1da3b9d89c8932b5597e752fe1468ebe236d21328a2453769624f69becf05656

Analysis

max time kernel
148s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 12:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
support.client.exe
Size 83KB
Sample260820-pf4teazvcs
SHA256 1da3b9d89c8932b5597e752fe1468ebe236d21328a2453769624f69becf05656
MD5 2f6b5f2fd13471519adb8d74b0715479
SHA1 006c04308a62f31a603460c2687eccd9f391fc98
SHA512 3b7083f93dd1012af40f3a613082d9e8709ae3c7b803f693aa2066a650d8395672b366578832aef3d49ba3ece452e05ea88c9be3957cb43b39e0eae75e4f3c7b
SSDEEP 1536:LoG6KpY6Qi3yj2wyq4HwiMO10HVLCJRpsWr6cdaWPBJYY179fJn:lenkyfPAwiMq0RqRfbaWZJYY13n
TLSH
T18A836C43B5D184B5E9720E3118B1D9F4593FBE110E648EAB3398426E0F352D19E3AE7B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery revoked_codesign spyware trojan

Malware Config

Signatures

Downloads MZ/PE file 6 IoCs

flow	pid	Process
5	4628	dfsvc.exe
5	4628	dfsvc.exe
5	4628	dfsvc.exe
5	4628	dfsvc.exe
5	4628	dfsvc.exe
5	4628	dfsvc.exe

Manipulates Digital Signatures 1 TTPs 1 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\C6F3A56E194FDC3DFA0D2D80039C870CDAAF8D68\Blob = 030000000100000014000000c6f3a56e194fdc3dfa0d2d80039c870cdaaf8d682000000001000000aa040000308204a63082038ea00302010202145fbd242cb0a6812a0ddb14e6200422b1fd0fd7d7300d06092a864886f70d01010b050030818b310b300906035504061302555331193017060355040a1310436c6f7564466c6172652c20496e632e31343032060355040b132b436c6f7564466c617265204f726967696e2053534c20436572746966696361746520417574686f72697479311630140603550407130d53616e204672616e636973636f311330110603550408130a43616c69666f726e6961301e170d3236303830373139343930305a170d3431303830333139343930305a306231193017060355040a1310436c6f7564466c6172652c20496e632e311d301b060355040b1314436c6f7564466c617265204f726967696e204341312630240603550403131d436c6f7564466c617265204f726967696e20436572746966696361746530820122300d06092a864886f70d01010105000382010f003082010a0282010100d01f6e38bb3eb885d0cbece59554a9a71f1a86707d2c4080e25133e370a00fba95e463a8109f02c5faec1b56234e201ade60fd83e4371103e955079013303baae05297179a16928285dcb4333a444ed86e9e6cf06446baf0f7d5507f391ca913299dea7493e5b49b53ed4c544e6e533b61ebe0849ced2cde20b980b8787b89796fd0c2aa274c8da3f0c5b98839767d82557ea77885eaba4dda5a280a1ea80fb19a53368db0e0065344e207c75556326477076b4b77559010da6cddb95f5d2e1ca41138ab769a962790593b45001e85a255856a0498bad4ceb39907585aae4185f5cbd633199354ba271fbd1d24e3567da206487d78198695c685f465a180d0830203010001a382012830820124300e0603551d0f0101ff0404030205a0301d0603551d250416301406082b0601050507030206082b06010505070301300c0603551d130101ff04023000301d0603551d0e04160414d9ae781f75b12e7da250de54c1ee9b78d39459ad301f0603551d2304183016801424e853575d7c344087a9eb94dbbae11678fc29a4304006082b0601050507010104343032303006082b060105050730018624687474703a2f2f6f6373702e636c6f7564666c6172652e636f6d2f6f726967696e5f636130290603551d1104223020820f2a2e736164616d756c612e73686f70820d736164616d756c612e73686f7030380603551d1f0431302f302da02ba0298627687474703a2f2f63726c2e636c6f7564666c6172652e636f6d2f6f726967696e5f63612e63726c300d06092a864886f70d01010b05000382010100861e5cce43466ffbceb3f6a3b2d59f708de9c8f5859e3101da21e3c78478d671e52edeb53cf6edbd22e9b7235f8a09536b4b8daca9acd97ba8abd100ac51dde4f949060f384b56c88d7f176e0bd444217039d340783b37cc2554d9e6ca50c726d2c6cbdc8826ea9555b5a84e94c46c1b081a98dca69ff72f7773245e8a68febffee69b442b6270374a88aea5b05e55060ac02aee685443ebce39b283adffbecc7fbf5fb3120e845d79abf8e24509141c5631e6bcf65f73907c2fa6249916ed5a38c08b3a74bfd0f3e42566ae2e5a8091a2538465c24f5c81e9125f43e3925edcda2ade1793734006cdd4accf826c64322cf64d8cfcd34ec8b94bb164435de7fd	support.client.exe

Signed with revoked ConnectWise certificate 4 IoCs

Binary is signed using a ConnectWise certificate revoked for key compromise.

revoked_codesign

resource	yara_rule
behavioral2/files/0x000c00000001c614-49.dat	revoked_cert_connectwise
behavioral2/files/0x000c00000001c60d-196.dat	revoked_cert_connectwise
behavioral2/files/0x000c00000001c60e-195.dat	revoked_cert_connectwise
behavioral2/files/0x000c00000001c612-191.dat	revoked_cert_connectwise

Executes dropped EXE 1 IoCs

pid	Process
4452	ScreenConnect.WindowsClient.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\KN9XTNHK.WN1\9PPW2WN2.X5R\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	support.client.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dfsvc.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0018.0003_dc2e9ccfa6fe95f2\scre..core_4b14c015c87c1ad8_0018.0003_none_5334f1fbf	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_4b14c015c87c1ad8_0018.0003_none_5334f1fbfe91ad06\Files	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\Gc_scre..tion_59a2f4d4d8d73d8d	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_4b14c015c87c1ad8_0018.0003_none_04888a4494511071\implication!scre..tion_25b0fbb6ef7eb094_0018.0003_c3 = 68747470733a2f2f6b696b616b752e736164616d756c612e73686f702f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32342e332e372e393036372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_25b0fbb6ef7eb094_0018.0003_none_97cb907042c6ab92\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32342e332e372e393036372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0018.0003_dc2e9ccfa6fe95f2	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0018.0003_dc2e9ccfa6fe95f2\scre..dows_4b14c015c87c1ad8_0018.0003_none_57acc9dd3	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0018.0003_none_e94a4fce0de1030a\DigestValue = 1220987627782d3c3397d4abf01ac3777999e01c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0018.0003_none_e94a4fce0de1030a\Transform = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0018.0003_none_b47bcb1fe7759013\lock!0e000000b699590e14120000d4160000000000000000000 = 30303030313231342c30316464333039646438613037306238	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_25b0fbb6ef7eb094_0018.0003_none_97cb907042c6ab92\lock!040000002d9b590e641100005c110000000000000000000 = 30303030313136342c30316464333039646466343637386564	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_25b0fbb6ef7eb = 68747470733a2f2f6b696b616b752e736164616d756c612e73686f702f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32342e332e372e393036372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32342e332e372e393036372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_4b14c015c87c1ad8_0018.0003_none_57acc9dd3adfc036\implication!scre..tion_25b0fbb6ef7eb094_0018.0003_c3 = 68747470733a2f2f6b696b616b752e736164616d756c612e73686f702f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32342e332e372e393036372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_25b0fbb6ef7eb094_0018.0003_none_38bfca06a9457575	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_25b0fbb6ef7eb094_0018.0003_none_97cb907042c6ab92\lock!06000000b699590e14120000d4160000000000000000000 = 30303030313231342c30316464333039646438613037306238	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0018.0003_dc2e9ccfa6fe95f2\scre...exe_25b0fbb6ef7eb094_0018.0003_none_97cb90704 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_4b14c015c87c1ad8_0018.0003_none_04888a4494511071\lock!180000003c9b590e641100005c110000000000000000000 = 30303030313136342c30316464333039646466343637386564	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\F_scre..tion_25b0fbb6ef7eb094_a17db7b664627bec\LastRunVersion = 68747470733a2f2f6b696b616b752e736164616d756c612e73686f702f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32342e332e372e393036372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32342e332e372e393036372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Categories	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0018.0003_none_e94a4fce0de1030a\SizeOfStronglyNamedComponent = e711030000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_25b0fbb6ef7eb094_0018.0003_dc2e9ccfa6fe95f2\lock!1d0000004c9b590e641100005c1100000000000000000000caa2 = 30303030313136342c30316464333039646466343637386564	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications\scre..tion_25b0fbb6ef7eb094_0018.0003_dc2e9ccfa6fe95f2\identity = 68747470733a2f2f6b696b616b752e736164616d756c612e73686f702f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32342e332e372e393036372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32342e332e372e393036372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0018.0003_none_b47bcb1fe7759013\lock!1a0000003c9b590e641100005c110000000000000000000 = 30303030313136342c30316464333039646466343637386564	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0018.0003_dc2e9ccfa6fe95f2\scre..ient_4b14c015c87c1ad8_0018.0003_none_e94a4fce0 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_4b14c015c87c1ad8_0018.0003_none_5334f1fbfe91ad06\SizeOfStronglyNamedComponent = 3b72080000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_25b0fbb6ef7eb094_0018.0003_none_38bfca06a9457575\lock!04000000b699590e14120000d4160000000000000000000 = 30303030313231342c30316464333039646438613037306238	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_25b0fbb6ef7eb094_0018.0003_none_38bfca06a9457575\implication!scre..tion_25b0fbb6ef7eb094_0018.0003_c3 = 68747470733a2f2f6b696b616b752e736164616d756c612e73686f702f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32342e332e372e393036372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0018.0003_none_b47bcb1fe7759013\Files	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_25b0fbb6ef7eb094_0018.0003_none_38bfca06a9457575	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_4b14c015c87c1ad8_0018.0003_none_5334f1fbfe91ad06\lock!1c0000003c9b590e641100005c110000000000000000000 = 30303030313136342c30316464333039646466343637386564	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications\scre..tion_25b0fbb6ef7eb094_0018.0003_dc2e9ccfa6fe95f2	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_25b0fbb6ef7eb094_0018.0003_none_97cb907042c6ab92\DigestValue = f271ebc2542397e59c3d57d30cc54bf1d9db4f69	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0018.0003_dc2e9ccfa6fe95f2\scre..dows_4b14c015c87c1ad8_0018.0003_none_57acc9dd3 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0018.0003_none_b47bcb1fe7759013\DigestValue = 0203b65e92d2d1200dd695fe4c334955befbddd3	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0018.0003_dc2e9ccfa6fe95f2\scre..ient_4b14c015c87c1ad8_0018.0003_none_e94a4fce0	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0018.0003_none_e94a4fce0de1030a\Files\ScreenConnect.Client.dll_fc1d7bd48553fcab = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_4b14c015c87c1ad8_0018.0003_none_04888a4494511071\DigestValue = f2d3160f15cfd0989091249a61132a369e44dea4	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0018.0003_dc2e9ccfa6fe95f2\scre...exe_25b0fbb6ef7eb094_0018.0003_none_97cb90704	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Assemblies	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0018.0003_none_e94a4fce0de1030a\implication!scre..tion_25b0fbb6ef7eb094_0018.0003_c3 = 68747470733a2f2f6b696b616b752e736164616d756c612e73686f702f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32342e332e372e393036372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_25b0fbb6ef7eb094_0018.0003_none_97cb907042c6ab92\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32342e332e372e393036372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_25b0fbb6ef7eb094_0018.0003_none_97cb907042c6ab92\lock!120000003c9b590e641100005c110000000000000000000 = 30303030313136342c30316464333039646466343637386564	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications\scre..tion_25b0fbb6ef7eb094_0018.0003_dc2e9ccfa6fe95f2\HasRunBefore = 01	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0018.0003_none_b47bcb1fe7759013\Transform = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0018.0003_none_e94a4fce0de1030a	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_4b14c015c87c1ad8_0018.0003_none_04888a4494511071	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_4b14c015c87c1ad8_0018.0003_none_57acc9dd3adfc036\identity = 53637265656e436f6e6e6563742e57696e646f77732c2056657273696f6e3d32342e332e372e393036372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_4b14c015c87c1ad8_0018.0003_none_57acc9dd3adfc036\DigestValue = 6b4b581fc4e3ecb91b24ec601daa0594106bcc5d	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_4b14c015c87c1ad8_0018.0003_none_04888a4494511071\identity = 53637265656e436f6e6e6563742e436c69656e74536572766963652c2056657273696f6e3d32342e332e372e393036372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_25b0fbb6ef7eb094_0018.0003_none_97cb907042c6ab92\Files\ScreenConnect.WindowsFileManager.exe_0e21 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_4b14c015c87c1ad8_0018.0003_none_57acc9dd3adfc036\identity = 53637265656e436f6e6e6563742e57696e646f77732c2056657273696f6e3d32342e332e372e393036372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\C6F3A56E194FDC3DFA0D2D80039C870CDAAF8D68\Blob = 030000000100000014000000c6f3a56e194fdc3dfa0d2d80039c870cdaaf8d682000000001000000aa040000308204a63082038ea00302010202145fbd242cb0a6812a0ddb14e6200422b1fd0fd7d7300d06092a864886f70d01010b050030818b310b300906035504061302555331193017060355040a1310436c6f7564466c6172652c20496e632e31343032060355040b132b436c6f7564466c617265204f726967696e2053534c20436572746966696361746520417574686f72697479311630140603550407130d53616e204672616e636973636f311330110603550408130a43616c69666f726e6961301e170d3236303830373139343930305a170d3431303830333139343930305a306231193017060355040a1310436c6f7564466c6172652c20496e632e311d301b060355040b1314436c6f7564466c617265204f726967696e204341312630240603550403131d436c6f7564466c617265204f726967696e20436572746966696361746530820122300d06092a864886f70d01010105000382010f003082010a0282010100d01f6e38bb3eb885d0cbece59554a9a71f1a86707d2c4080e25133e370a00fba95e463a8109f02c5faec1b56234e201ade60fd83e4371103e955079013303baae05297179a16928285dcb4333a444ed86e9e6cf06446baf0f7d5507f391ca913299dea7493e5b49b53ed4c544e6e533b61ebe0849ced2cde20b980b8787b89796fd0c2aa274c8da3f0c5b98839767d82557ea77885eaba4dda5a280a1ea80fb19a53368db0e0065344e207c75556326477076b4b77559010da6cddb95f5d2e1ca41138ab769a962790593b45001e85a255856a0498bad4ceb39907585aae4185f5cbd633199354ba271fbd1d24e3567da206487d78198695c685f465a180d0830203010001a382012830820124300e0603551d0f0101ff0404030205a0301d0603551d250416301406082b0601050507030206082b06010505070301300c0603551d130101ff04023000301d0603551d0e04160414d9ae781f75b12e7da250de54c1ee9b78d39459ad301f0603551d2304183016801424e853575d7c344087a9eb94dbbae11678fc29a4304006082b0601050507010104343032303006082b060105050730018624687474703a2f2f6f6373702e636c6f7564666c6172652e636f6d2f6f726967696e5f636130290603551d1104223020820f2a2e736164616d756c612e73686f70820d736164616d756c612e73686f7030380603551d1f0431302f302da02ba0298627687474703a2f2f63726c2e636c6f7564666c6172652e636f6d2f6f726967696e5f63612e63726c300d06092a864886f70d01010b05000382010100861e5cce43466ffbceb3f6a3b2d59f708de9c8f5859e3101da21e3c78478d671e52edeb53cf6edbd22e9b7235f8a09536b4b8daca9acd97ba8abd100ac51dde4f949060f384b56c88d7f176e0bd444217039d340783b37cc2554d9e6ca50c726d2c6cbdc8826ea9555b5a84e94c46c1b081a98dca69ff72f7773245e8a68febffee69b442b6270374a88aea5b05e55060ac02aee685443ebce39b283adffbecc7fbf5fb3120e845d79abf8e24509141c5631e6bcf65f73907c2fa6249916ed5a38c08b3a74bfd0f3e42566ae2e5a8091a2538465c24f5c81e9125f43e3925edcda2ade1793734006cdd4accf826c64322cf64d8cfcd34ec8b94bb164435de7fd	support.client.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\C6F3A56E194FDC3DFA0D2D80039C870CDAAF8D68	support.client.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\KN9XTNHK.WN1\9PPW2WN2.X5R\ScreenConnect.WindowsClient.exe:Zone.Identifier	dfsvc.exe
File created	C:\Users\Admin\AppData\Local\Apps\2.0\4KDOAHZV.2W8\2VWM0BEN.0DO\scre..ient_4b14c015c87c1ad8_0018.0003_none_b47bcb1fe7759013\ScreenConnect.WindowsClient.exe\:Zone.Identifier:$DATA	dfsvc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4628	dfsvc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4092 wrote to memory of 4628	4092	support.client.exe	89
PID 4628 wrote to memory of 4452	4628	dfsvc.exe	90

C:\Users\Admin\AppData\Local\Temp\support.client.exe
"C:\Users\Admin\AppData\Local\Temp\support.client.exe"
1⤵
- Manipulates Digital Signatures
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:4092
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
  2⤵
  - Downloads MZ/PE file
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4628
- - C:\Users\Admin\AppData\Local\Apps\2.0\4KDOAHZV.2W8\2VWM0BEN.0DO\scre..tion_25b0fbb6ef7eb094_0018.0003_dc2e9ccfa6fe95f2\ScreenConnect.WindowsClient.exe
    "C:\Users\Admin\AppData\Local\Apps\2.0\4KDOAHZV.2W8\2VWM0BEN.0DO\scre..tion_25b0fbb6ef7eb094_0018.0003_dc2e9ccfa6fe95f2\ScreenConnect.WindowsClient.exe"
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    PID:4452

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

scre...exe_25b0fbb6ef7eb094_0018.0003_none_97cb907042c6ab92.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\4KDOAHZV.2W8\2VWM0BEN.0DO\manifests\scre...exe_25b0fbb6ef7eb094_0018.0003_none_97cb907042c6ab92.cdf-ms
Size 24KB
SHA256 4828731fbba80e167133f6ba76e9c78d358c18bd6671775a549116234139c482
MD5 7b333d3649e0fda13722f8ea3c0f1e88
SHA1 464141c238f47a0e640657830a7b27edebcb53a0
SHA512 8aaff58a101c13de79f788618b8602d06ca268892b8f7caf9f6650573729b505c6d4dc4e315b8b6ad7f514b9aa083059e9750d2c7e8ebc2cfc2492871f653b42
SSDEEP 384:iOrqQHOGnph6cOX9jX9R/QPIBM7YV+++amtn:inonn6cOX9jX9R/QPI+0V+++amtn
TLSH
T1B6B27041B7D2E923D2466733DCE6C3E53236FD914EA6138B30453B2EAD707C95A23686
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..core_4b14c015c87c1ad8_0018.0003_none_5334f1fbfe91ad06.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\4KDOAHZV.2W8\2VWM0BEN.0DO\manifests\scre..core_4b14c015c87c1ad8_0018.0003_none_5334f1fbfe91ad06.cdf-ms
Size 3KB
SHA256 ec65f08e1499b9de51548c7274664398004e57d8b41366d07964938f1a4293b5
MD5 3bf028b98f21d63b23774ed5d3aa93f4
SHA1 777084bed62d63fe6e490cbb8c982af112fa1f74
SHA512 6cc807834e2320c123b0a8187d2a943325f91aaf967d14cf66720d327d160fbf5215a213da4e3d2bec6d138ed10f2c3671b1397bbf1646501e8a735d46f272b8
TLSH
T113619741B644DE17D9690633ACD5D6EE36B57E83CF82820B74C07F6F7A362F50621291
MD5 SHA1 SHA512 TLSH

Submit Download

scre..dows_4b14c015c87c1ad8_0018.0003_none_57acc9dd3adfc036.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\4KDOAHZV.2W8\2VWM0BEN.0DO\manifests\scre..dows_4b14c015c87c1ad8_0018.0003_none_57acc9dd3adfc036.cdf-ms
Size 5KB
SHA256 a7820e6e3e8df4671503bd41cf95160b6d3d31f46014bf867062919de33ec7f4
MD5 9504da86fd70a6cadc108bb9c54c32ba
SHA1 1f3c0447a0eaef3761679b25a838ede48cad4276
SHA512 93e9a1125062cf430f34849b3afb0f7a11f2f336c0db7437ab9901983706b6891f6c662fc0348cd1cf146f6407bb528547a171ac5f3189a706374835fff42b2f
SSDEEP 96:HSP+RxlSKeV+Ww7NkjfjL4DTMDXa+ctwCcngnsRK:PRxl8Jxjf3yTMUt/EQv
TLSH
T174B15311B344CA17D4B806336CA6C3DD2B61BE13CE81420B70D47B2FB6335EA47262A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_4b14c015c87c1ad8_0018.0003_none_b47bcb1fe7759013.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\4KDOAHZV.2W8\2VWM0BEN.0DO\manifests\scre..ient_4b14c015c87c1ad8_0018.0003_none_b47bcb1fe7759013.cdf-ms
Size 6KB
SHA256 4490772c80bc545bb3577a7fa290b5b5222486f748464ee8b7d6423ac461d3b0
MD5 54c55cf586f8abf221115da5df184d6a
SHA1 897f0623851237811245e20fbc43b77099d714c1
SHA512 e45da276ed7c5adf8452168013a7e4dce1768417f541d328096d2009102e0e2ede1a0c4f2893f048d12de9e182549382402d30dc016db4da5734273b4840897f
SSDEEP 96:E4GBPPbpvpeV+Wwwx8Wpm2TOtPO6gb6OL6zV2iAHn6qB/B:sPPcJxpmZPQb6OOwiAH6k
TLSH
T14BD1FE227305EE57D4B90A33AC5AD3DD27683D56DE42470B70C4BF2F7A322B61B26191
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_4b14c015c87c1ad8_0018.0003_none_e94a4fce0de1030a.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\4KDOAHZV.2W8\2VWM0BEN.0DO\manifests\scre..ient_4b14c015c87c1ad8_0018.0003_none_e94a4fce0de1030a.cdf-ms
Size 2KB
SHA256 a155b463067adeda3f37f06c757373dcaa68f08837a9d21629c38c04626dab64
MD5 8d35a852164475a2d949f0f2e7253c64
SHA1 5795e3b1a9a983772cdc76613e7690142715349e
SHA512 ead1864aba70b4fce49c7e76f618ce26f799a33a08907e1def0afe8e64b6d0639bdf5699ca0fc3df6ee81a7f995824d697a13830c6e5fb9b9e6044f4740ba00b
TLSH
T1945121017748D667DA260331ACA2C1CE7BB83D43CE91110BB0C0377F5A726D55B1A1A6
MD5 SHA1 SHA512 TLSH

Submit Download

scre..tion_25b0fbb6ef7eb094_0018.0003_none_38bfca06a9457575.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\4KDOAHZV.2W8\2VWM0BEN.0DO\manifests\scre..tion_25b0fbb6ef7eb094_0018.0003_none_38bfca06a9457575.cdf-ms
Size 14KB
SHA256 95d4c1b5e6ef05c153909482a1bce6cba75b531492fb72e23763fd039860c43a
MD5 7bffc6a3d376c125590a404b2113ae0d
SHA1 9fd19af898f197f8f04c57bbc76642b231aa173c
SHA512 2fd7a4a62474af7736a11ec8749118d906f4365af58574fa31756a2ea158ec94271378fb5887cdeff280b51253040d681788f24bf94693c6ac619fb124c8d92e
SSDEEP 192:jfMwI9rf6h9o8s8owwSzN8s8oTN2x2QPIlFDLhEDh7BqWojOF:jfMR9rf6QX9mxX9R/QPIBM7YjC
TLSH
T1DB6206847B50EA13C106A633CCE3C7E53679FE934ED3479B74427B1F6938B845A22292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..vice_4b14c015c87c1ad8_0018.0003_none_04888a4494511071.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\4KDOAHZV.2W8\2VWM0BEN.0DO\manifests\scre..vice_4b14c015c87c1ad8_0018.0003_none_04888a4494511071.cdf-ms
Size 4KB
SHA256 a508b0103cabe26e07332fd8ee06ad0732627b43722018b24e9355b1bcd51189
MD5 1e6094e3c137e556368f7505fe111d8f
SHA1 fc61e35e9e801a4316eb17f7e0204215abeb1da9
SHA512 eca11ec0e22713371a05edc8bdb144471f21eec9d7ea1fcc1dcafd124d9440be737c25a4ead9458a6d0801cff9c8ac3de9f482a113129a50059bce6c7da87270
SSDEEP 96:aa3ceV+Ww8x45u87k5sBDEn4wDaOXfn6GyVf:7DJiu8t2/rXf6b
TLSH
T16A91DE117280E92BD1A50A32AC56C2ED3B7ABC82DD414B0770C43F3F76795F61B32156
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0415btfo.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\4KDOAHZV.2W8\2VWM0BEN.0DO\scre..tion_25b0fbb6ef7eb094_0018.0003_dc2e9ccfa6fe95f2\0415btfo.newcfg
Size 574B
SHA256 6113a62c3ee9b84ff7f33a21a56b699133e9bda24afb101255e4f058615a805e
MD5 7b5bd8194df2023fba3fd1e562c10485
SHA1 75d50b4e8c47168c7c2ed4cafb203da77969f165
SHA512 e15495ba9334a8181bad0db2d22c47fc5a2a97de9e18afefa5a59ff8ceb6e8f95637ba97d422c28c59c38d9e807038cf8d6b57634f07d4363a70c99f7004b907
TLSH
T141F0F6A531807E5A03636D23C5124744AD722B9B0555209874BF613B5F315DA07A32DA
MD5 SHA1 SHA512 TLSH

Submit Download

2lcnmfmz.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\4KDOAHZV.2W8\2VWM0BEN.0DO\scre..tion_25b0fbb6ef7eb094_0018.0003_dc2e9ccfa6fe95f2\2lcnmfmz.newcfg
Size 574B
SHA256 25f7c736f24b4654c9ae0b4d780de9cad847692582f0b9fdff26cb3cbef36789
MD5 b837eff7af0752f17787c51bb668a1ba
SHA1 f181880c718af272f0bcb256421da5fb9cb8466a
SHA512 93ce72bcc1f94792e277a0274d002072a1778c9336b45b61857a9dfd4c6022107b6fb6e48475f2afa721efd66f01d207265f4dac1b4eac3f75319dde4f90a2b5
TLSH
T116F02BA531807E5A03736D33C5124744EE721BDB0555209874BF613B5F315DB07A31DE
MD5 SHA1 SHA512 TLSH

Submit Download

app.config

Path C:\Users\Admin\AppData\Local\Apps\2.0\4KDOAHZV.2W8\2VWM0BEN.0DO\scre..tion_25b0fbb6ef7eb094_0018.0003_dc2e9ccfa6fe95f2\app.config
Size 1KB
SHA256 805e6e9447a4838d874d84e6b2cdff93723641b06726d8ee58d51e8b651cd226
MD5 2744e91bb44e575ad8e147e06f8199e3
SHA1 6795c6b8f0f2dc6d8bd39f9cf971bab81556b290
SHA512 586edc48a71fa17cdf092a95d27fce2341c023b8ea4d93fa2c86ca9b3b3e056fd69bd3644edbad1224297bce9646419036ea442c93778985f839e14776f51498
TLSH
T1B441601DB5C0AF9915B25631E73152D1EC6009335266B0E0B8DE316B9F70ECA4BF32EA
MD5 SHA1 SHA512 TLSH

Submit Download

bmr42coo.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\4KDOAHZV.2W8\2VWM0BEN.0DO\scre..tion_25b0fbb6ef7eb094_0018.0003_dc2e9ccfa6fe95f2\bmr42coo.newcfg
Size 574B
SHA256 3da6a75045f24f0c92821f0dc9c9a74988084c2799e1dadccbaade1c80d793b7
MD5 d67ab8375f7d458db0cec76dd7780dd0
SHA1 d7f50cdbc130187b9bbd014cf81d05c1b01a0b24
SHA512 013ab119bce90700dd6a6827eb5ec31e917a12901120b93f0ae511c8e47e4aa0da0732f54e8ad5425d5be08162030890bca2d42e72bcfe4b51c67e2052c617ed
TLSH
T1E1F02BA531807E5A03736D33C5124744ED721BDB0555209874BF613B9F315DB07A31DE
MD5 SHA1 SHA512 TLSH

Submit Download

fckvgu52.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\4KDOAHZV.2W8\2VWM0BEN.0DO\scre..tion_25b0fbb6ef7eb094_0018.0003_dc2e9ccfa6fe95f2\fckvgu52.newcfg
Size 574B
SHA256 35b028cde5cc189299a9248d1d16b4e08126a49861fe5489e04bf3a0e91673c7
MD5 4d490209f12bfea648b7dd02fd7e7bde
SHA1 bc220fa2b910c865a64a1f033eb8d9b5c297d182
SHA512 2161968f0b87ac8144acdbb19d541cb15736e1b5254c5f2c85146ba247b5300cae57003775112ac15856fe1fb553711036f92342ebdd32f6c1c24e4f81a7f87d
TLSH
T124F0F6A931807E5A03636D23C5124744AD722B9B0555209874AF613B5F315DA07A32DA
MD5 SHA1 SHA512 TLSH

Submit Download

gtd3ck1m.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\4KDOAHZV.2W8\2VWM0BEN.0DO\scre..tion_25b0fbb6ef7eb094_0018.0003_dc2e9ccfa6fe95f2\gtd3ck1m.newcfg
Size 574B
SHA256 402ab6dbcb8b0f2b634a8e038bb0aa9ed36d17651e56e611440646366bd254ed
MD5 31cde8213e803eac95496624bc459d4f
SHA1 1a3c0aa9b410f9446b585c18ab01dd85141e60a4
SHA512 9095e2af4bcb9be38a832724476ab34936badc6655b25f59f2bcbdad8bd00efc6c3d98a2ce471d56e83427623b15f12b7c5c212b1453f654aaeed5143bb25772
TLSH
T19DF0F6A531807E5A03636D23C5124744ED722B9B0555209874AF613B5F315DA07A32DA
MD5 SHA1 SHA512 TLSH

Submit Download

hx3cw4fg.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\4KDOAHZV.2W8\2VWM0BEN.0DO\scre..tion_25b0fbb6ef7eb094_0018.0003_dc2e9ccfa6fe95f2\hx3cw4fg.newcfg
Size 574B
SHA256 4205ca2ac590667b672df6c0752242509e80c33fd93adc06bea42d781e2daf10
MD5 67de43d655733edeb1f1409eee56fca7
SHA1 b4d8125c52f40e85d574e34d9cac414c43ac6447
SHA512 b11dbd2d96fdb0745cdcd810bc689dec969289c8db87e959ab1c72bc10e7b3e07c014fb82c6629f7f22810b21f8a800fa4946752defbac1fc717225bea87c3a2
TLSH
T1CAF02BA531807E5A03736D33C5124744ED721BDB0555209874BF613B5F315DB07A31DE
MD5 SHA1 SHA512 TLSH

Submit Download

jsokvvce.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\4KDOAHZV.2W8\2VWM0BEN.0DO\scre..tion_25b0fbb6ef7eb094_0018.0003_dc2e9ccfa6fe95f2\jsokvvce.newcfg
Size 574B
SHA256 53bc7ec4939b1eeb6ca10da1f3bed542352dcda4a1a4b3222ac43dfcf09ba4f2
MD5 0842bfb6aba647ccb3ad0da28cebf3a4
SHA1 8cdca83186f2ee2fe2660c39d3b1be3ed97c0e29
SHA512 96757b10da93b714a2e6240b7f2843f1f2a85ab23fec936d9f1f6067a06b81e1151a252f2b5851081fff899eb290d46f363b3f3bc79ad96308f7915aed895450
TLSH
T1D9F02BA931807E5A03736D33C5124744ED721BDB0555209874BF613B5F315DB07A31DE
MD5 SHA1 SHA512 TLSH

Submit Download

ttnlvc0o.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\4KDOAHZV.2W8\2VWM0BEN.0DO\scre..tion_25b0fbb6ef7eb094_0018.0003_dc2e9ccfa6fe95f2\ttnlvc0o.newcfg
Size 574B
SHA256 7224ad3e76c239d30f82f7ff28c94d79061b22f287b78cda51b5331c1bf4d628
MD5 7843df529b23c694235c0811f9295b1f
SHA1 03c6334ba24d6e7347c226066130cef1576f7cc5
SHA512 05e07e26f40ad711cfcae7b832c3e39ad44854fab86f2c8fb413284fec7d759497ae1bb49f0b573237bec51dcf9cc0018e69b7a98e1da6bb7d498fee8c802558
TLSH
T168F0F6A931807E5A03636D23C5124744AD722B9B0555209874AF613B5F315DA07A32DA
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Users\Admin\AppData\Local\Apps\2.0\4KDOAHZV.2W8\2VWM0BEN.0DO\scre..tion_25b0fbb6ef7eb094_0018.0003_dc2e9ccfa6fe95f2\user.config
Size 574B
SHA256 48f987cb2ee3fa2bfe3245d511eb28e8c44ae9f30549e5e85eea1a3f1a35afdb
MD5 7760792a737c6f8fd684ad6b07f3817b
SHA1 062712733b5b0fde80f02d0b4d95c597a95f42c1
SHA512 c94f130467930547c33cdaf1ef76f9ae2a31ca996a18526c1679c3991b17ff5772039fed529423ca2fb1e5a2769737073bbb0bbb638b2313a68c39cdc9d0c9de
TLSH
T1A2F0F6A531807E5A07A36D23C5124745AD722B9B0555209874AF613B5F315DA07A32DA
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Users\Admin\AppData\Local\Apps\2.0\4KDOAHZV.2W8\2VWM0BEN.0DO\scre..tion_25b0fbb6ef7eb094_0018.0003_dc2e9ccfa6fe95f2\user.config
Size 574B
SHA256 2b2de81278c5b2625e2db4633b0638b9407d3885dd27f9d179015a92c18a2de9
MD5 ee269cda508c36c17eb778e833eb6f96
SHA1 5e6156d6df755f2b57b14238e6f4192bb0e14d75
SHA512 17a80a9e5d3d372030c0e4c485e16080d59ca8b6a9ab3c9b5325346ad6066ba59135788a821302d0a4030bba48b5d0a8301658896bfddca8c6bc8e186db46d36
TLSH
T14BF0F6A531807E5A03636D23C5124744AD722B9B0555209874BF613B5F315DA07A32DA
MD5 SHA1 SHA512 TLSH

Submit Download

22M2BPJG.T5W.application

Path C:\Users\Admin\AppData\Local\Temp\Deployment\43Y9G97E.XAT\22M2BPJG.T5W.application
Size 114KB
SHA256 89eb055f32184dfe333494a271ed865958d5adc1521043c6d81098f541cc0b3f
MD5 fe06c5e9c53ab451368667d3e3b1504b
SHA1 7c76334bb2bc0d1e444a1fcaa484b642572cad1e
SHA512 b0c6570f937582b1072491506992ad077bd271b7301c26624a9418baf77bbe5496d30ef3522d63d60ef8beecc2ca113788b4a91833b99d931c841bac0d051caa
SSDEEP 3072:xNIcT51/FXvMVNWfCXq9ym7m2o9HuzhJOvP:gcfiVIpmt8vOvP
TLSH
T12CB3E82ACF30F4C4877DB021D1652D6735811B57DBB30FACDA0A286B0E69792EF5A64C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\KN9XTNHK.WN1\9PPW2WN2.X5R\ScreenConnect.Client.dll
Size 192KB
SHA256 ea0a545f40ff491d02172228c1a39ae68344c4340a6094486a47be746952e64f
MD5 3724f06f3422f4e42b41e23acb39b152
SHA1 1220987627782d3c3397d4abf01ac3777999e01c
SHA512 509d9a32179a700ad76471b4cd094b8eb6d5d4ae7ad15b20fd76c482ed6d68f44693fc36bcb3999da9346ae9e43375cd8fe02b61edeabe4e78c4e2e44bf71d42
SSDEEP 3072:/xLtNGTlIyS7/ObjusqVFJRJcyzvYqSmzDvJXYF:FtNGTGySabqPJYbqSmG
TLSH
T1DD144B8633A94E36DA9F5D73B46060358AB5ED066023E3EE5E04F9F61A733408E553E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\KN9XTNHK.WN1\9PPW2WN2.X5R\ScreenConnect.Client.dll.genman
Size 1KB
SHA256 f1bf5014656d836a4c5c42e7ed67ff368d1706c41082e1e4f33abf9cda09d647
MD5 618dc5f6c85a2057bc7a86c5f498e2f1
SHA1 5073b2c3a117985e8f26ed5bea8c93a5bb202eea
SHA512 a8ed838573ef9a4119a4d32335543ea5074250d47212068ef2c4b470a451eb0154bceb8b3bf8b0722d4250122f6b5a196383576f715fd938d3ccb6cbde7c2799
TLSH
T14A11590181C8FA361F3301D1BEE7E02157AE1B33058D194BB0A968AFCB2DAE643471B3
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\KN9XTNHK.WN1\9PPW2WN2.X5R\ScreenConnect.ClientService.dll
Size 66KB
SHA256 fd5818dcdf5fc76316b8f7f96630ec66bb1cb5b5a8127cf300e5842f2c74ffca
MD5 5db908c12d6e768081bced0e165e36f8
SHA1 f2d3160f15cfd0989091249a61132a369e44dea4
SHA512 8400486cadb7c07c08338d8876bc14083b6f7de8a8237f4fe866f4659139acc0b587eb89289d281106e5baf70187b3b5e86502a2e340113258f03994d959328d
SSDEEP 1536:+A0ZscQ5V6TsQqoSD6h6+39QFVIl1zJhb8gq:p0Zy3gUOQFVQzJq
TLSH
T1C2634A45A3E95E77C9DF5F7C7865B1410FB08A02E462FB989CC9A8D71A537C12E003AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\KN9XTNHK.WN1\9PPW2WN2.X5R\ScreenConnect.ClientService.dll.genman
Size 1KB
SHA256 276b0232a7c76292d34207f916966ea1bcd5cd7e1e1d9a2751c663f06e45b63c
MD5 4e77158d54337b51a6368d7d094397c4
SHA1 3a029b30b95786adf97fb3c0b1c37b11154e0344
SHA512 69d7a90b2802575555e68991d157885253a72f5ed5181af5795e52bb6165b979542f482bac1e3cc164013133a4b812e1ec10bbcd39aa1166318099abc267ed95
TLSH
T1C831E90651C4FA351F3301C1BEE7E0619BAE1B33158E1947709969ABCF2DAA64347173
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\KN9XTNHK.WN1\9PPW2WN2.X5R\ScreenConnect.ClientService.exe
Size 93KB
SHA256 f1b5c000794f046259121c63ed37f9eff0cfe1258588eca6fd85e16d3922767e
MD5 75b21d04c69128a7230a0998086b61aa
SHA1 244bd68a722cfe41d1f515f5e40c3742be2b3d1d
SHA512 8d51b2cd5f21c211eb8fea4b69dc9f91dffa7bb004d9780c701de35eac616e02ca30ef3882d73412f7eab1211c5aa908338f3fa10fdf05b110f62b8ecd9d24c2
SSDEEP 1536:Eg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkggU0HMx790K:dhbNDxZGXfdHrX7rAc6myJkggU0HqB
TLSH
T1B7935B13B5C28872D473093158E0DAB49A3FF9215E61DEAB3798022E4F741C1AE75EB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\KN9XTNHK.WN1\9PPW2WN2.X5R\ScreenConnect.Core.dll
Size 536KB
SHA256 a2e9752de49d18e885cbd61b29905983d44b4bc0379a244bfabdaa3188c01f0a
MD5 14e7489ffebbb5a2ea500f796d881ad9
SHA1 0323ee0e1faa4aa0e33fb6c6147290aa71637ebd
SHA512 2110113240b7d803d8271139e0a2439dbc86ae8719ecd8b132bbda2520f22dc3f169598c8e966ac9c0a40e617219cb8fe8aac674904f6a1ae92d4ac1e20627cd
SSDEEP 12288:xC2YKhQCNc6kVTplfWL/YTHUYCBdySISYz:HhE6O7WL/EC
TLSH
T12BC47D2233AC9A2EC56E133BB072915DC5F0E906351AF79F76C5E5BC2EC27450E112EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\KN9XTNHK.WN1\9PPW2WN2.X5R\ScreenConnect.Core.dll.genman
Size 1KB
SHA256 ac3c489c02264ff1918fc0b79083a7754b98542a6cc4e2af67eafdbf76c6232e
MD5 293c100b1896e7532d241dac2b32dcb3
SHA1 1e14b49c9af799da0371474bf712f3ac3e5b6ebc
SHA512 ed3935d90f48043be2bf7a60cacbb47964672eab0c9ebfc2eeac8ebc4341383f32f55901601de56698eef6aec6399e77eb8dec6f5158d1b3761d5f25adfc3499
TLSH
T1AE216A0181C8FA261F3302D2BEE7E421979E5B3314CD194B7469689FCB2DAD64747173
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\KN9XTNHK.WN1\9PPW2WN2.X5R\ScreenConnect.Windows.dll
Size 1.6MB
SHA256 84a09ed81afc5ff9a17f81763c044c82a2d9e26f852de528112153ee9ab041d0
MD5 9ad3964ba3ad24c42c567e47f88c82b2
SHA1 6b4b581fc4e3ecb91b24ec601daa0594106bcc5d
SHA512 ce557a89c0fe6de59046116c1e262a36bbc3d561a91e44dcda022bef72cb75742c8b01bedcc5b9b999e07d8de1f94c665dd85d277e981b27b6bfebeaf9e58097
SSDEEP 24576:dx5xeYkYFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPo:dx5xTkYJkGYYpT0+TFiH7efP
TLSH
T1DC85BD41E2C365F5D46B047888BF572ABA743C080315CAFB97D4AE396D33BC09A36756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\KN9XTNHK.WN1\9PPW2WN2.X5R\ScreenConnect.Windows.dll.genman
Size 1KB
SHA256 d48afb709e61b86eb6eef67b41d0fa7ec780c4536f5cf9aca7a0b440aed98ef0
MD5 88ecd545bdbe3ed49c6a2b87589102ec
SHA1 e72949af66b0a20e50474d2005e320ba63ba9b2b
SHA512 7ed19ed32e02348abc8a64ca0a21e05496a6595a8b94d3f960cf3f6a6c6445d30aad7aec09ce76776023f9e5f4b40df032408deffba102026247099879cb95de
TLSH
T17F41D01281C8FA250F3302C2BEEBE431979E5723158E194B7499A99BCF29AE74747137
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsBackstageShell.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\KN9XTNHK.WN1\9PPW2WN2.X5R\ScreenConnect.WindowsBackstageShell.exe
Size 59KB
SHA256 e25f32ba3fa32fd0ddd99eb65b26835e30829b5e4b58573690aa717e093a5d8f
MD5 afa97caf20f3608799e670e9d6253247
SHA1 7e410fde0ca1350aa68ef478e48274888688f8ee
SHA512 fe0b378651783ef4add3851e12291c82edccde1dbd1fa0b76d7a2c2dcd181e013b9361bbdae4dae946c0d45fb4bf6f75dc027f217326893c906e47041e3039b0
SSDEEP 1536:kW/+lo6MOc8IoiKWjrNv8DtyQ4RE+TC6WAhVbb57bP8:kLlo6dccldyQGWy5s
TLSH
T1DE537D4063F84A26C9FE5E3AB4F1D2250AF1AA426451E7AE0ECD51E94E137C16F603F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\KN9XTNHK.WN1\9PPW2WN2.X5R\ScreenConnect.WindowsClient.exe
Size 588KB
SHA256 600cf10e27311e60d32722654ef184c031a77b5ae1f8abae8891732710afee31
MD5 1778204a8c3bc2b8e5e4194edbaf7135
SHA1 0203b65e92d2d1200dd695fe4c334955befbddd3
SHA512 a902080ff8ee0d9aeffa0b86e7980457a4e3705789529c82679766580df0dc17535d858fbe50731e00549932f6d49011868dee4181c6716c36379ad194b0ed69
SSDEEP 6144:fybAk1FVMVTZL/4TvqpU0pSdRW3akod1sI5mgve8mZXuRFtSc4q2/R4IEyxuV5AN:qbAOwJ/MvIFptJoR5NmtiFsxsFE
TLSH
T168D46D2677B8DB6BC9EF073AB0B15E2457B0E8036686D78E48A4B5D90DC738149093F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Users\Admin\AppData\Local\Temp\Deployment\KN9XTNHK.WN1\9PPW2WN2.X5R\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
TLSH
T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\KN9XTNHK.WN1\9PPW2WN2.X5R\ScreenConnect.WindowsClient.exe.genman
Size 2KB
SHA256 8aa9dacc29faef7be40d54b45fba75afc13bf25638d9a46dc4b516529ae74619
MD5 6a1c3ff3e8f5e23698453b4ccda2fd12
SHA1 c7eed4383b7f1982222e663a0b8850d09b6b20ef
SHA512 c9f09c968d71f4d7481c1aadbf8337fbce052f71aa168795daf374d53cc827ba9e7f1cf9adc50fc423cf68ee500bfc931dd2e14648626ed7d688f1a41447dccc
TLSH
T19951B40641C8FA210F3301C1BEEBE471979E5B32158E19477099A99FCF2DAA74747137
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.manifest

Path C:\Users\Admin\AppData\Local\Temp\Deployment\KN9XTNHK.WN1\9PPW2WN2.X5R\ScreenConnect.WindowsClient.exe.manifest
Size 17KB
SHA256 2e0e46f395d5a6440f179b61c4008abf3d72cfcda705a543c8ee18b41d37b025
MD5 7f68a01c2fea1c80a75e287bb36d6b43
SHA1 f271ebc2542397e59c3d57d30cc54bf1d9db4f69
SHA512 c6c1c9d6d9c50f94c9bc8c8a422cd00397ee184b6f6113ea19f9209c0e2339b540ee92d35bcce81f242d6fdc3c720ec2e56675e702e90c91533a07fa9f9db753
SSDEEP 384:rexTuzvdu98aXVEf6/DX9mX9FX9R/QPIYM7Y7:rn6/DX9mX9FX9R/QPIN07
TLSH
T1EB82C54A88C17C11433691D0FFF38920BE556B2341FE048ABC4E55AF8F6569993972F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsFileManager.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\KN9XTNHK.WN1\9PPW2WN2.X5R\ScreenConnect.WindowsFileManager.exe
Size 79KB
SHA256 ebd04a4540d6e76776bd58deea627345d0f8fba2c04cc65be5e979a8a67a62a1
MD5 1aee526dc110e24d1399affccd452ab3
SHA1 04db0e8772933bc57364615d0d104dc2550bd064
SHA512 482a8ee35d53be907be39dbd6c46d1f45656046baca95630d1f07ac90a66f0e61d41f940fb166677ac4d5a48cf66c28e76d89912aed3d673a80737732e863851
SSDEEP 1536:Ety9l44Kzb1I5kLP+VVVVVVVVVVVVVVVVVVVVVVVVVC7j27Vy:PvqukLdn2s
TLSH
T18883E68235762631DF85C5379492C9B59D366F22133DC5BD2DA2FE3A69F03043A8ADB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4452-289-0x0000000000AC0000-0x0000000000B56000-memory.dmp

Download

memory/4452-296-0x0000000002D10000-0x0000000002D28000-memory.dmp

Download

memory/4628-303-0x00007FF8E6220000-0x00007FF8E6BC4000-memory.dmp

Download

memory/4628-3-0x00007FF8E6220000-0x00007FF8E6BC4000-memory.dmp

Download

memory/4628-47-0x000001736D630000-0x000001736D6C6000-memory.dmp

Download

memory/4628-41-0x000001736D8F0000-0x000001736DA9A000-memory.dmp

Download

memory/4628-31-0x00007FF8E6220000-0x00007FF8E6BC4000-memory.dmp

Download

memory/4628-24-0x00007FF8E6220000-0x00007FF8E6BC4000-memory.dmp

Download

memory/4628-19-0x00007FF8E6220000-0x00007FF8E6BC4000-memory.dmp

Download

memory/4628-16-0x00007FF8E6220000-0x00007FF8E6BC4000-memory.dmp

Download

memory/4628-14-0x00007FF8E6220000-0x00007FF8E6BC4000-memory.dmp

Download

memory/4628-279-0x00007FF8E6220000-0x00007FF8E6BC4000-memory.dmp

Download

memory/4628-1-0x000001734E370000-0x000001734E378000-memory.dmp

Download

memory/4628-304-0x00007FF8E6220000-0x00007FF8E6BC4000-memory.dmp

Download

memory/4628-53-0x000001736D450000-0x000001736D486000-memory.dmp

Download

memory/4628-13-0x00007FF8E6220000-0x00007FF8E6BC4000-memory.dmp

Download

memory/4628-59-0x0000017368E60000-0x0000017368E78000-memory.dmp

Download

memory/4628-305-0x00007FF8E6220000-0x00007FF8E6BC4000-memory.dmp

Download

memory/4628-12-0x000001736B330000-0x000001736B380000-memory.dmp

Download

memory/4628-11-0x00007FF8E6220000-0x00007FF8E6BC4000-memory.dmp

Download

memory/4628-321-0x00007FF8E6220000-0x00007FF8E6BC4000-memory.dmp

Download

memory/4628-8-0x00007FF8E6220000-0x00007FF8E6BC4000-memory.dmp

Download

memory/4628-7-0x00007FF8E6220000-0x00007FF8E6BC4000-memory.dmp

Download

memory/4628-6-0x00007FF8E6220000-0x00007FF8E6BC4000-memory.dmp

Download

memory/4628-5-0x00007FF8E6220000-0x00007FF8E6BC4000-memory.dmp

Download

memory/4628-4-0x00007FF8E6220000-0x00007FF8E6BC4000-memory.dmp

Download

memory/4628-65-0x000001736D620000-0x000001736D6AC000-memory.dmp

Download

memory/4628-2-0x0000017368B30000-0x0000017368CB8000-memory.dmp

Download

memory/4628-0-0x00007FF8E63AF000-0x00007FF8E63B0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads