3c50648a814c910e0dd75b3066ce386742373e12fb98e0657158396e12b1d16b

Analysis

max time kernel
149s
max time network
131s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 09:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-23_1b66a222c74b7c889d96902260e81da8_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe
Size 5.0MB
Sample260723-lay47aba85
SHA256 3c50648a814c910e0dd75b3066ce386742373e12fb98e0657158396e12b1d16b
MD5 1b66a222c74b7c889d96902260e81da8
SHA1 7d6829a89180cbf3ec45d294c788867fd738e296
SHA512 1cebddb2ca075c52a9ee27c300a1141c7ad0c7f0c6929a6ddcb2e15b0a4b1521c582ab1bc0e91e583ec17739bbcb4b05be52a04b37b74e60e1989614a7501bcf
SSDEEP 98304:5h6+6efPBJYV6lVhSxWGIdYdsBDG0uWT5hWOgcD:EefPcVinNGInBphDgI
TLSH
T14D36F112F7D581B6D0BF0638E87956669770BC095322C76F9394BD693D33B809E223B2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

backdoor discovery persistence privilege_escalation ransomware rat revoked_codesign

Malware Config

Signatures

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (1830d7263bc4f64f)\ImagePath = "\"C:\\Program Files (x86)\\ScreenConnect Client (1830d7263bc4f64f)\\ScreenConnect.ClientService.exe\" \"?e=Access&h=instance-ohfrcy-relay.screenconnect.com&p=443&s=ccb5a746-efb5-45d0-a17e-e1960fb41a37&k=BgIAAACkAABSU0ExAAgAAAEAAQBZBxE%2b%2fLmV2LWEo6f3GK6kMCawIOzG2i9%2fLGy74%2bJOSffsnxdF596HGQFsa5Xbt1odASOkNVzF%2b6%2fbeG05DFjayWyir4lssBizvNB2W8iUTyb9R%2fDlDWkZqxh2xJ%2bMYx59GuM6%2fFTsfAOeC8p5clju7OS20ktMN7bnRsFe7WUr3p03lX9z3bbLzx52ghTN7zX4EI4mAK1T99H%2bmkOqiGxSxtBZAkT1gbstSBa0768hMWd0fnoBJPifWdshoQagaofkAhkN8AmDk09yqRef%2bev7ajtvVp4oVIZtB1asKzUrKkdJQ6fG5%2f%2f5103L5NcU9l1OvtJZB%2foUpJoe2JmaD927&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAAjih6tkTYCk6CXI3hg8LbIgAAAAACAAAAAAAQZgAAAAEAACAAAADviV5A0VjDrjvKkdxEEecFm8m9OiTCAoqR7QEKKDwklAAAAAAOgAAAAAIAACAAAADdGtHpOpgdNtXc6fYe97ciLgjrDCGV70M21TyoC5FhLqAEAAD04fbUNsG%2ffn3bZOfvszXpPcEVJbze9hRD8SKJMIaiM3N38czGtcfRsahtAt7ESGln7VzUrw579tShIAWzjOcduaIl69lD8%2fEVEigS5mfQuFCV7klEHnDeww%2b%2f2Dur%2fQ35v1oq9TVe84MJ2lsM4kAZNHbv9sr9vwJ2V8sKqeirpMr3psP%2fuPUs08ncTnYKPbuDEB5ZxaHHYFw7gT417L%2fRMNjr1Y0U6DRUmXt6mTlXrEFlqQameneDSazEQf0RdA5%2bblFYmgGHK0fGcdKtu8Jil64JTkjYipS%2bXRv8eUlQFLjm03pzSxW2xVEte1uxyEx2xff4ASESddtvvzhijOHOmvWyTYzuWEA%2fdlVzIge4gxiBkQ%2ffHB01R7e0rerzjWSAFA2bjFzNmGqkk0QmBsUC0RQHGzmVDOQ9A1IcEruYpNqYhoeRrkQu43XXApG%2b0fH314oOWTmsIZhAOcDvlYHMKC1GFdlT34%2fTwzjYmXYucrddcAfiZKkwMe%2baLeSUl1LHQAeGZDYgvNUxQfHiAEJzKNgn7RiMVRK3eJGZG1AvJjCyv2HOmbX7XhHUAEtlGriaTDB7bdwkp0pjYQ9QGl7zKID0ow9UEauX%2fKzapLHgrVoXJNUOMhpxlxS%2fLCKS1bO0fpMchXrDlD50iza7xywf2BUWsBZwHwBy7XmQYChxHXBIpTZhkGhqw2OjyNQdSVn1%2b6AHzn6IfDBlZ2kb31fytxpEGyY4voEf%2fd5X1%2bb0gtMZvhncFWR6kvxmK2pbuSd0WIjn64Famdy7HyD%2btAR9LLPD77OXEY8uavlef9zwNrWA%2fD4eQ0ryVEey%2bSZqqL%2bJDSuZbbmLzKzvYKDOPl%2fHyRkmcpZD70vyF8kj5pvbCY3sZ9AMYPu%2bYmtgJiIa8kmCDcH6Z8N13oXtyryg3zEs02lV25Hl4FYCVs8MaKx2fxwwh0zar0fpRde1nh4P%2fcgR8qZvyf5Hy7e1LYHrvXOCCjHVk0GXT97bUQoGqAnbKCKHTdltMxRaWkCPGuW%2bGH1QhZvwT%2bjQvtLewbQl5Pdg7un9jQxAmy9JWaGtEjNzrS0JOWanh9lYa%2fjsESiVvYa2JegdsZYMN3qJk5bLp1Xs5rYvogfPgnA3n6TwbgbF6BXSL4jtublLCEjQ4F9l9kajBohoSdAfkdz22U9cXQ%2fHgr6ElVWounTDh0quzoIPjLAasnf0cAdLQDtTzdN2%2fFBPbxN7lt%2b%2f5uoQCrNF9fKXb5eNFwfjmP8KBMsFzkO2ML4rJpxxQ1YLBngK%2fRtHKRjtptYb5Z8NANmf6UftWO%2fNy5vIm297uzyOMDa0yei0LT1axLuW80%2fth9785QqwiboGcNkKuwH%2b626KyyV05K9Q3yONLKBapwIqeB9pAy%2fs7oVCwvkolL3F%2fV8l31nOI3VQUO4SBdMttv824MVf0dVcVoN4n%2bjuPfFhPF0HvzCooiHJ%2bqL2wFx6XSu%2b1Gpfecq4c6nRrhvCx2iu9ob1nQGdLTNOgVThH5N1ALSXJZ0EqZI3IbXdZdN4lIP%2bcxfVrV9%2fPReybhDg21EepiyNUr8qcz%2b%2bYCtjtfUUPIaDSHXn4UAAAAAHBm8NkfPlk0lT5qOysu9JkhRXcOG0Jedbx2U1xz6d0GNMhOsVtmutnDaORs%2bh1gDSzsj%2f%2bIW%2fbEQRK8PumJXH\""	ScreenConnect.ClientService.exe

Signed with revoked ConnectWise certificate 5 IoCs

Binary is signed using a ConnectWise certificate revoked for key compromise.

revoked_codesign

resource	yara_rule
behavioral2/memory/1844-2-0x0000000005CE0000-0x0000000005F9E000-memory.dmp	revoked_cert_connectwise
behavioral2/files/0x000d00000001c5a5-69.dat	revoked_cert_connectwise
behavioral2/files/0x000d00000001c5a4-93.dat	revoked_cert_connectwise
behavioral2/memory/676-94-0x00000000042C0000-0x000000000437E000-memory.dmp	revoked_cert_connectwise
behavioral2/files/0x000d00000001c5a2-111.dat	revoked_cert_connectwise

ConnectWise ScreenConnect remote access tool
ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
backdoor rat
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 2 IoCs

pid	Process
676	ScreenConnect.ClientService.exe
236	ScreenConnect.WindowsClient.exe

Loads dropped DLL 20 IoCs

pid	Process
1388	MsiExec.exe
5084	rundll32.exe
5084	rundll32.exe
5084	rundll32.exe
5084	rundll32.exe
5084	rundll32.exe
5084	rundll32.exe
5084	rundll32.exe
2416	MsiExec.exe
5128	MsiExec.exe
676	ScreenConnect.ClientService.exe
676	ScreenConnect.ClientService.exe
676	ScreenConnect.ClientService.exe
676	ScreenConnect.ClientService.exe
676	ScreenConnect.ClientService.exe
676	ScreenConnect.ClientService.exe
676	ScreenConnect.ClientService.exe
676	ScreenConnect.ClientService.exe
676	ScreenConnect.ClientService.exe
676	ScreenConnect.ClientService.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe

Drops file in System32 directory 27 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1830d7263bc4f64f)\3utv3d4o.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1830d7263bc4f64f)\2fcmcojl.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1830d7263bc4f64f)\rb5ho1ce.tmp	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1830d7263bc4f64f)\rb5ho1ce.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1830d7263bc4f64f)\ssk0zbuw.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1830d7263bc4f64f)\ssk0zbuw.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1830d7263bc4f64f)\41ksaws2.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1830d7263bc4f64f)\41ksaws2.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1830d7263bc4f64f)\2fcmcojl.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1830d7263bc4f64f)\40xrezdk.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1830d7263bc4f64f)\rb5ho1ce.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1830d7263bc4f64f)\p0ijz3rz.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1830d7263bc4f64f)\hsxon3qm.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1830d7263bc4f64f)\41ksaws2.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1830d7263bc4f64f)\3utv3d4o.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1830d7263bc4f64f)\p0ijz3rz.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1830d7263bc4f64f)\guz3cxca.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1830d7263bc4f64f)\guz3cxca.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1830d7263bc4f64f)\user.config	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1830d7263bc4f64f)\3utv3d4o.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1830d7263bc4f64f)\2fcmcojl.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1830d7263bc4f64f)\40xrezdk.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1830d7263bc4f64f)\40xrezdk.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1830d7263bc4f64f)\p0ijz3rz.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1830d7263bc4f64f)\guz3cxca.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1830d7263bc4f64f)\hsxon3qm.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1830d7263bc4f64f)\ssk0zbuw.newcfg	ScreenConnect.ClientService.exe

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ScreenConnect Client (1830d7263bc4f64f)\ScreenConnect.Client.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (1830d7263bc4f64f)\system.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (1830d7263bc4f64f)\ScreenConnect.ClientService.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (1830d7263bc4f64f)\ScreenConnect.ClientService.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (1830d7263bc4f64f)\Client.Override.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (1830d7263bc4f64f)\Client.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (1830d7263bc4f64f)\ScreenConnect.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (1830d7263bc4f64f)\ScreenConnect.Windows.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (1830d7263bc4f64f)\ScreenConnect.WindowsBackstageShell.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (1830d7263bc4f64f)\ScreenConnect.WindowsBackstageShell.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (1830d7263bc4f64f)\app.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (1830d7263bc4f64f)\Client.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (1830d7263bc4f64f)\ScreenConnect.WindowsClient.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (1830d7263bc4f64f)\ScreenConnect.WindowsClient.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (1830d7263bc4f64f)\ScreenConnect.WindowsCredentialProvider.dll	msiexec.exe

Drops file in Windows directory 17 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\e59fea9.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFE98E5AB5D766D7BA.TMP	msiexec.exe
File created	C:\Windows\Installer\e59feab.msi	msiexec.exe
File created	C:\Windows\Installer\{A2202314-B56B-4CC6-A195-FD0EEE63EBFD}\DefaultIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI496.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{A2202314-B56B-4CC6-A195-FD0EEE63EBFD}\DefaultIcon	msiexec.exe
File created	C:\Windows\SystemTemp\~DFD46EE57B157664D7.TMP	msiexec.exe
File created	C:\Windows\Installer\e59fea9.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\~DF67CAF7CBFD0C6324.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI447.tmp	msiexec.exe
File created	C:\Windows\Installer\wix{A2202314-B56B-4CC6-A195-FD0EEE63EBFD}.SchedServiceConfig.rmi	MsiExec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{A2202314-B56B-4CC6-A195-FD0EEE63EBFD}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5EF.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF282FD67B0B640F8C.TMP	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenConnect.ClientService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-23_1b66a222c74b7c889d96902260e81da8_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000031a81fc62ba3bf350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380131a81fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410131a81fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e331a81fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e631a81fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.ClientService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.ClientService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe

Modifies registry class 37 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\sc-1830d7263bc4f64f	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4132022AB65B6CC41A59DFE0EE36BEDF\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4132022AB65B6CC41A59DFE0EE36BEDF\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4132022AB65B6CC41A59DFE0EE36BEDF\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4132022AB65B6CC41A59DFE0EE36BEDF\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-3090-EFB869D1737A}\ = "ScreenConnect Client (1830d7263bc4f64f) Credential Provider"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4132022AB65B6CC41A59DFE0EE36BEDF\ProductIcon = "C:\\Windows\\Installer\\{A2202314-B56B-4CC6-A195-FD0EEE63EBFD}\\DefaultIcon"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\4C9BEEA2A1A05E8581037D62B34C6FF4\4132022AB65B6CC41A59DFE0EE36BEDF	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-1830d7263bc4f64f\shell	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-3090-EFB869D1737A}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4132022AB65B6CC41A59DFE0EE36BEDF	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4132022AB65B6CC41A59DFE0EE36BEDF\PackageCode = "2E096E98D6DBB9D49AF74CB200F8F52B"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4132022AB65B6CC41A59DFE0EE36BEDF\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4132022AB65B6CC41A59DFE0EE36BEDF\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4132022AB65B6CC41A59DFE0EE36BEDF\Version = "369699165"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4132022AB65B6CC41A59DFE0EE36BEDF\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4132022AB65B6CC41A59DFE0EE36BEDF\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-1830d7263bc4f64f\UseOriginalUrlEncoding = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-1830d7263bc4f64f	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-3090-EFB869D1737A}\InprocServer32\ = "C:\\Program Files (x86)\\ScreenConnect Client (1830d7263bc4f64f)\\ScreenConnect.WindowsCredentialProvider.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-3090-EFB869D1737A}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4132022AB65B6CC41A59DFE0EE36BEDF\ProductName = "ScreenConnect Client (1830d7263bc4f64f)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4132022AB65B6CC41A59DFE0EE36BEDF\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4132022AB65B6CC41A59DFE0EE36BEDF\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4132022AB65B6CC41A59DFE0EE36BEDF\SourceList\PackageName = "setup.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-1830d7263bc4f64f\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-1830d7263bc4f64f\shell\open	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-1830d7263bc4f64f\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-1830d7263bc4f64f\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (1830d7263bc4f64f)\\ScreenConnect.WindowsClient.exe\" \"%1\""	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-3090-EFB869D1737A}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4132022AB65B6CC41A59DFE0EE36BEDF\Full	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4132022AB65B6CC41A59DFE0EE36BEDF\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4132022AB65B6CC41A59DFE0EE36BEDF\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-1830d7263bc4f64f\URL Protocol	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4132022AB65B6CC41A59DFE0EE36BEDF	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\4C9BEEA2A1A05E8581037D62B34C6FF4	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4132022AB65B6CC41A59DFE0EE36BEDF\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1084	msiexec.exe
1084	msiexec.exe
676	ScreenConnect.ClientService.exe
676	ScreenConnect.ClientService.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1844	2026-07-23_1b66a222c74b7c889d96902260e81da8_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe
Token: SeShutdownPrivilege	2400	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2400	msiexec.exe
Token: SeSecurityPrivilege	1084	msiexec.exe
Token: SeCreateTokenPrivilege	2400	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2400	msiexec.exe
Token: SeLockMemoryPrivilege	2400	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2400	msiexec.exe
Token: SeMachineAccountPrivilege	2400	msiexec.exe
Token: SeTcbPrivilege	2400	msiexec.exe
Token: SeSecurityPrivilege	2400	msiexec.exe
Token: SeTakeOwnershipPrivilege	2400	msiexec.exe
Token: SeLoadDriverPrivilege	2400	msiexec.exe
Token: SeSystemProfilePrivilege	2400	msiexec.exe
Token: SeSystemtimePrivilege	2400	msiexec.exe
Token: SeProfSingleProcessPrivilege	2400	msiexec.exe
Token: SeIncBasePriorityPrivilege	2400	msiexec.exe
Token: SeCreatePagefilePrivilege	2400	msiexec.exe
Token: SeCreatePermanentPrivilege	2400	msiexec.exe
Token: SeBackupPrivilege	2400	msiexec.exe
Token: SeRestorePrivilege	2400	msiexec.exe
Token: SeShutdownPrivilege	2400	msiexec.exe
Token: SeDebugPrivilege	2400	msiexec.exe
Token: SeAuditPrivilege	2400	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2400	msiexec.exe
Token: SeChangeNotifyPrivilege	2400	msiexec.exe
Token: SeRemoteShutdownPrivilege	2400	msiexec.exe
Token: SeUndockPrivilege	2400	msiexec.exe
Token: SeSyncAgentPrivilege	2400	msiexec.exe
Token: SeEnableDelegationPrivilege	2400	msiexec.exe
Token: SeManageVolumePrivilege	2400	msiexec.exe
Token: SeImpersonatePrivilege	2400	msiexec.exe
Token: SeCreateGlobalPrivilege	2400	msiexec.exe
Token: SeCreateTokenPrivilege	2400	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2400	msiexec.exe
Token: SeLockMemoryPrivilege	2400	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2400	msiexec.exe
Token: SeMachineAccountPrivilege	2400	msiexec.exe
Token: SeTcbPrivilege	2400	msiexec.exe
Token: SeSecurityPrivilege	2400	msiexec.exe
Token: SeTakeOwnershipPrivilege	2400	msiexec.exe
Token: SeLoadDriverPrivilege	2400	msiexec.exe
Token: SeSystemProfilePrivilege	2400	msiexec.exe
Token: SeSystemtimePrivilege	2400	msiexec.exe
Token: SeProfSingleProcessPrivilege	2400	msiexec.exe
Token: SeIncBasePriorityPrivilege	2400	msiexec.exe
Token: SeCreatePagefilePrivilege	2400	msiexec.exe
Token: SeCreatePermanentPrivilege	2400	msiexec.exe
Token: SeBackupPrivilege	2400	msiexec.exe
Token: SeRestorePrivilege	2400	msiexec.exe
Token: SeShutdownPrivilege	2400	msiexec.exe
Token: SeDebugPrivilege	2400	msiexec.exe
Token: SeAuditPrivilege	2400	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2400	msiexec.exe
Token: SeChangeNotifyPrivilege	2400	msiexec.exe
Token: SeRemoteShutdownPrivilege	2400	msiexec.exe
Token: SeUndockPrivilege	2400	msiexec.exe
Token: SeSyncAgentPrivilege	2400	msiexec.exe
Token: SeEnableDelegationPrivilege	2400	msiexec.exe
Token: SeManageVolumePrivilege	2400	msiexec.exe
Token: SeImpersonatePrivilege	2400	msiexec.exe
Token: SeCreateGlobalPrivilege	2400	msiexec.exe
Token: SeCreateTokenPrivilege	2400	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2400	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2400	msiexec.exe
2400	msiexec.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2400	msiexec.exe
1084	msiexec.exe
1388	MsiExec.exe
2416	MsiExec.exe
5128	MsiExec.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1844 wrote to memory of 2400	1844	2026-07-23_1b66a222c74b7c889d96902260e81da8_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe	88
PID 1084 wrote to memory of 1388	1084	msiexec.exe	90
PID 1388 wrote to memory of 5084	1388	MsiExec.exe	91
PID 1084 wrote to memory of 3524	1084	msiexec.exe	96
PID 1084 wrote to memory of 2416	1084	msiexec.exe	98
PID 1084 wrote to memory of 5128	1084	msiexec.exe	99
PID 676 wrote to memory of 236	676	ScreenConnect.ClientService.exe	101

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-23_1b66a222c74b7c889d96902260e81da8_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-23_1b66a222c74b7c889d96902260e81da8_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1844
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\setup.msi"
  2⤵
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:2400

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1084
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding E04B322F4D37C35DB77DF1D31FD62F36 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1388
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIB116.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240759218 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:5084
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:3524
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 617B4171D1B187B1467269CCA89F89B3
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2416
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 76D546B7163B992204F4147C5D465541 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5128

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:1852

C:\Program Files (x86)\ScreenConnect Client (1830d7263bc4f64f)\ScreenConnect.ClientService.exe
"C:\Program Files (x86)\ScreenConnect Client (1830d7263bc4f64f)\ScreenConnect.ClientService.exe" "?e=Access&h=instance-ohfrcy-relay.screenconnect.com&p=443&s=ccb5a746-efb5-45d0-a17e-e1960fb41a37&k=BgIAAACkAABSU0ExAAgAAAEAAQBZBxE%2b%2fLmV2LWEo6f3GK6kMCawIOzG2i9%2fLGy74%2bJOSffsnxdF596HGQFsa5Xbt1odASOkNVzF%2b6%2fbeG05DFjayWyir4lssBizvNB2W8iUTyb9R%2fDlDWkZqxh2xJ%2bMYx59GuM6%2fFTsfAOeC8p5clju7OS20ktMN7bnRsFe7WUr3p03lX9z3bbLzx52ghTN7zX4EI4mAK1T99H%2bmkOqiGxSxtBZAkT1gbstSBa0768hMWd0fnoBJPifWdshoQagaofkAhkN8AmDk09yqRef%2bev7ajtvVp4oVIZtB1asKzUrKkdJQ6fG5%2f%2f5103L5NcU9l1OvtJZB%2foUpJoe2JmaD927"
1⤵
- Sets service image path in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:676
- C:\Program Files (x86)\ScreenConnect Client (1830d7263bc4f64f)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (1830d7263bc4f64f)\ScreenConnect.WindowsClient.exe" "RunRole" "201ff677-b529-4493-98e3-faaa42c16945" "User"
  2⤵
  - Executes dropped EXE
  PID:236

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59feaa.rbs

Path C:\Config.Msi\e59feaa.rbs
Size 213KB
SHA256 a65c84ff22fd677dfc35f3308943194218f3b6f3f3d4fdf0a464cab4f91d6292
MD5 47652f3dcb595c25d9b9fc9403ee8fc5
SHA1 c7251c54249cc6def8286d24bd38220f8301d58c
SHA512 9a94f5cc7b783cf7121b60c03e7a113686cebcea8e7875ac7194090859ad6d560d413a30814e4531b5db2f9b66a70edcf7f2998d13a8f3048ffbf9b1e5b24bb7
SSDEEP 3072:V39LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMGd:V3uH2aCGw1ST1wQLdqvd
TLSH
T1D6248D227480807EE7FA1A36D93F9A617E7CF6281760C59EC3848C1E5D604D06BF6B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.Override.en-US.resources

Path C:\Program Files (x86)\ScreenConnect Client (1830d7263bc4f64f)\Client.Override.en-US.resources
Size 336B
SHA256 5d51a011e7a175f62d08f4eefe57150effe9f391c9a9a246c8e4573cd6ba6f36
MD5 4647ae7b2e8789308ffc8b653fa49e7b
SHA1 2378c32820eeb6dfcb51304b1c94a68bcfcb335d
SHA512 80437455492b9d1e336e9d0e44e3c3234004e864b1c41c5d6fff4458882a864d959c4404eb59b34e74684a3303052c2963de9c84f06830c3ae34431bdc5b8539
TLSH
T1DDE0262733AC2836D0F2067B385A3083193BB57E8234486CE850311D4AB2A0ACF92A32
MD5 SHA1 SHA512 TLSH

Submit Download

Client.en-US.resources

Path C:\Program Files (x86)\ScreenConnect Client (1830d7263bc4f64f)\Client.en-US.resources
Size 47KB
SHA256 a023527e773b886fb64c5f31de484f659c5816cf4ab696be7c98a3ea4de57d41
MD5 e5d912067630d3efe53f290b9c9d0d27
SHA1 b0fc2105716c6eab770f89b9ed88ce2a36bdb5b2
SHA512 13fcb0f3f0208c072c86f1df8efe73cfade2803bc4b04e666787a95e10f49289fe6c1b8e10e7dbb5071cae92345fa12139fc220dc23dee4b098cc77fc53a316b
SSDEEP 768:T5F6LdqoaQZHw50YeOrmtxBQDu5CLHEFJ59UwgLJhwKa1wrvrMetEHWITF9:T5cLdqQZHw50YeOrmHBQDu5CLHEFJ59v
TLSH
T140231D1277FD0A18F5F36F45BE7A94619937BC5A2E25C06F1028855E09B2F80CAB2773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.resources

Path C:\Program Files (x86)\ScreenConnect Client (1830d7263bc4f64f)\Client.resources
Size 2KB
SHA256 2a9d8d6847f1fb064730c860a4c8aa71a347a54ef1f124ac5953c39de63b1393
MD5 2cd59b9cbcbb58544c8a0de1ef09c570
SHA1 b7717fbdbf5fb0189d0256a99a93b60f9b27e485
SHA512 59a09ccc2df55a52b02fcf8393f01d7483f51ace8b4acf54687af56c8f725d03e86cefb69909cd281f4da09b447b91e2731b1fc078f49f75be7a7068c3b4e4f2
TLSH
T16551DDCA3BFA3C74F5B75B736EB95451EE39FE1C3526C6AD1406841A2B213099880B37
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Client.dll

Path C:\Program Files (x86)\ScreenConnect Client (1830d7263bc4f64f)\ScreenConnect.Client.dll
Size 179KB
SHA256 4a49d6aba012345b5a8a5530a6e2bbca1841a954925ff531a00d77f959309d40
MD5 9393afc5cd81af67a37684aafa9dcaa1
SHA1 b1d64e2b15c7f38b15022433561808d3a32081c8
SHA512 cad554c10a3c562f76c7612b88a585ade9d1a60da62447008477c3dc6c3f566844458b05aba9a1fd2b86bb937cc5fd601b05f667f17d7b26dfff6d66ac8de036
SSDEEP 3072:HBJuFXzwA/bKvoRsj+3/HrzdMcCQzDafzVF:HBJgP/bKv2L/GcZCfzV
TLSH
T1AD04399573A88E2ACEAF4B73B55081258E7AAD546117F3EE8D147CF916B3340C6016F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Program Files (x86)\ScreenConnect Client (1830d7263bc4f64f)\ScreenConnect.ClientService.dll
Size 54KB
SHA256 a29af3350c607c2d492b08ed7fa18c426e8ef631a1fbdf62436831cb8eea81a0
MD5 20a8911f288f256b66336460a77ee3bf
SHA1 51e91ce0c28fb66e4c5ca2e1b88d3dd70d7b45f6
SHA512 c83e554d5864365da24a0f8afcd37b791a039f6a17435844928b0e39a10dd78608e4be0b21cdac9fb488e2c5ec24166dd468321d7ae3ef81da9e91f8250b3c90
SSDEEP 1536:+tazPGf/Yv8zq16f2u5CfQgVcE+S7wTbPTTY:+taDGHYvYq161YQgVQAOQ
TLSH
T110433C42A6BD4F36C9DF4E387CB6F14007F09D169563FB989E8DA4DA0A627C01A143DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Program Files (x86)\ScreenConnect Client (1830d7263bc4f64f)\ScreenConnect.ClientService.exe
Size 95KB
SHA256 e8a69ea4a6b59df0ee5f91768a41106494c9358682c5686a5061a58c0e2240c0
MD5 2f70085306af604f19a017706e670ca0
SHA1 be74d6bbb31ce9a91cb7766806fe0bea745e574c
SHA512 08a113c88bcbb309a5371cdc9e93335a56c3551871caf572fe5bb54fe5d189872233d3ae0e25bb8461d8d5d65078edac644c02095c088c0add95b658a174b76e
SSDEEP 1536:uEofEH5TJEVg5lJQKtFQrv+euEQdkWKCXHsWGKPtcdQgjR4rZv7UVPxg:boK5Cm5ntvQrGVEQ5KAwQgjR4rZvoJxg
TLSH
T174936A51B5D1C871E477593158E8DEB05A3EFD601E618EAB3388022B0FB51C19A35EBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Program Files (x86)\ScreenConnect Client (1830d7263bc4f64f)\ScreenConnect.Windows.dll
Size 1.6MB
SHA256 400edb602b31d44d6c04917ce2d85d54bea70f459bd755b5970a90954c439c63
MD5 1c9f3779f1c727e851f10cfcc1f359e1
SHA1 35a79a2d9521d317ef5b0fa40e7a3aa9c12c4905
SHA512 ef670c7e4ade6cc5c222c1848ab7131d5ae242732778b184ae6e0b023042aa0554c80704a7386b685820b3bf8d06fd31a74d05e4f7bbde0cebe6a30721b4dec3
SSDEEP 24576:OuiHedrimVsJq2l6TOKoMjSvShvU86+RfmT01krTFiH4SqfKPTsUTHEWEZfM14wC:SHwi963PSumT0+TFiH7efP
TLSH
T1CC75BE42F2D211F5D06B4478C8BE561BEB747C090320CBAF97D4BE66AD337D09A2A356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Program Files (x86)\ScreenConnect Client (1830d7263bc4f64f)\ScreenConnect.WindowsClient.exe
Size 559KB
SHA256 12a5bcd7dd8176d2bfab9592700773654aefb0f25da208808539f2e9f3ea5112
MD5 2628e414f08931053a8e54b528c7796f
SHA1 7834cd0084316bdbcb4af46625f2b9bec8952952
SHA512 0b3119c20ee8cf4cbaf2af78cc5e3c9553993488b065bd9330b7d8a6837a8070c77d3a242d04e4d2334dad4b1d3fff7101b1e23872767ae2c2880778f4daa963
SSDEEP 12288:kpL1GVq+NbBE0Z8XxFrIMkir7MklgcvOJddTvJU:4IV7ZiFEarngcGJdQ
TLSH
T10CC46CEA33B89A7AD9AF07BEF075180417B0DC4A6695E3DE5D80B4D90D863818E053F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Program Files (x86)\ScreenConnect Client (1830d7263bc4f64f)\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
TLSH
T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsCredentialProvider.dll

Path C:\Program Files (x86)\ScreenConnect Client (1830d7263bc4f64f)\ScreenConnect.WindowsCredentialProvider.dll
Size 746KB
SHA256 62b405f32a43da0c8e8ed14a58ec7b9b4422b154bfd4aed4f9be5de0bc6eb5e8
MD5 f01a59c5cf7ec437097d414d7c6d59c4
SHA1 9ea1c3fbf3b5adbe5a23578dea3b511d44e6a2dd
SHA512 587748ad4dd18677a3b7943eab1c0f8e77fe50a45e17266ba9a0e1363eda0ff1eabcf11884a5d608e23baf86af8f011db745ad06bcdecdfd01c20430745fe4bb
SSDEEP 12288:OQ+rYYCG4xWh6+/ZCXnZ9GTWGsP9fuApxEF:r+rYYCTMh6IZkkWNBzpGF
TLSH
T1EDF44A07EAA481ADD06DC17483635536B7B2FC860725B6AF17906A216F3BFD06B3D348
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.config

Path C:\Program Files (x86)\ScreenConnect Client (1830d7263bc4f64f)\app.config
Size 551B
SHA256 d11b6ccf9e181a4298f9e60718b7658365987d6baa548c8fc9b3206e90c15d45
MD5 220f1db7fbde64f91461efde107b84f9
SHA1 2cfc861767ede3e12a22432ffd20eb38fcba85bd
SHA512 c1cc14b1906c1a678d2099d90ff47939f1578d63a4acbc473b4e645079858f3f1ddc64c3a85c62db8ebc3ad0f6ed7d24e354ee182717465e1861c40665976d14
TLSH
T126F0BB2931C9BD2A16631E13E5234200BDB09EA21116686D30EE203BD7B65D513F32C7
MD5 SHA1 SHA512 TLSH

Submit Download

system.config

Path C:\Program Files (x86)\ScreenConnect Client (1830d7263bc4f64f)\system.config
Size 916B
SHA256 86da09d4493a392562deeeae059d1864f4e2b44d6a7efc275d24f72726dc3e25
MD5 3e81ff9a81b2c907762e38dca60e038b
SHA1 6d8dc5dee045f872d01612171107b30705b34e49
SHA512 5e2a8f9d1118ec5e457dd8e7a93a52c9d48ccd911818ad37dfd41210f2ed252aeb9ef86088ca88f600d026cfc3af4ae7bfc645ce6f2f212684cbaa1aa2100519
TLSH
T1011100A13184694B47B32923CD168725ED710F5B2454118D7ABE323AEF7189A0B9368E
MD5 SHA1 SHA512 TLSH

Submit Download

MSIB116.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSIB116.tmp
Size 1022KB
SHA256 9fef0e87140b52d5cd59af0e84805637b75dbaaf0321ff8ab625660486533a56
MD5 13c3805e771a38aaaec828908a8bed37
SHA1 00b02a8feb505922b9e459e3f4367042064281bf
SHA512 6f80c1c08cd3cb2a83e317eaccf0168ba4d4a115e17a218ba9c33e22aac6984ccec5132dd56e622918dbaaaa4ccc382d94242a41add7bcc14fc77fe579be785c
SSDEEP 24576:4UUGGF/6pzhEx3OJgoTtdiZg/hWGT5XexSVmQIh/:bGFSpN03ZoT1/hWGT5Xe0W1
TLSH
T1612523687AEA9075F3E336342C74A1A10AF97DB57E758089778A022D0DB1B81DB71373
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Deployment.WindowsInstaller.dll

Path C:\Users\Admin\AppData\Local\Temp\MSIB116.tmp-\Microsoft.Deployment.WindowsInstaller.dll
Size 172KB
SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
MD5 5ef88919012e4a3d8a1e2955dc8c8d81
SHA1 c0cfb830b8f1d990e3836e0bcc786e7972c9ed62
SHA512 4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684
SSDEEP 3072:FkfZS7FUguxN+77b1W5GR69UgoCaf8TpCnfKlRUjW01Ky4:x+c7b1W4R6joxfQE
TLSH
T14E045B2563FC473ECAEF87B4E2624251E7B2E2E97113DB0DDC8541AA2522780F792753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\MSIB116.tmp-\ScreenConnect.Core.dll
Size 482KB
SHA256 384a9cad42153fd4485dd4bf20f73ab803ed5a5d6d620d795747d5330ac8de1b
MD5 38592458c5907179b8be1b2fd31017c5
SHA1 88d7b00786b54da2bf287b5637a9429205380809
SHA512 94268cf89f1929a91face37ac44664c863d1d1fed8448213f4662249340617a5f1c0e95637ea4b3a5de5810ba7e9833e8ebdce68a27574b136ec28c50ac23d01
SSDEEP 6144:PvnEVyYEll17c/V7FagoEm5/CQdScM7Ic2gD8/8Gujvlx4kK4PVNy4Zc:nEVy7l/koz/cvDC
TLSH
T1DAA45B1A7FE88A6BC5AE077BF434541A4370DD0A710BE71F6698F4B82C87765DE001EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.InstallerActions.dll

Path C:\Users\Admin\AppData\Local\Temp\MSIB116.tmp-\ScreenConnect.InstallerActions.dll
Size 20KB
SHA256 b5f75aefa6eed74994781f13c10cc39d9e50440f3c58ce774c29d5124405d227
MD5 52673e58a3f9307d73ea738046bba833
SHA1 1d61f5a1a6abbb9f358846064f2ebfad580c8342
SHA512 b3001c7653f5cd3712377ecfc8e33e737afc73551364b9b95270810dc96cdeaa45a7a131167a59dc5d5591b2ac636b0059f01213182185ca69a286e3b4014edb
SSDEEP 384:pwMan2rcaQiyNMGqmtphaF/zeYc6rMbbJ1kjvIYU5y8o+jOMHPrbIR:SMgDS4tCgYcD95yuqMjbIR
TLSH
T17C928011A7EC172AF5FF2F74AEF211504B32BD62AE35DB1E1984504E4D32B449AA0B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.msi

Path C:\Users\Admin\AppData\Local\Temp\setup.msi
Size 2.8MB
SHA256 23a92293670d4c86bc0d1c6a8c248cc2ee716ccae6d22ef635d804b109622b26
MD5 e122d63b66532e2f1f12d528c55a0843
SHA1 8e493681a994d9087ff8d9b35ec559b9360d1fd6
SHA512 d0c6f729efebfef23069f33db7497a86295fdeee4994ba34dfcda72a2f77d07ecd77e13dc63c9be57f06f8b70d7e65505eeee32ee0049248a38967010cadb3a7
SSDEEP 49152:lZ+kOV6i3gVhSOEndgUd49GjJh4dYdJSBNGFSpN03ZoT1/hWGT5Xe0WK1g:lZYV6lVhSxWGIdYdsBNG0uWT5hWOgc
TLSH
T1EED5123136E8C13AE2B21A39E93A81F15979BD64DA23C05F53647D1E3971E809A73373
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI496.tmp

Path C:\Windows\Installer\MSI496.tmp
Size 202KB
SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
MD5 ba84dd4e0c1408828ccc1de09f585eda
SHA1 e8e10065d479f8f591b9885ea8487bc673301298
SHA512 7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290
SSDEEP 3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
TLSH
T129147C326494803EE7F91A36D93E9A61AE7DF6241760C99EC3848C0E5D604D06BF7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2fcmcojl.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1830d7263bc4f64f)\2fcmcojl.newcfg
Size 587B
SHA256 41a301580a2de2af816b4965bafed361fa637f38520eb078014b806d448ea357
MD5 e9d4b82e09c68d958c9f996c1671243b
SHA1 0b07408e3c73ce7398c7f869ccbb7419731fabfa
SHA512 db14d3bc37d7880ca8d0b8bcb5642dbca98abd2dfd06638da76311a7ea202c0afd0c981da6c8acc06565769de18a8651efdc233bea2ea1521839047445ef56de
TLSH
T13EF02BB531806E5A07A35D33C5114745FE726B9B0169249838AF617A9F311DB03A31DF
MD5 SHA1 SHA512 TLSH

Submit Download

3utv3d4o.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1830d7263bc4f64f)\3utv3d4o.newcfg
Size 587B
SHA256 a507cfdac923779940a24299527bb14719c9bda820ac99538b77e497290f2bab
MD5 5cdc135e465f0d7f51836f149d3b9ffb
SHA1 a826224fe62da6c1c49f27ba9b2627aae105f170
SHA512 00c79163981b554174a54b820a60a2d86e2db71dba9c83a21dd669f6b5fe8e24c975034a74971f6e7e01843f6a689284a9f095e39252aee4464135314a1a6da4
TLSH
T113F02BB531806E5A07A31E33C5114745FE716B9B01692498386F617A6F311DB03A31DF
MD5 SHA1 SHA512 TLSH

Submit Download

40xrezdk.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1830d7263bc4f64f)\40xrezdk.newcfg
Size 587B
SHA256 79e44add908bf3fc1d7a00207b0e45c60ecbef309defc7eb9811dce9e62ce6e5
MD5 0c77e3c4f3453801145e1b14ee51c72d
SHA1 c86ed393030a5382cb9b0025984b99f379dead2d
SHA512 79f510be8fd2cc5b8a462535724088993246c0f94e868baea4eafe127e033d9c9eb84613baf21586757f35d66f6639baec8ef48ae06bb5191eeb16cd495cc99b
TLSH
T130F08BB431806E5A07A31D33C5114345FE712B9B01682098386F617A5F311DB03A31DF
MD5 SHA1 SHA512 TLSH

Submit Download

41ksaws2.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1830d7263bc4f64f)\41ksaws2.newcfg
Size 587B
SHA256 981f263c8ab76e7e8098afbfccee405725dde067742c204d595b970e5fa70daa
MD5 de07bb863c2473d80fd1e810e6dbb60a
SHA1 c52ed5a1c64b3e1f9df16514315fe6c9763194c3
SHA512 205721acce6ce091fbe89c4a046e7ec6e5dfeed36b001b13df83d01ca6113c5cd8515231813dc5a296ed075d49c60c3bd4e7ec45b62ba5ee08f83c18024992a5
TLSH
T143F02BB531806E5A07A31D33C5124745FE716B9B01696498386F617A5F311DB03A35DF
MD5 SHA1 SHA512 TLSH

Submit Download

guz3cxca.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1830d7263bc4f64f)\guz3cxca.newcfg
Size 587B
SHA256 e026a9194cc0764c63293948a594b5dcea204d4c9aad72349ee1b6e9a8642867
MD5 fe73432482d95ecec61cfe55aaa94d92
SHA1 be7af4ece8394a9713971733715bafd3fb1c3224
SHA512 0b0df45a554018995a6021e7327d441d00bf19826b92d9a46209e18f22c50886197606e97c75c32e13685b816414f7cc29395a5be38fb486fb1fbe9c1eb428e5
TLSH
T133F02BB531806E5A07A35D33C5114745FD726B9B0169149838AF617A5F311DF03A35DF
MD5 SHA1 SHA512 TLSH

Submit Download

p0ijz3rz.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1830d7263bc4f64f)\p0ijz3rz.newcfg
Size 587B
SHA256 74f3b567a7b82baa02d16a526961193dff830788bfeba038107d368f82374c86
MD5 9b70702ca778af3eefbebc6376be3232
SHA1 b6b9c530f50b6298b3af171d3ebef7a40c0bc0a6
SHA512 40551d34ec770cb9ba9272d4475537052dac8708d56733b0e305421b43052cde6137d50714c8e0a827611245cd65432dfed807f11001cb41d2d0ea401ba17dc7
TLSH
T119F02BB531806E5A07A31D33C5114745FE716B9B11692498386F617A9F311DB03A31DF
MD5 SHA1 SHA512 TLSH

Submit Download

rb5ho1ce.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1830d7263bc4f64f)\rb5ho1ce.newcfg
Size 587B
SHA256 1ce819777d921c2c8e144878c0f78e551f24b2b20183f73b9dec82760d6cea31
MD5 05d15733fb9c471f46379062086aabe9
SHA1 7e24724f94e0639f8ad7e07f93baae4ac82f7a86
SHA512 49129577e37aacf53c3c8cd2524fa689b3eaaa6ee36ffcf1c3219c34eb95d52c72e1f3680d4b271bb7b6c4dfe414534a8efc377e665abfc63c573bd242969ebe
TLSH
T1A4F08BB431807E5A07A31D33C5114345FE312B9B00682098386F613A5F311DB03A31EF
MD5 SHA1 SHA512 TLSH

Submit Download

ssk0zbuw.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1830d7263bc4f64f)\ssk0zbuw.newcfg
Size 587B
SHA256 e3e939bc02ef418efb1d8fc4a3c0268c95bc09255e962bc418296503bbcd0515
MD5 53662226667d9ad04a0307de1eefd26b
SHA1 70e0897bd0fba7eef79e0d8d6f0d2968c75477f7
SHA512 0943e8f3425a9b0152802d3c453f1e09204f9ad5ca51479626f2818ef3819218ba0e719dd889dc9475cbd442cd13a9033caed6699142eea64374e27290ded354
TLSH
T1D1F02BB531806E5A07A31D33C5114745FE716B9B01A96498386F617A5F311DB03A31DF
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1830d7263bc4f64f)\user.config
Size 587B
SHA256 bf3b7d3d8ba38d2a7084b52483bbc23d6d195e0dbadf86c4c17aab44dc83131e
MD5 4df6d82abb51b0910502350d022b5c7d
SHA1 06e047635213eb4c9022428705c6804faae08dd0
SHA512 caf66cc3b45fa9af578811a56cf879c5c437db073ef155597a77a0b211b6ddbfb7873864bc204d54cf9b99f864ec260c81373434ab30a4e2f6406779a3ff6fb6
TLSH
T1F3F02BB531806E5A07A31E33C5114745FD716B9B01692498786F617A5F315DB03A31DF
MD5 SHA1 SHA512 TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 94a05185bfceac1b96abb50cd37aa41099f1f8a7ef15a1f7a687827b6f4eda41
MD5 37bad40de16a9c509b6bca465860ff1e
SHA1 62a1ff8f2ecf5148772619f42185b65df519f31b
SHA512 35c6c95b794d9104aa3951770945d9371e2dc25c22946d8800263f3ab63da6d99cbef8c47578acfb6cacd38cc4582bae61af107a603aa70783e57a166fa4e54a
SSDEEP 24576:NFo3DMP3doO/vvTL/yAjDilQP7eJY7Eg0+1xNudb1WtqJESTsIRmD6pin+n:fHk
TLSH
T1E757B31436F92200E7B79E3DB8F06A234D397D5BAC15DE8D45511B8E0822F71E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{60786b33-8e45-41ad-980b-1b6637697865}_OnDiskSnapshotProp

Path \??\Volume{c61fa831-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{60786b33-8e45-41ad-980b-1b6637697865}_OnDiskSnapshotProp
Size 6KB
SHA256 25446533d5afc99963c75aa3b3beb10b8afc81c8aa91b24f2c7de88b14e9c8dd
MD5 a505990211f7924175c4f0ef1aa9a4bf
SHA1 56df88f8c4fc3322359749caf4d8d3c2c694ed17
SHA512 df89878231f89a17addc633c52253f04c5ef2556ded344c76de996651d02d1b11f347b238f4b6f332c934c701d269f45e8a7cc4f4665fb185d597e3365133896
SSDEEP 96:FWI8MGbHvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:4I/qb++uVm
TLSH
T11AD167085AF54711E2B3AB3128F14557A877B911FF33CB8E0198238E6671A10F975F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/236-117-0x000000001B340000-0x000000001B4E0000-memory.dmp

Download

memory/236-115-0x00000000022A0000-0x00000000022D4000-memory.dmp

Download

memory/236-114-0x00000000000A0000-0x0000000000130000-memory.dmp

Download

memory/236-116-0x000000001B120000-0x000000001B19E000-memory.dmp

Download

memory/236-119-0x0000000002240000-0x0000000002254000-memory.dmp

Download

memory/236-118-0x000000001B4E0000-0x000000001B668000-memory.dmp

Download

memory/676-90-0x00000000047E0000-0x0000000004D9A000-memory.dmp

Download

memory/676-74-0x0000000003CF0000-0x0000000003D04000-memory.dmp

Download

memory/676-92-0x0000000004220000-0x00000000042B2000-memory.dmp

Download

memory/676-91-0x0000000003F80000-0x0000000003FD0000-memory.dmp

Download

memory/676-94-0x00000000042C0000-0x000000000437E000-memory.dmp

Download

memory/676-89-0x0000000004080000-0x0000000004220000-memory.dmp

Download

memory/676-80-0x0000000003D50000-0x0000000003D84000-memory.dmp

Download

memory/1844-6-0x0000000074580000-0x0000000074D3C000-memory.dmp

Download

memory/1844-11-0x0000000074580000-0x0000000074D3C000-memory.dmp

Download

memory/1844-8-0x0000000074580000-0x0000000074D3C000-memory.dmp

Download

memory/1844-0-0x0000000074592000-0x0000000074593000-memory.dmp

Download

memory/1844-7-0x0000000074580000-0x0000000074D3C000-memory.dmp

Download

memory/1844-5-0x0000000005A10000-0x0000000005A28000-memory.dmp

Download

memory/1844-4-0x0000000005980000-0x00000000059FE000-memory.dmp

Download

memory/1844-3-0x0000000074580000-0x0000000074D3C000-memory.dmp

Download

memory/1844-2-0x0000000005CE0000-0x0000000005F9E000-memory.dmp

Download

memory/1844-1-0x00000000033F0000-0x00000000033F8000-memory.dmp

Download

memory/5084-35-0x0000000005B60000-0x0000000005BDE000-memory.dmp

Download

memory/5084-31-0x0000000005A30000-0x0000000005A3C000-memory.dmp

Download

memory/5084-27-0x0000000005A40000-0x0000000005A6E000-memory.dmp

Download