Analysis
- max time kernel
148s - max time network
133s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/06/2026, 17:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-26_28603068b87fde90d95307477201a80a_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-26_28603068b87fde90d95307477201a80a_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
24 signatures
150 seconds
General
- Target 2026-06-26_28603068b87fde90d95307477201a80a_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe
- Size 16.3MB
- Sample260629-vy2pnact3l
- SHA256 07bce35e44a27fe43fa9ad078f2d158033af1f21271000296edb44be19909535
- MD5 28603068b87fde90d95307477201a80a
- SHA1 63a8ec63eebb95ba26d65682531538dad9e7a18b
- SHA512 d8ec9255efeee69f5d587a852aca3fc368e7fdd46706502550244c3001b6c973197306472e81f777858c289eb10d88ec3e81599b22b1b1b1ac145ed8acd7ef7b
- SSDEEP 393216:aCXvI5MvHxOJkCXvI5MvHxuCXvI5MvHxDCXvI5MvHxFCXvI5MvHxKCXvI5MvHxa:aZ6HxLZ6HxuZ6HxDZ6HxFZ6HxKZ6Hxa
- TLSH T1DB072211B3E585B6D0BF1678E8BD52654632FC144B26C2AF53A4796E2C32BC08E32777
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects encrypted or obfuscated .NET executables 1 IoCs
resource yara_rule behavioral2/files/0x001300000001c5b9-210.dat INDICATOR_EXE_DotNET_Encrypted - Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 2 4760 msiexec.exe 3 7108 rundll32.exe - Sets service image path in registry 3 TTPs 1 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (f0a1d97a83a887d2)\ImagePath = "\"C:\\Program Files (x86)\\ScreenConnect Client (f0a1d97a83a887d2)\\ScreenConnect.ClientService.exe\" \"?e=Access&y=Guest&h=instance-ediyf4-relay.screenconnect.com&p=443&s=efe1fcc7-1158-469a-9c91-7c8ed5157dfd&k=BgIAAACkAABSU0ExAAgAAAEAAQCReHGgrf3XaXSe2dPkrB4Z456fqczJCJtQP5XAki0XciL4hKQHd7OXKtQ3NPW6C%2bb11eXVUxLzCR%2fadAsxa7%2fwy%2bWuOj4gERXDGvS8KMPa48dexHFqKQ4iIbX6Dm2Qps72KSRfwVQFbqJlKWroOzAOc2DDvLlukMavy2jzFgVNFUtBv1yRwch5vdO4IX%2b7mvLVsfZoqOq3OPTdx2Vu7EXrvZYoypFK0eyG0wCXk3CEbND0HGCcBEafEoNOPZYPGGwQJfLY%2biiB50VQUjBxan8hy%2f%2bt%2fdTBrJ%2bUxpzDI5h5kK46eVp2i7XtyAwH0u7S0GlWI7We0BFsIzTIeoZbM8m8&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAA3qc5OM2qMUOYiHxwImzd2wAAAAACAAAAAAAQZgAAAAEAACAAAAACFE3VXEiKza8GZnR3WqthBDT0b1LlAXjroOHVHH4kLgAAAAAOgAAAAAIAACAAAAAeFAs%2fnHqmP1SrYdK%2fSHgg%2byPbvjs%2fpx3jkO25f5Mv1aAEAAA2hpiQt4dk3ZF4d0EcT%2bquUcQL%2fsT3DH%2bEBGug8%2frpk610oY4AhPyOObRdYeM4XojemWNr6O0j9E81pQ0HS91vPwVS4eMNWAtDqv66ABePbcRWhVwH9Qlrl%2feSgISOHqKnFZJSlRM6QzApPHw0U3I%2bGBVRRm80ZAgzE2a9lnSuMSbs977Ez2mmrhsabSCPWQkq%2fll5xglietRsgsmR15h3EXL6BCN5cJcrVzIUObEwdr%2byc2hQN9bauzpJ9Rtb3HU%2f7NDgeExDBV6wU61QSKMj9gy6dU4lPzvlbzFepuBO3AeBkuquTwjtk7Oq6RRyTKqH2qMcy8DT1ZLgFER4nj45JWihYBTKROwahGtkqpZyam1VWg2Asin0Jgqo2089ocP4pQm42r6fo9LbEmoCj2sKj%2f4Cq8Zxeodp19xdgatva168TvYUTUpWKhjiuRQiUBtMo0kFjviXxIJURkswI6mh%2bZd%2bvXfCB9YI6ZMn%2fvxvF6zpBHwK1EGBZm2zqATaJbBmS7OclpL7fnVI0du0jgOswYbaGXsmvSnTqcDx6PFsRvuUYLnqqloM2jCld0xOSFwQsZRMFMO3inHlo%2b5onBCM0rbC1JIY9Nl9JsgoaGorEXcs7GjOvjhkDa2AyafA9lQzQZqAteHh6aSPdWk4LSzWM0ZwyL0YVTPJkKt3R0veb7S4Xi7vfB5IU8hpjm4pM0yIfgLqy5%2bJ1KZpsI40RUYSJulk9LfHdrJiVOAgFHnpN5R3N7qfXC7MYUC5Pq4wHuH147Y8WPIV%2fl%2fkUVOELbEVBcxapQ7wMheooGQBUNSJjhmBW1K1hRIgwzuTnKfQJ7zdBr6Wgbly01o%2bkD5qr9EMUmiz21Q6SeMOUCtSmeLtHfVvUHFrm9OHE7iC%2beybohu%2fELZ8M9oBpmpTJQDh9NlzJHVvWjsQ72VNE6xProZG7TyGTob%2fqwAgCJIOvrVMIPgTH%2bthzEjQg0Gmx4Ooll4zjUaWoqphqcGoB26UCP%2bH%2b4wpl36yA%2fPfJfs7yDAzrekJ2JjtrFZunPQfmbgQuBjZXwFlsne07fyxK8HW1HRu9LJS2aZTAn4tPYlyV83CP1%2bQRfSH3%2bzekUoT9bvzsKuyZ4wCEtHChLImaHlZrISqgdl8uPRadE0ZL%2fOyfhtu9ZiSArKnMOMwJTCXWFSAyCJR4ZRI3G8nMX3jpNEfYZPkqocgRci9erExU5zcOyaqDVkk1mma9lIBqUWBgPMr3R5SGifVv8Yf7gsy6GR7rc9cYtI%2boHsJx7nFqKP0O5AqolGOXjCYmq9TkSk6EOD1btbfnAdNJNFG6OgBYYeAsKNi31YvTqBdr51I%2fkUKS5pg0Jb6whFaYixAlAS%2fDG%2bTgZxq%2fG2Y0QWk6hirkJ6mnonhDh5nTtw%2byxm%2b2pKyoLK%2bdWm76KKVP%2f5FqA1k1wYu52L4NV0AY%2fB%2bNdf1Dz6lISgsBYryLI0wREjG9BBshFJkkGZ8DgvWwb7RFsQ6ER59aAV%2fq9AH9m4e%2fWXsAAT%2fKlXGawXsWZEai1yttuceHMRrkhx2Vfg9huvL9HgkT9Yn4mC09ghvohrZhOSdeHlJ32pVMEAAAABmylScP%2fLDdo9SnSRDR%2fQ6wxxE1f8ywX0jC9KYP%2faI07Nb2mW6ShMAhq3Rp5GW0sxEIKC%2fwtFK4vMxQB5ME1Qe\"" ScreenConnect.ClientService.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe - Boot or Logon Autostart Execution: Authentication Package 1 TTPs 2 IoCs
Suspicious Windows Authentication Registry Modification.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\Authentication Packages = 6d007300760031005f003000000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800660030006100310064003900370061003800330061003800380037006400320029005c00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f0077007300410075007400680065006e007400690063006100740069006f006e005000610063006b006100670065002e0064006c006c0000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\Authentication Packages = 6d007300760031005f00300000000000 msiexec.exe - Drops file in System32 directory 12 IoCs
description ioc Process File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (f0a1d97a83a887d2)\jbbrtbyg.newcfg ScreenConnect.ClientService.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (f0a1d97a83a887d2)\user.config ScreenConnect.ClientService.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (f0a1d97a83a887d2)\jbbrtbyg.newcfg ScreenConnect.ClientService.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (f0a1d97a83a887d2)\g54g2xu0.newcfg ScreenConnect.ClientService.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (f0a1d97a83a887d2)\g54g2xu0.newcfg ScreenConnect.ClientService.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (f0a1d97a83a887d2)\jbbrtbyg.tmp ScreenConnect.ClientService.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (f0a1d97a83a887d2)\g54g2xu0.tmp ScreenConnect.ClientService.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (f0a1d97a83a887d2)\pna3ymvm.tmp ScreenConnect.ClientService.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (f0a1d97a83a887d2)\pna3ymvm.newcfg ScreenConnect.ClientService.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (f0a1d97a83a887d2)\pna3ymvm.newcfg ScreenConnect.ClientService.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (f0a1d97a83a887d2)\g4k3u4cz.tmp ScreenConnect.ClientService.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (f0a1d97a83a887d2)\g4k3u4cz.newcfg ScreenConnect.ClientService.exe - Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Drops file in Program Files directory 36 IoCs
description ioc Process File created C:\Program Files (x86)\ScreenConnect Client (f0a1d97a83a887d2)\ScreenConnect.WindowsBackstageShell.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (f0a1d97a83a887d2)\ScreenConnect.WindowsCredentialProvider.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (f0a1d97a83a887d2)\Client.resources msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (f0a1d97a83a887d2)\system.config msiexec.exe File opened for modification C:\Program Files (x86)\ScreenConnect Client (f0a1d97a83a887d2)\ScreenConnect.WindowsFileManager.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (f0a1d97a83a887d2)\app.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (f0a1d97a83a887d2)\ScreenConnect.Client.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (f0a1d97a83a887d2)\ScreenConnect.WindowsFileManager.exe.config msiexec.exe File opened for modification C:\Program Files (x86)\ScreenConnect Client (f0a1d97a83a887d2)\Client.resources msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (f0a1d97a83a887d2)\ScreenConnect.ClientService.dll msiexec.exe File opened for modification C:\Program Files (x86)\ScreenConnect Client (f0a1d97a83a887d2)\ScreenConnect.WindowsClient.exe.config msiexec.exe File opened for modification C:\Program Files (x86)\ScreenConnect Client (f0a1d97a83a887d2)\Client.en-US.resources msiexec.exe File opened for modification C:\Program Files (x86)\ScreenConnect Client (f0a1d97a83a887d2)\ScreenConnect.WindowsBackstageShell.exe msiexec.exe File opened for modification C:\Program Files (x86)\ScreenConnect Client (f0a1d97a83a887d2)\ScreenConnect.WindowsFileManager.exe.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (f0a1d97a83a887d2)\ScreenConnect.Windows.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (f0a1d97a83a887d2)\ScreenConnect.WindowsBackstageShell.exe.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (f0a1d97a83a887d2)\Client.en-US.resources msiexec.exe File opened for modification C:\Program Files (x86)\ScreenConnect Client (f0a1d97a83a887d2)\ScreenConnect.WindowsAuthenticationPackage.dll msiexec.exe File opened for modification C:\Program Files (x86)\ScreenConnect Client (f0a1d97a83a887d2)\ScreenConnect.WindowsCredentialProvider.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (f0a1d97a83a887d2)\ScreenConnect.Core.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (f0a1d97a83a887d2)\ScreenConnect.WindowsAuthenticationPackage.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (f0a1d97a83a887d2)\ScreenConnect.WindowsFileManager.exe msiexec.exe File opened for modification C:\Program Files (x86)\ScreenConnect Client (f0a1d97a83a887d2)\app.config msiexec.exe File opened for modification C:\Program Files (x86)\ScreenConnect Client (f0a1d97a83a887d2)\system.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (f0a1d97a83a887d2)\ScreenConnect.WindowsClient.exe.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (f0a1d97a83a887d2)\Client.Override.en-US.resources msiexec.exe File opened for modification C:\Program Files (x86)\ScreenConnect Client (f0a1d97a83a887d2)\ScreenConnect.ClientService.dll msiexec.exe File opened for modification C:\Program Files (x86)\ScreenConnect Client (f0a1d97a83a887d2)\ScreenConnect.WindowsClient.exe msiexec.exe File opened for modification C:\Program Files (x86)\ScreenConnect Client (f0a1d97a83a887d2)\ScreenConnect.Client.dll msiexec.exe File opened for modification C:\Program Files (x86)\ScreenConnect Client (f0a1d97a83a887d2)\Client.Override.en-US.resources msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (f0a1d97a83a887d2)\ScreenConnect.ClientService.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (f0a1d97a83a887d2)\ScreenConnect.WindowsClient.exe msiexec.exe File opened for modification C:\Program Files (x86)\ScreenConnect Client (f0a1d97a83a887d2)\ScreenConnect.Core.dll msiexec.exe File opened for modification C:\Program Files (x86)\ScreenConnect Client (f0a1d97a83a887d2)\ScreenConnect.Windows.dll msiexec.exe File opened for modification C:\Program Files (x86)\ScreenConnect Client (f0a1d97a83a887d2)\ScreenConnect.WindowsBackstageShell.exe.config msiexec.exe File opened for modification C:\Program Files (x86)\ScreenConnect Client (f0a1d97a83a887d2)\ScreenConnect.ClientService.exe msiexec.exe - Drops file in Windows directory 58 IoCs
description ioc Process File created C:\Windows\SystemTemp\ScreenConnect\26.3.11.9650\f0a1d97a83a887d2\ScreenConnect.ClientSetup.msi ScreenConnect.ClientSetup.exe File created C:\Windows\SystemTemp\~DF6864653F89F11A46.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF905AF50EDBD7F834.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI8BF0.tmp msiexec.exe File opened for modification C:\Windows\Installer\e588991.msi msiexec.exe File created C:\Windows\SystemTemp\~DFF324F8DE1B61313B.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF49A935928318C7CF.TMP msiexec.exe File created C:\Windows\Installer\e588991.msi msiexec.exe File created C:\Windows\SystemTemp\~DFEB434D3633706D2B.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF5C69959C6215F711.TMP msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSIC811.tmp-\ScreenConnect.WindowsInstaller.dll rundll32.exe File created C:\Windows\SystemTemp\~DF3840BA9CFE50CD88.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIC811.tmp-\ScreenConnect.InstallerActions.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIC811.tmp-\Microsoft.Deployment.WindowsInstaller.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIC811.tmp-\Microsoft.Deployment.Compression.Cab.dll rundll32.exe File created C:\Windows\SystemTemp\~DFD8EE3274414772C1.TMP msiexec.exe File created C:\Windows\Installer\SourceHash{6872076A-F322-098F-3B1A-57A0369403BB} msiexec.exe File opened for modification C:\Windows\Installer\{EE48CCC6-E41C-3A9E-405E-472C7AB59F52}\DefaultIcon msiexec.exe File opened for modification C:\Windows\Installer\MSID1E8.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF28DA5F6AF3E6E4D1.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIC811.tmp-\Microsoft.Deployment.WindowsInstaller.Package.dll rundll32.exe File created C:\Windows\SystemTemp\~DF3EA2248261C30342.TMP msiexec.exe File created C:\Windows\Installer\{6872076A-F322-098F-3B1A-57A0369403BB}\DefaultIcon msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\wix{EE48CCC6-E41C-3A9E-405E-472C7AB59F52}.SchedServiceConfig.rmi MsiExec.exe File opened for modification C:\Windows\Installer\MSIC811.tmp msiexec.exe File created C:\Windows\Installer\e5889aa.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\{EE48CCC6-E41C-3A9E-405E-472C7AB59F52}\DefaultIcon msiexec.exe File opened for modification C:\Windows\Installer\MSID08F.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF7AA5352CF159BE48.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF19E03AB12CE64912.TMP msiexec.exe File created C:\Windows\Installer\SourceHash{EE48CCC6-E41C-3A9E-405E-472C7AB59F52} msiexec.exe File created C:\Windows\SystemTemp\~DF83BC99F3FCEBE35B.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIC811.tmp-\Microsoft.Deployment.Compression.dll rundll32.exe File created C:\Windows\SystemTemp\~DF2EAEEDC5D3C10967.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSICF26.tmp msiexec.exe File created C:\Windows\Installer\wix{6872076A-F322-098F-3B1A-57A0369403BB}.SchedServiceConfig.rmi MsiExec.exe File created C:\Windows\Installer\e58898e.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI8D59.tmp msiexec.exe File created C:\Windows\SystemTemp\ScreenConnect\26.1.24.9579\ScreenConnect.ClientSetup.exe ScreenConnect.ClientService.exe File opened for modification C:\Windows\Installer\MSIC811.tmp-\CustomAction.config rundll32.exe File opened for modification C:\Windows\Installer\{6872076A-F322-098F-3B1A-57A0369403BB}\DefaultIcon msiexec.exe File created C:\Windows\SystemTemp\~DF83772700461B65EE.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF0E3E70EAB9684353.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIC811.tmp-\ScreenConnect.Windows.dll rundll32.exe File created C:\Windows\SystemTemp\~DFE1C5769F30AD14C6.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIC811.tmp-\ScreenConnect.Core.dll rundll32.exe File created C:\Windows\SystemTemp\~DF90A3524C382E4EE0.TMP msiexec.exe File created C:\Windows\SystemTemp\~DFF01D4D222723DE6F.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF2CDFAA075729A847.TMP msiexec.exe File created C:\Windows\SystemTemp\~DFB2B5D4F3C6A3462D.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSID0DE.tmp msiexec.exe File opened for modification C:\Windows\Installer\e58898e.msi msiexec.exe File created C:\Windows\SystemTemp\~DF820E16E8CF1DB8EF.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI8BA1.tmp msiexec.exe File created C:\Windows\Installer\e588990.msi msiexec.exe - Executes dropped EXE 7 IoCs
pid Process 4952 ScreenConnect.ClientService.exe 1996 ScreenConnect.WindowsClient.exe 4824 ScreenConnect.WindowsClient.exe 2648 ScreenConnect.ClientSetup.exe 5160 ScreenConnect.ClientService.exe 3104 ScreenConnect.WindowsClient.exe 1952 ScreenConnect.WindowsClient.exe - Loads dropped DLL 64 IoCs
pid Process 5860 MsiExec.exe 4588 rundll32.exe 4588 rundll32.exe 4588 rundll32.exe 4588 rundll32.exe 4588 rundll32.exe 4588 rundll32.exe 4588 rundll32.exe 4588 rundll32.exe 4588 rundll32.exe 5860 MsiExec.exe 7108 rundll32.exe 7108 rundll32.exe 7108 rundll32.exe 7108 rundll32.exe 7108 rundll32.exe 7108 rundll32.exe 7108 rundll32.exe 7108 rundll32.exe 7108 rundll32.exe 5860 MsiExec.exe 1944 rundll32.exe 1944 rundll32.exe 1944 rundll32.exe 1944 rundll32.exe 1944 rundll32.exe 1944 rundll32.exe 1944 rundll32.exe 1944 rundll32.exe 1944 rundll32.exe 2852 MsiExec.exe 5088 MsiExec.exe 4952 ScreenConnect.ClientService.exe 4952 ScreenConnect.ClientService.exe 4952 ScreenConnect.ClientService.exe 4952 ScreenConnect.ClientService.exe 4952 ScreenConnect.ClientService.exe 4952 ScreenConnect.ClientService.exe 4952 ScreenConnect.ClientService.exe 4952 ScreenConnect.ClientService.exe 4952 ScreenConnect.ClientService.exe 4952 ScreenConnect.ClientService.exe 2716 MsiExec.exe 6160 rundll32.exe 6160 rundll32.exe 6160 rundll32.exe 6160 rundll32.exe 6160 rundll32.exe 6160 rundll32.exe 6160 rundll32.exe 6160 rundll32.exe 6160 rundll32.exe 2716 MsiExec.exe 2716 MsiExec.exe 5160 ScreenConnect.ClientService.exe 5160 ScreenConnect.ClientService.exe 5160 ScreenConnect.ClientService.exe 5160 ScreenConnect.ClientService.exe 5160 ScreenConnect.ClientService.exe 5160 ScreenConnect.ClientService.exe 5160 ScreenConnect.ClientService.exe 5160 ScreenConnect.ClientService.exe 5160 ScreenConnect.ClientService.exe 5160 ScreenConnect.ClientService.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 14 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ScreenConnect.ClientSetup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ScreenConnect.ClientService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ScreenConnect.ClientService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-26_28603068b87fde90d95307477201a80a_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe - Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ScreenConnect.WindowsClient.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ScreenConnect.WindowsClient.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ScreenConnect.WindowsClient.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ScreenConnect.WindowsClient.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs msiexec.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0001\RegProcsHash = e574806f35135c2da88b9b0b6b14abd4165bb7a548d10d3662680fafce88f113 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" ScreenConnect.WindowsClient.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" ScreenConnect.WindowsClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000 msiexec.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0001\Owner = 880c00002e17da40ec07dd01 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0002 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0002 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ ScreenConnect.WindowsClient.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" ScreenConnect.WindowsClient.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" ScreenConnect.ClientSetup.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed msiexec.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0002\Owner = 2c1900001dbb9735ec07dd01 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ ScreenConnect.ClientSetup.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" ScreenConnect.ClientService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" ScreenConnect.ClientSetup.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates msiexec.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800660030006100310064003900370061003800330061003800380037006400320029005c00530063007200650065006e0043006f006e006e006500630074002e0043006c00690065006e00740053006500720076006900630065002e0064006c006c00000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800660030006100310064003900370061003800330061003800380037006400320029005c00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f007700730043006c00690065006e0074002e00650078006500000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800660030006100310064003900370061003800330061003800380037006400320029005c00530063007200650065006e0043006f006e006e006500630074002e0043006c00690065006e0074002e0064006c006c00000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800660030006100310064003900370061003800330061003800380037006400320029005c00530063007200650065006e0043006f006e006e006500630074002e0043006f00720065002e0064006c006c00000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800660030006100310064003900370061003800330061003800380037006400320029005c00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f00770073002e0064006c006c00000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800660030006100310064003900370061003800330061003800380037006400320029005c00530063007200650065006e0043006f006e006e006500630074002e0043006c00690065006e00740053006500720076006900630065002e0065007800650000000000 msiexec.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0001\RegProcsHash = d69d73b42859366b34d6782f645833af01f981c2234b49479ce64cf3a5a753e5 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" ScreenConnect.WindowsClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" ScreenConnect.WindowsClient.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" ScreenConnect.ClientService.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" ScreenConnect.WindowsClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot msiexec.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0001\RegProcs0000 = 300030003000300030003700630063003a00300031006400640030003700650063003a003300390035006400660034006300320000000000 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000 msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0001\Sequence = "1" msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Sequence = "2" msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Sequence = "3" msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0001 msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0002\Sequence = "1" msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" ScreenConnect.ClientService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0001 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ ScreenConnect.ClientService.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000 msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" ScreenConnect.WindowsClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs msiexec.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-f0a1d97a83a887d2\shell\open\command msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6CCC84EEC14EE9A304E574C2A75BF925\ProductName = "ScreenConnect Client (f0a1d97a83a887d2)" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6CCC84EEC14EE9A304E574C2A75BF925 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A6702786223FF890B3A1750A634930BB\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6CCC84EEC14EE9A304E574C2A75BF925 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6CCC84EEC14EE9A304E574C2A75BF925\SourceList\PackageName = "ScreenConnect.ClientSetup.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A6702786223FF890B3A1750A634930BB msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A6702786223FF890B3A1750A634930BB\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6CCC84EEC14EE9A304E574C2A75BF925\SourceList\Media msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6CCC84EEC14EE9A304E574C2A75BF925\SourceList\Net msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6CCC84EEC14EE9A304E574C2A75BF925\SourceList msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-2A5D-A892CD44821E}\InprocServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A6702786223FF890B3A1750A634930BB\PackageCode = "A6702786223FF890B3A1750A634930BB" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6CCC84EEC14EE9A304E574C2A75BF925\Full msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6CCC84EEC14EE9A304E574C2A75BF925\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\26.1.24.9579\\f0a1d97a83a887d2\\" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6CCC84EEC14EE9A304E574C2A75BF925\Version = "436273176" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\A6702786223FF890B3A1750A634930BB msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A6702786223FF890B3A1750A634930BB\SourceList\LastUsedSource = "n;1;C:\\Windows\\SystemTemp\\ScreenConnect\\26.3.11.9650\\f0a1d97a83a887d2\\" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-2A5D-A892CD44821E} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-2A5D-A892CD44821E}\InprocServer32\ThreadingModel = "Apartment" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\45A7E6BD82E7F5FF0F1A9DA7388A782D msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6CCC84EEC14EE9A304E574C2A75BF925\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6CCC84EEC14EE9A304E574C2A75BF925\SourceList\Media\1 = ";" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A6702786223FF890B3A1750A634930BB\SourceList\Media\1 = ";" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-f0a1d97a83a887d2 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6CCC84EEC14EE9A304E574C2A75BF925\Assignment = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\45A7E6BD82E7F5FF0F1A9DA7388A782D\6CCC84EEC14EE9A304E574C2A75BF925 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6CCC84EEC14EE9A304E574C2A75BF925\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\26.1.24.9579\\f0a1d97a83a887d2\\" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A6702786223FF890B3A1750A634930BB\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A6702786223FF890B3A1750A634930BB\SourceList\Net\1 = "C:\\Windows\\SystemTemp\\ScreenConnect\\26.3.11.9650\\f0a1d97a83a887d2\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-f0a1d97a83a887d2\shell msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A6702786223FF890B3A1750A634930BB\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-f0a1d97a83a887d2\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (f0a1d97a83a887d2)\\ScreenConnect.WindowsClient.exe\" \"%1\"" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6CCC84EEC14EE9A304E574C2A75BF925\AdvertiseFlags = "388" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6CCC84EEC14EE9A304E574C2A75BF925\SourceList\Media msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A6702786223FF890B3A1750A634930BB\Language = "1033" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\45A7E6BD82E7F5FF0F1A9DA7388A782D\A6702786223FF890B3A1750A634930BB msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A6702786223FF890B3A1750A634930BB\SourceList\Media msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-2A5D-A892CD44821E} msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-2A5D-A892CD44821E}\InprocServer32 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6CCC84EEC14EE9A304E574C2A75BF925\DeploymentFlags = "3" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A6702786223FF890B3A1750A634930BB\Version = "436404235" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A6702786223FF890B3A1750A634930BB\AdvertiseFlags = "388" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\sc-f0a1d97a83a887d2\shell\open\command msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-2A5D-A892CD44821E}\ = "ScreenConnect Client (f0a1d97a83a887d2) Credential Provider" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6CCC84EEC14EE9A304E574C2A75BF925 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6CCC84EEC14EE9A304E574C2A75BF925\Language = "1033" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6CCC84EEC14EE9A304E574C2A75BF925\Clients = 3a0000000000 msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\sc-f0a1d97a83a887d2\shell msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A6702786223FF890B3A1750A634930BB\InstanceType = "0" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\sc-f0a1d97a83a887d2 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6CCC84EEC14EE9A304E574C2A75BF925\ProductIcon = "C:\\Windows\\Installer\\{EE48CCC6-E41C-3A9E-405E-472C7AB59F52}\\DefaultIcon" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6CCC84EEC14EE9A304E574C2A75BF925\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6CCC84EEC14EE9A304E574C2A75BF925\SourceList msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\sc-f0a1d97a83a887d2\shell\open msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-f0a1d97a83a887d2\URL Protocol msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-f0a1d97a83a887d2\shell\open msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-2A5D-A892CD44821E}\InprocServer32\ = "C:\\Program Files (x86)\\ScreenConnect Client (f0a1d97a83a887d2)\\ScreenConnect.WindowsCredentialProvider.dll" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6CCC84EEC14EE9A304E574C2A75BF925\InstanceType = "0" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6CCC84EEC14EE9A304E574C2A75BF925 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A6702786223FF890B3A1750A634930BB\ProductIcon = "C:\\Windows\\Installer\\{6872076A-F322-098F-3B1A-57A0369403BB}\\DefaultIcon" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-f0a1d97a83a887d2\UseOriginalUrlEncoding = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6CCC84EEC14EE9A304E574C2A75BF925\PackageCode = "6CCC84EEC14EE9A304E574C2A75BF925" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\45A7E6BD82E7F5FF0F1A9DA7388A782D msiexec.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 6444 msiexec.exe 6444 msiexec.exe 4952 ScreenConnect.ClientService.exe 4952 ScreenConnect.ClientService.exe 4952 ScreenConnect.ClientService.exe 4952 ScreenConnect.ClientService.exe 4952 ScreenConnect.ClientService.exe 4952 ScreenConnect.ClientService.exe 6444 msiexec.exe 6444 msiexec.exe 6444 msiexec.exe 6444 msiexec.exe 6444 msiexec.exe 6444 msiexec.exe 6444 msiexec.exe 6444 msiexec.exe 6444 msiexec.exe 6444 msiexec.exe 3208 msiexec.exe 3208 msiexec.exe 3208 msiexec.exe 3208 msiexec.exe 3208 msiexec.exe 3208 msiexec.exe 3208 msiexec.exe 3208 msiexec.exe 3208 msiexec.exe 3208 msiexec.exe 6444 msiexec.exe 6444 msiexec.exe 6444 msiexec.exe 6444 msiexec.exe 6444 msiexec.exe 6444 msiexec.exe 6444 msiexec.exe 6444 msiexec.exe 6444 msiexec.exe 6444 msiexec.exe 3208 msiexec.exe 3208 msiexec.exe 3208 msiexec.exe 3208 msiexec.exe 3208 msiexec.exe 3208 msiexec.exe 3208 msiexec.exe 3208 msiexec.exe 3208 msiexec.exe 3208 msiexec.exe 6444 msiexec.exe 6444 msiexec.exe 6444 msiexec.exe 6444 msiexec.exe 6444 msiexec.exe 6444 msiexec.exe 6444 msiexec.exe 6444 msiexec.exe 6444 msiexec.exe 6444 msiexec.exe 6444 msiexec.exe 6444 msiexec.exe 6444 msiexec.exe 6444 msiexec.exe 6444 msiexec.exe 6444 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1072 2026-06-26_28603068b87fde90d95307477201a80a_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe Token: SeShutdownPrivilege 4760 msiexec.exe Token: SeIncreaseQuotaPrivilege 4760 msiexec.exe Token: SeSecurityPrivilege 6444 msiexec.exe Token: SeCreateTokenPrivilege 4760 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4760 msiexec.exe Token: SeLockMemoryPrivilege 4760 msiexec.exe Token: SeIncreaseQuotaPrivilege 4760 msiexec.exe Token: SeMachineAccountPrivilege 4760 msiexec.exe Token: SeTcbPrivilege 4760 msiexec.exe Token: SeSecurityPrivilege 4760 msiexec.exe Token: SeTakeOwnershipPrivilege 4760 msiexec.exe Token: SeLoadDriverPrivilege 4760 msiexec.exe Token: SeSystemProfilePrivilege 4760 msiexec.exe Token: SeSystemtimePrivilege 4760 msiexec.exe Token: SeProfSingleProcessPrivilege 4760 msiexec.exe Token: SeIncBasePriorityPrivilege 4760 msiexec.exe Token: SeCreatePagefilePrivilege 4760 msiexec.exe Token: SeCreatePermanentPrivilege 4760 msiexec.exe Token: SeBackupPrivilege 4760 msiexec.exe Token: SeRestorePrivilege 4760 msiexec.exe Token: SeShutdownPrivilege 4760 msiexec.exe Token: SeDebugPrivilege 4760 msiexec.exe Token: SeAuditPrivilege 4760 msiexec.exe Token: SeSystemEnvironmentPrivilege 4760 msiexec.exe Token: SeChangeNotifyPrivilege 4760 msiexec.exe Token: SeRemoteShutdownPrivilege 4760 msiexec.exe Token: SeUndockPrivilege 4760 msiexec.exe Token: SeSyncAgentPrivilege 4760 msiexec.exe Token: SeEnableDelegationPrivilege 4760 msiexec.exe Token: SeManageVolumePrivilege 4760 msiexec.exe Token: SeImpersonatePrivilege 4760 msiexec.exe Token: SeCreateGlobalPrivilege 4760 msiexec.exe Token: SeCreateTokenPrivilege 4760 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4760 msiexec.exe Token: SeLockMemoryPrivilege 4760 msiexec.exe Token: SeIncreaseQuotaPrivilege 4760 msiexec.exe Token: SeMachineAccountPrivilege 4760 msiexec.exe Token: SeTcbPrivilege 4760 msiexec.exe Token: SeSecurityPrivilege 4760 msiexec.exe Token: SeTakeOwnershipPrivilege 4760 msiexec.exe Token: SeLoadDriverPrivilege 4760 msiexec.exe Token: SeSystemProfilePrivilege 4760 msiexec.exe Token: SeSystemtimePrivilege 4760 msiexec.exe Token: SeProfSingleProcessPrivilege 4760 msiexec.exe Token: SeIncBasePriorityPrivilege 4760 msiexec.exe Token: SeCreatePagefilePrivilege 4760 msiexec.exe Token: SeCreatePermanentPrivilege 4760 msiexec.exe Token: SeBackupPrivilege 4760 msiexec.exe Token: SeRestorePrivilege 4760 msiexec.exe Token: SeShutdownPrivilege 4760 msiexec.exe Token: SeDebugPrivilege 4760 msiexec.exe Token: SeAuditPrivilege 4760 msiexec.exe Token: SeSystemEnvironmentPrivilege 4760 msiexec.exe Token: SeChangeNotifyPrivilege 4760 msiexec.exe Token: SeRemoteShutdownPrivilege 4760 msiexec.exe Token: SeUndockPrivilege 4760 msiexec.exe Token: SeSyncAgentPrivilege 4760 msiexec.exe Token: SeEnableDelegationPrivilege 4760 msiexec.exe Token: SeManageVolumePrivilege 4760 msiexec.exe Token: SeImpersonatePrivilege 4760 msiexec.exe Token: SeCreateGlobalPrivilege 4760 msiexec.exe Token: SeCreateTokenPrivilege 4760 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4760 msiexec.exe - Suspicious use of FindShellTrayWindow 12 IoCs
pid Process 4760 msiexec.exe 4760 msiexec.exe 1996 ScreenConnect.WindowsClient.exe 1996 ScreenConnect.WindowsClient.exe 1996 ScreenConnect.WindowsClient.exe 1996 ScreenConnect.WindowsClient.exe 1996 ScreenConnect.WindowsClient.exe 1996 ScreenConnect.WindowsClient.exe 3104 ScreenConnect.WindowsClient.exe 3104 ScreenConnect.WindowsClient.exe 3104 ScreenConnect.WindowsClient.exe 3104 ScreenConnect.WindowsClient.exe - Suspicious use of SendNotifyMessage 10 IoCs
pid Process 1996 ScreenConnect.WindowsClient.exe 1996 ScreenConnect.WindowsClient.exe 1996 ScreenConnect.WindowsClient.exe 1996 ScreenConnect.WindowsClient.exe 1996 ScreenConnect.WindowsClient.exe 1996 ScreenConnect.WindowsClient.exe 3104 ScreenConnect.WindowsClient.exe 3104 ScreenConnect.WindowsClient.exe 3104 ScreenConnect.WindowsClient.exe 3104 ScreenConnect.WindowsClient.exe - Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 4760 msiexec.exe 6444 msiexec.exe 5860 MsiExec.exe 2852 MsiExec.exe 5088 MsiExec.exe 3208 msiexec.exe 2716 MsiExec.exe - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 1072 wrote to memory of 4760 1072 2026-06-26_28603068b87fde90d95307477201a80a_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe 88 PID 6444 wrote to memory of 5860 6444 msiexec.exe 90 PID 5860 wrote to memory of 4588 5860 MsiExec.exe 91 PID 5860 wrote to memory of 7108 5860 MsiExec.exe 92 PID 5860 wrote to memory of 1944 5860 MsiExec.exe 93 PID 6444 wrote to memory of 2852 6444 msiexec.exe 96 PID 6444 wrote to memory of 5088 6444 msiexec.exe 97 PID 4952 wrote to memory of 1996 4952 ScreenConnect.ClientService.exe 99 PID 4952 wrote to memory of 4824 4952 ScreenConnect.ClientService.exe 100 PID 4952 wrote to memory of 2648 4952 ScreenConnect.ClientService.exe 102 PID 2648 wrote to memory of 3208 2648 ScreenConnect.ClientSetup.exe 103 PID 6444 wrote to memory of 2716 6444 msiexec.exe 104 PID 2716 wrote to memory of 6160 2716 MsiExec.exe 105 PID 5160 wrote to memory of 3104 5160 ScreenConnect.ClientService.exe 107 PID 5160 wrote to memory of 1952 5160 ScreenConnect.ClientService.exe 108 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-26_28603068b87fde90d95307477201a80a_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-26_28603068b87fde90d95307477201a80a_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\26.1.24.9579\f0a1d97a83a887d2\ScreenConnect.ClientSetup.msi" SC_EXE_PATH="C:\Users\Admin\AppData\Local\Temp\2026-06-26_28603068b87fde90d95307477201a80a_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe"2⤵
- Badlisted process makes network request
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4760
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Boot or Logon Autostart Execution: Authentication Package
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6444 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding D61924C0A28BD2CAF33F6516EA0E904C C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5860 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI7DA7.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240680515 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4588
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI8161.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240681343 10 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.CheckMsiMotw3⤵
- Badlisted process makes network request
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:7108
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI86A2.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240682781 17 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.CheckMsiFileName3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1944
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 3BB5D2840DCCE580CB0B267323EA3BB52⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2852
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 8006ABFA8AAC43D11E8B1913F053C315 E Global\MSI00002⤵
- Drops file in Windows directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5088
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 2FBADE9185407E85DCCE0B445D39E5FE E Global\MSI00002⤵
- Drops file in Windows directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSIC811.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240699468 12 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
- Drops file in Windows directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:6160
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:1720
-
C:\Program Files (x86)\ScreenConnect Client (f0a1d97a83a887d2)\ScreenConnect.ClientService.exe"C:\Program Files (x86)\ScreenConnect Client (f0a1d97a83a887d2)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=instance-ediyf4-relay.screenconnect.com&p=443&s=efe1fcc7-1158-469a-9c91-7c8ed5157dfd&k=BgIAAACkAABSU0ExAAgAAAEAAQCReHGgrf3XaXSe2dPkrB4Z456fqczJCJtQP5XAki0XciL4hKQHd7OXKtQ3NPW6C%2bb11eXVUxLzCR%2fadAsxa7%2fwy%2bWuOj4gERXDGvS8KMPa48dexHFqKQ4iIbX6Dm2Qps72KSRfwVQFbqJlKWroOzAOc2DDvLlukMavy2jzFgVNFUtBv1yRwch5vdO4IX%2b7mvLVsfZoqOq3OPTdx2Vu7EXrvZYoypFK0eyG0wCXk3CEbND0HGCcBEafEoNOPZYPGGwQJfLY%2biiB50VQUjBxan8hy%2f%2bt%2fdTBrJ%2bUxpzDI5h5kK46eVp2i7XtyAwH0u7S0GlWI7We0BFsIzTIeoZbM8m8"1⤵
- Sets service image path in registry
- Drops file in System32 directory
- Drops file in Windows directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Program Files (x86)\ScreenConnect Client (f0a1d97a83a887d2)\ScreenConnect.WindowsClient.exe"C:\Program Files (x86)\ScreenConnect Client (f0a1d97a83a887d2)\ScreenConnect.WindowsClient.exe" "RunRole" "ad06aaca-e35c-45d1-a710-8923c307d59d" "User"2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1996
-
-
C:\Program Files (x86)\ScreenConnect Client (f0a1d97a83a887d2)\ScreenConnect.WindowsClient.exe"C:\Program Files (x86)\ScreenConnect Client (f0a1d97a83a887d2)\ScreenConnect.WindowsClient.exe" "RunRole" "8276bc71-8433-4e38-8a38-1f9d00d9e9ca" "System"2⤵
- Executes dropped EXE
- Checks processor information in registry
- Modifies data under HKEY_USERS
PID:4824
-
-
C:\Windows\SystemTemp\ScreenConnect\26.1.24.9579\ScreenConnect.ClientSetup.exe"C:\Windows\SystemTemp\ScreenConnect\26.1.24.9579\ScreenConnect.ClientSetup.exe"2⤵
- Drops file in Windows directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Windows\SystemTemp\ScreenConnect\26.3.11.9650\f0a1d97a83a887d2\ScreenConnect.ClientSetup.msi" SC_EXE_PATH="C:\Windows\SystemTemp\ScreenConnect\26.1.24.9579\ScreenConnect.ClientSetup.exe"3⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3208
-
-
-
C:\Program Files (x86)\ScreenConnect Client (f0a1d97a83a887d2)\ScreenConnect.ClientService.exe"C:\Program Files (x86)\ScreenConnect Client (f0a1d97a83a887d2)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=instance-ediyf4-relay.screenconnect.com&p=443&s=efe1fcc7-1158-469a-9c91-7c8ed5157dfd&k=BgIAAACkAABSU0ExAAgAAAEAAQCReHGgrf3XaXSe2dPkrB4Z456fqczJCJtQP5XAki0XciL4hKQHd7OXKtQ3NPW6C%2bb11eXVUxLzCR%2fadAsxa7%2fwy%2bWuOj4gERXDGvS8KMPa48dexHFqKQ4iIbX6Dm2Qps72KSRfwVQFbqJlKWroOzAOc2DDvLlukMavy2jzFgVNFUtBv1yRwch5vdO4IX%2b7mvLVsfZoqOq3OPTdx2Vu7EXrvZYoypFK0eyG0wCXk3CEbND0HGCcBEafEoNOPZYPGGwQJfLY%2biiB50VQUjBxan8hy%2f%2bt%2fdTBrJ%2bUxpzDI5h5kK46eVp2i7XtyAwH0u7S0GlWI7We0BFsIzTIeoZbM8m8&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAA3qc5OM2qMUOYiHxwImzd2wAAAAACAAAAAAAQZgAAAAEAACAAAAACFE3VXEiKza8GZnR3WqthBDT0b1LlAXjroOHVHH4kLgAAAAAOgAAAAAIAACAAAAAeFAs%2fnHqmP1SrYdK%2fSHgg%2byPbvjs%2fpx3jkO25f5Mv1aAEAAA2hpiQt4dk3ZF4d0EcT%2bquUcQL%2fsT3DH%2bEBGug8%2frpk610oY4AhPyOObRdYeM4XojemWNr6O0j9E81pQ0HS91vPwVS4eMNWAtDqv66ABePbcRWhVwH9Qlrl%2feSgISOHqKnFZJSlRM6QzApPHw0U3I%2bGBVRRm80ZAgzE2a9lnSuMSbs977Ez2mmrhsabSCPWQkq%2fll5xglietRsgsmR15h3EXL6BCN5cJcrVzIUObEwdr%2byc2hQN9bauzpJ9Rtb3HU%2f7NDgeExDBV6wU61QSKMj9gy6dU4lPzvlbzFepuBO3AeBkuquTwjtk7Oq6RRyTKqH2qMcy8DT1ZLgFER4nj45JWihYBTKROwahGtkqpZyam1VWg2Asin0Jgqo2089ocP4pQm42r6fo9LbEmoCj2sKj%2f4Cq8Zxeodp19xdgatva168TvYUTUpWKhjiuRQiUBtMo0kFjviXxIJURkswI6mh%2bZd%2bvXfCB9YI6ZMn%2fvxvF6zpBHwK1EGBZm2zqATaJbBmS7OclpL7fnVI0du0jgOswYbaGXsmvSnTqcDx6PFsRvuUYLnqqloM2jCld0xOSFwQsZRMFMO3inHlo%2b5onBCM0rbC1JIY9Nl9JsgoaGorEXcs7GjOvjhkDa2AyafA9lQzQZqAteHh6aSPdWk4LSzWM0ZwyL0YVTPJkKt3R0veb7S4Xi7vfB5IU8hpjm4pM0yIfgLqy5%2bJ1KZpsI40RUYSJulk9LfHdrJiVOAgFHnpN5R3N7qfXC7MYUC5Pq4wHuH147Y8WPIV%2fl%2fkUVOELbEVBcxapQ7wMheooGQBUNSJjhmBW1K1hRIgwzuTnKfQJ7zdBr6Wgbly01o%2bkD5qr9EMUmiz21Q6SeMOUCtSmeLtHfVvUHFrm9OHE7iC%2beybohu%2fELZ8M9oBpmpTJQDh9NlzJHVvWjsQ72VNE6xProZG7TyGTob%2fqwAgCJIOvrVMIPgTH%2bthzEjQg0Gmx4Ooll4zjUaWoqphqcGoB26UCP%2bH%2b4wpl36yA%2fPfJfs7yDAzrekJ2JjtrFZunPQfmbgQuBjZXwFlsne07fyxK8HW1HRu9LJS2aZTAn4tPYlyV83CP1%2bQRfSH3%2bzekUoT9bvzsKuyZ4wCEtHChLImaHlZrISqgdl8uPRadE0ZL%2fOyfhtu9ZiSArKnMOMwJTCXWFSAyCJR4ZRI3G8nMX3jpNEfYZPkqocgRci9erExU5zcOyaqDVkk1mma9lIBqUWBgPMr3R5SGifVv8Yf7gsy6GR7rc9cYtI%2boHsJx7nFqKP0O5AqolGOXjCYmq9TkSk6EOD1btbfnAdNJNFG6OgBYYeAsKNi31YvTqBdr51I%2fkUKS5pg0Jb6whFaYixAlAS%2fDG%2bTgZxq%2fG2Y0QWk6hirkJ6mnonhDh5nTtw%2byxm%2b2pKyoLK%2bdWm76KKVP%2f5FqA1k1wYu52L4NV0AY%2fB%2bNdf1Dz6lISgsBYryLI0wREjG9BBshFJkkGZ8DgvWwb7RFsQ6ER59aAV%2fq9AH9m4e%2fWXsAAT%2fKlXGawXsWZEai1yttuceHMRrkhx2Vfg9huvL9HgkT9Yn4mC09ghvohrZhOSdeHlJ32pVMEAAAABmylScP%2fLDdo9SnSRDR%2fQ6wxxE1f8ywX0jC9KYP%2faI07Nb2mW6ShMAhq3Rp5GW0sxEIKC%2fwtFK4vMxQB5ME1Qe"1⤵
- Drops file in System32 directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:5160 -
C:\Program Files (x86)\ScreenConnect Client (f0a1d97a83a887d2)\ScreenConnect.WindowsClient.exe"C:\Program Files (x86)\ScreenConnect Client (f0a1d97a83a887d2)\ScreenConnect.WindowsClient.exe" "RunRole" "6806e74b-094c-4dc4-80f5-2daffd1612c8" "User"2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3104
-
-
C:\Program Files (x86)\ScreenConnect Client (f0a1d97a83a887d2)\ScreenConnect.WindowsClient.exe"C:\Program Files (x86)\ScreenConnect Client (f0a1d97a83a887d2)\ScreenConnect.WindowsClient.exe" "RunRole" "1141f8e0-a18b-42a9-9b71-f62f175d1a77" "System"2⤵
- Executes dropped EXE
- Checks processor information in registry
- Modifies data under HKEY_USERS
PID:1952
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Authentication Package
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
2Authentication Package
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Component Object Model Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e58898f.rbs
- Size 214KB
- SHA256 8b5bed870319f4303c708b40f57e38361a8948e266a3104d9f90900a4b3aca67
- MD5 234e23f3d8c4267f7c68834da9481090
- SHA1 fe45b30a010163112785a5e96e774c392c05c128
- SHA512 9fb8bda6a013eacaac9e911b3d89bb45fa8ed04d8418bf5ee12bc0007a53beaaecdd574f5d3c6684162fe6b1b8423a09ce83a888ebff27d239b58f35a672521a
- SSDEEP 3072:8G9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMGS:8GuH2aCGw1ST1wQLdqvS
- TLSH T128248D226080907EE7FA1A32D93FDA617E7DF6641760C95E83848C1E5DA04C06BF7B67
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e588996.rbs
- Size 19KB
- SHA256 c8c15c56a5763aedd08c00fd6fadfdc98182f2046162a74e400db47a4edbace1
- MD5 454c64369a36d6259d99976b70285563
- SHA1 0f5a9912257fc1eed8a04664f3b107e54806ddbb
- SHA512 6936612f9252330521a1909770b182ee090770937535e6e4857dc2aa5607085e4501cb8ade2d334e6d6f617dded0b7e9b42c80f4da432e1224aae6facd81fa2d
- SSDEEP 192:c2RTL6RTLEBXFU7RKgZQI+nPBGYcn4aOTz0zyrqM75EruyQr8tA:c2RTWRTcgu7PBlcnZOTjeA
- TLSH T172925093634262E2E6421B71DE634F943F63DED46A52422B50EC913C8EB27C12F7D9C9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e5889a9.rbs
- Size 214KB
- SHA256 cd1722cbfe60559b37d255abf494cc2f7593211e4668c38447a6256c8d24da8c
- MD5 76b55543c2046c0a73bf1ee59c9f6b98
- SHA1 c27a77a96b55337b3905ea18fedc84d1b858d211
- SHA512 cc0054e608940acc637cd7d97dfd4bf7104536659641c25231d24922d71ec038de5b37e464701c9ae392b1bbfa7f491585a0fb7440e632aa974527a51793398f
- SSDEEP 3072:uG9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMGZ:uGuH2aCGw1ST1wQLdqvZ
- TLSH T198248D226480807EE7FA1A32D93F9A717E7DF6241760C99EC3848C1E5D604D06BF6B67
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (f0a1d97a83a887d2)\Client.Override.en-US.resources
- Size 1024B
- SHA256 3d8a39aa7421216b3217ec481a4b7fcd8aa6c4c1512a25b1101cdbde844238d1
- MD5 a41e5cfc8fbed7d06e5e71746c49ff49
- SHA1 31656d415928bfe44f3e7e1e8b94f95aa3b4f36c
- SHA512 5f4c466fec1ee49b3682109984b3d4f57e4174310a60a25751294b2911affefbbef4645a5f4f3ab265c72a3f5c96c2ac40dac5fc69e3288dbd776de7e59c7beb
- TLSH T16B11021A2FBC30E4E4F3677A387A305387362DB94818909D9804130C1973346EB4B67A
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (f0a1d97a83a887d2)\Client.en-US.resources
- Size 64KB
- SHA256 efdb0b4fcc38b52cbf72336bd107a814db8454003f3495de21e2026a148823ea
- MD5 92232708774febf9a4a464bbeda36215
- SHA1 521d4e630f5e00977bbca7cd17dd0d22dbe1ca9e
- SHA512 59442cbc57604f0dd170bb4f86f0e2b6c96408daf67250e6f40e00d034033b6871502cd83df0267f4628c3a035f191d56f26bf1927e691b5330524eb810852f2
- SSDEEP 1536:5fkiK2FoQ67wwLFSj7Be3sZvU/7UFN+9nwLLChTKN1ljpneMarA:5fkiK2FoQ6jFSj7Be3sZvU/7UFN+9nwS
- TLSH T1A8532E1277FD0A58F5F36F35BE7A94619937BC5A2E25C06E1028815E09B2F80C9B2773
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (f0a1d97a83a887d2)\Client.resources
- Size 6KB
- SHA256 bd34378ad99f7609fa0c7c8edde6337c738a61d288863015629329806a1cc728
- MD5 1e863134f29bcabe1ee571c91ac4fbe6
- SHA1 57cc5966fcae49019da5f8f507c840cedfc103f4
- SHA512 7e2640c4ddb8719230de0ddb0d18f9a4b1499a037247f12b142b1c16a2a989390abcb5ac7816a63dbce2d43c08510cec7cfc87cd24458bc2fa919c396b36d4f9
- SSDEEP 192:rpDZHfbkqYvZJG293IIs1Z4EO/nM3ZWYijpo2YG:rRZjkqYxJ3JI/sMJ/ijp/p
- TLSH T1D8D13BC49BFEAC3CF05E51BE3A7692990275FF113AA3C3582460106A7F228856C56737
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (f0a1d97a83a887d2)\ScreenConnect.Client.dll
- Size 411KB
- SHA256 28ff8468ad2db8b41fe9d9a2971dd56fea0aecad14808fe4b31c9b1072d3b129
- MD5 62d114c95b604d7ca684759c22c4c688
- SHA1 d0563d46f2dc95dc8c18535efe7b18292128c0e6
- SHA512 c02280814930d898527708f98061bed64f35b8ec76135b22984c2b5cbcc3d881f1088a3c77d960a52862a423855f99f59d7b13cd05a48539a5d2f0252f8ccaed
- SSDEEP 6144:e2E4tiGCnwldvN7ADSD8ETEavHy+vd7JPYIYyqQni65/PGq:IaiGIwNAeDHTEavSW7OQni3q
- TLSH T12294CF8563E8882EEE9F3A73F16162248D72BC55B492E2E94D0C75F51BB338287447D3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (f0a1d97a83a887d2)\ScreenConnect.ClientService.dll
- Size 90KB
- SHA256 9cf2c77df0a1a1e854ec1bbc6940d96f508bfb4b0555a07657c77314803a717e
- MD5 cee388546abc6dfb7a766a33a8066ff5
- SHA1 a41ffb64a859ff3bd32589ce58ac03a84c0b1955
- SHA512 8c1d39bf142048a93c5388ebacc1a409c773ce7ec9f684127a97779a53c4914ef650f8d8474e4d999b12b848ca1ff4d3a697a0888dd1213d6414c703fc3c37f8
- SSDEEP 1536:QtZxUAtbcOyfDNq9IxcBoSDW3ieKw/PM3ZRVQbV3l5EpSj/zJX+VugmCD74mGyN:Qa4CDIICCieKnVQbVDEkj/zJX+VugPD7
- TLSH T1BB935C0293AD993BC9DF4E34B461F1610AB1BA13D4E7E7D99D9864E62F063C11F043AE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (f0a1d97a83a887d2)\ScreenConnect.ClientService.exe
- Size 93KB
- SHA256 01341bd42426c3d110136cc94433df00dbad690a56593f7cca41a93f698f214a
- MD5 751e8bcc20a49aeab090d99a6417919f
- SHA1 c2a313826c8fd840e4583435f821229c25ac34bf
- SHA512 91b278afa4ef8d917552a9da6f5df3e5c93319a7e69baedca3cfb1f68463f17f16e1649e027bc574136753cea2d77f7cf5dede7c1a3e02ebc1f9131e1245f9b0
- SSDEEP 1536:vg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgUT0HMm7mT:YhbNDxZGXfdHrX7rAc6myJkgUT0H7iT
- TLSH T117935A13B5C28872D473093158E0DAB09A3FF9615E61DEAB3798022E4F742C1AE75E77
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (f0a1d97a83a887d2)\ScreenConnect.Core.dll
- Size 572KB
- SHA256 92e831159d5e9f2676241ab7ce80060a0b1dc34684f83797aec93b3ecff41139
- MD5 f5be8d175195df18890643f146ec4383
- SHA1 ef2945ea142cbad107f4731de0ec33b428f1024f
- SHA512 998b29e4e66ccc0cf411d8daf661eb25da4f257b16e7a79047316f81b12c49693cabb6a1012db14d398bbe78db48af85a7da01c1fc12a6d067852a144f0dbd6c
- SSDEEP 6144:HuPdHSnGdti7Bn2Bomiu7qTOGXwU6eISZl2JILinW5dQifdlb1QS/qhwDTax4kxP:Yd+McMYu7w1jXyadQmbb1QHMy1
- TLSH T151C47D12B39497F7C5AE037EE07053184272FA4564B6E38B65A8D4FA3C923C95D806FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (f0a1d97a83a887d2)\ScreenConnect.Windows.dll
- Size 1.7MB
- SHA256 2292aac48ad575c6d1ed99c862e3408e254db34b8fea50cf3594aa08f3e875d0
- MD5 63d6f975924dee293c5346992cf1b10d
- SHA1 33e47573b3b9e384128ca4f66d6ae73f83f3dd89
- SHA512 68a464b8c2a7017b7bd24521f995b1962969ebb9f0b088c2673b715df73b30e1461bbf1b111178067f2ff28105953e49ce27612956ec54cc32edf3a191cf6b0b
- SSDEEP 24576:S1/VFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUTz:o/VJkGYYpT0+TFiH7efPS
- TLSH T1FC85BD41E2C365F5D46B047888BF972AB6743C080365CAFB93D4AE366D33BC09A36756
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (f0a1d97a83a887d2)\ScreenConnect.WindowsAuthenticationPackage.dll
- Size 254KB
- SHA256 a5b8f0070201e4f26260af6a25941ea38bd7042aefd48cd68b9acf951fa99ee5
- MD5 5adcb5ae1a1690be69fd22bdf3c2db60
- SHA1 09a802b06a4387b0f13bf2cda84f53ca5bdc3785
- SHA512 812be742f26d0c42fdde20ab4a02f1b47389f8d1acaa6a5bb3409ba27c64be444ac06d4129981b48fa02d4c06b526cb5006219541b0786f8f37cf2a183a18a73
- SSDEEP 3072:qJvChyA4m2zNGvxDd6Q6dtaVNVrlaHpFahvJ9ERnWtMG8Ff2lt9Bgcld5aaYxg:0IvxDdL6d8VNdlC3g0RCXh5D
- TLSH T1C5448E15B7A40CB4EC77823888535A06E776BC160760E6CF03E0825ADF6F7D1A63E762
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (f0a1d97a83a887d2)\ScreenConnect.WindowsBackstageShell.exe
- Size 71KB
- SHA256 0e6502db9fcae756f42f1e32cbb70b87b54286cc9ea1b7a83f51f57b10975aad
- MD5 222611c5a579a6e22a3333dcd3587aba
- SHA1 a1cc8b62acbb217146525a20f26e9ef4241e8563
- SHA512 c498d3d23f9d0278b6b9b98e497fbe7d70ef02173b079ba03ec8ed3aa235102eefb59ee482288132ee2d9844935d1ac5ccbc0ba93a48825d89d2b515fa02551c
- SSDEEP 768:UzlYsf/wCdOBti+3kDeuRsUQHkyik5lvmDSmBsuMQX5E+TCMXESslUqt6LYiDLkN:URYKtdU39PVlvmDqfQX5E+TC7Sa6L7wF
- TLSH T135637E5023DC9535E9FF2E34B4E1F6600AB3BA638CE1D7D52DA821DA2E127C14F64396
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (f0a1d97a83a887d2)\ScreenConnect.WindowsBackstageShell.exe.config
- Size 266B
- SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
- MD5 728175e20ffbceb46760bb5e1112f38b
- SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
- SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
- TLSH T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (f0a1d97a83a887d2)\ScreenConnect.WindowsClient.exe
- Size 665KB
- SHA256 6e95d68102dc761942e67e2337ad8e49d32ee7c8943340489a01e2c56ea6e00b
- MD5 1bec5ec41f5a88bab602ba15d6d2879d
- SHA1 859fd0edba414551a48d598141a58fabbb343715
- SHA512 8c9fda75e2309942041f1c76bdb5989a26767d64086d1502e6184fd9b404f22af652d967a661a4262fe073130947e839005dbc4d540707d6739d3d9b045cd5b1
- SSDEEP 6144:CJdXZuij7nl/k+XKzIHWxInzii8IiHx4PAyYES4QtkU/ycMF2/B4IF1ICkJAs1iV:Cw67l/5KM2yuKYmS4QjjIm1ZT/
- TLSH T184E47E1137ACDB7BC4EF0B76A432195517B8E802A585E7CFF640A0E95D863809E067EF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (f0a1d97a83a887d2)\ScreenConnect.WindowsCredentialProvider.dll
- Size 838KB
- SHA256 3fa1fe4a588015cc94eceb06867f16a5e562293139fbf6b36bde21dba478968d
- MD5 d67718dfb12e8fa47be42c3d4b54d19f
- SHA1 e49eb358c1f6fe71b9b0babc391b8c137ba6e760
- SHA512 813c8661756d91645d80a4c9412280054a5b8e2d611fe6333d68f97db78c7fe815505ebecce511c7b8ca63b7c81432f0acfc6455f801d7bc844194e0c26c46ca
- SSDEEP 12288:8hUSQJg/+QShEMuu/gUD+FkoiS+upfHH4:8wNQrMuu/gUD+Son+2fn4
- TLSH T1D7054C1BE7A440B9C0ADC6B5C35B9736BBB6F4864514B29F07D40A227F6BF40AB1D384
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (f0a1d97a83a887d2)\ScreenConnect.WindowsFileManager.exe
- Size 91KB
- SHA256 a40087c78a18f9d177dfe5fa5f0bec2cf113a80c2ffbe4d0ec3d582b067120d5
- MD5 ebebb49c1d1e6f35febe4b8d4138f7b5
- SHA1 00337a0af8352464407d9b8f114ad798ba99bee5
- SHA512 ec5dca6e88e671be2c72afde9e235c0ce47e782bb96931c8d52dc0fe9e138dc14f84caef8bd29275daa75fb414c20000c84e94bc011e3095af4125d67ee4d831
- SSDEEP 1536:FHMxIdlP49mjI5kLP+VVVVVVVVVVVVVVVVVVVVVVVVVdibp7M:IIPHukLCwpA
- TLSH T1DD93D59235266235DEC5C033A492E9B19C377F6207FDC5BD28A1BA3639E03943E99D70
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (f0a1d97a83a887d2)\app.config
- Size 517B
- SHA256 ca47828ed440cabb039b1ea1dca882e3844e72a9165c0303423b7d45deac19fb
- MD5 2ce8d5d8ac4a42ecb507dac129ea69d3
- SHA1 d322db5041298a6178e1450116e2f705011aab48
- SHA512 969118b8cd78544bb76660c4452706a5d91c376b47525cb4b2094ed83762f4856446cfb882716e611bd28d3e6efc96ed24d3a47c4ad44c0e04be8b852f31e850
- TLSH T18DF0E92531C87D5A16A31F23E52342007DB04DE21206286D74AE313FEB765D513F32C7
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (f0a1d97a83a887d2)\system.config
- Size 964B
- SHA256 5a07537af77e4d2db9a22ee68a7a26b5e23a6a4f0393c9d19665d2e23af30180
- MD5 30fe1708129b4918906a2b77cce7cd61
- SHA1 2827ea53845a0c9c89613c89891cd25fe323103b
- SHA512 4d2039e403dc3ac6cdf76f060c8117eafd575093dfdd083e99de8a50e0055cf69da22fcc4d8a0f9d46da736b0adcd5eeb218885bebdd840f812748be82e11121
- TLSH T11B1148F273446E0747E35E22D601C7857E71E65A251140C834AF127E4F319CE03B3259
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_59E89BCE9615F2B61F2F2C691688F111
- Size 727B
- SHA256 5c7338db576b3824abe29af5aaa853efd1ca2a69b6023fb5a100ee7b49998fde
- MD5 9fa5aef40d563238bed1e3517dbf9d64
- SHA1 931164f161938612c6cf4d36f08f128c89437736
- SHA512 adcc8c219969e8da8cf631b42fd4e46332799053b7e892e21005698a53bc6d342c27cf228e64d07be55f48f96d43a402e1b78d4ceac710ac2b54d0f44eba8672
- TLSH T15A0165C2F5E9C641C2324A18EF39E4EC30D984606ECD18536B276E8471853C35902A30
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_59E89BCE9615F2B61F2F2C691688F111
- Size 404B
- SHA256 600ee68c4a5147ced12c274efa3941cdc8d9837f9c3d255a92d7f4460a2439b2
- MD5 afbe0dee2bf00244a689f5814e6560cb
- SHA1 e34d7e083647bbdc1d517cbcea04d58aff08d64b
- SHA512 ef207b6ca6413007824431a51a90e6db75b737322e7349b55019a367c1a3ebc3979b6f073336b1777fcac025f063b7b934559c3f430ce9bc4dce2f9b62814124
- TLSH T1FDE0283431F9849CF2F5D83547FAFD53484CF25A4141C36C1780131BAE2BB004CB2224
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI7DA7.tmp
- Size 1.1MB
- SHA256 cd6bccce073b2a5205840ec31c91df0d443cc57c68756de2c03e21db8e3fc157
- MD5 914db3d3a01cc102bfe18dbde54e56b3
- SHA1 91246f683c6b78f67bf0eb7dd0043dc459f548cb
- SHA512 58e60853dcd5cedfc83dca39e19a9c2a31d4ed6f230e393df9015f5e013189c9527db4e17e10f685c584b3c0e124573ac3ffd9ea24395e65b3a4eb681212ae7c
- SSDEEP 24576:bUUGGakXrcMRzUH1YWmDqSPe+YPF0KkCNWUj2+bI4ie8tj3Nz:sGak7lQ1VmD3Pd0F0TCUU3bpiLvz
- TLSH T13935231537B8803AF1A62A306D3590621EFDB8B556F5C2992B99053D0FF2B81DB79333
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI7DA7.tmp-\Microsoft.Deployment.WindowsInstaller.dll
- Size 172KB
- SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
- MD5 5ef88919012e4a3d8a1e2955dc8c8d81
- SHA1 c0cfb830b8f1d990e3836e0bcc786e7972c9ed62
- SHA512 4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684
- SSDEEP 3072:FkfZS7FUguxN+77b1W5GR69UgoCaf8TpCnfKlRUjW01Ky4:x+c7b1W4R6joxfQE
- TLSH T14E045B2563FC473ECAEF87B4E2624251E7B2E2E97113DB0DDC8541AA2522780F792753
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI7DA7.tmp-\ScreenConnect.Core.dll
- Size 562KB
- SHA256 c51a2b5cb5054ec0136e332bf290c8af3392d7936b5137a07423df08ab33d264
- MD5 d9ef4f245159eb7374677f603e18b9ec
- SHA1 e7aa0b8bce504d31323d10dd987fa2d517649191
- SHA512 c46494c811c828faffe9baea85cfb923a53ef088ee75d0798fea0482076b493c43ee4b2243a44e35e8e686423d108ee80ddad5546e723eb8ce9fb17f13041d80
- SSDEEP 6144:GuPdHSnGdti7Bn2Bomiu7qTOGXwU6eISZl2JILinW5dQifdlb1QS/qhwDTax4kxC:Fd+McMYu7w1jXyadQmbb1QHM
- TLSH T171C47D11B39497F7C5AE037EE07053180272FA4564B6E78B65A8E4FA3C923C95D806FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI7DA7.tmp-\ScreenConnect.InstallerActions.dll
- Size 24KB
- SHA256 432abf3a198ff64fb2c660eb06b2bb33a16cf69fd28d836cfcb65c43d37dc462
- MD5 80d4201dcb4e018aaff5fc1a5859da40
- SHA1 f59cfd60eb1f56050d4f8439b6a5ddcf0a6d2883
- SHA512 d3f4c28df23bf4beae556eb05e825fbeffe99dbecda47072267b5ec0142085fb95bbedbadb93de1a34c5d7bfcb0661c359bd56dde18c209498b0a2c3488c72a8
- SSDEEP 384:VPJazzV1WTsaS8hQlL6QX4V7NaNeirM0dbMsFkjvZBPs0MY:VxazwQX4VMcLvXj
- TLSH T1B7B2C620678DE17AF9EE1634B563F7B002B3BDB3CCE9DA8665A410152D253E04FB5B06
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI7DA7.tmp-\ScreenConnect.Windows.dll
- Size 1.7MB
- SHA256 10933424536d53e397f651915f862c933199c50722943c236b020787b2e8f147
- MD5 c261e034df63aca035d7914d354b9dca
- SHA1 50e59350f4b524e55eec1a7ee0531bf9ad33a33b
- SHA512 5c67ca36550bbe0dfb8c5f1f32c34045b42a72a6199802c4730694148eec630c345a42f99bf44f7a3a62bd19256ffdf170ec849b40bb976e48b601f2a15dac69
- SSDEEP 24576:91/VFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUTM:7/VJkGYYpT0+TFiH7efP
- TLSH T1E985BD41E2C365F5D46B047888BF972AB6743C080365CAFB93D4AE366D33BC09A36756
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI8161.tmp-\CustomAction.config
- Size 234B
- SHA256 7027b69ab6ebc9f3f7d2f6c800793fde2a057b76010d8cfd831cf440371b2b23
- MD5 6f52ebea639fd7cefca18d9e5272463e
- SHA1 b5e8387c2eb20dd37df8f4a3b9b0e875fa5415e3
- SHA512 b5960066430ed40383d39365eadb3688cadadfeca382404924024c908e32c670afabd37ab41ff9e6ac97491a5eb8b55367d7199002bf8569cf545434ab2f271a
- TLSH T18CD0A70405D0FD1B5E231A2337524559FF34B1E290A44408B06F3A130A220CD4757317
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI8161.tmp-\ScreenConnect.WindowsInstaller.dll
- Size 137KB
- SHA256 528242c7745783b3b4ae72fec13bb9bd49b17b0e00f60c027351147f21fdd359
- MD5 dc1e764763d65555086850eba51af5c4
- SHA1 66043dbac97f3b86c019c218e5b127bb7e4441b8
- SHA512 175cdd4fdadd07afb6f54f0f909aadd74a579e069ea69dc96ceb9c07c14df2dcd1c929dc821e7f242ab39abadb91dd7c7bdf832e7b13416167200860caa0f8a1
- SSDEEP 1536:M6PufIhTx7WsJU5Ds9ZrUP43IO6A16d2K7kvDutUVfh5U3KiQtlJRWq8qo0m1:RPufGKTJ44i+k1VfjRDn+
- TLSH T183D33A3463AC9A37E6EF5AB9E431B1440BF2B527B4A3F78D694864F81C127D14B20367
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ScreenConnect\26.1.24.9579\f0a1d97a83a887d2\ScreenConnect.ClientSetup.msi
- Size 13.8MB
- SHA256 6c30b2af61765338a9918f8db22865738ba8f04ee283ba35bb2ecbc673aa72f2
- MD5 8d68c69a8be19653fdaceb5bc207c3b7
- SHA1 f0004987014c7c235482b4fa9ece035455df5983
- SHA512 e7ff9b1587beab4d0a01e5f99d4f86c19b1ec72588d62b1e49c282d28241bc1c4b8e4cd73eb72818db0a827baa23855cbb558fc63fef2461758fde03f8e22350
- SSDEEP 393216:8CXvI5MvHxOJkCXvI5MvHxuCXvI5MvHxDCXvI5MvHxFCXvI5MvHxKCXvI5MvHx+:8Z6HxLZ6HxuZ6HxDZ6HxFZ6HxKZ6Hx+
- TLSH T1A8E623216BF88164F1FB6A74B9BC80A14A36BC658F26C04F0774399E18B0F64D5B6737
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI8BF0.tmp
- Size 202KB
- SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
- MD5 ba84dd4e0c1408828ccc1de09f585eda
- SHA1 e8e10065d479f8f591b9885ea8487bc673301298
- SHA512 7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290
- SSDEEP 3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
- TLSH T129147C326494803EE7F91A36D93E9A61AE7DF6241760C99EC3848C0E5D604D06BF7B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e5889aa.msi
- Size 13.9MB
- SHA256 cf7f069cdc2b80827173f26a4c22be25ffdee1120a013aac564a2d578373960d
- MD5 05e0bf9d5abe4f936280fab3f695a05e
- SHA1 601b31ebc7459489c4180b07aecb1b6940a7616c
- SHA512 1e77b0b6e4ed7932628ca7350374f0356b307cc2bfcfa0886dbddaf06adec0334a7f0b3ff45497fe9d6f989a6fec31a0bf5038f0f1c0500b003a923c7b1c8347
- SSDEEP 196608:GoHQjDSOgt2PhDoHQjDSOgtpDoHQjDSOgtZDoHQjDSOgt9DoHQjDSOgt6DoHQjDw:GowXSEdowXSLowXSDowXSrowXSwowXSB
- TLSH T1E2E6232233F5846EE4F21A36E9B961A01137BCA4D853C25F5670BD5E6E71984E8B3333
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\{EE48CCC6-E41C-3A9E-405E-472C7AB59F52}\DefaultIcon
- Size 1KB
- SHA256 87bed2d86c91b9f7d19adca1829df20881cbe9cc44638e073684d09c9b7cf11c
- MD5 a8b8f09d92363e54230bd83bb6e6f553
- SHA1 3c02161fa71951d60533cec49403fd7c199d06f8
- SHA512 1c6aeac8a83e3457606f8e52fce03d1afc3cc4f3e50c0dea828a74f8eb95b6751a4b9b6b2196422a421257df17798ed2aef2d37012de7a7d5fccfa7e74677222
- TLSH T1421175DF26906C7DC43D1DB245878A68F8BF4CD914D7A1D370A1103A15602CA43283EE
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (f0a1d97a83a887d2)\g54g2xu0.newcfg
- Size 882B
- SHA256 2a0f4f550330bf04ea2f6ff73a94a205f5e3eabc1ad8a1cb891827bfa4958c35
- MD5 7d57a857e5600bf81519cda7a2a56d9a
- SHA1 97cee07957671ed3866f496c457786728f903db3
- SHA512 a68c1236c6623986ea3508289d3db8013bcdfe564690abccbbe1aa839a80a545d6a1a60f21f7a491a05d8a6ffe4a5e5d2133b13e7abfc8d37f6eb71490629858
- TLSH T1FE11FDA9B2C0AD4602B71E32C5310385FE715A97027560E438AE21374F305CF03E32EA
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (f0a1d97a83a887d2)\pna3ymvm.newcfg
- Size 882B
- SHA256 1079aff2f3c752652408b968674c11012239abf13de9c8543b7ccc6467e6d9a1
- MD5 2bb4b5570aba7cd30471e7c0b94ee405
- SHA1 bc17f14dd3ee8ee692a0db55634e6153062e5940
- SHA512 f373583618dcdab4234900f3c4dd567182513de68814caedf672a72db0881b0aa2a3e197f67c6c9cc2b55c6968fea6031f794588b6efdc9ac6d6956b5bb10a17
- TLSH T11911FDA9B2C0AD4A02B31E32C5310385FD715A97027530E438AE21374F305CF03E32EA
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (f0a1d97a83a887d2)\user.config
- Size 719B
- SHA256 84720fa1a7588d374849a13eabb1c1def346347ee636c4c5fdc0f64924e61c50
- MD5 fa8ca4ab0f69961f755bf340a1f974a2
- SHA1 ab227216ed9f738eef43bbc19eae87b2770c3bc5
- SHA512 d99a55de1958a130b90df2a68f71a4136585932fb9ad07caa2a64c1cecf03515b6c0db7e6f6c084ccdc8b0864a144571aebbae33ca2c795099c82df5f069d67a
- TLSH T1140176A932C0AD4A02A31E32C5214785FE765A97116520A838AF213A5F305CF03A32EA
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\ScreenConnect\26.1.24.9579\ScreenConnect.ClientSetup.exe
- Size 16.4MB
- SHA256 394afba63344d5d63eeb67d777f338380772acfa4e4b6ae8e646d1e3710ca563
- MD5 dbae3f8d25037a6904daf91e872152a6
- SHA1 ecd4068b73d3fb1e33fbc0377b17ea9ed581e5f8
- SHA512 1a8cfb273c71671722f80a772f91e2e404263e9b6f9c1c9cc8ca6ebb4a9cb51e63bdef8dc1c8fb3ca7897bb5eb47d4d1c1d4e635c309824728109f6ed6e74ea1
- SSDEEP 393216:XRowXSEdowXSLowXSDowXSrowXSwowXS1:honEdonLonDonronwon1
- TLSH T1DF071211B3E694BAD4BB0638D8BA62655235BC148752C3BF5790BD6E2D32BC0DD32363
- MD5 SHA1 SHA512 SSDEEP TLSH