cbc216b9fe5b2e51b1eac19fc809522d88f071fcbac232721bbc4a0bba1cf210

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 17:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_fd2daa3e5b8e1070e9bfbd38864e4e1b_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe
Size 26.0MB
Sample260804-vyd9cstsgs
SHA256 cbc216b9fe5b2e51b1eac19fc809522d88f071fcbac232721bbc4a0bba1cf210
MD5 fd2daa3e5b8e1070e9bfbd38864e4e1b
SHA1 aca53bcaa6b1a280fb71f34b96e3f9e0e0087d36
SHA512 9a0441cbe65f10cd319d2d8e48041b81406524b5ea851d0063dbdbd7c9e872e1e90ba77f613e67af2a33dd140b7fe369c3addc823c3ca10def92eb4dbb2fabaf
SSDEEP 786432:FYz+X/a/dg+X/a/j+X/a/j+X/a/Z+X/a/5+X/a/++X/a/H:FX0d7X0SX0SX0gX0AX0RX0H
TLSH
T1C557230177DE6536D4BB0A3A987552109774FC418B12C7AF5AE0BE3D1C32BD0AE2636B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

backdoor discovery persistence ransomware rat

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
3	3224	rundll32.exe

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (a330e929a1701f4a)\ImagePath = "\"C:\\Program Files (x86)\\ScreenConnect Client (a330e929a1701f4a)\\ScreenConnect.ClientService.exe\" \"?e=Access&y=Guest&s=3bf063cd-46e8-46a5-baad-29cecff54eb7&k=BgIAAACkAABSU0ExAAgAAAEAAQDTnOLHb6xlEA0beG1FU63MTrYlJ%2fq3n%2blb7fkOgFEiUf8O%2fghJFFJO4oQQqyxswaiWm%2bV4CdIQ3pUGiV%2fN7SMy62Jiqf7sUUlbIuD6gUoE6Ip2JObc%2bPSoZ1HmC1IGQ1GwlGwZFs%2bK%2bXaQ9AdeRhAUZ03XgJEj7rovfUv8NH8H1nfRrFiJF2MkYPRbL%2bS9lPwTx8ulvkC%2b0zfk2vnPgzHsXUaeuo3F6fpnhFmap31ac2zd9xGuXwzj9Aq%2bwc%2bapO%2bExBaOuJVui%2ftCL9h4xlP41FrPk92pZQXI2K07%2fOfd8WzO%2fgeo6e%2fC%2bj8mWfNXhgPDjh%2fGpMswL2cOgaG0cvKa&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAA1PMx2EivrEepqWv6gSL7SQAAAAACAAAAAAAQZgAAAAEAACAAAADE09B2%2bu5fRZ%2bjQbcvo4m%2bxDdZZxlCtfENxJd65C90eAAAAAAOgAAAAAIAACAAAAAZCTj%2bQoJ9ks3QZ5zJin8XWkqNHmK%2fOomocWFrf2R4dKAEAAB4U7hkA6t7s0pfmKogjhhrbDa3rDOFC7Mo2mjAmiKZI6WHQhbv9UuqL6%2fRdkWruq2j%2fl4hicChdN3nDS8BIB172Sg7wKAc1sUyLyTHPlpZ%2bzOkyNmWy7%2fYMRYDtHep%2fu699XVsQ%2fW8498FwjzcHpWA6H8HUKcKd8Isit3ogpCWG8BHy0UY%2bIDW%2fzCSFtha7ChBxXl7IDCklIF853L9%2f7K87Uk7lfypbLxglubVYY4JZAtyRNLycEsGD%2bSTGq6vuUqv0mAycRB4DIv%2bCcMIIcaqy%2fau0BWyFI2i6SdBK0aTue5z7yRzDf9ZlKC20coX3dhfVaDU1B9SsRcIFA9KTVhw99iJF56la%2f5Tmc%2fZwm9VulYiD4i4SYpjb7G44yh9QE4hQPiCw0Uou2GL3MRloxafp7mKtk11EDV9uxTVkrXJStVGBOIyJOTixBPyoRaaoptYmQ9OUt4UUWux0Js5VxwDxdk1Yi%2fY2In0BRvcArlyJHj0RyHhroM6V7Q5MV%2bcQoNhNKjS7DdK%2fnMFjn5vNiH6y3b4q0v0Cpoa4SqBC6uLA6LPzuz1iWgPZVQQoSVM0SFYvxWad7idsslgie7jZzl6Fgrimh%2bBAgG0SX4Z46flN7HwfW%2bZvSvC56iAtERApgXFlcaKQPdmJI6x1bGWB9YZCHciyJVtqCKI3Yy4Ujt4h3pWr%2b5Jk%2fSwaM2bnF4wxStY5O%2fdjQTWMYmFVi3CJxdCkKCTytR4selL2aP%2bUn4i2khyLSwFQgZihCmCaiR%2f9NLOD8o7iuytQmdGCrbej7LBaY68%2f4In6VIH9GYbjNvhBDbveOL%2ftCeZc2y168mL9KggB6uL3w4o40ZejkdKA%2fHAZDz16sSgVHc3h3%2fbjFDz7LF1GqdhYnD0y%2bagAUywO06i2B%2fU5q7Q9m8IkmLn5vIRyJd%2bMfuEuiemW%2bkpaG3w7Je8HRk7wpv5x84ownWVT8IHJfiJdc0DHOjEEiEKcFztU%2b4RzBwiz93WpHN44tzHq%2bvBN83JlpHGGmBPlmE7eBpfHSq28eo%2b0O%2bL1GMlS%2bmR5Th5mwU652u3cwcmxixnA8dszjOWaCCwy9siKNEI6RaWWxp2frcvFS3vbvsR5QNZFG0Qbd5o%2fkT9ZYQmBrjBcseA3pjYYPLQnZmRrD9LoQ19YdfhxaEhtrG1QqyTp4kM0dpzv7YWnUvNX48ST3OPp8QVUZVxa59h%2brrNXK6K3dHGhroZWLWHMRapeJ6uJ%2f8wi3UuwZeF0HMI%2bpF3JDX0getJvo7PnhBbYgFgnUidjaamoQji4%2f%2fHYVyQvqbrHFRPSxLuW%2b8g98SeRIHaFo9M%2bHDcQIl5JmzX0a0JeU2aVQa%2boB%2fO51mOknp%2b%2fVad8oWSK%2bxq8V459RN97p5GtKcIUiVRQCOyt0wJcQ2A5xUXs6siO45NOLvs52WAOqP4Bufr%2f3MFtR2DxYlJ416vgCJejgEgM1S36mPLJjfTFEZ5JBqpsS7h8oM5jhKYSKvbTb%2f2tHaJLATXJelWhhnAyqXsRjy85Hb3VgIQ%2fd8jL9yOlqE%2bOy%2bLbIwD7sL%2fBTWJHAjDzhYxJiOH%2fSxpDlGvEIM3T0AAAABUptwOOMu7jxejSpwJkuD3s1MH0k8SGqwqPik11uEvilu4AHdP0jqj1WvGNlueoIivVLA3R5hNz8kkbFNRbF3F\""	ScreenConnect.ClientService.exe

ConnectWise ScreenConnect remote access tool
ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
backdoor rat

Executes dropped EXE 2 IoCs

pid	Process
2188	ScreenConnect.ClientService.exe
2904	ScreenConnect.WindowsClient.exe

Loads dropped DLL 42 IoCs

pid	Process
1092	MsiExec.exe
5116	rundll32.exe
5116	rundll32.exe
5116	rundll32.exe
5116	rundll32.exe
5116	rundll32.exe
5116	rundll32.exe
5116	rundll32.exe
5116	rundll32.exe
5116	rundll32.exe
1092	MsiExec.exe
3224	rundll32.exe
3224	rundll32.exe
3224	rundll32.exe
3224	rundll32.exe
3224	rundll32.exe
3224	rundll32.exe
3224	rundll32.exe
3224	rundll32.exe
3224	rundll32.exe
1092	MsiExec.exe
2688	rundll32.exe
2688	rundll32.exe
2688	rundll32.exe
2688	rundll32.exe
2688	rundll32.exe
2688	rundll32.exe
2688	rundll32.exe
2688	rundll32.exe
2688	rundll32.exe
4268	MsiExec.exe
4304	MsiExec.exe
2188	ScreenConnect.ClientService.exe
2188	ScreenConnect.ClientService.exe
2188	ScreenConnect.ClientService.exe
2188	ScreenConnect.ClientService.exe
2188	ScreenConnect.ClientService.exe
2188	ScreenConnect.ClientService.exe
2188	ScreenConnect.ClientService.exe
2188	ScreenConnect.ClientService.exe
2188	ScreenConnect.ClientService.exe
2188	ScreenConnect.ClientService.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe

Drops file in System32 directory 30 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (a330e929a1701f4a)\32ejvggc.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (a330e929a1701f4a)\jxyvfkbi.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (a330e929a1701f4a)\gaawf2sf.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (a330e929a1701f4a)\b3pfaexw.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (a330e929a1701f4a)\b3pfaexw.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (a330e929a1701f4a)\5wfft4dh.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (a330e929a1701f4a)\dpezjzda.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (a330e929a1701f4a)\ia0ufylj.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (a330e929a1701f4a)\user.config	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (a330e929a1701f4a)\gaawf2sf.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (a330e929a1701f4a)\5wfft4dh.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (a330e929a1701f4a)\dpezjzda.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (a330e929a1701f4a)\is2p0nhn.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (a330e929a1701f4a)\b3pfaexw.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (a330e929a1701f4a)\32ejvggc.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (a330e929a1701f4a)\is2p0nhn.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (a330e929a1701f4a)\is2p0nhn.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (a330e929a1701f4a)\jxyvfkbi.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (a330e929a1701f4a)\zbfglola.tmp	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (a330e929a1701f4a)\zbfglola.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (a330e929a1701f4a)\dpezjzda.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (a330e929a1701f4a)\ia0ufylj.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (a330e929a1701f4a)\gaawf2sf.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (a330e929a1701f4a)\32ejvggc.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (a330e929a1701f4a)\jxyvfkbi.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (a330e929a1701f4a)\ucnl4t3b.tmp	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (a330e929a1701f4a)\ia0ufylj.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (a330e929a1701f4a)\zbfglola.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (a330e929a1701f4a)\ucnl4t3b.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (a330e929a1701f4a)\ucnl4t3b.newcfg	ScreenConnect.ClientService.exe

Drops file in Program Files directory 17 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ScreenConnect Client (a330e929a1701f4a)\Client.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (a330e929a1701f4a)\Client.Override.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (a330e929a1701f4a)\ScreenConnect.ClientService.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (a330e929a1701f4a)\ScreenConnect.WindowsBackstageShell.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (a330e929a1701f4a)\ScreenConnect.WindowsClient.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (a330e929a1701f4a)\ScreenConnect.WindowsFileManager.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (a330e929a1701f4a)\app.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (a330e929a1701f4a)\Client.Override.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (a330e929a1701f4a)\ScreenConnect.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (a330e929a1701f4a)\ScreenConnect.Windows.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (a330e929a1701f4a)\ScreenConnect.WindowsClient.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (a330e929a1701f4a)\ScreenConnect.WindowsFileManager.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (a330e929a1701f4a)\Client.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (a330e929a1701f4a)\ScreenConnect.Client.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (a330e929a1701f4a)\ScreenConnect.WindowsBackstageShell.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (a330e929a1701f4a)\ScreenConnect.ClientService.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (a330e929a1701f4a)\system.config	msiexec.exe

Drops file in Windows directory 17 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\e59ebed.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{F73271EE-B4D3-8F8B-19CD-7837E5956F4E}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF4BFE56D290DB67D6.TMP	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF66E.tmp	msiexec.exe
File created	C:\Windows\Installer\e59ebef.msi	msiexec.exe
File created	C:\Windows\Installer\{F73271EE-B4D3-8F8B-19CD-7837E5956F4E}\DefaultIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\{F73271EE-B4D3-8F8B-19CD-7837E5956F4E}\DefaultIcon	msiexec.exe
File created	C:\Windows\SystemTemp\~DF08E4AB710EA6EEF8.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF2826F3BD900844F0.TMP	msiexec.exe
File created	C:\Windows\Installer\e59ebed.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFBF5973B528ABC4F6.TMP	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF2D2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF312.tmp	msiexec.exe
File created	C:\Windows\Installer\wix{F73271EE-B4D3-8F8B-19CD-7837E5956F4E}.SchedServiceConfig.rmi	MsiExec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_fd2daa3e5b8e1070e9bfbd38864e4e1b_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenConnect.ClientService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ffbf1fc65d8bbf350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801ffbf1fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101ffbf1fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3ffbf1fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6ffbf1fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Modifies data under HKEY_USERS 8 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.ClientService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.ClientService.exe

Modifies registry class 32 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-a330e929a1701f4a\UseOriginalUrlEncoding = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-a330e929a1701f4a\URL Protocol	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-a330e929a1701f4a\shell\open	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-a330e929a1701f4a\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EE17237F3D4BB8F891DC87735E59F6E4	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EE17237F3D4BB8F891DC87735E59F6E4\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EE17237F3D4BB8F891DC87735E59F6E4\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EE17237F3D4BB8F891DC87735E59F6E4\DeploymentFlags = "3"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EE17237F3D4BB8F891DC87735E59F6E4\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EE17237F3D4BB8F891DC87735E59F6E4\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EE17237F3D4BB8F891DC87735E59F6E4\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\26.5.3.9704\\a330e929a1701f4a\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EE17237F3D4BB8F891DC87735E59F6E4\ProductName = "ScreenConnect Client (a330e929a1701f4a)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EE17237F3D4BB8F891DC87735E59F6E4\PackageCode = "EE17237F3D4BB8F891DC87735E59F6E4"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EE17237F3D4BB8F891DC87735E59F6E4\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EE17237F3D4BB8F891DC87735E59F6E4\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\26.5.3.9704\\a330e929a1701f4a\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-a330e929a1701f4a\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (a330e929a1701f4a)\\ScreenConnect.WindowsClient.exe\" \"%1\""	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\EE17237F3D4BB8F891DC87735E59F6E4	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EE17237F3D4BB8F891DC87735E59F6E4\SourceList\PackageName = "ScreenConnect.ClientSetup.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-a330e929a1701f4a	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-a330e929a1701f4a\shell	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EE17237F3D4BB8F891DC87735E59F6E4\Version = "436535299"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EE17237F3D4BB8F891DC87735E59F6E4\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\EE17237F3D4BB8F891DC87735E59F6E4\Full	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EE17237F3D4BB8F891DC87735E59F6E4\ProductIcon = "C:\\Windows\\Installer\\{F73271EE-B4D3-8F8B-19CD-7837E5956F4E}\\DefaultIcon"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EE17237F3D4BB8F891DC87735E59F6E4\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EE17237F3D4BB8F891DC87735E59F6E4\SourceList\Media	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EE17237F3D4BB8F891DC87735E59F6E4\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-a330e929a1701f4a	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-a330e929a1701f4a\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\750BA1CB719C3CEB3A039E921A07F1A4	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\750BA1CB719C3CEB3A039E921A07F1A4\EE17237F3D4BB8F891DC87735E59F6E4	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EE17237F3D4BB8F891DC87735E59F6E4\SourceList\Media\1 = ";"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5944	msiexec.exe
5944	msiexec.exe
2188	ScreenConnect.ClientService.exe
2188	ScreenConnect.ClientService.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1856	2026-08-04_fd2daa3e5b8e1070e9bfbd38864e4e1b_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe
Token: SeShutdownPrivilege	828	msiexec.exe
Token: SeIncreaseQuotaPrivilege	828	msiexec.exe
Token: SeSecurityPrivilege	5944	msiexec.exe
Token: SeCreateTokenPrivilege	828	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	828	msiexec.exe
Token: SeLockMemoryPrivilege	828	msiexec.exe
Token: SeIncreaseQuotaPrivilege	828	msiexec.exe
Token: SeMachineAccountPrivilege	828	msiexec.exe
Token: SeTcbPrivilege	828	msiexec.exe
Token: SeSecurityPrivilege	828	msiexec.exe
Token: SeTakeOwnershipPrivilege	828	msiexec.exe
Token: SeLoadDriverPrivilege	828	msiexec.exe
Token: SeSystemProfilePrivilege	828	msiexec.exe
Token: SeSystemtimePrivilege	828	msiexec.exe
Token: SeProfSingleProcessPrivilege	828	msiexec.exe
Token: SeIncBasePriorityPrivilege	828	msiexec.exe
Token: SeCreatePagefilePrivilege	828	msiexec.exe
Token: SeCreatePermanentPrivilege	828	msiexec.exe
Token: SeBackupPrivilege	828	msiexec.exe
Token: SeRestorePrivilege	828	msiexec.exe
Token: SeShutdownPrivilege	828	msiexec.exe
Token: SeDebugPrivilege	828	msiexec.exe
Token: SeAuditPrivilege	828	msiexec.exe
Token: SeSystemEnvironmentPrivilege	828	msiexec.exe
Token: SeChangeNotifyPrivilege	828	msiexec.exe
Token: SeRemoteShutdownPrivilege	828	msiexec.exe
Token: SeUndockPrivilege	828	msiexec.exe
Token: SeSyncAgentPrivilege	828	msiexec.exe
Token: SeEnableDelegationPrivilege	828	msiexec.exe
Token: SeManageVolumePrivilege	828	msiexec.exe
Token: SeImpersonatePrivilege	828	msiexec.exe
Token: SeCreateGlobalPrivilege	828	msiexec.exe
Token: SeCreateTokenPrivilege	828	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	828	msiexec.exe
Token: SeLockMemoryPrivilege	828	msiexec.exe
Token: SeIncreaseQuotaPrivilege	828	msiexec.exe
Token: SeMachineAccountPrivilege	828	msiexec.exe
Token: SeTcbPrivilege	828	msiexec.exe
Token: SeSecurityPrivilege	828	msiexec.exe
Token: SeTakeOwnershipPrivilege	828	msiexec.exe
Token: SeLoadDriverPrivilege	828	msiexec.exe
Token: SeSystemProfilePrivilege	828	msiexec.exe
Token: SeSystemtimePrivilege	828	msiexec.exe
Token: SeProfSingleProcessPrivilege	828	msiexec.exe
Token: SeIncBasePriorityPrivilege	828	msiexec.exe
Token: SeCreatePagefilePrivilege	828	msiexec.exe
Token: SeCreatePermanentPrivilege	828	msiexec.exe
Token: SeBackupPrivilege	828	msiexec.exe
Token: SeRestorePrivilege	828	msiexec.exe
Token: SeShutdownPrivilege	828	msiexec.exe
Token: SeDebugPrivilege	828	msiexec.exe
Token: SeAuditPrivilege	828	msiexec.exe
Token: SeSystemEnvironmentPrivilege	828	msiexec.exe
Token: SeChangeNotifyPrivilege	828	msiexec.exe
Token: SeRemoteShutdownPrivilege	828	msiexec.exe
Token: SeUndockPrivilege	828	msiexec.exe
Token: SeSyncAgentPrivilege	828	msiexec.exe
Token: SeEnableDelegationPrivilege	828	msiexec.exe
Token: SeManageVolumePrivilege	828	msiexec.exe
Token: SeImpersonatePrivilege	828	msiexec.exe
Token: SeCreateGlobalPrivilege	828	msiexec.exe
Token: SeCreateTokenPrivilege	828	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	828	msiexec.exe

Suspicious use of FindShellTrayWindow 18 IoCs

pid	Process
828	msiexec.exe
828	msiexec.exe
2904	ScreenConnect.WindowsClient.exe
2904	ScreenConnect.WindowsClient.exe
2904	ScreenConnect.WindowsClient.exe
2904	ScreenConnect.WindowsClient.exe
2904	ScreenConnect.WindowsClient.exe
2904	ScreenConnect.WindowsClient.exe
2904	ScreenConnect.WindowsClient.exe
2904	ScreenConnect.WindowsClient.exe
2904	ScreenConnect.WindowsClient.exe
2904	ScreenConnect.WindowsClient.exe
2904	ScreenConnect.WindowsClient.exe
2904	ScreenConnect.WindowsClient.exe
2904	ScreenConnect.WindowsClient.exe
2904	ScreenConnect.WindowsClient.exe
2904	ScreenConnect.WindowsClient.exe
2904	ScreenConnect.WindowsClient.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2904	ScreenConnect.WindowsClient.exe
2904	ScreenConnect.WindowsClient.exe
2904	ScreenConnect.WindowsClient.exe
2904	ScreenConnect.WindowsClient.exe
2904	ScreenConnect.WindowsClient.exe
2904	ScreenConnect.WindowsClient.exe
2904	ScreenConnect.WindowsClient.exe
2904	ScreenConnect.WindowsClient.exe
2904	ScreenConnect.WindowsClient.exe
2904	ScreenConnect.WindowsClient.exe
2904	ScreenConnect.WindowsClient.exe
2904	ScreenConnect.WindowsClient.exe
2904	ScreenConnect.WindowsClient.exe
2904	ScreenConnect.WindowsClient.exe
2904	ScreenConnect.WindowsClient.exe
2904	ScreenConnect.WindowsClient.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
828	msiexec.exe
5944	msiexec.exe
1092	MsiExec.exe
4268	MsiExec.exe
4304	MsiExec.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1856 wrote to memory of 828	1856	2026-08-04_fd2daa3e5b8e1070e9bfbd38864e4e1b_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe	89
PID 5944 wrote to memory of 1092	5944	msiexec.exe	91
PID 1092 wrote to memory of 5116	1092	MsiExec.exe	92
PID 1092 wrote to memory of 3224	1092	MsiExec.exe	93
PID 1092 wrote to memory of 2688	1092	MsiExec.exe	94
PID 5944 wrote to memory of 4796	5944	msiexec.exe	100
PID 5944 wrote to memory of 4268	5944	msiexec.exe	102
PID 5944 wrote to memory of 4304	5944	msiexec.exe	103
PID 2188 wrote to memory of 2904	2188	ScreenConnect.ClientService.exe	105

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-04_fd2daa3e5b8e1070e9bfbd38864e4e1b_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_fd2daa3e5b8e1070e9bfbd38864e4e1b_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1856
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\26.5.3.9704\a330e929a1701f4a\ScreenConnect.ClientSetup.msi" SC_EXE_PATH="C:\Users\Admin\AppData\Local\Temp\2026-08-04_fd2daa3e5b8e1070e9bfbd38864e4e1b_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe"
  2⤵
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:828

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5944
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 091839F5BCEBCED90221B42EF8E17786 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1092
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI93DA.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240751859 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:5116
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI990B.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240752968 8 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.CheckMsiMotw
    3⤵
    - Badlisted process makes network request
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:3224
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIA001.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240755109 15 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.CheckMsiFileName
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2688
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4796
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 1AEA9E261DD0DD331DBC108EDF259647
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4268
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding B9F3E2442B9AACF91F52DB0727B33926 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4304

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:4912

C:\Program Files (x86)\ScreenConnect Client (a330e929a1701f4a)\ScreenConnect.ClientService.exe
"C:\Program Files (x86)\ScreenConnect Client (a330e929a1701f4a)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&s=3bf063cd-46e8-46a5-baad-29cecff54eb7&k=BgIAAACkAABSU0ExAAgAAAEAAQDTnOLHb6xlEA0beG1FU63MTrYlJ%2fq3n%2blb7fkOgFEiUf8O%2fghJFFJO4oQQqyxswaiWm%2bV4CdIQ3pUGiV%2fN7SMy62Jiqf7sUUlbIuD6gUoE6Ip2JObc%2bPSoZ1HmC1IGQ1GwlGwZFs%2bK%2bXaQ9AdeRhAUZ03XgJEj7rovfUv8NH8H1nfRrFiJF2MkYPRbL%2bS9lPwTx8ulvkC%2b0zfk2vnPgzHsXUaeuo3F6fpnhFmap31ac2zd9xGuXwzj9Aq%2bwc%2bapO%2bExBaOuJVui%2ftCL9h4xlP41FrPk92pZQXI2K07%2fOfd8WzO%2fgeo6e%2fC%2bj8mWfNXhgPDjh%2fGpMswL2cOgaG0cvKa"
1⤵
- Sets service image path in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Program Files (x86)\ScreenConnect Client (a330e929a1701f4a)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (a330e929a1701f4a)\ScreenConnect.WindowsClient.exe" "RunRole" "d71b6eee-fa7a-447a-a00e-9accb1139202" "User"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2904

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59ebee.rbs

Path C:\Config.Msi\e59ebee.rbs
Size 213KB
SHA256 8d9d5cabc6b965a1fd1751ebd76b47ed805ed88bfed15129faf78e865e3f1228
MD5 25bf25f393e17a5469f3b58253fc1243
SHA1 1aaaaef09ba7ff6b57e8e086046b06d44d2cd7a1
SHA512 4d8303b455942dd2a67105a0e2ecd48e59e596308f35b48c5ddb922226d9d6c4c8c19ab7b016e96461a1b4308e3378d9172c22df4984b64b8aca337a0ed4e18e
SSDEEP 3072:7F9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMGU:7FuH2aCGw1ST1wQLdqvU
TLSH
T1DE248D227484807EE7FA1A32D93E9A717E7DF6240760C59EC3888C1E5D604C16BF6B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.Override.en-US.resources

Path C:\Program Files (x86)\ScreenConnect Client (a330e929a1701f4a)\Client.Override.en-US.resources
Size 256B
SHA256 dfd5b8f405fe58825f954c8c12cf020dcfa6b8a32a235c437b6667503378f21f
MD5 5ec7cdd661b660091cd2a0f739082537
SHA1 48f828e49941426bd637edd11a49171b2b1b8f8e
SHA512 03adc002f6bfd5eda1f73eac36515da3decf59a62d4aa0ec45e12fb59504183c0559324dc340a1e48b4a77a7c40a5800278af78ea1366c6b4d809a6baa737571
TLSH
T198D08C36130C60B6CA621E7B241875C2122BD619D538296CDCA9223CAFF2317DBD3E62
MD5 SHA1 SHA512 TLSH

Submit Download

Client.Override.resources

Path C:\Program Files (x86)\ScreenConnect Client (a330e929a1701f4a)\Client.Override.resources
Size 4KB
SHA256 c3a78ac93d223649d69f208e659eaee740a86e86126f40981d6256935374e081
MD5 d0b40e67a3cdf4cca047b887762cb4fd
SHA1 1a581937a27cb681088549c7d0555fa741a7a81a
SHA512 4705a19614c0478061277ebccd76b38a9ae322393c396f1cd51deb394e13f34ba6fabd942dab74aa2e5cb0ccce612d054ceec62a5a7e7ffb631f0c144a70f596
SSDEEP 96:rWSLBk3tMsVr/0JIY1ZUygW40+dAcKpeABF4He8ePLUB:rWY6pT0JpIPW40JLeG4L2Ls
TLSH
T136A1198337168A39C5DB6333A04B3161AD378E9D53E2A40C9837E0295EA1A881DC4B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.en-US.resources

Path C:\Program Files (x86)\ScreenConnect Client (a330e929a1701f4a)\Client.en-US.resources
Size 64KB
SHA256 a90983b3d26f9e6bb472663b84d13254349f62b0ad4c667fd76b3edd270240b2
MD5 440efe703a19cdf7890efad27f5714a2
SHA1 a95e7d35f2d1b01c5f959756c1541daaf48f220f
SHA512 d37e65cffa3487ef0c6a7bdedff0374e0d5aac0d8cd060004700920b0da4c0750b0b4aeaeddf2dcc4fb655495ce53d737a161096e448062ed50841c6c9bd622c
SSDEEP 1536:Q5mcDzSbBYQdQ5Fe2rmcPpZfjZ8peFTp9EwILThIKC1IXpbLeMarA:Q5mszSbaQCe2rmcPpZfjZ8peFTp9EwI0
TLSH
T13D531E1277FD0A18F5F36F75BE7A94629937BC5A2E25C06E1028454E09B2F80C9B2773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.resources

Path C:\Program Files (x86)\ScreenConnect Client (a330e929a1701f4a)\Client.resources
Size 6KB
SHA256 bd34378ad99f7609fa0c7c8edde6337c738a61d288863015629329806a1cc728
MD5 1e863134f29bcabe1ee571c91ac4fbe6
SHA1 57cc5966fcae49019da5f8f507c840cedfc103f4
SHA512 7e2640c4ddb8719230de0ddb0d18f9a4b1499a037247f12b142b1c16a2a989390abcb5ac7816a63dbce2d43c08510cec7cfc87cd24458bc2fa919c396b36d4f9
SSDEEP 192:rpDZHfbkqYvZJG293IIs1Z4EO/nM3ZWYijpo2YG:rRZjkqYxJ3JI/sMJ/ijp/p
TLSH
T1D8D13BC49BFEAC3CF05E51BE3A7692990275FF113AA3C3582460106A7F228856C56737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll

Path C:\Program Files (x86)\ScreenConnect Client (a330e929a1701f4a)\ScreenConnect.Client.dll
Size 628KB
SHA256 b2a13c7ad0637c3be7c4164d7665239076c423ab09ec2793e3879c7516fff864
MD5 7e8f5d2de8fb6d334f4cb080fec45f76
SHA1 00f54a74dd1b5ccb36c6133b7726b404ecf896a7
SHA512 8270c7dfedc9cecea53fc8029a9a0d2b1f530971ab0b0bae4011a1db3f986c45a80e02d7e30f3a1fe8c2f5fc4175d7cd11e346177ca5cd8648d1213079b7a65b
SSDEEP 12288:qV7rUHB9pGjRm34baT2zHTEavSW7OQniurRZ5:q5Ah9gjU34hzEn8qudv
TLSH
T12FD4C089EB94AD39ED6E0B73F15137209AB0ACC64967D70F1E68367C9C35B843A4D2C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Program Files (x86)\ScreenConnect Client (a330e929a1701f4a)\ScreenConnect.ClientService.dll
Size 189KB
SHA256 e15b308721df8328d87bade1ba4cf46fed75ba556001968d5ed2c90b3a339754
MD5 22ddb76c563f2ddc533b492f0409d07b
SHA1 0bcc80845edbfb3cfb2b48b973ef4c0ecdb3a4c8
SHA512 b22c0fef6270c67a0993c4df371a08e913f40722701e2a22be0f23a1fe51d791fbcc169ee3527d77f521e9a828e7fe27bde38236e11f971582eed59b7773b5c7
SSDEEP 3072:7ctwzjdJQxOe0GuUZNolP05xA6nAXAzaSVuGzxboCQoVLElWWPATln2:YCzZJQge0GuCNxxAyuyFNclWW4TM
TLSH
T13F14AF49BB5EE926C59F4A36A461B32002F1A053D9EBD74FAC9462DE1E173D43F043CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Program Files (x86)\ScreenConnect Client (a330e929a1701f4a)\ScreenConnect.ClientService.exe
Size 93KB
SHA256 46140f64e0ec35aafbb6f2286ffc02e746a8556d90362afdbf21d5dcc5ed525b
MD5 2886a782f159efc195d7ef85b54216b3
SHA1 84700f844f45960a2123c3913e69db5cd8759c46
SHA512 c1488bfc0b331b68c62f5332d76c33b9d4a3c03a6cfc98f1bddf2491268b08296c2e248423a858a0c77e66e48434b1333d6c78c928112a227c1e4290ef81d67f
SSDEEP 1536:kg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkg8U0HMp7iMP:9hbNDxZGXfdHrX7rAc6myJkg8U0Hsj
TLSH
T1EE935B13B5C29872D473093158E0DAB09A3FF9615E61DEAB3788022E4F742C1AE75E77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Program Files (x86)\ScreenConnect Client (a330e929a1701f4a)\ScreenConnect.Core.dll
Size 1.3MB
SHA256 906f7c098a9b46f99273aafb62e025ee2037cdfea7aeb2c69ba250c64dc1ff8d
MD5 43cc6ac35aa0757a132507a9d4600323
SHA1 e407c9418b5613e97627fd7f79decb35dea10601
SHA512 7925e11c0aec1328868cea538946ee199e85ee75e9973bed7a76104e347e9afd04caf3e785a8f46ea7b4635fbbe6e4cae9293235c38db045a613ec7a22768615
SSDEEP 24576:s638IckRdAlbo4PP7no9W0ipxbL8Ldd/I2R6vZhVzR/Q/UXN:noo4LnLbL8LbI2R6ZN/Q/Ud
TLSH
T176558E4E7FCAE627D9AD16B744A01200A7B4D0D29B63E70B7960BB3D0C493E87D592CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Program Files (x86)\ScreenConnect Client (a330e929a1701f4a)\ScreenConnect.Windows.dll
Size 1.9MB
SHA256 6ff4abd95d513f731560768176ebfdff4e3488e2ba8d67884782228d5e8e6b55
MD5 0cbde04094e3d7ca2ec831b9224f8ea6
SHA1 f1420c97723535b6b39e6ab55abbecd343b4e9a6
SHA512 32b4cccb628dd04d241857d0ee1bc165ae5f8bc0f59e3f4ad77d67764d825f80e392b8f3cd4c12a2a46e736415f5a86de06c72a25ba4775565fe7f482c1316a8
SSDEEP 24576:0ItfI1JZOFj+Ifz3zvnXj/zXzvAAkGz8mvgt379S+2bfR+RfmTk1krT1iH4SqfK5:0ooOJkGYYZTk+T1iH7efPytV
TLSH
T1A995AD45F6C369FAD42B047888AE632AB7743C040355CBFB97D4AA392D337C09A36795
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Program Files (x86)\ScreenConnect Client (a330e929a1701f4a)\ScreenConnect.WindowsClient.exe
Size 1.5MB
SHA256 a29d983b1f94c6f797181fed194a98905487fdc02139ce002bdc49921e5fde75
MD5 d3a4aab9a64e151fc8329de02274ecac
SHA1 1ff7d0e56a0ae6863ae7eeccca08f5b1be67ea20
SHA512 da41fe713b9d3633e3f5399f3a8b0a881d808beee6d6d0b71133cf03e4a4a85fc86f9701079c67aa23e86640f445aebb9f68c9bcab9bd25c6ef571aabaeeab58
SSDEEP 24576:JzGOGtl93a7iTfwt2VIw9zbwACxoZHm5pfrTxoc2w136ifzCErYa1tp/RFE:FGOCesfJrYl52w13D+dKTg
TLSH
T198759DC97EE8EE66C95E0B7B8065220477F085918F63DB4768A07B7E1C893987D085CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Program Files (x86)\ScreenConnect Client (a330e929a1701f4a)\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
TLSH
T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
MD5 SHA1 SHA512 TLSH

Submit Download

app.config

Path C:\Program Files (x86)\ScreenConnect Client (a330e929a1701f4a)\app.config
Size 639B
SHA256 52b82585e250fc1e2a962d9add5783b844092ed97795c0dad79e84a45507b6a0
MD5 c688f0cff3546562715367960b018925
SHA1 fd2d1152086de23403d483cae3bb02ac7a7c3e5a
SHA512 6dfad7f035f1f64685f1c4baad52f32de04f88307851330047413f6f9d0ff076447782531da5c98149c98bc2352987d301ae7222062bc225e4ca71d960f65336
TLSH
T14CF0F91974C4BD2916A31E33E5230900ACB05DA30215646D78AE313BEB765D503F33D7
MD5 SHA1 SHA512 TLSH

Submit Download

system.config

Path C:\Program Files (x86)\ScreenConnect Client (a330e929a1701f4a)\system.config
Size 926B
SHA256 c8d0c442bbbef1421f84bb8c6f58d38d161deb094afe053b28b42bf96d2d5c74
MD5 54875dc5f8231c8241c96be3fdd09c40
SHA1 3fba0c80a64af8b078539a5b1c226bd82554c80e
SHA512 0297cffca38cbe9dcafa6c65f932aba153c03fce9fd59a9406e2a7757a87c1f5a64101bdb470a48ebe6d5d3c3884e8303d07181f7e2581287e41b19cc28e5b3b
TLSH
T16E1100B635C46E4606F31E32D1128A589DF1965B101800EC756E12779F329DF07B315E
MD5 SHA1 SHA512 TLSH

Submit Download

MSI93DA.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI93DA.tmp
Size 1.8MB
SHA256 05a2c77e3f99e5b348c58193ac5a857d8a9c95662e2e532ab8ad1456bce92929
MD5 39bad6f01414d4dfbd126bac76d922ae
SHA1 0d2c14ec11d6b6220fd88687900d26e7c83585ad
SHA512 6ecd1d03ba472364cb8b4a8a2a62fadc21b62372862b130ff6744c5b9e10f5562a90f58487af36064f3981d38f2d5783fec61d7d52fd47a63acf4048593ae25c
SSDEEP 49152:FGJ4LzxYx7x4jazoEtwDop9Cuu2xGU+IcU0sa:FGGfazzwDO9fxrz0sa
TLSH
T1B4953310FBD4D474E6BB363AB97121B45AF838306572804E9B99502C4F91B53FB91BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Deployment.WindowsInstaller.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI93DA.tmp-\Microsoft.Deployment.WindowsInstaller.dll
Size 172KB
SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
MD5 5ef88919012e4a3d8a1e2955dc8c8d81
SHA1 c0cfb830b8f1d990e3836e0bcc786e7972c9ed62
SHA512 4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684
SSDEEP 3072:FkfZS7FUguxN+77b1W5GR69UgoCaf8TpCnfKlRUjW01Ky4:x+c7b1W4R6joxfQE
TLSH
T14E045B2563FC473ECAEF87B4E2624251E7B2E2E97113DB0DDC8541AA2522780F792753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI93DA.tmp-\ScreenConnect.Core.dll
Size 1.3MB
SHA256 a72a36b2bd2e3fa7a3b1a082b217d17ddec70429db1b588f3c7a2e044c4a1d8c
MD5 71703126115a1ca8a3fedcce6ed4f3d6
SHA1 816a2c9294ff80763cf8136fc77a5470adab3d18
SHA512 fbb39142accbd0ade64d1bb47c07a37e3e485bcdc8f43d2f35d474bce043771b1a4b86f0c04ce7ceeeb88e306f0c350f6896e0af7a730e6580a3c1b37afd115a
SSDEEP 24576:n638IckRdAlbo4PP7no9W0ipxbL8Ldd/I2R6vZhVzR/Q/UX:Coo4LnLbL8LbI2R6ZN/Q/U
TLSH
T15F558E4E7FCAE627D9AD16B744601200A7B4D0D29B63E70B7960BB3D0C493E87D592CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.InstallerActions.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI93DA.tmp-\ScreenConnect.InstallerActions.dll
Size 24KB
SHA256 0cf928de332e1d39227aa80a8233274dd4cf698fc532544fd62f38498cce3d99
MD5 b995f66f9720b92a36ca69d6d75685e2
SHA1 ddd76aae99866d624d40a8c964b278e3109d2ae9
SHA512 6e2c2ff8d8f4cdce5bb85750199d033387b9f76ecbdf18c2073738d8c36054229ae4802d016a4e9b5d7a6dc47755a46629cf633fb51bef3dc49a9ad6835f0129
SSDEEP 384:QLazzV1VTsaS8hQlLkmoAcV7NaNeirM0dbMsFkjvZBwH20V4hu:wazC9cVMcLvqVv
TLSH
T133B2D620678DE17AF9EB1634B563FBA001B3BDB3CCE9DA8565A420153D253E04FB5B06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI93DA.tmp-\ScreenConnect.Windows.dll
Size 1.9MB
SHA256 193bfcece3f6129806f48406fa3011b01ae0f654c1a576fa8cd51fee118f449b
MD5 bba7a791d79b898b6d85a01ae98dafc6
SHA1 5a97d2e2cef472813cafa5679a8efd9ae8c6b3de
SHA512 67fe1003550e4522a99e0779d9578096819f851e3af2ebc0f9ab7e05fe7284f5d9756fde297edf7e02231ecfdc9987a5ff4bffc438973ddc144db12c60d35994
SSDEEP 24576:wItfI1JZOFj+Ifz3zvnXj/zXzvAAkGz8mvgt379S+2bfR+RfmTk1krT1iH4SqfKL:wooOJkGYYZTk+T1iH7efPyt
TLSH
T1BC95AD45F6C369FAD42B047888BE632AB7743C040355CBFB96D4AA392D337C09A36795
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CustomAction.config

Path C:\Users\Admin\AppData\Local\Temp\MSI990B.tmp-\CustomAction.config
Size 234B
SHA256 7027b69ab6ebc9f3f7d2f6c800793fde2a057b76010d8cfd831cf440371b2b23
MD5 6f52ebea639fd7cefca18d9e5272463e
SHA1 b5e8387c2eb20dd37df8f4a3b9b0e875fa5415e3
SHA512 b5960066430ed40383d39365eadb3688cadadfeca382404924024c908e32c670afabd37ab41ff9e6ac97491a5eb8b55367d7199002bf8569cf545434ab2f271a
TLSH
T18CD0A70405D0FD1B5E231A2337524559FF34B1E290A44408B06F3A130A220CD4757317
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsInstaller.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI990B.tmp-\ScreenConnect.WindowsInstaller.dll
Size 405KB
SHA256 5dc0994086dc6abe90de41163c5c1f8d070a89839d9bacdc62fb778e86799c60
MD5 ddf2b81159a32f01fb505cf1db4ef948
SHA1 415fdcfd67b578c22ef1ef8ac85d18caf5a24055
SHA512 ffa80ea94a72f54da8f14ea9e449fa196d7a5f3ddc1c844f33a479aabbd43df0915e480015a9c2f1c7cfbd8542f67b70589e5923064d38b87b93cdbf509ed7f3
SSDEEP 12288:ffRXmAhOUcdVJvYUFZ9ZPd/h+2px3y6AK4U32mU0INyTyo6:BmAhf0/Bd/h+2px3y6AK4U32WWyTy
TLSH
T147949E1DAB89A626D62E0B3BC8217100D3F0E49F99A7C38FEC94366D6E147D867D41C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientSetup.msi

Path C:\Users\Admin\AppData\Local\Temp\ScreenConnect\26.5.3.9704\a330e929a1701f4a\ScreenConnect.ClientSetup.msi
Size 22.3MB
SHA256 70715859b9bc095c5b97777512ecbec4f374baff8cfa83993dba21db5261cfd5
MD5 e6d8ce56d46aa4beb5a85b4ddd7af4f8
SHA1 ab5352a0a6a4477cb1f08fbc94c70714a430fe41
SHA512 f95286d45fea04073cc9d5c8132a505a46d256e25d68debb433fc30157f79ac31ae0ed754f7674d23a63d724b29b8a858c4bc5e3b219e9f0cfef83285f4e35ca
SSDEEP 393216:5+X/a/dDc+X/a/j+X/a/j+X/a/Z+X/a/5+X/a/++X/a/:5+X/a/dg+X/a/j+X/a/j+X/a/Z+X/a/G
TLSH
T1B637232133FD2428E5F29E3AFE7996660976BC04D916806F1AE1BC0D09B1F91D923737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIF312.tmp

Path C:\Windows\Installer\MSIF312.tmp
Size 202KB
SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
MD5 ba84dd4e0c1408828ccc1de09f585eda
SHA1 e8e10065d479f8f591b9885ea8487bc673301298
SHA512 7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290
SSDEEP 3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
TLSH
T129147C326494803EE7F91A36D93E9A61AE7DF6241760C99EC3848C0E5D604D06BF7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

32ejvggc.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (a330e929a1701f4a)\32ejvggc.newcfg
Size 836B
SHA256 99df02c42ea57e28278869bba3df34ecb39cf56a03f6c59d0002939cb750ecbd
MD5 49bf4d6911f95787e2575ffe907f6811
SHA1 ba10e4498bf7db775d20daef57beb2804f9ffe6c
SHA512 ffa4b110ccd3975c2792b9bcc8724fbccfd7296b4d0270b4fcd631a6ebb5e685ae4276087b07be3dd57b07a61fcc59a02fbe026ce82ed3af405b8f48dd6ba373
TLSH
T146016D5871C0AE4A12B36E32C5615385FDB1565701A570E834EE21775F308DF07A32DF
MD5 SHA1 SHA512 TLSH

Submit Download

b3pfaexw.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (a330e929a1701f4a)\b3pfaexw.newcfg
Size 836B
SHA256 bb7483e32e998e1bc39d3572ca5a335459ab5b01eeab8b6625a3eba6cdc674c7
MD5 1a90ebf069f995fee9b72ae683c6f3e2
SHA1 ef37257fef4dc91e5e1e7ee7a2b95e8c8c365cf8
SHA512 602c2cf1a10be43bd55862ab9f7de0759c0aaf88f83bdf398a755380566c9465e8df0a6c6ec870990b2cc6e1cb4f1874c8939a2cad1be3b80d8afe859788046b
TLSH
T1B601455871C0AE8A12B36E32C6615385FD71565702A930E838EE21379F3089F07A32DB
MD5 SHA1 SHA512 TLSH

Submit Download

dpezjzda.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (a330e929a1701f4a)\dpezjzda.newcfg
Size 638B
SHA256 42725afc7e3c4428022ad3a70af7de9f18f24f4b30ef77313f2a142bacc000e9
MD5 1a4c98cbcaa6afc951c9eb58ae5e0d63
SHA1 ddc09b878a417fb4a26cbb8474381723dcd334af
SHA512 d82c721ddfc18548187ec12dfc7521de719472e686451419ce8373b258eb7393c77eba3bb9867e581a9df7f2aace01ce983ffb75bb54a5a4bb6f9d1a3ef812cb
TLSH
T128F04C5570C0AE4B03B32E33C5218781FE711A570161209834AE213B5F308CF07E32CE
MD5 SHA1 SHA512 TLSH

Submit Download

gaawf2sf.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (a330e929a1701f4a)\gaawf2sf.newcfg
Size 836B
SHA256 69e731bbdbaf3a780349050b9946b7dceb992f94567762c9e5ea7df783a0c111
MD5 84dd8447fe527874571f70fab4cc225b
SHA1 93464502cb6cd462bcede99d24021e27c544f7c9
SHA512 97ff55f1417aba1c845b10acc5aaf2554cffc49a4fb392aa369152b5e21d3662219cda13e5336a96017dc1cc7e403fa00170d2e4d1966431903aa239b9564df9
TLSH
T16B01685870C0AE8A12B36E32C6615385FDB15A5701A530E838EE21379F308DF07A32DF
MD5 SHA1 SHA512 TLSH

Submit Download

ia0ufylj.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (a330e929a1701f4a)\ia0ufylj.newcfg
Size 836B
SHA256 fc7075ae3afe410bf7e1833be05006aca6e725a6527aab8d927e46b3d55a0933
MD5 d9c0ac989c850bc191f6bb67f5e5f223
SHA1 d36fa2c61b4b857fd7631c9a9243bc8f46616744
SHA512 545953bb1497d63fb3b5a880f2d16118eec9d0ddac65fe8e5f34a3c25f1f6097637f299919803532c7e1d279d57ead1e5b709e89d575f94152add0bc58d60346
TLSH
T12401685870C0AE8A12B36E32C6615385FDB1565701A530E838EE21379F308DF07A32DF
MD5 SHA1 SHA512 TLSH

Submit Download

is2p0nhn.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (a330e929a1701f4a)\is2p0nhn.newcfg
Size 836B
SHA256 b01e979cd655fcdc1230c37a0ffe3c2c05cfb75e3dd1194f846c829311db0031
MD5 53261faf6b6db101f6cefa16dbd6a605
SHA1 fddeac285911b5ebd2d4a216ddb3fffcb8d6e773
SHA512 0a4c0c9dcc65dec80f65dbbb08d8aea1b2d1a65c2859ce64815a38c6ae0f96a013bbb42394ab62b43e3460f575cdc556b9146abeded06583525766690bd57aa5
TLSH
T10501685870C0AE8A12B36E32C6615385FDB1565701A530E838EE21779F308DF07A32DF
MD5 SHA1 SHA512 TLSH

Submit Download

jxyvfkbi.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (a330e929a1701f4a)\jxyvfkbi.newcfg
Size 836B
SHA256 8d9edc08656e02addd79e5800e7827d563f35e1888a7eb1573f3efb1d8970488
MD5 301c9d3a4b9fa641fc2ef377e688e9fe
SHA1 3fb8171b34a6b68301d63027c6190cb45c5e9a9f
SHA512 da89344793f20e966fafe23b8017fd08c785a1a55915948ba9c7d7de50124acba6ad1fa75b4c20c57649465d027e7e7ac21f526226b0c30ea78a37d587c560c4
TLSH
T17501685870C0AE8A12B36E32C6615385FDB1565701A930E878EE21379F308DF07A32DF
MD5 SHA1 SHA512 TLSH

Submit Download

ucnl4t3b.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (a330e929a1701f4a)\ucnl4t3b.newcfg
Size 836B
SHA256 52eee3080924df89597c3f24a81bf9b211fa3248e577b9048988ce8d9fe63390
MD5 dfe252a59179e8dcf6102b41a0cdbf50
SHA1 a411a73f12f707d6f86de14cc5c2189dd6ae5469
SHA512 6a5f77ed0d83958de98d0a10c42d20b041ba956615c47f2fd22370a175043702804acd6b46a571e68e21af07410258ce8167238eaf216754ef0d3af3e77deded
TLSH
T17A01685870C0AE8A12B36E32C6615385FDB1565701A930E838EE21379F308DF07A32DF
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (a330e929a1701f4a)\user.config
Size 520B
SHA256 9fb6aa81085e9f41ebaa82e0f3be027d0e62c0cb408c3491816bcb0bd8ad29dc
MD5 7631a1eeda2644ff8002b2f57d9820d1
SHA1 f09d633a98a35389b2dcd8a8c2fbc9290b852c3d
SHA512 0a616e426a40cf89a90fbc5140c2ac05c5e1a6046ea1e20bc7b955d6e6d751cd2233ffe3b47994b48e428a0b0b3aea9b29c896618c7ca85e5259f2a11e706239
TLSH
T1EAF0E9A131806D4B07A36E23C5128745EE726A9B0565249874AF217B5F315CE03A32CE
MD5 SHA1 SHA512 TLSH

Submit Download

zbfglola.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (a330e929a1701f4a)\zbfglola.newcfg
Size 836B
SHA256 30744bfad43c249db1d5647644e7adf237a283cd83a1a897956d0573555060b3
MD5 94cdac5931156087a7921a5d4530cd86
SHA1 37a331d1db6a26c294c569361ff3a30443feaed7
SHA512 fec14e6cac373ac38dfc352942a640f4a412908f934a82a05517b386c4c6f7d19c80fbedd199caed665af10f076ecdc481da09d24ef62d950aae606497e1587f
TLSH
T13401455870C0AE8A12B36A32C6615385FD71565701A530E838EE21379F3089F07A32DB
MD5 SHA1 SHA512 TLSH

Submit Download

{f9101e6d-c474-48c2-a836-3cdf289ae720}_OnDiskSnapshotProp

Path \??\Volume{c61fbfff-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{f9101e6d-c474-48c2-a836-3cdf289ae720}_OnDiskSnapshotProp
Size 6KB
SHA256 2597802a55c6aae891eaff7de3d031cbe716c479e8d87788d467f33d7f1f832a
MD5 590d784d9e51a8c4136f4f4cdd41e90f
SHA1 dde0c98dbde8b636c2f02b6fb43344ddc0e296cd
SHA512 d84b2a0c94e0eb30bbdd2d73773fdc7314f62cd10122561b96e8602259696cb18f4cd164eb6baef143fce18734e4a6cbb8838245ea92b1651e1dbeb2586b01ab
SSDEEP 96:FQUW5mnlDvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:WDml/b++uVm
TLSH
T103D178085AE54311E2B3AB7129F18557A837B911EF33CB8E0198238E6671910F975F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1856-11-0x0000000074FF0000-0x00000000757AC000-memory.dmp

Download

memory/1856-9-0x0000000007EE0000-0x0000000007F72000-memory.dmp

Download

memory/1856-8-0x0000000007420000-0x000000000748C000-memory.dmp

Download

memory/1856-10-0x0000000074FF0000-0x00000000757AC000-memory.dmp

Download

memory/1856-13-0x0000000074FF0000-0x00000000757AC000-memory.dmp

Download

memory/1856-2-0x0000000004480000-0x0000000004490000-memory.dmp

Download

memory/1856-6-0x0000000074FF0000-0x00000000757AC000-memory.dmp

Download

memory/1856-1-0x0000000004460000-0x0000000004468000-memory.dmp

Download

memory/1856-7-0x0000000007820000-0x0000000007DDA000-memory.dmp

Download

memory/1856-5-0x0000000007070000-0x0000000007254000-memory.dmp

Download

memory/1856-4-0x0000000006CA0000-0x0000000006DF0000-memory.dmp

Download

memory/1856-3-0x0000000074FF0000-0x00000000757AC000-memory.dmp

Download

memory/1856-0-0x0000000075002000-0x0000000075003000-memory.dmp

Download

memory/2188-154-0x00000000015A0000-0x00000000015D4000-memory.dmp

Download

memory/2188-197-0x0000000004A90000-0x0000000004B32000-memory.dmp

Download

memory/2188-178-0x0000000004990000-0x00000000049E0000-memory.dmp

Download

memory/2188-164-0x0000000004440000-0x0000000004624000-memory.dmp

Download

memory/2188-160-0x0000000003D80000-0x0000000003ED0000-memory.dmp

Download

memory/2904-218-0x0000000000B70000-0x0000000000CFE000-memory.dmp

Download

memory/2904-219-0x000000001BAE0000-0x000000001BB82000-memory.dmp

Download

memory/2904-220-0x000000001C0E0000-0x000000001C230000-memory.dmp

Download

memory/2904-221-0x000000001C420000-0x000000001C604000-memory.dmp

Download

memory/2904-222-0x000000001C9A0000-0x000000001CB28000-memory.dmp

Download

memory/2904-223-0x0000000003000000-0x0000000003034000-memory.dmp

Download

memory/3224-76-0x0000000005AE0000-0x0000000005B4C000-memory.dmp

Download

memory/5116-34-0x00000000039B0000-0x00000000039DE000-memory.dmp

Download

memory/5116-38-0x00000000039A0000-0x00000000039AC000-memory.dmp

Download

memory/5116-46-0x0000000005EC0000-0x00000000060A4000-memory.dmp

Download

memory/5116-42-0x0000000005B80000-0x0000000005CD0000-memory.dmp

Download

memory/5944-224-0x00000194834E0000-0x0000019483E84000-memory.dmp

Download