395b9fda966091bba1e1e7e8af4e3aaa6255990ceb78d80053de1c7f35132de6

Analysis

max time kernel
141s
max time network
114s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 20:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

395b9fda966091bba1e1e7e8af4e3aaa6255990ceb78d80053de1c7f35132de6.exe
Size

84KB
MD5

9ac5a710a4e0ba22c658af8eab2b9386
SHA1

cf5a1f0ccfb32d89abfc13107207b7aff72ac2a6
SHA256

395b9fda966091bba1e1e7e8af4e3aaa6255990ceb78d80053de1c7f35132de6
SHA512

906925320f023b8db9b2caacb0086a36ab34a11f6f7fec9d9ae5d05e2c485a4952d921491543dcbbcdc601d749e1ac75e8d3ace41a785b0bd85ff155cf2784c5
SSDEEP

1536:+azWlKzJVcNp++yQNS6xNNCT2l8NE8llbpTaCJRpsWr6cdaQTJSvYYS7Q8xdE:yFNpo6rIKlUE8fbkqRfbaQlaYYSdE

Score

8^/10

persistence

Malware Config

Signatures

Downloads MZ/PE file

Manipulates Digital Signatures 1 TTPs 4 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

SIP and Trust Provider Hijacking

T1553.003

Processes:

395b9fda966091bba1e1e7e8af4e3aaa6255990ceb78d80053de1c7f35132de6.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C\Blob = 0300000001000000140000007b0f360b775f76c94a12ca48445aa2d2a875701c2000000001000000b4060000308206b030820498a003020102021008ad40b260d29c4c9f5ecda9bd93aed9300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3231303432393030303030305a170d3336303432383233353935395a3069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e6720525341343039362053484133383420323032312043413130820222300d06092a864886f70d01010105000382020f003082020a0282020100d5b42f42d028ad78b75dd539591bb18842f5338ceb3d819770c5bbc48526309fa48e68d85cf5eb342407e14b4fd37843f417d71edaf9d2d5671a524f0ea157fc8899c191cc81033e4d702464b38de2087d347d4c8057126b439a99f2c53b1ff2efcb475a13a64cb3012025f310d38bb2fb08f08ae09d09c065a7fa98804935873d5119e8902178452ea19f2ce118c21accc5ee93497042328ffbc6ea1cf3656891a24d4c8211485268de10bd14575de8181365c57fb24f852c48a4568435d6f92e9caa0015d137fe1a0694c27cc8ea1b32e6cac2f4a7a3030e74a5af39b6ab6012e3e8d6b9f731e1dcade418a0d8c1234747b3a10f6ea3ab6d9806831bb76a672dd2bd441a9210818fb03b09d7c79b325ac2ff6a60548b49c193ede1b45ce06feb26f98cd5b2f93810e6eace91f5bed3fb6f9361345cbc93452883362a66285fb073ce8b262506b283d45cf615194ced62e05e33f2e8e8ec0aa7b0032b91b23679bef7ad081e75a665ccbbe34850f377911afedb50a246c8615898f57c02163c8328ad3986ecd4b70d53d0f847e675308dec30937614a65b4b5d74614d3f129176debf58cb72102941f0d5c56d267668114113589adc262b01f4894d59db78cf814a3e40475fc98150738510232159608a6454c1cc211ae838197c661ccd78384530994fff634f4cbbaa0d0853417c583d47b3fab6ec8c320902cc6c3c0c56110203010001a38201593082015530120603551d130101ff040830060101ff020100301d0603551d0e041604146837e0ebb63bf85f1186fbfe617b088865f44e42301f0603551d23041830168014ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300e0603551d0f0101ff04040302018630130603551d25040c300a06082b06010505070303307706082b06010505070101046b3069302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304106082b060105050730028635687474703a2f2f636163657274732e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63727430430603551d1f043c303a3038a036a0348632687474703a2f2f63726c332e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63726c301c0603551d20041530133007060567810c01033008060667810c010401300d06092a864886f70d01010c050003820201003a23443d8d0876ee8fbc3a99d356e0021aa5f84834f32cb6e67466f79472b100caaf6c302713129e90449f4bfd9ea37c26d537bc3a5d486d95d53f49f427bb16814550fd9cbdb685e0767e3771cb22f75aaa90cff5936ae3eb20d1d55079889a8a8ac1b6bda148187edcd8801a111918cd61998156f6c9e376e7c4e41b5f43f83e94ff76393d9ed499cf4add28eb5f26a1955848d51afed7273ffd90d17686dd1cb0605cf30da8eee089a1bd39e1384eda6ebb369dfbe521535ac3cae96af1a23edb43b833c84f38149299f5ddce546dd95d02141f40337c03e295b2c221757352cb46d8c4341ca2a54b8dcd6f76372c853f1ace26e918be9007b0437f9588208270f0cccaeffd29355c1f893855f7378a8b09a1cb0be9311aff2e195c3971e1be9ca70a06d62667b792e64e5fde7aac49cf2ea47492addb3ca49c861fe3c1561b2b23ff8fb5ea887b706be6a0bafd3a3f45a6c4e81691528b41c048844b964dab4440e38df01528ceedf11856072a2f10c40c08643c338fae288c3ccb8f880b0dbf3bf4ce1e7b8eefb5ebcbb7f07713e6e7283fac12aea52f226c41f9825c1566cc6c0ecac586c3f626330c074ba0d307026a6a4030484b34a85120bbad1b8508e2590d6dca05502bea4a1c9ea5fda0a71f0674e7f2d65290fdaf854821f9573bb49c03ed8645f4b4616ebf68e2266086eac8afa9fe941de7631b3a8656784e	395b9fda966091bba1e1e7e8af4e3aaa6255990ceb78d80053de1c7f35132de6.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4C2272FBA7A7380F55E2A424E9E624AEE1C14579\Blob = 0300000001000000140000004c2272fba7a7380f55e2a424e9e624aee1c145792000000001000000640700003082076030820548a00302010202100b9360051bccf66642998998d5ba97ce300d06092a864886f70d01010b05003069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e67205253413430393620534841333834203230323120434131301e170d3232303831373030303030305a170d3235303831353233353935395a3065310b30090603550406130255533110300e06035504081307466c6f72696461310e300c0603550407130554616d706131193017060355040a1310436f6e6e656374776973652c204c4c433119301706035504031310436f6e6e656374776973652c204c4c4330820222300d06092a864886f70d01010105000382020f003082020a0282020100ec489826d08d2c6de21b3cd3676db1e0e50cb1ff75ff564e9741f9574aa3640aa8297294a05b4db68abd0760b6b05b50ce92ff42a4e390be776a43e9961c722f6b3a4d5c880bcc6a61b4026f9137d36b2b7e9b86055876b9fa860dbcb164fe7f4b5b9de4799ae4e02dc1f0bee01e5d032933a2827388f8db0b482e76c441b1bd50909ef2023e1fb62196c994ce052266b28cd89253e6416044133139764db5fc45702529536bf82c775f9ec81fa27dc409530325f40cdef95b81b9ce0d42791cee72e7bd1b36c257b52257c65a28970e457513989434bfc239e2992b193e1b3cc3f11ccdd1d26d4ec9845099ab913906a42069af999c0071169b45a2ea1aa666f1904e8acb05e1823a359a291fd46b4ef7aed5935bb6ab17ebf077210726930c90f01761d6544a94e8fa614cc41d817eec734b1c3d3afb7c58fb256f0c09edc1459bddbff9940ed1958570265d67af79a9b6a16affd70fc6328c9810d5dc186e39af6fbcad49a270f237e6bcd5de0bc014bc3179cd79776591340311a42ca94f33416c2e01b59bd1d71de86ace6716bc90b2d7695d155039aa08fbac19a4d93fb784230a20a485287a16355645fc09142c602d140fa046b7bfd75328184ff7bdf8f9e0d65e6201c8d242931047f59bd328ac353777ccefa60408887b84fc3631301463461a1d73c0b5cc74d6d82905ddf923bdbab027a311cc38d3fa16f639a50203010001a382020630820202301f0603551d230418301680146837e0ebb63bf85f1186fbfe617b088865f44e42301d0603551d0e04160414338ce10a6e06d9c6ed0bc6cae736cefb8188646a300e0603551d0f0101ff04040302078030130603551d25040c300a06082b060105050703033081b50603551d1f0481ad3081aa3053a051a04f864d687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c3053a051a04f864d687474703a2f2f63726c342e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c303e0603551d20043730353033060667810c0104013029302706082b06010505070201161b687474703a2f2f7777772e64696769636572742e636f6d2f43505330819406082b06010505070101048187308184302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d305c06082b060105050730028650687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e637274300c0603551d130101ff04023000300d06092a864886f70d01010b050003820201000ad79f00cf4984864c8981ecce8718aa875647f6a74608c968e16568c7aa9d711ed7341676038067f01330c91621b27a2a8894c4108c268162a31f13f9757a7d6bb3c6f19bf27c3a29896d712d85873627d827cd6471761444fabf1d31e903f791143c5b4ce5e7444aacba36d759aeba3069d195226755cbc675aa747f77596c53c96e083c45bba24479d6845eea9f2b28ba29b4dcf0bcf14aa4ce176c24e2c1b8fec3ee16e1c086db6fda97388859e83be65c03f701395b78b842c6dd1533ef642cca6fe50f6337d3f2dfedd8b28f2b28e0c98edd2151392e7cc75489f48859f1de14c81b306eb50eed7bb78be30eaada76767c4ca523a11eec5a2372d6122926ab1801a6a6778e9504791487ee47d4577154988802070f80fc535957658f954cd083546c5afb5a6567b6761275f5db20f70ab86feef94c7cfc65369d325121b69a82399bc7dc1962416f0f05cf1eee64d495a3527e464e2c68da0187093f97b673e43dddbcc067e00713f1565fcff8c3772d44b40a04e600644f22a990345f9a6b5b52963e82c81a0ce91d43a230f67b37d8debda40ea3d59d305e18adc1976516c12a8ba2bca24143b12e9527b4dca58872aa9b3a8c6ac563fc2dc02bf51be889516d35a4ba9d062417b5bdcc50ba945fae26b60d6aec03984798a6a21d3ff793cc0849e81ed55b8027411c50db776ae8feef2fdc2dafb04345261dedc054	395b9fda966091bba1e1e7e8af4e3aaa6255990ceb78d80053de1c7f35132de6.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C	395b9fda966091bba1e1e7e8af4e3aaa6255990ceb78d80053de1c7f35132de6.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4C2272FBA7A7380F55E2A424E9E624AEE1C14579	395b9fda966091bba1e1e7e8af4e3aaa6255990ceb78d80053de1c7f35132de6.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

ScreenConnect.ClientService.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (a5b2a486-5c61-443e-8c27-5fbee7398254)\ImagePath = "\"C:\\Users\\Admin\\AppData\\Local\\Apps\\2.0\\52AEOZL6.Q93\\R3ZRWMKC.GNA\\scre..tion_25b0fbb6ef7eb094_0017.0009_d2b150e250a00e67\\ScreenConnect.ClientService.exe\" \"?e=Support&y=Guest&h=instance-x4pxrv-relay.screenconnect.com&p=443&s=a5b2a486-5c61-443e-8c27-5fbee7398254&k=BgIAAACkAABSU0ExAAgAAAEAAQAV7fxF6G2Co%2bgofUQo0iMSkvqwwnZNqGUWV20oB1TLXsJywgN7Kz2ugN0qeCUJEQCqcCGXInt9mxRkWiz6%2bZitPn8PxB6wC1nrORnrGWH6dE1jrzWIPwV72TP3G3uqISb%2bbLmkvEMztsg8J40oDXvLPITpb%2f0%2f2tawiBDzEerVfkmIVutPW4dh7ChvvwCqvrV6jnfxZt7yvoyo8dHFuY4zmNzb20lWUn%2bNUhHCHqHcVkMwUMJhTSypGbFpOUpHuutbXlaa9QHN4flEha8w0hBPdHpWRd7FigkZTyQeTqwiuHK7EkzjxFDEI4qLeFlL3mCVg14Ng%2bLnz3FWWOmtYG%2fB&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAA%2fvw6PIZ12UeS%2baV0tbBYAAAAAAACAAAAAAAQZgAAAAEAACAAAADeBAexGxAKBfIiZlvRAwvFmoyzvd4FNXPyNivyaHORuAAAAAAOgAAAAAIAACAAAAAjJOVKslU2X8xrRl%2beRthRlCAUiKBEry9T2XMpazYuz6AEAADXCMjaRnMawJG7rJhzQNNwo42mo4WPP%2b24YvzrB1Ytstqs5Hw0uswDCEk9OcO9pMz0Ay%2fz7gknH%2f55jO%2b5cD4ngYLrZCcCpvVKeSxvADn3XRkS0R6fQ5V4KyU2gOHUfPndSr2wpx2WMpMC718aufrWZt86lQ85ftKI6%2fYz%2bBSvtM4%2bH8hXVLAkSTLmrJS0dPQFYcw%2boo8uawl2yyGh1QEtc06nME9XF1ob%2bMYCCviFUfMWGC%2b7ilwHmYk11380xDzc0xp1mUzo50YxCmORM5CO%2fFh2mrafpgcQ9ddF2WjsD424Am7QygBOCvgf9Bs0poILy%2bABu%2fVuYSTahw7N1NiEvEESsjpi3zcnv7pp4hl6m%2f2jptC8mNwcfQYoUUJ3oTMQo0O7Lvg%2fco7bQR%2bkOQRvZSPq1QpyBXKapsFYZ%2bzCn9%2f9wsP%2bqo4dAY8ttwPHvKFQzOVUrDvq045LeD7YdPgL8I9%2fcI5Ck8r88HRlyKRICpEI%2b1oLpIMo3SbkDtLkvgjo61lwG%2f4DgIcuIWcAGLJ%2fJkB8omdJwW8IKpMwXaU5hUX8hRZpQMFgxYbGESie0QoDz9JKp6NhDSqOBiv0v9F5pE4TVm%2f%2bHSRp8H3H0Ixf3MYinjQe6LWjt5d%2btnSOAdSbGyC7B3q2%2f5jWB%2bRtnbQEJUaghZLDH31QzNoTJbp1ct6SVfRXZQ97m80eTGDUJ3gIpeXU3aKoYySxcNCbbT9LoqG%2bfwHmj%2fPyy1GqD3eA2qjMHazLjJunZkNC7wrQjOE6D42oStl0Bbj%2f8ieCISXrDeZB1Oq0YDb%2fQ8NgdvKcaw3MyuSVx8JJmnTTDh1s4A595JKBNrTtYIRNZ3GlRZQEGiUyScfCygahfVmru8mUkHZa2qrz7sYH3lHzFF5YysamH%2bq74Jxn3n5x5aG%2bDWyLS58AsmGEXEnimcabaomTxdP85RDqFIPhTpkGzM4Pb%2fsSunnustu1dGbct%2bNmj9gR2GAfkl%2b76IHuRpfKq1bpZSozYLCdMPniNjYwgFBYZtY3Ws0NQhOHyR8NOQidF1YxboBhiF2HiPgz9pHTXnrBLMa21oygN16QKG9xZ9A5D3UO0WgH8XhlLpu6VJMXXRrvumruBBPFM0LzjUBr4P%2bP%2fh%2bQD5Gd96%2fJKB0jfJf%2fdzwj5bnJ6Lk5JQPeqkqhV0D5t729qzifO3Xf3oH51ihPEihmOLeOtPcMP07Dl0XnjHYAlzcHG77i3yvVrR464RLACtDnyhkyd13gahS1LEDsCpvKrAnMdbZcdlZq2RBuDbqnvK8iBsncMTbrNyfSdNtrnsxUDFz2fEHnNBrmGp6OXm2YqY%2fr5JcpWC01PmaQmkPH2rSk5ahE2q7dyqJCT9WhKQTwT6g2NJmB0AfqE%2fplA0VB0loVOWyrFX%2bt6wG7uqBrdYYFGun8to%2b%2by7M0vCUgJJgXufPT8zSq4SPX6kKAPby28JA149jjr897iu7J1IonojMrO876no55e%2fVIJfbueABko9zXOi3vUOiTTCX6RQdxbB0MtatO7EQQtBm3SlBOOxPN7K8PP24PGMAorhpyZRCFJNVpek%2b9EEhvLd2MbUAAAADdJV4iH4XO9GjM%2fRggt%2b7yXHmXU%2f7NGCInx9jp%2fen3yHa2a0ym%2fJTeBxkp31gv4XAO2CiYfwr7979PrI%2fzBLBl&r=&i=Mark\" \"1\""	ScreenConnect.ClientService.exe

Executes dropped EXE 4 IoCs

Processes:

ScreenConnect.WindowsClient.exeScreenConnect.ClientService.exeScreenConnect.ClientService.exeScreenConnect.WindowsClient.exe

pid	process
1032	ScreenConnect.WindowsClient.exe
1888	ScreenConnect.ClientService.exe
4052	ScreenConnect.ClientService.exe
2692	ScreenConnect.WindowsClient.exe

Loads dropped DLL 16 IoCs

Processes:

ScreenConnect.ClientService.exeScreenConnect.ClientService.exe

pid	process
1888	ScreenConnect.ClientService.exe
1888	ScreenConnect.ClientService.exe
1888	ScreenConnect.ClientService.exe
1888	ScreenConnect.ClientService.exe
1888	ScreenConnect.ClientService.exe
1888	ScreenConnect.ClientService.exe
4052	ScreenConnect.ClientService.exe
4052	ScreenConnect.ClientService.exe
4052	ScreenConnect.ClientService.exe
4052	ScreenConnect.ClientService.exe
4052	ScreenConnect.ClientService.exe
4052	ScreenConnect.ClientService.exe
4052	ScreenConnect.ClientService.exe
4052	ScreenConnect.ClientService.exe
4052	ScreenConnect.ClientService.exe
4052	ScreenConnect.ClientService.exe

Drops file in System32 directory 3 IoCs

Processes:

ScreenConnect.WindowsClient.exeScreenConnect.ClientService.exe

description	ioc	process
File created	C:\Windows\system32\user.config	ScreenConnect.WindowsClient.exe
File opened for modification	C:\Windows\system32\user.config	ScreenConnect.WindowsClient.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ScreenConnect.ClientService.exe.log	ScreenConnect.ClientService.exe

Modifies data under HKEY_USERS 5 IoCs

Processes:

ScreenConnect.ClientService.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.ClientService.exe

Modifies registry class 64 IoCs

Processes:

dfsvc.exeScreenConnect.WindowsClient.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_25b0fbb6ef7eb094_0017.0009_d2b150e250a00e67\appid = 68747470733a2f2f6368617468616d746563682e73637265656e636f6e6e6563742e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32332e392e31302e383831372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32332e392e31302e383831372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_25b0fbb6ef7eb094_0017.0009_none_aa62037c34f7a445\DigestValue = cc57bfd02228be76c6e08bde16996fa992ff0e54	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_25b0fbb6ef7eb094_0017.0009_none_aa62037c34f7a445\Files	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_4b14c015c87c1ad8_0017.0009_none_65cb6507f0c2a5b9\DigestMethod = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0017.0009_none_fbe0c2da0011fbbd	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_25b0fbb6ef7eb094_0017.0009_none_aa62037c34f7a445\Files\ScreenConnect.WindowsFileManager.exe_0e21 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0017.0009_none_c7123e2bd9a688c6\DigestMethod = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0017.0009_none_fbe0c2da0011fbbd\DigestMethod = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0017.0009_d2b150e250a00e67\SubstructureCreated = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_25b0fbb6ef7eb094_0017.0009_f9ba1375d4e4e31c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_4b14c015c87c1ad8_0017.0009_none_171efd5086820924\implication!scre..tion_25b0fbb6ef7eb094_0017.0009_f9 = 68747470733a2f2f6368617468616d746563682e73637265656e636f6e6e6563742e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32332e392e31302e383831372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_25b0fbb6ef7eb = 680074007400700073003a002f002f006300680061007400680061006d0074006500630068002e00730063007200650065006e0063006f006e006e006500630074002e0063006f006d002f00420069006e002f00530063007200650065006e0043006f006e006e006500630074002e0043006c00690065006e0074002e006100700070006c00690063006100740069006f006e002300530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f007700730043006c00690065006e0074002e006100700070006c00690063006100740069006f006e002c002000560065007200730069006f006e003d00320033002e0039002e00310030002e0038003800310037002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d0032003500620030006600620062003600650066003700650062003000390034002c002000700072006f0063006500730073006f0072004100720063006800690074006500630074007500720065003d006d00730069006c002f00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f007700730043006c00690065006e0074002e006500780065002c002000560065007200730069006f006e003d00320033002e0039002e00310030002e0038003800310037002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d0032003500620030006600620062003600650066003700650062003000390034002c002000700072006f0063006500730073006f0072004100720063006800690074006500630074007500720065003d006d00730069006c002c00200074007900700065003d00770069006e00330032000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0017.0009_none_fbe0c2da0011fbbd\SizeOfStronglyNamedComponent = e9ff020000000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_25b0fbb6ef7eb = 460061006c00730065000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_4b14c015c87c1ad8_0017.0009_none_6a433ce92d10b8e9\Files\ScreenConnect.Windows.dll_fc0d83aff7df0b5 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_4b14c015c87c1ad8_0017.0009_none_171efd5086820924\Files	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications\scre..tion_25b0fbb6ef7eb094_0017.0009_d2b150e250a00e67	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_4b14c015c87c1ad8_0017.0009_none_6a433ce92d10b8e9\identity = 53637265656e436f6e6e6563742e57696e646f77732c2056657273696f6e3d32332e392e31302e383831372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0017.0009_d2b150e250a00e67\scre..vice_4b14c015c87c1ad8_0017.0009_none_171efd508	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_25b0fbb6ef7eb = 30000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0017.0009_d2b150e250a00e67\scre...exe_25b0fbb6ef7eb094_0017.0009_none_aa62037c3 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_4b14c015c87c1ad8_0017.0009_none_6a433ce92d10b8e9\lock!0e000000f062570e08040000fc020000000000000000000 = 30303030303430382c30316461616338373633643936613962	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_4b14c015c87c1ad8_0017.0009_none_6a433ce92d10b8e9	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0017.0009_d2b150e250a00e67\scre..core_4b14c015c87c1ad8_0017.0009_none_65cb6507f = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0017.0009_none_fbe0c2da0011fbbd\DigestValue = f36ab74e4e502fdaf81e101836b94c91d80cb8ea	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0017.0009_none_c7123e2bd9a688c6\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742c2056657273696f6e3d32332e392e31302e383831372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0017.0009_none_c7123e2bd9a688c6	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0017.0009_d2b150e250a00e67\scre..dows_4b14c015c87c1ad8_0017.0009_none_6a433ce92	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_4b14c015c87c1ad8_0017.0009_none_6a433ce92d10b8e9	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0017.0009_none_fbe0c2da0011fbbd\lock!0c000000f062570e08040000fc020000000000000000000 = 30303030303430382c30316461616338373633643936613962	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_4b14c015c87c1ad8_0017.0009_none_65cb6507f0c2a5b9\lock!0a000000f062570e08040000fc020000000000000000000 = 30303030303430382c30316461616338373633643936613962	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0017.0009_none_4b563d129b766e28\SizeOfStronglyNamedComponent = 41f8010000000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0017.0009_d2b150e250a00e67	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_4b14c015c87c1ad8_0017.0009_none_65cb6507f0c2a5b9\Transform = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Visibility	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0017.0009_none_c7123e2bd9a688c6\lock!160000000063570e08040000fc020000000000000000000 = 30303030303430382c30316461616338373633643936613962	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\F_scre..tion_25b0fbb6ef7eb094_d14e50a429e9f121	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\Gc_scre..tion_89738dc29e5eb2c2	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_25b0fbb6ef7eb = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_25b0fbb6ef7eb = 30003000300031002f00300031002f00300031002000300030003a00300030003a00300030000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_25b0fbb6ef7eb094_0017.0009_none_4b563d129b766e28\lock!100000000063570e08040000fc020000000000000000000 = 30303030303430382c30316461616338373633643936613962	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\Gi_scre..tion_25b0fbb6ef7eb094_9edfe039055229dd\LastRunVersion = 68747470733a2f2f6368617468616d746563682e73637265656e636f6e6e6563742e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32332e392e31302e383831372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32332e392e31302e383831372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0017.0009_none_fbe0c2da0011fbbd\lock!1a0000000063570e08040000fc020000000000000000000 = 30303030303430382c30316461616338373633643936613962	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_25b0fbb6ef7eb = 32003000320034002f00300035002f00320032002000320030003a00330034003a00300035000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_4b14c015c87c1ad8_0017.0009_none_6a433ce92d10b8e9\DigestValue = 334202965b07ab69f08b16fed0ee6c7274463556	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Categories	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_25b0fbb6ef7eb = 680074007400700073003a002f002f006300680061007400680061006d0074006500630068002e00730063007200650065006e0063006f006e006e006500630074002e0063006f006d002f00420069006e002f00530063007200650065006e0043006f006e006e006500630074002e0043006c00690065006e0074002e006100700070006c00690063006100740069006f006e003f0065003d0053007500700070006f0072007400260079003d0047007500650073007400260068003d0069006e007300740061006e00630065002d007800340070007800720076002d00720065006c00610079002e00730063007200650065006e0063006f006e006e006500630074002e0063006f006d00260070003d00340034003300260073003d00610035006200320061003400380036002d0035006300360031002d0034003400330065002d0038006300320037002d0035006600620065006500370033003900380032003500340026006b003d0042006700490041004100410043006b0041004100420053005500300045007800410041006700410041004100450041004100510041005600370066007800460036004700320043006f0025003200620067006f006600550051006f00300069004d0053006b0076007100770077006e005a004e0071004700550057005600320030006f004200310054004c00580073004a007900770067004e0037004b007a003200750067004e00300071006500430055004a004500510043007100630043004700580049006e00740039006d00780052006b00570069007a0036002500320062005a006900740050006e00380050007800420036007700430031006e0072004f0052006e00720047005700480036006400450031006a0072007a005700490050007700560037003200540050003300470033007500710049005300620025003200620062004c006d006b00760045004d007a0074007300670038004a00340030006f004400580076004c0050004900540070006200250032006600300025003200660032007400610077006900420044007a00450065007200560066006b006d004900560075007400500057003400640068003700430068007600760077004300710076007200560036006a006e00660078005a0074003700790076006f0079006f0038006400480046007500590034007a006d004e007a006200320030006c00570055006e002500320062004e005500680048004300480071004800630056006b004d00770055004d004a006800540053007900700047006200460070004f00550070004800750075007400620058006c00610061003900510048004e00340066006c0045006800610038007700300068004200500064004800700057005200640037004600690067006b005a0054007900510065005400710077006900750048004b00370045006b007a006a0078004600440045004900340071004c00650046006c004c0033006d00430056006700310034004e0067002500320062004c006e007a0033004600570057004f006d007400590047002500320066004200260072003d00260069003d004d00610072006b000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0017.0009_none_c7123e2bd9a688c6	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Software\Microsoft	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0017.0009_d2b150e250a00e67\scre..core_4b14c015c87c1ad8_0017.0009_none_65cb6507f	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}\scre..tion_25b0fbb6ef7eb = 68747470733a2f2f6368617468616d746563682e73637265656e636f6e6e6563742e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32332e392e31302e383831372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_25b0fbb6ef7eb	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_25b0fbb6ef7eb094_0017.0009_none_4b563d129b766e28	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_4b14c015c87c1ad8_0017.0009_none_171efd5086820924\lock!140000000063570e08040000fc020000000000000000000 = 30303030303430382c30316461616338373633643936613962	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_25b0fbb6ef7eb094_0017.0009_d2b150e250a00e67	ScreenConnect.WindowsClient.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\ComponentStore_RandomString = "52AEOZL6Q93R3ZRWMKCGNAJ0"	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0017.0009_none_c7123e2bd9a688c6\DigestValue = 8807695ee8345e37efec43cbc0874277ed9b0a66	dfsvc.exe

Modifies system certificate store 2 TTPs 6 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

395b9fda966091bba1e1e7e8af4e3aaa6255990ceb78d80053de1c7f35132de6.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C	395b9fda966091bba1e1e7e8af4e3aaa6255990ceb78d80053de1c7f35132de6.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C\Blob = 0300000001000000140000007b0f360b775f76c94a12ca48445aa2d2a875701c2000000001000000b4060000308206b030820498a003020102021008ad40b260d29c4c9f5ecda9bd93aed9300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3231303432393030303030305a170d3336303432383233353935395a3069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e6720525341343039362053484133383420323032312043413130820222300d06092a864886f70d01010105000382020f003082020a0282020100d5b42f42d028ad78b75dd539591bb18842f5338ceb3d819770c5bbc48526309fa48e68d85cf5eb342407e14b4fd37843f417d71edaf9d2d5671a524f0ea157fc8899c191cc81033e4d702464b38de2087d347d4c8057126b439a99f2c53b1ff2efcb475a13a64cb3012025f310d38bb2fb08f08ae09d09c065a7fa98804935873d5119e8902178452ea19f2ce118c21accc5ee93497042328ffbc6ea1cf3656891a24d4c8211485268de10bd14575de8181365c57fb24f852c48a4568435d6f92e9caa0015d137fe1a0694c27cc8ea1b32e6cac2f4a7a3030e74a5af39b6ab6012e3e8d6b9f731e1dcade418a0d8c1234747b3a10f6ea3ab6d9806831bb76a672dd2bd441a9210818fb03b09d7c79b325ac2ff6a60548b49c193ede1b45ce06feb26f98cd5b2f93810e6eace91f5bed3fb6f9361345cbc93452883362a66285fb073ce8b262506b283d45cf615194ced62e05e33f2e8e8ec0aa7b0032b91b23679bef7ad081e75a665ccbbe34850f377911afedb50a246c8615898f57c02163c8328ad3986ecd4b70d53d0f847e675308dec30937614a65b4b5d74614d3f129176debf58cb72102941f0d5c56d267668114113589adc262b01f4894d59db78cf814a3e40475fc98150738510232159608a6454c1cc211ae838197c661ccd78384530994fff634f4cbbaa0d0853417c583d47b3fab6ec8c320902cc6c3c0c56110203010001a38201593082015530120603551d130101ff040830060101ff020100301d0603551d0e041604146837e0ebb63bf85f1186fbfe617b088865f44e42301f0603551d23041830168014ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300e0603551d0f0101ff04040302018630130603551d25040c300a06082b06010505070303307706082b06010505070101046b3069302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304106082b060105050730028635687474703a2f2f636163657274732e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63727430430603551d1f043c303a3038a036a0348632687474703a2f2f63726c332e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63726c301c0603551d20041530133007060567810c01033008060667810c010401300d06092a864886f70d01010c050003820201003a23443d8d0876ee8fbc3a99d356e0021aa5f84834f32cb6e67466f79472b100caaf6c302713129e90449f4bfd9ea37c26d537bc3a5d486d95d53f49f427bb16814550fd9cbdb685e0767e3771cb22f75aaa90cff5936ae3eb20d1d55079889a8a8ac1b6bda148187edcd8801a111918cd61998156f6c9e376e7c4e41b5f43f83e94ff76393d9ed499cf4add28eb5f26a1955848d51afed7273ffd90d17686dd1cb0605cf30da8eee089a1bd39e1384eda6ebb369dfbe521535ac3cae96af1a23edb43b833c84f38149299f5ddce546dd95d02141f40337c03e295b2c221757352cb46d8c4341ca2a54b8dcd6f76372c853f1ace26e918be9007b0437f9588208270f0cccaeffd29355c1f893855f7378a8b09a1cb0be9311aff2e195c3971e1be9ca70a06d62667b792e64e5fde7aac49cf2ea47492addb3ca49c861fe3c1561b2b23ff8fb5ea887b706be6a0bafd3a3f45a6c4e81691528b41c048844b964dab4440e38df01528ceedf11856072a2f10c40c08643c338fae288c3ccb8f880b0dbf3bf4ce1e7b8eefb5ebcbb7f07713e6e7283fac12aea52f226c41f9825c1566cc6c0ecac586c3f626330c074ba0d307026a6a4030484b34a85120bbad1b8508e2590d6dca05502bea4a1c9ea5fda0a71f0674e7f2d65290fdaf854821f9573bb49c03ed8645f4b4616ebf68e2266086eac8afa9fe941de7631b3a8656784e	395b9fda966091bba1e1e7e8af4e3aaa6255990ceb78d80053de1c7f35132de6.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4C2272FBA7A7380F55E2A424E9E624AEE1C14579	395b9fda966091bba1e1e7e8af4e3aaa6255990ceb78d80053de1c7f35132de6.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4C2272FBA7A7380F55E2A424E9E624AEE1C14579\Blob = 0300000001000000140000004c2272fba7a7380f55e2a424e9e624aee1c145792000000001000000640700003082076030820548a00302010202100b9360051bccf66642998998d5ba97ce300d06092a864886f70d01010b05003069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e67205253413430393620534841333834203230323120434131301e170d3232303831373030303030305a170d3235303831353233353935395a3065310b30090603550406130255533110300e06035504081307466c6f72696461310e300c0603550407130554616d706131193017060355040a1310436f6e6e656374776973652c204c4c433119301706035504031310436f6e6e656374776973652c204c4c4330820222300d06092a864886f70d01010105000382020f003082020a0282020100ec489826d08d2c6de21b3cd3676db1e0e50cb1ff75ff564e9741f9574aa3640aa8297294a05b4db68abd0760b6b05b50ce92ff42a4e390be776a43e9961c722f6b3a4d5c880bcc6a61b4026f9137d36b2b7e9b86055876b9fa860dbcb164fe7f4b5b9de4799ae4e02dc1f0bee01e5d032933a2827388f8db0b482e76c441b1bd50909ef2023e1fb62196c994ce052266b28cd89253e6416044133139764db5fc45702529536bf82c775f9ec81fa27dc409530325f40cdef95b81b9ce0d42791cee72e7bd1b36c257b52257c65a28970e457513989434bfc239e2992b193e1b3cc3f11ccdd1d26d4ec9845099ab913906a42069af999c0071169b45a2ea1aa666f1904e8acb05e1823a359a291fd46b4ef7aed5935bb6ab17ebf077210726930c90f01761d6544a94e8fa614cc41d817eec734b1c3d3afb7c58fb256f0c09edc1459bddbff9940ed1958570265d67af79a9b6a16affd70fc6328c9810d5dc186e39af6fbcad49a270f237e6bcd5de0bc014bc3179cd79776591340311a42ca94f33416c2e01b59bd1d71de86ace6716bc90b2d7695d155039aa08fbac19a4d93fb784230a20a485287a16355645fc09142c602d140fa046b7bfd75328184ff7bdf8f9e0d65e6201c8d242931047f59bd328ac353777ccefa60408887b84fc3631301463461a1d73c0b5cc74d6d82905ddf923bdbab027a311cc38d3fa16f639a50203010001a382020630820202301f0603551d230418301680146837e0ebb63bf85f1186fbfe617b088865f44e42301d0603551d0e04160414338ce10a6e06d9c6ed0bc6cae736cefb8188646a300e0603551d0f0101ff04040302078030130603551d25040c300a06082b060105050703033081b50603551d1f0481ad3081aa3053a051a04f864d687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c3053a051a04f864d687474703a2f2f63726c342e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c303e0603551d20043730353033060667810c0104013029302706082b06010505070201161b687474703a2f2f7777772e64696769636572742e636f6d2f43505330819406082b06010505070101048187308184302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d305c06082b060105050730028650687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e637274300c0603551d130101ff04023000300d06092a864886f70d01010b050003820201000ad79f00cf4984864c8981ecce8718aa875647f6a74608c968e16568c7aa9d711ed7341676038067f01330c91621b27a2a8894c4108c268162a31f13f9757a7d6bb3c6f19bf27c3a29896d712d85873627d827cd6471761444fabf1d31e903f791143c5b4ce5e7444aacba36d759aeba3069d195226755cbc675aa747f77596c53c96e083c45bba24479d6845eea9f2b28ba29b4dcf0bcf14aa4ce176c24e2c1b8fec3ee16e1c086db6fda97388859e83be65c03f701395b78b842c6dd1533ef642cca6fe50f6337d3f2dfedd8b28f2b28e0c98edd2151392e7cc75489f48859f1de14c81b306eb50eed7bb78be30eaada76767c4ca523a11eec5a2372d6122926ab1801a6a6778e9504791487ee47d4577154988802070f80fc535957658f954cd083546c5afb5a6567b6761275f5db20f70ab86feef94c7cfc65369d325121b69a82399bc7dc1962416f0f05cf1eee64d495a3527e464e2c68da0187093f97b673e43dddbcc067e00713f1565fcff8c3772d44b40a04e600644f22a990345f9a6b5b52963e82c81a0ce91d43a230f67b37d8debda40ea3d59d305e18adc1976516c12a8ba2bca24143b12e9527b4dca58872aa9b3a8c6ac563fc2dc02bf51be889516d35a4ba9d062417b5bdcc50ba945fae26b60d6aec03984798a6a21d3ff793cc0849e81ed55b8027411c50db776ae8feef2fdc2dafb04345261dedc054	395b9fda966091bba1e1e7e8af4e3aaa6255990ceb78d80053de1c7f35132de6.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C	395b9fda966091bba1e1e7e8af4e3aaa6255990ceb78d80053de1c7f35132de6.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4C2272FBA7A7380F55E2A424E9E624AEE1C14579	395b9fda966091bba1e1e7e8af4e3aaa6255990ceb78d80053de1c7f35132de6.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

ScreenConnect.WindowsClient.exe

pid process

2692 ScreenConnect.WindowsClient.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

ScreenConnect.ClientService.exe

pid process

4052 ScreenConnect.ClientService.exe
4052 ScreenConnect.ClientService.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

dfsvc.exeScreenConnect.ClientService.exe

description pid process

Token: SeDebugPrivilege 3576 dfsvc.exe
Token: SeDebugPrivilege 4052 ScreenConnect.ClientService.exe
Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

ScreenConnect.WindowsClient.exe

pid process

2692 ScreenConnect.WindowsClient.exe
2692 ScreenConnect.WindowsClient.exe
2692 ScreenConnect.WindowsClient.exe
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

ScreenConnect.WindowsClient.exe

pid process

2692 ScreenConnect.WindowsClient.exe
2692 ScreenConnect.WindowsClient.exe
2692 ScreenConnect.WindowsClient.exe

pid	process
2692	ScreenConnect.WindowsClient.exe

pid	process
4052	ScreenConnect.ClientService.exe
4052	ScreenConnect.ClientService.exe

description	pid	process
Token: SeDebugPrivilege	3576	dfsvc.exe
Token: SeDebugPrivilege	4052	ScreenConnect.ClientService.exe

pid	process
2692	ScreenConnect.WindowsClient.exe
2692	ScreenConnect.WindowsClient.exe
2692	ScreenConnect.WindowsClient.exe

pid	process
2692	ScreenConnect.WindowsClient.exe
2692	ScreenConnect.WindowsClient.exe
2692	ScreenConnect.WindowsClient.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

395b9fda966091bba1e1e7e8af4e3aaa6255990ceb78d80053de1c7f35132de6.exedfsvc.exeScreenConnect.WindowsClient.exeScreenConnect.ClientService.exe

description	pid	process	target process
PID 4800 wrote to memory of 3576	4800	395b9fda966091bba1e1e7e8af4e3aaa6255990ceb78d80053de1c7f35132de6.exe	dfsvc.exe
PID 4800 wrote to memory of 3576	4800	395b9fda966091bba1e1e7e8af4e3aaa6255990ceb78d80053de1c7f35132de6.exe	dfsvc.exe
PID 3576 wrote to memory of 1032	3576	dfsvc.exe	ScreenConnect.WindowsClient.exe
PID 3576 wrote to memory of 1032	3576	dfsvc.exe	ScreenConnect.WindowsClient.exe
PID 3576 wrote to memory of 1032	3576	dfsvc.exe	ScreenConnect.WindowsClient.exe
PID 1032 wrote to memory of 1888	1032	ScreenConnect.WindowsClient.exe	ScreenConnect.ClientService.exe
PID 1032 wrote to memory of 1888	1032	ScreenConnect.WindowsClient.exe	ScreenConnect.ClientService.exe
PID 1032 wrote to memory of 1888	1032	ScreenConnect.WindowsClient.exe	ScreenConnect.ClientService.exe
PID 4052 wrote to memory of 2692	4052	ScreenConnect.ClientService.exe	ScreenConnect.WindowsClient.exe
PID 4052 wrote to memory of 2692	4052	ScreenConnect.ClientService.exe	ScreenConnect.WindowsClient.exe
PID 4052 wrote to memory of 2692	4052	ScreenConnect.ClientService.exe	ScreenConnect.WindowsClient.exe

C:\Users\Admin\AppData\Local\Temp\395b9fda966091bba1e1e7e8af4e3aaa6255990ceb78d80053de1c7f35132de6.exe
"C:\Users\Admin\AppData\Local\Temp\395b9fda966091bba1e1e7e8af4e3aaa6255990ceb78d80053de1c7f35132de6.exe"
1⤵
- Manipulates Digital Signatures
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:4800
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
  2⤵
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3576
- - C:\Users\Admin\AppData\Local\Apps\2.0\52AEOZL6.Q93\R3ZRWMKC.GNA\scre..tion_25b0fbb6ef7eb094_0017.0009_d2b150e250a00e67\ScreenConnect.WindowsClient.exe
    "C:\Users\Admin\AppData\Local\Apps\2.0\52AEOZL6.Q93\R3ZRWMKC.GNA\scre..tion_25b0fbb6ef7eb094_0017.0009_d2b150e250a00e67\ScreenConnect.WindowsClient.exe"
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1032
  - - C:\Users\Admin\AppData\Local\Apps\2.0\52AEOZL6.Q93\R3ZRWMKC.GNA\scre..tion_25b0fbb6ef7eb094_0017.0009_d2b150e250a00e67\ScreenConnect.ClientService.exe
      "C:\Users\Admin\AppData\Local\Apps\2.0\52AEOZL6.Q93\R3ZRWMKC.GNA\scre..tion_25b0fbb6ef7eb094_0017.0009_d2b150e250a00e67\ScreenConnect.ClientService.exe" "?e=Support&y=Guest&h=instance-x4pxrv-relay.screenconnect.com&p=443&s=a5b2a486-5c61-443e-8c27-5fbee7398254&k=BgIAAACkAABSU0ExAAgAAAEAAQAV7fxF6G2Co%2bgofUQo0iMSkvqwwnZNqGUWV20oB1TLXsJywgN7Kz2ugN0qeCUJEQCqcCGXInt9mxRkWiz6%2bZitPn8PxB6wC1nrORnrGWH6dE1jrzWIPwV72TP3G3uqISb%2bbLmkvEMztsg8J40oDXvLPITpb%2f0%2f2tawiBDzEerVfkmIVutPW4dh7ChvvwCqvrV6jnfxZt7yvoyo8dHFuY4zmNzb20lWUn%2bNUhHCHqHcVkMwUMJhTSypGbFpOUpHuutbXlaa9QHN4flEha8w0hBPdHpWRd7FigkZTyQeTqwiuHK7EkzjxFDEI4qLeFlL3mCVg14Ng%2bLnz3FWWOmtYG%2fB&r=&i=Mark" "1"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1888

C:\Users\Admin\AppData\Local\Apps\2.0\52AEOZL6.Q93\R3ZRWMKC.GNA\scre..tion_25b0fbb6ef7eb094_0017.0009_d2b150e250a00e67\ScreenConnect.ClientService.exe
"C:\Users\Admin\AppData\Local\Apps\2.0\52AEOZL6.Q93\R3ZRWMKC.GNA\scre..tion_25b0fbb6ef7eb094_0017.0009_d2b150e250a00e67\ScreenConnect.ClientService.exe" "?e=Support&y=Guest&h=instance-x4pxrv-relay.screenconnect.com&p=443&s=a5b2a486-5c61-443e-8c27-5fbee7398254&k=BgIAAACkAABSU0ExAAgAAAEAAQAV7fxF6G2Co%2bgofUQo0iMSkvqwwnZNqGUWV20oB1TLXsJywgN7Kz2ugN0qeCUJEQCqcCGXInt9mxRkWiz6%2bZitPn8PxB6wC1nrORnrGWH6dE1jrzWIPwV72TP3G3uqISb%2bbLmkvEMztsg8J40oDXvLPITpb%2f0%2f2tawiBDzEerVfkmIVutPW4dh7ChvvwCqvrV6jnfxZt7yvoyo8dHFuY4zmNzb20lWUn%2bNUhHCHqHcVkMwUMJhTSypGbFpOUpHuutbXlaa9QHN4flEha8w0hBPdHpWRd7FigkZTyQeTqwiuHK7EkzjxFDEI4qLeFlL3mCVg14Ng%2bLnz3FWWOmtYG%2fB&r=&i=Mark" "1"
1⤵
- Sets service image path in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4052
- C:\Users\Admin\AppData\Local\Apps\2.0\52AEOZL6.Q93\R3ZRWMKC.GNA\scre..tion_25b0fbb6ef7eb094_0017.0009_d2b150e250a00e67\ScreenConnect.WindowsClient.exe
  "C:\Users\Admin\AppData\Local\Apps\2.0\52AEOZL6.Q93\R3ZRWMKC.GNA\scre..tion_25b0fbb6ef7eb094_0017.0009_d2b150e250a00e67\ScreenConnect.WindowsClient.exe" "RunRole" "5f05639c-a58e-4215-ae35-e47e5c99af08" "User"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Apps\2.0\52AEOZL6.Q93\R3ZRWMKC.GNA\manifests\scre...exe_25b0fbb6ef7eb094_0017.0009_none_aa62037c34f7a445.cdf-ms

Filesize
24KB

MD5
9b669ab28e02d302069110b09d680c2a

SHA1
c1ae941547e28270fa086dd676b6b25bf345eded

SHA256
f903b6035425c346016655357157366b3c506a02267e8b6b226aead069a4fee2

SHA512
88c753db9c1ede1b3ea20986fa0de2f3ac8bdf05c9325859fb2df27401a6b93ae75283dcbf7cfa7767a27ff0b4bcea42c661362f3522025775b6a848b0f5cf9b

Download Submit
C:\Users\Admin\AppData\Local\Apps\2.0\52AEOZL6.Q93\R3ZRWMKC.GNA\manifests\scre..core_4b14c015c87c1ad8_0017.0009_none_65cb6507f0c2a5b9.cdf-ms

Filesize
3KB

MD5
481688edb5b357fbe2cb6e49dbf2a7ce

SHA1
734b852e0470360e20e25cf39eb13a33f20d05c6

SHA256
4871e0d539c24cc08f477e6a9ee315eaaf18e2919fb836cfb269c825776b7706

SHA512
07253d5c12af3c4e00ab6bdabf2c28fa2ddf5f9d6d135d1074274cf815c2b19a1b2abe33aee733c6c535231d2ca275be36cd16ea160a48e4c844766a57b1f719

Download Submit
C:\Users\Admin\AppData\Local\Apps\2.0\52AEOZL6.Q93\R3ZRWMKC.GNA\manifests\scre..dows_4b14c015c87c1ad8_0017.0009_none_6a433ce92d10b8e9.cdf-ms

Filesize
5KB

MD5
3c0d6b7b45ee49f241dd12a6d33e0ccf

SHA1
16832a19d3256eb2fac3608c9bd55ba2215d6949

SHA256
2300ab757392509f2cb82f42a0aa11b90ddc303ffa3e0393252258ff812ff2ce

SHA512
7ccf9917cc2c46a78e37281a4be8beba6726d352a463e3ceaa0783a4362b1d679de1f9e241e86e8be461a613dab9219bfa757821096f2a8750d896ea042c746b

Download Submit
C:\Users\Admin\AppData\Local\Apps\2.0\52AEOZL6.Q93\R3ZRWMKC.GNA\manifests\scre..ient_4b14c015c87c1ad8_0017.0009_none_c7123e2bd9a688c6.cdf-ms

Filesize
6KB

MD5
084dd3878b5e067da15c7c2f971c84a5

SHA1
4c950ba89b76b1683d509030a986a88c90edae85

SHA256
8f86c2c2c225162548acbd5ad4fece28579318b93f536b3f6d0b6eb5acb6f9bd

SHA512
3323c57f704644c4a984d211eca4e5ba08de8cd89b57db49cea281380614e99f777ea12ec62e16b39f52cfe3923a82b6ed1a285810e573690ce67d30c74a9b04

Download Submit
C:\Users\Admin\AppData\Local\Apps\2.0\52AEOZL6.Q93\R3ZRWMKC.GNA\manifests\scre..ient_4b14c015c87c1ad8_0017.0009_none_fbe0c2da0011fbbd.cdf-ms

Filesize
2KB

MD5
64435ae5f678957c5e143594e071718e

SHA1
3e5c4f4f47463041ea0317df0904935d6f92b9bb

SHA256
ca726f190646a9287e555466536d7f284a2137b0c6583949eba91377dfe3db7a

SHA512
9358cd9141d60d618ac4ad7a89b7b7af3afb817a8cf41ed3dca06ca441096b301971d181ca590b085d93a85247ec608c1514afdb2bf89a751dbc64f984d0fb87

Download Submit
C:\Users\Admin\AppData\Local\Apps\2.0\52AEOZL6.Q93\R3ZRWMKC.GNA\manifests\scre..tion_25b0fbb6ef7eb094_0017.0009_none_4b563d129b766e28.cdf-ms

Filesize
14KB

MD5
a6422dd91bbfef076524d9b46bb1ae40

SHA1
1f65e8e3e14b4ccae186a34f79220d4e7ffd08de

SHA256
77b0c4197bd4adbba0dfe4042302467afcc321b5ffeea9de9409a310e96cf7f9

SHA512
105b85065dae4bb5c610fcf6e2ae92b0bda187567aa6473be7691b1086c8a29763de1652292c209488f9469286daec4d94f2ad50612acf21ef25b07e403d1fa6

Download Submit
C:\Users\Admin\AppData\Local\Apps\2.0\52AEOZL6.Q93\R3ZRWMKC.GNA\manifests\scre..vice_4b14c015c87c1ad8_0017.0009_none_171efd5086820924.cdf-ms

Filesize
4KB

MD5
31024b115f8694cbe9682fc951ad625c

SHA1
45882df16d8fa5b9831d30a140b342ab6475c353

SHA256
17e8d50c16758fbf683e0cdba28e42a7ceb8ec82baa7359e27ef1dcda194ca84

SHA512
726f16daac1392b0242fadc485082565a270805d7d46aa77aa27e17b173801daa93899ff7f98b8cf88e10a8768aaa82c3f77966d4176f4fadd85a6718309d185

Download Submit
C:\Users\Admin\AppData\Local\Apps\2.0\52AEOZL6.Q93\R3ZRWMKC.GNA\scre...exe_25b0fbb6ef7eb094_0017.0009_none_aa62037c34f7a445\ScreenConnect.ClientService.exe

Filesize
93KB

MD5
dc615e9d8ec81cbf2e2452516373e5a0

SHA1
ec83d37a4f45caeb07b1605324d0315f959452e9

SHA256
e9ab064ed381c29a3930f75ca3e05605c6ee07f30a69c043f576a5461de3bafc

SHA512
82fe00447fb9785264dfb8032399adf6d33d91d71058212d252742c9e5fd54f5a52f6baf4fb05e95f9a4055057c60a33a7c1c642f18a6a4e045b49be88fa5d9f

Download Submit
C:\Users\Admin\AppData\Local\Apps\2.0\52AEOZL6.Q93\R3ZRWMKC.GNA\scre..tion_25b0fbb6ef7eb094_0017.0009_d2b150e250a00e67\Client.Override.en-US.resources

Filesize
180B

MD5
cd7dbc7abeda9893ce25793744443958

SHA1
dbbbbe2694d4b9b990881f279b4313574dbeac9b

SHA256
e13ed2c59366d0eea74863fd71a81f0cb977cce1edfde304fc538690a4f6ac89

SHA512
e880f131ff460384940248ab2ecd97189ae0b7169fe5246440dfbce32f295cbd7697ce2ee65b434a0e40be91b91c21b2c14b1f446b2b1650d0a5d94c0d4f37ef

Download Submit
C:\Users\Admin\AppData\Local\Apps\2.0\52AEOZL6.Q93\R3ZRWMKC.GNA\scre..tion_25b0fbb6ef7eb094_0017.0009_d2b150e250a00e67\Client.en-US.resources

Filesize
47KB

MD5
3e83a3aa62c5ff54ed98e27b3fbecf90

SHA1
96d8927c870a74a478864240b3ace94ad543dfb8

SHA256
2d88b97d28be01abca4544c6381a4370c1a1ce05142c176742f13b44889ddf90

SHA512
ea9d05a4aa1ee5cccc61c4f5e8994efba9efff0549b69577bef1f2a22cce908739124eff1e0db5cfdd69e077ad2d7cdb1307de92d79673c9309ee621cb139956

Download Submit
C:\Users\Admin\AppData\Local\Apps\2.0\52AEOZL6.Q93\R3ZRWMKC.GNA\scre..tion_25b0fbb6ef7eb094_0017.0009_d2b150e250a00e67\Client.resources

Filesize
26KB

MD5
5cd580b22da0c33ec6730b10a6c74932

SHA1
0b6bded7936178d80841b289769c6ff0c8eead2d

SHA256
de185ee5d433e6cfbb2e5fcc903dbd60cc833a3ca5299f2862b253a41e7aa08c

SHA512
c2494533b26128fbf8149f7d20257d78d258abffb30e4e595cb9c6a742f00f1bf31b1ee202d4184661b98793b9909038cf03c04b563ce4eca1e2ee2dec3bf787

Download Submit
C:\Users\Admin\AppData\Local\Apps\2.0\52AEOZL6.Q93\R3ZRWMKC.GNA\scre..tion_25b0fbb6ef7eb094_0017.0009_d2b150e250a00e67\app.config

Filesize
924B

MD5
f26f0a30a66995dc02e93cc1914a8a7d

SHA1
f4ecccd915d8dc0484782ec7651c12bceedb6171

SHA256
7194bd18740394a30bdf2d3904e0dec298b2fdda01d65de07266f37a7c213054

SHA512
488dd6f3dd9054c4e773164ba54576d88169c6d0bdfe4d1281658ed852080ce90e5efd877c6826594ed4d9293f92bb8ef7a2ebe75e14ce59eeb4b6ac26ed4dda

Download Submit
C:\Users\Admin\AppData\Local\Apps\2.0\52AEOZL6.Q93\R3ZRWMKC.GNA\scre..tion_25b0fbb6ef7eb094_0017.0009_d2b150e250a00e67\user.config

Filesize
587B

MD5
a98ba6cea29e7244ad083c0cc49ebe2b

SHA1
b0c1376fa0e4f09aca19ce99d0753d6cccd27629

SHA256
22f626135d69f563c7c5a80b168f4b21479324f69cecc8c77786f00bffba8460

SHA512
6e751735cc1f15948da1984c6fc7abe842cc2e249ce8fa21e1a1f2c671f46b6ed684b6c24fbbe0ed337e2301ca4f5dbdf342f713c41091783cff2ea1f0faf4bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ScreenConnect.WindowsClient.exe.log

Filesize
1KB

MD5
efd934620fb989581d19963e3fbb6d58

SHA1
63b103bb53e254a999eb842ef90462f208e20162

SHA256
3af88293fb19b74f43b351ed49ccc031727f389c7ca509eece181da5763a492f

SHA512
6061817547280c5cf5d2cd50fa76b92aa9c1cfc433f17d6b545192e1098281394562adb773931cecd15d1b594d3b9c03855b70682fe6c54df5912c185b54670b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Deployment\31NHECO8.L5D\9Z7ZXQ03.DQJ\ScreenConnect.Client.dll

Filesize
188KB

MD5
6bc9611d5b6cee698149a18d986547a8

SHA1
f36ab74e4e502fdaf81e101836b94c91d80cb8ea

SHA256
17377a52eeae11e8ee01eb629d6a60c10015ad2bb8bc9768e5c8e4b6500a15ed

SHA512
3f23670d0ba150de19a805db6beb6eed8538bbad6fbe3cc21d17d738a43cf411c679a23cea11549e69be0321e672f740791d40e92498aef9d1f8650743ee85ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\Deployment\31NHECO8.L5D\9Z7ZXQ03.DQJ\ScreenConnect.Client.dll.genman

Filesize
1KB

MD5
9ce092e164085ce2566f654314bf99dc

SHA1
acef36091ec262a4c42aa5a5b394c71b13b4767e

SHA256
6b36ddce4021fd15c29cf63c7102e60edfe2627d1b00ef97d0b4de3051737439

SHA512
95bd7f9315dc181de529d940e697b652651bc9e954e96fbc059998909259a719af062548c533d24350c25a159cb113f568eb7c622ae3069ce25fb9224ebf02a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Deployment\31NHECO8.L5D\9Z7ZXQ03.DQJ\ScreenConnect.ClientService.dll

Filesize
60KB

MD5
22af3a23bd30484514cdacf67c5b3810

SHA1
e92a4eaee9d896964de541ce2f01c2404b638258

SHA256
7c5442121dba2a30ab9579ec08e111ded372cf9cf90fb3256f273980b975afa9

SHA512
95e40b27e90fce7ca85e76afbbc16eb62b4bb977664702b987de2eb2294e6fe9e6df5610ec7b2362c2c68493313f30fbbcbd3446dbe8ae2fa47b89407f5d5936

Download Submit
C:\Users\Admin\AppData\Local\Temp\Deployment\31NHECO8.L5D\9Z7ZXQ03.DQJ\ScreenConnect.ClientService.dll.genman

Filesize
1KB

MD5
f94d041a8128be81c4347caf6a3c47bf

SHA1
3285f9acf70c0e4d34f888c28bd3f693e3df5909

SHA256
91a65bacad5f7f70bddc6209ed65dd5c375cef9f3c289eab83fd90d622adf46b

SHA512
90199543207caf9b4501be7e9509dc9526dafcd5602aaed700314763021c8f3ed06d93a31a90a34cb19d4fb7184aa7d154b197f9e535657aeb9eb872da377a41

Download Submit
C:\Users\Admin\AppData\Local\Temp\Deployment\31NHECO8.L5D\9Z7ZXQ03.DQJ\ScreenConnect.Core.dll

Filesize
519KB

MD5
b319407e807be1a49e366f7f8ea7ee2a

SHA1
b12197a877fb7e33b1cb5ba11b0da5ca706581ba

SHA256
761b7e50baa229e8afcd9a50990d7f776ddb5ed1ea5fbb131c802e57cf918742

SHA512
dc497643790dc608dece9c8fe7264efedd13724bd24c9bf28a60d848b405fddefb8337a60f3f32bb91518910e02c7a2aaf29fc32f86a464dfcafa365526bdb7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Deployment\31NHECO8.L5D\9Z7ZXQ03.DQJ\ScreenConnect.Core.dll.genman

Filesize
1KB

MD5
6da6dc34636435e9c2bd1b5ff79091b5

SHA1
61b6d8c16330fe9063f041bcc025c10de82d876b

SHA256
98d4edaa86468540d2d17ef17a9bcd7224b128099a51a8f92a65a88950dcb44c

SHA512
0bb929107ecfa257dfb2ff7b37955d8c2402287e989c015632a6292362858667a398ad0563103c1324a29585a8177aaa4bce3c57d867735e40d2cc5c996bd5b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Deployment\31NHECO8.L5D\9Z7ZXQ03.DQJ\ScreenConnect.Windows.dll

Filesize
1.6MB

MD5
29454a0cb83f28c24805e9a70e53444a

SHA1
334202965b07ab69f08b16fed0ee6c7274463556

SHA256
998cc3f9af5bd41ccf0f9be86192bbe20cdec08a6ff73c1199e1364195a83e14

SHA512
62790920974a2f1b018d466ae3e3b5100006a3c8013f43bdb04af7074cfe5d992caaeb610de2b1b72ff0e4acf8762db1513a4a0cf331f9a340ae0ce53c3be895

Download Submit
C:\Users\Admin\AppData\Local\Temp\Deployment\31NHECO8.L5D\9Z7ZXQ03.DQJ\ScreenConnect.Windows.dll.genman

Filesize
1KB

MD5
1fb3a39063c9fbbc9252d1224cf8c89d

SHA1
0f0622eb6205f515651e055c17d0067a94308721

SHA256
199c3f5089b07f1fb6cb343180620b2094bcdda9e1f6a3f41269c56402d98439

SHA512
8c70ff2fe2f1935454aa6bb4ce0998da1adcbfe7219f1eaee4688ee86bbc730de30347f39b9b1413cbd345d1bf786491ed2f79142d9333dba3a7f0edc9f48e3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Deployment\31NHECO8.L5D\9Z7ZXQ03.DQJ\ScreenConnect.WindowsBackstageShell.exe

Filesize
59KB

MD5
10dba57f22a6ab4039330000570f39f8

SHA1
b8b5c65a89256177da802c4c9cbd11b013221730

SHA256
9bd8d15759f83d99edd1f2617d59a94e1c2bb4bd7c4977958f5d5f22c5a7c469

SHA512
38230b63a4630145608f619d75ca3115c05ab0338fb57566e012df1bd157123a670a37ae0fea92351ab7352319a5af29f9db3f8bb14962f3f0de3a4f5a5b754c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Deployment\31NHECO8.L5D\9Z7ZXQ03.DQJ\ScreenConnect.WindowsClient.exe

Filesize
573KB

MD5
5dec65c4047de914c78816b8663e3602

SHA1
8807695ee8345e37efec43cbc0874277ed9b0a66

SHA256
71602f6b0b27c8b7d8ad624248e6126970939effde785ec913ace19052e9960e

SHA512
27b5dcb5b0aeadf246b91a173d06e5e8d6cf2cd19d86ca358e0a85b84cd9d8f2b26372ef34c3d427f57803d90f2e97cf59692c80c268a71865f08fc0e7ce42d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Deployment\31NHECO8.L5D\9Z7ZXQ03.DQJ\ScreenConnect.WindowsClient.exe.config

Filesize
266B

MD5
728175e20ffbceb46760bb5e1112f38b

SHA1
2421add1f3c9c5ed9c80b339881d08ab10b340e3

SHA256
87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077

SHA512
fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Deployment\31NHECO8.L5D\9Z7ZXQ03.DQJ\ScreenConnect.WindowsClient.exe.genman

Filesize
2KB

MD5
efa59a7f55af829c3974a02f30ebe80c

SHA1
0faba6763d910d5ee104e3457045c63ccc5bf79b

SHA256
3e2d5cc7867afa23663d5894127ce6e2880d3075773a249b37576eda5088875a

SHA512
72262b09c21dc4a2b2701a5b32c149349fa3107035d5a115eac4335e3961dcf12a7a867aeff595c13aa618ea955b604538c0f4e529cb6a76fff0cb75927cc74d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Deployment\31NHECO8.L5D\9Z7ZXQ03.DQJ\ScreenConnect.WindowsClient.exe.manifest

Filesize
17KB

MD5
f4b84e283123b025a90bbde33e2080fd

SHA1
cc57bfd02228be76c6e08bde16996fa992ff0e54

SHA256
93f9eb492b6952d8c7aa1ef1ee5a901234ba1fd2d5ef58d24e1faef597ea8e02

SHA512
abc92965bf97c37a614b556d2219d06e63687777d79df5ffb4b5d447dd138c160e5a45cab76a2353d758ad62960f2e58745f0523881ff6c0ea4ccbcd7ed40002

Download Submit
C:\Users\Admin\AppData\Local\Temp\Deployment\31NHECO8.L5D\9Z7ZXQ03.DQJ\ScreenConnect.WindowsFileManager.exe

Filesize
79KB

MD5
c333d3a6eeb74e4d76c3b9e0f6bfd04c

SHA1
a39e2643e8dbd2097829e0b08938726557cb8e36

SHA256
998d7a0cd6b1a837489e55e99cb992088b9fde220a1025346a461849e1f50d22

SHA512
58cc7741ebe1aada93fd82a3e0a571a9a1aa3e400c46e7cdddef876d74f4fbbcbae4293ac556b3823e8dc977e7ce72337a16c2d48eab0aa52b736412ae43c634

Download Submit
C:\Users\Admin\AppData\Local\Temp\Deployment\6152ZTYT.EVQ\68277GMA.QPR.application

Filesize
111KB

MD5
c75b8ac01077e6e880490a615615028a

SHA1
3a4cb339f161b5fed4ad1f6d3323c0dbd5be9a01

SHA256
11bf2861a9acda4546475758b8c0e2f94f7b62bfc99aa0cb52e686826abdd20a

SHA512
6f3900e418ca1a2563672b7b7b2000c0a90dc520e95767d7fa1fe3ef032c91325b11692713e1b16f188453c490ba54953357db90725b1527b8102f6844b275a0

Download Submit
memory/1032-347-0x0000000000080000-0x0000000000114000-memory.dmp

Filesize
592KB

Download
memory/1888-383-0x0000000004C50000-0x0000000004CD8000-memory.dmp

Filesize
544KB

Download
memory/1888-378-0x0000000004BA0000-0x0000000004BB6000-memory.dmp

Filesize
88KB

Download
memory/2692-410-0x00000000013D0000-0x00000000013E6000-memory.dmp

Filesize
88KB

Download
memory/2692-416-0x000000001C4E0000-0x000000001C689000-memory.dmp

Filesize
1.7MB

Download
memory/3576-346-0x00007FFE31140000-0x00007FFE31C01000-memory.dmp

Filesize
10.8MB

Download
memory/3576-413-0x000001BD70540000-0x000001BD706E9000-memory.dmp

Filesize
1.7MB

Download
memory/3576-38-0x000001BD737C0000-0x000001BD73854000-memory.dmp

Filesize
592KB

Download
memory/3576-50-0x000001BD737B0000-0x000001BD73838000-memory.dmp

Filesize
544KB

Download
memory/3576-56-0x000001BD72E00000-0x000001BD72E36000-memory.dmp

Filesize
216KB

Download
memory/3576-422-0x00007FFE31140000-0x00007FFE31C01000-memory.dmp

Filesize
10.8MB

Download
memory/3576-420-0x00007FFE31140000-0x00007FFE31C01000-memory.dmp

Filesize
10.8MB

Download
memory/3576-419-0x00007FFE31143000-0x00007FFE31145000-memory.dmp

Filesize
8KB

Download
memory/3576-63-0x000001BD71070000-0x000001BD71086000-memory.dmp

Filesize
88KB

Download
memory/3576-44-0x000001BD73A80000-0x000001BD73C2A000-memory.dmp

Filesize
1.7MB

Download
memory/3576-7-0x000001BD73050000-0x000001BD730A0000-memory.dmp

Filesize
320KB

Download
memory/3576-4-0x00007FFE31140000-0x00007FFE31C01000-memory.dmp

Filesize
10.8MB

Download
memory/3576-3-0x00007FFE31140000-0x00007FFE31C01000-memory.dmp

Filesize
10.8MB

Download
memory/3576-2-0x000001BD700B0000-0x000001BD70236000-memory.dmp

Filesize
1.5MB

Download
memory/3576-0-0x000001BD55AC0000-0x000001BD55AC8000-memory.dmp

Filesize
32KB

Download
memory/3576-1-0x00007FFE31143000-0x00007FFE31145000-memory.dmp

Filesize
8KB

Download
memory/4052-402-0x0000000004980000-0x0000000004A12000-memory.dmp

Filesize
584KB

Download
memory/4052-401-0x00000000046D0000-0x0000000004706000-memory.dmp

Filesize
216KB

Download
memory/4052-398-0x0000000004680000-0x00000000046D0000-memory.dmp

Filesize
320KB

Download
memory/4052-397-0x0000000004E90000-0x0000000005434000-memory.dmp

Filesize
5.6MB

Download
memory/4052-396-0x0000000004730000-0x00000000048DA000-memory.dmp

Filesize
1.7MB

Download