2a036e2ea81f16abde4fe0e5bbd26f686c34b14955a74ee594e5775436416c23

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 03:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_ba5068ac4653c95885e800ca35fe8bd6_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe
Size 19.6MB
Sample260813-ealqjay1ds
SHA256 2a036e2ea81f16abde4fe0e5bbd26f686c34b14955a74ee594e5775436416c23
MD5 ba5068ac4653c95885e800ca35fe8bd6
SHA1 27f7b98bfc2a665baf27f44e8217d7d1c77dc7d0
SHA512 c6f8af25d6714788f019df29e055c5b2e00c69615245b841e8df9e6310c416a20cc7772dc18bd55145d128a57abfed76aa0bf1f30e7fc6c187d06a185d502528
SSDEEP 393216:rh1OvTi7hha62+3/11VOvTi7hha62LOvTi7hha62UOvTi7hha62W:rh1Ovj+391VOvjLOvjUOvjW
TLSH
T1842723017BC6AAA7D43F0635987A632067B4BC414F13C36F66A47A3D1D327C06E727A6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery ransomware

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
3	3776	msiexec.exe
4	1892	rundll32.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe

Drops file in Program Files directory 14 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ScreenConnect Client (7ade31a136fc3a09)\system.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (7ade31a136fc3a09)\ScreenConnect.Client.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (7ade31a136fc3a09)\ScreenConnect.ClientService.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (7ade31a136fc3a09)\ScreenConnect.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (7ade31a136fc3a09)\ScreenConnect.WindowsBackstageShell.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (7ade31a136fc3a09)\ScreenConnect.WindowsClient.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (7ade31a136fc3a09)\ScreenConnect.WindowsFileManager.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (7ade31a136fc3a09)\ScreenConnect.WindowsFileManager.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (7ade31a136fc3a09)\Client.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (7ade31a136fc3a09)\ScreenConnect.Windows.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (7ade31a136fc3a09)\ScreenConnect.WindowsBackstageShell.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (7ade31a136fc3a09)\ScreenConnect.WindowsClient.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (7ade31a136fc3a09)\ScreenConnect.ClientService.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (7ade31a136fc3a09)\Client.resources	msiexec.exe

Drops file in Windows directory 15 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e59f003.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF65D.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF6A7524FDC696D96C.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e59f003.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\SourceHash{C6C64451-FC3E-B456-125C-9BD27F4705ED}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF63D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{C6C64451-FC3E-B456-125C-9BD27F4705ED}\DefaultIcon	msiexec.exe
File created	C:\Windows\SystemTemp\~DF2EDC193C0E7ED7E6.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\{C6C64451-FC3E-B456-125C-9BD27F4705ED}\DefaultIcon	msiexec.exe
File created	C:\Windows\SystemTemp\~DFD4391846FC0A22DC.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF150B25575CC5F79E.TMP	msiexec.exe
File created	C:\Windows\Installer\e59f005.msi	msiexec.exe

Executes dropped EXE 2 IoCs

pid	Process
4640	ScreenConnect.WindowsClient.exe
3632	ScreenConnect.WindowsClient.exe

Loads dropped DLL 31 IoCs

pid	Process
800	MsiExec.exe
1684	rundll32.exe
1684	rundll32.exe
1684	rundll32.exe
1684	rundll32.exe
1684	rundll32.exe
1684	rundll32.exe
1684	rundll32.exe
1684	rundll32.exe
1684	rundll32.exe
800	MsiExec.exe
1892	rundll32.exe
1892	rundll32.exe
1892	rundll32.exe
1892	rundll32.exe
1892	rundll32.exe
1892	rundll32.exe
1892	rundll32.exe
1892	rundll32.exe
1892	rundll32.exe
800	MsiExec.exe
2860	rundll32.exe
2860	rundll32.exe
2860	rundll32.exe
2860	rundll32.exe
2860	rundll32.exe
2860	rundll32.exe
2860	rundll32.exe
2860	rundll32.exe
2860	rundll32.exe
5580	MsiExec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-13_ba5068ac4653c95885e800ca35fe8bd6_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ad3b1fc6af0fc0350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801ad3b1fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101ad3b1fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3ad3b1fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6ad3b1fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 32 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\15446C6CE3CF654B21C5B92DF77450DE\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\26.1.18.9566\\7ade31a136fc3a09\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\15446C6CE3CF654B21C5B92DF77450DE\ProductName = "ScreenConnect Client (7ade31a136fc3a09)"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\47A2F32A065DE122A7ED131A63CFA390	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-7ade31a136fc3a09\URL Protocol	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-7ade31a136fc3a09\UseOriginalUrlEncoding = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-7ade31a136fc3a09	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\15446C6CE3CF654B21C5B92DF77450DE\Full	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\15446C6CE3CF654B21C5B92DF77450DE\PackageCode = "15446C6CE3CF654B21C5B92DF77450DE"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\15446C6CE3CF654B21C5B92DF77450DE\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\15446C6CE3CF654B21C5B92DF77450DE\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-7ade31a136fc3a09\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-7ade31a136fc3a09\shell	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\15446C6CE3CF654B21C5B92DF77450DE\Version = "436273170"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\15446C6CE3CF654B21C5B92DF77450DE\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\15446C6CE3CF654B21C5B92DF77450DE\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-7ade31a136fc3a09\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (7ade31a136fc3a09)\\ScreenConnect.WindowsClient.exe\" \"%1\""	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\15446C6CE3CF654B21C5B92DF77450DE	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\15446C6CE3CF654B21C5B92DF77450DE\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\15446C6CE3CF654B21C5B92DF77450DE\SourceList\Media\1 = ";"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\15446C6CE3CF654B21C5B92DF77450DE\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\47A2F32A065DE122A7ED131A63CFA390\15446C6CE3CF654B21C5B92DF77450DE	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\15446C6CE3CF654B21C5B92DF77450DE\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\15446C6CE3CF654B21C5B92DF77450DE\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\26.1.18.9566\\7ade31a136fc3a09\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-7ade31a136fc3a09\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\15446C6CE3CF654B21C5B92DF77450DE	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\15446C6CE3CF654B21C5B92DF77450DE\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\15446C6CE3CF654B21C5B92DF77450DE\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-7ade31a136fc3a09\shell\open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\15446C6CE3CF654B21C5B92DF77450DE\ProductIcon = "C:\\Windows\\Installer\\{C6C64451-FC3E-B456-125C-9BD27F4705ED}\\DefaultIcon"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-7ade31a136fc3a09	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\15446C6CE3CF654B21C5B92DF77450DE\SourceList\PackageName = "ScreenConnect.ClientSetup.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\15446C6CE3CF654B21C5B92DF77450DE\SourceList\Media	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4976	msiexec.exe
4976	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1004	2026-08-13_ba5068ac4653c95885e800ca35fe8bd6_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe
Token: SeShutdownPrivilege	3776	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3776	msiexec.exe
Token: SeSecurityPrivilege	4976	msiexec.exe
Token: SeCreateTokenPrivilege	3776	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3776	msiexec.exe
Token: SeLockMemoryPrivilege	3776	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3776	msiexec.exe
Token: SeMachineAccountPrivilege	3776	msiexec.exe
Token: SeTcbPrivilege	3776	msiexec.exe
Token: SeSecurityPrivilege	3776	msiexec.exe
Token: SeTakeOwnershipPrivilege	3776	msiexec.exe
Token: SeLoadDriverPrivilege	3776	msiexec.exe
Token: SeSystemProfilePrivilege	3776	msiexec.exe
Token: SeSystemtimePrivilege	3776	msiexec.exe
Token: SeProfSingleProcessPrivilege	3776	msiexec.exe
Token: SeIncBasePriorityPrivilege	3776	msiexec.exe
Token: SeCreatePagefilePrivilege	3776	msiexec.exe
Token: SeCreatePermanentPrivilege	3776	msiexec.exe
Token: SeBackupPrivilege	3776	msiexec.exe
Token: SeRestorePrivilege	3776	msiexec.exe
Token: SeShutdownPrivilege	3776	msiexec.exe
Token: SeDebugPrivilege	3776	msiexec.exe
Token: SeAuditPrivilege	3776	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3776	msiexec.exe
Token: SeChangeNotifyPrivilege	3776	msiexec.exe
Token: SeRemoteShutdownPrivilege	3776	msiexec.exe
Token: SeUndockPrivilege	3776	msiexec.exe
Token: SeSyncAgentPrivilege	3776	msiexec.exe
Token: SeEnableDelegationPrivilege	3776	msiexec.exe
Token: SeManageVolumePrivilege	3776	msiexec.exe
Token: SeImpersonatePrivilege	3776	msiexec.exe
Token: SeCreateGlobalPrivilege	3776	msiexec.exe
Token: SeCreateTokenPrivilege	3776	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3776	msiexec.exe
Token: SeLockMemoryPrivilege	3776	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3776	msiexec.exe
Token: SeMachineAccountPrivilege	3776	msiexec.exe
Token: SeTcbPrivilege	3776	msiexec.exe
Token: SeSecurityPrivilege	3776	msiexec.exe
Token: SeTakeOwnershipPrivilege	3776	msiexec.exe
Token: SeLoadDriverPrivilege	3776	msiexec.exe
Token: SeSystemProfilePrivilege	3776	msiexec.exe
Token: SeSystemtimePrivilege	3776	msiexec.exe
Token: SeProfSingleProcessPrivilege	3776	msiexec.exe
Token: SeIncBasePriorityPrivilege	3776	msiexec.exe
Token: SeCreatePagefilePrivilege	3776	msiexec.exe
Token: SeCreatePermanentPrivilege	3776	msiexec.exe
Token: SeBackupPrivilege	3776	msiexec.exe
Token: SeRestorePrivilege	3776	msiexec.exe
Token: SeShutdownPrivilege	3776	msiexec.exe
Token: SeDebugPrivilege	3776	msiexec.exe
Token: SeAuditPrivilege	3776	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3776	msiexec.exe
Token: SeChangeNotifyPrivilege	3776	msiexec.exe
Token: SeRemoteShutdownPrivilege	3776	msiexec.exe
Token: SeUndockPrivilege	3776	msiexec.exe
Token: SeSyncAgentPrivilege	3776	msiexec.exe
Token: SeEnableDelegationPrivilege	3776	msiexec.exe
Token: SeManageVolumePrivilege	3776	msiexec.exe
Token: SeImpersonatePrivilege	3776	msiexec.exe
Token: SeCreateGlobalPrivilege	3776	msiexec.exe
Token: SeCreateTokenPrivilege	3776	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3776	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3776	msiexec.exe
3776	msiexec.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
3776	msiexec.exe
4976	msiexec.exe
800	MsiExec.exe
5580	MsiExec.exe
3632	ScreenConnect.WindowsClient.exe
3632	ScreenConnect.WindowsClient.exe
3632	ScreenConnect.WindowsClient.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1004 wrote to memory of 3776	1004	2026-08-13_ba5068ac4653c95885e800ca35fe8bd6_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe	90
PID 4976 wrote to memory of 800	4976	msiexec.exe	92
PID 800 wrote to memory of 1684	800	MsiExec.exe	93
PID 800 wrote to memory of 1892	800	MsiExec.exe	94
PID 800 wrote to memory of 2860	800	MsiExec.exe	95
PID 4976 wrote to memory of 4404	4976	msiexec.exe	101
PID 4976 wrote to memory of 5580	4976	msiexec.exe	103
PID 4976 wrote to memory of 4640	4976	msiexec.exe	104
PID 4640 wrote to memory of 3632	4640	ScreenConnect.WindowsClient.exe	105

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-13_ba5068ac4653c95885e800ca35fe8bd6_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_ba5068ac4653c95885e800ca35fe8bd6_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1004
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\26.1.18.9566\7ade31a136fc3a09\ScreenConnect.ClientSetup.msi" SC_EXE_PATH="C:\Users\Admin\AppData\Local\Temp\2026-08-13_ba5068ac4653c95885e800ca35fe8bd6_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe"
  2⤵
  - Badlisted process makes network request
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:3776

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4976
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding BA8AC1B99FDD513E64F5E56C32B5BA11 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:800
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI9B0D.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240753562 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:1684
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI9D22.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240753984 8 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.CheckMsiMotw
    3⤵
    - Badlisted process makes network request
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:1892
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIA6C7.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240756484 15 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.CheckMsiFileName
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2860
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4404
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 6D942F4C2EC16A8B162C763E465BFB40
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5580
- C:\Program Files (x86)\ScreenConnect Client (7ade31a136fc3a09)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (7ade31a136fc3a09)\ScreenConnect.WindowsClient.exe" "Rerun" "?e=Access&y=Host&h=instance-y6572y-relay.screenconnect.com&p=443&s=3917a7ee-7ac5-4943-a2b9-84f682042f50&k=BgIAAACkAABSU0ExAAgAAAEAAQBn0GNoIcr0ewvMw6zB6KC3seQvBkPq09YEsHBEAjVPWda%2f47mmdsBefNjOowZNz%2b7Ifz4dSmQT01xT5FYYvkN7dKdeqnQil7TMgSPw%2fU0eYthmy5uWyEFMrGkWGSm5NKt3OwDV2KEtQJE1NuMF3ew5AiL9cB5Q309Ay5dQoYEl4dgy7C5YYr44Fe7OqeZy5lXCdPfca73s5NOEXQaErdEhQ0RagqJzt6U62KWy3b6Xc6dsJi4isGV9m279h5tGVNehZXLbJZKcPR6cMaZRK1pLL3MfwChD3f5CCo0iyy8NFz43VViaEXxuM%2fLi4oOnKBNng21Xv9WERcfK8PncjZe9&n=BL%2fgu21t2t%2bezBcmxJGTkW09FVYWf4QsVPvregiYIVcG2gOcAdJPkgJLBSUkVOqGA4SII5sb98TPX%2fdZ2nyFADdfleepivvVTBjzy9%2brDoiCMcPha7xUn%2fjOi%2ftgiGAmemXwWq31D%2bLiV9U96sTTKxF6Ui7mE8qw9WBiKjDxE7eJTzgwStF2579oU%2bg4iwIgxQ%3d%3d&i=K-PW"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4640
- - C:\Program Files (x86)\ScreenConnect Client (7ade31a136fc3a09)\ScreenConnect.WindowsClient.exe
    "C:\Program Files (x86)\ScreenConnect Client (7ade31a136fc3a09)\ScreenConnect.WindowsClient.exe" "?e=Access&y=Host&h=instance-y6572y-relay.screenconnect.com&p=443&s=3917a7ee-7ac5-4943-a2b9-84f682042f50&k=BgIAAACkAABSU0ExAAgAAAEAAQBn0GNoIcr0ewvMw6zB6KC3seQvBkPq09YEsHBEAjVPWda%2f47mmdsBefNjOowZNz%2b7Ifz4dSmQT01xT5FYYvkN7dKdeqnQil7TMgSPw%2fU0eYthmy5uWyEFMrGkWGSm5NKt3OwDV2KEtQJE1NuMF3ew5AiL9cB5Q309Ay5dQoYEl4dgy7C5YYr44Fe7OqeZy5lXCdPfca73s5NOEXQaErdEhQ0RagqJzt6U62KWy3b6Xc6dsJi4isGV9m279h5tGVNehZXLbJZKcPR6cMaZRK1pLL3MfwChD3f5CCo0iyy8NFz43VViaEXxuM%2fLi4oOnKBNng21Xv9WERcfK8PncjZe9&n=BL%2fgu21t2t%2bezBcmxJGTkW09FVYWf4QsVPvregiYIVcG2gOcAdJPkgJLBSUkVOqGA4SII5sb98TPX%2fdZ2nyFADdfleepivvVTBjzy9%2brDoiCMcPha7xUn%2fjOi%2ftgiGAmemXwWq31D%2bLiV9U96sTTKxF6Ui7mE8qw9WBiKjDxE7eJTzgwStF2579oU%2bg4iwIgxQ%3d%3d&i=K-PW"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3632

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:2544

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59f004.rbs

Path C:\Config.Msi\e59f004.rbs
Size 10KB
SHA256 c6f6b0e3986e532d6efa833beb63482e248dffa771a0007453215bb3faf437b3
MD5 f2c771a1f90bb2e478cb5f2a5182047e
SHA1 e67bc7cccde565d525f815acc179270a1676b652
SHA512 65b2c3984a6b70a8617f441589982344b85fd281e4c7ee61a8bc81d07fc0ba16cb770c6eccaeb6b4d78e64da7806674406a01635df4483fd3310e89cbb8dbad6
SSDEEP 192:WcCiG+yNM882SmqbqwXzCzQBx5CCISZ8y5Igy5/dvvq4ypOpn7BQ8RA65GpYfDH+:WCG+yNF4Cy3y/o
TLSH
T1BE223F51776A91E2F5262E32CB5B1F213B75DEA56700260F08CC41B49DA27CD2BBD2CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.en-US.resources

Path C:\Program Files (x86)\ScreenConnect Client (7ade31a136fc3a09)\Client.en-US.resources
Size 64KB
SHA256 efdb0b4fcc38b52cbf72336bd107a814db8454003f3495de21e2026a148823ea
MD5 92232708774febf9a4a464bbeda36215
SHA1 521d4e630f5e00977bbca7cd17dd0d22dbe1ca9e
SHA512 59442cbc57604f0dd170bb4f86f0e2b6c96408daf67250e6f40e00d034033b6871502cd83df0267f4628c3a035f191d56f26bf1927e691b5330524eb810852f2
SSDEEP 1536:5fkiK2FoQ67wwLFSj7Be3sZvU/7UFN+9nwLLChTKN1ljpneMarA:5fkiK2FoQ6jFSj7Be3sZvU/7UFN+9nwS
TLSH
T1A8532E1277FD0A58F5F36F35BE7A94619937BC5A2E25C06E1028815E09B2F80C9B2773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.resources

Path C:\Program Files (x86)\ScreenConnect Client (7ade31a136fc3a09)\Client.resources
Size 6KB
SHA256 bd34378ad99f7609fa0c7c8edde6337c738a61d288863015629329806a1cc728
MD5 1e863134f29bcabe1ee571c91ac4fbe6
SHA1 57cc5966fcae49019da5f8f507c840cedfc103f4
SHA512 7e2640c4ddb8719230de0ddb0d18f9a4b1499a037247f12b142b1c16a2a989390abcb5ac7816a63dbce2d43c08510cec7cfc87cd24458bc2fa919c396b36d4f9
SSDEEP 192:rpDZHfbkqYvZJG293IIs1Z4EO/nM3ZWYijpo2YG:rRZjkqYxJ3JI/sMJ/ijp/p
TLSH
T1D8D13BC49BFEAC3CF05E51BE3A7692990275FF113AA3C3582460106A7F228856C56737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll

Path C:\Program Files (x86)\ScreenConnect Client (7ade31a136fc3a09)\ScreenConnect.Client.dll
Size 616KB
SHA256 204d17d90001f6848449cb8e6763f4884d60c7ce0b802d33a5b5025e63f9437b
MD5 699bd6561a615f30ba009e96efbd8cc7
SHA1 84fb94e397ed6229c752bf6a5dd171b0ecb6c65e
SHA512 3c030a2b8c5fe1e2157973487f6a80f7abf7fcd284c62e91f4758275918b7ab33d5ecea2ebe596df9a493ce13c043ee63fd6919f2a8ea81fc691f3b67077986d
SSDEEP 12288:Gaim+/CHl7ypy+f/zHTEavSW7OQninphseI:GaiEVkfLzEn8qnphlI
TLSH
T194D4D04EABD49A2DE93E0733E25023506FB06C994D57DB1F2D3436B95EB27C16AC82C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Program Files (x86)\ScreenConnect Client (7ade31a136fc3a09)\ScreenConnect.ClientService.dll
Size 174KB
SHA256 81e434159e91fe93c546d9cbb1a35a0438c98e2467836a586c5cdd3175eb2f09
MD5 e2bfe1cc5844b87d575d5b2c7090565f
SHA1 f325878ef140bd0d6372621c9cb588814550005b
SHA512 a78d05eb3c3205bb93aac48dcd12d3e7364314e6464c24921bfd6a3861734ad4ef319ef68448d6e829c6128a6a2cb4ca22e4cc8935d566e0bd73d9537c655cb4
SSDEEP 3072:AOKtkTp3CyEjmJm8TMLMZ39MX1a8rUptnwRVDp05LjQ7VpRv1Sr/:wtkVH8Gm8TMgMlhAVwHDpWyRvA
TLSH
T147049D48BF5D9929C89E0D31B860B62006F2B496DDE7D79A6C9832EF1D427D01F482DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Program Files (x86)\ScreenConnect Client (7ade31a136fc3a09)\ScreenConnect.Core.dll
Size 1.3MB
SHA256 ff590d39b36694947d6cb7bb79aa76ebe8e68122e380d4a858035977c0aa3d95
MD5 119c464415cac27e0d777acb567e9a53
SHA1 901d7a9660070d3818646886239a578b381671b5
SHA512 582145cc9b87d0f437f30b93d107a9f2af1f05922c487d8472db30bcb38e479e5147095d91ca766eed79a3710ced48648fc910a0e5b3ab43cce397c984bd1435
SSDEEP 24576:eDZQeSI2Jy8VPrYd7dn9DSWTGA7VeA2HSp3fM/DN:e9Qearl0dEN
TLSH
T17F558D4A7FC9BB17CC6D1A72582523006BF4D0849EA3D74F39B8AA7D1D853C82D891ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Program Files (x86)\ScreenConnect Client (7ade31a136fc3a09)\ScreenConnect.Windows.dll
Size 1.9MB
SHA256 5c1f4fb54bb584cfa7a89f0785addc086e9824046dc40e36d098edd4dcaf1087
MD5 d3a4795979315695ace458084006a786
SHA1 39b055a52b7f78b181bbda72eaab18b78fdc1bce
SHA512 084e3df31fda982cb5adfdbf5d7ca316fee120c25f161cc046679c1a437424d0fbef774a464ca6fd4eaf74c32288466a0ad7b6f0fd65ef21f975af21d817706c
SSDEEP 24576:7q3/N0Fj+Ifz3zvnXj/zXzvAAkGz8mvgt379S+2bfR+RfmTk1krT1iH4SqfKPTsG:7JkGYYZTk+T1iH7efP0my
TLSH
T14F95AD41E6C365F6D46F047888BE932AB6743C050315CAFB93D4AE3A6D33BC09A36795
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Program Files (x86)\ScreenConnect Client (7ade31a136fc3a09)\ScreenConnect.WindowsClient.exe
Size 1.5MB
SHA256 0a46625ec3f41f4a7821a88e1b7edc0fe3062c92f982a5e8dd4258c4a169c052
MD5 02912dc303c8bf5ff0bdc58578b9d7a2
SHA1 56217ea0d371438e170bc380ac6a3d9bc2a0ffad
SHA512 b81fb292513341858307ee12a86af2f5a5e5d254d14895eb0831b8a21d1e1d024580c812e95a6598974c6fb62c0f29384c6f6f2b99137859385b01d5572b5d71
SSDEEP 24576:Q0QES6I7KPzDpKzN4Nzs1GLQdQ/tq1zwJk0BfBxzA9ZEEzn1p:hQCIUtWwvoEExp
TLSH
T11675AF4E7ED6EE27C82E0B77946172087FF094528B63CB4766A4B63E0ED43D46D442CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Program Files (x86)\ScreenConnect Client (7ade31a136fc3a09)\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
TLSH
T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
MD5 SHA1 SHA512 TLSH

Submit Download

system.config

Path C:\Program Files (x86)\ScreenConnect Client (7ade31a136fc3a09)\system.config
Size 952B
SHA256 93b055e74c42a82dcbc3db3ec1661222d95e940b278a01a2be9ef30304f53180
MD5 abcdab2f02610f8e612417541cba555d
SHA1 81a63c8e66d858f7ce4d3722cae701562122c1c1
SHA512 07227b0310ae7d8879a6afb83c3c9f49302f731a46361fa12023b4ca769bd41b81bbac54cc1ae799fa58797011553a82db55dccafc7a2a3c100bc58a5bc1e613
TLSH
T1571110A56180BC8A07B35A21C4164741EDB24A8F26240188369E127AEB702DB03931AE
MD5 SHA1 SHA512 TLSH

Submit Download

45c5yjbt.newcfg

Path C:\Users\Admin\AppData\Local\ScreenConnect Client (7ade31a136fc3a09)\45c5yjbt.newcfg
Size 586B
SHA256 5905c43ceac67768fc535d519dabfb9342e79a0ce98325ab666d913b97c14afe
MD5 24c942e99f86e748605a78f9f5f6030a
SHA1 6147ed74b97b94c40a00d89bf96832f07a7a1221
SHA512 5d7640fde96f4c4aec3c0a7ddc86b963ada56dcf416b4a88c8fc3e8d9968f7965f2b45652e9abf64ad73e3ea59fd5a3ad3f2ac91f1c639d3c2bb83108acd475d
TLSH
T1CDF08BA53080AD4713B35D23C4114744FE721B9B0525108C386F61365F311DB03A31DF
MD5 SHA1 SHA512 TLSH

Submit Download

f4seoiu5.newcfg

Path C:\Users\Admin\AppData\Local\ScreenConnect Client (7ade31a136fc3a09)\f4seoiu5.newcfg
Size 586B
SHA256 9cbc75e22b4d0347a7b1440f69ae97fe48ff9b69810c22f258fca9d286f0e160
MD5 9ecbc30087e98acfe9026503eff83928
SHA1 7744468402ceb34ee18444d0c0b0bf244ccab3fb
SHA512 d1fbee041f6043b3e46e1eed7e5bb634c857783caa64daeb8aaa907f5ccba50e384ae8f223e7c16d51878028f8b38ec6b885baddd05865e6de295394b5f8cc08
TLSH
T125F08BA43080AE5613B31D23C4114744FE721B9B0529508C386F913A5F311DF03A31DF
MD5 SHA1 SHA512 TLSH

Submit Download

g0ev01wy.newcfg

Path C:\Users\Admin\AppData\Local\ScreenConnect Client (7ade31a136fc3a09)\g0ev01wy.newcfg
Size 586B
SHA256 b1a17a457a0c1b85042272170b20477b1f1c5e5a5d1e2dc1c2fc26ddb4d2e32c
MD5 0b1ea77e13c9af3e8d35705c75734019
SHA1 2783a2b322f6a51682c90ef8621227c0e5a00890
SHA512 8e19fb7d25de9ff3330b3d11c5edf51c8ed278eaedac7b6e04cdf5941137d2c500a56eb65522153ea5b473ff6a17943cfd4d4e6873f0cbb68431aa14d60946f2
TLSH
T110F08BA43080AD4617B31D23C4114744FE722B9B0125509C386F61365F311DB03A31DF
MD5 SHA1 SHA512 TLSH

Submit Download

niydehap.newcfg

Path C:\Users\Admin\AppData\Local\ScreenConnect Client (7ade31a136fc3a09)\niydehap.newcfg
Size 586B
SHA256 897e6c34772a1a6f5ff878f79c62cde6ec606b4c566ce63152eba1c2a3096be3
MD5 6ea172f7db0bd90e323d363e4d1df903
SHA1 9438b25a7462592dcde3b7c2dd64e0fbeb83a2ea
SHA512 629d1a5d8a5e3f43a2d1843d44eaf95f93d2b3d072538efc1f671b049379095fb38decc584eecd4495a079d45187ec5541a91d0d3d53b5901e1dff3faf08302e
TLSH
T17BF08BA43080AD4613B31D23C4114744FE721B9B0125108C386F51765F311DB03A31EF
MD5 SHA1 SHA512 TLSH

Submit Download

qvj1k4rw.newcfg

Path C:\Users\Admin\AppData\Local\ScreenConnect Client (7ade31a136fc3a09)\qvj1k4rw.newcfg
Size 586B
SHA256 c2fb68797d745828860729262f4d5d6087eb530d61ba9a1817fda1f80cbd1e5a
MD5 f1d07ec1c3674ce24b024a4e87d705df
SHA1 4e02ec56fc8e08417d2405d6d88a525a8c0b17e6
SHA512 5184721759a3df2a459bc5796aa760223178dd25f96599f785c2468ef29bfa58240bd069a8cbc6acf5cdabbedd899ee46c80d8c6854f32506439e68a3b06a559
TLSH
T187F08BA43080AD8613B31D23C4114744FE721B9B0125108C78AF51365F311DF03A31DF
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Users\Admin\AppData\Local\ScreenConnect Client (7ade31a136fc3a09)\user.config
Size 586B
SHA256 230ca7493e4af2af53d04ffb635a54ea4934808cc1139bb069642ab893c6cb09
MD5 2b05fb4d6a48e7ba272640688c8869e2
SHA1 3e24b0f66571fb97cf0ddc08104634f467329564
SHA512 266ed5b993bb84584573de2782e880a26794f0ad32c79525b94b2c607faee904385a610b083dceca33ea3ef8409547a228baf194753e9b2313d76467cd13345f
TLSH
T115F08BA53080AD4617B31D23C4114744FE722B9B0125509C386F51365F311DF03A31DF
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Users\Admin\AppData\Local\ScreenConnect Client (7ade31a136fc3a09)\user.config
Size 586B
SHA256 0274a3012f9a8cc218692a104da74f0c49e0099d5b68d1c17d8d88dd32835b51
MD5 f5201fd3103be74b5cc6b5a17e11fc18
SHA1 976b2525d489734489385ae54f20d7256075e847
SHA512 256d7772b6680bf32489a862f8168f175f17ecf48ee8f3d3df3012c7a0479ab0f57acfc6f814d7d5ad4c2efff05d75e5856ea3aeea2b175a1e080624f075bb9a
TLSH
T107F08BA530C0AD5613B31D23C5124744FE721B9B0129508C386F913A5F311DB03A35DF
MD5 SHA1 SHA512 TLSH

Submit Download

MSI9B0D.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI9B0D.tmp
Size 1.8MB
SHA256 ac1b1afb6c8e73e6a476de1c2ef07e8d31888468ba705b9ac548a0e860017363
MD5 3da27d0c256a14bb017f21f3a486d136
SHA1 d4cebb725f28248853dfe6f3e042b94db85d107f
SHA512 dc5f4b2be3bce83af68db869ef5ac17a3deae4c8e4d7a08d66d1fd4f37e3f6bce861207e8377ca655ebe57321f8a8e1d2cb36f70473fee0dec4d4914fbefa3a1
SSDEEP 49152:kGbpxBxe/A6/NIDURTA+XnFT2WqCXG2cs:kGl3QAKLVZ2W1G25
TLSH
T13495230073E9843AD3923D3608A7A6B4997A3865A77581CEDB85063CCDF0F5097B9B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Deployment.WindowsInstaller.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI9B0D.tmp-\Microsoft.Deployment.WindowsInstaller.dll
Size 172KB
SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
MD5 5ef88919012e4a3d8a1e2955dc8c8d81
SHA1 c0cfb830b8f1d990e3836e0bcc786e7972c9ed62
SHA512 4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684
SSDEEP 3072:FkfZS7FUguxN+77b1W5GR69UgoCaf8TpCnfKlRUjW01Ky4:x+c7b1W4R6joxfQE
TLSH
T14E045B2563FC473ECAEF87B4E2624251E7B2E2E97113DB0DDC8541AA2522780F792753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI9B0D.tmp-\ScreenConnect.Core.dll
Size 1.3MB
SHA256 f530f5e1f75d1d13436347c58dc72947a50d030bfbc4b531c922e3450b98bd60
MD5 e68fe19a338ace19cdcb8451962454c3
SHA1 5dc3c42db325885b7bfd5779a29ada71f740c8d7
SHA512 6b132af1d305ed9a27fe34311594856c144e56fd623779e353f34fa354527eed6b484080d13963729316b7368ab43029239d71670751dbf1db03e025a0620f70
SSDEEP 24576:jDZQeSI2Jy8VPrYd7dn9DSWTGA7VeA2HSp3fM/D:j9Qearl0dE
TLSH
T196558D497FC9BB17CC6D1A72582523006BF4D0849EA3D74F39B8AA7E1D853C82D891ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.InstallerActions.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI9B0D.tmp-\ScreenConnect.InstallerActions.dll
Size 24KB
SHA256 54ed2a3200e96d8cf603e594f148f2832340fa23a6ce0140a16b666966cd5d3b
MD5 0c94bbd2593bb06f7e96a3f19de39ef0
SHA1 2beb82b0fe2eab5ca4ca954c2f4af235b301c7a4
SHA512 031c9a6963441d1cdd666b4b9583b248d6a4e721cb0b7fe5c1fd8db5bbed7e6e96b0bac6d0a7d9cbf4a3d438efba07864d8f4b31012388a421185acb2d004435
SSDEEP 384:NVazzV1WTsaS8hQlL6QXgV7NaNeirM0dbMsFkjvZBLcs0aD:3azwQXgVMcLvsG
TLSH
T160B2D620678DE17AF9EB1634B563FBA011B3BDB3CCE9DA8565A420153C253E04FB5B06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI9B0D.tmp-\ScreenConnect.Windows.dll
Size 1.8MB
SHA256 d61ea81371332c01be9969d359df8412b7e1b0f5803c08dfc480c0421dce8a44
MD5 0e7a185162afaae9e8b9e088d97a0887
SHA1 a8c03884019b2f722d15acfc375764f53a8c8848
SHA512 09b608b5ea5649f26dd56073b266b7e49b9f25727dd347b7a8946151b6fc2b5c9212fab0869518508b918e0d2babb21fc52055ec804c2070892f8b4f6a00a3eb
SSDEEP 24576:3q3/N0Fj+Ifz3zvnXj/zXzvAAkGz8mvgt379S+2bfR+RfmTk1krT1iH4SqfKPTso:/JkGYYZTk+T1iH7efP0m
TLSH
T1C795AD41E6C365F6D46F047888BE932AB6743C050315CAFB93D4AE3A6D33BC09A36795
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CustomAction.config

Path C:\Users\Admin\AppData\Local\Temp\MSI9D22.tmp-\CustomAction.config
Size 234B
SHA256 7027b69ab6ebc9f3f7d2f6c800793fde2a057b76010d8cfd831cf440371b2b23
MD5 6f52ebea639fd7cefca18d9e5272463e
SHA1 b5e8387c2eb20dd37df8f4a3b9b0e875fa5415e3
SHA512 b5960066430ed40383d39365eadb3688cadadfeca382404924024c908e32c670afabd37ab41ff9e6ac97491a5eb8b55367d7199002bf8569cf545434ab2f271a
TLSH
T18CD0A70405D0FD1B5E231A2337524559FF34B1E290A44408B06F3A130A220CD4757317
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsInstaller.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI9D22.tmp-\ScreenConnect.WindowsInstaller.dll
Size 381KB
SHA256 0dfb99e851541cef064abc98270922ca8f9380635b58f43219557e828634f3be
MD5 32bc6332f1c75908d862cdd7df4e981d
SHA1 d5dd75dee85d4b2c153fe9baacb9805dae086c3b
SHA512 544ec6f2fe70571451b6d902297f142660ca9eaa625b3c6cfe4cf00032983e0eed04d794e377083fbbf4be9b6bb2e8b5db46846eb97c64f7bfa5c6c91edc15f2
SSDEEP 6144:tfQ4wCma0g6eTl257z4ktkB+NaxHQGSX/qUOLwM/TFpglFB:BhnWxe+NAHQ3XcLhFpg
TLSH
T15B849E6CBB8E6F12EA2E0B77C4957220A7F1E0A21D5BC38F6D81366D5C007D967652C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientSetup.msi

Path C:\Users\Admin\AppData\Local\Temp\ScreenConnect\26.1.18.9566\7ade31a136fc3a09\ScreenConnect.ClientSetup.msi
Size 16.0MB
SHA256 5d5fefbb19712bd54250d3df99c28541d683d0ac7f007dc1f494c752cdd31985
MD5 153b1bcfac2556c7e8cae8720c4d325b
SHA1 af184dc94fbc4762a097c4fa5cb27d204c5c6a64
SHA512 00b052bddcde61a56d1fb2942cae97425d02b6028307545227d511b2c775e5e7a0a0479a6001a6e35caa7c8d2d9b6ff4744afef10cc0c5d4c125a1f1dfd800b6
SSDEEP 393216:DOvTi7hha62+3/11VOvTi7hha62LOvTi7hha62UOvTi7hha62:DOvj+391VOvjLOvjUOvj
TLSH
T1CBF633102BE8A5AAF2735B38EC7B26B00579BD51CE13D02F4319B81E5531D94AAB3773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIF65D.tmp

Path C:\Windows\Installer\MSIF65D.tmp
Size 202KB
SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
MD5 ba84dd4e0c1408828ccc1de09f585eda
SHA1 e8e10065d479f8f591b9885ea8487bc673301298
SHA512 7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290
SSDEEP 3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
TLSH
T129147C326494803EE7F91A36D93E9A61AE7DF6241760C99EC3848C0E5D604D06BF7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 93ca3a8a2467e69c27598a6181a63ec1056a0f76f6ec172c6783b7caf22e272f
MD5 f08151cc373e3d3c3bc402cbaa7b31a5
SHA1 6d6567fec470371b99f073424357b0f8d2a4f8c3
SHA512 7715112a93477ec65e8b324282769797f4d2396a681b239ad12046611bdc3d3e1db5479bca1b8268ad4ea2208ea4158befb2576d2f74187eba35431f7f5e1fbc
SSDEEP 24576:XFo3DMPKdoO/vvTL/Sg88iFQvrumHb7P0BKudxSUKpyKpb9cMoRWclmd4+2:EHY
TLSH
T19F57B42436F92200E7F79E3DA8F06A234D397D5BAC15DE8D45511B4E0822F71E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{06c56438-63c5-4498-b317-9fca763ba605}_OnDiskSnapshotProp

Path \??\Volume{c61f3bad-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{06c56438-63c5-4498-b317-9fca763ba605}_OnDiskSnapshotProp
Size 6KB
SHA256 8ed2a9deccad26ef26530b9769129b41fc90a46c22a27e770a01c1530266c790
MD5 618164333ce5007b3a6f47a172b10457
SHA1 8982db3a8ade21cb0f357f1cb38ee0ac5ab0ba60
SHA512 e1ded1bc2b9eb65b8f2be6c1b88213a2458c47fb138f856195645e7a597ed8c2669f9e9e2c69c75223006e979bfdbbe80656f9ac4b9777132bd1582485e163eb
SSDEEP 96:FeJ7LCvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:gReb++uVm
TLSH
T1B8D177081AF54311E2B3AB3229F14557A877B811FF33CB8E0198238E6621A14F975F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1004-12-0x00000000746A0000-0x0000000074E5C000-memory.dmp

Download

memory/1004-3-0x00000000061A0000-0x00000000062F0000-memory.dmp

Download

memory/1004-1-0x0000000002100000-0x0000000002108000-memory.dmp

Download

memory/1004-2-0x0000000003C10000-0x0000000003C1C000-memory.dmp

Download

memory/1004-4-0x00000000746A0000-0x0000000074E5C000-memory.dmp

Download

memory/1004-6-0x00000000062F0000-0x00000000064D0000-memory.dmp

Download

memory/1004-5-0x0000000006110000-0x0000000006176000-memory.dmp

Download

memory/1004-0-0x00000000746B2000-0x00000000746B3000-memory.dmp

Download

memory/1004-8-0x0000000006A90000-0x000000000704A000-memory.dmp

Download

memory/1004-7-0x00000000746A0000-0x0000000074E5C000-memory.dmp

Download

memory/1004-9-0x00000000746A0000-0x0000000074E5C000-memory.dmp

Download

memory/1004-14-0x00000000746A0000-0x0000000074E5C000-memory.dmp

Download

memory/1004-10-0x00000000065B0000-0x0000000006642000-memory.dmp

Download

memory/1004-11-0x00000000746B2000-0x00000000746B3000-memory.dmp

Download

memory/1684-37-0x00000000037B0000-0x00000000037DE000-memory.dmp

Download

memory/1684-41-0x00000000037F0000-0x00000000037FC000-memory.dmp

Download

memory/1684-45-0x0000000005AB0000-0x0000000005C00000-memory.dmp

Download

memory/1684-49-0x0000000005E90000-0x0000000006070000-memory.dmp

Download

memory/1892-79-0x0000000005E10000-0x0000000005E76000-memory.dmp

Download

memory/3632-173-0x000000001B560000-0x000000001B5B0000-memory.dmp

Download

memory/3632-172-0x0000000002240000-0x0000000002270000-memory.dmp

Download

memory/3632-171-0x0000000000A30000-0x0000000000A60000-memory.dmp

Download

memory/4640-167-0x000000001CFA0000-0x000000001D128000-memory.dmp

Download

memory/4640-164-0x000000001BE70000-0x000000001BFC0000-memory.dmp

Download

memory/4640-166-0x000000001C1A0000-0x000000001C380000-memory.dmp

Download

memory/4640-162-0x000000001B980000-0x000000001BA1E000-memory.dmp

Download

memory/4640-155-0x0000000000B20000-0x0000000000CAA000-memory.dmp

Download