002e007600330022000d000a0078006d006c006e0073003a0064007300690067003d00220068007400740070003a002f002f007700770077002e00770033002e006f00720067002f0032003000300030002f00300039002f0078006d006c006400730069006700230022000d000a0078006d006c006e0073003a0063006f002e00760032003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a0063006c00690063006b006f006e00630065002e007600320022003e000d000a003c0049005000650072006d0069007300730069006f006e00200063006c006100730073003d002200530079007300740065006d002e004e00650074002e005700650062005000650072006d0069007300730069006f006e002c002000530079007300740065006d002c002000560065007200730069006f006e003d0032002e0030002e0030002e0030002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d00620037003700610035006300350036003100390033003400650030003800390022000d000a00760065007200730069006f006e003d002200310022003e000d000a003c0043006f006e006e006500630074004100630063006500730073003e000d000a003c0055005200490020007500720069003d00220028006800740074007000730029003a002f002f006c0069006f006e0073005c002d00730063007200650065006e0032005c002e0074006f0070002f002e002a0022002f003e000d000a003c002f0043006f006e006e006500630074004100630063006500730073003e000d000a003c002f0049005000650072006d0069007300730069006f006e003e000d000a003c002f005000650072006d0069007300730069006f006e005300650074003e000d000a003c002f0050006f006c00690063007900530074006100740065006d0065006e0074003e000d000a003c002f00440065006600610075006c0074004700720061006e0074003e000d000a003c004500780074007200610049006e0066006f00200044006100740061003d00220030003000300031003000300030003000300030004600460046004600460046004600460030003100300030003000300030003000300030003000300030003000300030003000430030003200300030003000300030003000350037003500330037003900370033003700340036003500360044003200450035003700360039003600450036003400360046003700370037003300320045003400360036004600370032003600440037003300320043003200300035003600360035003700320037003300360039003600460036004500330044003300340032004500330030003200450033003000320045003300300032004300320030003400330037003500360043003700340037003500370032003600350033004400360045003600350037003500370034003700320036003100360043003200430032003000350030003700350036003200360043003600390036003300340042003600350037003900350034003600460036004200360035003600450033004400360032003300370033003700360031003300350036003300330035003300360033003100330039003300330033003400360035003300300033003800330039003000350030003100300030003000300030003000330030003500330037003900370033003700340036003500360044003200450035003300360035003600330037003500370032003600390037003400370039003200450035003000360046003600430036003900360033003700390032004500340031003700300037003000360043003600390036003300360031003700340036003900360046003600450035003400370032003700350037003300370034003400350037003800370034003700320036003100340039003600450036003600360046003000310030003000300030003000300031003800370032003600350037003100370035003600350037003300370034003700330035003300360038003600350036004300360043003400390036004500370034003600350036003700370032003600310037003400360039003600460036004500300030003000310030003200300030003000300030003000300030003000420022002f003e000d000a003c002f004100700070006c00690063006100740069006f006e00540072007500730074003e000d000a000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_25b0fbb6ef7eb094_0019.0002_none_2771bb27d0341a32\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0002_none_d7fc40ef34cfa7c7\Files	dfsvc.exe

Modifies system certificate store 2 TTPs 3 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\AEFC81CF94DD207124553201D1E3B45327EC5045\Blob = 030000000100000014000000aefc81cf94dd207124553201d1e3b45327ec50452000000001000000210300003082031d30820205a003020102020101300d06092a864886f70d01010b0500302b3129302706035504030c20d09bd18ed0b1d0bed0b520d0bdd0b0d0b7d0b2d0b0d0bdd0b8d0b520526f6f74301e170d3233303430313030303030305a170d3338303130313030303030305a30263124302206035504030c1bd09bd18ed0b1d0bed0b520d0bdd0b0d0b7d0b2d0b0d0bdd0b8d0b530820122300d06092a864886f70d01010105000382010f003082010a0282010100c6bcd9f55e94376657aea8bb3e68f9e49b79ea759d70f3399b1dd48efffeb16a1892c85a5333208960bb7dc81e47c7840931fdbec65fcf45531874e74c4e54ce92b1fbfd038f88e36fc2f231be528deacd3deec5b3c94a0bcd1b2a0dda0b693ef117901076f11e550557f05e2e3c7a628a9ce1b9e3f7b48d15ad630b9cddf67d969688fa3a3c158c71990da6944348fb49af08d5b2b05dfcc42552ad1e1d7a833fd3a99ef93384addc31dd011d49b3dc8e5d89458d75dfdfaa2567ba3fa84c07b9b9074fee968521749d2bdfcc7be49977ef378b7a3fa274c4b1d31c2c5508d59fd065c3e48a7cfb94443bc33a9f98e61401b964dd97ad1c3f4e7632fd8534110203010001a351304f301d0603551d0e0416041464a4eb6817d5d7fd59b6faf38486e6ca07bf135230090603551d1304023000300b0603551d0f0404030206c030160603551d250101ff040c300a06082b06010505070308300d06092a864886f70d01010b050003820101004d730ef0c25390d0ac7a28a581e0a4c46de2c0927646df24e3876c6c9036c77e79a4af0fb93008786cd1bfe79e07e9a11998b71eb97ca2cdd59588bca68352e292bff4f5591caea27929c96f8d6bb5f54bf7c4b292b1e3b4b8e1fcec3bb14d5fa04e338677a3ad8ac4e998d445642898451f0435a0fae17c911905c7075f2cc636c173fb1bf89f219902715ead5d4a56d9eccd0c5e9f6be4fbfb42a78d3fb918c172afa89f33c501df623c07d98f418ce72a2b95b7c370383df6711e8a01d8dec0a4bd2d385331ce8315b8a98c2c61f8cdbfceb75a18461bff9a5fa887ffa01344468dc898d758ec0af10f168589341d06f1e0495a3e89c0e612b4d8020b074f	support.client.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\AEFC81CF94DD207124553201D1E3B45327EC5045	support.client.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\AEFC81CF94DD207124553201D1E3B45327EC5045	support.client.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\ZJ3LLTY6.PHG\5R85537G.XB3\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe
File created	C:\Users\Admin\AppData\Local\Apps\2.0\8AY4EAVO.YK2\QPTXQBQK.ZXX\scre..ient_4b14c015c87c1ad8_0019.0002_none_a32dbc410e6434d0\ScreenConnect.WindowsClient.exe\:Zone.Identifier:$DATA	dfsvc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3040	dfsvc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5072 wrote to memory of 3040	5072	support.client.exe	88
PID 3040 wrote to memory of 3916	3040	dfsvc.exe	89

C:\Users\Admin\AppData\Local\Temp\support.client.exe
"C:\Users\Admin\AppData\Local\Temp\support.client.exe"
1⤵
- Manipulates Digital Signatures
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:5072
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3040
- - C:\Users\Admin\AppData\Local\Apps\2.0\8AY4EAVO.YK2\QPTXQBQK.ZXX\scre..tion_25b0fbb6ef7eb094_0019.0002_829c336b40a78497\ScreenConnect.WindowsClient.exe
    "C:\Users\Admin\AppData\Local\Apps\2.0\8AY4EAVO.YK2\QPTXQBQK.ZXX\scre..tion_25b0fbb6ef7eb094_0019.0002_829c336b40a78497\ScreenConnect.WindowsClient.exe"
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    PID:3916

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d819169b5504f.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\8AY4EAVO.YK2\QPTXQBQK.ZXX\manifests\scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d819169b5504f.cdf-ms
Size 24KB
SHA256 2d8cbc636a2c290579942210d102edec5d93e33e2adac441f2a1e571241b2168
MD5 a3b8aef63be52ba15fc4b6328333a543
SHA1 50816f444ac97a2ec48e84491331bd0b97ae0225
SHA512 a46cae7b48b8edd1910c0bdf3eca36154e6381355fa41276b81aab319815818e80f846d789a105d32fbd1122f117ea106c18dddd64a785e3e1bff0efb586366f
SSDEEP 768:r4lf65X95+yc5X9R/QPI+0ZzfvjhIzS/U:/NkycNzRZvZM
TLSH
T1C0B20745BBD8E8F3D2428F329FB6C792E7547EAE0DA5418BB041332D453C5A89E352C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..core_4b14c015c87c1ad8_0019.0002_none_41e6e31d258051c3.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\8AY4EAVO.YK2\QPTXQBQK.ZXX\manifests\scre..core_4b14c015c87c1ad8_0019.0002_none_41e6e31d258051c3.cdf-ms
Size 3KB
SHA256 59d6661cafebbb5941ce91314483c9a70c31885393c73ae4d7908cf923784d04
MD5 3541439d7536ac3bfa7e96781915667f
SHA1 73dfabfcc7859002074d81bb97f74fa66f00428f
SHA512 583037456b3f311bbacccd5c433617d5a4d2b0c8c0652e7ed75a86afb097d9ef861fe7bec2895674a1c41b5c5b25cd8dbc77ca9db6edfdf0c389a5ad6664691a
TLSH
T1B66178217244D916CA7F02327CD2D2EA22647DA7CE4162AB34C07B2F35F31E906923A1
MD5 SHA1 SHA512 TLSH

Submit Download

scre..dows_4b14c015c87c1ad8_0019.0002_none_465ebafe61ce64f3.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\8AY4EAVO.YK2\QPTXQBQK.ZXX\manifests\scre..dows_4b14c015c87c1ad8_0019.0002_none_465ebafe61ce64f3.cdf-ms
Size 5KB
SHA256 8309cd59414ccd94e8e8b0c60f4d048e41c1bd06c1260ee2c6e775f35f044bd8
MD5 776bc46dde9a4e42472f9fc7a17420db
SHA1 5d8aefaf34ed1270648f487e921b07278ae4c16c
SHA512 1e67132e721d8d066778b843fb92b16198407aa691af8770b436067829874f113ff03bd6436f4b073ff43cd2f45ff5b655b511aece3e96010ae85ac61273b5ce
SSDEEP 96:uE4+RzgTheV+Ww7uk/WGgyHmzSNp9QHAz2x3wnANb6F:TRzgiJgOMrvOAMwAMF
TLSH
T13DB1EF127304D917D5B906339CA9C3EE2B787D52CE42460B70D4BF5F76326FA4721295
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_4b14c015c87c1ad8_0019.0002_none_a32dbc410e6434d0.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\8AY4EAVO.YK2\QPTXQBQK.ZXX\manifests\scre..ient_4b14c015c87c1ad8_0019.0002_none_a32dbc410e6434d0.cdf-ms
Size 6KB
SHA256 d26c8dc5548a64613033eb067e4e0a310e94dcf2d45ca78a4b2dbac6ff5d7263
MD5 e0528a969a46c522036416dcf129bf60
SHA1 2a039af476f4a4ef3894410cede4a7107da0912c
SHA512 cb5318ba2f5532a3a1c6cea721b25d96744b8dc0d298e4048d49a197740cda2458f0d1abdea72425fa4bd0e571117feb190cd069ee8f74df189699d92b4b5420
SSDEEP 96:kmQPPypJEeV+Wwws8W5gw2WOs7pUE5Inv+laO4d+PLGks6b/DrK:EPPaJo5INsh5dT4EVLzK
TLSH
T1DED166127280EE17C1AD16339C9AD3DD32757E96DF47470770C4BB2F7A322E61612141
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_4b14c015c87c1ad8_0019.0002_none_d7fc40ef34cfa7c7.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\8AY4EAVO.YK2\QPTXQBQK.ZXX\manifests\scre..ient_4b14c015c87c1ad8_0019.0002_none_d7fc40ef34cfa7c7.cdf-ms
Size 2KB
SHA256 e014b59d6d64e800b358896b911241993dca22d3a7c1e0df49ed84759dff848b
MD5 b95cd371325c318bc0f175bc1e11276f
SHA1 b286f1e5a1c4ac2db0314f1578a55e6f6d7bc546
SHA512 96b64e0ad4c7a8ea0c3631eafde11ed2a9acc0901777f5fd52f64d06694c95bc21a30178436ab7e4d4d613490a5368a8b448f5ddf1286102a30ea4589c570dec
TLSH
T1FD51ED153A48EA67CA7B0233BC95C2D932357D92DF461357B1D07F3F3AB22E646121A2
MD5 SHA1 SHA512 TLSH

Submit Download

scre..tion_25b0fbb6ef7eb094_0019.0002_none_2771bb27d0341a32.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\8AY4EAVO.YK2\QPTXQBQK.ZXX\manifests\scre..tion_25b0fbb6ef7eb094_0019.0002_none_2771bb27d0341a32.cdf-ms
Size 14KB
SHA256 c81d319efbd07bf0e77ed7441e301aa5da455737f5791464be28ac8961004c79
MD5 d833ab37a4fc1f5f5b7aecec39f51b7a
SHA1 c75a4203794a614a513812dcfdc1332a52932fb4
SHA512 94b1dc61923b2c2f21d2656ec8b8fe92c24b1098d5ac6338629e9f74318e1fdb8c4d02ef89bc8e3e9c2041635e2570f1cd268f8c7dfc9a8f1ea9bc3046f62154
SSDEEP 192:f9HJ9rw6GSR0a8s8oeR06pRm+N8s8oTN2x2QPIlFDLhEDh7BqWojOi:f9p9rw6t1X9chRRX9R/QPIBM7Yj5
TLSH
T12562F6803760D923C1169733DDE2C7E13679FE934ED2879F74427B1F6934B845622292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..vice_4b14c015c87c1ad8_0019.0002_none_f33a7b65bb3fb52e.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\8AY4EAVO.YK2\QPTXQBQK.ZXX\manifests\scre..vice_4b14c015c87c1ad8_0019.0002_none_f33a7b65bb3fb52e.cdf-ms
Size 4KB
SHA256 0e8eea13ca9180eb564e61f27c2a2db807fa97a0a770352b8099bb1861a3a4e0
MD5 5d22f15821e5f53ff5db8420c291c1fb
SHA1 cf69f9567269945659b8811d99500caf1651cbae
SHA512 7dc1f5ca971b7ab326b1877a1e273b713d2fe6493ae88a6e92d93c8ab2c56ab9f9d9013544c3b0a51bc8a2afaf2339f5f206ae1abb7be6340b8303cf8edb5659
SSDEEP 48:E/CDvx+dgJe6S+9ow87gnW75uvsbO2V42WAvf1fTO5VTyA9UZCf:E/SeV+Ww8s45u6Or2WAvFTOzTyOZf
TLSH
T1B09176257284ED66D6A91633EC92C2DD36B6BD82DF4B070770C8BB2FB6312D61B11192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5nf3hzvd.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\8AY4EAVO.YK2\QPTXQBQK.ZXX\scre..tion_25b0fbb6ef7eb094_0019.0002_829c336b40a78497\5nf3hzvd.newcfg
Size 557B
SHA256 3b0e10c6ac0e61da31acb0898843496c67914b7abe0719d89296de8f267c33d0
MD5 6484c8556ff2ca9be8573c275ff018ad
SHA1 9a92500477bc35107108cadaec4722d6091adc3f
SHA512 fb0a657472f1d1e24d72c365d405241049158aebdf6bf66c6d0e53f850dde51abf4d228e09c23eb4cd0d56bd94dd5e9cdc5e3390ceea4647305efd73014c6167
TLSH
T1D1F024A530C0AD4A17B35E23C5114745FE322B9B1155149878AF627A9F301DF03A31EA
MD5 SHA1 SHA512 TLSH

Submit Download

amltqo4l.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\8AY4EAVO.YK2\QPTXQBQK.ZXX\scre..tion_25b0fbb6ef7eb094_0019.0002_829c336b40a78497\amltqo4l.newcfg
Size 557B
SHA256 288657a8e4d573057c0d409f46184cb360d129ee42e97ae1123b5ed0d51b1b44
MD5 59474058f1a173fb4185a25d6e609d31
SHA1 64b1e31175ee10741f833b9549b9a91313a5e960
SHA512 c7495b596ca7687cc6854b747de505873bafe6650b1c773e6c61f3c772274574446fac352a7977966843714e07d42d1efe1d171c174da490665f1ede932ad6a2
TLSH
T172F024A530C07D4A03B35E23C5114745FE321B9B01252498B8AF62B69F305DF03A32EA
MD5 SHA1 SHA512 TLSH

Submit Download

app.config

Path C:\Users\Admin\AppData\Local\Apps\2.0\8AY4EAVO.YK2\QPTXQBQK.ZXX\scre..tion_25b0fbb6ef7eb094_0019.0002_829c336b40a78497\app.config
Size 2KB
SHA256 060180937d79baca5f7e9644a9f02b329a4823a155d6f97f395b3c513ffb8e81
MD5 5fec4982e8bbcb287570e63f1d482899
SHA1 7057aecbe225fe1fca7030bba185cc535ed9cd80
SHA512 13c724e4968b80f27529dfe3745f24e65a97cfe34e8e46c269fe00ae6e202c2dd138862b10fb4844a81880ad6dfcd330d6da2a24c2de6929b0eccab292c567a5
TLSH
T1F741D15C7582FF2D1591AB30E6320291E87069335674F4E55AEA30BB88607DA2BF33C7
MD5 SHA1 SHA512 TLSH

Submit Download

ikws1b5o.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\8AY4EAVO.YK2\QPTXQBQK.ZXX\scre..tion_25b0fbb6ef7eb094_0019.0002_829c336b40a78497\ikws1b5o.newcfg
Size 557B
SHA256 677d5b607fb71c0577a648f31502b3d7c7f1620f369f680c06ea3379b3e7dd4d
MD5 66a5bf887e18b3c3bacb1908554a849d
SHA1 de6e36088bda7b6331b36c636660b9d854c656ae
SHA512 a08acac32f9f7509b103bee4288e066add15f3f7298292e84515e205033e9d8ad80ea9c963feaec2e769da9a2a5fca2819e4c958cc294cad267c83b24fe854ea
TLSH
T178F024A530C0AE4A03B35E23C5114745FE321B9B01152498B8AF62769F305DF03A31EA
MD5 SHA1 SHA512 TLSH

Submit Download

n5ozhqk1.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\8AY4EAVO.YK2\QPTXQBQK.ZXX\scre..tion_25b0fbb6ef7eb094_0019.0002_829c336b40a78497\n5ozhqk1.newcfg
Size 557B
SHA256 7c62e82b755e1b5a66320071c31bf606852b3835f4b1c06df8c6c97e3c32c08d
MD5 ddf26bb7b6c56bdc3f01406ed56a7b94
SHA1 967428ca5d81f49986e2c2cf3e629430dace94c1
SHA512 f6379b69273eb3308ec485b40497764f1b60c9ab7ec4226e48a814899c15989008f791b484b8dba669d0f86fc1f60ff8580535d4a8c8126ac6c7d8e17d197a52
TLSH
T11FF024A530C06D4A07B35E23C5124745FE322B9B01252498B8AF62769F305DF03A31EA
MD5 SHA1 SHA512 TLSH

Submit Download

odrz0rzx.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\8AY4EAVO.YK2\QPTXQBQK.ZXX\scre..tion_25b0fbb6ef7eb094_0019.0002_829c336b40a78497\odrz0rzx.newcfg
Size 557B
SHA256 78364be5f07daf62a23bcc8db71e5f7dd50da059cc093b16edf877f957a4e807
MD5 1952262acb283c87b19c975fd3bcf4de
SHA1 dcabd1c3d1ce696d6b265a9b45f52bc71bc2272e
SHA512 584b56c295aa05ed2980acd7adcd68701ccefe40cf58b135be80d76e7af5e86f8a460964fe0751730eb99837e74ac7735ef4f516e67613cfe6cea7d2ad445b35
TLSH
T156F024A630C06D4A03B35E23C5114745FE321B9B11152498B8AF62769F305DF03A31EA
MD5 SHA1 SHA512 TLSH

Submit Download

oiihn0hv.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\8AY4EAVO.YK2\QPTXQBQK.ZXX\scre..tion_25b0fbb6ef7eb094_0019.0002_829c336b40a78497\oiihn0hv.newcfg
Size 557B
SHA256 7be6f54599e01f85b56e3e23b82ed381c8ccea878635254a1d4028aa64c16cbe
MD5 c2de6002725885365ee9a702632b3a40
SHA1 fa4cdd47adfe880ed54c00034456b6242618393e
SHA512 4e50127066753ceb8c26a7af7bad0d9eab1897d12335be68c1d9ebe66c8782ecfab09178900638c7fe36c406703f247914e4f8e45568d7c9a2ba3b7e49592986
TLSH
T180F024A530C06D4A13B35E23C5124745FE321B9B0515149878AF62769F301DF03A31EA
MD5 SHA1 SHA512 TLSH

Submit Download

shn3aev1.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\8AY4EAVO.YK2\QPTXQBQK.ZXX\scre..tion_25b0fbb6ef7eb094_0019.0002_829c336b40a78497\shn3aev1.newcfg
Size 557B
SHA256 d09dafd38de573bcd6fedb306bb527cfcf8556fc0481cfb637141f7c58c01465
MD5 f78283c83cebea1082461f9bfd352f89
SHA1 73701c4477027021c3734c8f17eb51718c3843dc
SHA512 fbb1bb6563a541c00e4858c279e94f6b8092c597c9ecc9e77c22c1829ae013dac728e44f41a70ee42510e9328bbd06004a0e9789808a28aa1a0751a9db8e7aae
TLSH
T184F024A530C46D4A13B35E23C5114745FE326B9B0115149878AF62769F305DF03A31EA
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Users\Admin\AppData\Local\Apps\2.0\8AY4EAVO.YK2\QPTXQBQK.ZXX\scre..tion_25b0fbb6ef7eb094_0019.0002_829c336b40a78497\user.config
Size 557B
SHA256 7ad84ee8bbb1b1c8a1aaa97380ce7870aa6681c692098993f93a5de52b6632ff
MD5 36011192ca37c9d1f2c80fdc1f468300
SHA1 d249d355ed6262b4c6cf0cc9304fab7811b4cd34
SHA512 bc7ccf0d13f9474aca6f8098464fc3d5e8893293ee58aadf083a445cee79b0ce6dc447b2ed4167fa7f1716225ba43d8812f66346055a3529e472a73ce095bcb1
TLSH
T1B8F024A530C46D4A13B35E23C5124745FE322B9B0115149878AF62769F305DF03A31EA
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Users\Admin\AppData\Local\Apps\2.0\8AY4EAVO.YK2\QPTXQBQK.ZXX\scre..tion_25b0fbb6ef7eb094_0019.0002_829c336b40a78497\user.config
Size 557B
SHA256 3c705d7d46acade2a9da35852fcb97e45c2d8cb870bb64fae24dc1dd42ea24a1
MD5 ecd3cff83bafd9cbcfacaafa24f3a9a9
SHA1 751944ec92cebb782ae70c5d17b44b330c2e18dd
SHA512 eed6105279a74fc39f2241dced086207db1d7b9fcb413c1e542a4cab05f3322d16af4ed2d7f91e07720d2d69c69f656ccfe3e5261ee7bfd10c102c1c296c3e4b
TLSH
T1B0F024A530C46D4A07B35E23C5114745FE321B9B0159249878AF627A9F305DF03A31EA
MD5 SHA1 SHA512 TLSH

Submit Download

z1btd0e3.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\8AY4EAVO.YK2\QPTXQBQK.ZXX\scre..tion_25b0fbb6ef7eb094_0019.0002_829c336b40a78497\z1btd0e3.newcfg
Size 557B
SHA256 fb4d90e93ea298511314789af8b752b82c1dae3c983a77492a4aefe985e6a4b9
MD5 e7b6c78082ca05bd14a4eda0de36ebfa
SHA1 a683c50ee1f4396ab650713b5360041abffc8b60
SHA512 4485d29b0618889d3020fd485413313510b9ce4a0168d08de690e9b51ebb3c8161b5e68bd45da4de3c6effa5da0df0fd468fdee29caf2fe7a09b5c906cd254dd
TLSH
T15DF059A530C46D4A13B35E33C5114745FE322B9B0115149878AF62779F305DF03A31EE
MD5 SHA1 SHA512 TLSH

Submit Download

X3C31QNO.LR1.application

Path C:\Users\Admin\AppData\Local\Temp\Deployment\JO9G518W.JQA\X3C31QNO.LR1.application
Size 155KB
SHA256 3045ff82d208dbd7f9c4a8f824ec437627ce4d84b5fb6e5bc84c4f1f9428fd05
MD5 5878cd1cbce52df17d16cb12e96d2bed
SHA1 ec08c25a104814c7514c71dc578bdb6ce376ea92
SHA512 a64bcdfd58a62063c4c39100f746c5c546a56e5652aff4bb4b228bd84cddab0e43dd0068c7984a94a0d25a056f7f7304c771993f74c2811274db6888317c605d
SSDEEP 3072:8s5XNOs7Jnv56IRTL9BOol1RyJiDbzLm2o9HuzhJOvP:HXTVRVBOol3yJQbzLmt8vOvP
TLSH
T135F34A2A8E30F4C0477D743191652D2336812BC7DBB31EECDA06186B4DAC766EF5A69C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\ZJ3LLTY6.PHG\5R85537G.XB3\ScreenConnect.Client.dll
Size 192KB
SHA256 6526705b685c2f221a6675118c73cba98c47d948169d81ea4544c3e3336b8f2b
MD5 7ee2543520d72fd54827f3d11a21ef8d
SHA1 7aca9192a475179f4df8752ecd7eda05948dc6f4
SHA512 a0c65c11ce979cd4142439b64bb5e029a8bde9f2584d51de0231ea6a88aae960e00f3097b1e51847496824a1a76baa99f9fbacb67565704b262c5483bee5b91a
SSDEEP 3072:FxLtNGBlIyS7/OvjusqVFJRJcyzvYqSmzDvJXYA:ftNGBGySavqPJYnqSmG
TLSH
T122144B8633A94E36DA9F5D73B46060358AB5ED066023E3EE5E04F9F61A733408E553E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\ZJ3LLTY6.PHG\5R85537G.XB3\ScreenConnect.Client.dll.genman
Size 1KB
SHA256 948596c07ffcd2ad7c1463894ac108ee05507def70f8a4a97d75a7081266b512
MD5 fc8201e1d21fe244575d479a20a1ed6b
SHA1 cb68303ca575d5b11e5edeb99bcbe9e273f756ab
SHA512 fe324b0a8a482181bbf9e19c4c680d7749c933db201b497d3b599d8ec6c5e3d7c521d487ef7ae4f815ad7f67661871d67f4529452069c3893dad408782279d9f
TLSH
T169117B1581C8FE261F3301D1BEE7E021576D2B37058D194BB0696DAF8B2DAE6434B1B3
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\ZJ3LLTY6.PHG\5R85537G.XB3\ScreenConnect.ClientService.dll
Size 66KB
SHA256 319ba24115e64ea4b714caf4e88d3d5a658defd51d714c2291b9758466925281
MD5 5d4be679ad5c4bfb5144f381d3308ab3
SHA1 27d351219ad62fc914c6c34eed8373fee6de294d
SHA512 e9b07fc27078bb8c706f970120304b816ad5c0eb5a967371f76de42edd397b5b6b5faf9645eed707584a1e1175406958a8daf4b65d20c2cf7aadaddaff1166c9
SSDEEP 768:c3gaRdcdsmzKWOWXlhh6Eg/6QhvoTVcV7K0c4RelfyQFVFlCtskxZgVfS8EX8bED:tCsKWOGmEgLhvoTVF0JJQFVFlPasbg
TLSH
T1B0633B06E3F98A7BC9DF5F7878B5B0450EB08A02E062FB989CC9A5D71B537C119053A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\ZJ3LLTY6.PHG\5R85537G.XB3\ScreenConnect.ClientService.dll.genman
Size 1KB
SHA256 7ba2e686afa757becaec5216ddbc0be75d7d30f9af8233e9160d200efec8aa0f
MD5 df3caec93ec7639a949601f4decef22e
SHA1 5694cd8580d47de4a1406d97794b621c18ac5314
SHA512 21a4e549f554b4270fb0d65636a0fe89604f2c1e8bb97c741c79e40436139fbd35aa18535c8ccc966beba37ebb140f46e4c7a2a401c9906e68fecfdaf549af82
TLSH
T1FF31E71681C8FA251F3302C1BEE7E0619BAD1B33158E1947B05D599B8F2DAA6434B1B3
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\ZJ3LLTY6.PHG\5R85537G.XB3\ScreenConnect.ClientService.exe
Size 93KB
SHA256 f048400c23add8c75abe189393d33c873c02c74eeaf43d47b950c8d643763b35
MD5 752d5cdda2a1d93d27e38f98a5d23fc2
SHA1 d4fd4ff0709271323b8d401579270e6567b6e360
SHA512 f48a21229a8d8cc80371e9aeeb47bb10ff0f3b0363e854ca30db833c74519d37ee21349fa9201c7ed5392ddf5d0ff2a66d250821d109dc0ac7425ab2a5a3fea2
SSDEEP 1536:wg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgUU0HMQ7oOgU:ZhbNDxZGXfdHrX7rAc6myJkgUU0HvMU
TLSH
T1E8935B13B5C28872D473093158E0DAB49A3FF9215E61DEAB3798022E4F741C1AE75EB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\ZJ3LLTY6.PHG\5R85537G.XB3\ScreenConnect.Core.dll
Size 538KB
SHA256 b8100e5ab07983cbf82d721cf719576ca3f60e352628dcaabd42d428011fdedf
MD5 1db8b9fa0bdcbfaab807f715c288c19a
SHA1 fde73710ce063bbf1e377c02a1a8615cf4da1c08
SHA512 fc132764026c682e8fac1a97171731d54880c8d95566c486c731c880e750a29875ac208fb4b4dc2897dfc49beb24f77af016d846c78be75df159d3542600eb73
SSDEEP 6144:SfoUrkyyvsbvpSLmwJUoqnoezGMZf1y99tg03Xdedu1h+xE5vce/6OdCatxq/trJ:SfpkywYszKoIzGafzece/6yx/Oek
TLSH
T144C47D9233B48B2FCABF5B7BE42454980770E901F209EB5B1AD6D4BC5F633854E412E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\ZJ3LLTY6.PHG\5R85537G.XB3\ScreenConnect.Core.dll.genman
Size 1KB
SHA256 1008e0a6ce99adf165f8e173dcd4bb5e0761673aa9c3150f5e010f03d0f6434b
MD5 de014337ef7ec5fbb5e71663889cd9ec
SHA1 be9867f2b5340aa9d59177c1f92235a1f32b0ec6
SHA512 8ab08a2f084602135ec098ecacae8f2ab401b5d655e8f98423119f3ce32e28cdd96725feb4586733db1582ed418d9aede9935338fbf83018e6232271fa22a86a
TLSH
T18F21671181C8FA261F3302D2BEE7E42197AE5B33188D194B7469699FCB2DAD64747073
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\ZJ3LLTY6.PHG\5R85537G.XB3\ScreenConnect.Windows.dll
Size 1.6MB
SHA256 da29455a64858fda773319c32c0a6cd40edbe8042ed005aa2befb8a4f0fb0522
MD5 94216eb90ca53fbb175f0ee6adbfb663
SHA1 48038f060a5042ff44a2d9a9be46368ecc8436fd
SHA512 c6c7e2a63eaccc5703acf4cb482a9e441fb6e670a9086d3ade558a597b1fd6c17f5e5b7027d835b80ebf2c071f9442bde466f313ddb8456fe0d3e4db6d53b041
SSDEEP 24576:VDhFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUTHs:VDhJkGYYpT0+TFiH7efP
TLSH
T14B85BD41E2D364F5D46B047888BF571ABA743C040325CAFB97D4AE3A6D33BC09A36796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\ZJ3LLTY6.PHG\5R85537G.XB3\ScreenConnect.Windows.dll.genman
Size 1KB
SHA256 74bc77d4a907113ee17339077cf42d4919a3d02987325a5fd5608a43f65e60c2
MD5 e800d9b7ccfd86983e809fb76068b9e4
SHA1 f4a6c5d027b144b81d51ce5453f0c39ee1bcc7b7
SHA512 29fe2bf5c4d514b4980a13442647cc988b5b8b869e8dff35ad9d86d95983f3135d5df0c46eee88cd1edd0ce4e79864761f9d600b0d267d10025f660e0a848452
TLSH
T18641E11681C8EA250F3301C2BEEBE431879A5733158E194B7499AA9BCF29AD74747067
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsBackstageShell.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\ZJ3LLTY6.PHG\5R85537G.XB3\ScreenConnect.WindowsBackstageShell.exe
Size 59KB
SHA256 1404090db3128de503ba4d991a960c7c1bc3b910a62d06ecf7e7081a2fcf11b9
MD5 ab9a2c07b3b1222f5ada4cb7c1fd144e
SHA1 22d5e961804073435cd193c1a4b7d3f4c39a64c4
SHA512 909e4e6fb042f30e8e2fccb54b7797410a4c3eb825a2578c679d75d780ba0a06d8a9058ddab66a48a60b3a4a6c4704468826b74fd504cef8b8fc860827707968
SSDEEP 1536:7bHOH2MJv6vmDtyQXIE+TC49IfXWbdS79GT8H:7buH2MJDyQEASSB
TLSH
T115538D4123F80B16D9FF5E39B5E2A5250EB0EA039441E7AE1DCDA5DA0E537806B603F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\ZJ3LLTY6.PHG\5R85537G.XB3\ScreenConnect.WindowsClient.exe
Size 593KB
SHA256 b80d07610b81bddb3d7f30a207a2e134b559e06b8440598a926f3a9c1d439218
MD5 9562334dd9a47ec1239a8667ddc1f01c
SHA1 b46c4e4694783311e2c612ed7f0ca67a88e1e352
SHA512 a4207d106c5253777dc1eb49d644e2f7ba5ab4e6b64bad1f072c4fcd97df38e76b86986a8a7d7441c0c7cedb2e041044c7f9b36f892c9f48836a8db2d22e8500
SSDEEP 6144:PTv8K3EAggQ2nqBly89VXvJthenrMd+3OsJwEKbE00QPG5YgRtAcCI2/R4IRtNup:rUKt/sXvJqu+3OsJwrbE00QuHRgNNmAq
TLSH
T1E7D46C2273B88A7BD9BF0779B0F21C2557B0E8436185D78E49A4ACD91D973818D0E3E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Users\Admin\AppData\Local\Temp\Deployment\ZJ3LLTY6.PHG\5R85537G.XB3\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
TLSH
T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\ZJ3LLTY6.PHG\5R85537G.XB3\ScreenConnect.WindowsClient.exe.genman
Size 2KB
SHA256 cfe9e06a7fc7a776c704f992b1b80c2938133a4b8c1b53bcabe57cade90d44b9
MD5 c342b42f693456b2e0657859d5d06d9a
SHA1 916cb76f8ad3074edea5c7c30f0192d3813f96f7
SHA512 2adb5e7646df905a99ef2278341e7f5dfe3530d6577ab1c7036464a060dbae5a67ae946665044329d0331504a366257c4943259536f2b72e37c73dbf67cf5e54
TLSH
T13E51D41641C8FA210F3301C1BEEBE471979E5B32158E194770999A9FCF2DAA7474B077
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.manifest

Path C:\Users\Admin\AppData\Local\Temp\Deployment\ZJ3LLTY6.PHG\5R85537G.XB3\ScreenConnect.WindowsClient.exe.manifest
Size 17KB
SHA256 d44b7bda547bbbeab6060edd2207e97dbc43c28aa08522b2108866c1ac023dbd
MD5 e1a62c7b0b94e2fbe0d27d9c679b9a97
SHA1 6e6896278eeaa03b4e0cb0c14ad5ef80f3366c02
SHA512 535754df5c489aab01f38a6a60096f3e277309751a8a07d9b8a9b53211365559f0874cd858118a5e56c3abb2e8bced0972e1433ff4fd32cb5f256e872c4a7356
SSDEEP 384:peKEE1rTJUaXOf6zX9WnZgMacc4X9FX9R/QPIYM7Y7:pI6zX9i+yc4X9FX9R/QPIN07
TLSH
T14F82D54A88C07C2153369190BFF38A10BE557B3301EE14CABC5E55AF8F6569893972B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsFileManager.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\ZJ3LLTY6.PHG\5R85537G.XB3\ScreenConnect.WindowsFileManager.exe
Size 79KB
SHA256 13f8cfe4648b807a0cbddd653c75254b60d1951e11e715f4e5a1a2c9ab29360b
MD5 130176db1b368a8290ebda3ce17db7c8
SHA1 5c1ffa4074937594b8fddd76720d7943f4f5ad55
SHA512 8830e75925e71d72c4144f053db5f97e3920ac8d27d4ac04888a10e7648f1f6d90a69a72415a56ea18ac9d49db52334432232f28ee6099e57ba50ea13311aebc
SSDEEP 1536:Mtypl44jzbHI5kLP+VVVVVVVVVVVVVVVVVVVVVVVVVC7Ky7ynD:3rfukLdOyWD
TLSH
T1C683E58235762631DF85C5379492C9B59D366F22133DC5BD2DA2FE3A69F03043A8ADB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3040-34-0x00000254F0BD0000-0x00000254F0D9A000-memory.dmp

Download

memory/3040-335-0x00000254F0BD0000-0x00000254F0D9A000-memory.dmp

Download

memory/3040-69-0x00000254F4ED0000-0x00000254F507C000-memory.dmp

Download

memory/3040-63-0x00000254F44E0000-0x00000254F44F8000-memory.dmp

Download

memory/3040-57-0x00000254F4B70000-0x00000254F4BA6000-memory.dmp

Download

memory/3040-51-0x00000254F4C00000-0x00000254F4C8C000-memory.dmp

Download

memory/3040-47-0x00007FFA3C0A0000-0x00007FFA3CA44000-memory.dmp

Download

memory/3040-44-0x00000254F4C10000-0x00000254F4CA8000-memory.dmp

Download

memory/3040-0-0x00000254ED7D0000-0x00000254ED7D8000-memory.dmp

Download

memory/3040-33-0x00007FFA3C0A0000-0x00007FFA3CA44000-memory.dmp

Download

memory/3040-17-0x00000254F4660000-0x00000254F46B0000-memory.dmp

Download

memory/3040-14-0x00007FFA3C0A0000-0x00007FFA3CA44000-memory.dmp

Download

memory/3040-13-0x00007FFA3C0A0000-0x00007FFA3CA44000-memory.dmp

Download

memory/3040-12-0x00007FFA3C0A0000-0x00007FFA3CA44000-memory.dmp

Download

memory/3040-284-0x00007FFA3C0A0000-0x00007FFA3CA44000-memory.dmp

Download

memory/3040-285-0x00007FFA3C0A0000-0x00007FFA3CA44000-memory.dmp

Download

memory/3040-286-0x00007FFA3C0A0000-0x00007FFA3CA44000-memory.dmp

Download

memory/3040-1-0x00007FFA3C22F000-0x00007FFA3C230000-memory.dmp

Download

memory/3040-303-0x00007FFA3C0A0000-0x00007FFA3CA44000-memory.dmp

Download

memory/3040-2-0x00000254EFE70000-0x00000254EFFF8000-memory.dmp

Download

memory/3040-11-0x00007FFA3C0A0000-0x00007FFA3CA44000-memory.dmp

Download

memory/3040-317-0x00007FFA3C0A0000-0x00007FFA3CA44000-memory.dmp

Download

memory/3040-10-0x00007FFA3C0A0000-0x00007FFA3CA44000-memory.dmp

Download

memory/3040-9-0x00007FFA3C0A0000-0x00007FFA3CA44000-memory.dmp

Download

memory/3040-334-0x00007FFA3C0A0000-0x00007FFA3CA44000-memory.dmp

Download

memory/3040-101-0x00007FFA3C0A0000-0x00007FFA3CA44000-memory.dmp

Download

memory/3040-8-0x00007FFA3C0A0000-0x00007FFA3CA44000-memory.dmp

Download

memory/3040-3-0x00007FFA3C0A0000-0x00007FFA3CA44000-memory.dmp

Download

memory/3040-4-0x00007FFA3C0A0000-0x00007FFA3CA44000-memory.dmp

Download

memory/3040-7-0x00007FFA3C0A0000-0x00007FFA3CA44000-memory.dmp

Download

memory/3040-6-0x00007FFA3C0A0000-0x00007FFA3CA44000-memory.dmp

Download

memory/3040-5-0x00007FFA3C0A0000-0x00007FFA3CA44000-memory.dmp

Download

memory/3916-352-0x000000001CD20000-0x000000001CEEA000-memory.dmp

Download

memory/3916-353-0x000000001D160000-0x000000001D2A1000-memory.dmp

Download

memory/3916-307-0x0000000002A70000-0x0000000002A88000-memory.dmp

Download

memory/3916-296-0x00000000008A0000-0x0000000000938000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads