{
  "Name": "247ithelp.com (ConnectWise)",
  "Category": "RMM",
  "Description": "247ithelp.com (ConnectWise) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.",
  "Author": "",
  "Created": "2024-08-02",
  "LastModified": "2025-12-14",
  "Details": {
    "Website": "https://www.247ithelp.com/",
    "PEMetadata": {
      "Filename": "",
      "OriginalFileName": "",
      "Description": ""
    },
    "Privileges": "",
    "Free": "",
    "Verification": "",
    "SupportedOS": [],
    "Capabilities": [],
    "Vulnerabilities": [],
    "InstallationPaths": [
      "Remote Workforce Client.exe"
    ]
  },
  "Artifacts": {
    "Disk": [],
    "EventLog": [],
    "Registry": [],
    "Network": [
      {
        "Description": "Known remote domains",
        "Domains": [
          "*.247ithelp.com"
        ],
        "Ports": []
      }
    ]
  },
  "Detections": [
    {
      "Sigma": "https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/247ithelp.com__connectwise__network_sigma.yml",
      "Description": "Detects potential network activity of 247ithelp.com (ConnectWise) RMM tool"
    },
    {
      "Sigma": "https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/247ithelp.com__connectwise__processes_sigma.yml",
      "Description": "Detects potential processes activity of 247ithelp.com (ConnectWise) RMM tool"
    }
  ],
  "References": [],
  "Acknowledgement": [],
  "CodeSigning": {
    "search_names": [
      "remote workforce client.exe",
      "remoteworkforceclientwpf.exe"
    ],
    "company_names": [],
    "signer_names": [],
    "certificates": []
  },
  "FileHashes": {
    "authenticode": [
      {
        "file_name": "RemoteWorkforceClientWpf.exe",
        "sha256": "1DB81299210F602CDC21E32A68209B639392CF3714D6C4827C4FB81D8697CFF2",
        "sha1": "975A38C110AE8D645F85E25EB89B1B3B5EF57145"
      },
      {
        "file_name": "RemoteWorkforceClientWpf.exe",
        "sha256": "13EE0322429E8A56BC563A0151A0FC2B45BC48DA76A3815A6F8CBE4AD0B4D543",
        "sha1": "E492C7EA0457064830A0005721199673BA843C2C"
      },
      {
        "file_name": "RemoteWorkforceClientWpf.exe",
        "sha256": "A5F5EBC48211E71752125DE8072287E483FC9A31946F539A0299F234CE7D5E9D",
        "sha1": "997F2508915A9503F58478FF5578A2A010586CA9"
      },
      {
        "file_name": "RemoteWorkforceClientWpf.exe",
        "sha256": "10A657260E0F6137622FECB2D9B87F1D81D7F5D8B0FE8EC8B9DDB9D97A1B74FA",
        "sha1": "3AF53CBCB440E4C85D1D904C943F74C85C0E0887"
      },
      {
        "file_name": "RemoteWorkforceClientWpf.exe",
        "sha256": "3B8E603758F1DAF444A92769502FA1FE03EABF27B07DFB411F1D7B70D10CCBB4",
        "sha1": "F09A875363B8DE259BE5059E2ECFB87697B11A0E"
      },
      {
        "file_name": "Remote Workforce Client.exe",
        "sha256": "7A2457ADFE15ED2E8A4230339786FA88BE6F2DF31BA083C2BBF7179DF36D1859",
        "sha1": "BE495BBFD534B7E077AD42A4EEA957D98AEBF23D"
      },
      {
        "file_name": "RemoteWorkforceClientWpf.exe",
        "sha256": "183B5E1F0E7114426823E2B3543A250976E9D739EBC2FE81D502208DC197FBFF",
        "sha1": "BDC8A7AAA1099B590A3C38294BA52FCC419CF421"
      },
      {
        "file_name": "RemoteWorkforceClientWpf.exe",
        "sha256": "66C1E8EA6506739A1FFA7F7486D00B61F7126FF54C67E795255A333C86BC730A",
        "sha1": "FE2F243B92A51B11A5534A02EFC3F8CCF8DC26EB"
      },
      {
        "file_name": "RemoteWorkforceClientWpf.exe",
        "sha256": "B04A9086B765468ED44B383D83334EF7935178C1A3856B57AE821123C08C2494",
        "sha1": "E858F6135F4AD5F1BA4FCE079E7C566B0EF3FD54"
      },
      {
        "file_name": "RemoteWorkforceClientWpf.exe",
        "sha256": "5F75A6E90C15FAADF18DC7581A65806154AE12DE851B7CA0185A64F2B93374A6",
        "sha1": "C59B8C3943BDEB5FE08CACA44F264B8501F0576D"
      },
      {
        "file_name": "RemoteWorkforceClientWpf.exe",
        "sha256": "306E6166EBB9A58EBE7BBE868AD7B41C3F0C49AAA7862B6D74C66B35E0F89BCB",
        "sha1": "F8C26C0970BBEBB19A0A0030CA1B0DAC5B5BD305"
      },
      {
        "file_name": "RemoteWorkforceClientWpf.exe",
        "sha256": "26225AC3BD32BDA82C170C7BFEFDBDB139887C01D0344C78D37B4B7183F9EFFF",
        "sha1": "37D92EDFCD244B1C896E743571DF13F38EFC8F01"
      },
      {
        "file_name": "RemoteWorkforceClientWpf.exe",
        "sha256": "762FA7FA385D7848C3BE07A164B6BCF116FBE6D6636F82ED8E8CC3D43CB11A64",
        "sha1": "F87D5976D12DDAB1DF4C6BE621E10D3A8D641818"
      },
      {
        "file_name": "RemoteWorkforceClientWpf.exe",
        "sha256": "B33107C5C51230CDF4F5845BDA4A41CCBDD77C7C907085D0AB0EE8E8D882D41A",
        "sha1": "CC632598B8C35132A4012DB9CAE217FA5D235468"
      },
      {
        "file_name": "RemoteWorkforceClientWpf.exe",
        "sha256": "3B9E7574E6A05B26F96A007E198145CDBFC6D89787B1F540528F9EC4398A27D5",
        "sha1": "D67D16B06EBA7E2AE34AC1CEA60F7479E7E8713C"
      },
      {
        "file_name": "RemoteWorkforceClientWpf.exe",
        "sha256": "38194ED130B15B33CB31ACEC9E6203EE6B2D4E1BF24FF201B2E0A3877BD51354",
        "sha1": "2379D544AF83EB70FDA255031DC2DF7FE5EAC587"
      },
      {
        "file_name": "RemoteWorkforceClientWpf.exe",
        "sha256": "353176BD0B488388D1F20AAA3F377A4215511646B777586BB15F952999727172",
        "sha1": "377CB8AB7E242BD0C05EFD1BCF0028C2500634D9"
      },
      {
        "file_name": "RemoteWorkforceClientWpf.exe",
        "sha256": "70C2279E3C1E015DF0F8222960C52DA370C88FEC450ECA64E2DB18C0E6A44A76",
        "sha1": "D5302B7E79A21E3529A1EF089BE6F25DC71D3F7B"
      },
      {
        "file_name": "RemoteWorkforceClientWpf.exe",
        "sha256": "F819995BE08D96DF46227E12DE59F969B6635B496272418BC5F40BCB5771F85E",
        "sha1": "36F57363A98FBCEDF00114889EC1879E7ABD1222"
      },
      {
        "file_name": "RemoteWorkforceClientWpf.exe",
        "sha256": "2B68153F8E7D3A3949AEA323F449C1381CA76FDD51262948FF7DF7DEDC1F2D2E",
        "sha1": "ED69344A0C38CA2EAE793E20750FC2E8F7082B65"
      }
    ],
    "page": [
      {
        "file_name": "RemoteWorkforceClientWpf.exe",
        "sha256": "FAAE529A9FCF82757E8371FF4A7349C53D6C92CC88D3A5885946585852C7975B",
        "sha1": "0E6B57954C4AF2B0F11C1E075071A9A80A4FD023"
      },
      {
        "file_name": "Remote Workforce Client.exe",
        "sha256": "50E30025685A61E771332D280F7FBDB3CA896020B1DF9C807655CCC581EC69A2",
        "sha1": "3C231A17DA5450AD5BB85F133F440D773ABF7F5D"
      }
    ]
  }
}