3c50648a814c910e0dd75b3066ce386742373e12fb98e0657158396e12b1d16b

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/07/2026, 09:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-23_1b66a222c74b7c889d96902260e81da8_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe
Size 5.0MB
Sample260723-lay47aba85
SHA256 3c50648a814c910e0dd75b3066ce386742373e12fb98e0657158396e12b1d16b
MD5 1b66a222c74b7c889d96902260e81da8
SHA1 7d6829a89180cbf3ec45d294c788867fd738e296
SHA512 1cebddb2ca075c52a9ee27c300a1141c7ad0c7f0c6929a6ddcb2e15b0a4b1521c582ab1bc0e91e583ec17739bbcb4b05be52a04b37b74e60e1989614a7501bcf
SSDEEP 98304:5h6+6efPBJYV6lVhSxWGIdYdsBDG0uWT5hWOgcD:EefPcVinNGInBphDgI
TLSH
T14D36F112F7D581B6D0BF0638E87956669770BC095322C76F9394BD693D33B809E223B2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

backdoor discovery persistence privilege_escalation ransomware rat revoked_codesign

Malware Config

Signatures

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (1830d7263bc4f64f)\ImagePath = "\"C:\\Program Files (x86)\\ScreenConnect Client (1830d7263bc4f64f)\\ScreenConnect.ClientService.exe\" \"?e=Access&h=instance-ohfrcy-relay.screenconnect.com&p=443&s=9cb40ee6-37fa-4e03-b811-b589b4508b6b&k=BgIAAACkAABSU0ExAAgAAAEAAQBZBxE%2b%2fLmV2LWEo6f3GK6kMCawIOzG2i9%2fLGy74%2bJOSffsnxdF596HGQFsa5Xbt1odASOkNVzF%2b6%2fbeG05DFjayWyir4lssBizvNB2W8iUTyb9R%2fDlDWkZqxh2xJ%2bMYx59GuM6%2fFTsfAOeC8p5clju7OS20ktMN7bnRsFe7WUr3p03lX9z3bbLzx52ghTN7zX4EI4mAK1T99H%2bmkOqiGxSxtBZAkT1gbstSBa0768hMWd0fnoBJPifWdshoQagaofkAhkN8AmDk09yqRef%2bev7ajtvVp4oVIZtB1asKzUrKkdJQ6fG5%2f%2f5103L5NcU9l1OvtJZB%2foUpJoe2JmaD927&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAAQ%2fhSTBw1sUO0skS28pJRRwAAAAACAAAAAAAQZgAAAAEAACAAAABELv2ZvRnX%2bRW4PeACMxg8Bi3a7MENnG%2fncXhGln2azAAAAAAOgAAAAAIAACAAAADO68tV6pIs6iPEWn546gP7lY4U2p6FmSMbDMH2Z5Hwe6AEAADH3wr%2f%2fbRam1KY%2fG1uWDGVx7FcXNEtz13yDj1fBy0Hvv43yhPMxHPOXvsngJXulFpxTIuy7S6OdcZ%2bdDZwU3iRmTib7Ka1w%2fOFEE0FZ7ZlkzqpWBb2P1KRZfxa%2bISqJYJDjTFrHg0MmY7PQbLhvHPlxONLbYcoQWNgHZIyhj5sPkdsgkg3ZTaKU3AspbeEdII9HOul67kvCmJq7ilAUTYh7rxTVmcDF%2f1PnbT%2fcA6JsLejN3gnvW%2f4fV6a4eIj0PPoJRAa8i2zJ%2fPMkcktFwfO%2bIAX1d7eDd%2fE5rrqxSE8olYsldIlTkrzGwYEvQUHLagkdGsbYCHzCUpD8JfiM5akRNjX3auqPvVCtIpcM3oRFQ9qixn07KijpPLn%2fkfTKDL8rcsztW4MDoG9Y08FUkWYCnhJdNhEVo%2fOHxDJFi%2bs3cbKuFvLe1etkf%2bk22MoKUOPZs2f8DiTPI565DTiN2twkw%2fHsN0fkFP0V4R%2f8Hfs%2f810spITQgj%2fFPBrSrCYHOV9QvGX9BJRCi57eYlM5Cu90mI9rJxdAJieHDJ8r6VrhbgAhOt6b9Rfd4Dqwoyh4qVB6WQ6z%2fCEoUzKZcuM%2bA3qn6j6iI%2fEF8369zMGF9%2bJoF1eXs0OyjdUj3aQPBb733KmD3EgL8Ng90XFSUtglgt0E7f3%2f11fLyunCjZVWOUvQu0E%2b%2b0A4WbR8cvDB%2fXf4u%2fAUvkrMoTMOTNSVkUxAV5pHp%2fNJYZ%2bBjjkSIvboNA3pa%2fVtnqm1gU86YVuAIAq0wVOA44woqcggcJ38Ro1P0SZDGpPSRGaXjxc9NYZhT27AjtUQuou%2f2YV1xEMcNjeqZiA9cw62o3isORwVMN%2fX2SPoCS2UrEkE9KCyJbbGsrrFQCr%2b1g2fPnCQt6phh%2byN3YNRgqrVB2zFBZu6tKEQK18j7cxLZPY8tMPvw58mp97sABcuj5zBEL7V%2b02YjgxCvLqZeFgzj6Tyg%2fN2wJTrKn1VPBgmLJ2qnrQVlCn3N4KwZBg23haslKWXt4sEr%2fZPiP%2bRqBic4gu%2fM3gb3ZBboEFxPqpAmPARbludzCrbRHbOTNparmLaH38h2VbffuRs8fiuq%2bQ%2fEYVTJTbqAweFBf6DJx5H8rzz3nT%2f80DNCwqTHPx%2f5aI3xJX7QErAJi3NeEUYS3CaKxA0ftaDUUeC93pXfoGJ2DDxkxBzPySCWTSjRT9lzwmeByJ502Jlyfp6zVsX9g7B7HEufsn%2fvkfg7Htjgh%2bjqfNuhL3l3163M0gwACyW0lu1JhtJ0m9bQcILBzDCEmK8GG2jWr%2bjPRBc8e14PL2L%2b5aHUZJCtg%2bWBIa6OrkgdXTLJIITwjOd0%2bTUaWT280DKbX3GMB6nTOTOyQ5oQgNTYNOzBz0BLL%2ft%2bIFOHTFgN4gtFkuLP88g%2bvwZH338xU6ZovbHgwZozp3wHGxbrp7tqB7TpnV%2fB8NX8Obi6SJYOntdpl2FfBQo4kuiCDWJMkpuphOoIPRQcQzAgFNDk%2b7l64UtoSMLW2yNDN46bbKLt4r8VyEXHg1qBfXjwqn2%2fpZbqsPFXXgzi2JsYTjhwlFSATBfJlSuog1%2b%2fh2UkAAAAA0Hhi%2btyHI4TQBK5rxuDzQY7bA3jHHj2ms94zSE89zboq7qjgNk3P11LIFOpXjlpLwtqEuex97nhfy3IU4tN9d\""	ScreenConnect.ClientService.exe

Signed with revoked ConnectWise certificate 5 IoCs

Binary is signed using a ConnectWise certificate revoked for key compromise.

revoked_codesign

resource	yara_rule
behavioral1/memory/4352-3-0x0000000005470000-0x000000000572E000-memory.dmp	revoked_cert_connectwise
behavioral1/files/0x00070000000245bb-70.dat	revoked_cert_connectwise
behavioral1/files/0x00070000000245ba-105.dat	revoked_cert_connectwise
behavioral1/memory/3388-106-0x0000000003DC0000-0x0000000003E7E000-memory.dmp	revoked_cert_connectwise
behavioral1/files/0x00070000000245b8-114.dat	revoked_cert_connectwise

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	2026-07-23_1b66a222c74b7c889d96902260e81da8_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe

ConnectWise ScreenConnect remote access tool
ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
backdoor rat
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 2 IoCs

pid	Process
3388	ScreenConnect.ClientService.exe
4064	ScreenConnect.WindowsClient.exe

Loads dropped DLL 20 IoCs

pid	Process
4244	MsiExec.exe
2148	rundll32.exe
2148	rundll32.exe
2148	rundll32.exe
2148	rundll32.exe
2148	rundll32.exe
2148	rundll32.exe
2148	rundll32.exe
744	MsiExec.exe
928	MsiExec.exe
3388	ScreenConnect.ClientService.exe
3388	ScreenConnect.ClientService.exe
3388	ScreenConnect.ClientService.exe
3388	ScreenConnect.ClientService.exe
3388	ScreenConnect.ClientService.exe
3388	ScreenConnect.ClientService.exe
3388	ScreenConnect.ClientService.exe
3388	ScreenConnect.ClientService.exe
3388	ScreenConnect.ClientService.exe
3388	ScreenConnect.ClientService.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe

Drops file in System32 directory 15 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1830d7263bc4f64f)\hiqummg0.tmp	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1830d7263bc4f64f)\b33kyaar.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1830d7263bc4f64f)\np5mi4wi.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1830d7263bc4f64f)\b33kyaar.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1830d7263bc4f64f)\1svguyck.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1830d7263bc4f64f)\hiqummg0.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1830d7263bc4f64f)\b33kyaar.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1830d7263bc4f64f)\1svguyck.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1830d7263bc4f64f)\1svguyck.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1830d7263bc4f64f)\user.config	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1830d7263bc4f64f)\np5mi4wi.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1830d7263bc4f64f)\np5mi4wi.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1830d7263bc4f64f)\c4qr2vc0.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1830d7263bc4f64f)\c4qr2vc0.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1830d7263bc4f64f)\c4qr2vc0.newcfg	ScreenConnect.ClientService.exe

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ScreenConnect Client (1830d7263bc4f64f)\ScreenConnect.Windows.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (1830d7263bc4f64f)\ScreenConnect.WindowsBackstageShell.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (1830d7263bc4f64f)\ScreenConnect.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (1830d7263bc4f64f)\ScreenConnect.WindowsBackstageShell.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (1830d7263bc4f64f)\ScreenConnect.WindowsClient.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (1830d7263bc4f64f)\app.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (1830d7263bc4f64f)\Client.Override.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (1830d7263bc4f64f)\ScreenConnect.WindowsClient.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (1830d7263bc4f64f)\ScreenConnect.WindowsCredentialProvider.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (1830d7263bc4f64f)\Client.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (1830d7263bc4f64f)\ScreenConnect.Client.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (1830d7263bc4f64f)\ScreenConnect.ClientService.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (1830d7263bc4f64f)\Client.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (1830d7263bc4f64f)\system.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (1830d7263bc4f64f)\ScreenConnect.ClientService.dll	msiexec.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e585176.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e585176.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5280.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI59D5.tmp	msiexec.exe
File created	C:\Windows\Installer\wix{1326E1EB-A457-46F8-8A29-5F708FC47007}.SchedServiceConfig.rmi	MsiExec.exe
File opened for modification	C:\Windows\Installer\{1326E1EB-A457-46F8-8A29-5F708FC47007}\DefaultIcon	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{1326E1EB-A457-46F8-8A29-5F708FC47007}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI52DF.tmp	msiexec.exe
File created	C:\Windows\Installer\e585178.msi	msiexec.exe
File created	C:\Windows\Installer\{1326E1EB-A457-46F8-8A29-5F708FC47007}\DefaultIcon	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-23_1b66a222c74b7c889d96902260e81da8_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenConnect.ClientService.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000f94cc820840d1c590000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000f94cc8200000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900f94cc820000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1af94cc820000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1df94cc820000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.ClientService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.ClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	ScreenConnect.ClientService.exe

Modifies registry class 37 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-1830d7263bc4f64f\shell\open	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-1830d7263bc4f64f\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-3090-EFB869D1737A}\InprocServer32\ = "C:\\Program Files (x86)\\ScreenConnect Client (1830d7263bc4f64f)\\ScreenConnect.WindowsCredentialProvider.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BE1E6231754A8F64A892F507F84C0770\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-3090-EFB869D1737A}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BE1E6231754A8F64A892F507F84C0770\PackageCode = "356C6F2EF580F0C40ABE7482C3F09E5F"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-1830d7263bc4f64f\shell	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BE1E6231754A8F64A892F507F84C0770	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BE1E6231754A8F64A892F507F84C0770\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BE1E6231754A8F64A892F507F84C0770\ProductIcon = "C:\\Windows\\Installer\\{1326E1EB-A457-46F8-8A29-5F708FC47007}\\DefaultIcon"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BE1E6231754A8F64A892F507F84C0770\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BE1E6231754A8F64A892F507F84C0770\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-3090-EFB869D1737A}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-3090-EFB869D1737A}\ = "ScreenConnect Client (1830d7263bc4f64f) Credential Provider"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\BE1E6231754A8F64A892F507F84C0770	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\BE1E6231754A8F64A892F507F84C0770\Full	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BE1E6231754A8F64A892F507F84C0770\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\4C9BEEA2A1A05E8581037D62B34C6FF4	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BE1E6231754A8F64A892F507F84C0770\SourceList\PackageName = "setup.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-1830d7263bc4f64f	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BE1E6231754A8F64A892F507F84C0770\ProductName = "ScreenConnect Client (1830d7263bc4f64f)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BE1E6231754A8F64A892F507F84C0770\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BE1E6231754A8F64A892F507F84C0770\Version = "369699165"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BE1E6231754A8F64A892F507F84C0770\Clients = 3a0000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-1830d7263bc4f64f\UseOriginalUrlEncoding = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-1830d7263bc4f64f\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-3090-EFB869D1737A}\InprocServer32	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BE1E6231754A8F64A892F507F84C0770\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\4C9BEEA2A1A05E8581037D62B34C6FF4\BE1E6231754A8F64A892F507F84C0770	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BE1E6231754A8F64A892F507F84C0770\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BE1E6231754A8F64A892F507F84C0770\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BE1E6231754A8F64A892F507F84C0770\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-1830d7263bc4f64f	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-1830d7263bc4f64f\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (1830d7263bc4f64f)\\ScreenConnect.WindowsClient.exe\" \"%1\""	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BE1E6231754A8F64A892F507F84C0770\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BE1E6231754A8F64A892F507F84C0770\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-1830d7263bc4f64f\URL Protocol	msiexec.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1132	msiexec.exe
1132	msiexec.exe
3388	ScreenConnect.ClientService.exe
3388	ScreenConnect.ClientService.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4352	2026-07-23_1b66a222c74b7c889d96902260e81da8_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe
Token: SeShutdownPrivilege	2408	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2408	msiexec.exe
Token: SeSecurityPrivilege	1132	msiexec.exe
Token: SeCreateTokenPrivilege	2408	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2408	msiexec.exe
Token: SeLockMemoryPrivilege	2408	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2408	msiexec.exe
Token: SeMachineAccountPrivilege	2408	msiexec.exe
Token: SeTcbPrivilege	2408	msiexec.exe
Token: SeSecurityPrivilege	2408	msiexec.exe
Token: SeTakeOwnershipPrivilege	2408	msiexec.exe
Token: SeLoadDriverPrivilege	2408	msiexec.exe
Token: SeSystemProfilePrivilege	2408	msiexec.exe
Token: SeSystemtimePrivilege	2408	msiexec.exe
Token: SeProfSingleProcessPrivilege	2408	msiexec.exe
Token: SeIncBasePriorityPrivilege	2408	msiexec.exe
Token: SeCreatePagefilePrivilege	2408	msiexec.exe
Token: SeCreatePermanentPrivilege	2408	msiexec.exe
Token: SeBackupPrivilege	2408	msiexec.exe
Token: SeRestorePrivilege	2408	msiexec.exe
Token: SeShutdownPrivilege	2408	msiexec.exe
Token: SeDebugPrivilege	2408	msiexec.exe
Token: SeAuditPrivilege	2408	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2408	msiexec.exe
Token: SeChangeNotifyPrivilege	2408	msiexec.exe
Token: SeRemoteShutdownPrivilege	2408	msiexec.exe
Token: SeUndockPrivilege	2408	msiexec.exe
Token: SeSyncAgentPrivilege	2408	msiexec.exe
Token: SeEnableDelegationPrivilege	2408	msiexec.exe
Token: SeManageVolumePrivilege	2408	msiexec.exe
Token: SeImpersonatePrivilege	2408	msiexec.exe
Token: SeCreateGlobalPrivilege	2408	msiexec.exe
Token: SeCreateTokenPrivilege	2408	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2408	msiexec.exe
Token: SeLockMemoryPrivilege	2408	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2408	msiexec.exe
Token: SeMachineAccountPrivilege	2408	msiexec.exe
Token: SeTcbPrivilege	2408	msiexec.exe
Token: SeSecurityPrivilege	2408	msiexec.exe
Token: SeTakeOwnershipPrivilege	2408	msiexec.exe
Token: SeLoadDriverPrivilege	2408	msiexec.exe
Token: SeSystemProfilePrivilege	2408	msiexec.exe
Token: SeSystemtimePrivilege	2408	msiexec.exe
Token: SeProfSingleProcessPrivilege	2408	msiexec.exe
Token: SeIncBasePriorityPrivilege	2408	msiexec.exe
Token: SeCreatePagefilePrivilege	2408	msiexec.exe
Token: SeCreatePermanentPrivilege	2408	msiexec.exe
Token: SeBackupPrivilege	2408	msiexec.exe
Token: SeRestorePrivilege	2408	msiexec.exe
Token: SeShutdownPrivilege	2408	msiexec.exe
Token: SeDebugPrivilege	2408	msiexec.exe
Token: SeAuditPrivilege	2408	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2408	msiexec.exe
Token: SeChangeNotifyPrivilege	2408	msiexec.exe
Token: SeRemoteShutdownPrivilege	2408	msiexec.exe
Token: SeUndockPrivilege	2408	msiexec.exe
Token: SeSyncAgentPrivilege	2408	msiexec.exe
Token: SeEnableDelegationPrivilege	2408	msiexec.exe
Token: SeManageVolumePrivilege	2408	msiexec.exe
Token: SeImpersonatePrivilege	2408	msiexec.exe
Token: SeCreateGlobalPrivilege	2408	msiexec.exe
Token: SeCreateTokenPrivilege	2408	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2408	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2408	msiexec.exe
2408	msiexec.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4352 wrote to memory of 2408	4352	2026-07-23_1b66a222c74b7c889d96902260e81da8_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe	85
PID 1132 wrote to memory of 4244	1132	msiexec.exe	88
PID 4244 wrote to memory of 2148	4244	MsiExec.exe	89
PID 1132 wrote to memory of 820	1132	msiexec.exe	94
PID 1132 wrote to memory of 744	1132	msiexec.exe	96
PID 1132 wrote to memory of 928	1132	msiexec.exe	97
PID 3388 wrote to memory of 4064	3388	ScreenConnect.ClientService.exe	99

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-23_1b66a222c74b7c889d96902260e81da8_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-23_1b66a222c74b7c889d96902260e81da8_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4352
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\setup.msi"
  2⤵
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:2408

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1132
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding FA10192BE18DD1AA90403B64F4340331 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4244
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI17C9.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240654531 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2148
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:820
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 711228E22B8B5C1A1EC77AA24F158F8E
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:744
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 1D68AC2CCF591F4A05536A57A716259B E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:928

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:4080

C:\Program Files (x86)\ScreenConnect Client (1830d7263bc4f64f)\ScreenConnect.ClientService.exe
"C:\Program Files (x86)\ScreenConnect Client (1830d7263bc4f64f)\ScreenConnect.ClientService.exe" "?e=Access&h=instance-ohfrcy-relay.screenconnect.com&p=443&s=9cb40ee6-37fa-4e03-b811-b589b4508b6b&k=BgIAAACkAABSU0ExAAgAAAEAAQBZBxE%2b%2fLmV2LWEo6f3GK6kMCawIOzG2i9%2fLGy74%2bJOSffsnxdF596HGQFsa5Xbt1odASOkNVzF%2b6%2fbeG05DFjayWyir4lssBizvNB2W8iUTyb9R%2fDlDWkZqxh2xJ%2bMYx59GuM6%2fFTsfAOeC8p5clju7OS20ktMN7bnRsFe7WUr3p03lX9z3bbLzx52ghTN7zX4EI4mAK1T99H%2bmkOqiGxSxtBZAkT1gbstSBa0768hMWd0fnoBJPifWdshoQagaofkAhkN8AmDk09yqRef%2bev7ajtvVp4oVIZtB1asKzUrKkdJQ6fG5%2f%2f5103L5NcU9l1OvtJZB%2foUpJoe2JmaD927"
1⤵
- Sets service image path in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3388
- C:\Program Files (x86)\ScreenConnect Client (1830d7263bc4f64f)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (1830d7263bc4f64f)\ScreenConnect.WindowsClient.exe" "RunRole" "f38bdace-0cc6-4b93-91ec-49ccb54ba37f" "User"
  2⤵
  - Executes dropped EXE
  PID:4064

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e585177.rbs

Path C:\Config.Msi\e585177.rbs
Size 213KB
SHA256 474d8b73c262a4e669302c37c4525bb2fb76799d8ea90eb603a096f28810ade9
MD5 4721d535f330a31b937b1a48657f551e
SHA1 c2600df7bcc55d2fc38ac856d3b12136316dfb9f
SHA512 2c8a3e45b3b19f44447c97ad03ee40804b77215afd402607972d4570ebf7b8c51263ae8ca3f7150921ffa52e29e6778afebe21f8760eb3074c12503c39c5b270
SSDEEP 3072:2T9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMGG:2TuH2aCGw1ST1wQLdqvG
TLSH
T198248C226491807EE7FA1A36D93F9A217E7CF6281760C59EC3848C1E5D604C06BF7B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.Override.en-US.resources

Path C:\Program Files (x86)\ScreenConnect Client (1830d7263bc4f64f)\Client.Override.en-US.resources
Size 336B
SHA256 5d51a011e7a175f62d08f4eefe57150effe9f391c9a9a246c8e4573cd6ba6f36
MD5 4647ae7b2e8789308ffc8b653fa49e7b
SHA1 2378c32820eeb6dfcb51304b1c94a68bcfcb335d
SHA512 80437455492b9d1e336e9d0e44e3c3234004e864b1c41c5d6fff4458882a864d959c4404eb59b34e74684a3303052c2963de9c84f06830c3ae34431bdc5b8539
TLSH
T1DDE0262733AC2836D0F2067B385A3083193BB57E8234486CE850311D4AB2A0ACF92A32
MD5 SHA1 SHA512 TLSH

Submit Download

Client.en-US.resources

Path C:\Program Files (x86)\ScreenConnect Client (1830d7263bc4f64f)\Client.en-US.resources
Size 47KB
SHA256 a023527e773b886fb64c5f31de484f659c5816cf4ab696be7c98a3ea4de57d41
MD5 e5d912067630d3efe53f290b9c9d0d27
SHA1 b0fc2105716c6eab770f89b9ed88ce2a36bdb5b2
SHA512 13fcb0f3f0208c072c86f1df8efe73cfade2803bc4b04e666787a95e10f49289fe6c1b8e10e7dbb5071cae92345fa12139fc220dc23dee4b098cc77fc53a316b
SSDEEP 768:T5F6LdqoaQZHw50YeOrmtxBQDu5CLHEFJ59UwgLJhwKa1wrvrMetEHWITF9:T5cLdqQZHw50YeOrmHBQDu5CLHEFJ59v
TLSH
T140231D1277FD0A18F5F36F45BE7A94619937BC5A2E25C06F1028855E09B2F80CAB2773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.resources

Path C:\Program Files (x86)\ScreenConnect Client (1830d7263bc4f64f)\Client.resources
Size 2KB
SHA256 2a9d8d6847f1fb064730c860a4c8aa71a347a54ef1f124ac5953c39de63b1393
MD5 2cd59b9cbcbb58544c8a0de1ef09c570
SHA1 b7717fbdbf5fb0189d0256a99a93b60f9b27e485
SHA512 59a09ccc2df55a52b02fcf8393f01d7483f51ace8b4acf54687af56c8f725d03e86cefb69909cd281f4da09b447b91e2731b1fc078f49f75be7a7068c3b4e4f2
TLSH
T16551DDCA3BFA3C74F5B75B736EB95451EE39FE1C3526C6AD1406841A2B213099880B37
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Client.dll

Path C:\Program Files (x86)\ScreenConnect Client (1830d7263bc4f64f)\ScreenConnect.Client.dll
Size 179KB
SHA256 4a49d6aba012345b5a8a5530a6e2bbca1841a954925ff531a00d77f959309d40
MD5 9393afc5cd81af67a37684aafa9dcaa1
SHA1 b1d64e2b15c7f38b15022433561808d3a32081c8
SHA512 cad554c10a3c562f76c7612b88a585ade9d1a60da62447008477c3dc6c3f566844458b05aba9a1fd2b86bb937cc5fd601b05f667f17d7b26dfff6d66ac8de036
SSDEEP 3072:HBJuFXzwA/bKvoRsj+3/HrzdMcCQzDafzVF:HBJgP/bKv2L/GcZCfzV
TLSH
T1AD04399573A88E2ACEAF4B73B55081258E7AAD546117F3EE8D147CF916B3340C6016F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Program Files (x86)\ScreenConnect Client (1830d7263bc4f64f)\ScreenConnect.ClientService.dll
Size 54KB
SHA256 a29af3350c607c2d492b08ed7fa18c426e8ef631a1fbdf62436831cb8eea81a0
MD5 20a8911f288f256b66336460a77ee3bf
SHA1 51e91ce0c28fb66e4c5ca2e1b88d3dd70d7b45f6
SHA512 c83e554d5864365da24a0f8afcd37b791a039f6a17435844928b0e39a10dd78608e4be0b21cdac9fb488e2c5ec24166dd468321d7ae3ef81da9e91f8250b3c90
SSDEEP 1536:+tazPGf/Yv8zq16f2u5CfQgVcE+S7wTbPTTY:+taDGHYvYq161YQgVQAOQ
TLSH
T110433C42A6BD4F36C9DF4E387CB6F14007F09D169563FB989E8DA4DA0A627C01A143DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Program Files (x86)\ScreenConnect Client (1830d7263bc4f64f)\ScreenConnect.ClientService.exe
Size 95KB
SHA256 e8a69ea4a6b59df0ee5f91768a41106494c9358682c5686a5061a58c0e2240c0
MD5 2f70085306af604f19a017706e670ca0
SHA1 be74d6bbb31ce9a91cb7766806fe0bea745e574c
SHA512 08a113c88bcbb309a5371cdc9e93335a56c3551871caf572fe5bb54fe5d189872233d3ae0e25bb8461d8d5d65078edac644c02095c088c0add95b658a174b76e
SSDEEP 1536:uEofEH5TJEVg5lJQKtFQrv+euEQdkWKCXHsWGKPtcdQgjR4rZv7UVPxg:boK5Cm5ntvQrGVEQ5KAwQgjR4rZvoJxg
TLSH
T174936A51B5D1C871E477593158E8DEB05A3EFD601E618EAB3388022B0FB51C19A35EBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Program Files (x86)\ScreenConnect Client (1830d7263bc4f64f)\ScreenConnect.Windows.dll
Size 1.6MB
SHA256 400edb602b31d44d6c04917ce2d85d54bea70f459bd755b5970a90954c439c63
MD5 1c9f3779f1c727e851f10cfcc1f359e1
SHA1 35a79a2d9521d317ef5b0fa40e7a3aa9c12c4905
SHA512 ef670c7e4ade6cc5c222c1848ab7131d5ae242732778b184ae6e0b023042aa0554c80704a7386b685820b3bf8d06fd31a74d05e4f7bbde0cebe6a30721b4dec3
SSDEEP 24576:OuiHedrimVsJq2l6TOKoMjSvShvU86+RfmT01krTFiH4SqfKPTsUTHEWEZfM14wC:SHwi963PSumT0+TFiH7efP
TLSH
T1CC75BE42F2D211F5D06B4478C8BE561BEB747C090320CBAF97D4BE66AD337D09A2A356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Program Files (x86)\ScreenConnect Client (1830d7263bc4f64f)\ScreenConnect.WindowsClient.exe
Size 559KB
SHA256 12a5bcd7dd8176d2bfab9592700773654aefb0f25da208808539f2e9f3ea5112
MD5 2628e414f08931053a8e54b528c7796f
SHA1 7834cd0084316bdbcb4af46625f2b9bec8952952
SHA512 0b3119c20ee8cf4cbaf2af78cc5e3c9553993488b065bd9330b7d8a6837a8070c77d3a242d04e4d2334dad4b1d3fff7101b1e23872767ae2c2880778f4daa963
SSDEEP 12288:kpL1GVq+NbBE0Z8XxFrIMkir7MklgcvOJddTvJU:4IV7ZiFEarngcGJdQ
TLSH
T10CC46CEA33B89A7AD9AF07BEF075180417B0DC4A6695E3DE5D80B4D90D863818E053F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Program Files (x86)\ScreenConnect Client (1830d7263bc4f64f)\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
TLSH
T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsCredentialProvider.dll

Path C:\Program Files (x86)\ScreenConnect Client (1830d7263bc4f64f)\ScreenConnect.WindowsCredentialProvider.dll
Size 746KB
SHA256 62b405f32a43da0c8e8ed14a58ec7b9b4422b154bfd4aed4f9be5de0bc6eb5e8
MD5 f01a59c5cf7ec437097d414d7c6d59c4
SHA1 9ea1c3fbf3b5adbe5a23578dea3b511d44e6a2dd
SHA512 587748ad4dd18677a3b7943eab1c0f8e77fe50a45e17266ba9a0e1363eda0ff1eabcf11884a5d608e23baf86af8f011db745ad06bcdecdfd01c20430745fe4bb
SSDEEP 12288:OQ+rYYCG4xWh6+/ZCXnZ9GTWGsP9fuApxEF:r+rYYCTMh6IZkkWNBzpGF
TLSH
T1EDF44A07EAA481ADD06DC17483635536B7B2FC860725B6AF17906A216F3BFD06B3D348
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.config

Path C:\Program Files (x86)\ScreenConnect Client (1830d7263bc4f64f)\app.config
Size 551B
SHA256 d11b6ccf9e181a4298f9e60718b7658365987d6baa548c8fc9b3206e90c15d45
MD5 220f1db7fbde64f91461efde107b84f9
SHA1 2cfc861767ede3e12a22432ffd20eb38fcba85bd
SHA512 c1cc14b1906c1a678d2099d90ff47939f1578d63a4acbc473b4e645079858f3f1ddc64c3a85c62db8ebc3ad0f6ed7d24e354ee182717465e1861c40665976d14
TLSH
T126F0BB2931C9BD2A16631E13E5234200BDB09EA21116686D30EE203BD7B65D513F32C7
MD5 SHA1 SHA512 TLSH

Submit Download

system.config

Path C:\Program Files (x86)\ScreenConnect Client (1830d7263bc4f64f)\system.config
Size 916B
SHA256 86da09d4493a392562deeeae059d1864f4e2b44d6a7efc275d24f72726dc3e25
MD5 3e81ff9a81b2c907762e38dca60e038b
SHA1 6d8dc5dee045f872d01612171107b30705b34e49
SHA512 5e2a8f9d1118ec5e457dd8e7a93a52c9d48ccd911818ad37dfd41210f2ed252aeb9ef86088ca88f600d026cfc3af4ae7bfc645ce6f2f212684cbaa1aa2100519
TLSH
T1011100A13184694B47B32923CD168725ED710F5B2454118D7ABE323AEF7189A0B9368E
MD5 SHA1 SHA512 TLSH

Submit Download

MSI17C9.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI17C9.tmp
Size 1022KB
SHA256 9fef0e87140b52d5cd59af0e84805637b75dbaaf0321ff8ab625660486533a56
MD5 13c3805e771a38aaaec828908a8bed37
SHA1 00b02a8feb505922b9e459e3f4367042064281bf
SHA512 6f80c1c08cd3cb2a83e317eaccf0168ba4d4a115e17a218ba9c33e22aac6984ccec5132dd56e622918dbaaaa4ccc382d94242a41add7bcc14fc77fe579be785c
SSDEEP 24576:4UUGGF/6pzhEx3OJgoTtdiZg/hWGT5XexSVmQIh/:bGFSpN03ZoT1/hWGT5Xe0W1
TLSH
T1612523687AEA9075F3E336342C74A1A10AF97DB57E758089778A022D0DB1B81DB71373
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Deployment.WindowsInstaller.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI17C9.tmp-\Microsoft.Deployment.WindowsInstaller.dll
Size 172KB
SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
MD5 5ef88919012e4a3d8a1e2955dc8c8d81
SHA1 c0cfb830b8f1d990e3836e0bcc786e7972c9ed62
SHA512 4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684
SSDEEP 3072:FkfZS7FUguxN+77b1W5GR69UgoCaf8TpCnfKlRUjW01Ky4:x+c7b1W4R6joxfQE
TLSH
T14E045B2563FC473ECAEF87B4E2624251E7B2E2E97113DB0DDC8541AA2522780F792753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI17C9.tmp-\ScreenConnect.Core.dll
Size 482KB
SHA256 384a9cad42153fd4485dd4bf20f73ab803ed5a5d6d620d795747d5330ac8de1b
MD5 38592458c5907179b8be1b2fd31017c5
SHA1 88d7b00786b54da2bf287b5637a9429205380809
SHA512 94268cf89f1929a91face37ac44664c863d1d1fed8448213f4662249340617a5f1c0e95637ea4b3a5de5810ba7e9833e8ebdce68a27574b136ec28c50ac23d01
SSDEEP 6144:PvnEVyYEll17c/V7FagoEm5/CQdScM7Ic2gD8/8Gujvlx4kK4PVNy4Zc:nEVy7l/koz/cvDC
TLSH
T1DAA45B1A7FE88A6BC5AE077BF434541A4370DD0A710BE71F6698F4B82C87765DE001EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.InstallerActions.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI17C9.tmp-\ScreenConnect.InstallerActions.dll
Size 20KB
SHA256 b5f75aefa6eed74994781f13c10cc39d9e50440f3c58ce774c29d5124405d227
MD5 52673e58a3f9307d73ea738046bba833
SHA1 1d61f5a1a6abbb9f358846064f2ebfad580c8342
SHA512 b3001c7653f5cd3712377ecfc8e33e737afc73551364b9b95270810dc96cdeaa45a7a131167a59dc5d5591b2ac636b0059f01213182185ca69a286e3b4014edb
SSDEEP 384:pwMan2rcaQiyNMGqmtphaF/zeYc6rMbbJ1kjvIYU5y8o+jOMHPrbIR:SMgDS4tCgYcD95yuqMjbIR
TLSH
T17C928011A7EC172AF5FF2F74AEF211504B32BD62AE35DB1E1984504E4D32B449AA0B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.msi

Path C:\Users\Admin\AppData\Local\Temp\setup.msi
Size 2.8MB
SHA256 f30d42c44a643125399de33f683bab572c5637f4fb00b539d8a5580678547d3f
MD5 1ac8209780e02b1f03b2e31d415424ab
SHA1 f32a16a181e0ba4e2f047e92b626be6a7a55406a
SHA512 baa7f357ec6ffec66345c64fcc7bd08324e37be3a76d48c03bbecb52116b77e9ae58bcf560fd371e96a83d5255f2055a51018fbb2b86b4fa3adda0eab9a2db1e
SSDEEP 49152:gZ+kOV6i3gVhSOEndgUd49GjJh4dYdJSBNGFSpN03ZoT1/hWGT5Xe0WK1g:gZYV6lVhSxWGIdYdsBNG0uWT5hWOgc
TLSH
T1E9D5123136E8C13AE2B21A39E93A81F15979BD64DA23C05F53647D1E3971E809A73373
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI52DF.tmp

Path C:\Windows\Installer\MSI52DF.tmp
Size 202KB
SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
MD5 ba84dd4e0c1408828ccc1de09f585eda
SHA1 e8e10065d479f8f591b9885ea8487bc673301298
SHA512 7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290
SSDEEP 3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
TLSH
T129147C326494803EE7F91A36D93E9A61AE7DF6241760C99EC3848C0E5D604D06BF7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1svguyck.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1830d7263bc4f64f)\1svguyck.newcfg
Size 587B
SHA256 96699a5c680c774bec7f04af6762e877bf9584fb90a0df779fee7f7daa9a2c17
MD5 725225a640c6d40e2141e344274516ae
SHA1 4386826464492a26dfa25875a3554e5cc80dee1c
SHA512 8098548e19bb60adf21c062534678e0f6a4adaa16a00a1409228afb84e4ea8ab01a92084c09578d8e3b9030ca42becdf01b5f6679b5a730122f20e459668f34b
TLSH
T1BBF02BB531806E5A07A35D33C5114745FD726B9B0169149838AF617A5F311DF03A31DF
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1830d7263bc4f64f)\user.config
Size 587B
SHA256 8d9d6ae31f547c2b755ee12ba0aba5df7a31300d0e36d05b1c349ff244cd8b23
MD5 4547c2d7c8cfb7521ca90d3379f5ca83
SHA1 886eeef7faddaa93c1ce5cadc2b09b00c71f41f4
SHA512 af8b4cea3032e93b87474485040f43acd14b75da6c53635c1bbd62c72a251d06d4444c52852c2cb1c253f9918324b99c6ac98544799af10267029ae8c48ff181
TLSH
T151F02BB531807E5A07A31D33C5114745FE716B9B05692498386F617A5F311DF03A31EF
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1830d7263bc4f64f)\user.config
Size 587B
SHA256 f2bc4c2448a4611edd54519d734975c5b5de6588fadcffef0117f5dfb42a3cec
MD5 97b4fd549cd7fd6fd3cde69557f86a90
SHA1 87ea137bbec0459e7aa8cf6dce25a8aa78443d8b
SHA512 e9785bb9cf1e8c0450f4f478051b2b0b2af240340a27a056c6feb7d1b9c9b19523d6a0aa489cd41c589423f12b93d2055eecfa82a7d728aa5d019a176281c1d6
TLSH
T196F08BB431806E4A07A31E33C5124345FD312B9B00682088386F613A5F311DB03A31DF
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1830d7263bc4f64f)\user.config
Size 587B
SHA256 2d63c3fb017d0940f8e7e582180cc07d3ebb06a70fb5fc855330b297196ff96c
MD5 cc93fa30f05117d43e6c2c00455e14b9
SHA1 dd0832d75577b8f33f553e66f550957855b0a8da
SHA512 829665464091bcb2dfb1e8252883dd9e61c7beb3551191f29384995882b2fc74b732945fbb6cb0b5c3da8540eb4cf4749782f1c9feb7d93a25328f9c4c282212
TLSH
T1F3F02BB531806E5A07A31D33C5114745FE726B9B0169649838AF617A5F311DB03A31DF
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (1830d7263bc4f64f)\user.config
Size 587B
SHA256 df38ad74b822381e50e2659e8242d47c49dc01eb17a8e19ab6b838f149aee675
MD5 9487b10bf08e1be3d52ee3c79fd70ec2
SHA1 051950387251abc641bdf55f83c3de05b3e90f6d
SHA512 3cf21602abf6bdd6412bbef1a3c4294f2ddd600fee6869bd4f12fa2330fd8a521bdcc7f0fb7ce6a75b52423aaf2fa9ceff47114624bd80c1ad8ad370e202363e
TLSH
T12FF08BB431806E4A07A31E33C5114345FD312B9B00682098386F613A5F311DB03A31DF
MD5 SHA1 SHA512 TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 b6288fdafb1f07e003a9ad8f2cadae5823fea597618434875728cec14a8340c3
MD5 0c9a835fa3f531c435b6f30316f9f856
SHA1 9e12aad66923e66b711179b987bda65876ae0d2a
SHA512 f6913922bc84b33b91d1d18e4fc02f09c1c2a01b22052c21965bbcb3006bbe2075af696a29dfa20ce5a2a0ac5237ea2f6f583f1e4e9e251e8c22f981141a99b6
SSDEEP 24576:Ru8m+1zvdoO/vvTLrWceJG64dl0zEVMiwKmNeTtlU06tuLlBovVFk6XRp:F
TLSH
T17E47E42436F92110E7F79E3CA8F16A234D3A7D5B8C159E8D05411B4E0962FB1E872F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{b2630e0a-f731-4a18-9d57-a704dd7e72c4}_OnDiskSnapshotProp

Path \??\Volume{20c84cf9-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{b2630e0a-f731-4a18-9d57-a704dd7e72c4}_OnDiskSnapshotProp
Size 6KB
SHA256 2bc3d1317a335af993a79eec8063ffa7dd510661c21766da14cf2d06694c16bc
MD5 db495691c3310985d828e19db11d1208
SHA1 29523be09c58b4d468bd4fd80ce18b2795f1ba47
SHA512 10333e445f630015986e3dd76b3f3217c8a59fead5be8ebd4acbae9743cd68f3587431b4240efc63eaa0c0e62ec232d2a738a6d10262c6c37307e3d9de1df917
SSDEEP 96:FHK3NMGcAOAvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:FK3C5ab++ZVm
TLSH
T11DD1780C5AF54311E2B3AB3129F18557A877B911EF33CB8E0298238E2671910F935F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2148-29-0x00000000029F0000-0x00000000029FC000-memory.dmp

Download

memory/2148-25-0x00000000029C0000-0x00000000029EE000-memory.dmp

Download

memory/2148-33-0x0000000004DF0000-0x0000000004E6E000-memory.dmp

Download

memory/3388-104-0x0000000003D20000-0x0000000003DB2000-memory.dmp

Download

memory/3388-102-0x00000000042D0000-0x0000000004874000-memory.dmp

Download

memory/3388-103-0x0000000003A90000-0x0000000003AE0000-memory.dmp

Download

memory/3388-106-0x0000000003DC0000-0x0000000003E7E000-memory.dmp

Download

memory/3388-81-0x00000000038A0000-0x00000000038D4000-memory.dmp

Download

memory/3388-75-0x0000000001210000-0x0000000001224000-memory.dmp

Download

memory/3388-90-0x0000000003B80000-0x0000000003D20000-memory.dmp

Download

memory/4064-120-0x000000001BD60000-0x000000001BEE6000-memory.dmp

Download

memory/4064-117-0x0000000002C70000-0x0000000002CA4000-memory.dmp

Download

memory/4064-116-0x0000000000A40000-0x0000000000AD0000-memory.dmp

Download

memory/4064-119-0x000000001BBC0000-0x000000001BD60000-memory.dmp

Download

memory/4064-118-0x000000001B9A0000-0x000000001BA1E000-memory.dmp

Download

memory/4064-121-0x0000000002C30000-0x0000000002C44000-memory.dmp

Download

memory/4352-1-0x0000000000DC0000-0x0000000000DC8000-memory.dmp

Download

memory/4352-6-0x0000000005190000-0x00000000051A0000-memory.dmp

Download

memory/4352-2-0x0000000005190000-0x00000000051A0000-memory.dmp

Download

memory/4352-3-0x0000000005470000-0x000000000572E000-memory.dmp

Download

memory/4352-0-0x0000000005190000-0x00000000051A0000-memory.dmp

Download

memory/4352-4-0x0000000002C90000-0x0000000002D0E000-memory.dmp

Download

memory/4352-5-0x0000000002D10000-0x0000000002D28000-memory.dmp

Download