5b67cb6b81cebe801f3b4b5a39881e760d36fb3c3941cc0d43e6844fee361734

Analysis

max time kernel
149s
max time network
118s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
29/05/2026, 16:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-29_32fb408aa3a739a53e04d324016055e8_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe
Size 14.1MB
Sample260529-thdr8aas6r
SHA256 5b67cb6b81cebe801f3b4b5a39881e760d36fb3c3941cc0d43e6844fee361734
MD5 32fb408aa3a739a53e04d324016055e8
SHA1 6eaecaf21370a90afdfdc2739f0b533c39a22fba
SHA512 ae8d76af718a8273af2633aa72c09a84efd3b589b5d7e1eb65b96c76225b0ea262c61a45f9053d97b471a534c76fc78bdfabd3a9c9593f86039c43119e51c6d9
SSDEEP 196608:eUfefP7bzeasVjg53/szeasVjezeasVjZzeasVjqzeasVjH:xasVU53/HasVdasVIasVhasV7
TLSH
T143E61201B3EA49B5D0BF0638E87E86A56A31BD055712C6BF5394B96D2E32BC08D31377
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

backdoor discovery persistence privilege_escalation ransomware rat

Malware Config

Signatures

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (16198b3bc7c20455)\ImagePath = "\"C:\\Program Files (x86)\\ScreenConnect Client (16198b3bc7c20455)\\ScreenConnect.ClientService.exe\" \"?e=Access&y=Guest&h=help.progent.com&p=8041&s=aaa9b906-b67a-4e43-87ee-dbf8e9cbc34f&k=BgIAAACkAABSU0ExAAgAAAEAAQCDgB4YZ4D0EfDbWk7L301HOlwY17cPDEAbo6ow88vALbnr7AsNCC%2b7DEHcZkanqbg0E49RT8FdRXdoI8jDy1pbT4WaUWmcNTYEJU0XtxJlQLawNxSn7OTd%2bTIdYvqz48H7qlg66oBoBLzhxY6ZhcChzSL4Y%2ftrP%2fQdVdI50p0q0AFwZy2lXx3VCN3tnq4IMNW0CSqY7YR9EcZu71vzsaIrtxwGQ0zsd3Mky1BIWipc6OqJh%2bzVyTbAc8MMtO0gsQmPyZgwH03GVSlG0PMz3QPhVXLzaZlNiQGJYZ8Ck%2fujyOUX36McSSSSXB1I5RWbF2%2fDCNjUqg9yye%2fdiyPcxUDX&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAA2EAdS4LiWkSPdO%2bRctFvMwAAAAACAAAAAAAQZgAAAAEAACAAAAAhb98EYxV92Kn5%2frKv59W59m9%2bXN6rhNJciFPaQtZhOAAAAAAOgAAAAAIAACAAAADjWlClgQrDMw4ZeRqcwRQ59WHutjLG8UfZA3h8U0IehqAEAAAzCW98ZD072zzTLVaTTolX1loqy1M5GiPCFAc%2bWcT2pnELMAwIR4PzsJY1LILIEzbR4MXavFXMlU7kcyq3Y5RRbGvHgwChRgGLG9e5nyfYo6qj61ISPOR%2f4LBSIJABVqDohnXNNzCUsOXrCrrxYDJ4Jq8bJCdrBIEm%2f5i17gTNI8j7i8ADjV5XEMxEfvGsN7N0jUdTZ7syhxmrJzc98dtr2mbHek666dVkHvzVvlEMt%2bTHl5ex2lXYYzBxh0%2fthrxNhfNo65XX8OkLjdLXsRBs4If5kVgt1ijJc8uq9T11oPazJVLduBSywRq6Duoq%2fAC5RHAmcLhc6ZMcKeMK%2f%2fm%2fa98KjiyrQoPlmShRHgGR4xAxqh%2bljL9gsHMtEV3%2by11%2f6D6Xu92Qppkom2P%2fBEZyz4NSZd3XSiR14UOYv7CDyOzRkBtjQbB52c0r51P9NhjBWWCPytkse%2fYsqwNNHP9Afp3VmhO3Gp5QTtFY0TaA8dyjf2szuj0Z0ahbFCtOrxOtwZ5Eybqc2%2fQjSDtaeP%2fgY1wkH8aMx2DJjl9x0FsPalYiri0%2bP9Z8vOJPWKlA6IEXoJ%2flFQ3Y9KTj%2fuMe7S1fO2vAni2iZObv5IJIvwGmWKVJTP9weilD%2bN1OqoXDFif%2ffi9kA3XN%2fVABI8IPdaDWlblrJK9JHJCod2PO2moMS7zI2kVB1kAENQPtnjoLkZwQZ8YCKW3B5bKqS2Zn2Mmwr%2baeI8Dqg2U0KWkitZsV%2fKCVNNRtk95BsR4IN4x0v0Z99Iqu9klfATeiqYVpD2Aet%2f%2bTyhGWAPnaXY%2bY9WiGFPjHUOvIWUdgCvHorOL4VaD760rCHCixQkSzlZ7uv3mpBQxPilGuFB9Nm%2bgx0n3ZXCB7ud4a1FtN9seguBA7uFK8r07Mn9ydYK7YCPa%2bl60%2bvJzM2SzhX7KUZDahc1mEV0OOspjPvbDMSrsl%2b4mh9%2btjFsWh5ZiynrGNfeTrk3BeppFQJOZRXTADJjYASvaKVLkWcy%2ftp%2fJ8FkIHde4DCYkAulqeDbo%2fxKl9sYZz%2bNjBGAFvAqdJTlkoI0h7oQFZsBxmgnXTzcNo2dl9NSbYS7yJA40%2f0PnJsCLiJkcXgrbxBo%2f%2fE9SvFA27V%2frkypaQa9zHiRPd6G3qQ8SMRjX6vX3yAbvFEAEL6C0Ugz1hfBhGTGzuqq%2b7DaEMWA6rCXXO0QTKovcolXenSiUkUMoqIMBJRelzuBG0lTcboGSIilg8yNrOLc0OCHwPl5YeOpzfZ%2fanOgjikbfHq0UOqZ%2bviuYMTtE%2fEQz6LXKekhmA9ORmvqoJUNyGLureKiwKf08UQszEIKTqHWF9%2fE1EHvxP9qijnOq7ckc66hzHRJYMI5D54BHMyKxOQfGNxJSBsGyVUJb9QLM7bQQ%2b1lepqcKLC4GAeEOr5mF8P0BJCmtG0628VWet6XHhk54xaa9BUtDYaY5w%2fE5uEItsiI5g7WrquwBZxYsuJYVL9iM7t5DEQ9p8usDVqITfcoFoR7LS5BJ1UYeuTsY0fzhe8uTVZV%2bfOqejBvlOAxRamfhq7AoFZZu6%2fdfG52s64T8ZSkI6XVLWhUAAAABIIzOaWlVx8Q71PmZO2gwDNEB9OcdSgpNslRj08BI2AZoB8rs6oxdMkcX7YdVHhROrVTxumqHA5qZjTD0f5HMB&c=AMS%20Construction%20Services&c=Aaron%20Rose&c=Client%20PC&c=Desktop&c=&c=&c=&c=\""	ScreenConnect.ClientService.exe

ConnectWise ScreenConnect remote access tool
ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
backdoor rat

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	2152	msiexec.exe
3	2152	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe

Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs

Suspicious Windows Authentication Registry Modification.

persistence privilege_escalation

Authentication Package

T1547.002

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\Authentication Packages = 6d007300760031005f003000000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800310036003100390038006200330062006300370063003200300034003500350029005c00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f0077007300410075007400680065006e007400690063006100740069006f006e005000610063006b006100670065002e0064006c006c0000000000	msiexec.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (16198b3bc7c20455)\zv1j1ofl.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (16198b3bc7c20455)\zv1j1ofl.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ScreenConnect.WindowsClient.exe.log	ScreenConnect.WindowsClient.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Drops file in Program Files directory 17 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ScreenConnect Client (16198b3bc7c20455)\ScreenConnect.WindowsBackstageShell.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (16198b3bc7c20455)\Client.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (16198b3bc7c20455)\Client.Override.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (16198b3bc7c20455)\system.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (16198b3bc7c20455)\ScreenConnect.Client.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (16198b3bc7c20455)\ScreenConnect.Windows.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (16198b3bc7c20455)\ScreenConnect.WindowsBackstageShell.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (16198b3bc7c20455)\ScreenConnect.WindowsClient.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (16198b3bc7c20455)\ScreenConnect.ClientService.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (16198b3bc7c20455)\ScreenConnect.ClientService.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (16198b3bc7c20455)\ScreenConnect.WindowsAuthenticationPackage.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (16198b3bc7c20455)\ScreenConnect.WindowsClient.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (16198b3bc7c20455)\ScreenConnect.WindowsCredentialProvider.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (16198b3bc7c20455)\ScreenConnect.WindowsFileManager.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (16198b3bc7c20455)\ScreenConnect.WindowsFileManager.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (16198b3bc7c20455)\Client.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (16198b3bc7c20455)\ScreenConnect.Core.dll	msiexec.exe

Drops file in Windows directory 17 IoCs

description	ioc	Process
File created	C:\Windows\Installer\{A4482C5B-4D33-5D91-B06D-13505C9FDA79}\DefaultIcon	msiexec.exe
File created	C:\Windows\Installer\e58b3bb.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB551.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF5AB6F596398D62CE.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e58b3bb.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\wix{A4482C5B-4D33-5D91-B06D-13505C9FDA79}.SchedServiceConfig.rmi	MsiExec.exe
File opened for modification	C:\Windows\Installer\{A4482C5B-4D33-5D91-B06D-13505C9FDA79}\DefaultIcon	msiexec.exe
File created	C:\Windows\SystemTemp\~DFED56F332E3BE4FC7.TMP	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\SystemTemp\~DFBE2EE0166E18A65E.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB581.tmp	msiexec.exe
File created	C:\Windows\Installer\e58b3bd.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF673195CB99DD659D.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{A4482C5B-4D33-5D91-B06D-13505C9FDA79}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB6CA.tmp	msiexec.exe

Executes dropped EXE 3 IoCs

pid	Process
4360	ScreenConnect.ClientService.exe
3980	ScreenConnect.WindowsClient.exe
4844	ScreenConnect.WindowsClient.exe

Loads dropped DLL 22 IoCs

pid	Process
3936	MsiExec.exe
4628	rundll32.exe
4628	rundll32.exe
4628	rundll32.exe
4628	rundll32.exe
4628	rundll32.exe
4628	rundll32.exe
4628	rundll32.exe
4628	rundll32.exe
4628	rundll32.exe
2464	MsiExec.exe
2652	MsiExec.exe
4360	ScreenConnect.ClientService.exe
4360	ScreenConnect.ClientService.exe
4360	ScreenConnect.ClientService.exe
4360	ScreenConnect.ClientService.exe
4360	ScreenConnect.ClientService.exe
4360	ScreenConnect.ClientService.exe
4360	ScreenConnect.ClientService.exe
4360	ScreenConnect.ClientService.exe
4360	ScreenConnect.ClientService.exe
4360	ScreenConnect.ClientService.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenConnect.ClientService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-29_32fb408aa3a739a53e04d324016055e8_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000588ba66725cf3d120000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000588ba6670000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900588ba667000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a588ba667000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d588ba667000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ScreenConnect.WindowsClient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ScreenConnect.WindowsClient.exe

Modifies data under HKEY_USERS 13 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.ClientService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.WindowsClient.exe

Modifies registry class 37 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-16198b3bc7c20455\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (16198b3bc7c20455)\\ScreenConnect.WindowsClient.exe\" \"%1\""	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-0770-C9B97D9D3520}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B5C2844A33D419D50BD63105C5F9AD97	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B5C2844A33D419D50BD63105C5F9AD97\SourceList\PackageName = "ScreenConnect.ClientSetup.msi"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B5C2844A33D419D50BD63105C5F9AD97\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-16198b3bc7c20455\shell\open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-0770-C9B97D9D3520}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B5C2844A33D419D50BD63105C5F9AD97\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B5C2844A33D419D50BD63105C5F9AD97\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-16198b3bc7c20455\URL Protocol	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\B4D1D052ED6183A26191B8B37C2C4055\B5C2844A33D419D50BD63105C5F9AD97	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-16198b3bc7c20455\shell	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-0770-C9B97D9D3520}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B5C2844A33D419D50BD63105C5F9AD97\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B5C2844A33D419D50BD63105C5F9AD97\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-16198b3bc7c20455	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-0770-C9B97D9D3520}\ = "ScreenConnect Client (16198b3bc7c20455) Credential Provider"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-0770-C9B97D9D3520}\InprocServer32\ = "C:\\Program Files (x86)\\ScreenConnect Client (16198b3bc7c20455)\\ScreenConnect.WindowsCredentialProvider.dll"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B5C2844A33D419D50BD63105C5F9AD97\Version = "419954691"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-16198b3bc7c20455\UseOriginalUrlEncoding = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-16198b3bc7c20455\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B5C2844A33D419D50BD63105C5F9AD97	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B5C2844A33D419D50BD63105C5F9AD97\Full	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B5C2844A33D419D50BD63105C5F9AD97\ProductName = "ScreenConnect Client (16198b3bc7c20455)"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\B4D1D052ED6183A26191B8B37C2C4055	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B5C2844A33D419D50BD63105C5F9AD97\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B5C2844A33D419D50BD63105C5F9AD97\SourceList\Net	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B5C2844A33D419D50BD63105C5F9AD97\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B5C2844A33D419D50BD63105C5F9AD97\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\25.8.3.9466\\16198b3bc7c20455\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B5C2844A33D419D50BD63105C5F9AD97\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B5C2844A33D419D50BD63105C5F9AD97\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-16198b3bc7c20455	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B5C2844A33D419D50BD63105C5F9AD97\PackageCode = "B5C2844A33D419D50BD63105C5F9AD97"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B5C2844A33D419D50BD63105C5F9AD97\ProductIcon = "C:\\Windows\\Installer\\{A4482C5B-4D33-5D91-B06D-13505C9FDA79}\\DefaultIcon"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B5C2844A33D419D50BD63105C5F9AD97\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B5C2844A33D419D50BD63105C5F9AD97\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\25.8.3.9466\\16198b3bc7c20455\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-16198b3bc7c20455\shell\open\command	msiexec.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3660	msiexec.exe
3660	msiexec.exe
4360	ScreenConnect.ClientService.exe
4360	ScreenConnect.ClientService.exe
4360	ScreenConnect.ClientService.exe
4360	ScreenConnect.ClientService.exe
4360	ScreenConnect.ClientService.exe
4360	ScreenConnect.ClientService.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1196	2026-05-29_32fb408aa3a739a53e04d324016055e8_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe
Token: SeShutdownPrivilege	2152	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2152	msiexec.exe
Token: SeSecurityPrivilege	3660	msiexec.exe
Token: SeCreateTokenPrivilege	2152	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2152	msiexec.exe
Token: SeLockMemoryPrivilege	2152	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2152	msiexec.exe
Token: SeMachineAccountPrivilege	2152	msiexec.exe
Token: SeTcbPrivilege	2152	msiexec.exe
Token: SeSecurityPrivilege	2152	msiexec.exe
Token: SeTakeOwnershipPrivilege	2152	msiexec.exe
Token: SeLoadDriverPrivilege	2152	msiexec.exe
Token: SeSystemProfilePrivilege	2152	msiexec.exe
Token: SeSystemtimePrivilege	2152	msiexec.exe
Token: SeProfSingleProcessPrivilege	2152	msiexec.exe
Token: SeIncBasePriorityPrivilege	2152	msiexec.exe
Token: SeCreatePagefilePrivilege	2152	msiexec.exe
Token: SeCreatePermanentPrivilege	2152	msiexec.exe
Token: SeBackupPrivilege	2152	msiexec.exe
Token: SeRestorePrivilege	2152	msiexec.exe
Token: SeShutdownPrivilege	2152	msiexec.exe
Token: SeDebugPrivilege	2152	msiexec.exe
Token: SeAuditPrivilege	2152	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2152	msiexec.exe
Token: SeChangeNotifyPrivilege	2152	msiexec.exe
Token: SeRemoteShutdownPrivilege	2152	msiexec.exe
Token: SeUndockPrivilege	2152	msiexec.exe
Token: SeSyncAgentPrivilege	2152	msiexec.exe
Token: SeEnableDelegationPrivilege	2152	msiexec.exe
Token: SeManageVolumePrivilege	2152	msiexec.exe
Token: SeImpersonatePrivilege	2152	msiexec.exe
Token: SeCreateGlobalPrivilege	2152	msiexec.exe
Token: SeCreateTokenPrivilege	2152	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2152	msiexec.exe
Token: SeLockMemoryPrivilege	2152	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2152	msiexec.exe
Token: SeMachineAccountPrivilege	2152	msiexec.exe
Token: SeTcbPrivilege	2152	msiexec.exe
Token: SeSecurityPrivilege	2152	msiexec.exe
Token: SeTakeOwnershipPrivilege	2152	msiexec.exe
Token: SeLoadDriverPrivilege	2152	msiexec.exe
Token: SeSystemProfilePrivilege	2152	msiexec.exe
Token: SeSystemtimePrivilege	2152	msiexec.exe
Token: SeProfSingleProcessPrivilege	2152	msiexec.exe
Token: SeIncBasePriorityPrivilege	2152	msiexec.exe
Token: SeCreatePagefilePrivilege	2152	msiexec.exe
Token: SeCreatePermanentPrivilege	2152	msiexec.exe
Token: SeBackupPrivilege	2152	msiexec.exe
Token: SeRestorePrivilege	2152	msiexec.exe
Token: SeShutdownPrivilege	2152	msiexec.exe
Token: SeDebugPrivilege	2152	msiexec.exe
Token: SeAuditPrivilege	2152	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2152	msiexec.exe
Token: SeChangeNotifyPrivilege	2152	msiexec.exe
Token: SeRemoteShutdownPrivilege	2152	msiexec.exe
Token: SeUndockPrivilege	2152	msiexec.exe
Token: SeSyncAgentPrivilege	2152	msiexec.exe
Token: SeEnableDelegationPrivilege	2152	msiexec.exe
Token: SeManageVolumePrivilege	2152	msiexec.exe
Token: SeImpersonatePrivilege	2152	msiexec.exe
Token: SeCreateGlobalPrivilege	2152	msiexec.exe
Token: SeCreateTokenPrivilege	2152	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2152	msiexec.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
2152	msiexec.exe
2152	msiexec.exe
3980	ScreenConnect.WindowsClient.exe
3980	ScreenConnect.WindowsClient.exe
3980	ScreenConnect.WindowsClient.exe
3980	ScreenConnect.WindowsClient.exe
3980	ScreenConnect.WindowsClient.exe

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
3980	ScreenConnect.WindowsClient.exe
3980	ScreenConnect.WindowsClient.exe
3980	ScreenConnect.WindowsClient.exe
3980	ScreenConnect.WindowsClient.exe
3980	ScreenConnect.WindowsClient.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1196 wrote to memory of 2152	1196	2026-05-29_32fb408aa3a739a53e04d324016055e8_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe	80
PID 3660 wrote to memory of 3936	3660	msiexec.exe	82
PID 3936 wrote to memory of 4628	3936	MsiExec.exe	83
PID 3660 wrote to memory of 240	3660	msiexec.exe	87
PID 3660 wrote to memory of 2464	3660	msiexec.exe	89
PID 3660 wrote to memory of 2652	3660	msiexec.exe	90
PID 4360 wrote to memory of 3980	4360	ScreenConnect.ClientService.exe	92
PID 4360 wrote to memory of 4844	4360	ScreenConnect.ClientService.exe	93

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-29_32fb408aa3a739a53e04d324016055e8_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-29_32fb408aa3a739a53e04d324016055e8_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1196
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\25.8.3.9466\16198b3bc7c20455\ScreenConnect.ClientSetup.msi"
  2⤵
  - Badlisted process makes network request
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:2152

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Boot or Logon Autostart Execution: Authentication Package
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3660
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding ADEA725A4C778F00944503B4CC87108D C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3936
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI73B4.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240677921 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:4628
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:240
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 7E93B2CC8692D19DD8B5E32F2077C73D
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2464
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding CBD4BAC124083B72BACED30E055A20D8 E Global\MSI0000
  2⤵
  - Drops file in Windows directory
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2652

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:4784

C:\Program Files (x86)\ScreenConnect Client (16198b3bc7c20455)\ScreenConnect.ClientService.exe
"C:\Program Files (x86)\ScreenConnect Client (16198b3bc7c20455)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=help.progent.com&p=8041&s=aaa9b906-b67a-4e43-87ee-dbf8e9cbc34f&k=BgIAAACkAABSU0ExAAgAAAEAAQCDgB4YZ4D0EfDbWk7L301HOlwY17cPDEAbo6ow88vALbnr7AsNCC%2b7DEHcZkanqbg0E49RT8FdRXdoI8jDy1pbT4WaUWmcNTYEJU0XtxJlQLawNxSn7OTd%2bTIdYvqz48H7qlg66oBoBLzhxY6ZhcChzSL4Y%2ftrP%2fQdVdI50p0q0AFwZy2lXx3VCN3tnq4IMNW0CSqY7YR9EcZu71vzsaIrtxwGQ0zsd3Mky1BIWipc6OqJh%2bzVyTbAc8MMtO0gsQmPyZgwH03GVSlG0PMz3QPhVXLzaZlNiQGJYZ8Ck%2fujyOUX36McSSSSXB1I5RWbF2%2fDCNjUqg9yye%2fdiyPcxUDX&c=AMS%20Construction%20Services&c=Aaron%20Rose&c=Client%20PC&c=Desktop&c=&c=&c=&c="
1⤵
- Sets service image path in registry
- Drops file in System32 directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4360
- C:\Program Files (x86)\ScreenConnect Client (16198b3bc7c20455)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (16198b3bc7c20455)\ScreenConnect.WindowsClient.exe" "RunRole" "d70d67e8-aefe-44a4-baf4-611829dc4ab3" "User"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:3980
- C:\Program Files (x86)\ScreenConnect Client (16198b3bc7c20455)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (16198b3bc7c20455)\ScreenConnect.WindowsClient.exe" "RunRole" "8398fa26-44e8-4751-8235-ecffaf1c6f95" "System"
  2⤵
  - Drops file in System32 directory
  - Executes dropped EXE
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  PID:4844

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e58b3bc.rbs

Path C:\Config.Msi\e58b3bc.rbs
Size 214KB
SHA256 0048e417f2692deb2ac29159cc4d6e06bdfd5d36abea58398bdca978fc19316d
MD5 78cd48f4542377b4a06a0fa0d1d81bf2
SHA1 ad0aeea863f55c119a19a9b338d36d2aa5ee2255
SHA512 3313f44932c1ab9926be3f9c3a83827625e9113905d811f691a3f9193c30c586b5c4d9a06780a643b02e4b039c91b4e80582a6a7597a29de08213351f39ae869
SSDEEP 3072:K/9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMGU:K/uH2aCGw1ST1wQLdqvU
TLSH
T159248C216490807EE7FA1A32D93F9671BE7DF6280760C99E83C48C1E9D604C16BF6767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.Override.en-US.resources

Path C:\Program Files (x86)\ScreenConnect Client (16198b3bc7c20455)\Client.Override.en-US.resources
Size 512B
SHA256 370c840618f8cab7ac3a74f0fe8477fc91bb956dc8c379c0d62d66cfdd06e41f
MD5 76f6202245356579d320082a0b2e5aba
SHA1 1e4c4466778e2df477a03363c749f7e64c59205b
SHA512 87b34df10d58da9126a3e6608736105cbf2f8c7955f0a13e67a22f86147d5b132b368e72b5713ea112d8698343e2732bc5d58f0a5732d11c915598ce0fc723ff
TLSH
T159F0E51617EC15B9E4E31A7F387B7484163BB9298424846E5454611D5AF3E0F4A93723
MD5 SHA1 SHA512 TLSH

Submit Download

Client.en-US.resources

Path C:\Program Files (x86)\ScreenConnect Client (16198b3bc7c20455)\Client.en-US.resources
Size 64KB
SHA256 efdb0b4fcc38b52cbf72336bd107a814db8454003f3495de21e2026a148823ea
MD5 92232708774febf9a4a464bbeda36215
SHA1 521d4e630f5e00977bbca7cd17dd0d22dbe1ca9e
SHA512 59442cbc57604f0dd170bb4f86f0e2b6c96408daf67250e6f40e00d034033b6871502cd83df0267f4628c3a035f191d56f26bf1927e691b5330524eb810852f2
SSDEEP 1536:5fkiK2FoQ67wwLFSj7Be3sZvU/7UFN+9nwLLChTKN1ljpneMarA:5fkiK2FoQ6jFSj7Be3sZvU/7UFN+9nwS
TLSH
T1A8532E1277FD0A58F5F36F35BE7A94619937BC5A2E25C06E1028815E09B2F80C9B2773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.resources

Path C:\Program Files (x86)\ScreenConnect Client (16198b3bc7c20455)\Client.resources
Size 2KB
SHA256 4514129a17cafb2891674dd75cf25dfc3e2ac08a08f7adebeba3519f2313ac5e
MD5 c4f2cff169ba9db3e208c833c73431d9
SHA1 3cca7222ebc8a51750157c908a7ba2ddfb49083b
SHA512 c68ff4e9925b99cd50a8f36dc4b5a3ed3c9e62874248d93714cd2e3059e2157f1b4db9c1aae60ba6a3f121e2231b88c824eb805599d98eddbcd31e35b4ed4c62
TLSH
T12F41E2550BFA286CF4BBABF6AEF990AA1273FE253931C37C1810101A67312824900B33
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Client.dll

Path C:\Program Files (x86)\ScreenConnect Client (16198b3bc7c20455)\ScreenConnect.Client.dll
Size 400KB
SHA256 7dc1fdabef0f94f07991b0d1f689e1ca6be9c90c948696d21f95ad88dce20d2f
MD5 43c0447e963aaf660c2b366e807b604c
SHA1 209f363aca8f281f8ceb022c0c7f5829b8e9612c
SHA512 78e7895e47f74446b89fd42ee9b44ca36d127d15b0a32ecee74dc84d824e9752695ddeaaa4ed1fdc356e0329289b0b73708f39dd9db5bd76addf9a73127859d2
SSDEEP 6144:LMSiC+QXJN+ZvH8ETEavHy+vd7JPYIYyqQni65/PGh:wSF+X5HHTEavSW7OQni3h
TLSH
T11594CF85B3B44D2DFEAF0A37F46082258E739C456552F66D0E44B9F80AB37928644FE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Program Files (x86)\ScreenConnect Client (16198b3bc7c20455)\ScreenConnect.ClientService.dll
Size 78KB
SHA256 9e045471fca438cbe7d3fa150eb48da09333e3ca72924fd89f2a18a9228b3af8
MD5 c93dc825a86cb06d074b2a757e1b4e81
SHA1 9f55f4b80515efcd9cf2c347ba86d8988228c266
SHA512 78c4f90e22c6386415009cc251893ab463b0f0a5501428e7c7ec15dbbbcf0a803cef6b52c69b72a2051cc58ebe0e72de8b201240136e7a2505725f209b8284c0
SSDEEP 1536:A7xQmiDqhpozTKpA9mH50ascXk/QQV3lTumkbPHg7M:A7xQmKCpST1O50G0QQVFudgg
TLSH
T1B8733C41A3AC9E26C9DF4E7874A5B0450F709A0294F7FBDD9D8DE4EA1E563C12A003DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Program Files (x86)\ScreenConnect Client (16198b3bc7c20455)\ScreenConnect.ClientService.exe
Size 93KB
SHA256 ba39787b65982eb2f8daf572a6f02780aaad54c23e5d2c9210b5b7aef4fbeb70
MD5 61fe268d8003536dae5f3c22ebfa9884
SHA1 9841b61a12c25edd6de06451eb4a32fc7e9dca98
SHA512 6e02378940f4146cce13de37fed6e8e35f85cf16510d567da39e432404f1e31390368d4a11bf987cd08b5402a54afe3a2d458a679dc8b8b789357b7448c7b0ee
SSDEEP 1536:Xg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkg8U0HMG7q:QhbNDxZGXfdHrX7rAc6myJkg8U0Hn+
TLSH
T1E3935B13B5C28872D473193158E0DAB09A3FF9615E61DEAB3788022E4F742C1AE75E77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Program Files (x86)\ScreenConnect Client (16198b3bc7c20455)\ScreenConnect.Core.dll
Size 553KB
SHA256 eee3b2aa4dedcc23503a4ac3a279bed0d67def1d3fa0e894acfe139af25450b5
MD5 cd98f1beafcafd7a4f32b85afd1787d5
SHA1 1dd78514fc61884f21208dfb57d74df538aca43e
SHA512 01f3ec1e62e5d2fcfa3d5d4a2167fb0675dc0f93339c45607d912e15babc297ebd12f42d3ff7d179dc4e0d8541df93973def15ed4e4521ec638f995fe804d75b
SSDEEP 12288:Ixzn3KCeQqm1mHw3TFvG5qm7ab26X/fjJ:mm88bg9/fl
TLSH
T1BEC48E9133988B2AC5EF4B3BE470D5542A71E524B00EE35B2A99F5E51E8234B4E0C7F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Program Files (x86)\ScreenConnect Client (16198b3bc7c20455)\ScreenConnect.Windows.dll
Size 1.7MB
SHA256 3af6ea2cd302e5e6f497d82801bf3ddcec24a30217ab103bbdcd34ce8e1e27e7
MD5 c88da6b352751638377ea41a470f5e56
SHA1 7dd832ea90d814c74a6e790b55066e7fdf939f47
SHA512 f32f459299a4970fd39c680a266f09f00304a36df9318e7a4ef6eec78fcd5dbd5c30c2dea8cca286dd363a7f7c4575722b5e190d1d186b768ed803da57e965bd
SSDEEP 24576:vZp+Fj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUTT:xp+JkGYYpT0+TFiH7efPO
TLSH
T1A085AD41E2C369F5D46B047888BF572AAA743C080325CAFB97D4BE356D33BC09A36756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsAuthenticationPackage.dll

Path C:\Program Files (x86)\ScreenConnect Client (16198b3bc7c20455)\ScreenConnect.WindowsAuthenticationPackage.dll
Size 254KB
SHA256 a5b8f0070201e4f26260af6a25941ea38bd7042aefd48cd68b9acf951fa99ee5
MD5 5adcb5ae1a1690be69fd22bdf3c2db60
SHA1 09a802b06a4387b0f13bf2cda84f53ca5bdc3785
SHA512 812be742f26d0c42fdde20ab4a02f1b47389f8d1acaa6a5bb3409ba27c64be444ac06d4129981b48fa02d4c06b526cb5006219541b0786f8f37cf2a183a18a73
SSDEEP 3072:qJvChyA4m2zNGvxDd6Q6dtaVNVrlaHpFahvJ9ERnWtMG8Ff2lt9Bgcld5aaYxg:0IvxDdL6d8VNdlC3g0RCXh5D
TLSH
T1C5448E15B7A40CB4EC77823888535A06E776BC160760E6CF03E0825ADF6F7D1A63E762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Program Files (x86)\ScreenConnect Client (16198b3bc7c20455)\ScreenConnect.WindowsClient.exe
Size 603KB
SHA256 ee0fd474de7eb1b844ec8359a4453bfb56263191643c03919bd05f439761c722
MD5 6288afe5545bfed1d5995ca38312dd0e
SHA1 a8d57917127b273530b843af29a9bc25a88523f7
SHA512 dde81e1dc6b786da764aee5f9ed142b4324aedb7dc474b8c679b4ff6cb00f60339a121cf891fd18c78c6e4d740c85c942ac2273b4e313fe580c782912506de3e
SSDEEP 12288:JJdIARli93cAz7QWG+xNXe9siyT3zf9muw:pli9bBlTzouw
TLSH
T1ABD46C2173BCDA3BC8BF0779B0E118645FB0F8156685E78E8904A9D90FD739A49443EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Program Files (x86)\ScreenConnect Client (16198b3bc7c20455)\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
TLSH
T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsCredentialProvider.dll

Path C:\Program Files (x86)\ScreenConnect Client (16198b3bc7c20455)\ScreenConnect.WindowsCredentialProvider.dll
Size 838KB
SHA256 2e422ce2708aaa89895264abdf53a374a36dbf2523419bbf24e6b42187f3c3ef
MD5 b19b1b9de2c943a9df947e563ce94773
SHA1 2eae39fe7b38546aaa2034e7f7a9bb7609a9c1f7
SHA512 9c282d13b20b4925a066144c36e8a189d31c60fd5fc94bf2049100ecdf4bf4b39cc998541ff9bfb3c00484527c313fc0376733b97fdca56526e41619f370ddd9
SSDEEP 12288:0hUSQJg/+QShEMuu/gUD+FkoiS+upfHHF:0wNQrMuu/gUD+Son+2fnF
TLSH
T155054C1BE7A440B9C0ADC6B5C35B9736BBB6F4864514B29F07D40A227F6BF40AB1D384
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.config

Path C:\Program Files (x86)\ScreenConnect Client (16198b3bc7c20455)\system.config
Size 938B
SHA256 76169202127b748ecca33bb9be8272786b19e8f749f6a42ca3bfbe23b6dd6d57
MD5 ebce6e07e831cc7224509bb48bfc4425
SHA1 e34a7ecb8cafcd196be20530577832b7a3c3cad7
SHA512 4b8755d6ab239131c89a0724924ad2322bfee8d361c455e95190665622431ad8fe999a4a0f9f3e12454fb02417fbb7b3d42ef419ab8a5ec847452a0628ccd1ae
TLSH
T13F11DCA171806E5A17631A2ADA518690ED72575A2514104C70AE933AEF716EA03A32DA
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_A18F20A30FE8F85B0631DFDE989361DD

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_A18F20A30FE8F85B0631DFDE989361DD
Size 727B
SHA256 cbd839101b9bb42a38a7758a4f305e15d8d941d9e7f4d3ea7ba197cc8d193592
MD5 4d82e65edd8dfff0cc33254709b72464
SHA1 6d3720b86cc6d57a80c1a53165245a938449d66c
SHA512 72220429957b9c153b20b43f5560e606ec58eaef207cefa22f3c11bf7d86dab490c093c7683cb95617117b3ce1afb6db5b85724d38a790acb4a208007780a4ee
TLSH
T1DF019982BD12579045215E0657F886A53475D0C21B4F405F39095792F74EF421852705
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 727B
SHA256 8360cc6f51681fb6e2af86774f6ac60fe7cf57a08070f59aafe50a9bf3172a56
MD5 6fb96c657cc31897574343ee248bbc24
SHA1 cc9334595c1fee33f285ba1473b01d8a88adef7f
SHA512 ffe30bbc5c541c343f26c715a2491571892cd04e5c8ca66dcbd967cfb458fbffdb4f25389ca62b5cd0d17952eac60c465d9e43e9e066d0e585b7ce15b6b9a5f3
TLSH
T16C01441B14FBBCD475740BD8F7AE8AF9BBF1A38520C90161A77839999281FD09803B64
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_A18F20A30FE8F85B0631DFDE989361DD

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_A18F20A30FE8F85B0631DFDE989361DD
Size 404B
SHA256 a04c7d1d7d83af1ea0cf0e8bc28ffc576a97d128aae1e52d6c8d3a3b1feca26b
MD5 2bb0072a31fda23539f97abf19016256
SHA1 1c8e4fa94c945ef83969a8da944771a472e2967f
SHA512 393352dcf16cef245209b92863ec80d0287f2ebbd424594fedde4f588a4d87fd483d12ccc83cd139b97eb27402316a8d541d4b6d5b42d9ed2cd6a67c59a695a9
TLSH
T1DAE0C63031F6098DF1B0E43806F2A823689DF323260083BA20402316EA20B000ED2665
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 412B
SHA256 be279c02f2bde7e81bfca4f4fa4f8d99842d7d9edeb7d4ee2ddf28ac9430109f
MD5 b489b6f18a8a2e9487c3707db9d024b0
SHA1 7b84bd21edb6796c89f930e6318ed85b70924418
SHA512 6f184317a38dc7b2a1c6fa5131d2292a4f91436635c483de1ff355cad75f9ee637d3e857d68f1fc00c55fc03f712d54925d3d6eb4bf9ac4987deabdbfd5ed586
TLSH
T1F7E0C0281EFB611EF150DC3442F6E07A0E89F3011000877905C0431CFB02F005C10EF0
MD5 SHA1 SHA512 TLSH

Submit Download

MSI73B4.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI73B4.tmp
Size 1.1MB
SHA256 df67696dfa6f60a1b3a4019d8412e478b72ac96cbeeedc9a8b09fd711823f815
MD5 a5c1ec6ef0fd805ce8e18c8b864857e4
SHA1 5a7901f35d183bcd8b06395d539adcfd34a72dfc
SHA512 e60e1785c735b39ab65044925e30222914ccf1c6bd835ceca1eaaca9341b3d5d4bbe5626b51e2d3be4b1f4baf42db80a4fe38b9005c40e539ea0ecb77eeb0994
SSDEEP 24576:iUUGGALkXvDxxNgG5HUYs6CXHyocKPYQYVTTFRCf0dZrUvLw3/1f:NGALeDuKnoHJyV/H007t3/1f
TLSH
T1DD352300B7F5803AF0FA3A700D25675109BD7DB269B0C4CEAB55866D4F61BD1AAF8327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Deployment.WindowsInstaller.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI73B4.tmp-\Microsoft.Deployment.WindowsInstaller.dll
Size 172KB
SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
MD5 5ef88919012e4a3d8a1e2955dc8c8d81
SHA1 c0cfb830b8f1d990e3836e0bcc786e7972c9ed62
SHA512 4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684
SSDEEP 3072:FkfZS7FUguxN+77b1W5GR69UgoCaf8TpCnfKlRUjW01Ky4:x+c7b1W4R6joxfQE
TLSH
T14E045B2563FC473ECAEF87B4E2624251E7B2E2E97113DB0DDC8541AA2522780F792753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI73B4.tmp-\ScreenConnect.Core.dll
Size 543KB
SHA256 600865076f4e6126dad2b3eff623bfb0ab8658ee2a287eed60599646e50b08d6
MD5 a80b7c959acae4f3b833c2b85713dc07
SHA1 e318c661eb222129039552e70af9ef57cee301d0
SHA512 b8c760c9785acd56b5c8d442ae1c9316de6418dbc1a31eda65e66191f8e060b07abdc2f4fc588e03c4ce2cdb537ee898faeab8aa5b9a2c68b56e21bd61e11962
SSDEEP 12288:mxzn3KCeQqm1mHw3TFvG5qm7ab26X/fj:gm88bg9/f
TLSH
T1AAC47E9133988B2AC5EF4B3BE470D9542A31E524B00EE75B2A99F5E51D8234B4E0C7F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.InstallerActions.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI73B4.tmp-\ScreenConnect.InstallerActions.dll
Size 11KB
SHA256 7aab2b665585cba47fdc755f7f053cfb24185be64e9c45259746402d6abdb675
MD5 085a7998ea83a98cf6e356f97474286a
SHA1 9b54707cbf23caf558e9791bd63b779e10914647
SHA512 a16120b2a6a79dd53af42f496fac42908139459101f8fb65c943ac1449bcf0d811880ca1ea08021fb0148c4764a2628493fa4d1a78675fdaa862084b235825f9
SSDEEP 192:B8/Qp6lCJuV3jpXtyVNamVNG1YZfCrMmbfHJ7kjvLibuLd9NEFbox:G/cBJatXt2NaheUrMmb/FkjvLibuZfx
TLSH
T11032D60037DC973AE8BE0F799EB361910A71FB74A015DF2E18C891569C367449EA07A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI73B4.tmp-\ScreenConnect.Windows.dll
Size 1.7MB
SHA256 b5b2c2c2f2cb7ffc3393f29a1c450d7b8ea117a37e8319f7e5ffee1debfa1887
MD5 cb3512b071a487cce851e721f5760f83
SHA1 31bac62c98d33392f142c8ef1f86682453061ffa
SHA512 cb8a87fdf9ff31dfffeb02f12cfcb5f7c0f2862f85fc1783c4faa81ea8f19748aa31e1a19c8bba5137866236e4b9dc725fdae96f537751a17fc51edb401d097f
SSDEEP 24576:CZp+Fj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUTM:wp+JkGYYpT0+TFiH7efP
TLSH
T18A85BD41E2C365F5D46B047888BF572AAA743C080325CAFB97D4BE396D33BC09A36756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientSetup.msi

Path C:\Users\Admin\AppData\Local\Temp\ScreenConnect\25.8.3.9466\16198b3bc7c20455\ScreenConnect.ClientSetup.msi
Size 11.7MB
SHA256 e8463df8f0158e725e04650165fbccd7cc2f4520d8c7abef1d7c6550dbce95a1
MD5 386f17f830c8e866fd88fa541c013e70
SHA1 30466fde3f47a821aba0c1c16738bccd5f201744
SHA512 0ab12098553dee338777ff0921ae8b02d6c5a2a9a14d48795cb542469c827eb4df8be7e7262438d3b797788759a95aab3edde1a8cae5223dfbed3c5a8b903e9e
SSDEEP 196608:/zeasVjg53/szeasVjezeasVjZzeasVjqzeasVj:yasVU53/HasVdasVIasVhasV
TLSH
T187C6232136FD8975E1FA4735FC3A89F159367D5A9962C01F5328781D2A72E80C8B233B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIB581.tmp

Path C:\Windows\Installer\MSIB581.tmp
Size 202KB
SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
MD5 ba84dd4e0c1408828ccc1de09f585eda
SHA1 e8e10065d479f8f591b9885ea8487bc673301298
SHA512 7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290
SSDEEP 3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
TLSH
T129147C326494803EE7F91A36D93E9A61AE7DF6241760C99EC3848C0E5D604D06BF7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.6MB
SHA256 25ce99d2b47fc689c9b67ac228caf95eda52228c21b62845fa381b81fa69551b
MD5 1d378cc41049685de224bd99a3fb0219
SHA1 98551bdefecebb0cc072964903477814e5097aa5
SHA512 32b1c085773a7a2315b99cb29ea6125155632dd0769c8bd12116aa1957a77d946d0b1ecad226f8e44a5000d7b888f2638dde15bde8df0599e563c5931cfeb3c3
SSDEEP 24576:f2gmSp1udoO/vvTLcW3OhkXafKJ8A4jt22kt3JkH+M64ErjS48mwLqtwx:8
TLSH
T1C747072436F92100E7F79E3CB8F06A27593A7D579C15EE8D05411B8D0922FB1E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{1a92f0e3-1f09-46d2-a15f-0005a0dc845b}_OnDiskSnapshotProp

Path \??\Volume{67a68b58-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{1a92f0e3-1f09-46d2-a15f-0005a0dc845b}_OnDiskSnapshotProp
Size 6KB
SHA256 0661f79559dc86556c6400ba79b64b06d35854912d2aa9cd8526ebabf60322a3
MD5 f170d627e56a0276d6bdc199e082a991
SHA1 7c5879e5ceba04a62e5d33f293d670ede745e64b
SHA512 e7edb49fd48ba82d40f85ef37b9788e4ea40bf79b4fa19e5c4db68a5f9781dd5be66efca4db973c2e7dc4ae27d879901ad722413b1af57da8621e3658a9f7d07
SSDEEP 96:FCsNLzcvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:TUb++ZVm
TLSH
T182D178185AE54711E2B3AB7228F18557A877B811FF33CB8E0198238E6631910F875F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1196-2-0x0000000005EA0000-0x0000000005EB0000-memory.dmp

Download

memory/1196-0-0x0000000005EA0000-0x0000000005EB0000-memory.dmp

Download

memory/1196-11-0x0000000005EA0000-0x0000000005EB0000-memory.dmp

Download

memory/1196-12-0x0000000005EA0000-0x0000000005EB0000-memory.dmp

Download

memory/1196-10-0x0000000005EA0000-0x0000000005EB0000-memory.dmp

Download

memory/1196-1-0x0000000002040000-0x0000000002048000-memory.dmp

Download

memory/1196-8-0x0000000006630000-0x0000000006BD6000-memory.dmp

Download

memory/1196-3-0x0000000005EA0000-0x0000000005EB0000-memory.dmp

Download

memory/1196-4-0x0000000002070000-0x0000000002078000-memory.dmp

Download

memory/1196-5-0x0000000005E00000-0x0000000005E8E000-memory.dmp

Download

memory/1196-6-0x0000000005EB0000-0x0000000005ED4000-memory.dmp

Download

memory/1196-9-0x0000000006180000-0x0000000006212000-memory.dmp

Download

memory/1196-7-0x0000000005ED0000-0x000000000607E000-memory.dmp

Download

memory/3980-143-0x000000001C460000-0x000000001C4C8000-memory.dmp

Download

memory/3980-144-0x000000001C860000-0x000000001C8EE000-memory.dmp

Download

memory/3980-150-0x0000000000B20000-0x0000000000B38000-memory.dmp

Download

memory/3980-149-0x0000000000AE0000-0x0000000000AF8000-memory.dmp

Download

memory/3980-148-0x000000001DE90000-0x000000001E018000-memory.dmp

Download

memory/3980-142-0x00000000001F0000-0x000000000028A000-memory.dmp

Download

memory/3980-145-0x000000001CAA0000-0x000000001CC4E000-memory.dmp

Download

memory/4360-103-0x0000000001C40000-0x0000000001C58000-memory.dmp

Download

memory/4360-113-0x00000000044D0000-0x000000000467E000-memory.dmp

Download

memory/4360-126-0x0000000004470000-0x00000000044B1000-memory.dmp

Download

memory/4360-115-0x0000000004680000-0x00000000046D0000-memory.dmp

Download

memory/4360-109-0x0000000004250000-0x00000000042DE000-memory.dmp

Download

memory/4360-134-0x00000000049D0000-0x0000000004AA5000-memory.dmp

Download

memory/4360-119-0x00000000046D0000-0x0000000004738000-memory.dmp

Download

memory/4628-44-0x0000000002710000-0x000000000273E000-memory.dmp

Download

memory/4628-56-0x0000000004DE0000-0x0000000004F8E000-memory.dmp

Download

memory/4628-52-0x0000000004BA0000-0x0000000004C2E000-memory.dmp

Download

memory/4628-48-0x0000000002750000-0x000000000275A000-memory.dmp

Download

memory/4844-152-0x00000000028E0000-0x0000000002921000-memory.dmp

Download