Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
ScreenConnect.ClientService.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ScreenConnect.ClientService.exe.log
|
ASCII text, with CRLF line terminators
|
dropped
|
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\ScreenConnect.ClientService.exe
|
"C:\Users\user\Desktop\ScreenConnect.ClientService.exe"
|
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
2F01000
|
trusted library allocation
|
page read and write
|
||
|
FF0000
|
heap
|
page read and write
|
||
|
1580000
|
heap
|
page execute and read and write
|
||
|
14E0000
|
trusted library allocation
|
page read and write
|
||
|
164E000
|
stack
|
page read and write
|
||
|
2D4000
|
unkown
|
page write copy
|
||
|
15CE000
|
stack
|
page read and write
|
||
|
1530000
|
heap
|
page read and write
|
||
|
2D4000
|
unkown
|
page read and write
|
||
|
509E000
|
stack
|
page read and write
|
||
|
13DE000
|
stack
|
page read and write
|
||
|
112E000
|
stack
|
page read and write
|
||
|
1229000
|
heap
|
page read and write
|
||
|
54CE000
|
stack
|
page read and write
|
||
|
1540000
|
trusted library allocation
|
page execute and read and write
|
||
|
10E0000
|
heap
|
page read and write
|
||
|
2CD000
|
unkown
|
page readonly
|
||
|
1560000
|
trusted library allocation
|
page read and write
|
||
|
150B000
|
trusted library allocation
|
page execute and read and write
|
||
|
3F01000
|
trusted library allocation
|
page read and write
|
||
|
1212000
|
heap
|
page read and write
|
||
|
1219000
|
heap
|
page read and write
|
||
|
572F000
|
stack
|
page read and write
|
||
|
11D0000
|
trusted library allocation
|
page read and write
|
||
|
116E000
|
stack
|
page read and write
|
||
|
11E0000
|
heap
|
page read and write
|
||
|
1500000
|
trusted library allocation
|
page read and write
|
||
|
10D5000
|
heap
|
page read and write
|
||
|
1650000
|
heap
|
page read and write
|
||
|
2D6000
|
unkown
|
page readonly
|
||
|
2C1000
|
unkown
|
page execute read
|
||
|
14DE000
|
stack
|
page read and write
|
||
|
2EFF000
|
stack
|
page read and write
|
||
|
1252000
|
heap
|
page read and write
|
||
|
1180000
|
heap
|
page read and write
|
||
|
11C0000
|
trusted library allocation
|
page read and write
|
||
|
11D3000
|
trusted library allocation
|
page execute and read and write
|
||
|
548E000
|
stack
|
page read and write
|
||
|
1550000
|
heap
|
page read and write
|
||
|
160C000
|
stack
|
page read and write
|
||
|
582E000
|
stack
|
page read and write
|
||
|
F8B000
|
stack
|
page read and write
|
||
|
11EA000
|
heap
|
page read and write
|
||
|
11DD000
|
trusted library allocation
|
page execute and read and write
|
||
|
1520000
|
trusted library allocation
|
page read and write
|
||
|
11EE000
|
heap
|
page read and write
|
||
|
2C0000
|
unkown
|
page readonly
|
||
|
1507000
|
trusted library allocation
|
page execute and read and write
|
||
|
592E000
|
stack
|
page read and write
|
||
|
54E0000
|
heap
|
page execute and read and write
|
||
|
2CD000
|
unkown
|
page readonly
|
||
|
10D0000
|
heap
|
page read and write
|
||
|
E8C000
|
stack
|
page read and write
|
||
|
11D4000
|
trusted library allocation
|
page read and write
|
There are 44 hidden memdumps, click here to show them.