48a615f434c90047ca7eddee102940147e4f578b27baecc6c07942190986a499

Analysis

max time kernel
154s
max time network
164s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
31/10/2023, 14:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

224a34f0462d2231a6391f713d63c48998e6bbd642a24fb7855e72c6339cc277.exe
Size

3.9MB
MD5

5c9b84f700532179ba0e3540b3abe909
SHA1

64d8d4a5f65ad5c64b98d0b2ac6acb06bc7144ca
SHA256

224a34f0462d2231a6391f713d63c48998e6bbd642a24fb7855e72c6339cc277
SHA512

de04ec98264a65c9f7d05b8fffcb36d9e0fe78bb72b7bce0d2ec16a63f9d0a25ff2d46a4675f23d287ed827d002a416e751470622e8820c51ed790fd85f92e96
SSDEEP

49152:7rsMZ3Li963PSumT0+TFiH7efP4dhNiIU69q1sxSdB2gODQLo6eK1XGuYRO3R2hR:7wMZi6+6efP62IU69lG22bemGFO32R

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
2060	ScreenConnect.ClientService.exe
2460	ScreenConnect.WindowsClient.exe
1320	ScreenConnect.WindowsClient.exe
2564	ScreenConnect.ClientSetup.exe

Loads dropped DLL 45 IoCs

pid	Process
2516	MsiExec.exe
2600	rundll32.exe
2600	rundll32.exe
2600	rundll32.exe
2600	rundll32.exe
2600	rundll32.exe
2600	rundll32.exe
2600	rundll32.exe
960	MsiExec.exe
960	MsiExec.exe
960	MsiExec.exe
744	MsiExec.exe
744	MsiExec.exe
2060	ScreenConnect.ClientService.exe
2060	ScreenConnect.ClientService.exe
2060	ScreenConnect.ClientService.exe
2060	ScreenConnect.ClientService.exe
2060	ScreenConnect.ClientService.exe
2060	ScreenConnect.ClientService.exe
2060	ScreenConnect.ClientService.exe
2060	ScreenConnect.ClientService.exe
2060	ScreenConnect.ClientService.exe
2060	ScreenConnect.ClientService.exe
2060	ScreenConnect.ClientService.exe
2060	ScreenConnect.ClientService.exe
2060	ScreenConnect.ClientService.exe
2060	ScreenConnect.ClientService.exe
2060	ScreenConnect.ClientService.exe
2060	ScreenConnect.ClientService.exe
944	MsiExec.exe
1588	rundll32.exe
1588	rundll32.exe
1588	rundll32.exe
1588	rundll32.exe
1588	rundll32.exe
1588	rundll32.exe
1588	rundll32.exe
2660	msiexec.exe
2660	msiexec.exe
2660	msiexec.exe
2660	msiexec.exe
2660	msiexec.exe
2660	msiexec.exe
2660	msiexec.exe
2660	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe

Drops file in Program Files directory 24 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ScreenConnect Client (ef92d1ca7ab7e4a0)\Client.Override.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (ef92d1ca7ab7e4a0)\system.config	msiexec.exe
File opened for modification	C:\Program Files (x86)\ScreenConnect Client (ef92d1ca7ab7e4a0)\ScreenConnect.Core.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\ScreenConnect Client (ef92d1ca7ab7e4a0)\Client.en-US.resources	msiexec.exe
File opened for modification	C:\Program Files (x86)\ScreenConnect Client (ef92d1ca7ab7e4a0)\Client.Override.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (ef92d1ca7ab7e4a0)\ScreenConnect.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (ef92d1ca7ab7e4a0)\ScreenConnect.WindowsClient.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (ef92d1ca7ab7e4a0)\ScreenConnect.WindowsClient.exe.config	msiexec.exe
File opened for modification	C:\Program Files (x86)\ScreenConnect Client (ef92d1ca7ab7e4a0)\ScreenConnect.Client.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\ScreenConnect Client (ef92d1ca7ab7e4a0)\system.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (ef92d1ca7ab7e4a0)\ScreenConnect.Client.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (ef92d1ca7ab7e4a0)\ScreenConnect.ClientService.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\ScreenConnect Client (ef92d1ca7ab7e4a0)\ScreenConnect.ClientService.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\ScreenConnect Client (ef92d1ca7ab7e4a0)\ScreenConnect.WindowsClient.exe.config	msiexec.exe
File opened for modification	C:\Program Files (x86)\ScreenConnect Client (ef92d1ca7ab7e4a0)\ScreenConnect.ClientService.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (ef92d1ca7ab7e4a0)\ScreenConnect.Windows.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (ef92d1ca7ab7e4a0)\ScreenConnect.ClientService.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (ef92d1ca7ab7e4a0)\Client.resources	msiexec.exe
File opened for modification	C:\Program Files (x86)\ScreenConnect Client (ef92d1ca7ab7e4a0)\ScreenConnect.Windows.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\ScreenConnect Client (ef92d1ca7ab7e4a0)\Client.Override.resources	msiexec.exe
File opened for modification	C:\Program Files (x86)\ScreenConnect Client (ef92d1ca7ab7e4a0)\Client.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (ef92d1ca7ab7e4a0)\Client.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (ef92d1ca7ab7e4a0)\Client.Override.resources	msiexec.exe
File opened for modification	C:\Program Files (x86)\ScreenConnect Client (ef92d1ca7ab7e4a0)\ScreenConnect.WindowsClient.exe	msiexec.exe

Drops file in Windows directory 27 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI99E7.tmp-\ScreenConnect.Core.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI7F3F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI964C.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File created	C:\Windows\Installer\f775c76.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI99E7.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\f775c72.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7F2E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI99E7.tmp-\ScreenConnect.Windows.dll	rundll32.exe
File created	C:\Windows\Installer\f775c72.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI986F.tmp	msiexec.exe
File created	C:\Windows\Installer\wix{8C350B49-8518-40A8-947F-C470C29AC503}.SchedServiceConfig.rmi	MsiExec.exe
File opened for modification	C:\Windows\Installer\MSI99E7.tmp-\ScreenConnect.InstallerActions.dll	rundll32.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File created	C:\Windows\Installer\f775c75.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\{8C350B49-8518-40A8-947F-C470C29AC503}\DefaultIcon	msiexec.exe
File created	C:\Windows\Installer\f775c79.ipi	msiexec.exe
File created	C:\Windows\Installer\f775c73.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\f775c76.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI99E7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI99E7.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI800B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8134.tmp	msiexec.exe
File created	C:\Windows\Installer\{8C350B49-8518-40A8-947F-C470C29AC503}\DefaultIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\f775c73.ipi	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ScreenConnect.WindowsClient.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ScreenConnect.WindowsClient.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	ScreenConnect.WindowsClient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	ScreenConnect.WindowsClient.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	ScreenConnect.ClientSetup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000	msiexec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0001\SessionHash = 01d293ee86075cbf591ecfd759902daee1014b6ce79db714ec5ff721bd74b071	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0001\Sequence = "1"	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0001\Sequence = "2"	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.ClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	msiexec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2E	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Sequence = "1"	msiexec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0001\RegProcs0000 = 300030003000300030003900390063003a00300031006400610030006300300038003a00380066003500330064003200660030000000300030003000300030003500320038003a00300031006400610030006300300038003a003900300063003400630038003100300000000000	msiexec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0001\RegProcs0000 = 300030003000300030003900390063003a00300031006400610030006300300038003a00380066003500330064003200660030000000300030003000300030003500320038003a00300031006400610030006300300038003a00390030006300340063003800310030000000300030003000300030003800300063003a00300031006400610030006300300038003a003800390039006500340036006200300000000000	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	ScreenConnect.ClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 9124af5187041fadf4d93fd176b3db581f0f2cf0cd45e3562e7190eb179db5d5	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0001	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	ScreenConnect.ClientSetup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.ClientSetup.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800650066003900320064003100630061003700610062003700650034006100300029005c00530063007200650065006e0043006f006e006e006500630074002e0043006c00690065006e00740053006500720076006900630065002e0064006c006c00000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800650066003900320064003100630061003700610062003700650034006100300029005c00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f007700730043006c00690065006e0074002e00650078006500000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800650066003900320064003100630061003700610062003700650034006100300029005c00530063007200650065006e0043006f006e006e006500630074002e0043006c00690065006e0074002e0064006c006c00000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800650066003900320064003100630061003700610062003700650034006100300029005c00530063007200650065006e0043006f006e006e006500630074002e0043006f00720065002e0064006c006c00000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800650066003900320064003100630061003700610062003700650034006100300029005c00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f00770073002e0064006c006c00000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800650066003900320064003100630061003700610062003700650034006100300029005c00530063007200650065006e0043006f006e006e006500630074002e0043006c00690065006e00740053006500720076006900630065002e0065007800650000000000	msiexec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0001\RegProcsHash = b66f79896bd918d4d16c342eb3b3022b76e1dec760638cb7576305ef934ea073	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = c8c60cb93c5b72cca6e8a4e006d42b3d592522499fb1f5112f96fe76ce3335ff	msiexec.exe

Modifies registry class 32 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\sc-ef92d1ca7ab7e4a0	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-ef92d1ca7ab7e4a0\shell\open\command	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\94B053C881588A0449F74C072CA95C30\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\2717D06C3B1BEE76FE291DACA77B4E0A	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\94B053C881588A0449F74C072CA95C30\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\94B053C881588A0449F74C072CA95C30\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-ef92d1ca7ab7e4a0\URL Protocol	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-ef92d1ca7ab7e4a0\UseOriginalUrlEncoding = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-ef92d1ca7ab7e4a0\shell	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-ef92d1ca7ab7e4a0\shell\open	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\94B053C881588A0449F74C072CA95C30\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\94B053C881588A0449F74C072CA95C30\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\2717D06C3B1BEE76FE291DACA77B4E0A\94B053C881588A0449F74C072CA95C30	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-ef92d1ca7ab7e4a0\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (ef92d1ca7ab7e4a0)\\ScreenConnect.WindowsClient.exe\" \"%1\""	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\94B053C881588A0449F74C072CA95C30	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\94B053C881588A0449F74C072CA95C30\ProductIcon = "C:\\Windows\\Installer\\{8C350B49-8518-40A8-947F-C470C29AC503}\\DefaultIcon"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\94B053C881588A0449F74C072CA95C30\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\94B053C881588A0449F74C072CA95C30\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\94B053C881588A0449F74C072CA95C30\Full	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\94B053C881588A0449F74C072CA95C30\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\94B053C881588A0449F74C072CA95C30	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\94B053C881588A0449F74C072CA95C30\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-ef92d1ca7ab7e4a0	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\94B053C881588A0449F74C072CA95C30\SourceList\PackageName = "setup.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\94B053C881588A0449F74C072CA95C30\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-ef92d1ca7ab7e4a0\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\94B053C881588A0449F74C072CA95C30\ProductName = "ScreenConnect Client (ef92d1ca7ab7e4a0)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\94B053C881588A0449F74C072CA95C30\PackageCode = "CA2A2A0B0B13FC94EAA0460C39960EA1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\94B053C881588A0449F74C072CA95C30\Version = "353178562"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\94B053C881588A0449F74C072CA95C30\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\94B053C881588A0449F74C072CA95C30\Assignment = "1"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\94B053C881588A0449F74C072CA95C30\Clients = 3a0000000000	msiexec.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2620	msiexec.exe
2620	msiexec.exe
2060	ScreenConnect.ClientService.exe
2060	ScreenConnect.ClientService.exe
2060	ScreenConnect.ClientService.exe
2060	ScreenConnect.ClientService.exe
2060	ScreenConnect.ClientService.exe
2060	ScreenConnect.ClientService.exe
2620	msiexec.exe
2620	msiexec.exe
2620	msiexec.exe
2620	msiexec.exe
2620	msiexec.exe
2620	msiexec.exe
2620	msiexec.exe
2620	msiexec.exe
2620	msiexec.exe
2620	msiexec.exe
2620	msiexec.exe
2620	msiexec.exe
2620	msiexec.exe
2620	msiexec.exe
2660	msiexec.exe
2660	msiexec.exe
2660	msiexec.exe
2660	msiexec.exe
2660	msiexec.exe
2660	msiexec.exe
2660	msiexec.exe
2660	msiexec.exe
2660	msiexec.exe
2660	msiexec.exe
2660	msiexec.exe
2660	msiexec.exe
2660	msiexec.exe
2660	msiexec.exe
2620	msiexec.exe
2620	msiexec.exe
2620	msiexec.exe
2620	msiexec.exe
2620	msiexec.exe
2620	msiexec.exe
2620	msiexec.exe
2620	msiexec.exe
2620	msiexec.exe
2620	msiexec.exe
2620	msiexec.exe
2620	msiexec.exe
2620	msiexec.exe
2620	msiexec.exe
2660	msiexec.exe
2660	msiexec.exe
2660	msiexec.exe
2660	msiexec.exe
2660	msiexec.exe
2660	msiexec.exe
2660	msiexec.exe
2660	msiexec.exe
2660	msiexec.exe
2660	msiexec.exe
2660	msiexec.exe
2660	msiexec.exe
2660	msiexec.exe
2660	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1524	224a34f0462d2231a6391f713d63c48998e6bbd642a24fb7855e72c6339cc277.exe
Token: SeShutdownPrivilege	2768	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2768	msiexec.exe
Token: SeRestorePrivilege	2620	msiexec.exe
Token: SeTakeOwnershipPrivilege	2620	msiexec.exe
Token: SeSecurityPrivilege	2620	msiexec.exe
Token: SeCreateTokenPrivilege	2768	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2768	msiexec.exe
Token: SeLockMemoryPrivilege	2768	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2768	msiexec.exe
Token: SeMachineAccountPrivilege	2768	msiexec.exe
Token: SeTcbPrivilege	2768	msiexec.exe
Token: SeSecurityPrivilege	2768	msiexec.exe
Token: SeTakeOwnershipPrivilege	2768	msiexec.exe
Token: SeLoadDriverPrivilege	2768	msiexec.exe
Token: SeSystemProfilePrivilege	2768	msiexec.exe
Token: SeSystemtimePrivilege	2768	msiexec.exe
Token: SeProfSingleProcessPrivilege	2768	msiexec.exe
Token: SeIncBasePriorityPrivilege	2768	msiexec.exe
Token: SeCreatePagefilePrivilege	2768	msiexec.exe
Token: SeCreatePermanentPrivilege	2768	msiexec.exe
Token: SeBackupPrivilege	2768	msiexec.exe
Token: SeRestorePrivilege	2768	msiexec.exe
Token: SeShutdownPrivilege	2768	msiexec.exe
Token: SeDebugPrivilege	2768	msiexec.exe
Token: SeAuditPrivilege	2768	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2768	msiexec.exe
Token: SeChangeNotifyPrivilege	2768	msiexec.exe
Token: SeRemoteShutdownPrivilege	2768	msiexec.exe
Token: SeUndockPrivilege	2768	msiexec.exe
Token: SeSyncAgentPrivilege	2768	msiexec.exe
Token: SeEnableDelegationPrivilege	2768	msiexec.exe
Token: SeManageVolumePrivilege	2768	msiexec.exe
Token: SeImpersonatePrivilege	2768	msiexec.exe
Token: SeCreateGlobalPrivilege	2768	msiexec.exe
Token: SeCreateTokenPrivilege	2768	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2768	msiexec.exe
Token: SeLockMemoryPrivilege	2768	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2768	msiexec.exe
Token: SeMachineAccountPrivilege	2768	msiexec.exe
Token: SeTcbPrivilege	2768	msiexec.exe
Token: SeSecurityPrivilege	2768	msiexec.exe
Token: SeTakeOwnershipPrivilege	2768	msiexec.exe
Token: SeLoadDriverPrivilege	2768	msiexec.exe
Token: SeSystemProfilePrivilege	2768	msiexec.exe
Token: SeSystemtimePrivilege	2768	msiexec.exe
Token: SeProfSingleProcessPrivilege	2768	msiexec.exe
Token: SeIncBasePriorityPrivilege	2768	msiexec.exe
Token: SeCreatePagefilePrivilege	2768	msiexec.exe
Token: SeCreatePermanentPrivilege	2768	msiexec.exe
Token: SeBackupPrivilege	2768	msiexec.exe
Token: SeRestorePrivilege	2768	msiexec.exe
Token: SeShutdownPrivilege	2768	msiexec.exe
Token: SeDebugPrivilege	2768	msiexec.exe
Token: SeAuditPrivilege	2768	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2768	msiexec.exe
Token: SeChangeNotifyPrivilege	2768	msiexec.exe
Token: SeRemoteShutdownPrivilege	2768	msiexec.exe
Token: SeUndockPrivilege	2768	msiexec.exe
Token: SeSyncAgentPrivilege	2768	msiexec.exe
Token: SeEnableDelegationPrivilege	2768	msiexec.exe
Token: SeManageVolumePrivilege	2768	msiexec.exe
Token: SeImpersonatePrivilege	2768	msiexec.exe
Token: SeCreateGlobalPrivilege	2768	msiexec.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
2768	msiexec.exe
2768	msiexec.exe
2460	ScreenConnect.WindowsClient.exe
2460	ScreenConnect.WindowsClient.exe
2460	ScreenConnect.WindowsClient.exe
2460	ScreenConnect.WindowsClient.exe
2460	ScreenConnect.WindowsClient.exe
2460	ScreenConnect.WindowsClient.exe

Suspicious use of SendNotifyMessage 6 IoCs

pid	Process
2460	ScreenConnect.WindowsClient.exe
2460	ScreenConnect.WindowsClient.exe
2460	ScreenConnect.WindowsClient.exe
2460	ScreenConnect.WindowsClient.exe
2460	ScreenConnect.WindowsClient.exe
2460	ScreenConnect.WindowsClient.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1524 wrote to memory of 2768	1524	224a34f0462d2231a6391f713d63c48998e6bbd642a24fb7855e72c6339cc277.exe	28
PID 1524 wrote to memory of 2768	1524	224a34f0462d2231a6391f713d63c48998e6bbd642a24fb7855e72c6339cc277.exe	28
PID 1524 wrote to memory of 2768	1524	224a34f0462d2231a6391f713d63c48998e6bbd642a24fb7855e72c6339cc277.exe	28
PID 1524 wrote to memory of 2768	1524	224a34f0462d2231a6391f713d63c48998e6bbd642a24fb7855e72c6339cc277.exe	28
PID 1524 wrote to memory of 2768	1524	224a34f0462d2231a6391f713d63c48998e6bbd642a24fb7855e72c6339cc277.exe	28
PID 1524 wrote to memory of 2768	1524	224a34f0462d2231a6391f713d63c48998e6bbd642a24fb7855e72c6339cc277.exe	28
PID 1524 wrote to memory of 2768	1524	224a34f0462d2231a6391f713d63c48998e6bbd642a24fb7855e72c6339cc277.exe	28
PID 2620 wrote to memory of 2516	2620	msiexec.exe	30
PID 2620 wrote to memory of 2516	2620	msiexec.exe	30
PID 2620 wrote to memory of 2516	2620	msiexec.exe	30
PID 2620 wrote to memory of 2516	2620	msiexec.exe	30
PID 2620 wrote to memory of 2516	2620	msiexec.exe	30
PID 2620 wrote to memory of 2516	2620	msiexec.exe	30
PID 2620 wrote to memory of 2516	2620	msiexec.exe	30
PID 2516 wrote to memory of 2600	2516	MsiExec.exe	31
PID 2516 wrote to memory of 2600	2516	MsiExec.exe	31
PID 2516 wrote to memory of 2600	2516	MsiExec.exe	31
PID 2516 wrote to memory of 2600	2516	MsiExec.exe	31
PID 2516 wrote to memory of 2600	2516	MsiExec.exe	31
PID 2516 wrote to memory of 2600	2516	MsiExec.exe	31
PID 2516 wrote to memory of 2600	2516	MsiExec.exe	31
PID 2620 wrote to memory of 960	2620	msiexec.exe	37
PID 2620 wrote to memory of 960	2620	msiexec.exe	37
PID 2620 wrote to memory of 960	2620	msiexec.exe	37
PID 2620 wrote to memory of 960	2620	msiexec.exe	37
PID 2620 wrote to memory of 960	2620	msiexec.exe	37
PID 2620 wrote to memory of 960	2620	msiexec.exe	37
PID 2620 wrote to memory of 960	2620	msiexec.exe	37
PID 2620 wrote to memory of 744	2620	msiexec.exe	38
PID 2620 wrote to memory of 744	2620	msiexec.exe	38
PID 2620 wrote to memory of 744	2620	msiexec.exe	38
PID 2620 wrote to memory of 744	2620	msiexec.exe	38
PID 2620 wrote to memory of 744	2620	msiexec.exe	38
PID 2620 wrote to memory of 744	2620	msiexec.exe	38
PID 2620 wrote to memory of 744	2620	msiexec.exe	38
PID 2060 wrote to memory of 2460	2060	ScreenConnect.ClientService.exe	40
PID 2060 wrote to memory of 2460	2060	ScreenConnect.ClientService.exe	40
PID 2060 wrote to memory of 2460	2060	ScreenConnect.ClientService.exe	40
PID 2060 wrote to memory of 2460	2060	ScreenConnect.ClientService.exe	40
PID 2060 wrote to memory of 1320	2060	ScreenConnect.ClientService.exe	41
PID 2060 wrote to memory of 1320	2060	ScreenConnect.ClientService.exe	41
PID 2060 wrote to memory of 1320	2060	ScreenConnect.ClientService.exe	41
PID 2060 wrote to memory of 1320	2060	ScreenConnect.ClientService.exe	41
PID 2060 wrote to memory of 2564	2060	ScreenConnect.ClientService.exe	43
PID 2060 wrote to memory of 2564	2060	ScreenConnect.ClientService.exe	43
PID 2060 wrote to memory of 2564	2060	ScreenConnect.ClientService.exe	43
PID 2060 wrote to memory of 2564	2060	ScreenConnect.ClientService.exe	43
PID 2060 wrote to memory of 2564	2060	ScreenConnect.ClientService.exe	43
PID 2060 wrote to memory of 2564	2060	ScreenConnect.ClientService.exe	43
PID 2060 wrote to memory of 2564	2060	ScreenConnect.ClientService.exe	43
PID 2564 wrote to memory of 2660	2564	ScreenConnect.ClientSetup.exe	44
PID 2564 wrote to memory of 2660	2564	ScreenConnect.ClientSetup.exe	44
PID 2564 wrote to memory of 2660	2564	ScreenConnect.ClientSetup.exe	44
PID 2564 wrote to memory of 2660	2564	ScreenConnect.ClientSetup.exe	44
PID 2564 wrote to memory of 2660	2564	ScreenConnect.ClientSetup.exe	44
PID 2564 wrote to memory of 2660	2564	ScreenConnect.ClientSetup.exe	44
PID 2564 wrote to memory of 2660	2564	ScreenConnect.ClientSetup.exe	44
PID 2620 wrote to memory of 944	2620	msiexec.exe	45
PID 2620 wrote to memory of 944	2620	msiexec.exe	45
PID 2620 wrote to memory of 944	2620	msiexec.exe	45
PID 2620 wrote to memory of 944	2620	msiexec.exe	45
PID 2620 wrote to memory of 944	2620	msiexec.exe	45
PID 2620 wrote to memory of 944	2620	msiexec.exe	45
PID 2620 wrote to memory of 944	2620	msiexec.exe	45

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\224a34f0462d2231a6391f713d63c48998e6bbd642a24fb7855e72c6339cc277.exe
"C:\Users\Admin\AppData\Local\Temp\224a34f0462d2231a6391f713d63c48998e6bbd642a24fb7855e72c6339cc277.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1524
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\setup.msi"
  2⤵
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:2768

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2620
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding B6037199D9D9FC7D56A724ADFCD71CD4 C
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2516
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI98C6.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_259430832 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    - Loads dropped DLL
    PID:2600
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 334276A142C9C1DD3481533B0BD0A51F
  2⤵
  - Loads dropped DLL
  PID:960
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 7505B6CE7CB72AC48C8F20E181E1C00E M Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:744
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 91640F4EDB06F5E92A1759A4C1F34736 M Global\MSI0000
  2⤵
  - Loads dropped DLL
  PID:944
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI99E7.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_259567895 26 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    PID:1588

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:580

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000003AC" "00000000000004C0"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:940

C:\Program Files (x86)\ScreenConnect Client (ef92d1ca7ab7e4a0)\ScreenConnect.ClientService.exe
"C:\Program Files (x86)\ScreenConnect Client (ef92d1ca7ab7e4a0)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=instance-o169aw-relay.screenconnect.com&p=443&s=bc3cda62-482e-44a9-9d91-14d8f1b5b498&k=BgIAAACkAABSU0ExAAgAAAEAAQAdN6XV%2fFG9IhYaxguP0y1srMTmyyBCebs7bVbmou%2f5wxwsTfARDnUpoiayp95tTpUPgC8pwTz0ack%2bMGhmL9hYOR8NDyTEaf9LqP775%2fYWmzKitQBxhgP6lVbE7yTsu%2bI4SCVbtxKYim0vgf71LEnhHe5bRYBeezWvZuF5nhu1ikIHbQplwvpjYT45bzHIbCi9GTwvduHHTTm%2fnO8sBiqgp9M7me1jEf4gEEiqoFe9Jb%2bAcEeLlgy9uArk5elJxcsv189dKNKHAVqgifTp7UOxamAroYGidHg1S3T3ukEVbhOK1vtIbMtKi0FnnDL%2fOwCG3%2bKRtiWOzVCrZlbZosqo&t=&c=Star%20Crane&c=&c=&c=&c=&c=&c=&c="
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Program Files (x86)\ScreenConnect Client (ef92d1ca7ab7e4a0)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (ef92d1ca7ab7e4a0)\ScreenConnect.WindowsClient.exe" "RunRole" "583395f3-8b50-46a8-9dc3-2caf8c078cad" "User"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2460
- C:\Program Files (x86)\ScreenConnect Client (ef92d1ca7ab7e4a0)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (ef92d1ca7ab7e4a0)\ScreenConnect.WindowsClient.exe" "RunRole" "dfde0dfe-f3a0-48f3-a2b9-e23958ab5023" "System"
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  PID:1320
- C:\Windows\TEMP\ScreenConnect\21.13.5058.7951\ScreenConnect.ClientSetup.exe
  "C:\Windows\TEMP\ScreenConnect\21.13.5058.7951\ScreenConnect.ClientSetup.exe"
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of WriteProcessMemory
  PID:2564
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Windows\TEMP\ScreenConnect\ef92d1ca7ab7e4a0\setup.msi"
    3⤵
    - Loads dropped DLL
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:2660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f775c74.rbs

Filesize
211KB

MD5
921846590f4015775ea873c207d75399

SHA1
1ed2b42bbc369681c436c7cffe4c9044572ea2ec

SHA256
b7f6a6c8a1fcf863d61fdd4d85131e9d203e60b1c2b3d346b15747ad59cfb981

SHA512
ba3ef30dc3d2ed820113019eb5497202516704cafc2fe81a42855c8cb7140e2525ac74f9464df48d2ad59c3a3c27aed4873b0e1c4e4a2bdebbf3100b53f371d9

Download Submit
C:\Program Files (x86)\ScreenConnect Client (ef92d1ca7ab7e4a0)\Client.Override.en-US.resources

Filesize
498B

MD5
2fb10bbe9ff59723438f7e9aa53d4c85

SHA1
1dbb3442b95afc4b765716a9d1ad4eb99ba05688

SHA256
a34f8aad20db71f330668c58f8b3397e6effea6e2272234b4006dd5081c06455

SHA512
f1a437202464e9639c08e1b5fed71c63247b574f5828c67a0d8571dbc804d91309495236dc53b0c2445e31fd9aec67cea461fb754e1c2dd9efd609bb4e255ff5

Download Submit
C:\Program Files (x86)\ScreenConnect Client (ef92d1ca7ab7e4a0)\Client.Override.resources

Filesize
1KB

MD5
bda614fbf2ba779b8f59191431ace353

SHA1
a31c1934d3bc33cbb99523b02eec3d73d54e65e4

SHA256
881832c6831d5bfd153823ee5490388524ce3468aa320c3ee5bfac1c478c0609

SHA512
74ad4ccbbaff9ec6069a61d649713862381749020b69c8059472e8a0b84c613d588a351b676977b0bec734b3e822b52c5e91af9091b7a043236568647c13ca15

Download Submit
C:\Program Files (x86)\ScreenConnect Client (ef92d1ca7ab7e4a0)\Client.en-US.resources

Filesize
41KB

MD5
04cd8d49f688839c54470bc1ea74d205

SHA1
cc02bd8f1ab7e511bf720b9dc9e37140f67bcc01

SHA256
4ee7905e2120490128a0069f0865ae31421fa0ba3c1395d90cf874f6d3444cf2

SHA512
27742f53118001e0ec1d239afeb56f5d9caad929a2cb6d3f7a12a01947a27a016b6e7311b19c6ee04e2526cc90b4a1bf29dd4803162cfb49045b02415bcc97b4

Download Submit
C:\Program Files (x86)\ScreenConnect Client (ef92d1ca7ab7e4a0)\Client.resources

Filesize
2KB

MD5
0b47901f2c782922f034fba8e8062916

SHA1
893075f8ca04f92dbef7f6e81223e1b08e29328f

SHA256
64da2cfeacfcba97cad701da9288618bc42a20f69dd4a0fe5652ce49ef92524c

SHA512
b3db1c4ffed1dbaef5e03f4819bcba5f0a6864c26123e059b6a649911adbd380ae3aa1eb63c2397ea1ea5fc61103468b5db838080d7c7d5de848b5002c31cbd6

Download Submit
C:\Program Files (x86)\ScreenConnect Client (ef92d1ca7ab7e4a0)\ScreenConnect.Client.dll

Filesize
152KB

MD5
c62efdfdba800cae8514b9ab81466bcd

SHA1
c7cebd9f0f07df214b6d7a53d62efd8cf2aaeb94

SHA256
d2aa58149f4e81afb718c7e79f97c53e56bf14a23b999715d9cc3860600da992

SHA512
a2d0aeb700b12a121205b452e8119d6544fe1b8746c85f6ee005ce80693dd45ec856d4e61b5120d94fd14ba7f37155b3562c46066a1f1e2cae61f998f88ec50f

Download Submit
C:\Program Files (x86)\ScreenConnect Client (ef92d1ca7ab7e4a0)\ScreenConnect.ClientService.dll

Filesize
30KB

MD5
dd2a1cd08659bfa1718a379493815a11

SHA1
a1fd2f8bae1ce79f14981c0ce434f25c1908ba2a

SHA256
6c3e45dd037a8178ec772516634c42a81424e1ea2c0d425c2b7e6a8ae331da60

SHA512
47f219c443aa3f5eae4b61f34f05e3600ba85675d839e18d84a11bcfb8e4157e8fb54674b0fa605a47e228ecdcc1aeab5818e35ce5e5205f79f87c23a7242cc0

Download Submit
C:\Program Files (x86)\ScreenConnect Client (ef92d1ca7ab7e4a0)\ScreenConnect.ClientService.exe

Filesize
89KB

MD5
0daa8a453ee3d2370a16c97eee2b0958

SHA1
a2deca01ca37027bd148fa71956fbb5607c50e87

SHA256
72e5a01a10f75fd4da23c01d2944936a0962a5e2b65bb9e45e26f75b9142f8b6

SHA512
1e04a2066591fe3c85b7572482689b42f8efcf0c4c07fdde4feff5089b3ba6937d4853ce320073c7a034d0974d29c1db7dc53b2bf02fb91d6d307de6fd2a3ade

Download Submit
C:\Program Files (x86)\ScreenConnect Client (ef92d1ca7ab7e4a0)\ScreenConnect.ClientService.exe

Filesize
89KB

MD5
0daa8a453ee3d2370a16c97eee2b0958

SHA1
a2deca01ca37027bd148fa71956fbb5607c50e87

SHA256
72e5a01a10f75fd4da23c01d2944936a0962a5e2b65bb9e45e26f75b9142f8b6

SHA512
1e04a2066591fe3c85b7572482689b42f8efcf0c4c07fdde4feff5089b3ba6937d4853ce320073c7a034d0974d29c1db7dc53b2bf02fb91d6d307de6fd2a3ade

Download Submit
C:\Program Files (x86)\ScreenConnect Client (ef92d1ca7ab7e4a0)\ScreenConnect.Core.dll

Filesize
426KB

MD5
247b3c622b9edec8903bff62ea5c4b05

SHA1
db0069d2ca540b44d4873c9232f68ec0a06423bb

SHA256
d804db826c67648eb85fe0c3929e8e0d7b59cb6cfa19a2ea7c020e95bd1dfe2b

SHA512
993370e1e16c963873105c7315e63e693d174175e126a98bacee4ad05d490c132c159962fc915d7a4604ab82b50b2695575a41d7bbfcf69413f0362792639466

Download Submit
C:\Program Files (x86)\ScreenConnect Client (ef92d1ca7ab7e4a0)\ScreenConnect.Windows.dll

Filesize
1.6MB

MD5
aedc2f720b8fadf1291f06aa67a11e06

SHA1
e1afdb834d6a077a9785cd4c6b7672eb9cd6ec3e

SHA256
2c777242ed2cc26f378a1a5b224529c795a2cdb01abf679d4e300be666f27b80

SHA512
1fbb99d58480ca4f89dd02d8befcbc8d738ad3e20b6ceae019f98a8880faf360f50188bf8e2beefcdf49f03d64facb1acf42760fb0f3b81719ef47e6eb78c3ec

Download Submit
C:\Program Files (x86)\ScreenConnect Client (ef92d1ca7ab7e4a0)\ScreenConnect.WindowsClient.exe

Filesize
546KB

MD5
5723f723a4243db2a96e04d1d6ebfcd7

SHA1
e98ae8bf1ce23cbb606c6ceb5053072fbfa84358

SHA256
a4b18e06fbfeeed39e6184a349ecde836b79984e722e05f336f7b90b2823837c

SHA512
e3b3e7da2323261d9ab1777f2be0145b8a500142fcf9663662b2c3823fe7ed09418c881592b23bc89c4f1424a0c060b793c6b5976581ff848ba5774491bb1312

Download Submit
C:\Program Files (x86)\ScreenConnect Client (ef92d1ca7ab7e4a0)\ScreenConnect.WindowsClient.exe

Filesize
546KB

MD5
5723f723a4243db2a96e04d1d6ebfcd7

SHA1
e98ae8bf1ce23cbb606c6ceb5053072fbfa84358

SHA256
a4b18e06fbfeeed39e6184a349ecde836b79984e722e05f336f7b90b2823837c

SHA512
e3b3e7da2323261d9ab1777f2be0145b8a500142fcf9663662b2c3823fe7ed09418c881592b23bc89c4f1424a0c060b793c6b5976581ff848ba5774491bb1312

Download Submit
C:\Program Files (x86)\ScreenConnect Client (ef92d1ca7ab7e4a0)\ScreenConnect.WindowsClient.exe

Filesize
546KB

MD5
5723f723a4243db2a96e04d1d6ebfcd7

SHA1
e98ae8bf1ce23cbb606c6ceb5053072fbfa84358

SHA256
a4b18e06fbfeeed39e6184a349ecde836b79984e722e05f336f7b90b2823837c

SHA512
e3b3e7da2323261d9ab1777f2be0145b8a500142fcf9663662b2c3823fe7ed09418c881592b23bc89c4f1424a0c060b793c6b5976581ff848ba5774491bb1312

Download Submit
C:\Program Files (x86)\ScreenConnect Client (ef92d1ca7ab7e4a0)\ScreenConnect.WindowsClient.exe.config

Filesize
266B

MD5
728175e20ffbceb46760bb5e1112f38b

SHA1
2421add1f3c9c5ed9c80b339881d08ab10b340e3

SHA256
87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077

SHA512
fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7

Download Submit
C:\Program Files (x86)\ScreenConnect Client (ef92d1ca7ab7e4a0)\system.config

Filesize
891B

MD5
5fa451dd503695d7b7c09d358fe49108

SHA1
90322084943560452e9996a2b8c3d270390c0e6f

SHA256
b42705b5fcee7d61468c348ec2e4853e87587bd5a4e0af74641449db4bbefc99

SHA512
895b7fbf244f754242a91207e620a171583a334a7f5f320d8a52b89b313a109dde4950af8e1fcc60f1d79f8f0f22eb717d74aa5e494afb576712b23f38ad77e9

Download Submit
C:\ProgramData\ScreenConnect Client (ef92d1ca7ab7e4a0)\user.config

Filesize
574B

MD5
0339880bf1b53f7c459592d75ddb0c94

SHA1
d13248a9548e57ddcccf70fee884e0b4675a8877

SHA256
07e5cb51bdc49d41d8a2f174bfa2c256e057d1cef5f545b52565ff3e910007e3

SHA512
07b9d77fffa1cc2701a6f4257957cff44fb65510e7cd75e89da4173715a1496ea55bf12f6f70fed4c49ebd718dfae3a685b410df2ceabb35bfa2087d48a6242b

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI98C6.tmp

Filesize
351KB

MD5
c0cadb11c47908b53069efb02098c866

SHA1
c595a157b12be5d9fbb3605fd22fc92a2bef640c

SHA256
485d0cd57bf93a5a8ea41929f84df7869a1a951eb8f47f5742f974dbab49652e

SHA512
74efaaba6dec75c89d119d2c3e2e99222836551013a558312854004c7b4ea5db4cb9831ead06161494a48d80fd74a544135ec41f56386989e758629c07fdfbc1

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup.msi

Filesize
1.8MB

MD5
3f1e680c437498c6572ab64f65460f2b

SHA1
f7b2b00126f99802f1c6d457c9a5fe1b86f3a052

SHA256
f1723a01d71d13aef6b2026f4f95a4157232845cf6908d4264672fd027a1cd32

SHA512
87666f74d07bb2e27bc833c725632600ca1289e6195cad0a6cf4941d4cdc99959761559672aba34e3166ffa0c564c694a215f0ddd01fb2d3d0c945958bac60e0

Download Submit
C:\Windows\Installer\MSI7F3F.tmp

Filesize
202KB

MD5
ba84dd4e0c1408828ccc1de09f585eda

SHA1
e8e10065d479f8f591b9885ea8487bc673301298

SHA256
3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852

SHA512
7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290

Download Submit
C:\Windows\Installer\MSI800B.tmp

Filesize
202KB

MD5
ba84dd4e0c1408828ccc1de09f585eda

SHA1
e8e10065d479f8f591b9885ea8487bc673301298

SHA256
3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852

SHA512
7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290

Download Submit
C:\Windows\Installer\MSI8134.tmp

Filesize
202KB

MD5
ba84dd4e0c1408828ccc1de09f585eda

SHA1
e8e10065d479f8f591b9885ea8487bc673301298

SHA256
3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852

SHA512
7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290

Download Submit
C:\Windows\Installer\MSI8134.tmp

Filesize
202KB

MD5
ba84dd4e0c1408828ccc1de09f585eda

SHA1
e8e10065d479f8f591b9885ea8487bc673301298

SHA256
3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852

SHA512
7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290

Download Submit
C:\Windows\Installer\MSI964C.tmp

Filesize
202KB

MD5
ba84dd4e0c1408828ccc1de09f585eda

SHA1
e8e10065d479f8f591b9885ea8487bc673301298

SHA256
3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852

SHA512
7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290

Download Submit
C:\Windows\Installer\MSI986F.tmp

Filesize
202KB

MD5
ba84dd4e0c1408828ccc1de09f585eda

SHA1
e8e10065d479f8f591b9885ea8487bc673301298

SHA256
3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852

SHA512
7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290

Download Submit
C:\Windows\Installer\MSI99E7.tmp

Filesize
1.0MB

MD5
0542ab86fac00270f03385f192a9711d

SHA1
98d0c70e11ba5418e0427abbbcffd5985b492814

SHA256
14ff538aa809d5d6d3aa4e6dea848b5da9d6a061e68e8f6008469b2a022a6dfe

SHA512
5c57811f0fdad8e1123e168abbf575cb6b7ed5920260669ddf04b54840f971f6f89b950934b8978b975e6f7704a029a1385f0b1c3054c004fb47fd347c45cf55

Download Submit
C:\Windows\Installer\MSI99E7.tmp-\CustomAction.config

Filesize
228B

MD5
eb99ee012eb63c162eebc1df3a15990b

SHA1
d48fd3b3b942c754e3588d91920670c087fce7e9

SHA256
c5045c2d482f71215877eb668264ee47e1415792457f19a5a55651c3554cc7cd

SHA512
455ec01953ec27186fbead17c503b7f952474a80b41e986494697497eceab130ad81a5561373d6762b71eec473d8e37cde742f557e50233f7eb0e8fb8b0be4ad

Download Submit
C:\Windows\Installer\MSI99E7.tmp-\Microsoft.Deployment.WindowsInstaller.dll

Filesize
172KB

MD5
5ef88919012e4a3d8a1e2955dc8c8d81

SHA1
c0cfb830b8f1d990e3836e0bcc786e7972c9ed62

SHA256
3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d

SHA512
4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684

Download Submit
C:\Windows\Installer\f775c72.msi

Filesize
1.8MB

MD5
3f1e680c437498c6572ab64f65460f2b

SHA1
f7b2b00126f99802f1c6d457c9a5fe1b86f3a052

SHA256
f1723a01d71d13aef6b2026f4f95a4157232845cf6908d4264672fd027a1cd32

SHA512
87666f74d07bb2e27bc833c725632600ca1289e6195cad0a6cf4941d4cdc99959761559672aba34e3166ffa0c564c694a215f0ddd01fb2d3d0c945958bac60e0

Download Submit
C:\Windows\TEMP\ScreenConnect\21.13.5058.7951\ScreenConnect.ClientSetup.exe

Filesize
5.2MB

MD5
ed1e82423b91a614b1d50c5c7131a673

SHA1
382ddf82581692038b8db66cb1ef64d37b03f42f

SHA256
760b4ea7c4922902807e1488c9d5ffa10124965f81a2d580fa4502ec92e2385c

SHA512
cd56fea712e8afcbf679321376795947a8f4d8ca8b5abecf88fe22e221830e4ba48874bf8b1f75ad364c41b9e0f20c8c9e3bbcfd5e5d1a799202aca4463c7377

Download Submit
C:\Windows\TEMP\ScreenConnect\ef92d1ca7ab7e4a0\setup.msi

Filesize
10.4MB

MD5
729eed1da458cfdae81e460985991da8

SHA1
f74e5102f6af32a40c73126f7d27560d8d64e265

SHA256
39fdf5c524cd8d339eb956de0a91163e656600984a9d1a0ef9296ac965a4680e

SHA512
b05289e9bce598a9c98c264e048f19bc88bf48b276d3a7a22329cdd7e493971de45f736cf3cb0810e6445441733008a39350049a63890ba64913c2c7b29bf3b6

Download Submit
C:\Windows\Temp\ScreenConnect\21.13.5058.7951\ScreenConnect.ClientSetup.exe

Filesize
5.2MB

MD5
ed1e82423b91a614b1d50c5c7131a673

SHA1
382ddf82581692038b8db66cb1ef64d37b03f42f

SHA256
760b4ea7c4922902807e1488c9d5ffa10124965f81a2d580fa4502ec92e2385c

SHA512
cd56fea712e8afcbf679321376795947a8f4d8ca8b5abecf88fe22e221830e4ba48874bf8b1f75ad364c41b9e0f20c8c9e3bbcfd5e5d1a799202aca4463c7377

Download Submit
\Program Files (x86)\ScreenConnect Client (ef92d1ca7ab7e4a0)\ScreenConnect.Client.dll

Filesize
152KB

MD5
c62efdfdba800cae8514b9ab81466bcd

SHA1
c7cebd9f0f07df214b6d7a53d62efd8cf2aaeb94

SHA256
d2aa58149f4e81afb718c7e79f97c53e56bf14a23b999715d9cc3860600da992

SHA512
a2d0aeb700b12a121205b452e8119d6544fe1b8746c85f6ee005ce80693dd45ec856d4e61b5120d94fd14ba7f37155b3562c46066a1f1e2cae61f998f88ec50f

Download Submit
\Program Files (x86)\ScreenConnect Client (ef92d1ca7ab7e4a0)\ScreenConnect.Client.dll

Filesize
152KB

MD5
c62efdfdba800cae8514b9ab81466bcd

SHA1
c7cebd9f0f07df214b6d7a53d62efd8cf2aaeb94

SHA256
d2aa58149f4e81afb718c7e79f97c53e56bf14a23b999715d9cc3860600da992

SHA512
a2d0aeb700b12a121205b452e8119d6544fe1b8746c85f6ee005ce80693dd45ec856d4e61b5120d94fd14ba7f37155b3562c46066a1f1e2cae61f998f88ec50f

Download Submit
\Program Files (x86)\ScreenConnect Client (ef92d1ca7ab7e4a0)\ScreenConnect.ClientService.dll

Filesize
30KB

MD5
dd2a1cd08659bfa1718a379493815a11

SHA1
a1fd2f8bae1ce79f14981c0ce434f25c1908ba2a

SHA256
6c3e45dd037a8178ec772516634c42a81424e1ea2c0d425c2b7e6a8ae331da60

SHA512
47f219c443aa3f5eae4b61f34f05e3600ba85675d839e18d84a11bcfb8e4157e8fb54674b0fa605a47e228ecdcc1aeab5818e35ce5e5205f79f87c23a7242cc0

Download Submit
\Program Files (x86)\ScreenConnect Client (ef92d1ca7ab7e4a0)\ScreenConnect.ClientService.dll

Filesize
30KB

MD5
dd2a1cd08659bfa1718a379493815a11

SHA1
a1fd2f8bae1ce79f14981c0ce434f25c1908ba2a

SHA256
6c3e45dd037a8178ec772516634c42a81424e1ea2c0d425c2b7e6a8ae331da60

SHA512
47f219c443aa3f5eae4b61f34f05e3600ba85675d839e18d84a11bcfb8e4157e8fb54674b0fa605a47e228ecdcc1aeab5818e35ce5e5205f79f87c23a7242cc0

Download Submit
\Program Files (x86)\ScreenConnect Client (ef92d1ca7ab7e4a0)\ScreenConnect.ClientService.dll

Filesize
30KB

MD5
dd2a1cd08659bfa1718a379493815a11

SHA1
a1fd2f8bae1ce79f14981c0ce434f25c1908ba2a

SHA256
6c3e45dd037a8178ec772516634c42a81424e1ea2c0d425c2b7e6a8ae331da60

SHA512
47f219c443aa3f5eae4b61f34f05e3600ba85675d839e18d84a11bcfb8e4157e8fb54674b0fa605a47e228ecdcc1aeab5818e35ce5e5205f79f87c23a7242cc0

Download Submit
\Program Files (x86)\ScreenConnect Client (ef92d1ca7ab7e4a0)\ScreenConnect.ClientService.dll

Filesize
30KB

MD5
dd2a1cd08659bfa1718a379493815a11

SHA1
a1fd2f8bae1ce79f14981c0ce434f25c1908ba2a

SHA256
6c3e45dd037a8178ec772516634c42a81424e1ea2c0d425c2b7e6a8ae331da60

SHA512
47f219c443aa3f5eae4b61f34f05e3600ba85675d839e18d84a11bcfb8e4157e8fb54674b0fa605a47e228ecdcc1aeab5818e35ce5e5205f79f87c23a7242cc0

Download Submit
\Program Files (x86)\ScreenConnect Client (ef92d1ca7ab7e4a0)\ScreenConnect.Core.dll

Filesize
426KB

MD5
247b3c622b9edec8903bff62ea5c4b05

SHA1
db0069d2ca540b44d4873c9232f68ec0a06423bb

SHA256
d804db826c67648eb85fe0c3929e8e0d7b59cb6cfa19a2ea7c020e95bd1dfe2b

SHA512
993370e1e16c963873105c7315e63e693d174175e126a98bacee4ad05d490c132c159962fc915d7a4604ab82b50b2695575a41d7bbfcf69413f0362792639466

Download Submit
\Program Files (x86)\ScreenConnect Client (ef92d1ca7ab7e4a0)\ScreenConnect.Core.dll

Filesize
426KB

MD5
247b3c622b9edec8903bff62ea5c4b05

SHA1
db0069d2ca540b44d4873c9232f68ec0a06423bb

SHA256
d804db826c67648eb85fe0c3929e8e0d7b59cb6cfa19a2ea7c020e95bd1dfe2b

SHA512
993370e1e16c963873105c7315e63e693d174175e126a98bacee4ad05d490c132c159962fc915d7a4604ab82b50b2695575a41d7bbfcf69413f0362792639466

Download Submit
\Program Files (x86)\ScreenConnect Client (ef92d1ca7ab7e4a0)\ScreenConnect.Windows.dll

Filesize
1.6MB

MD5
aedc2f720b8fadf1291f06aa67a11e06

SHA1
e1afdb834d6a077a9785cd4c6b7672eb9cd6ec3e

SHA256
2c777242ed2cc26f378a1a5b224529c795a2cdb01abf679d4e300be666f27b80

SHA512
1fbb99d58480ca4f89dd02d8befcbc8d738ad3e20b6ceae019f98a8880faf360f50188bf8e2beefcdf49f03d64facb1acf42760fb0f3b81719ef47e6eb78c3ec

Download Submit
\Program Files (x86)\ScreenConnect Client (ef92d1ca7ab7e4a0)\ScreenConnect.Windows.dll

Filesize
1.6MB

MD5
aedc2f720b8fadf1291f06aa67a11e06

SHA1
e1afdb834d6a077a9785cd4c6b7672eb9cd6ec3e

SHA256
2c777242ed2cc26f378a1a5b224529c795a2cdb01abf679d4e300be666f27b80

SHA512
1fbb99d58480ca4f89dd02d8befcbc8d738ad3e20b6ceae019f98a8880faf360f50188bf8e2beefcdf49f03d64facb1acf42760fb0f3b81719ef47e6eb78c3ec

Download Submit
\Program Files (x86)\ScreenConnect Client (ef92d1ca7ab7e4a0)\ScreenConnect.WindowsClient.exe

Filesize
546KB

MD5
5723f723a4243db2a96e04d1d6ebfcd7

SHA1
e98ae8bf1ce23cbb606c6ceb5053072fbfa84358

SHA256
a4b18e06fbfeeed39e6184a349ecde836b79984e722e05f336f7b90b2823837c

SHA512
e3b3e7da2323261d9ab1777f2be0145b8a500142fcf9663662b2c3823fe7ed09418c881592b23bc89c4f1424a0c060b793c6b5976581ff848ba5774491bb1312

Download Submit
\Program Files (x86)\ScreenConnect Client (ef92d1ca7ab7e4a0)\ScreenConnect.WindowsClient.exe

Filesize
546KB

MD5
5723f723a4243db2a96e04d1d6ebfcd7

SHA1
e98ae8bf1ce23cbb606c6ceb5053072fbfa84358

SHA256
a4b18e06fbfeeed39e6184a349ecde836b79984e722e05f336f7b90b2823837c

SHA512
e3b3e7da2323261d9ab1777f2be0145b8a500142fcf9663662b2c3823fe7ed09418c881592b23bc89c4f1424a0c060b793c6b5976581ff848ba5774491bb1312

Download Submit
\Program Files (x86)\ScreenConnect Client (ef92d1ca7ab7e4a0)\ScreenConnect.WindowsClient.exe

Filesize
546KB

MD5
5723f723a4243db2a96e04d1d6ebfcd7

SHA1
e98ae8bf1ce23cbb606c6ceb5053072fbfa84358

SHA256
a4b18e06fbfeeed39e6184a349ecde836b79984e722e05f336f7b90b2823837c

SHA512
e3b3e7da2323261d9ab1777f2be0145b8a500142fcf9663662b2c3823fe7ed09418c881592b23bc89c4f1424a0c060b793c6b5976581ff848ba5774491bb1312

Download Submit
\Program Files (x86)\ScreenConnect Client (ef92d1ca7ab7e4a0)\ScreenConnect.WindowsClient.exe

Filesize
546KB

MD5
5723f723a4243db2a96e04d1d6ebfcd7

SHA1
e98ae8bf1ce23cbb606c6ceb5053072fbfa84358

SHA256
a4b18e06fbfeeed39e6184a349ecde836b79984e722e05f336f7b90b2823837c

SHA512
e3b3e7da2323261d9ab1777f2be0145b8a500142fcf9663662b2c3823fe7ed09418c881592b23bc89c4f1424a0c060b793c6b5976581ff848ba5774491bb1312

Download Submit
\Program Files (x86)\ScreenConnect Client (ef92d1ca7ab7e4a0)\ScreenConnect.WindowsClient.exe

Filesize
546KB

MD5
5723f723a4243db2a96e04d1d6ebfcd7

SHA1
e98ae8bf1ce23cbb606c6ceb5053072fbfa84358

SHA256
a4b18e06fbfeeed39e6184a349ecde836b79984e722e05f336f7b90b2823837c

SHA512
e3b3e7da2323261d9ab1777f2be0145b8a500142fcf9663662b2c3823fe7ed09418c881592b23bc89c4f1424a0c060b793c6b5976581ff848ba5774491bb1312

Download Submit
\Users\Admin\AppData\Local\Temp\MSI98C6.tmp

Filesize
351KB

MD5
c0cadb11c47908b53069efb02098c866

SHA1
c595a157b12be5d9fbb3605fd22fc92a2bef640c

SHA256
485d0cd57bf93a5a8ea41929f84df7869a1a951eb8f47f5742f974dbab49652e

SHA512
74efaaba6dec75c89d119d2c3e2e99222836551013a558312854004c7b4ea5db4cb9831ead06161494a48d80fd74a544135ec41f56386989e758629c07fdfbc1

Download Submit
\Users\Admin\AppData\Local\Temp\MSI98C6.tmp

Filesize
351KB

MD5
c0cadb11c47908b53069efb02098c866

SHA1
c595a157b12be5d9fbb3605fd22fc92a2bef640c

SHA256
485d0cd57bf93a5a8ea41929f84df7869a1a951eb8f47f5742f974dbab49652e

SHA512
74efaaba6dec75c89d119d2c3e2e99222836551013a558312854004c7b4ea5db4cb9831ead06161494a48d80fd74a544135ec41f56386989e758629c07fdfbc1

Download Submit
\Users\Admin\AppData\Local\Temp\MSI98C6.tmp-\Microsoft.Deployment.WindowsInstaller.dll

Filesize
172KB

MD5
5ef88919012e4a3d8a1e2955dc8c8d81

SHA1
c0cfb830b8f1d990e3836e0bcc786e7972c9ed62

SHA256
3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d

SHA512
4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684

Download Submit
\Users\Admin\AppData\Local\Temp\MSI98C6.tmp-\Microsoft.Deployment.WindowsInstaller.dll

Filesize
172KB

MD5
5ef88919012e4a3d8a1e2955dc8c8d81

SHA1
c0cfb830b8f1d990e3836e0bcc786e7972c9ed62

SHA256
3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d

SHA512
4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684

Download Submit
\Users\Admin\AppData\Local\Temp\MSI98C6.tmp-\ScreenConnect.Core.dll

Filesize
426KB

MD5
247b3c622b9edec8903bff62ea5c4b05

SHA1
db0069d2ca540b44d4873c9232f68ec0a06423bb

SHA256
d804db826c67648eb85fe0c3929e8e0d7b59cb6cfa19a2ea7c020e95bd1dfe2b

SHA512
993370e1e16c963873105c7315e63e693d174175e126a98bacee4ad05d490c132c159962fc915d7a4604ab82b50b2695575a41d7bbfcf69413f0362792639466

Download Submit
\Users\Admin\AppData\Local\Temp\MSI98C6.tmp-\ScreenConnect.Core.dll

Filesize
426KB

MD5
247b3c622b9edec8903bff62ea5c4b05

SHA1
db0069d2ca540b44d4873c9232f68ec0a06423bb

SHA256
d804db826c67648eb85fe0c3929e8e0d7b59cb6cfa19a2ea7c020e95bd1dfe2b

SHA512
993370e1e16c963873105c7315e63e693d174175e126a98bacee4ad05d490c132c159962fc915d7a4604ab82b50b2695575a41d7bbfcf69413f0362792639466

Download Submit
\Users\Admin\AppData\Local\Temp\MSI98C6.tmp-\ScreenConnect.InstallerActions.dll

Filesize
17KB

MD5
512fc5c741aa871651a9281c89e9cdb7

SHA1
4355e0a8f03b127ae4527f23829f14af9e19a7db

SHA256
ffa1fda460b74d2bfb3d5f2ace45594aa3321fc21db5f5e1e2bc034e25430dd1

SHA512
7f22dde3ef3123a2854457d19f853885a1e0a60a0497f05da85051310a68182077a3bf369b2c9f38ecd71219d60df29101871191ad96b9f827a8f34c25dd4444

Download Submit
\Users\Admin\AppData\Local\Temp\MSI98C6.tmp-\ScreenConnect.InstallerActions.dll

Filesize
17KB

MD5
512fc5c741aa871651a9281c89e9cdb7

SHA1
4355e0a8f03b127ae4527f23829f14af9e19a7db

SHA256
ffa1fda460b74d2bfb3d5f2ace45594aa3321fc21db5f5e1e2bc034e25430dd1

SHA512
7f22dde3ef3123a2854457d19f853885a1e0a60a0497f05da85051310a68182077a3bf369b2c9f38ecd71219d60df29101871191ad96b9f827a8f34c25dd4444

Download Submit
\Windows\Installer\MSI7F3F.tmp

Filesize
202KB

MD5
ba84dd4e0c1408828ccc1de09f585eda

SHA1
e8e10065d479f8f591b9885ea8487bc673301298

SHA256
3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852

SHA512
7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290

Download Submit
\Windows\Installer\MSI800B.tmp

Filesize
202KB

MD5
ba84dd4e0c1408828ccc1de09f585eda

SHA1
e8e10065d479f8f591b9885ea8487bc673301298

SHA256
3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852

SHA512
7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290

Download Submit
\Windows\Installer\MSI8134.tmp

Filesize
202KB

MD5
ba84dd4e0c1408828ccc1de09f585eda

SHA1
e8e10065d479f8f591b9885ea8487bc673301298

SHA256
3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852

SHA512
7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290

Download Submit
\Windows\Installer\MSI964C.tmp

Filesize
202KB

MD5
ba84dd4e0c1408828ccc1de09f585eda

SHA1
e8e10065d479f8f591b9885ea8487bc673301298

SHA256
3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852

SHA512
7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290

Download Submit
\Windows\Installer\MSI986F.tmp

Filesize
202KB

MD5
ba84dd4e0c1408828ccc1de09f585eda

SHA1
e8e10065d479f8f591b9885ea8487bc673301298

SHA256
3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852

SHA512
7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290

Download Submit
\Windows\Installer\MSI99E7.tmp

Filesize
1.0MB

MD5
0542ab86fac00270f03385f192a9711d

SHA1
98d0c70e11ba5418e0427abbbcffd5985b492814

SHA256
14ff538aa809d5d6d3aa4e6dea848b5da9d6a061e68e8f6008469b2a022a6dfe

SHA512
5c57811f0fdad8e1123e168abbf575cb6b7ed5920260669ddf04b54840f971f6f89b950934b8978b975e6f7704a029a1385f0b1c3054c004fb47fd347c45cf55

Download Submit
\Windows\Installer\MSI99E7.tmp

Filesize
1.0MB

MD5
0542ab86fac00270f03385f192a9711d

SHA1
98d0c70e11ba5418e0427abbbcffd5985b492814

SHA256
14ff538aa809d5d6d3aa4e6dea848b5da9d6a061e68e8f6008469b2a022a6dfe

SHA512
5c57811f0fdad8e1123e168abbf575cb6b7ed5920260669ddf04b54840f971f6f89b950934b8978b975e6f7704a029a1385f0b1c3054c004fb47fd347c45cf55

Download Submit
\Windows\Installer\MSI99E7.tmp-\Microsoft.Deployment.WindowsInstaller.dll

Filesize
172KB

MD5
5ef88919012e4a3d8a1e2955dc8c8d81

SHA1
c0cfb830b8f1d990e3836e0bcc786e7972c9ed62

SHA256
3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d

SHA512
4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684

Download Submit
\Windows\Installer\MSI99E7.tmp-\Microsoft.Deployment.WindowsInstaller.dll

Filesize
172KB

MD5
5ef88919012e4a3d8a1e2955dc8c8d81

SHA1
c0cfb830b8f1d990e3836e0bcc786e7972c9ed62

SHA256
3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d

SHA512
4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684

Download Submit
\Windows\Installer\MSI99E7.tmp-\ScreenConnect.Core.dll

Filesize
517KB

MD5
f611831c20074591a1512a135dd18b10

SHA1
ccf6b81bbff015a05d33fdc2a1ba56e7438a4ad7

SHA256
487fc1dc2d641f58ae8bca3fe53c83ecc7bc049f54c6276b63d924b572119acf

SHA512
7f5a11243f223f3e322eb6ae7f432ffe5647a17496709fc7a921dd698027edcee222523832960116107bea969f14ab579426dca47cded7dd5320d16cf7902ebf

Download Submit
\Windows\Installer\MSI99E7.tmp-\ScreenConnect.InstallerActions.dll

Filesize
21KB

MD5
e6e4518deef91f3d390249202a1fd985

SHA1
ede8058edf4bf94a80ef9d1f5d8910e56774dff2

SHA256
dbbb6c2187a5de822d28cbe43c6d393da0fd2e28c90d8b7208b1aad66d55cc71

SHA512
8bc88f5e0ed9a0bc0e447f944bf27f13a4294a50c01bda9c152c093410e46f66329fdca5bccb190cdcdfdafb9497bf59829d9aedad3498d9bd14bf8552029b09

Download Submit
\Windows\Installer\MSI99E7.tmp-\ScreenConnect.InstallerActions.dll

Filesize
21KB

MD5
e6e4518deef91f3d390249202a1fd985

SHA1
ede8058edf4bf94a80ef9d1f5d8910e56774dff2

SHA256
dbbb6c2187a5de822d28cbe43c6d393da0fd2e28c90d8b7208b1aad66d55cc71

SHA512
8bc88f5e0ed9a0bc0e447f944bf27f13a4294a50c01bda9c152c093410e46f66329fdca5bccb190cdcdfdafb9497bf59829d9aedad3498d9bd14bf8552029b09

Download Submit
\Windows\Temp\ScreenConnect\21.13.5058.7951\ScreenConnect.ClientSetup.exe

Filesize
5.2MB

MD5
ed1e82423b91a614b1d50c5c7131a673

SHA1
382ddf82581692038b8db66cb1ef64d37b03f42f

SHA256
760b4ea7c4922902807e1488c9d5ffa10124965f81a2d580fa4502ec92e2385c

SHA512
cd56fea712e8afcbf679321376795947a8f4d8ca8b5abecf88fe22e221830e4ba48874bf8b1f75ad364c41b9e0f20c8c9e3bbcfd5e5d1a799202aca4463c7377

Download Submit
memory/1320-159-0x000007FEF5B70000-0x000007FEF655C000-memory.dmp

Filesize
9.9MB

Download
memory/1320-160-0x000000001BA40000-0x000000001BAC0000-memory.dmp

Filesize
512KB

Download
memory/1320-165-0x000000001BA40000-0x000000001BAC0000-memory.dmp

Filesize
512KB

Download
memory/1320-168-0x000007FEF5B70000-0x000007FEF655C000-memory.dmp

Filesize
9.9MB

Download
memory/1320-169-0x000000001BA40000-0x000000001BAC0000-memory.dmp

Filesize
512KB

Download
memory/1320-244-0x000007FEF5B70000-0x000007FEF655C000-memory.dmp

Filesize
9.9MB

Download
memory/1524-0-0x0000000074B90000-0x000000007527E000-memory.dmp

Filesize
6.9MB

Download
memory/1524-3-0x0000000004DC0000-0x0000000004E00000-memory.dmp

Filesize
256KB

Download
memory/1524-1-0x0000000004DC0000-0x0000000004E00000-memory.dmp

Filesize
256KB

Download
memory/1524-9-0x0000000074B90000-0x000000007527E000-memory.dmp

Filesize
6.9MB

Download
memory/1524-7-0x0000000004E00000-0x0000000004F98000-memory.dmp

Filesize
1.6MB

Download
memory/1524-6-0x0000000000670000-0x00000000006E2000-memory.dmp

Filesize
456KB

Download
memory/1524-5-0x0000000000380000-0x0000000000398000-memory.dmp

Filesize
96KB

Download
memory/1524-2-0x0000000000350000-0x0000000000358000-memory.dmp

Filesize
32KB

Download
memory/1524-4-0x0000000004FC0000-0x0000000005182000-memory.dmp

Filesize
1.8MB

Download
memory/1588-218-0x00000000044C0000-0x0000000004548000-memory.dmp

Filesize
544KB

Download
memory/1588-204-0x00000000731A0000-0x000000007388E000-memory.dmp

Filesize
6.9MB

Download
memory/1588-206-0x0000000004610000-0x0000000004650000-memory.dmp

Filesize
256KB

Download
memory/1588-210-0x00000000004B0000-0x00000000004DE000-memory.dmp

Filesize
184KB

Download
memory/1588-211-0x0000000004610000-0x0000000004650000-memory.dmp

Filesize
256KB

Download
memory/1588-215-0x0000000000910000-0x000000000091C000-memory.dmp

Filesize
48KB

Download
memory/1588-228-0x00000000731A0000-0x000000007388E000-memory.dmp

Filesize
6.9MB

Download
memory/2060-133-0x0000000003CA0000-0x0000000003E38000-memory.dmp

Filesize
1.6MB

Download
memory/2060-138-0x0000000003830000-0x00000000038BE000-memory.dmp

Filesize
568KB

Download
memory/2060-248-0x00000000731A0000-0x000000007388E000-memory.dmp

Filesize
6.9MB

Download
memory/2060-100-0x0000000003760000-0x00000000037A0000-memory.dmp

Filesize
256KB

Download
memory/2060-129-0x0000000003760000-0x00000000037A0000-memory.dmp

Filesize
256KB

Download
memory/2060-126-0x00000000731A0000-0x000000007388E000-memory.dmp

Filesize
6.9MB

Download
memory/2060-149-0x0000000003760000-0x00000000037A0000-memory.dmp

Filesize
256KB

Download
memory/2060-99-0x0000000003760000-0x00000000037A0000-memory.dmp

Filesize
256KB

Download
memory/2060-95-0x00000000731A0000-0x000000007388E000-memory.dmp

Filesize
6.9MB

Download
memory/2060-110-0x0000000000350000-0x000000000035E000-memory.dmp

Filesize
56KB

Download
memory/2060-96-0x0000000003760000-0x00000000037A0000-memory.dmp

Filesize
256KB

Download
memory/2060-125-0x0000000000CC0000-0x0000000000D32000-memory.dmp

Filesize
456KB

Download
memory/2060-121-0x0000000000920000-0x000000000094C000-memory.dmp

Filesize
176KB

Download
memory/2060-104-0x0000000000350000-0x000000000035E000-memory.dmp

Filesize
56KB

Download
memory/2460-152-0x0000000000370000-0x00000000003E2000-memory.dmp

Filesize
456KB

Download
memory/2460-156-0x0000000000480000-0x000000000048E000-memory.dmp

Filesize
56KB

Download
memory/2460-167-0x000000001AF90000-0x000000001B010000-memory.dmp

Filesize
512KB

Download
memory/2460-247-0x000007FEF5B70000-0x000007FEF655C000-memory.dmp

Filesize
9.9MB

Download
memory/2460-150-0x0000000000E10000-0x0000000000E9E000-memory.dmp

Filesize
568KB

Download
memory/2460-151-0x0000000000330000-0x000000000035C000-memory.dmp

Filesize
176KB

Download
memory/2460-166-0x000007FEF5B70000-0x000007FEF655C000-memory.dmp

Filesize
9.9MB

Download
memory/2460-153-0x000000001B340000-0x000000001B4D8000-memory.dmp

Filesize
1.6MB

Download
memory/2460-154-0x000007FEF5B70000-0x000007FEF655C000-memory.dmp

Filesize
9.9MB

Download
memory/2460-155-0x000000001AF90000-0x000000001B010000-memory.dmp

Filesize
512KB

Download
memory/2564-183-0x0000000003A20000-0x0000000003A60000-memory.dmp

Filesize
256KB

Download
memory/2564-180-0x00000000003F0000-0x0000000000412000-memory.dmp

Filesize
136KB

Download
memory/2564-182-0x0000000003A20000-0x0000000003A60000-memory.dmp

Filesize
256KB

Download
memory/2564-186-0x00000000731A0000-0x000000007388E000-memory.dmp

Filesize
6.9MB

Download
memory/2564-187-0x0000000003A20000-0x0000000003A60000-memory.dmp

Filesize
256KB

Download
memory/2564-178-0x00000000731A0000-0x000000007388E000-memory.dmp

Filesize
6.9MB

Download
memory/2564-179-0x0000000000BD0000-0x0000000000C58000-memory.dmp

Filesize
544KB

Download
memory/2564-191-0x00000000731A0000-0x000000007388E000-memory.dmp

Filesize
6.9MB

Download
memory/2564-181-0x0000000003A20000-0x0000000003A60000-memory.dmp

Filesize
256KB

Download
memory/2564-188-0x0000000003A20000-0x0000000003A60000-memory.dmp

Filesize
256KB

Download
memory/2564-177-0x0000000003D30000-0x0000000003FFC000-memory.dmp

Filesize
2.8MB

Download
memory/2564-176-0x00000000002E0000-0x00000000002E8000-memory.dmp

Filesize
32KB

Download
memory/2600-27-0x0000000000EC0000-0x0000000000F00000-memory.dmp

Filesize
256KB

Download
memory/2600-26-0x0000000073890000-0x0000000073F7E000-memory.dmp

Filesize
6.9MB

Download
memory/2600-25-0x0000000000580000-0x00000000005AE000-memory.dmp

Filesize
184KB

Download
memory/2600-35-0x00000000024A0000-0x0000000002512000-memory.dmp

Filesize
456KB

Download
memory/2600-31-0x00000000005B0000-0x00000000005BA000-memory.dmp

Filesize
40KB

Download
memory/2600-44-0x0000000073890000-0x0000000073F7E000-memory.dmp

Filesize
6.9MB

Download