1ac4a409a2942fe3d49ae1cfd9eb7ffa24f57291a339f58343c433a3f0586149

Analysis

max time kernel
149s
max time network
136s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260630-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 21:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-02_0f49708819ea9a7e363d07a526a5f2f3_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe
Size 14.2MB
Sample260702-1bm6msfs8w
SHA256 1ac4a409a2942fe3d49ae1cfd9eb7ffa24f57291a339f58343c433a3f0586149
MD5 0f49708819ea9a7e363d07a526a5f2f3
SHA1 0be402b68752362f8f239c5a8cf213832c866e22
SHA512 5080422109526a9701ada26058e426847c0c41039de8f1010c3c9000d49f5e901aba6f19fd6f8775cc1fa3ab92d2ffdd93ae7a791471905c1db7e3aea94d0bcb
SSDEEP 196608:IfefPG0aDbXyhlMudpz0aDbXyhlMu20aDbXyhlMup0aDbXyhlMuH0aDbXyhlMul:vaD27M3aD27MeaD27M1aD27MtaD27Ms
TLSH
T122E61201B3DA65BAC0BF0538D87992646775BC154762C6EF53A0B96D2C33BC08E327A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

backdoor discovery persistence privilege_escalation ransomware rat

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	2040	msiexec.exe
3	4488	rundll32.exe

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (344e459ab554378d)\ImagePath = "\"C:\\Program Files (x86)\\ScreenConnect Client (344e459ab554378d)\\ScreenConnect.ClientService.exe\" \"?e=Access&y=Guest&s=bb70c60e-ef10-4267-9099-8b48d7b947e0&k=BgIAAACkAABSU0ExAAgAAAEAAQCNM6Iu3vzNsgaT4UZQJGpMG%2fNQZiSZSHhfVW5QiL2bjx7fuuOKQHHv1Av69OPC9tCbwfWk9GeOuLuSZiWnbfD1dAtdE%2fVEeBmPkEWUbNpSId409IWHtdu9ZYWq%2bZh77lLGYGLGQ8FBV%2fbENSTbudwBTHyZgzFld0yFDkKc2IM5K366ODHtAKZfJv6N6op4Uid0VriFrKEuftXeAlksnfmQgFuUmKdyb0OJCOeZW3RU5zZCtkak9c59I26CQqwUSPOty3DiPB5Nd40t0CRv%2fab9CwUyKpuWRG0O9Ica2FQHLMU7K2XhLRbfX919x%2bDDbUNOoqJzCwC5DJNv5OWwzMq3&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAAdHucC%2fCyb0q9SZvZbSLf2wAAAAACAAAAAAAQZgAAAAEAACAAAAAQFpgtHuMZgS2L8MJ2OmT0SLm94UpUd9lGtHHQaRHNgAAAAAAOgAAAAAIAACAAAAA7E9FGaA1WIb7Yp8zFAivTK6SNogk0J6OGC2qQXKme0qAEAACwFXFNn16AW%2bkv%2fXyEO2tXrbwzgfnF2I%2fIvjil3CK6R1deblZU3No6VsGSrIfFqgOv47gPcxYhJPZX6TV6VvVx2uxPe6eb7k9aOPR3bSdQlXiuDaHCkyysrc1j4q4s7zw9hWc7QYXZg7tCWrIuFOMVGUwo2HSWh4Pe5kPE6a8g49Zop6%2bicPTXVVCYq6dyhEdOVbR6jGNnn6%2fygyLnWHEPS1bwfvNkKxLvBBsr2fpcZ5XMsSSfJBmL4AGSgANDBPQ7nNvxBno1mXdMIhTRLX%2bcc98mGNJpClwQT5pxprlDfOlV1x6bqqj%2fJzMGQfI7dMc4XYWXQWExHRGpZHtcwprBdm0TcdjxXkyPhJhMGtZYEbLzfupdtVo9NJKm%2bAIrKttyq%2fZiJh56ZIWtUUislfzeOYKLF6Wl82f3MNk7K1Vw4AB86h9biWf9FXwTcAAJJBvkAsW4wIXzQ52Ey20O6fVeOvjM6%2fK6NGdzUpP6vZhy%2bPWtPE9TfIxj2%2f1YMGGVEwPwTIOaTB44w1odxNxE8STRg4IQ%2fkeafSED1fUz8JWZ4IuwwyGHKhcJn25I3UpmoMHNrv8g3ZZmYg1B3ZTQO7JFDe6maFoW3dcV5DeksdSLRPPlpQmzXuNmqtDFjAc%2fvjQlJ2n8nWuZiqymf6uzk7iPppuvncxO0zGpW5hL2ZQbftS9sg9TCTm7Mxl%2fQa1R7V1HqtTOoanY0xtWQbWEyVpbBITTQ6Y0rM%2fnyHG9KJpKvfL3IeL904hsiMqdL7aAAdUE9VUm3WkhW%2b5mTeJe0cTi9x23S0HURYzPvjFYY7jwkrzOmFu445NZSeertVaKdVWpaVt84hjDdTfYvoyDJJAscoydHvaJ2U%2fs%2bbBtAhyhs0JSewyzf4Jk12ekM01Hkd91g%2biSotGRAvaCDXRVSQPxNcfbebeOURaGTN0xFR7fXr8qCtixpvcyQD0GRvXby%2fstXyttYbtF5Mma6m%2bWbpWFOTKhbHASKGG0QFrAqP56hi89EDHihCeLgG47e6kFxcHEsw%2fWzL3IkaRwvTT%2f2Sjbz2zQPZsW96xoGEgujgJbxWRQmQveNfFpPKY8V9VcVjbWnHkFUTKncFT8pOOm36CpZwViJRkw%2b%2b7VDx50evtdOqA62Z29byRTDNuotDbiltUutkMEjpgkKkOVn%2fY9ZvYHYgdVxjbTqhsTkqg337l4BbSl36BG2nht4hMtzodymvtJ153NLnWNcKs1A482YWavzVyZ5PZ92hNt1mlCMPF2hRSC349P1CQHubx0hH39jgvAaXgYs1rlNbbbfuN%2b71Ej3AKcB77FRUxgdiy3qw%2fHOM5kK4iclprug3kEf2MuqiFuCf53tS3yexhnxvkAa5oJNCHtRkwEr%2fHVjyrivUlWAewzkpn5WaQ21GbQ9bnyi6KyAP2RXs91JjLaNYrFyvt7O799CkJzaNMWgaf%2bjK%2f1UOz2ZEcPi67tzf18slnbfPyE2T2Bn%2fqw3SNlfM5HsKJdrTmRRvn1UAXbAZqaOYq97QWtgEUMFffQ%2fyZiC5kndVxkVAGzJDX1%2fNXBYoMqfq5WL2R62%2f1RLlILvwXGRxDdekAAAAC1i02ZytZJjKbpuwrlwyhxynm%2bU3M75EJqa6PhW6vqvRvCdxmMeYZ0KSuuKnYTDCGTIhleeUVxq%2bgNtxf7zbID\""	ScreenConnect.ClientService.exe

ConnectWise ScreenConnect remote access tool
ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
backdoor rat

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe

Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs

Suspicious Windows Authentication Registry Modification.

persistence privilege_escalation

Authentication Package

T1547.002

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\Authentication Packages = 6d007300760031005f003000000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800330034003400650034003500390061006200350035003400330037003800640029005c00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f0077007300410075007400680065006e007400690063006100740069006f006e005000610063006b006100670065002e0064006c006c0000000000	msiexec.exe

Drops file in System32 directory 24 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (344e459ab554378d)\dwfquw2e.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (344e459ab554378d)\2aftjt1b.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (344e459ab554378d)\dwfquw2e.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (344e459ab554378d)\dwfquw2e.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (344e459ab554378d)\hvbkoikx.tmp	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (344e459ab554378d)\hvbkoikx.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (344e459ab554378d)\va55psbv.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (344e459ab554378d)\2aftjt1b.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (344e459ab554378d)\2aftjt1b.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (344e459ab554378d)\axi32rtr.tmp	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (344e459ab554378d)\axi32rtr.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (344e459ab554378d)\hvbkoikx.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (344e459ab554378d)\va55psbv.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (344e459ab554378d)\gosbvwvc.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (344e459ab554378d)\ggby0xza.tmp	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (344e459ab554378d)\ggby0xza.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (344e459ab554378d)\va55psbv.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (344e459ab554378d)\ggby0xza.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (344e459ab554378d)\gosbvwvc.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (344e459ab554378d)\axi32rtr.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (344e459ab554378d)\user.config	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (344e459ab554378d)\putgpzm2.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (344e459ab554378d)\putgpzm2.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (344e459ab554378d)\putgpzm2.newcfg	ScreenConnect.ClientService.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Drops file in Program Files directory 17 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ScreenConnect Client (344e459ab554378d)\ScreenConnect.WindowsFileManager.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (344e459ab554378d)\ScreenConnect.WindowsFileManager.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (344e459ab554378d)\Client.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (344e459ab554378d)\system.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (344e459ab554378d)\ScreenConnect.ClientService.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (344e459ab554378d)\ScreenConnect.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (344e459ab554378d)\ScreenConnect.WindowsClient.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (344e459ab554378d)\ScreenConnect.WindowsClient.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (344e459ab554378d)\ScreenConnect.Client.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (344e459ab554378d)\ScreenConnect.Windows.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (344e459ab554378d)\ScreenConnect.WindowsBackstageShell.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (344e459ab554378d)\ScreenConnect.WindowsCredentialProvider.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (344e459ab554378d)\ScreenConnect.ClientService.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (344e459ab554378d)\app.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (344e459ab554378d)\Client.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (344e459ab554378d)\ScreenConnect.WindowsAuthenticationPackage.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (344e459ab554378d)\ScreenConnect.WindowsBackstageShell.exe	msiexec.exe

Drops file in Windows directory 17 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI935E.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFFF31F10A22E87C07.TMP	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI932E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI95EF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{1EE8DF31-60A4-767E-B567-5ED4A9CCFC44}\DefaultIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\e598d42.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\SystemTemp\~DFF5F713C0A08D8DE5.TMP	msiexec.exe
File created	C:\Windows\Installer\e598d44.msi	msiexec.exe
File created	C:\Windows\Installer\{1EE8DF31-60A4-767E-B567-5ED4A9CCFC44}\DefaultIcon	msiexec.exe
File created	C:\Windows\Installer\e598d42.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF17429C2C2401620C.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{1EE8DF31-60A4-767E-B567-5ED4A9CCFC44}	msiexec.exe
File created	C:\Windows\Installer\wix{1EE8DF31-60A4-767E-B567-5ED4A9CCFC44}.SchedServiceConfig.rmi	MsiExec.exe
File created	C:\Windows\SystemTemp\~DF7FCBDBF9633590C5.TMP	msiexec.exe

Executes dropped EXE 2 IoCs

pid	Process
1056	ScreenConnect.ClientService.exe
4432	ScreenConnect.WindowsClient.exe

Loads dropped DLL 42 IoCs

pid	Process
5860	MsiExec.exe
5576	rundll32.exe
5576	rundll32.exe
5576	rundll32.exe
5576	rundll32.exe
5576	rundll32.exe
5576	rundll32.exe
5576	rundll32.exe
5576	rundll32.exe
5576	rundll32.exe
5860	MsiExec.exe
4488	rundll32.exe
4488	rundll32.exe
4488	rundll32.exe
4488	rundll32.exe
4488	rundll32.exe
4488	rundll32.exe
4488	rundll32.exe
4488	rundll32.exe
4488	rundll32.exe
5860	MsiExec.exe
3512	rundll32.exe
3512	rundll32.exe
3512	rundll32.exe
3512	rundll32.exe
3512	rundll32.exe
3512	rundll32.exe
3512	rundll32.exe
3512	rundll32.exe
3512	rundll32.exe
5636	MsiExec.exe
5600	MsiExec.exe
1056	ScreenConnect.ClientService.exe
1056	ScreenConnect.ClientService.exe
1056	ScreenConnect.ClientService.exe
1056	ScreenConnect.ClientService.exe
1056	ScreenConnect.ClientService.exe
1056	ScreenConnect.ClientService.exe
1056	ScreenConnect.ClientService.exe
1056	ScreenConnect.ClientService.exe
1056	ScreenConnect.ClientService.exe
1056	ScreenConnect.ClientService.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-02_0f49708819ea9a7e363d07a526a5f2f3_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenConnect.ClientService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000bb1701daa133de210000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801bb1701da0000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101bb1701da000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3bb1701da00000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6bb1701da00000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Modifies data under HKEY_USERS 8 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.ClientService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe

Modifies registry class 37 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\sc-344e459ab554378d\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-344e459ab554378d\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (344e459ab554378d)\\ScreenConnect.WindowsClient.exe\" \"%1\""	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\13FD8EE14A06E7675B76E54D9ACCCF44\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-344e459ab554378d\URL Protocol	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-344e459ab554378d\UseOriginalUrlEncoding = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\13FD8EE14A06E7675B76E54D9ACCCF44\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\13FD8EE14A06E7675B76E54D9ACCCF44\ProductIcon = "C:\\Windows\\Installer\\{1EE8DF31-60A4-767E-B567-5ED4A9CCFC44}\\DefaultIcon"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\13FD8EE14A06E7675B76E54D9ACCCF44\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\13FD8EE14A06E7675B76E54D9ACCCF44	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\13FD8EE14A06E7675B76E54D9ACCCF44\ProductName = "ScreenConnect Client (344e459ab554378d)"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\13FD8EE14A06E7675B76E54D9ACCCF44\SourceList\Net	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\13FD8EE14A06E7675B76E54D9ACCCF44\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-344e459ab554378d\shell\open	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-344e459ab554378d\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-82DB-52D26AF115EC}\InprocServer32\ = "C:\\Program Files (x86)\\ScreenConnect Client (344e459ab554378d)\\ScreenConnect.WindowsCredentialProvider.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\13FD8EE14A06E7675B76E54D9ACCCF44\PackageCode = "13FD8EE14A06E7675B76E54D9ACCCF44"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\13FD8EE14A06E7675B76E54D9ACCCF44\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\13FD8EE14A06E7675B76E54D9ACCCF44\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\13FD8EE14A06E7675B76E54D9ACCCF44\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-344e459ab554378d	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-82DB-52D26AF115EC}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-82DB-52D26AF115EC}\ = "ScreenConnect Client (344e459ab554378d) Credential Provider"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\13FD8EE14A06E7675B76E54D9ACCCF44\Version = "436338692"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\23E2BC0BC835429743E454A95B4573D8\13FD8EE14A06E7675B76E54D9ACCCF44	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\13FD8EE14A06E7675B76E54D9ACCCF44\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\26.2.4.9623\\344e459ab554378d\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\13FD8EE14A06E7675B76E54D9ACCCF44\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\26.2.4.9623\\344e459ab554378d\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-344e459ab554378d	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-344e459ab554378d\shell	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\13FD8EE14A06E7675B76E54D9ACCCF44	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\23E2BC0BC835429743E454A95B4573D8	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-82DB-52D26AF115EC}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\13FD8EE14A06E7675B76E54D9ACCCF44\Full	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\13FD8EE14A06E7675B76E54D9ACCCF44\SourceList\PackageName = "ScreenConnect.ClientSetup.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-82DB-52D26AF115EC}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\13FD8EE14A06E7675B76E54D9ACCCF44\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\13FD8EE14A06E7675B76E54D9ACCCF44\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\13FD8EE14A06E7675B76E54D9ACCCF44\SourceList\Media\1 = ";"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2280	msiexec.exe
2280	msiexec.exe
1056	ScreenConnect.ClientService.exe
1056	ScreenConnect.ClientService.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5708	2026-07-02_0f49708819ea9a7e363d07a526a5f2f3_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe
Token: SeShutdownPrivilege	2040	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2040	msiexec.exe
Token: SeSecurityPrivilege	2280	msiexec.exe
Token: SeCreateTokenPrivilege	2040	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2040	msiexec.exe
Token: SeLockMemoryPrivilege	2040	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2040	msiexec.exe
Token: SeMachineAccountPrivilege	2040	msiexec.exe
Token: SeTcbPrivilege	2040	msiexec.exe
Token: SeSecurityPrivilege	2040	msiexec.exe
Token: SeTakeOwnershipPrivilege	2040	msiexec.exe
Token: SeLoadDriverPrivilege	2040	msiexec.exe
Token: SeSystemProfilePrivilege	2040	msiexec.exe
Token: SeSystemtimePrivilege	2040	msiexec.exe
Token: SeProfSingleProcessPrivilege	2040	msiexec.exe
Token: SeIncBasePriorityPrivilege	2040	msiexec.exe
Token: SeCreatePagefilePrivilege	2040	msiexec.exe
Token: SeCreatePermanentPrivilege	2040	msiexec.exe
Token: SeBackupPrivilege	2040	msiexec.exe
Token: SeRestorePrivilege	2040	msiexec.exe
Token: SeShutdownPrivilege	2040	msiexec.exe
Token: SeDebugPrivilege	2040	msiexec.exe
Token: SeAuditPrivilege	2040	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2040	msiexec.exe
Token: SeChangeNotifyPrivilege	2040	msiexec.exe
Token: SeRemoteShutdownPrivilege	2040	msiexec.exe
Token: SeUndockPrivilege	2040	msiexec.exe
Token: SeSyncAgentPrivilege	2040	msiexec.exe
Token: SeEnableDelegationPrivilege	2040	msiexec.exe
Token: SeManageVolumePrivilege	2040	msiexec.exe
Token: SeImpersonatePrivilege	2040	msiexec.exe
Token: SeCreateGlobalPrivilege	2040	msiexec.exe
Token: SeCreateTokenPrivilege	2040	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2040	msiexec.exe
Token: SeLockMemoryPrivilege	2040	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2040	msiexec.exe
Token: SeMachineAccountPrivilege	2040	msiexec.exe
Token: SeTcbPrivilege	2040	msiexec.exe
Token: SeSecurityPrivilege	2040	msiexec.exe
Token: SeTakeOwnershipPrivilege	2040	msiexec.exe
Token: SeLoadDriverPrivilege	2040	msiexec.exe
Token: SeSystemProfilePrivilege	2040	msiexec.exe
Token: SeSystemtimePrivilege	2040	msiexec.exe
Token: SeProfSingleProcessPrivilege	2040	msiexec.exe
Token: SeIncBasePriorityPrivilege	2040	msiexec.exe
Token: SeCreatePagefilePrivilege	2040	msiexec.exe
Token: SeCreatePermanentPrivilege	2040	msiexec.exe
Token: SeBackupPrivilege	2040	msiexec.exe
Token: SeRestorePrivilege	2040	msiexec.exe
Token: SeShutdownPrivilege	2040	msiexec.exe
Token: SeDebugPrivilege	2040	msiexec.exe
Token: SeAuditPrivilege	2040	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2040	msiexec.exe
Token: SeChangeNotifyPrivilege	2040	msiexec.exe
Token: SeRemoteShutdownPrivilege	2040	msiexec.exe
Token: SeUndockPrivilege	2040	msiexec.exe
Token: SeSyncAgentPrivilege	2040	msiexec.exe
Token: SeEnableDelegationPrivilege	2040	msiexec.exe
Token: SeManageVolumePrivilege	2040	msiexec.exe
Token: SeImpersonatePrivilege	2040	msiexec.exe
Token: SeCreateGlobalPrivilege	2040	msiexec.exe
Token: SeCreateTokenPrivilege	2040	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2040	msiexec.exe

Suspicious use of FindShellTrayWindow 18 IoCs

pid	Process
2040	msiexec.exe
2040	msiexec.exe
4432	ScreenConnect.WindowsClient.exe
4432	ScreenConnect.WindowsClient.exe
4432	ScreenConnect.WindowsClient.exe
4432	ScreenConnect.WindowsClient.exe
4432	ScreenConnect.WindowsClient.exe
4432	ScreenConnect.WindowsClient.exe
4432	ScreenConnect.WindowsClient.exe
4432	ScreenConnect.WindowsClient.exe
4432	ScreenConnect.WindowsClient.exe
4432	ScreenConnect.WindowsClient.exe
4432	ScreenConnect.WindowsClient.exe
4432	ScreenConnect.WindowsClient.exe
4432	ScreenConnect.WindowsClient.exe
4432	ScreenConnect.WindowsClient.exe
4432	ScreenConnect.WindowsClient.exe
4432	ScreenConnect.WindowsClient.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4432	ScreenConnect.WindowsClient.exe
4432	ScreenConnect.WindowsClient.exe
4432	ScreenConnect.WindowsClient.exe
4432	ScreenConnect.WindowsClient.exe
4432	ScreenConnect.WindowsClient.exe
4432	ScreenConnect.WindowsClient.exe
4432	ScreenConnect.WindowsClient.exe
4432	ScreenConnect.WindowsClient.exe
4432	ScreenConnect.WindowsClient.exe
4432	ScreenConnect.WindowsClient.exe
4432	ScreenConnect.WindowsClient.exe
4432	ScreenConnect.WindowsClient.exe
4432	ScreenConnect.WindowsClient.exe
4432	ScreenConnect.WindowsClient.exe
4432	ScreenConnect.WindowsClient.exe
4432	ScreenConnect.WindowsClient.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2040	msiexec.exe
2280	msiexec.exe
5860	MsiExec.exe
5636	MsiExec.exe
5600	MsiExec.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5708 wrote to memory of 2040	5708	2026-07-02_0f49708819ea9a7e363d07a526a5f2f3_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe	88
PID 2280 wrote to memory of 5860	2280	msiexec.exe	90
PID 5860 wrote to memory of 5576	5860	MsiExec.exe	91
PID 5860 wrote to memory of 4488	5860	MsiExec.exe	92
PID 5860 wrote to memory of 3512	5860	MsiExec.exe	93
PID 2280 wrote to memory of 2868	2280	msiexec.exe	99
PID 2280 wrote to memory of 5636	2280	msiexec.exe	101
PID 2280 wrote to memory of 5600	2280	msiexec.exe	102
PID 1056 wrote to memory of 4432	1056	ScreenConnect.ClientService.exe	104

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-02_0f49708819ea9a7e363d07a526a5f2f3_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-02_0f49708819ea9a7e363d07a526a5f2f3_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5708
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\26.2.4.9623\344e459ab554378d\ScreenConnect.ClientSetup.msi" SC_EXE_PATH="C:\Users\Admin\AppData\Local\Temp\2026-07-02_0f49708819ea9a7e363d07a526a5f2f3_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe"
  2⤵
  - Badlisted process makes network request
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:2040

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Boot or Logon Autostart Execution: Authentication Package
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 17A017C9ED9899B94A3C29BFD8167E41 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5860
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI39C3.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240728734 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:5576
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI3D20.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240729390 8 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.CheckMsiMotw
    3⤵
    - Badlisted process makes network request
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:4488
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI43D7.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240731125 15 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.CheckMsiFileName
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:3512
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:2868
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 2C03E3150002FB9030E0BFFEE998AEC9
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5636
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding BA3C0CCEC15C54EDF1C8FDF4DA3F40D5 E Global\MSI0000
  2⤵
  - Drops file in Windows directory
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5600

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:1844

C:\Program Files (x86)\ScreenConnect Client (344e459ab554378d)\ScreenConnect.ClientService.exe
"C:\Program Files (x86)\ScreenConnect Client (344e459ab554378d)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&s=bb70c60e-ef10-4267-9099-8b48d7b947e0&k=BgIAAACkAABSU0ExAAgAAAEAAQCNM6Iu3vzNsgaT4UZQJGpMG%2fNQZiSZSHhfVW5QiL2bjx7fuuOKQHHv1Av69OPC9tCbwfWk9GeOuLuSZiWnbfD1dAtdE%2fVEeBmPkEWUbNpSId409IWHtdu9ZYWq%2bZh77lLGYGLGQ8FBV%2fbENSTbudwBTHyZgzFld0yFDkKc2IM5K366ODHtAKZfJv6N6op4Uid0VriFrKEuftXeAlksnfmQgFuUmKdyb0OJCOeZW3RU5zZCtkak9c59I26CQqwUSPOty3DiPB5Nd40t0CRv%2fab9CwUyKpuWRG0O9Ica2FQHLMU7K2XhLRbfX919x%2bDDbUNOoqJzCwC5DJNv5OWwzMq3"
1⤵
- Sets service image path in registry
- Drops file in System32 directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1056
- C:\Program Files (x86)\ScreenConnect Client (344e459ab554378d)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (344e459ab554378d)\ScreenConnect.WindowsClient.exe" "RunRole" "12fe0b95-5b32-469b-bf66-bc82b3785eaf" "User"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:4432

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e598d43.rbs

Path C:\Config.Msi\e598d43.rbs
Size 214KB
SHA256 79da57fa9970f462544c5780bac548ab0abe23ab71040654fc2e8fc54a11860e
MD5 c5e668b49685e6d021e14c27643ad9ef
SHA1 86ceeb94feef5bcd426c252a9f5edff5ef13682d
SHA512 f99818d90b05a674d3797bb9e393e73697c1b20c6b0f7e3f76143049d255a4eefe986c8c5d5ccb3a6d8d8258ef1f13bef8c733c80128ab189ab6adf789a9aa43
SSDEEP 3072:hD9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMGz:hDuH2aCGw1ST1wQLdqvz
TLSH
T140248D217480907EE7FA1A32D93F9A71BE7CF6241760C59E83888C1E5D604C16BF6B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.en-US.resources

Path C:\Program Files (x86)\ScreenConnect Client (344e459ab554378d)\Client.en-US.resources
Size 64KB
SHA256 a189e7cdb5953cbfb808962e5cc30fb344ef4b62cf9ec3533faf6bdc1bede15d
MD5 1f9c54975ff90e202aa76b25c26abf98
SHA1 5da0e535ec64f3d25adc56d01b5be69cd645eb2e
SHA512 3f1a157807d106f43ce3426c6b6248e6d45d09ab3072cb1a02aa7cd65a1c6a07029165617c8dae9d641356a60d2803e2a26ffa78260072013cc03464a2ec1231
SSDEEP 1536:vIDzSbBYQkVp/JzytDksMToY5kF469LwPLYhLKO1R9pbLeMarA:v4zSbaQG/JzytDksMToY5kF469LwPLYe
TLSH
T1A1530C1277FD0A18F5F36F75BE7A94629937BC5A2E25C06E1028415E09B2F80C9B2773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.resources

Path C:\Program Files (x86)\ScreenConnect Client (344e459ab554378d)\Client.resources
Size 6KB
SHA256 bd34378ad99f7609fa0c7c8edde6337c738a61d288863015629329806a1cc728
MD5 1e863134f29bcabe1ee571c91ac4fbe6
SHA1 57cc5966fcae49019da5f8f507c840cedfc103f4
SHA512 7e2640c4ddb8719230de0ddb0d18f9a4b1499a037247f12b142b1c16a2a989390abcb5ac7816a63dbce2d43c08510cec7cfc87cd24458bc2fa919c396b36d4f9
SSDEEP 192:rpDZHfbkqYvZJG293IIs1Z4EO/nM3ZWYijpo2YG:rRZjkqYxJ3JI/sMJ/ijp/p
TLSH
T1D8D13BC49BFEAC3CF05E51BE3A7692990275FF113AA3C3582460106A7F228856C56737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll

Path C:\Program Files (x86)\ScreenConnect Client (344e459ab554378d)\ScreenConnect.Client.dll
Size 412KB
SHA256 c994acfb2bb2515d776ba4f760f9d83e0e9328d591b2a70af7aa6058b28d2b40
MD5 065db6af0f7178ced824c422768be215
SHA1 4e6a4b341cf07ee9231f78d8b4ebe0ce5e557eb7
SHA512 cc6651a0701ceeaea0c2bf450559daa91a205fb3398c0c5d102aa353758038392e5c57c57e18f5812296408eeb005d79ea0fa2a87bbef11faf76a42d51fa5743
SSDEEP 6144:5VTLfK1H+Zfog91vHtFsRJD8ETEavHy+vd7JPYIYyqQni65/PTJ:njpZfog5F4DHTEavSW7OQniOJ
TLSH
T11294D08163E8993EEAAF0A73F09161344E76BC05A543F6AE0D1435F41A7B7838764BD3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Program Files (x86)\ScreenConnect Client (344e459ab554378d)\ScreenConnect.ClientService.dll
Size 89KB
SHA256 e317dbf723fe19eb043b483153a8baf34367b0149271cc0412f257fcef74c6ec
MD5 c98a57a0440d13c8c9e00fb03af76bc4
SHA1 b97ec4920813ba1e756e0909f3b956fae7b02152
SHA512 ad4cd94271e07ccdd8f89caaf35cd4f469f1bf34d657159042ae907e7b79e52f492ff23a6e6ff7e9c9d298f70e8946464b9b4944a1e09a55e5b3f72a79ed3062
SSDEEP 1536:aLO2ARdYMOby1g8VAfSOGI9ATpQbV3lHv0l/yT7yh:aLKYpbVfbna9QbVBv2qTmh
TLSH
T161935B5293AC9926C9DF1E34B461F1600BB1BA13D4E6EBD8AC8C60EA1F523C15F5439F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Program Files (x86)\ScreenConnect Client (344e459ab554378d)\ScreenConnect.ClientService.exe
Size 93KB
SHA256 3ea5899e79699b1844f9d3cfa68940322c48bad71237048c46f3b5159ad744d6
MD5 23ea8dc2068c3b6fb1821b81a08a06c6
SHA1 a614d9f32be820b8eb461a6bf64907d8fafd058d
SHA512 363ab037c7ebbcebf4a520cd7c84260416f44f1007688837c51100a9776c2620e2394863b4140ab1c357773ef0b5a3bc05618e670c9ec7f017a4f55191cc73e3
SSDEEP 1536:6g1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgMU0HMb7DY/tj:7hbNDxZGXfdHrX7rAc6myJkgMU0Hq38h
TLSH
T1F7935B13B5C28872D473093158E1DAB09A3FF9615E61DEAB3788022E4F742C1AE75E77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Program Files (x86)\ScreenConnect Client (344e459ab554378d)\ScreenConnect.Core.dll
Size 575KB
SHA256 3c4dfda67b8d1c89cc405882a1c29bb9dc4b4875b5b9d244e7e350072331b6e6
MD5 098274a1387126fdfc8c5fb11f04c90a
SHA1 9dcdeda19278f23965e2e9ecd36b69a9ba5c4f58
SHA512 bfa75d43778cad0c657d606e4f8f4490e44f9ac4e510a0e55491b01afd2174bb2cdb32ef7b164ec064fdc187335bcc6528807f662515905acfe80d95c6006e3b
SSDEEP 6144:dqF259uAINF9SAV60SnNZp0ArA6BWiAetP5ggjq/bZTS/+hjTax4kxdhnSewrj0r:O2nZIjSd0Qx04A6gKBggO/bZT50Ma
TLSH
T1F6C47D117398B777C97E06B9E07099150379E82672BBF7C7A6A4E4FA2C833844D412B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Program Files (x86)\ScreenConnect Client (344e459ab554378d)\ScreenConnect.Windows.dll
Size 1.7MB
SHA256 3d937470daf37367b95c18965d899805a8b17dccd5d5c94f482944d05b1a8294
MD5 1075c641932894bec9819326b5f4a412
SHA1 29b83563177b2e3369a5b7328ea90f8ad00b5247
SHA512 d01528151245a77e6bad72707a050c6c34401192186fa2f51b9f7de127f2edf7ebea7d253f1fef9ae3202fad572741a945d2819441882c91bdf34275602a5e99
SSDEEP 24576:WCsgGFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUs:xsgGJkGYYpT0+TFiH7efPx
TLSH
T19D85BE41E2C365F5D46B047888BF572ABA743C080365CAFB93D4AE366D33BC09A36756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsAuthenticationPackage.dll

Path C:\Program Files (x86)\ScreenConnect Client (344e459ab554378d)\ScreenConnect.WindowsAuthenticationPackage.dll
Size 254KB
SHA256 a5b8f0070201e4f26260af6a25941ea38bd7042aefd48cd68b9acf951fa99ee5
MD5 5adcb5ae1a1690be69fd22bdf3c2db60
SHA1 09a802b06a4387b0f13bf2cda84f53ca5bdc3785
SHA512 812be742f26d0c42fdde20ab4a02f1b47389f8d1acaa6a5bb3409ba27c64be444ac06d4129981b48fa02d4c06b526cb5006219541b0786f8f37cf2a183a18a73
SSDEEP 3072:qJvChyA4m2zNGvxDd6Q6dtaVNVrlaHpFahvJ9ERnWtMG8Ff2lt9Bgcld5aaYxg:0IvxDdL6d8VNdlC3g0RCXh5D
TLSH
T1C5448E15B7A40CB4EC77823888535A06E776BC160760E6CF03E0825ADF6F7D1A63E762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Program Files (x86)\ScreenConnect Client (344e459ab554378d)\ScreenConnect.WindowsClient.exe
Size 668KB
SHA256 c6e6a312e8d2f5923f1e65004a0e555268194660e768587938753372bcc8d715
MD5 a80bae57fbd0d50dcd60d57236b0d853
SHA1 ca09b9872bf67cd5bf11d69578df3a793d5ead95
SHA512 b8c0b46749f65fca83f2ca00040df8007508591db14bae6709cddf83a66eec525a9a27d4287795ba77c230239e1381a7458ceff4a1e1542d79c882de3449d335
SSDEEP 12288:HQGxjhXiSOV/HRD/fiIDXWTOtBM4HhPee1KXWz/HgGBZ0T3:HqJbiIDSpaeiZT0T3
TLSH
T12DE47D2177BC9A7BC9AF0B3A7073195417B8E5117185EB4FF650A6EA0EC27808E053DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Program Files (x86)\ScreenConnect Client (344e459ab554378d)\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
TLSH
T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsCredentialProvider.dll

Path C:\Program Files (x86)\ScreenConnect Client (344e459ab554378d)\ScreenConnect.WindowsCredentialProvider.dll
Size 838KB
SHA256 7dbaf97286ab44c5741715ef839f309b1ec9101205e03913ef72e947bd849463
MD5 39d15825bc16d2c5c6887ad2ffe3c5d9
SHA1 6133ceb935ec0d13047ee3135834c09a0ad0e9d7
SHA512 2c53cd88888af3563ae42faa6f2dbe62606e28993d653cd7bacb030a2ae8c351eddae2d7e0e7ce0cbb7affc73f26089f1b676910736fe15d80838fe4ee5a33fe
SSDEEP 12288:yhUSQJg/+QShEMuu/gUD+FkoiS+upfHHV:ywNQrMuu/gUD+Son+2fnV
TLSH
T13C054C1BE7A440B9C0ADC6B5C35B9736BBB6F4864514B29F07D40A227F6BF40AB1D384
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.config

Path C:\Program Files (x86)\ScreenConnect Client (344e459ab554378d)\app.config
Size 827B
SHA256 d6a81b4e25291a9eb6cc9941ce6c533631b356e6466681bed1079c31d1959994
MD5 5e0252fa6d04d68f7080a8d6f550e032
SHA1 059795f40901a86d187ddf6b279af684e0321017
SHA512 1156689d9f9e242a16ba2659f4e448e70d8da7fe486cbd3fba6c351c527b53aed11645491834d3ae944a53b4dead23201f7b0ff0503581f38c498bb4a0fa68db
TLSH
T1AD01884DB0C0AF6912636A33EB3142C1ED708667059570E474DF21739F70ADA07E3796
MD5 SHA1 SHA512 TLSH

Submit Download

system.config

Path C:\Program Files (x86)\ScreenConnect Client (344e459ab554378d)\system.config
Size 900B
SHA256 4bf88a8dd325cba093852715aa7494ecc58de51ec85493e6891152c2b899f423
MD5 577f233c0f337d15f2a962fda6441120
SHA1 3ad35dc2b14d0e97fb27ae2f7872eb0b80a491d6
SHA512 bd4180bfa3fe8e439572085550cb911c3d83eec7d367a5293414de88d7f71d530065b155aebab04236b53f5b99b1a238ccdfce7c48872c9a445028e848566253
TLSH
T1E911236139413D9E0FB32F23C4158788EDB55B9A402515D874EE627A8F354EE03B318D
MD5 SHA1 SHA512 TLSH

Submit Download

MSI39C3.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI39C3.tmp
Size 1.1MB
SHA256 3c86ffd2223664767c965a1f133622152a259f9406abad4407c3178e88ac43cf
MD5 9f4c095ada9fa9d3a4b9f858984cea47
SHA1 f1232f7ab6ca8cac468c574ffbfc2b8739a1aee4
SHA512 31d501c50ed17597e5315ce3cdcb1036dfd860454ab7d948a80a6646dea4d559d655f752c9dab45df5dd6b8ccb890a433d724372e560fb68ae536cad3d1d82af
SSDEEP 24576:mUUGGFuEiTGQsP7A0wedRzSLwuvY3ZR4SImQQqc8mybQLDUk:pGFOijF1wLwuvUZR4SIJ3QLn
TLSH
T18F35231037B5A47BE3FB5E319C78B2706AAE38652B74C48D2705064E1E707D2EBB5722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Deployment.WindowsInstaller.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI39C3.tmp-\Microsoft.Deployment.WindowsInstaller.dll
Size 172KB
SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
MD5 5ef88919012e4a3d8a1e2955dc8c8d81
SHA1 c0cfb830b8f1d990e3836e0bcc786e7972c9ed62
SHA512 4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684
SSDEEP 3072:FkfZS7FUguxN+77b1W5GR69UgoCaf8TpCnfKlRUjW01Ky4:x+c7b1W4R6joxfQE
TLSH
T14E045B2563FC473ECAEF87B4E2624251E7B2E2E97113DB0DDC8541AA2522780F792753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI39C3.tmp-\ScreenConnect.Core.dll
Size 565KB
SHA256 46269076b7d852e2a80630d69e41200504ffb4decfcbd5996b0cf2d95fc2b30e
MD5 0494d7c175b247adb668876185dfd278
SHA1 779ddf017d4899dfdd7aca25b69defc1700c9fff
SHA512 8ea458bb266db5d236a0698f0fd668278dbcda11310e9bf9dd09d2131b7a5af8810f0e0c185913b753287df09964e184c42f41b05e1b364a70c6a3f646ec816a
SSDEEP 6144:wqF259uAINF9SAV60SnNZp0ArA6BWiAetP5ggjq/bZTS/+hjTax4kxdhnSewrj0M:h2nZIjSd0Qx04A6gKBggO/bZT50M
TLSH
T1B7C46C117398B777C97E06BAE07499150379E82671BBF7C7A6A4E4FA2C833844D012B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.InstallerActions.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI39C3.tmp-\ScreenConnect.InstallerActions.dll
Size 24KB
SHA256 dcd87dfa47e112f7001e313a63ca3084328543f5673cd1ce2993b16c848a3ec5
MD5 7c3212371b620308412aff8dde3ef313
SHA1 97935daf66afbedbbfeb8c21f991fbd5d3b4b39f
SHA512 2fe9607d4e95a318c76b337f2fbcb44b65540f89e51c091b328c8d57cd1fd87ce923cd85f787a610d63365758238387279ed6fd26d1f1be22895fb303174c37b
SSDEEP 384:gNazzV1VTsaS8hQlLkmoA0V7NaNeirM0dbMsFkjvZBX20Opa:OazC90VMcLvF9
TLSH
T1EBB2D620674DE27AF9EA1634B563F7B001B37DB3CCE9DA8525A420153C253E04FB5B06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI39C3.tmp-\ScreenConnect.Windows.dll
Size 1.7MB
SHA256 ef26cc20794ae6e01d060a3c186998bc90587774cab8da5c76bb72666896abc4
MD5 300f1f7213b2eac28f009cd0a297c1ba
SHA1 0c6eee77d354a77b9bd6b9e397ec848219d1441f
SHA512 790d5871145e75b4a830faf075aa2970cbb78ab339b9117b1ebc53fbb3ff6b2190b01427f10a406e06d8c62837ccc25f28e1e521797268e68482bc33aa49a1a4
SSDEEP 24576:BCsgGFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUw:0sgGJkGYYpT0+TFiH7efP
TLSH
T16D85BD41E2C365F5D46B047888BF572AB6743C080365CAFB93D4AE366D33BC09A36796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CustomAction.config

Path C:\Users\Admin\AppData\Local\Temp\MSI3D20.tmp-\CustomAction.config
Size 234B
SHA256 7027b69ab6ebc9f3f7d2f6c800793fde2a057b76010d8cfd831cf440371b2b23
MD5 6f52ebea639fd7cefca18d9e5272463e
SHA1 b5e8387c2eb20dd37df8f4a3b9b0e875fa5415e3
SHA512 b5960066430ed40383d39365eadb3688cadadfeca382404924024c908e32c670afabd37ab41ff9e6ac97491a5eb8b55367d7199002bf8569cf545434ab2f271a
TLSH
T18CD0A70405D0FD1B5E231A2337524559FF34B1E290A44408B06F3A130A220CD4757317
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsInstaller.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI3D20.tmp-\ScreenConnect.WindowsInstaller.dll
Size 137KB
SHA256 28d961577af7fd650c0a031582e14383acacf6260a7e2e6700844da82ac0b871
MD5 fb1c245a7e78b852a52781519661c192
SHA1 5019c5f0e559ac5f79e6e1f6872274823162388a
SHA512 d79d467cf8dceb20a261fc9238db16b0cbdd469dbbe3c7a02ce07e3a0731757a2cc13d336577a7364533aba969987a5195ab9dc8b2ce6671d2e0a9392b46eaa1
SSDEEP 1536:+6PufIhTx7WsJU5Ds9ZrUP43HO6A16dTKHkvDutUVfh5U3KiQtlJwWq8qo0yv:/PufGKTJ4XXSk1VfjwDne
TLSH
T185D3393463AC9A37E6EF5AB9E431B1440BF2B527B4E3F78D694864F81C127914B20367
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientSetup.msi

Path C:\Users\Admin\AppData\Local\Temp\ScreenConnect\26.2.4.9623\344e459ab554378d\ScreenConnect.ClientSetup.msi
Size 11.8MB
SHA256 85663af2de2563f3a3b402e89d44331da5b823487b807e4c0b927996f9a54137
MD5 ca22086099f9cccb6be4dbfc57667e46
SHA1 0dad7150086503e458d24b40de9198335d8b0f79
SHA512 bc6124c0b1ddc1a15b3590605f592ba94db07d21d896010fd7666216f7b81fe7ad37f65a3624af2b16d1dce3e2f0fe1c9a5e6c9f19fd1930abf0c1e1edda3191
SSDEEP 196608:N0aDbXyhlMudpz0aDbXyhlMu20aDbXyhlMup0aDbXyhlMuH0aDbXyhlMu:WaD27M3aD27MeaD27M1aD27MtaD27M
TLSH
T19DC6232137DA856AD1F70A36DC7991B45976BC299F62C02F13A0790D6831FC086B3BB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI935E.tmp

Path C:\Windows\Installer\MSI935E.tmp
Size 202KB
SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
MD5 ba84dd4e0c1408828ccc1de09f585eda
SHA1 e8e10065d479f8f591b9885ea8487bc673301298
SHA512 7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290
SSDEEP 3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
TLSH
T129147C326494803EE7F91A36D93E9A61AE7DF6241760C99EC3848C0E5D604D06BF7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2aftjt1b.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (344e459ab554378d)\2aftjt1b.newcfg
Size 587B
SHA256 68c409403f24caa1e7c01c0c0dc7c326ddfe12db73212238bc5ffbd437be65bd
MD5 bb0908402745bc72d9dcaca52d63a9ac
SHA1 aa918f87b0d4629f5ed0b92bca7344f01868537e
SHA512 56f3e3d3dd738a07084ecd211ff5ee981c0a372b9aacabd53358fa398d1e8c8b848acf2df4b120aecfbcf08c67c4ee3d974ddf8eeeb1d23f9e83d94f699ce34f
TLSH
T188F046A430846E4A02B35D23C9564340FD716B9B0059208874AF217A9F3159F03A32DB
MD5 SHA1 SHA512 TLSH

Submit Download

axi32rtr.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (344e459ab554378d)\axi32rtr.newcfg
Size 587B
SHA256 f187bf8e196a27b8269775142cf0a1ebf5af583229be7c3bb65109c8249aeef6
MD5 dfebc6e73e0e6d1792225bd02938aded
SHA1 cc5d71001bc78275dc81b6b9ae68bdc381f4a4eb
SHA512 0117ae9cc52a6ee0240d83c260ef145aaa2b4bceab21da3860a2679bb994c4377c63c0fe07be132be2c42eb54a1b79a87a7968b50beb5af7fa33a5f9c3747841
TLSH
T1BBF046A430807E4A02B35D23C9164340FD715B9B0055208874AF217A9F3159F03A32DA
MD5 SHA1 SHA512 TLSH

Submit Download

dwfquw2e.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (344e459ab554378d)\dwfquw2e.newcfg
Size 587B
SHA256 5287030b972966ca42905cf69589ac109efc7031af14139783665791ab5264c7
MD5 33de60474ba81554b69c8ff8d187e121
SHA1 797b8ed6dcb58e855149536bf8627773ec8cffd3
SHA512 325c34c534084609552d4fbd334dc76d9fa04b30e1d0fadbfd9f9bb6c90993bdbbfe9daf647bef382ab0e2779c4bc85723165ab4155728e74c56d5c42957306a
TLSH
T1D1F046A530846E4A02B35D23C5124340FE716B9B0019208CB4AF213A9F3159F03A32DA
MD5 SHA1 SHA512 TLSH

Submit Download

hvbkoikx.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (344e459ab554378d)\hvbkoikx.newcfg
Size 587B
SHA256 f32ce0c7446442f6ee454c6abaa0c2df2343a2d442b1c686ccaa188fdf7a1f32
MD5 02b73ecf3a59315123d3bf19a58db65e
SHA1 e743c6f170f0d3d74277df241e1f6af1577251b7
SHA512 89c58bf79c3a31387eb1d727d3d8dc72133d3113a77f0ba3a635351c67c93edd3ac91d958097472a7da366a88748eadbfeb447965fe19038fc58826c877a7446
TLSH
T13AF046A530846E4A02B35D23C5124344FD716B9B0019208CB4AF217A9F3159F03A32DA
MD5 SHA1 SHA512 TLSH

Submit Download

putgpzm2.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (344e459ab554378d)\putgpzm2.newcfg
Size 587B
SHA256 4c0230e6b1d09eb65ae33e0683203cbff2e0fe77afbd3e6758d0bb076dc28cf2
MD5 2cb312b5839f08db766dca90fb175b4c
SHA1 b223f34e6030eb0542c70d3308451cf7a0993f2c
SHA512 a70b386773d1c62eb8a126b45d96f492920a12c5dbc7505e44fc8dbb7703bca5ec1365138fbe963e226131649310d9be5cf179fb44e98c41e0df9236161cdd52
TLSH
T176F046A430846E4A02B35D23C9164340FD716B9B00592088B4AF217A9F3159F03A32DA
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (344e459ab554378d)\user.config
Size 587B
SHA256 aeb1a2cc0aa9641630cf06918562c91ebba0058690b6dcb257840f5c514be63c
MD5 3a996d8a97395dc46973547c160b52b3
SHA1 e0b7e22177603fd3f08e06d7d739b27205335b15
SHA512 82fb416b653fa76f41f8cbd6d5bea07268e30d79297c1d3e4a1bde27789d325f9d71ac8d4d24fd107880ba5988ee05ef2409e1fb09fa6dd0bc062c0e0f9a0f4b
TLSH
T149F046A530806E4A02B35D23C9164344FD715B9B0055208874AF217A9F3159F03A32DA
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (344e459ab554378d)\user.config
Size 587B
SHA256 f07077aae4ac51f2bd791a9ea1d6547f75c46de3dadf0243aa41f00edf04ca15
MD5 de914d4a15852e49215103db613a6683
SHA1 0ff0535c5503c59ab525dfe6cb182e42288829c0
SHA512 fd158853168e95fd7f6b5a17c14e44395a5d873fae6746560481ce98f738569659dfbba1048082434ccd421cd8508265137c249e78184b3dcf10f93906f06511
TLSH
T1A0F046A430807E4A02B35D23C9164340FD715B9B0455208874AF217A9F3159F03A32DB
MD5 SHA1 SHA512 TLSH

Submit Download

va55psbv.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (344e459ab554378d)\va55psbv.newcfg
Size 587B
SHA256 8a27d5d04acafa57f8c06290d22486b683067e8c9a1e91a9e00ccbcf24b3535d
MD5 304f744a43e35571bd5b3c38191ceaa7
SHA1 127e12656adda6a6c8aafbeeaa1497f62f756ebe
SHA512 316b65dd9295ca02feab7f5b6cec31941e5d9c651518457b260b362133bc57850179b293f519a854f7a552779309a7d771b4a9be62e48cb6833fbd8ea3eed3f5
TLSH
T176F046A530846E4A02B35D23C5168344FE716B9B0059208CB4AF213A9F3159F03A32DA
MD5 SHA1 SHA512 TLSH

Submit Download

{d0180a2d-7d9a-445e-925b-9d27a1c05052}_OnDiskSnapshotProp

Path \??\Volume{da0117bb-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{d0180a2d-7d9a-445e-925b-9d27a1c05052}_OnDiskSnapshotProp
Size 6KB
SHA256 41c4266935c060926587c9f1ce783664f73a15a8319a77e59e6f490d327cc3ab
MD5 03526ebebe7fea513c5f0164366c2d6e
SHA1 7c6d89bbdd6d1017fc2d77ffc3a262e61d0a0384
SHA512 3dba30b27a2472b391b3d0da0ec07539a29e1f9bf085b54b3b15450121922a59e064689a0c49792a6235933165bde1592e23d482e1353985943223869019bfba
SSDEEP 96:FCQV0uivc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:Fkb++uVm
TLSH
T165D186184AE54711E2B3AB3129F18557A837B811EF33CB8E0198638E2630A14F835F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1056-186-0x0000000003EC0000-0x0000000003F2C000-memory.dmp

Download

memory/1056-188-0x0000000003C90000-0x0000000003CD1000-memory.dmp

Download

memory/1056-190-0x00000000041C0000-0x0000000004295000-memory.dmp

Download

memory/1056-168-0x0000000003D10000-0x0000000003EC0000-memory.dmp

Download

memory/1056-158-0x00000000014E0000-0x00000000014FA000-memory.dmp

Download

memory/1056-164-0x0000000003AC0000-0x0000000003B54000-memory.dmp

Download

memory/1056-182-0x0000000003C40000-0x0000000003C90000-memory.dmp

Download

memory/4432-202-0x000000001C5D0000-0x000000001C758000-memory.dmp

Download

memory/4432-205-0x0000000003310000-0x0000000003351000-memory.dmp

Download

memory/4432-200-0x000000001C040000-0x000000001C0D4000-memory.dmp

Download

memory/4432-204-0x00000000032F0000-0x000000000330A000-memory.dmp

Download

memory/4432-203-0x0000000003180000-0x000000000319A000-memory.dmp

Download

memory/4432-201-0x000000001C290000-0x000000001C440000-memory.dmp

Download

memory/4432-199-0x000000001BB90000-0x000000001BBFC000-memory.dmp

Download

memory/4432-198-0x0000000000EA0000-0x0000000000F4A000-memory.dmp

Download

memory/4488-80-0x00000000040B0000-0x00000000040D8000-memory.dmp

Download

memory/5576-46-0x0000000003430000-0x00000000034C4000-memory.dmp

Download

memory/5576-42-0x0000000003360000-0x000000000336C000-memory.dmp

Download

memory/5576-38-0x0000000003320000-0x000000000334E000-memory.dmp

Download

memory/5576-50-0x00000000056F0000-0x00000000058A0000-memory.dmp

Download

memory/5708-13-0x00000000742C0000-0x0000000074A7C000-memory.dmp

Download

memory/5708-1-0x0000000001C20000-0x0000000001C28000-memory.dmp

Download

memory/5708-2-0x0000000003590000-0x000000000359C000-memory.dmp

Download

memory/5708-5-0x00000000742C0000-0x0000000074A7C000-memory.dmp

Download

memory/5708-4-0x0000000005AC0000-0x0000000005AE8000-memory.dmp

Download

memory/5708-3-0x0000000005B30000-0x0000000005BC4000-memory.dmp

Download

memory/5708-6-0x0000000005BC0000-0x0000000005D70000-memory.dmp

Download

memory/5708-14-0x00000000742C0000-0x0000000074A7C000-memory.dmp

Download

memory/5708-15-0x00000000742C0000-0x0000000074A7C000-memory.dmp

Download

memory/5708-8-0x0000000006330000-0x00000000068EA000-memory.dmp

Download

memory/5708-10-0x0000000005E50000-0x0000000005EE2000-memory.dmp

Download

memory/5708-9-0x00000000742C0000-0x0000000074A7C000-memory.dmp

Download

memory/5708-7-0x00000000742C0000-0x0000000074A7C000-memory.dmp

Download

memory/5708-11-0x00000000742D2000-0x00000000742D3000-memory.dmp

Download

memory/5708-0-0x00000000742D2000-0x00000000742D3000-memory.dmp

Download