c6742350c0b2a1ef0fe7fe3bdf46dce7b43d34230318539810390699980f455c

Analysis

max time kernel
148s
max time network
136s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/06/2026, 17:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
_c6742350c0b2a1ef0fe7fe3bdf46dce7b43d34230318539810390699980f455c.exe
Size 305KB
Sample260623-wekgpsez6w
SHA256 c6742350c0b2a1ef0fe7fe3bdf46dce7b43d34230318539810390699980f455c
MD5 ad8699ff1e37c4939837e21aaa02ecf9
SHA1 4146470ef45ae72591644e2cf97bbbae0d406170
SHA512 a42d2b4a974dd326716b26d54dcdc3327a9b08910a5056c998b5231b2197b08c3d94007afceed62e9ce3aa231aeeda906b6a2f6edab56dcad9df6df3d08ddd72
SSDEEP 6144:1mlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9:A1iw7gryNkSV1hy1Z1u2JLu9
TLSH
T10B647C11B9C48432C673383107B4E2B28DBDB8302D655B8F57A81D7A9F745D0EA29B6F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery revoked_codesign spyware trojan

Malware Config

Signatures

Downloads MZ/PE file 7 IoCs

flow	pid	Process
1	1172	dfsvc.exe
1	1172	dfsvc.exe
1	1172	dfsvc.exe
1	1172	dfsvc.exe
1	1172	dfsvc.exe
1	1172	dfsvc.exe
1	1172	dfsvc.exe

Manipulates Digital Signatures 1 TTPs 4 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Key deleted	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4C2272FBA7A7380F55E2A424E9E624AEE1C14579	_c6742350c0b2a1ef0fe7fe3bdf46dce7b43d34230318539810390699980f455c.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C\Blob = 0300000001000000140000007b0f360b775f76c94a12ca48445aa2d2a875701c2000000001000000b4060000308206b030820498a003020102021008ad40b260d29c4c9f5ecda9bd93aed9300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3231303432393030303030305a170d3336303432383233353935395a3069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e6720525341343039362053484133383420323032312043413130820222300d06092a864886f70d01010105000382020f003082020a0282020100d5b42f42d028ad78b75dd539591bb18842f5338ceb3d819770c5bbc48526309fa48e68d85cf5eb342407e14b4fd37843f417d71edaf9d2d5671a524f0ea157fc8899c191cc81033e4d702464b38de2087d347d4c8057126b439a99f2c53b1ff2efcb475a13a64cb3012025f310d38bb2fb08f08ae09d09c065a7fa98804935873d5119e8902178452ea19f2ce118c21accc5ee93497042328ffbc6ea1cf3656891a24d4c8211485268de10bd14575de8181365c57fb24f852c48a4568435d6f92e9caa0015d137fe1a0694c27cc8ea1b32e6cac2f4a7a3030e74a5af39b6ab6012e3e8d6b9f731e1dcade418a0d8c1234747b3a10f6ea3ab6d9806831bb76a672dd2bd441a9210818fb03b09d7c79b325ac2ff6a60548b49c193ede1b45ce06feb26f98cd5b2f93810e6eace91f5bed3fb6f9361345cbc93452883362a66285fb073ce8b262506b283d45cf615194ced62e05e33f2e8e8ec0aa7b0032b91b23679bef7ad081e75a665ccbbe34850f377911afedb50a246c8615898f57c02163c8328ad3986ecd4b70d53d0f847e675308dec30937614a65b4b5d74614d3f129176debf58cb72102941f0d5c56d267668114113589adc262b01f4894d59db78cf814a3e40475fc98150738510232159608a6454c1cc211ae838197c661ccd78384530994fff634f4cbbaa0d0853417c583d47b3fab6ec8c320902cc6c3c0c56110203010001a38201593082015530120603551d130101ff040830060101ff020100301d0603551d0e041604146837e0ebb63bf85f1186fbfe617b088865f44e42301f0603551d23041830168014ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300e0603551d0f0101ff04040302018630130603551d25040c300a06082b06010505070303307706082b06010505070101046b3069302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304106082b060105050730028635687474703a2f2f636163657274732e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63727430430603551d1f043c303a3038a036a0348632687474703a2f2f63726c332e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63726c301c0603551d20041530133007060567810c01033008060667810c010401300d06092a864886f70d01010c050003820201003a23443d8d0876ee8fbc3a99d356e0021aa5f84834f32cb6e67466f79472b100caaf6c302713129e90449f4bfd9ea37c26d537bc3a5d486d95d53f49f427bb16814550fd9cbdb685e0767e3771cb22f75aaa90cff5936ae3eb20d1d55079889a8a8ac1b6bda148187edcd8801a111918cd61998156f6c9e376e7c4e41b5f43f83e94ff76393d9ed499cf4add28eb5f26a1955848d51afed7273ffd90d17686dd1cb0605cf30da8eee089a1bd39e1384eda6ebb369dfbe521535ac3cae96af1a23edb43b833c84f38149299f5ddce546dd95d02141f40337c03e295b2c221757352cb46d8c4341ca2a54b8dcd6f76372c853f1ace26e918be9007b0437f9588208270f0cccaeffd29355c1f893855f7378a8b09a1cb0be9311aff2e195c3971e1be9ca70a06d62667b792e64e5fde7aac49cf2ea47492addb3ca49c861fe3c1561b2b23ff8fb5ea887b706be6a0bafd3a3f45a6c4e81691528b41c048844b964dab4440e38df01528ceedf11856072a2f10c40c08643c338fae288c3ccb8f880b0dbf3bf4ce1e7b8eefb5ebcbb7f07713e6e7283fac12aea52f226c41f9825c1566cc6c0ecac586c3f626330c074ba0d307026a6a4030484b34a85120bbad1b8508e2590d6dca05502bea4a1c9ea5fda0a71f0674e7f2d65290fdaf854821f9573bb49c03ed8645f4b4616ebf68e2266086eac8afa9fe941de7631b3a8656784e	_c6742350c0b2a1ef0fe7fe3bdf46dce7b43d34230318539810390699980f455c.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4C2272FBA7A7380F55E2A424E9E624AEE1C14579\Blob = 0300000001000000140000004c2272fba7a7380f55e2a424e9e624aee1c145792000000001000000640700003082076030820548a00302010202100b9360051bccf66642998998d5ba97ce300d06092a864886f70d01010b05003069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e67205253413430393620534841333834203230323120434131301e170d3232303831373030303030305a170d3235303831353233353935395a3065310b30090603550406130255533110300e06035504081307466c6f72696461310e300c0603550407130554616d706131193017060355040a1310436f6e6e656374776973652c204c4c433119301706035504031310436f6e6e656374776973652c204c4c4330820222300d06092a864886f70d01010105000382020f003082020a0282020100ec489826d08d2c6de21b3cd3676db1e0e50cb1ff75ff564e9741f9574aa3640aa8297294a05b4db68abd0760b6b05b50ce92ff42a4e390be776a43e9961c722f6b3a4d5c880bcc6a61b4026f9137d36b2b7e9b86055876b9fa860dbcb164fe7f4b5b9de4799ae4e02dc1f0bee01e5d032933a2827388f8db0b482e76c441b1bd50909ef2023e1fb62196c994ce052266b28cd89253e6416044133139764db5fc45702529536bf82c775f9ec81fa27dc409530325f40cdef95b81b9ce0d42791cee72e7bd1b36c257b52257c65a28970e457513989434bfc239e2992b193e1b3cc3f11ccdd1d26d4ec9845099ab913906a42069af999c0071169b45a2ea1aa666f1904e8acb05e1823a359a291fd46b4ef7aed5935bb6ab17ebf077210726930c90f01761d6544a94e8fa614cc41d817eec734b1c3d3afb7c58fb256f0c09edc1459bddbff9940ed1958570265d67af79a9b6a16affd70fc6328c9810d5dc186e39af6fbcad49a270f237e6bcd5de0bc014bc3179cd79776591340311a42ca94f33416c2e01b59bd1d71de86ace6716bc90b2d7695d155039aa08fbac19a4d93fb784230a20a485287a16355645fc09142c602d140fa046b7bfd75328184ff7bdf8f9e0d65e6201c8d242931047f59bd328ac353777ccefa60408887b84fc3631301463461a1d73c0b5cc74d6d82905ddf923bdbab027a311cc38d3fa16f639a50203010001a382020630820202301f0603551d230418301680146837e0ebb63bf85f1186fbfe617b088865f44e42301d0603551d0e04160414338ce10a6e06d9c6ed0bc6cae736cefb8188646a300e0603551d0f0101ff04040302078030130603551d25040c300a06082b060105050703033081b50603551d1f0481ad3081aa3053a051a04f864d687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c3053a051a04f864d687474703a2f2f63726c342e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c303e0603551d20043730353033060667810c0104013029302706082b06010505070201161b687474703a2f2f7777772e64696769636572742e636f6d2f43505330819406082b06010505070101048187308184302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d305c06082b060105050730028650687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e637274300c0603551d130101ff04023000300d06092a864886f70d01010b050003820201000ad79f00cf4984864c8981ecce8718aa875647f6a74608c968e16568c7aa9d711ed7341676038067f01330c91621b27a2a8894c4108c268162a31f13f9757a7d6bb3c6f19bf27c3a29896d712d85873627d827cd6471761444fabf1d31e903f791143c5b4ce5e7444aacba36d759aeba3069d195226755cbc675aa747f77596c53c96e083c45bba24479d6845eea9f2b28ba29b4dcf0bcf14aa4ce176c24e2c1b8fec3ee16e1c086db6fda97388859e83be65c03f701395b78b842c6dd1533ef642cca6fe50f6337d3f2dfedd8b28f2b28e0c98edd2151392e7cc75489f48859f1de14c81b306eb50eed7bb78be30eaada76767c4ca523a11eec5a2372d6122926ab1801a6a6778e9504791487ee47d4577154988802070f80fc535957658f954cd083546c5afb5a6567b6761275f5db20f70ab86feef94c7cfc65369d325121b69a82399bc7dc1962416f0f05cf1eee64d495a3527e464e2c68da0187093f97b673e43dddbcc067e00713f1565fcff8c3772d44b40a04e600644f22a990345f9a6b5b52963e82c81a0ce91d43a230f67b37d8debda40ea3d59d305e18adc1976516c12a8ba2bca24143b12e9527b4dca58872aa9b3a8c6ac563fc2dc02bf51be889516d35a4ba9d062417b5bdcc50ba945fae26b60d6aec03984798a6a21d3ff793cc0849e81ed55b8027411c50db776ae8feef2fdc2dafb04345261dedc054	_c6742350c0b2a1ef0fe7fe3bdf46dce7b43d34230318539810390699980f455c.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C	_c6742350c0b2a1ef0fe7fe3bdf46dce7b43d34230318539810390699980f455c.exe

Signed with revoked ConnectWise certificate 4 IoCs

Binary is signed using a ConnectWise certificate revoked for key compromise.

revoked_codesign

resource	yara_rule
behavioral2/files/0x000c00000001c65b-45.dat	revoked_cert_connectwise
behavioral2/files/0x000c00000001c655-199.dat	revoked_cert_connectwise
behavioral2/files/0x000c00000001c656-198.dat	revoked_cert_connectwise
behavioral2/files/0x000c00000001c65a-194.dat	revoked_cert_connectwise

Executes dropped EXE 1 IoCs

pid	Process
4620	ScreenConnect.WindowsClient.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\L5ZNT99Z.TQ2\LJ0B6QJ3.B63\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	_c6742350c0b2a1ef0fe7fe3bdf46dce7b43d34230318539810390699980f455c.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dfsvc.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_25b0fbb6ef7eb094_0019.0002_none_2771bb27d0341a32\lock!10000000a3b1590e0c12000004120000000000000000000 = 30303030313230632c30316464303333386335356137333730	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_4b14c015c87c1ad8_0019.0002_none_f33a7b65bb3fb52e\identity = 53637265656e436f6e6e6563742e436c69656e74536572766963652c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d819169b5504f\SizeOfStronglyNamedComponent = c04f040000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d819169b5504f\Files\ScreenConnect.WindowsFileManager.exe_0e21 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0019.0002_c4d6b089263ee444\scre..ient_4b14c015c87c1ad8_0019.0002_none_d7fc40ef3	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_4b14c015c87c1ad8_0019.0002_none_f33a7b65bb3fb52e	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Software	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\Gc_scre..tion_095449486fb1eb1f\LastRunVersion = 687474703a2f2f34352e36312e3133352e3131302f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Software	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d819169b5504f\lock!0100000070af590e94040000c4120000000000000000000 = 30303030303439342c30316464303333386261313364663364	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0019.0002_none_a32dbc410e6434d0\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_25b0fbb6ef7eb094_0019.0002_none_2771bb27d0341a32	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\F_scre..tion_25b0fbb6ef7eb094_512f0c29fb3d297e\LastRunVersion = 687474703a2f2f34352e36312e3133352e3131302f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}\scre..tion_25b0fbb6ef7eb = 687474703a2f2f34352e36312e3133352e3131302f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Categories	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Installations	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_4b14c015c87c1ad8_0019.0002_none_f33a7b65bb3fb52e\implication!scre..tion_25b0fbb6ef7eb094_0019.0002_22 = 687474703a2f2f34352e36312e3133352e3131302f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0019.0002_none_a32dbc410e6434d0	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0002_none_d7fc40ef34cfa7c7\DigestMethod = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_4b14c015c87c1ad8_0019.0002_none_f33a7b65bb3fb52e\SizeOfStronglyNamedComponent = ac21010000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_4b14c015c87c1ad8_0019.0002_none_41e6e31d258051c3\lock!0e0000001cb0590e94040000c4120000000000000000000 = 30303030303439342c30316464303333386261313364663364	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0019.0002_none_d7fc40ef34cfa7c7\lock!080000001cb0590e94040000c4120000000000000000000 = 30303030303439342c30316464303333386261313364663364	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_4b14c015c87c1ad8_0019.0002_none_f33a7b65bb3fb52e\lock!0e00000093b1590e0c12000004120000000000000000000 = 30303030313230632c30316464303333386335356137333730	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_4b14c015c87c1ad8_0019.0002_none_41e6e31d258051c3\identity = 53637265656e436f6e6e6563742e436f72652c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0019.0002_c4d6b089263ee444\scre..core_4b14c015c87c1ad8_0019.0002_none_41e6e31d2 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_4b14c015c87c1ad8_0019.0002_none_f33a7b65bb3fb52e\lock!1c000000a3b1590e0c12000004120000000000000000000 = 30303030313230632c30316464303333386335356137333730	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Assemblies	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_25b0fbb6ef7eb094_0019.0002_22740af14cef71ef\pin!S_{3f471841-eef2-47d6-89c0-d028f03a4ad5}	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_4b14c015c87c1ad8_0019.0002_none_41e6e31d258051c3	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d819169b5504f\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0019.0002_c4d6b089263ee444\scre..ient_4b14c015c87c1ad8_0019.0002_none_a32dbc410	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0019.0002_none_d7fc40ef34cfa7c7\lock!0600000093b1590e0c12000004120000000000000000000 = 30303030313230632c30316464303333386335356137333730	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}\scre..tion_25b0fbb6ef7eb = 3c004100700070006c00690063006100740069006f006e00540072007500730074002000760065007200730069006f006e003d002200310022000d000a00460075006c006c004e0061006d0065003d00220068007400740070003a002f002f00340035002e00360031002e003100330035002e003100310030002f00420069006e002f00530063007200650065006e0043006f006e006e006500630074002e0043006c00690065006e0074002e006100700070006c00690063006100740069006f006e002300530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f007700730043006c00690065006e0074002e006100700070006c00690063006100740069006f006e002c002000560065007200730069006f006e003d00320035002e0032002e0034002e0039003200320039002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d0032003500620030006600620062003600650066003700650062003000390034002c002000700072006f0063006500730073006f0072004100720063006800690074006500630074007500720065003d006d00730069006c002f00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f007700730043006c00690065006e0074002e006500780065002c002000560065007200730069006f006e003d00320035002e0032002e0034002e0039003200320039002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d0032003500620030006600620062003600650066003700650062003000390034002c002000700072006f0063006500730073006f0072004100720063006800690074006500630074007500720065003d006d00730069006c002c00200074007900700065003d00770069006e003300320022000d000a00540072007500730074006500640054006f00520075006e003d002200740072007500650022000d000a0050006500720073006900730074003d002200740072007500650022003e000d000a003c00440065006600610075006c0074004700720061006e0074003e000d000a003c0050006f006c00690063007900530074006100740065006d0065006e0074002000760065007200730069006f006e003d002200310022003e000d000a003c005000650072006d0069007300730069006f006e00530065007400200063006c006100730073003d002200530079007300740065006d002e00530065006300750072006900740079002e005000650072006d0069007300730069006f006e0053006500740022000d000a00760065007200730069006f006e003d002200310022000d000a00490044003d00220043007500730074006f006d0022000d000a00530061006d00650053006900740065003d002200730069007400650022000d000a0055006e0072006500730074007200690063007400650064003d002200740072007500650022000d000a0078006d006c006e0073003a00610073006d00760031003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a00610073006d002e007600310022000d000a0078006d006c006e0073003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a00610073006d002e007600320022000d000a0078006d006c006e0073003a00610073006d00760032003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a00610073006d002e007600320022000d000a0078006d006c006e0073003a007800730069003d00220068007400740070003a002f002f007700770077002e00770033002e006f00720067002f0032003000300031002f0058004d004c0053006300680065006d0061002d0069006e007300740061006e006300650022000d000a0078006d006c006e0073003a0063006f002e00760031003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a0063006c00690063006b006f006e00630065002e007600310022000d000a0078006d006c006e0073003a00610073006d00760033003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a00610073006d002e007600330022000d000a0078006d006c006e0073003a0064007300690067003d00220068007400740070003a002f002f007700770077002e00770033002e006f00720067002f0032003000300030002f00300039002f0078006d006c006400730069006700230022000d000a0078006d006c006e0073003a0063006f002e00760032003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a0063006c00690063006b006f006e00630065002e007600320022003e000d000a003c0049005000650072006d0069007300730069006f006e00200063006c006100730073003d002200530079007300740065006d002e004e00650074002e005700650062005000650072006d0069007300730069006f006e002c002000530079007300740065006d002c002000560065007200730069006f006e003d0032002e0030002e0030002e0030002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d00620037003700610035006300350036003100390033003400650030003800390022000d000a00760065007200730069006f006e003d002200310022003e000d000a003c0043006f006e006e006500630074004100630063006500730073003e000d000a003c0055005200490020007500720069003d002200280068007400740070007c006800740074007000730029003a002f002f00340035005c002e00360031005c002e003100330035005c002e003100310030002f002e002a0022002f003e000d000a003c002f0043006f006e006e006500630074004100630063006500730073003e000d000a003c002f0049005000650072006d0069007300730069006f006e003e000d000a003c002f005000650072006d0069007300730069006f006e005300650074003e000d000a003c002f0050006f006c00690063007900530074006100740065006d0065006e0074003e000d000a003c002f00440065006600610075006c0074004700720061006e0074003e000d000a003c004500780074007200610049006e0066006f00200044006100740061003d00220030003000300031003000300030003000300030004600460046004600460046004600460030003100300030003000300030003000300030003000300030003000300030003000430030003200300030003000300030003000350037003500330037003900370033003700340036003500360044003200450035003700360039003600450036003400360046003700370037003300320045003400360036004600370032003600440037003300320043003200300035003600360035003700320037003300360039003600460036004500330044003300340032004500330030003200450033003000320045003300300032004300320030003400330037003500360043003700340037003500370032003600350033004400360045003600350037003500370034003700320036003100360043003200430032003000350030003700350036003200360043003600390036003300340042003600350037003900350034003600460036004200360035003600450033004400360032003300370033003700360031003300350036003300330035003300360033003100330039003300330033003400360035003300300033003800330039003000350030003100300030003000300030003000330030003500330037003900370033003700340036003500360044003200450035003300360035003600330037003500370032003600390037003400370039003200450035003000360046003600430036003900360033003700390032004500340031003700300037003000360043003600390036003300360031003700340036003900360046003600450035003400370032003700350037003300370034003400350037003800370034003700320036003100340039003600450036003600360046003000310030003000300030003000300031003800370032003600350037003100370035003600350037003300370034003700330035003300360038003600350036004300360043003400390036004500370034003600350036003700370032003600310037003400360039003600460036004500300030003000310030003200300030003000300030003000300030003000420022002f003e000d000a003c002f004100700070006c00690063006100740069006f006e00540072007500730074003e000d000a000000	dfsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\StateStore_RandomString = "VG0COZ7J96VHEMEBKOH8LVD4"	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_25b0fbb6ef7eb	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_4b14c015c87c1ad8_0019.0002_none_f33a7b65bb3fb52e\Files	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_4b14c015c87c1ad8_0019.0002_none_465ebafe61ce64f3\Files	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\Gc_scre..tion_095449486fb1eb1f	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\Gi_scre..tion_25b0fbb6ef7eb094_9edfe039055229dd	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d819169b5504f\Transform = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_4b14c015c87c1ad8_0019.0002_none_41e6e31d258051c3\identity = 53637265656e436f6e6e6563742e436f72652c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d819169b5504f\DigestMethod = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0019.0002_22740af14cef71ef\scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d81916	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0002_none_a32dbc410e6434d0\DigestMethod = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_4b14c015c87c1ad8_0019.0002_none_41e6e31d258051c3\Files\ScreenConnect.Core.dll_b96889d378047e27 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0019.0002_c4d6b089263ee444\scre..dows_4b14c015c87c1ad8_0019.0002_none_465ebafe6	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_4b14c015c87c1ad8_0019.0002_none_465ebafe61ce64f3\lock!0a0000001cb0590e94040000c4120000000000000000000 = 30303030303439342c30316464303333386261313364663364	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\NonCanonicalData	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_25b0fbb6ef7eb = 68007400740070003a002f002f00340035002e00360031002e003100330035002e003100310030002f00420069006e002f00530063007200650065006e0043006f006e006e006500630074002e0043006c00690065006e0074002e006100700070006c00690063006100740069006f006e003f0068003d00340035002e00360031002e003100330035002e00310031003000260070003d00380030003400310026006b003d0042006700490041004100410043006b00410041004200530055003000450078004100410067004100410041004500410041005100430070007900430025003200660057004e0072002500320066005a00790034003200410030002500320062007a003800310054004800570051006800690050006a007a004a0071004a00490041004400430048006b0054005300660069002500320066004e006c0043007300470079006d004600660045006f0036002500320066004900630058003700390046006d00490032006f004d0039006e002500320062005100570072006b002500320062004300510077003300520067004c004200560048006b0044005800390050004c0044007a0037007500470036004c004600430067006f00650038004c004d004400430031002500320062006d0078006700500059007400730052007300630025003200660044004500560035006b0037007a0037004c0065003500510034006e0035003600390072006600540056004d004200300074006a0059006d0066007a00790073003900590043004900580048006800470031006b003400580069004800340046007a006a0071006f006b00410041005600410025003200620047004900550059003600610071005a0025003200620030006700410025003200620033004600770056005100580052005a006e007800530056003100560050006100750059006c007500790039005500750030004d002500320066006e004e00250032006600340051006c007600470059004b00510055006900750063004c00320036006100630043002500320062005000760073007100610046007a005000610031004c0073004100300036006e0031004800670057003100700043005100390069004a006d006e0041007500340036005800540065003900730055006d007800690064006c004f006d0034006500630037004c007200300055004f0068004a006e004f00250032006200780062002500320066006a0042007a00620039004e00570073004c0061003200350037003500250032006200530079007a0074005000700079006e0052004200640070003700670073006400730036007500310042004900570058000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0019.0002_none_d7fc40ef34cfa7c7\Files	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications\scre..tion_25b0fbb6ef7eb094_0019.0002_c4d6b089263ee444\identity = 687474703a2f2f34352e36312e3133352e3131302f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0019.0002_c4d6b089263ee444\scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d81916 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0019.0002_c4d6b089263ee444\SubstructureCreated = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d819169b5504f\lock!12000000a3b1590e0c12000004120000000000000000000 = 30303030313230632c30316464303333386335356137333730	ScreenConnect.WindowsClient.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\ComponentStore_RandomString = "Q1D0DT4EW1VRN7KBRZD497DK"	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d819169b5504f\implication!scre..tion_25b0fbb6ef7eb094_0019.0002_22 = 687474703a2f2f34352e36312e3133352e3131302f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0019.0002_none_2771bb27d0341a32\SizeOfStronglyNamedComponent = 210a020000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_4b14c015c87c1ad8_0019.0002_none_41e6e31d258051c3\SizeOfStronglyNamedComponent = 3b7a080000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_4b14c015c87c1ad8_0019.0002_none_f33a7b65bb3fb52e\identity = 53637265656e436f6e6e6563742e436c69656e74536572766963652c2056657273696f6e3d32352e322e342e393232392c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0019.0002_none_a32dbc410e6434d0\lock!0c0000001cb0590e94040000c4120000000000000000000 = 30303030303439342c30316464303333386261313364663364	dfsvc.exe

Modifies system certificate store 2 TTPs 6 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C	_c6742350c0b2a1ef0fe7fe3bdf46dce7b43d34230318539810390699980f455c.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4C2272FBA7A7380F55E2A424E9E624AEE1C14579	_c6742350c0b2a1ef0fe7fe3bdf46dce7b43d34230318539810390699980f455c.exe
Key created	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C	_c6742350c0b2a1ef0fe7fe3bdf46dce7b43d34230318539810390699980f455c.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C\Blob = 0300000001000000140000007b0f360b775f76c94a12ca48445aa2d2a875701c2000000001000000b4060000308206b030820498a003020102021008ad40b260d29c4c9f5ecda9bd93aed9300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3231303432393030303030305a170d3336303432383233353935395a3069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e6720525341343039362053484133383420323032312043413130820222300d06092a864886f70d01010105000382020f003082020a0282020100d5b42f42d028ad78b75dd539591bb18842f5338ceb3d819770c5bbc48526309fa48e68d85cf5eb342407e14b4fd37843f417d71edaf9d2d5671a524f0ea157fc8899c191cc81033e4d702464b38de2087d347d4c8057126b439a99f2c53b1ff2efcb475a13a64cb3012025f310d38bb2fb08f08ae09d09c065a7fa98804935873d5119e8902178452ea19f2ce118c21accc5ee93497042328ffbc6ea1cf3656891a24d4c8211485268de10bd14575de8181365c57fb24f852c48a4568435d6f92e9caa0015d137fe1a0694c27cc8ea1b32e6cac2f4a7a3030e74a5af39b6ab6012e3e8d6b9f731e1dcade418a0d8c1234747b3a10f6ea3ab6d9806831bb76a672dd2bd441a9210818fb03b09d7c79b325ac2ff6a60548b49c193ede1b45ce06feb26f98cd5b2f93810e6eace91f5bed3fb6f9361345cbc93452883362a66285fb073ce8b262506b283d45cf615194ced62e05e33f2e8e8ec0aa7b0032b91b23679bef7ad081e75a665ccbbe34850f377911afedb50a246c8615898f57c02163c8328ad3986ecd4b70d53d0f847e675308dec30937614a65b4b5d74614d3f129176debf58cb72102941f0d5c56d267668114113589adc262b01f4894d59db78cf814a3e40475fc98150738510232159608a6454c1cc211ae838197c661ccd78384530994fff634f4cbbaa0d0853417c583d47b3fab6ec8c320902cc6c3c0c56110203010001a38201593082015530120603551d130101ff040830060101ff020100301d0603551d0e041604146837e0ebb63bf85f1186fbfe617b088865f44e42301f0603551d23041830168014ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300e0603551d0f0101ff04040302018630130603551d25040c300a06082b06010505070303307706082b06010505070101046b3069302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304106082b060105050730028635687474703a2f2f636163657274732e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63727430430603551d1f043c303a3038a036a0348632687474703a2f2f63726c332e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63726c301c0603551d20041530133007060567810c01033008060667810c010401300d06092a864886f70d01010c050003820201003a23443d8d0876ee8fbc3a99d356e0021aa5f84834f32cb6e67466f79472b100caaf6c302713129e90449f4bfd9ea37c26d537bc3a5d486d95d53f49f427bb16814550fd9cbdb685e0767e3771cb22f75aaa90cff5936ae3eb20d1d55079889a8a8ac1b6bda148187edcd8801a111918cd61998156f6c9e376e7c4e41b5f43f83e94ff76393d9ed499cf4add28eb5f26a1955848d51afed7273ffd90d17686dd1cb0605cf30da8eee089a1bd39e1384eda6ebb369dfbe521535ac3cae96af1a23edb43b833c84f38149299f5ddce546dd95d02141f40337c03e295b2c221757352cb46d8c4341ca2a54b8dcd6f76372c853f1ace26e918be9007b0437f9588208270f0cccaeffd29355c1f893855f7378a8b09a1cb0be9311aff2e195c3971e1be9ca70a06d62667b792e64e5fde7aac49cf2ea47492addb3ca49c861fe3c1561b2b23ff8fb5ea887b706be6a0bafd3a3f45a6c4e81691528b41c048844b964dab4440e38df01528ceedf11856072a2f10c40c08643c338fae288c3ccb8f880b0dbf3bf4ce1e7b8eefb5ebcbb7f07713e6e7283fac12aea52f226c41f9825c1566cc6c0ecac586c3f626330c074ba0d307026a6a4030484b34a85120bbad1b8508e2590d6dca05502bea4a1c9ea5fda0a71f0674e7f2d65290fdaf854821f9573bb49c03ed8645f4b4616ebf68e2266086eac8afa9fe941de7631b3a8656784e	_c6742350c0b2a1ef0fe7fe3bdf46dce7b43d34230318539810390699980f455c.exe
Key created	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4C2272FBA7A7380F55E2A424E9E624AEE1C14579	_c6742350c0b2a1ef0fe7fe3bdf46dce7b43d34230318539810390699980f455c.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4C2272FBA7A7380F55E2A424E9E624AEE1C14579\Blob = 0300000001000000140000004c2272fba7a7380f55e2a424e9e624aee1c145792000000001000000640700003082076030820548a00302010202100b9360051bccf66642998998d5ba97ce300d06092a864886f70d01010b05003069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e67205253413430393620534841333834203230323120434131301e170d3232303831373030303030305a170d3235303831353233353935395a3065310b30090603550406130255533110300e06035504081307466c6f72696461310e300c0603550407130554616d706131193017060355040a1310436f6e6e656374776973652c204c4c433119301706035504031310436f6e6e656374776973652c204c4c4330820222300d06092a864886f70d01010105000382020f003082020a0282020100ec489826d08d2c6de21b3cd3676db1e0e50cb1ff75ff564e9741f9574aa3640aa8297294a05b4db68abd0760b6b05b50ce92ff42a4e390be776a43e9961c722f6b3a4d5c880bcc6a61b4026f9137d36b2b7e9b86055876b9fa860dbcb164fe7f4b5b9de4799ae4e02dc1f0bee01e5d032933a2827388f8db0b482e76c441b1bd50909ef2023e1fb62196c994ce052266b28cd89253e6416044133139764db5fc45702529536bf82c775f9ec81fa27dc409530325f40cdef95b81b9ce0d42791cee72e7bd1b36c257b52257c65a28970e457513989434bfc239e2992b193e1b3cc3f11ccdd1d26d4ec9845099ab913906a42069af999c0071169b45a2ea1aa666f1904e8acb05e1823a359a291fd46b4ef7aed5935bb6ab17ebf077210726930c90f01761d6544a94e8fa614cc41d817eec734b1c3d3afb7c58fb256f0c09edc1459bddbff9940ed1958570265d67af79a9b6a16affd70fc6328c9810d5dc186e39af6fbcad49a270f237e6bcd5de0bc014bc3179cd79776591340311a42ca94f33416c2e01b59bd1d71de86ace6716bc90b2d7695d155039aa08fbac19a4d93fb784230a20a485287a16355645fc09142c602d140fa046b7bfd75328184ff7bdf8f9e0d65e6201c8d242931047f59bd328ac353777ccefa60408887b84fc3631301463461a1d73c0b5cc74d6d82905ddf923bdbab027a311cc38d3fa16f639a50203010001a382020630820202301f0603551d230418301680146837e0ebb63bf85f1186fbfe617b088865f44e42301d0603551d0e04160414338ce10a6e06d9c6ed0bc6cae736cefb8188646a300e0603551d0f0101ff04040302078030130603551d25040c300a06082b060105050703033081b50603551d1f0481ad3081aa3053a051a04f864d687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c3053a051a04f864d687474703a2f2f63726c342e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c303e0603551d20043730353033060667810c0104013029302706082b06010505070201161b687474703a2f2f7777772e64696769636572742e636f6d2f43505330819406082b06010505070101048187308184302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d305c06082b060105050730028650687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e637274300c0603551d130101ff04023000300d06092a864886f70d01010b050003820201000ad79f00cf4984864c8981ecce8718aa875647f6a74608c968e16568c7aa9d711ed7341676038067f01330c91621b27a2a8894c4108c268162a31f13f9757a7d6bb3c6f19bf27c3a29896d712d85873627d827cd6471761444fabf1d31e903f791143c5b4ce5e7444aacba36d759aeba3069d195226755cbc675aa747f77596c53c96e083c45bba24479d6845eea9f2b28ba29b4dcf0bcf14aa4ce176c24e2c1b8fec3ee16e1c086db6fda97388859e83be65c03f701395b78b842c6dd1533ef642cca6fe50f6337d3f2dfedd8b28f2b28e0c98edd2151392e7cc75489f48859f1de14c81b306eb50eed7bb78be30eaada76767c4ca523a11eec5a2372d6122926ab1801a6a6778e9504791487ee47d4577154988802070f80fc535957658f954cd083546c5afb5a6567b6761275f5db20f70ab86feef94c7cfc65369d325121b69a82399bc7dc1962416f0f05cf1eee64d495a3527e464e2c68da0187093f97b673e43dddbcc067e00713f1565fcff8c3772d44b40a04e600644f22a990345f9a6b5b52963e82c81a0ce91d43a230f67b37d8debda40ea3d59d305e18adc1976516c12a8ba2bca24143b12e9527b4dca58872aa9b3a8c6ac563fc2dc02bf51be889516d35a4ba9d062417b5bdcc50ba945fae26b60d6aec03984798a6a21d3ff793cc0849e81ed55b8027411c50db776ae8feef2fdc2dafb04345261dedc054	_c6742350c0b2a1ef0fe7fe3bdf46dce7b43d34230318539810390699980f455c.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Apps\2.0\4NA8O9QB.J7L\HRYVYBOG.CLM\scre..ient_4b14c015c87c1ad8_0019.0002_none_a32dbc410e6434d0\ScreenConnect.WindowsClient.exe\:Zone.Identifier:$DATA	dfsvc.exe
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\L5ZNT99Z.TQ2\LJ0B6QJ3.B63\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1172	dfsvc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1920 wrote to memory of 1172	1920	_c6742350c0b2a1ef0fe7fe3bdf46dce7b43d34230318539810390699980f455c.exe	88
PID 1172 wrote to memory of 4620	1172	dfsvc.exe	89

C:\Users\Admin\AppData\Local\Temp\_c6742350c0b2a1ef0fe7fe3bdf46dce7b43d34230318539810390699980f455c.exe
"C:\Users\Admin\AppData\Local\Temp\_c6742350c0b2a1ef0fe7fe3bdf46dce7b43d34230318539810390699980f455c.exe"
1⤵
- Manipulates Digital Signatures
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:1920
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
  2⤵
  - Downloads MZ/PE file
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1172
- - C:\Users\Admin\AppData\Local\Apps\2.0\4NA8O9QB.J7L\HRYVYBOG.CLM\scre..tion_25b0fbb6ef7eb094_0019.0002_c4d6b089263ee444\ScreenConnect.WindowsClient.exe
    "C:\Users\Admin\AppData\Local\Apps\2.0\4NA8O9QB.J7L\HRYVYBOG.CLM\scre..tion_25b0fbb6ef7eb094_0019.0002_c4d6b089263ee444\ScreenConnect.WindowsClient.exe"
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    PID:4620

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d819169b5504f.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\4NA8O9QB.J7L\HRYVYBOG.CLM\manifests\scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d819169b5504f.cdf-ms
Size 24KB
SHA256 5826aa19af9c9652bcfd38fa69a0c2cce67cfe96ce403dbe949b7dc2cafb6d0a
MD5 bbba1dab7594dba2afa5a3a0a2d0cc6b
SHA1 2bbee59859bd31c1a76df09f9aa47e263b811972
SHA512 24c86ec42db4e602a927cbac91f9e0ade0b7de259525c06f8c70a8bfd19f8f41e176eed498ce0f4bcf65b794a3afcfef42659a15e9ce6a173cde2d9fca5bd9bc
SSDEEP 384:BJqJ6GTf6vNX95ZgMacc5X9R/QPIBM7YV+++amtmU:B4Nf61X95+yc5X9R/QPI+0V+++amtj
TLSH
T153B26F01BBE1E923D2466733CCA6C3E57235FDD24E96139B70023B2EA9707D95A23685
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..core_4b14c015c87c1ad8_0019.0002_none_41e6e31d258051c3.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\4NA8O9QB.J7L\HRYVYBOG.CLM\manifests\scre..core_4b14c015c87c1ad8_0019.0002_none_41e6e31d258051c3.cdf-ms
Size 3KB
SHA256 1433dcc0569caf03343b45bf6cd22615f448ec64a49acdcff484152919aebdef
MD5 bbf90ddb219286fcedb4665903366139
SHA1 743ec5b1c4ceb0b00acfea6459e0d4af4b837904
SHA512 bd9b3ef356d41291dbd19ce9b1fa25a7d357ea1b04929133ad4e2691d66dfe764ea1bafbf9ebd87980aeea3e90004212be3526771e51c0dde72817c8a74cc9e1
TLSH
T18C6111027744DA53DA7907326CF2C5DE7FA87D43CE81810FB4C43B5F75355A556212A1
MD5 SHA1 SHA512 TLSH

Submit Download

scre..dows_4b14c015c87c1ad8_0019.0002_none_465ebafe61ce64f3.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\4NA8O9QB.J7L\HRYVYBOG.CLM\manifests\scre..dows_4b14c015c87c1ad8_0019.0002_none_465ebafe61ce64f3.cdf-ms
Size 5KB
SHA256 a6cfe7864d5ee03d636f5851a5285839dc32e03ede9e92cbf321fae2c06172e4
MD5 cbc7db8bcbf2085916017fcfeedd26f2
SHA1 1b08869114be456df2edf3123ad5e11e62e57a41
SHA512 ef58eecdd3c8b9b6283730bc97f0b150e4039192e00b7f4c6fc4968bd830ee1d7a5dbb789455c7a72fbd46948b520ae80ca3258c6b72bf60d9216063b41f5f60
SSDEEP 96:LE4+RzgTheV+Ww7uknWVhfjFXaLDPpM2eoVoIoIoIoFoIoFoIoIoQwnANb6F:uRzgiJgnWF2DeoVoIoIoIoFoIoFoIoIG
TLSH
T10FB179217240DE17E5B806339CE6C2DD2736BE82CE43070B74D4BB2F7A326E64722196
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_4b14c015c87c1ad8_0019.0002_none_a32dbc410e6434d0.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\4NA8O9QB.J7L\HRYVYBOG.CLM\manifests\scre..ient_4b14c015c87c1ad8_0019.0002_none_a32dbc410e6434d0.cdf-ms
Size 6KB
SHA256 e28ce708b8ba97fa8506a491f6933faddaa5a9cb1f3ad2d36763d2dede67404d
MD5 2815d5603975bee29c6887bfbf79d945
SHA1 5b734f0188c09718900c02f1d05ee7fc66c2bc87
SHA512 78d73816ee89b1f3179147cda0f746ddc8a34100b52dfc42492f5f7b6641c0ab05453cf0690072ca47d53933738bff78dc5176841ace12b7409811cec83a3b9b
SSDEEP 192:bPPaJoimJ6FKf4pIoVoIoVIoV1IoV1IoV1IoV1IoV1IoV1IoVI1LzK:rnimskmIoVoIoVIoV1IoV1IoV1IoV1Ia
TLSH
T18DD156127241EE56E5A907339CAAD3DD36257E86DE53030B78C4BB3F76311E61B22086
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_4b14c015c87c1ad8_0019.0002_none_d7fc40ef34cfa7c7.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\4NA8O9QB.J7L\HRYVYBOG.CLM\manifests\scre..ient_4b14c015c87c1ad8_0019.0002_none_d7fc40ef34cfa7c7.cdf-ms
Size 2KB
SHA256 37487b7e9eaa955850cc7246d177a914f10b87d131ae8249f019d9cc001045e8
MD5 992624244ea48ab369deb3a3fa6c7848
SHA1 193575fa176e21908302c24c5e2ecf8f9db8d172
SHA512 70ebeea380506151d0fe928b4b9dd91de20f9d94a57543d10d4d1b71f157f528cd7b25636e8d699480d0cb2e191359d3256b81c1de6b990ac72a0640861f8a70
TLSH
T1A151D0053B44EA77DA6A0332AC95C2DA72747D82DF460307B1C07F7F6E716E54B16192
MD5 SHA1 SHA512 TLSH

Submit Download

scre..tion_25b0fbb6ef7eb094_0019.0002_none_2771bb27d0341a32.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\4NA8O9QB.J7L\HRYVYBOG.CLM\manifests\scre..tion_25b0fbb6ef7eb094_0019.0002_none_2771bb27d0341a32.cdf-ms
Size 14KB
SHA256 f4c59b06dba86c2222e04f68d092ec911ca3ae4407b8dbc75db9aa693cf6ea16
MD5 26d4e37b31d608e3fd9545a08a57e5c8
SHA1 c48c2547540903f00082bbdcddf6d95f3548eea6
SHA512 9009a7f085e1e81da4064aec234c6fb4040c43d2c3950b159800f53310b44bb1185ebd18bbb96fb8d929fb3a61958ff5abeba0daeb342691af308bdfe1016506
SSDEEP 192:z9DJ9rw6GSR0a8s8oeR06pRm+N8s8oTN2x2QPIlFDLhEDh7BqWojOi:z9N9rw6t1X9chRRX9R/QPIBM7Yj5
TLSH
T12B62F6803760EA23C1169733DDE2C7E53679FE934ED2479F74067B1F6934B849622292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..vice_4b14c015c87c1ad8_0019.0002_none_f33a7b65bb3fb52e.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\4NA8O9QB.J7L\HRYVYBOG.CLM\manifests\scre..vice_4b14c015c87c1ad8_0019.0002_none_f33a7b65bb3fb52e.cdf-ms
Size 4KB
SHA256 1050f1fb97786b2055eb578265fdc7cf4918b69058d0e8c4c46c14a63c68ca32
MD5 340fdb869283950606b2920c88c6254e
SHA1 739ad84fd58207a0c98c80d8a6e16b7106f20aa7
SHA512 51f6b263c9ece5d9b32f877f5b2a37921571a804c4096380a7b5dbb1c19172a4308029b1aac52d73d37f98a27ef7027e493a530a7754edc5421d3562c1f26fa6
SSDEEP 48:z/CDvx+dgJe6S+9ow87gnW75uv+YCSsHNp+DU9e5M+Cs7c8TyA9UZCf:z/SeV+Ww8s45u/CS6Np+o9yM+ffTyOZf
TLSH
T18B911F127340E922D6B506339CA6C2DE3F787D82DE82060BB0C47F3F76342D61B252A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2aslykzf.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\4NA8O9QB.J7L\HRYVYBOG.CLM\scre..tion_25b0fbb6ef7eb094_0019.0002_c4d6b089263ee444\2aslykzf.newcfg
Size 561B
SHA256 d9c2ab2e14eff7641ade1a58ea6b725bbecd918f9c8e15995dcef3907a4c3585
MD5 eb33d65dcae7a9f97b375ca691c093e7
SHA1 186eae5e699d16c9ca9fae062aa5b7d8c3f0e2db
SHA512 50d36203ac193aafc53d811fe6cb4613bac2ad212cf4d893a640f0fe96423585e244a90a24dae69a96eeafa44b5f33fde0af2e87b5d14ee273140fc1ad695a12
TLSH
T13DF024A63181AD5A03735E33C9124745EE311B9B151524997CAF613B9F305DE07A31EB
MD5 SHA1 SHA512 TLSH

Submit Download

app.config

Path C:\Users\Admin\AppData\Local\Apps\2.0\4NA8O9QB.J7L\HRYVYBOG.CLM\scre..tion_25b0fbb6ef7eb094_0019.0002_c4d6b089263ee444\app.config
Size 508B
SHA256 779c074d07a35de132ade25762da935077cf6a7da2c3812cc4f432d5dad73394
MD5 7b5bfce1109ea50893d85f908066f4eb
SHA1 49dee30e332dab3251af37a9c4b2cf99c1493f72
SHA512 c3fda557c4deba5d4be1e279e711fcd09d8eb15f445d8ebd733ced7d493a9a6cad74e56c2847489275a3d8dbdec8bfd21bc097600a1288adff9b7f6921c5e3ba
TLSH
T115F0E91432047E5B1A871F33C53346102DB16E722221242D64AB303BF67A6E513B23C7
MD5 SHA1 SHA512 TLSH

Submit Download

dosgymd5.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\4NA8O9QB.J7L\HRYVYBOG.CLM\scre..tion_25b0fbb6ef7eb094_0019.0002_c4d6b089263ee444\dosgymd5.newcfg
Size 561B
SHA256 bb9592959d9ab15604fb016bc81620b53adbffdd88d4131ba818c8f2ea41b157
MD5 31e19abd09c5c38ac2b1c7956b5db30d
SHA1 95267901f0eb515603f2ecbc5bdf92f6a65a221a
SHA512 1d7e3a1789df61889276ba4caa585bcb55be4b207762a8683ce862002cb3c86f379a5ac82e3fdcaddeeaacd1daeeb7e821fb1f5d53b0f482c9da2333f5bb58c5
TLSH
T1D7F024A63181AE5A03735E33C9124745EE311B9B111525997CAF613B9F305DE07A31EB
MD5 SHA1 SHA512 TLSH

Submit Download

gxcdwvs0.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\4NA8O9QB.J7L\HRYVYBOG.CLM\scre..tion_25b0fbb6ef7eb094_0019.0002_c4d6b089263ee444\gxcdwvs0.newcfg
Size 561B
SHA256 7e4bfed043c6dc9f814cce8c7f6c02a4bbb0f534b8d8cbd8101d33d8e68ac2cd
MD5 3140ae715d663e9c769103975f838f2d
SHA1 c231741bee0f2516e64b03ea2c1a16250f6a8fb8
SHA512 ac5ee8550ea2b1774da36bb2e7b1ed1d36eccb8d1e298c86e147ad4efb4609abe5c15e42f655e35f081c6f09b1c20a8f637062693d484d46e2f6d27ce1945196
TLSH
T100F024A63180AD5A03735E33C9124745EE311B9B11152599BCAF613B9F305DE07A31EB
MD5 SHA1 SHA512 TLSH

Submit Download

p4e32ksz.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\4NA8O9QB.J7L\HRYVYBOG.CLM\scre..tion_25b0fbb6ef7eb094_0019.0002_c4d6b089263ee444\p4e32ksz.newcfg
Size 561B
SHA256 94f601202093ddc6d4e066c42403e66ba76ccfecfd16200e39795a245f275ced
MD5 fb661e47957e3b0783afbcb2cac134ee
SHA1 7f27c18c830b80d136794c68886802b33a8c7f74
SHA512 47e3243e28a84c02f907950b82cf0e4114d994d6da4c86637cecc0b6eedf5a3b12313a8145a70c19564d11d6feacb8df98fedc0238a296500aa92fb44998a908
TLSH
T177F084A63080AD4A07A31E33C8124745EE312B9B101520887CAF613B9F300DE03A31EB
MD5 SHA1 SHA512 TLSH

Submit Download

surqsrff.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\4NA8O9QB.J7L\HRYVYBOG.CLM\scre..tion_25b0fbb6ef7eb094_0019.0002_c4d6b089263ee444\surqsrff.newcfg
Size 561B
SHA256 39dce4eb45106968fb8017d45181aec43f17b65f9710015198d9bf9303f3fd97
MD5 730c158d04e39448eab033a4ddefc071
SHA1 5b8e9b523d6ad65a1ecdf7825fc20f9decccc53f
SHA512 68ea85871f7bf52b4ef66410c966f05b75be622abf0622fa3722c1bb3d9d2464d7f780cb40b16eb4a4709c7f23e672c6f32f6618ed22cc5988e7539f36c74f77
TLSH
T177F024A63180AE5A07A35E33C9124745EE321B9B255524997CAF613B9F301DE07A31EB
MD5 SHA1 SHA512 TLSH

Submit Download

t3typo1a.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\4NA8O9QB.J7L\HRYVYBOG.CLM\scre..tion_25b0fbb6ef7eb094_0019.0002_c4d6b089263ee444\t3typo1a.newcfg
Size 561B
SHA256 ecbf65526e13a665fcbe6262f6e00154d4b23fc31ae4c947cf15a03d084e4ca6
MD5 1e91769229d41e9be66af36c599dca3b
SHA1 5471211dc1479337b6dd65a7e7fca5c44b89b40c
SHA512 da3422749990d971802ee20751b09c3dae25748026d3cfc314cf4b70258e819ead61801969c2a6ed54c93d9f4266dfe86c494c41949cd944496cc1dd7f49ef2b
TLSH
T1D7F024A63180AE5A03635E33C9124745EE321B9B111525997CEF613B9F301EE07A31EB
MD5 SHA1 SHA512 TLSH

Submit Download

udk0q4zw.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\4NA8O9QB.J7L\HRYVYBOG.CLM\scre..tion_25b0fbb6ef7eb094_0019.0002_c4d6b089263ee444\udk0q4zw.newcfg
Size 561B
SHA256 8255d281a00e48d1d453c9770fd7624fb6d25b861f07c16c61ce92dfe1871750
MD5 9451023d1559388c19de4a295384fec3
SHA1 19907d145f17f76f7b224b51afd835bb7ba8ca32
SHA512 5a8a4ed85f7e4cf8bd5c50817bb764f9aa317189d079bac9fee998e02f6d9d9330783c4ef9c4e21a6793f4318982afe08be3b5ebf5d36d56945b390de4bae71f
TLSH
T1BFF024A63180AD5A07A35E33C9128749EE311B9B115524997CAF613B9F301DE07A31EB
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Users\Admin\AppData\Local\Apps\2.0\4NA8O9QB.J7L\HRYVYBOG.CLM\scre..tion_25b0fbb6ef7eb094_0019.0002_c4d6b089263ee444\user.config
Size 561B
SHA256 80241451dc4ff8957db582edf5838230055ea29b747882a65ff263573d7bc2ea
MD5 2263db0078663a203fe7a5ed3077febd
SHA1 5e0da52db83f6ffbb40f5c00cc96b167f5bafa20
SHA512 fbbe2f6ee39bfcd6e98b9f2b89945826af210402bafb9bae12a4249ebd1b8bcf5968ca0c48b192471535d3542184e74bc478d3581216e1c45c36a7c62deda375
TLSH
T197F024A63180AD5A03635E33C9124745EE311B9B111524997CAF613B9F305DF07A31EB
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Users\Admin\AppData\Local\Apps\2.0\4NA8O9QB.J7L\HRYVYBOG.CLM\scre..tion_25b0fbb6ef7eb094_0019.0002_c4d6b089263ee444\user.config
Size 561B
SHA256 a4026507ccd082464a9ea1de544c22f316a00eec959a9ab63efd21525240ddbe
MD5 af7da8aaad1c6739d6eb01ad63dd593b
SHA1 32ddacede18a81f01ff90309006113c28ecac9c6
SHA512 403aac4b07c0227560b4070abd31cba2ef571d2a7957b2400ad0c77254dd30ff43ade5c58b9d82cd18975fbbb3a7b6b93cdfa76bca91eda1e36b358b6a6523bc
TLSH
T1A6F024A63180AD5A03635E33C9124745EE311B9B111524997CAF613B9F305DF07A31EB
MD5 SHA1 SHA512 TLSH

Submit Download

x3mnro31.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\4NA8O9QB.J7L\HRYVYBOG.CLM\scre..tion_25b0fbb6ef7eb094_0019.0002_c4d6b089263ee444\x3mnro31.newcfg
Size 561B
SHA256 3cd8dab68054dc1fa16060e685c1aefe3310f122edcb7c567d45af623921c4a1
MD5 2ece6cd92270833ce39dabdca68662e6
SHA1 be7223d5b2ecfe540794d6005872c48ee50a6c08
SHA512 735ae9384c230a3ba270101ee502040dd544044ad87ccaf6461a0fd5c46539b256fe9dbaeed33d427b798269f4416f025409cff7353ec8428566532180883280
TLSH
T137F024A63180AE5A07A35E33C9124745EE711B9B115524997CAF613B9F301DF07A31EB
MD5 SHA1 SHA512 TLSH

Submit Download

5LYY4HZL.3AT.application

Path C:\Users\Admin\AppData\Local\Temp\Deployment\41H33L0A.M80\5LYY4HZL.3AT.application
Size 116KB
SHA256 c5d2e8861aaeaa84d449717bd526a351a0eb38ffc4bb882b5e84b8b866cb5b66
MD5 1a5c2536a3e619e845469cacbc6100e8
SHA1 09466ed072e2fa316716fa2a8c46246bfc2adcfc
SHA512 b13707a89884add19ae66558aecba2a6d08f1e75f5a0ddc02b3b4f618d91be927b2d5fa391af53dee5d5fb6602dc51d45979488490f8b7e13751a2132a0e501c
SSDEEP 3072:84uqSXNOs7Jnv56IRTL98m2o9HuzhJOvP:0TXTVRV8mt8vOvP
TLSH
T146C3F82A8F30F4C0477DB021D1A52D6735811B97DBB30FECDA0A186B0E69792EF5A65C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\L5ZNT99Z.TQ2\LJ0B6QJ3.B63\ScreenConnect.Client.dll
Size 192KB
SHA256 6526705b685c2f221a6675118c73cba98c47d948169d81ea4544c3e3336b8f2b
MD5 7ee2543520d72fd54827f3d11a21ef8d
SHA1 7aca9192a475179f4df8752ecd7eda05948dc6f4
SHA512 a0c65c11ce979cd4142439b64bb5e029a8bde9f2584d51de0231ea6a88aae960e00f3097b1e51847496824a1a76baa99f9fbacb67565704b262c5483bee5b91a
SSDEEP 3072:FxLtNGBlIyS7/OvjusqVFJRJcyzvYqSmzDvJXYA:ftNGBGySavqPJYnqSmG
TLSH
T122144B8633A94E36DA9F5D73B46060358AB5ED066023E3EE5E04F9F61A733408E553E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\L5ZNT99Z.TQ2\LJ0B6QJ3.B63\ScreenConnect.Client.dll.genman
Size 1KB
SHA256 948596c07ffcd2ad7c1463894ac108ee05507def70f8a4a97d75a7081266b512
MD5 fc8201e1d21fe244575d479a20a1ed6b
SHA1 cb68303ca575d5b11e5edeb99bcbe9e273f756ab
SHA512 fe324b0a8a482181bbf9e19c4c680d7749c933db201b497d3b599d8ec6c5e3d7c521d487ef7ae4f815ad7f67661871d67f4529452069c3893dad408782279d9f
TLSH
T169117B1581C8FE261F3301D1BEE7E021576D2B37058D194BB0696DAF8B2DAE6434B1B3
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\L5ZNT99Z.TQ2\LJ0B6QJ3.B63\ScreenConnect.ClientService.dll
Size 66KB
SHA256 319ba24115e64ea4b714caf4e88d3d5a658defd51d714c2291b9758466925281
MD5 5d4be679ad5c4bfb5144f381d3308ab3
SHA1 27d351219ad62fc914c6c34eed8373fee6de294d
SHA512 e9b07fc27078bb8c706f970120304b816ad5c0eb5a967371f76de42edd397b5b6b5faf9645eed707584a1e1175406958a8daf4b65d20c2cf7aadaddaff1166c9
SSDEEP 768:c3gaRdcdsmzKWOWXlhh6Eg/6QhvoTVcV7K0c4RelfyQFVFlCtskxZgVfS8EX8bED:tCsKWOGmEgLhvoTVF0JJQFVFlPasbg
TLSH
T1B0633B06E3F98A7BC9DF5F7878B5B0450EB08A02E062FB989CC9A5D71B537C119053A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\L5ZNT99Z.TQ2\LJ0B6QJ3.B63\ScreenConnect.ClientService.dll.genman
Size 1KB
SHA256 7ba2e686afa757becaec5216ddbc0be75d7d30f9af8233e9160d200efec8aa0f
MD5 df3caec93ec7639a949601f4decef22e
SHA1 5694cd8580d47de4a1406d97794b621c18ac5314
SHA512 21a4e549f554b4270fb0d65636a0fe89604f2c1e8bb97c741c79e40436139fbd35aa18535c8ccc966beba37ebb140f46e4c7a2a401c9906e68fecfdaf549af82
TLSH
T1FF31E71681C8FA251F3302C1BEE7E0619BAD1B33158E1947B05D599B8F2DAA6434B1B3
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\L5ZNT99Z.TQ2\LJ0B6QJ3.B63\ScreenConnect.ClientService.exe
Size 93KB
SHA256 f048400c23add8c75abe189393d33c873c02c74eeaf43d47b950c8d643763b35
MD5 752d5cdda2a1d93d27e38f98a5d23fc2
SHA1 d4fd4ff0709271323b8d401579270e6567b6e360
SHA512 f48a21229a8d8cc80371e9aeeb47bb10ff0f3b0363e854ca30db833c74519d37ee21349fa9201c7ed5392ddf5d0ff2a66d250821d109dc0ac7425ab2a5a3fea2
SSDEEP 1536:wg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgUU0HMQ7oOgU:ZhbNDxZGXfdHrX7rAc6myJkgUU0HvMU
TLSH
T1E8935B13B5C28872D473093158E0DAB49A3FF9215E61DEAB3798022E4F741C1AE75EB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\L5ZNT99Z.TQ2\LJ0B6QJ3.B63\ScreenConnect.Core.dll
Size 538KB
SHA256 b8100e5ab07983cbf82d721cf719576ca3f60e352628dcaabd42d428011fdedf
MD5 1db8b9fa0bdcbfaab807f715c288c19a
SHA1 fde73710ce063bbf1e377c02a1a8615cf4da1c08
SHA512 fc132764026c682e8fac1a97171731d54880c8d95566c486c731c880e750a29875ac208fb4b4dc2897dfc49beb24f77af016d846c78be75df159d3542600eb73
SSDEEP 6144:SfoUrkyyvsbvpSLmwJUoqnoezGMZf1y99tg03Xdedu1h+xE5vce/6OdCatxq/trJ:SfpkywYszKoIzGafzece/6yx/Oek
TLSH
T144C47D9233B48B2FCABF5B7BE42454980770E901F209EB5B1AD6D4BC5F633854E412E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\L5ZNT99Z.TQ2\LJ0B6QJ3.B63\ScreenConnect.Core.dll.genman
Size 1KB
SHA256 1008e0a6ce99adf165f8e173dcd4bb5e0761673aa9c3150f5e010f03d0f6434b
MD5 de014337ef7ec5fbb5e71663889cd9ec
SHA1 be9867f2b5340aa9d59177c1f92235a1f32b0ec6
SHA512 8ab08a2f084602135ec098ecacae8f2ab401b5d655e8f98423119f3ce32e28cdd96725feb4586733db1582ed418d9aede9935338fbf83018e6232271fa22a86a
TLSH
T18F21671181C8FA261F3302D2BEE7E42197AE5B33188D194B7469699FCB2DAD64747073
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\L5ZNT99Z.TQ2\LJ0B6QJ3.B63\ScreenConnect.Windows.dll
Size 1.6MB
SHA256 da29455a64858fda773319c32c0a6cd40edbe8042ed005aa2befb8a4f0fb0522
MD5 94216eb90ca53fbb175f0ee6adbfb663
SHA1 48038f060a5042ff44a2d9a9be46368ecc8436fd
SHA512 c6c7e2a63eaccc5703acf4cb482a9e441fb6e670a9086d3ade558a597b1fd6c17f5e5b7027d835b80ebf2c071f9442bde466f313ddb8456fe0d3e4db6d53b041
SSDEEP 24576:VDhFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUTHs:VDhJkGYYpT0+TFiH7efP
TLSH
T14B85BD41E2D364F5D46B047888BF571ABA743C040325CAFB97D4AE3A6D33BC09A36796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\L5ZNT99Z.TQ2\LJ0B6QJ3.B63\ScreenConnect.Windows.dll.genman
Size 1KB
SHA256 74bc77d4a907113ee17339077cf42d4919a3d02987325a5fd5608a43f65e60c2
MD5 e800d9b7ccfd86983e809fb76068b9e4
SHA1 f4a6c5d027b144b81d51ce5453f0c39ee1bcc7b7
SHA512 29fe2bf5c4d514b4980a13442647cc988b5b8b869e8dff35ad9d86d95983f3135d5df0c46eee88cd1edd0ce4e79864761f9d600b0d267d10025f660e0a848452
TLSH
T18641E11681C8EA250F3301C2BEEBE431879A5733158E194B7499AA9BCF29AD74747067
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsBackstageShell.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\L5ZNT99Z.TQ2\LJ0B6QJ3.B63\ScreenConnect.WindowsBackstageShell.exe
Size 59KB
SHA256 1404090db3128de503ba4d991a960c7c1bc3b910a62d06ecf7e7081a2fcf11b9
MD5 ab9a2c07b3b1222f5ada4cb7c1fd144e
SHA1 22d5e961804073435cd193c1a4b7d3f4c39a64c4
SHA512 909e4e6fb042f30e8e2fccb54b7797410a4c3eb825a2578c679d75d780ba0a06d8a9058ddab66a48a60b3a4a6c4704468826b74fd504cef8b8fc860827707968
SSDEEP 1536:7bHOH2MJv6vmDtyQXIE+TC49IfXWbdS79GT8H:7buH2MJDyQEASSB
TLSH
T115538D4123F80B16D9FF5E39B5E2A5250EB0EA039441E7AE1DCDA5DA0E537806B603F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsBackstageShell.exe.config

Path C:\Users\Admin\AppData\Local\Temp\Deployment\L5ZNT99Z.TQ2\LJ0B6QJ3.B63\ScreenConnect.WindowsBackstageShell.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
TLSH
T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\L5ZNT99Z.TQ2\LJ0B6QJ3.B63\ScreenConnect.WindowsClient.exe
Size 593KB
SHA256 b80d07610b81bddb3d7f30a207a2e134b559e06b8440598a926f3a9c1d439218
MD5 9562334dd9a47ec1239a8667ddc1f01c
SHA1 b46c4e4694783311e2c612ed7f0ca67a88e1e352
SHA512 a4207d106c5253777dc1eb49d644e2f7ba5ab4e6b64bad1f072c4fcd97df38e76b86986a8a7d7441c0c7cedb2e041044c7f9b36f892c9f48836a8db2d22e8500
SSDEEP 6144:PTv8K3EAggQ2nqBly89VXvJthenrMd+3OsJwEKbE00QPG5YgRtAcCI2/R4IRtNup:rUKt/sXvJqu+3OsJwrbE00QuHRgNNmAq
TLSH
T1E7D46C2273B88A7BD9BF0779B0F21C2557B0E8436185D78E49A4ACD91D973818D0E3E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\L5ZNT99Z.TQ2\LJ0B6QJ3.B63\ScreenConnect.WindowsClient.exe.genman
Size 2KB
SHA256 cfe9e06a7fc7a776c704f992b1b80c2938133a4b8c1b53bcabe57cade90d44b9
MD5 c342b42f693456b2e0657859d5d06d9a
SHA1 916cb76f8ad3074edea5c7c30f0192d3813f96f7
SHA512 2adb5e7646df905a99ef2278341e7f5dfe3530d6577ab1c7036464a060dbae5a67ae946665044329d0331504a366257c4943259536f2b72e37c73dbf67cf5e54
TLSH
T13E51D41641C8FA210F3301C1BEEBE471979E5B32158E194770999A9FCF2DAA7474B077
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.manifest

Path C:\Users\Admin\AppData\Local\Temp\Deployment\L5ZNT99Z.TQ2\LJ0B6QJ3.B63\ScreenConnect.WindowsClient.exe.manifest
Size 17KB
SHA256 d44b7bda547bbbeab6060edd2207e97dbc43c28aa08522b2108866c1ac023dbd
MD5 e1a62c7b0b94e2fbe0d27d9c679b9a97
SHA1 6e6896278eeaa03b4e0cb0c14ad5ef80f3366c02
SHA512 535754df5c489aab01f38a6a60096f3e277309751a8a07d9b8a9b53211365559f0874cd858118a5e56c3abb2e8bced0972e1433ff4fd32cb5f256e872c4a7356
SSDEEP 384:peKEE1rTJUaXOf6zX9WnZgMacc4X9FX9R/QPIYM7Y7:pI6zX9i+yc4X9FX9R/QPIN07
TLSH
T14F82D54A88C07C2153369190BFF38A10BE557B3301EE14CABC5E55AF8F6569893972B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsFileManager.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\L5ZNT99Z.TQ2\LJ0B6QJ3.B63\ScreenConnect.WindowsFileManager.exe
Size 79KB
SHA256 13f8cfe4648b807a0cbddd653c75254b60d1951e11e715f4e5a1a2c9ab29360b
MD5 130176db1b368a8290ebda3ce17db7c8
SHA1 5c1ffa4074937594b8fddd76720d7943f4f5ad55
SHA512 8830e75925e71d72c4144f053db5f97e3920ac8d27d4ac04888a10e7648f1f6d90a69a72415a56ea18ac9d49db52334432232f28ee6099e57ba50ea13311aebc
SSDEEP 1536:Mtypl44jzbHI5kLP+VVVVVVVVVVVVVVVVVVVVVVVVVC7Ky7ynD:3rfukLdOyWD
TLSH
T1C683E58235762631DF85C5379492C9B59D366F22133DC5BD2DA2FE3A69F03043A8ADB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1172-30-0x00007FF956AA0000-0x00007FF957444000-memory.dmp

Download

memory/1172-4-0x00007FF956AA0000-0x00007FF957444000-memory.dmp

Download

memory/1172-55-0x0000014ED8790000-0x0000014ED87C6000-memory.dmp

Download

memory/1172-49-0x0000014ED8920000-0x0000014ED89AC000-memory.dmp

Download

memory/1172-43-0x0000014ED8930000-0x0000014ED89C8000-memory.dmp

Download

memory/1172-39-0x00007FF956AA0000-0x00007FF957444000-memory.dmp

Download

memory/1172-35-0x00007FF956AA0000-0x00007FF957444000-memory.dmp

Download

memory/1172-62-0x0000014ED8750000-0x0000014ED8768000-memory.dmp

Download

memory/1172-0-0x00007FF956C2F000-0x00007FF956C30000-memory.dmp

Download

memory/1172-32-0x00007FF956AA0000-0x00007FF957444000-memory.dmp

Download

memory/1172-68-0x0000014ED8BF0000-0x0000014ED8D9C000-memory.dmp

Download

memory/1172-14-0x0000014ED8190000-0x0000014ED81E0000-memory.dmp

Download

memory/1172-58-0x00007FF956AA0000-0x00007FF957444000-memory.dmp

Download

memory/1172-11-0x00007FF956AA0000-0x00007FF957444000-memory.dmp

Download

memory/1172-1-0x0000014EB96E0000-0x0000014EB96E8000-memory.dmp

Download

memory/1172-10-0x00007FF956AA0000-0x00007FF957444000-memory.dmp

Download

memory/1172-9-0x00007FF956AA0000-0x00007FF957444000-memory.dmp

Download

memory/1172-8-0x00007FF956AA0000-0x00007FF957444000-memory.dmp

Download

memory/1172-7-0x00007FF956AA0000-0x00007FF957444000-memory.dmp

Download

memory/1172-6-0x00007FF956AA0000-0x00007FF957444000-memory.dmp

Download

memory/1172-5-0x00007FF956AA0000-0x00007FF957444000-memory.dmp

Download

memory/1172-2-0x0000014ED3F90000-0x0000014ED4118000-memory.dmp

Download

memory/1172-3-0x00007FF956AA0000-0x00007FF957444000-memory.dmp

Download

memory/4620-298-0x00000000032B0000-0x00000000032C8000-memory.dmp

Download

memory/4620-291-0x0000000000FD0000-0x0000000001068000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads