Analysis
- max time kernel
149s - max time network
137s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
23/08/2026, 22:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-23_bd72f01c14ebde6945d803855665a95e_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
25 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-23_bd72f01c14ebde6945d803855665a95e_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
25 signatures
150 seconds
General
- Target 2026-08-23_bd72f01c14ebde6945d803855665a95e_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe
- Size 18.9MB
- Sample260823-2xv9tabd92
- SHA256 13bbd5297f6a38d595e6cc85f9772f444f140b3f4bfcc4b87cfb20075f587f78
- MD5 bd72f01c14ebde6945d803855665a95e
- SHA1 4175615ab3586f09e33187ce3abd4d27ab479856
- SHA512 5706a49e561b23cc278b3eba07f9a4e0f164aff6281a4add54e627d5bb484c609a6e664938b2c9c9b3887263cd26a9a5949e7d63f25b59f2e667ecc1dbf47b6d
- SSDEEP 393216:PCXvI5MvHxuJXCXvI5MvHxSCXvI5MvHxNCXvI5MvHx2CXvI5MvHxWCXvI5MvHx4M:PZ6HxsZ6HxSZ6HxNZ6Hx2Z6HxWZ6Hx4M
- TLSH T1DC172312B3E585B6E0BF1678E87D41658672FC140B26C2AF13A4796E2C327C09E72777
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects encrypted or obfuscated .NET executables 1 IoCs
resource yara_rule behavioral2/files/0x001100000001c5bd-215.dat INDICATOR_EXE_DotNET_Encrypted - Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 7 5868 rundll32.exe - Sets service image path in registry 3 TTPs 1 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (a0b8e396c9cd7941)\ImagePath = "\"C:\\Program Files (x86)\\ScreenConnect Client (a0b8e396c9cd7941)\\ScreenConnect.ClientService.exe\" \"?e=Access&y=Guest&h=instance-ggecdj-relay.screenconnect.com&p=443&s=aa0bfb23-13b3-42e2-971c-559c0a15c9cb&k=BgIAAACkAABSU0ExAAgAAAEAAQDlm90MS1xtpkJZChGbHNaryRrKx%2bS6MUIQl%2fDuhDhCVOL6ZLc8wwD1k%2byWkVDY888oDrrf5zSHqeaQQcxcAMnndU5AE5E6bK%2fR7N0AMpD6QE5CVGf97zOOxv6IL6g%2fGUeph7yAZXYPOWErEuK4C2FuOuAQ9m8Crl1joyXEUjEHZM3dPh8z79iKvZeBatANtJc%2bFoYUmmIkdQS%2fXk5m7FE48yzCtaUDhJUU0NKJoYxCvcQCvPXojVmb8kHPTNrPGaIqyzsiPK8PoKMtocRgFH3K550LE6z8CWc4dIUU8nY%2b9EksSC7Nc2qAE%2f6HMA5X797tI7C7tDU%2bmDkO2BmyPanX&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAA1PMx2EivrEepqWv6gSL7SQAAAAACAAAAAAAQZgAAAAEAACAAAACJ35gZexA9%2b4ngKXuqdiyFyLCoyCekQib381E0l6nB4QAAAAAOgAAAAAIAACAAAAAN1d3T%2buj%2bn34nJkKKqqmgMK2K6GjnMEiCfKgDzimmSaAEAACKEsxcjZuLAtBTmBFKeRAViltMptq%2fgzuPRgHZEd0YOufHmH%2f0dm2YpshtF8jmKstK9N2ULg6%2fAVkW0VRhet4nZCn75RuipWNrgm%2bdxJdl85K60HMV0m928Vxml3hIFEbvOAWhHGCe3Eb%2f24Ms%2fwI%2fD7dx7QwZsASL%2b2igNtGSCznWygpH44zHUKm1t2KAPUsUeUejAcHw0cyRDl3uy5UgpE4kw6VdjuS4O%2b6CBLLed8PFfrSwngegbF%2bkHfKkClBoU4i%2f5iNUXyC%2bTPh9foo852ayTmXYu09rPg0dG6l%2fdjGwpYIB%2bZH4vdn%2bx9cLwmxRgHYGRnmC8DVQUR8T4aHFeZWDM4a1tCJw4MUqCs2dgcNMNXsQkYzHz1RJ6%2buLSoi%2fzSRxidIJ3Dm%2bDyvUIhRFlxw%2bP6XsOc8rD1RwOAFn5zKWE6E4vAgkp%2bLUFCX5P3qhb6Ny0Zw%2b2KAL2k3xTsU9%2bekl3LHv11%2fKwUWTkelKAwzszmjVxYfZUdzv8m%2f9IBVP1d7%2bAFBgZGWT%2bZMSMCvxdQq7GDwbottHpQ1%2b%2beUgvz9XAjzDwX7KgaNeTLY8%2btaZwBziTx9U5xfCvLgOerBzEZU5pWLCwb8eo%2fnkGVvBWFL5GYC88JW8F469vji1PTI7dcQAZHEYBLC0rTrdpIMwUqSxA7RIDQyCtMS52O9IKHdIBujrKmJ%2f9YngjdI6Lb0EzfXr5jOg3MFZInMaj8Ndl7vvBai5k5k7gwTUC7yjvguehd00jypdFA%2fzeeTCxL%2bOLHf%2bQEqZvjoIfBLPHjGAMiCmbgPsi2Yuefw2N0QGTKLF%2bLIyj0Elt51H9efoJOPzcJKfe3dpgl6usrCOvsXmZRiVTD3goJxaJ6M4qw8drA0u15WHjMBoFG25Cxw5PZUK6ptoYAGBdA4wMUu79%2fmjctj1NjXQDy9aWrMUdhc3OkGmnNYU7XiNt8ug4SUBVp4sTF8XNZpF9GSwHyz%2b4BmBYtrovyYjwhzfkTEqKujnc3Z4MQTiiaf9xG%2fC%2faTmp67slQKzFDvTLvYQV4JzA4I604%2bPUdwoq2Ya1Zl4vGYWhrucTNcM8OZlEF4dfIXeLTpfH8bFeNg3AHKWj6HAP4zVhaEQX7fGxyN8Qx%2f7ZKsklQ3xv9vToBxfMdIvdO5XRrJ38Kkd0hel0OY7SKgovc7WZaiChDopYRUL0oqHbGmrQbCXSX9fRY83Mo%2bPquB6gZr4pknu43vhNlg9pWVQ9zw2C13g8Zn3HvL3DkYhuU54%2fiju8EHvepa%2fbMgrsFnsECZw32o0XjJySaYhJYHkngj6j0rsEcDyjqFl8frs5S6z4fje%2fOi6JmLI3xHS9NiZSgwL2YCRmX7MCBGKPBgIYcC6R5sEl0ltIERezpT4NCEft7O9JgbjTrWaAdnt2vNRYbQ4UNGIo92hOjYitMQnqAcxbQ%2bdLw30s9%2fCkossWH2BlZxH6ZArQ%2fI0LdIch1P%2bqreIeSrmL4ernySDiIMzNyWiyaB8BGQCfg2UXtrJbs6gDomm7O%2beu2htF0JtupockVRJDeULK97G7LzQvSGoBCgyYf7BQrrqM2tpi%2brXVicW20AAAACxhla0f0MSzLcuCb%2fTsG%2bP100tAtCegerF2p6humoSabOpbePP7UpwgYgJyihNKIX6mOkSn3R%2fFxNqRkeZMHC0\"" ScreenConnect.ClientService.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\G: msiexec.exe - Boot or Logon Autostart Execution: Authentication Package 1 TTPs 2 IoCs
Suspicious Windows Authentication Registry Modification.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\Authentication Packages = 6d007300760031005f003000000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800610030006200380065003300390036006300390063006400370039003400310029005c00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f0077007300410075007400680065006e007400690063006100740069006f006e005000610063006b006100670065002e0064006c006c0000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\Authentication Packages = 6d007300760031005f00300000000000 msiexec.exe - Drops file in System32 directory 12 IoCs
description ioc Process File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (a0b8e396c9cd7941)\q2cexs0k.tmp ScreenConnect.ClientService.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (a0b8e396c9cd7941)\nujkdwfm.newcfg ScreenConnect.ClientService.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (a0b8e396c9cd7941)\nujkdwfm.newcfg ScreenConnect.ClientService.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (a0b8e396c9cd7941)\xy13uyjg.tmp ScreenConnect.ClientService.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (a0b8e396c9cd7941)\vsqk44r4.newcfg ScreenConnect.ClientService.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (a0b8e396c9cd7941)\q2cexs0k.newcfg ScreenConnect.ClientService.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (a0b8e396c9cd7941)\nujkdwfm.tmp ScreenConnect.ClientService.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (a0b8e396c9cd7941)\user.config ScreenConnect.ClientService.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (a0b8e396c9cd7941)\xy13uyjg.newcfg ScreenConnect.ClientService.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (a0b8e396c9cd7941)\xy13uyjg.newcfg ScreenConnect.ClientService.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (a0b8e396c9cd7941)\vsqk44r4.tmp ScreenConnect.ClientService.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (a0b8e396c9cd7941)\vsqk44r4.newcfg ScreenConnect.ClientService.exe - Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Drops file in Program Files directory 38 IoCs
description ioc Process File created C:\Program Files (x86)\ScreenConnect Client (a0b8e396c9cd7941)\ScreenConnect.WindowsAuthenticationPackage.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (a0b8e396c9cd7941)\ScreenConnect.WindowsBackstageShell.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (a0b8e396c9cd7941)\ScreenConnect.WindowsClient.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (a0b8e396c9cd7941)\ScreenConnect.WindowsFileManager.exe msiexec.exe File opened for modification C:\Program Files (x86)\ScreenConnect Client (a0b8e396c9cd7941)\ScreenConnect.WindowsClient.exe msiexec.exe File opened for modification C:\Program Files (x86)\ScreenConnect Client (a0b8e396c9cd7941)\ScreenConnect.WindowsFileManager.exe.config msiexec.exe File opened for modification C:\Program Files (x86)\ScreenConnect Client (a0b8e396c9cd7941)\ScreenConnect.WindowsAuthenticationPackage.dll msiexec.exe File opened for modification C:\Program Files (x86)\ScreenConnect Client (a0b8e396c9cd7941)\app.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (a0b8e396c9cd7941)\ScreenConnect.ClientService.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (a0b8e396c9cd7941)\ScreenConnect.Windows.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (a0b8e396c9cd7941)\ScreenConnect.WindowsClient.exe.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (a0b8e396c9cd7941)\Client.resources msiexec.exe File opened for modification C:\Program Files (x86)\ScreenConnect Client (a0b8e396c9cd7941)\Client.Override.resources msiexec.exe File opened for modification C:\Program Files (x86)\ScreenConnect Client (a0b8e396c9cd7941)\Client.resources msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (a0b8e396c9cd7941)\ScreenConnect.ClientService.exe msiexec.exe File opened for modification C:\Program Files (x86)\ScreenConnect Client (a0b8e396c9cd7941)\ScreenConnect.WindowsFileManager.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (a0b8e396c9cd7941)\ScreenConnect.Core.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (a0b8e396c9cd7941)\Client.Override.en-US.resources msiexec.exe File opened for modification C:\Program Files (x86)\ScreenConnect Client (a0b8e396c9cd7941)\ScreenConnect.Core.dll msiexec.exe File opened for modification C:\Program Files (x86)\ScreenConnect Client (a0b8e396c9cd7941)\ScreenConnect.Windows.dll msiexec.exe File opened for modification C:\Program Files (x86)\ScreenConnect Client (a0b8e396c9cd7941)\ScreenConnect.WindowsClient.exe.config msiexec.exe File opened for modification C:\Program Files (x86)\ScreenConnect Client (a0b8e396c9cd7941)\ScreenConnect.WindowsBackstageShell.exe msiexec.exe File opened for modification C:\Program Files (x86)\ScreenConnect Client (a0b8e396c9cd7941)\ScreenConnect.Client.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (a0b8e396c9cd7941)\Client.en-US.resources msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (a0b8e396c9cd7941)\Client.Override.resources msiexec.exe File opened for modification C:\Program Files (x86)\ScreenConnect Client (a0b8e396c9cd7941)\ScreenConnect.ClientService.dll msiexec.exe File opened for modification C:\Program Files (x86)\ScreenConnect Client (a0b8e396c9cd7941)\ScreenConnect.ClientService.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (a0b8e396c9cd7941)\ScreenConnect.Client.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (a0b8e396c9cd7941)\ScreenConnect.WindowsBackstageShell.exe.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (a0b8e396c9cd7941)\ScreenConnect.WindowsCredentialProvider.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (a0b8e396c9cd7941)\system.config msiexec.exe File opened for modification C:\Program Files (x86)\ScreenConnect Client (a0b8e396c9cd7941)\system.config msiexec.exe File opened for modification C:\Program Files (x86)\ScreenConnect Client (a0b8e396c9cd7941)\ScreenConnect.WindowsBackstageShell.exe.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (a0b8e396c9cd7941)\app.config msiexec.exe File opened for modification C:\Program Files (x86)\ScreenConnect Client (a0b8e396c9cd7941)\Client.Override.en-US.resources msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (a0b8e396c9cd7941)\ScreenConnect.WindowsFileManager.exe.config msiexec.exe File opened for modification C:\Program Files (x86)\ScreenConnect Client (a0b8e396c9cd7941)\Client.en-US.resources msiexec.exe File opened for modification C:\Program Files (x86)\ScreenConnect Client (a0b8e396c9cd7941)\ScreenConnect.WindowsCredentialProvider.dll msiexec.exe - Drops file in Windows directory 58 IoCs
description ioc Process File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\e59bfee.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI3702.tmp-\ScreenConnect.Windows.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI3702.tmp-\Microsoft.Deployment.Compression.dll rundll32.exe File created C:\Windows\SystemTemp\~DFB8D55F7686B2A8AB.TMP msiexec.exe File created C:\Windows\Installer\{C2781965-0792-E4F4-2CCA-01D2FEAF943C}\DefaultIcon msiexec.exe File created C:\Windows\SystemTemp\~DFF4CBCAE4632BBE09.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF682C81B19600FB30.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF05F8FF5F361A4B61.TMP msiexec.exe File created C:\Windows\Installer\SourceHash{C89A6864-0271-672B-0630-AADC5FE48DD6} msiexec.exe File created C:\Windows\SystemTemp\~DF1879BD47B5D703C5.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI3702.tmp-\ScreenConnect.WindowsInstaller.dll rundll32.exe File opened for modification C:\Windows\Installer\e59bfeb.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIC6C2.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI3702.tmp-\CustomAction.config rundll32.exe File created C:\Windows\SystemTemp\~DFEC95157F1B8B2E11.TMP msiexec.exe File created C:\Windows\SystemTemp\~DFA3B3A9A01AC7D366.TMP msiexec.exe File created C:\Windows\Installer\{C89A6864-0271-672B-0630-AADC5FE48DD6}\DefaultIcon msiexec.exe File created C:\Windows\SystemTemp\~DF45E90B07CFDAF104.TMP msiexec.exe File created C:\Windows\SystemTemp\~DFD632393148F8ADEC.TMP msiexec.exe File created C:\Windows\SystemTemp\ScreenConnect\26.1.24.9579\ScreenConnect.ClientSetup.exe ScreenConnect.ClientService.exe File opened for modification C:\Windows\Installer\MSI3702.tmp-\ScreenConnect.Core.dll rundll32.exe File created C:\Windows\Installer\e59bfed.msi msiexec.exe File created C:\Windows\Installer\e59bfeb.msi msiexec.exe File created C:\Windows\SystemTemp\~DF7167BEC1841905F8.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI3702.tmp-\ScreenConnect.InstallerActions.dll rundll32.exe File created C:\Windows\SystemTemp\~DF4A97ACAA80D8B93E.TMP msiexec.exe File opened for modification C:\Windows\Installer\{C2781965-0792-E4F4-2CCA-01D2FEAF943C}\DefaultIcon msiexec.exe File created C:\Windows\SystemTemp\~DF4DC110695F8AEA71.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI3FBF.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI3702.tmp-\Microsoft.Deployment.Compression.Cab.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI3E47.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF51F474489BA30949.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF89DF755148994B83.TMP msiexec.exe File created C:\Windows\SystemTemp\ScreenConnect\26.3.11.9650\a0b8e396c9cd7941\ScreenConnect.ClientSetup.msi ScreenConnect.ClientSetup.exe File opened for modification C:\Windows\Installer\MSI3702.tmp msiexec.exe File created C:\Windows\Installer\wix{C89A6864-0271-672B-0630-AADC5FE48DD6}.SchedServiceConfig.rmi MsiExec.exe File opened for modification C:\Windows\Installer\{C89A6864-0271-672B-0630-AADC5FE48DD6}\DefaultIcon msiexec.exe File created C:\Windows\SystemTemp\~DF970C6511566BE4F0.TMP msiexec.exe File created C:\Windows\Installer\wix{C2781965-0792-E4F4-2CCA-01D2FEAF943C}.SchedServiceConfig.rmi MsiExec.exe File created C:\Windows\Installer\e59c008.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\e59bfee.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI3702.tmp-\Microsoft.Deployment.WindowsInstaller.dll rundll32.exe File created C:\Windows\SystemTemp\~DF438E7CBE3380C67B.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI4118.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF292791DCCA0ABF62.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF49F2D88F055FF97D.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSICD99.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{C2781965-0792-E4F4-2CCA-01D2FEAF943C} msiexec.exe File created C:\Windows\SystemTemp\~DFAAFE811F6DF3582E.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI400E.tmp msiexec.exe File created C:\Windows\SystemTemp\~DFBC729E606A529901.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIC634.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF404A762579487EDB.TMP msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI3702.tmp-\Microsoft.Deployment.WindowsInstaller.Package.dll rundll32.exe File created C:\Windows\SystemTemp\~DF7FEDB9D3BEB9D0D6.TMP msiexec.exe - Executes dropped EXE 7 IoCs
pid Process 1352 ScreenConnect.ClientService.exe 4872 ScreenConnect.WindowsClient.exe 3300 ScreenConnect.WindowsClient.exe 3196 ScreenConnect.ClientSetup.exe 1264 ScreenConnect.ClientService.exe 848 ScreenConnect.WindowsClient.exe 3556 ScreenConnect.WindowsClient.exe - Loads dropped DLL 64 IoCs
pid Process 4464 MsiExec.exe 6084 rundll32.exe 6084 rundll32.exe 6084 rundll32.exe 6084 rundll32.exe 6084 rundll32.exe 6084 rundll32.exe 6084 rundll32.exe 6084 rundll32.exe 6084 rundll32.exe 4464 MsiExec.exe 5868 rundll32.exe 5868 rundll32.exe 5868 rundll32.exe 5868 rundll32.exe 5868 rundll32.exe 5868 rundll32.exe 5868 rundll32.exe 5868 rundll32.exe 5868 rundll32.exe 4464 MsiExec.exe 1556 rundll32.exe 1556 rundll32.exe 1556 rundll32.exe 1556 rundll32.exe 1556 rundll32.exe 1556 rundll32.exe 1556 rundll32.exe 1556 rundll32.exe 1556 rundll32.exe 4460 MsiExec.exe 3100 MsiExec.exe 1352 ScreenConnect.ClientService.exe 1352 ScreenConnect.ClientService.exe 1352 ScreenConnect.ClientService.exe 1352 ScreenConnect.ClientService.exe 1352 ScreenConnect.ClientService.exe 1352 ScreenConnect.ClientService.exe 1352 ScreenConnect.ClientService.exe 1352 ScreenConnect.ClientService.exe 1352 ScreenConnect.ClientService.exe 1352 ScreenConnect.ClientService.exe 6092 MsiExec.exe 2660 rundll32.exe 2660 rundll32.exe 2660 rundll32.exe 2660 rundll32.exe 2660 rundll32.exe 2660 rundll32.exe 2660 rundll32.exe 2660 rundll32.exe 2660 rundll32.exe 6092 MsiExec.exe 6092 MsiExec.exe 1264 ScreenConnect.ClientService.exe 1264 ScreenConnect.ClientService.exe 1264 ScreenConnect.ClientService.exe 1264 ScreenConnect.ClientService.exe 1264 ScreenConnect.ClientService.exe 1264 ScreenConnect.ClientService.exe 1264 ScreenConnect.ClientService.exe 1264 ScreenConnect.ClientService.exe 1264 ScreenConnect.ClientService.exe 1264 ScreenConnect.ClientService.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 14 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ScreenConnect.ClientService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-23_bd72f01c14ebde6945d803855665a95e_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ScreenConnect.ClientService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ScreenConnect.ClientSetup.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ffbf1fc65d8bbf350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801ffbf1fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101ffbf1fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3ffbf1fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6ffbf1fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe - Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ScreenConnect.WindowsClient.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ScreenConnect.WindowsClient.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ScreenConnect.WindowsClient.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ScreenConnect.WindowsClient.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0001 msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" ScreenConnect.WindowsClient.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" ScreenConnect.ClientService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates msiexec.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0001\Owner = 8c1500003e450a0e5333dd01 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates msiexec.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0001\RegProcs0000 = 300030003000300031003300300038003a00300031006400640033003300350033003a003000300034006100390066003900350000000000 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ ScreenConnect.ClientService.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0002 msiexec.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 05e5e4f1af3ab33d200ccec2a1364e734220e4b86216bb2e87b5286cad0af376 msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Sequence = "1" msiexec.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0002\Owner = a012000074a3e8f05233dd01 msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" ScreenConnect.ClientService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" ScreenConnect.WindowsClient.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" ScreenConnect.WindowsClient.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" ScreenConnect.WindowsClient.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" ScreenConnect.WindowsClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0001\Sequence = "2" msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" ScreenConnect.ClientService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" ScreenConnect.ClientService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates msiexec.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0001\RegProcsHash = c0eb6ef2fe0c7c36e04bb7c29325f71ecdf6282df165c416483221439d33ccf6 msiexec.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0002\SessionHash = 10d1472a9adde6f5db28286836caa15e37fbb7eb078f147e7e7b7792426d5d64 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs msiexec.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 7d6a6cba24f52e4f1d163688d6c6f8c3ffaceae7f4ecd7140402ba9fde70dabd msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0002 msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" ScreenConnect.ClientService.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0001 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ ScreenConnect.WindowsClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ ScreenConnect.ClientService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" ScreenConnect.ClientSetup.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs msiexec.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Owner = a012000074a3e8f05233dd01 msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0001\Sequence = "1" msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing msiexec.exe - Modifies registry class 64 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5691872C29704F4EC2AC102DEFFA49C3\Assignment = "1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5691872C29704F4EC2AC102DEFFA49C3\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5691872C29704F4EC2AC102DEFFA49C3\SourceList\Media\1 = ";" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4686A98C1720B2766003AACDF54ED86D\Full msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\526382B00126E5B30A8B3E699CDC9714 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5691872C29704F4EC2AC102DEFFA49C3\ProductName = "ScreenConnect Client (a0b8e396c9cd7941)" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5691872C29704F4EC2AC102DEFFA49C3\Clients = 3a0000000000 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-a0b8e396c9cd7941\UseOriginalUrlEncoding = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4686A98C1720B2766003AACDF54ED86D\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\26.1.24.9579\\a0b8e396c9cd7941\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5691872C29704F4EC2AC102DEFFA49C3 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5691872C29704F4EC2AC102DEFFA49C3\ProductIcon = "C:\\Windows\\Installer\\{C2781965-0792-E4F4-2CCA-01D2FEAF943C}\\DefaultIcon" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-9225-BA036496E5DC}\InprocServer32\ThreadingModel = "Apartment" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-a0b8e396c9cd7941\shell msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\526382B00126E5B30A8B3E699CDC9714\4686A98C1720B2766003AACDF54ED86D msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4686A98C1720B2766003AACDF54ED86D\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\526382B00126E5B30A8B3E699CDC9714\5691872C29704F4EC2AC102DEFFA49C3 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5691872C29704F4EC2AC102DEFFA49C3\SourceList\PackageName = "ScreenConnect.ClientSetup.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5691872C29704F4EC2AC102DEFFA49C3\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-a0b8e396c9cd7941\shell\open msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4686A98C1720B2766003AACDF54ED86D\AdvertiseFlags = "388" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\sc-a0b8e396c9cd7941\shell\open msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5691872C29704F4EC2AC102DEFFA49C3\Full msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5691872C29704F4EC2AC102DEFFA49C3 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-9225-BA036496E5DC}\InprocServer32\ = "C:\\Program Files (x86)\\ScreenConnect Client (a0b8e396c9cd7941)\\ScreenConnect.WindowsCredentialProvider.dll" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\sc-a0b8e396c9cd7941 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-a0b8e396c9cd7941\URL Protocol msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\sc-a0b8e396c9cd7941\shell\open\command msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-9225-BA036496E5DC} msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4686A98C1720B2766003AACDF54ED86D\Assignment = "1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-a0b8e396c9cd7941 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4686A98C1720B2766003AACDF54ED86D\SourceList msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4686A98C1720B2766003AACDF54ED86D msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5691872C29704F4EC2AC102DEFFA49C3\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\526382B00126E5B30A8B3E699CDC9714 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4686A98C1720B2766003AACDF54ED86D\SourceList\Media\1 = ";" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5691872C29704F4EC2AC102DEFFA49C3\AdvertiseFlags = "388" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5691872C29704F4EC2AC102DEFFA49C3\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4686A98C1720B2766003AACDF54ED86D msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4686A98C1720B2766003AACDF54ED86D\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-a0b8e396c9cd7941\shell\open\command msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4686A98C1720B2766003AACDF54ED86D\SourceList msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4686A98C1720B2766003AACDF54ED86D\Version = "436273176" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4686A98C1720B2766003AACDF54ED86D\ProductName = "ScreenConnect Client (a0b8e396c9cd7941)" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4686A98C1720B2766003AACDF54ED86D\ProductIcon = "C:\\Windows\\Installer\\{C89A6864-0271-672B-0630-AADC5FE48DD6}\\DefaultIcon" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\sc-a0b8e396c9cd7941\shell\open\command msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\sc-a0b8e396c9cd7941 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4686A98C1720B2766003AACDF54ED86D\PackageCode = "4686A98C1720B2766003AACDF54ED86D" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4686A98C1720B2766003AACDF54ED86D\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4686A98C1720B2766003AACDF54ED86D\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4686A98C1720B2766003AACDF54ED86D\SourceList\Media msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-9225-BA036496E5DC}\InprocServer32 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5691872C29704F4EC2AC102DEFFA49C3\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5691872C29704F4EC2AC102DEFFA49C3\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5691872C29704F4EC2AC102DEFFA49C3\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5691872C29704F4EC2AC102DEFFA49C3\PackageCode = "5691872C29704F4EC2AC102DEFFA49C3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-a0b8e396c9cd7941\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (a0b8e396c9cd7941)\\ScreenConnect.WindowsClient.exe\" \"%1\"" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4686A98C1720B2766003AACDF54ED86D\InstanceType = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4686A98C1720B2766003AACDF54ED86D\SourceList\PackageName = "ScreenConnect.ClientSetup.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5691872C29704F4EC2AC102DEFFA49C3\SourceList\LastUsedSource = "n;1;C:\\Windows\\SystemTemp\\ScreenConnect\\26.3.11.9650\\a0b8e396c9cd7941\\" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-9225-BA036496E5DC}\InprocServer32 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4686A98C1720B2766003AACDF54ED86D msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4686A98C1720B2766003AACDF54ED86D\SourceList\Media msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4686A98C1720B2766003AACDF54ED86D\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5691872C29704F4EC2AC102DEFFA49C3\SourceList\Net\1 = "C:\\Windows\\SystemTemp\\ScreenConnect\\26.3.11.9650\\a0b8e396c9cd7941\\" msiexec.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4768 msiexec.exe 4768 msiexec.exe 1352 ScreenConnect.ClientService.exe 1352 ScreenConnect.ClientService.exe 1352 ScreenConnect.ClientService.exe 1352 ScreenConnect.ClientService.exe 1352 ScreenConnect.ClientService.exe 1352 ScreenConnect.ClientService.exe 4768 msiexec.exe 4768 msiexec.exe 4768 msiexec.exe 4768 msiexec.exe 4768 msiexec.exe 4768 msiexec.exe 4768 msiexec.exe 4768 msiexec.exe 4768 msiexec.exe 4768 msiexec.exe 5516 msiexec.exe 5516 msiexec.exe 5516 msiexec.exe 5516 msiexec.exe 5516 msiexec.exe 5516 msiexec.exe 5516 msiexec.exe 5516 msiexec.exe 5516 msiexec.exe 5516 msiexec.exe 4768 msiexec.exe 4768 msiexec.exe 4768 msiexec.exe 4768 msiexec.exe 4768 msiexec.exe 4768 msiexec.exe 4768 msiexec.exe 4768 msiexec.exe 4768 msiexec.exe 4768 msiexec.exe 5516 msiexec.exe 5516 msiexec.exe 5516 msiexec.exe 5516 msiexec.exe 5516 msiexec.exe 5516 msiexec.exe 5516 msiexec.exe 5516 msiexec.exe 5516 msiexec.exe 5516 msiexec.exe 4768 msiexec.exe 4768 msiexec.exe 4768 msiexec.exe 4768 msiexec.exe 4768 msiexec.exe 4768 msiexec.exe 4768 msiexec.exe 4768 msiexec.exe 4768 msiexec.exe 4768 msiexec.exe 4768 msiexec.exe 4768 msiexec.exe 4768 msiexec.exe 4768 msiexec.exe 4768 msiexec.exe 4768 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2208 2026-08-23_bd72f01c14ebde6945d803855665a95e_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe Token: SeShutdownPrivilege 6040 msiexec.exe Token: SeIncreaseQuotaPrivilege 6040 msiexec.exe Token: SeSecurityPrivilege 4768 msiexec.exe Token: SeCreateTokenPrivilege 6040 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 6040 msiexec.exe Token: SeLockMemoryPrivilege 6040 msiexec.exe Token: SeIncreaseQuotaPrivilege 6040 msiexec.exe Token: SeMachineAccountPrivilege 6040 msiexec.exe Token: SeTcbPrivilege 6040 msiexec.exe Token: SeSecurityPrivilege 6040 msiexec.exe Token: SeTakeOwnershipPrivilege 6040 msiexec.exe Token: SeLoadDriverPrivilege 6040 msiexec.exe Token: SeSystemProfilePrivilege 6040 msiexec.exe Token: SeSystemtimePrivilege 6040 msiexec.exe Token: SeProfSingleProcessPrivilege 6040 msiexec.exe Token: SeIncBasePriorityPrivilege 6040 msiexec.exe Token: SeCreatePagefilePrivilege 6040 msiexec.exe Token: SeCreatePermanentPrivilege 6040 msiexec.exe Token: SeBackupPrivilege 6040 msiexec.exe Token: SeRestorePrivilege 6040 msiexec.exe Token: SeShutdownPrivilege 6040 msiexec.exe Token: SeDebugPrivilege 6040 msiexec.exe Token: SeAuditPrivilege 6040 msiexec.exe Token: SeSystemEnvironmentPrivilege 6040 msiexec.exe Token: SeChangeNotifyPrivilege 6040 msiexec.exe Token: SeRemoteShutdownPrivilege 6040 msiexec.exe Token: SeUndockPrivilege 6040 msiexec.exe Token: SeSyncAgentPrivilege 6040 msiexec.exe Token: SeEnableDelegationPrivilege 6040 msiexec.exe Token: SeManageVolumePrivilege 6040 msiexec.exe Token: SeImpersonatePrivilege 6040 msiexec.exe Token: SeCreateGlobalPrivilege 6040 msiexec.exe Token: SeCreateTokenPrivilege 6040 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 6040 msiexec.exe Token: SeLockMemoryPrivilege 6040 msiexec.exe Token: SeIncreaseQuotaPrivilege 6040 msiexec.exe Token: SeMachineAccountPrivilege 6040 msiexec.exe Token: SeTcbPrivilege 6040 msiexec.exe Token: SeSecurityPrivilege 6040 msiexec.exe Token: SeTakeOwnershipPrivilege 6040 msiexec.exe Token: SeLoadDriverPrivilege 6040 msiexec.exe Token: SeSystemProfilePrivilege 6040 msiexec.exe Token: SeSystemtimePrivilege 6040 msiexec.exe Token: SeProfSingleProcessPrivilege 6040 msiexec.exe Token: SeIncBasePriorityPrivilege 6040 msiexec.exe Token: SeCreatePagefilePrivilege 6040 msiexec.exe Token: SeCreatePermanentPrivilege 6040 msiexec.exe Token: SeBackupPrivilege 6040 msiexec.exe Token: SeRestorePrivilege 6040 msiexec.exe Token: SeShutdownPrivilege 6040 msiexec.exe Token: SeDebugPrivilege 6040 msiexec.exe Token: SeAuditPrivilege 6040 msiexec.exe Token: SeSystemEnvironmentPrivilege 6040 msiexec.exe Token: SeChangeNotifyPrivilege 6040 msiexec.exe Token: SeRemoteShutdownPrivilege 6040 msiexec.exe Token: SeUndockPrivilege 6040 msiexec.exe Token: SeSyncAgentPrivilege 6040 msiexec.exe Token: SeEnableDelegationPrivilege 6040 msiexec.exe Token: SeManageVolumePrivilege 6040 msiexec.exe Token: SeImpersonatePrivilege 6040 msiexec.exe Token: SeCreateGlobalPrivilege 6040 msiexec.exe Token: SeCreateTokenPrivilege 6040 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 6040 msiexec.exe - Suspicious use of FindShellTrayWindow 12 IoCs
pid Process 6040 msiexec.exe 6040 msiexec.exe 4872 ScreenConnect.WindowsClient.exe 4872 ScreenConnect.WindowsClient.exe 4872 ScreenConnect.WindowsClient.exe 4872 ScreenConnect.WindowsClient.exe 4872 ScreenConnect.WindowsClient.exe 4872 ScreenConnect.WindowsClient.exe 848 ScreenConnect.WindowsClient.exe 848 ScreenConnect.WindowsClient.exe 848 ScreenConnect.WindowsClient.exe 848 ScreenConnect.WindowsClient.exe - Suspicious use of SendNotifyMessage 10 IoCs
pid Process 4872 ScreenConnect.WindowsClient.exe 4872 ScreenConnect.WindowsClient.exe 4872 ScreenConnect.WindowsClient.exe 4872 ScreenConnect.WindowsClient.exe 4872 ScreenConnect.WindowsClient.exe 4872 ScreenConnect.WindowsClient.exe 848 ScreenConnect.WindowsClient.exe 848 ScreenConnect.WindowsClient.exe 848 ScreenConnect.WindowsClient.exe 848 ScreenConnect.WindowsClient.exe - Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 6040 msiexec.exe 4768 msiexec.exe 4464 MsiExec.exe 4460 MsiExec.exe 3100 MsiExec.exe 5516 msiexec.exe 6092 MsiExec.exe - Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2208 wrote to memory of 6040 2208 2026-08-23_bd72f01c14ebde6945d803855665a95e_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe 89 PID 4768 wrote to memory of 4464 4768 msiexec.exe 91 PID 4464 wrote to memory of 6084 4464 MsiExec.exe 92 PID 4464 wrote to memory of 5868 4464 MsiExec.exe 93 PID 4464 wrote to memory of 1556 4464 MsiExec.exe 94 PID 4768 wrote to memory of 2396 4768 msiexec.exe 100 PID 4768 wrote to memory of 4460 4768 msiexec.exe 102 PID 4768 wrote to memory of 3100 4768 msiexec.exe 103 PID 1352 wrote to memory of 4872 1352 ScreenConnect.ClientService.exe 105 PID 1352 wrote to memory of 3300 1352 ScreenConnect.ClientService.exe 106 PID 1352 wrote to memory of 3196 1352 ScreenConnect.ClientService.exe 108 PID 3196 wrote to memory of 5516 3196 ScreenConnect.ClientSetup.exe 109 PID 4768 wrote to memory of 6092 4768 msiexec.exe 110 PID 6092 wrote to memory of 2660 6092 MsiExec.exe 111 PID 1264 wrote to memory of 848 1264 ScreenConnect.ClientService.exe 113 PID 1264 wrote to memory of 3556 1264 ScreenConnect.ClientService.exe 114 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-23_bd72f01c14ebde6945d803855665a95e_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-23_bd72f01c14ebde6945d803855665a95e_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\26.1.24.9579\a0b8e396c9cd7941\ScreenConnect.ClientSetup.msi" SC_EXE_PATH="C:\Users\Admin\AppData\Local\Temp\2026-08-23_bd72f01c14ebde6945d803855665a95e_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe"2⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:6040
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Boot or Logon Autostart Execution: Authentication Package
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 731FFE88E6A0911F6BF6C80CE65F4373 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI76BD.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240744218 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:6084
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI7AE4.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240745265 10 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.CheckMsiMotw3⤵
- Badlisted process makes network request
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5868
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI80C1.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240746859 17 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.CheckMsiFileName3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1556
-
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:2396
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 860144AF5369A4281AD9215768B668022⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4460
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 486E062058198140A4CA90C7F17F1BAE E Global\MSI00002⤵
- Drops file in Windows directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3100
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding A0D473D9FA7507F295C4F8FE65ACC1BA E Global\MSI00002⤵
- Drops file in Windows directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6092 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSI3702.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240793437 12 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
- Drops file in Windows directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2660
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:5448
-
C:\Program Files (x86)\ScreenConnect Client (a0b8e396c9cd7941)\ScreenConnect.ClientService.exe"C:\Program Files (x86)\ScreenConnect Client (a0b8e396c9cd7941)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=instance-ggecdj-relay.screenconnect.com&p=443&s=aa0bfb23-13b3-42e2-971c-559c0a15c9cb&k=BgIAAACkAABSU0ExAAgAAAEAAQDlm90MS1xtpkJZChGbHNaryRrKx%2bS6MUIQl%2fDuhDhCVOL6ZLc8wwD1k%2byWkVDY888oDrrf5zSHqeaQQcxcAMnndU5AE5E6bK%2fR7N0AMpD6QE5CVGf97zOOxv6IL6g%2fGUeph7yAZXYPOWErEuK4C2FuOuAQ9m8Crl1joyXEUjEHZM3dPh8z79iKvZeBatANtJc%2bFoYUmmIkdQS%2fXk5m7FE48yzCtaUDhJUU0NKJoYxCvcQCvPXojVmb8kHPTNrPGaIqyzsiPK8PoKMtocRgFH3K550LE6z8CWc4dIUU8nY%2b9EksSC7Nc2qAE%2f6HMA5X797tI7C7tDU%2bmDkO2BmyPanX"1⤵
- Sets service image path in registry
- Drops file in System32 directory
- Drops file in Windows directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Program Files (x86)\ScreenConnect Client (a0b8e396c9cd7941)\ScreenConnect.WindowsClient.exe"C:\Program Files (x86)\ScreenConnect Client (a0b8e396c9cd7941)\ScreenConnect.WindowsClient.exe" "RunRole" "2ea3026d-cf32-4f81-8c85-47c929363378" "User"2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4872
-
-
C:\Program Files (x86)\ScreenConnect Client (a0b8e396c9cd7941)\ScreenConnect.WindowsClient.exe"C:\Program Files (x86)\ScreenConnect Client (a0b8e396c9cd7941)\ScreenConnect.WindowsClient.exe" "RunRole" "56513433-8e22-4b44-b48d-cf6014db99b3" "System"2⤵
- Executes dropped EXE
- Checks processor information in registry
- Modifies data under HKEY_USERS
PID:3300
-
-
C:\Windows\SystemTemp\ScreenConnect\26.1.24.9579\ScreenConnect.ClientSetup.exe"C:\Windows\SystemTemp\ScreenConnect\26.1.24.9579\ScreenConnect.ClientSetup.exe"2⤵
- Drops file in Windows directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Windows\SystemTemp\ScreenConnect\26.3.11.9650\a0b8e396c9cd7941\ScreenConnect.ClientSetup.msi" SC_EXE_PATH="C:\Windows\SystemTemp\ScreenConnect\26.1.24.9579\ScreenConnect.ClientSetup.exe"3⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5516
-
-
-
C:\Program Files (x86)\ScreenConnect Client (a0b8e396c9cd7941)\ScreenConnect.ClientService.exe"C:\Program Files (x86)\ScreenConnect Client (a0b8e396c9cd7941)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=instance-ggecdj-relay.screenconnect.com&p=443&s=aa0bfb23-13b3-42e2-971c-559c0a15c9cb&k=BgIAAACkAABSU0ExAAgAAAEAAQDlm90MS1xtpkJZChGbHNaryRrKx%2bS6MUIQl%2fDuhDhCVOL6ZLc8wwD1k%2byWkVDY888oDrrf5zSHqeaQQcxcAMnndU5AE5E6bK%2fR7N0AMpD6QE5CVGf97zOOxv6IL6g%2fGUeph7yAZXYPOWErEuK4C2FuOuAQ9m8Crl1joyXEUjEHZM3dPh8z79iKvZeBatANtJc%2bFoYUmmIkdQS%2fXk5m7FE48yzCtaUDhJUU0NKJoYxCvcQCvPXojVmb8kHPTNrPGaIqyzsiPK8PoKMtocRgFH3K550LE6z8CWc4dIUU8nY%2b9EksSC7Nc2qAE%2f6HMA5X797tI7C7tDU%2bmDkO2BmyPanX&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAA1PMx2EivrEepqWv6gSL7SQAAAAACAAAAAAAQZgAAAAEAACAAAACJ35gZexA9%2b4ngKXuqdiyFyLCoyCekQib381E0l6nB4QAAAAAOgAAAAAIAACAAAAAN1d3T%2buj%2bn34nJkKKqqmgMK2K6GjnMEiCfKgDzimmSaAEAACKEsxcjZuLAtBTmBFKeRAViltMptq%2fgzuPRgHZEd0YOufHmH%2f0dm2YpshtF8jmKstK9N2ULg6%2fAVkW0VRhet4nZCn75RuipWNrgm%2bdxJdl85K60HMV0m928Vxml3hIFEbvOAWhHGCe3Eb%2f24Ms%2fwI%2fD7dx7QwZsASL%2b2igNtGSCznWygpH44zHUKm1t2KAPUsUeUejAcHw0cyRDl3uy5UgpE4kw6VdjuS4O%2b6CBLLed8PFfrSwngegbF%2bkHfKkClBoU4i%2f5iNUXyC%2bTPh9foo852ayTmXYu09rPg0dG6l%2fdjGwpYIB%2bZH4vdn%2bx9cLwmxRgHYGRnmC8DVQUR8T4aHFeZWDM4a1tCJw4MUqCs2dgcNMNXsQkYzHz1RJ6%2buLSoi%2fzSRxidIJ3Dm%2bDyvUIhRFlxw%2bP6XsOc8rD1RwOAFn5zKWE6E4vAgkp%2bLUFCX5P3qhb6Ny0Zw%2b2KAL2k3xTsU9%2bekl3LHv11%2fKwUWTkelKAwzszmjVxYfZUdzv8m%2f9IBVP1d7%2bAFBgZGWT%2bZMSMCvxdQq7GDwbottHpQ1%2b%2beUgvz9XAjzDwX7KgaNeTLY8%2btaZwBziTx9U5xfCvLgOerBzEZU5pWLCwb8eo%2fnkGVvBWFL5GYC88JW8F469vji1PTI7dcQAZHEYBLC0rTrdpIMwUqSxA7RIDQyCtMS52O9IKHdIBujrKmJ%2f9YngjdI6Lb0EzfXr5jOg3MFZInMaj8Ndl7vvBai5k5k7gwTUC7yjvguehd00jypdFA%2fzeeTCxL%2bOLHf%2bQEqZvjoIfBLPHjGAMiCmbgPsi2Yuefw2N0QGTKLF%2bLIyj0Elt51H9efoJOPzcJKfe3dpgl6usrCOvsXmZRiVTD3goJxaJ6M4qw8drA0u15WHjMBoFG25Cxw5PZUK6ptoYAGBdA4wMUu79%2fmjctj1NjXQDy9aWrMUdhc3OkGmnNYU7XiNt8ug4SUBVp4sTF8XNZpF9GSwHyz%2b4BmBYtrovyYjwhzfkTEqKujnc3Z4MQTiiaf9xG%2fC%2faTmp67slQKzFDvTLvYQV4JzA4I604%2bPUdwoq2Ya1Zl4vGYWhrucTNcM8OZlEF4dfIXeLTpfH8bFeNg3AHKWj6HAP4zVhaEQX7fGxyN8Qx%2f7ZKsklQ3xv9vToBxfMdIvdO5XRrJ38Kkd0hel0OY7SKgovc7WZaiChDopYRUL0oqHbGmrQbCXSX9fRY83Mo%2bPquB6gZr4pknu43vhNlg9pWVQ9zw2C13g8Zn3HvL3DkYhuU54%2fiju8EHvepa%2fbMgrsFnsECZw32o0XjJySaYhJYHkngj6j0rsEcDyjqFl8frs5S6z4fje%2fOi6JmLI3xHS9NiZSgwL2YCRmX7MCBGKPBgIYcC6R5sEl0ltIERezpT4NCEft7O9JgbjTrWaAdnt2vNRYbQ4UNGIo92hOjYitMQnqAcxbQ%2bdLw30s9%2fCkossWH2BlZxH6ZArQ%2fI0LdIch1P%2bqreIeSrmL4ernySDiIMzNyWiyaB8BGQCfg2UXtrJbs6gDomm7O%2beu2htF0JtupockVRJDeULK97G7LzQvSGoBCgyYf7BQrrqM2tpi%2brXVicW20AAAACxhla0f0MSzLcuCb%2fTsG%2bP100tAtCegerF2p6humoSabOpbePP7UpwgYgJyihNKIX6mOkSn3R%2fFxNqRkeZMHC0"1⤵
- Drops file in System32 directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Program Files (x86)\ScreenConnect Client (a0b8e396c9cd7941)\ScreenConnect.WindowsClient.exe"C:\Program Files (x86)\ScreenConnect Client (a0b8e396c9cd7941)\ScreenConnect.WindowsClient.exe" "RunRole" "ebc04990-39e6-4356-a5e5-9d0a74aeb891" "User"2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:848
-
-
C:\Program Files (x86)\ScreenConnect Client (a0b8e396c9cd7941)\ScreenConnect.WindowsClient.exe"C:\Program Files (x86)\ScreenConnect Client (a0b8e396c9cd7941)\ScreenConnect.WindowsClient.exe" "RunRole" "db41c1e4-0439-4776-bf92-a9db3af1ed22" "System"2⤵
- Executes dropped EXE
- Checks processor information in registry
- Modifies data under HKEY_USERS
PID:3556
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Authentication Package
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
2Authentication Package
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Component Object Model Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e59bfec.rbs
- Size 214KB
- SHA256 ee2bb191122e5fd3787321ccf02e0948d2e4773a3c39b4cc89f2ddcc0be7df0d
- MD5 82482cefee51200a03e472ecf922f3b3
- SHA1 f6d23b4679d8ccbf51fb2f7215325c06f1b49336
- SHA512 f11e8f313fc5fc909b87e56bf0a5bba453bb406b0e3fe30476ffadf949308dca7e77806362eedd3251f23716fe69fe61b89291fdcb922a6559ebd91ccf8d7394
- SSDEEP 3072:oH9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMGn:oHuH2aCGw1ST1wQLdqvn
- TLSH T12D249D217484807EE7FA1A32D93F9A217E7DF6281760C59EC3848C1E5D604D06BF6BA7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e59bff3.rbs
- Size 19KB
- SHA256 3810f3d47a8dac8791e21a05333f501f19642d4f1e16ea4494efb51211c99b21
- MD5 da4ca18837018282c36f04a375aea808
- SHA1 1853d8fe32bf8d3745c6c2f1a3b44d56b84f7911
- SHA512 dc0001e6ee4a7e5689452fd67300541d44c410a89fda9536592b396fe3bc12e7aab95bb5f8bfa234e42dcb72df2e30053a57f9c4904394ae3eb14cdafdab080d
- SSDEEP 192:CwRnLHRzLdQJQ+9pygSrWQl3bjOcrGCvvyhPt/rYI2H/QW6Yj:CwRn7Rzying2pnO6vvttj
- TLSH T17D9242132644E1E2E6676F35DA930F143F338EA85256429B40ACA17C8E727C5BBBD1C9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e59c007.rbs
- Size 214KB
- SHA256 87ebbc2bbcec035402a6f792180b23aeba66ba1cf09a17477d636d096fa36de5
- MD5 ef7b53174cc59f6a3dc5e83b28d69e5e
- SHA1 5bc1bf95eed9d443a12baf286dbcc626148d49ff
- SHA512 34f0da4e03c0b4de6663204bb7f1669261dc85fdfd4b98f8dc56f307e9ae7037a3e0edbca958279f915d49ba7dee7faac9426d801c701511467d6ff24537e90d
- SSDEEP 3072:QH9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMGL:QHuH2aCGw1ST1wQLdqvL
- TLSH T101248C327494807EE7FA1A32D93E9A617E7DF6280760C59E83848C1E5D604C06BF6B67
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (a0b8e396c9cd7941)\Client.Override.en-US.resources
- Size 512B
- SHA256 a76ebce0111a0fd0dfd6556c477827421ad3f950c47171806c6d4a17deabceed
- MD5 010bd1696d8670371d73d18c4cc3a9e1
- SHA1 62b76f46566c2491efa313a563402fd48a2943a7
- SHA512 8597a6fa286401e86f93f2be923376bab8e97de112e8a75a3b164b5b558582d1c4eb372d64e8248a4f2f699802c2753a7cc99b1159187c4640ecd5acc5e5c94a
- TLSH T114F07D27639C1036D5F2173B35A730C1193FF91D8220946C6850102C5AB260A4F81B23
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (a0b8e396c9cd7941)\Client.Override.resources
- Size 160KB
- SHA256 c8181272b7a99731198dc08472ae776b847cded070674d9bec3e1bf59b0fd7a0
- MD5 f3b7dff8831845b36d3281c57b73356e
- SHA1 065248c313b190834c2ab66027240a2bf3db5fa0
- SHA512 a57022bbbc67638c62afa2c6891f9bdda9126cfd6221743d7a68facfa8f0ff79b575a8d38dccbc78c69d4bc29164ea9292cd3247f0ce28463d3e79b8099cc9d7
- SSDEEP 1536:5BvV2C41skqBvV2C41skqBvV2C41skqBvV2C41skqBvV2C41sk:7dLdLdLdLd
- TLSH T1D3F3BFE3C726AEEEF705D233392B1E5DD7CBEAA8324F765360E07419B374140664A528
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (a0b8e396c9cd7941)\Client.en-US.resources
- Size 64KB
- SHA256 efdb0b4fcc38b52cbf72336bd107a814db8454003f3495de21e2026a148823ea
- MD5 92232708774febf9a4a464bbeda36215
- SHA1 521d4e630f5e00977bbca7cd17dd0d22dbe1ca9e
- SHA512 59442cbc57604f0dd170bb4f86f0e2b6c96408daf67250e6f40e00d034033b6871502cd83df0267f4628c3a035f191d56f26bf1927e691b5330524eb810852f2
- SSDEEP 1536:5fkiK2FoQ67wwLFSj7Be3sZvU/7UFN+9nwLLChTKN1ljpneMarA:5fkiK2FoQ6jFSj7Be3sZvU/7UFN+9nwS
- TLSH T1A8532E1277FD0A58F5F36F35BE7A94619937BC5A2E25C06E1028815E09B2F80C9B2773
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (a0b8e396c9cd7941)\Client.resources
- Size 6KB
- SHA256 bd34378ad99f7609fa0c7c8edde6337c738a61d288863015629329806a1cc728
- MD5 1e863134f29bcabe1ee571c91ac4fbe6
- SHA1 57cc5966fcae49019da5f8f507c840cedfc103f4
- SHA512 7e2640c4ddb8719230de0ddb0d18f9a4b1499a037247f12b142b1c16a2a989390abcb5ac7816a63dbce2d43c08510cec7cfc87cd24458bc2fa919c396b36d4f9
- SSDEEP 192:rpDZHfbkqYvZJG293IIs1Z4EO/nM3ZWYijpo2YG:rRZjkqYxJ3JI/sMJ/ijp/p
- TLSH T1D8D13BC49BFEAC3CF05E51BE3A7692990275FF113AA3C3582460106A7F228856C56737
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (a0b8e396c9cd7941)\ScreenConnect.Client.dll
- Size 411KB
- SHA256 28ff8468ad2db8b41fe9d9a2971dd56fea0aecad14808fe4b31c9b1072d3b129
- MD5 62d114c95b604d7ca684759c22c4c688
- SHA1 d0563d46f2dc95dc8c18535efe7b18292128c0e6
- SHA512 c02280814930d898527708f98061bed64f35b8ec76135b22984c2b5cbcc3d881f1088a3c77d960a52862a423855f99f59d7b13cd05a48539a5d2f0252f8ccaed
- SSDEEP 6144:e2E4tiGCnwldvN7ADSD8ETEavHy+vd7JPYIYyqQni65/PGq:IaiGIwNAeDHTEavSW7OQni3q
- TLSH T12294CF8563E8882EEE9F3A73F16162248D72BC55B492E2E94D0C75F51BB338287447D3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (a0b8e396c9cd7941)\ScreenConnect.ClientService.dll
- Size 90KB
- SHA256 9cf2c77df0a1a1e854ec1bbc6940d96f508bfb4b0555a07657c77314803a717e
- MD5 cee388546abc6dfb7a766a33a8066ff5
- SHA1 a41ffb64a859ff3bd32589ce58ac03a84c0b1955
- SHA512 8c1d39bf142048a93c5388ebacc1a409c773ce7ec9f684127a97779a53c4914ef650f8d8474e4d999b12b848ca1ff4d3a697a0888dd1213d6414c703fc3c37f8
- SSDEEP 1536:QtZxUAtbcOyfDNq9IxcBoSDW3ieKw/PM3ZRVQbV3l5EpSj/zJX+VugmCD74mGyN:Qa4CDIICCieKnVQbVDEkj/zJX+VugPD7
- TLSH T1BB935C0293AD993BC9DF4E34B461F1610AB1BA13D4E7E7D99D9864E62F063C11F043AE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (a0b8e396c9cd7941)\ScreenConnect.ClientService.exe
- Size 93KB
- SHA256 01341bd42426c3d110136cc94433df00dbad690a56593f7cca41a93f698f214a
- MD5 751e8bcc20a49aeab090d99a6417919f
- SHA1 c2a313826c8fd840e4583435f821229c25ac34bf
- SHA512 91b278afa4ef8d917552a9da6f5df3e5c93319a7e69baedca3cfb1f68463f17f16e1649e027bc574136753cea2d77f7cf5dede7c1a3e02ebc1f9131e1245f9b0
- SSDEEP 1536:vg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgUT0HMm7mT:YhbNDxZGXfdHrX7rAc6myJkgUT0H7iT
- TLSH T117935A13B5C28872D473093158E0DAB09A3FF9615E61DEAB3798022E4F742C1AE75E77
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (a0b8e396c9cd7941)\ScreenConnect.Core.dll
- Size 572KB
- SHA256 92e831159d5e9f2676241ab7ce80060a0b1dc34684f83797aec93b3ecff41139
- MD5 f5be8d175195df18890643f146ec4383
- SHA1 ef2945ea142cbad107f4731de0ec33b428f1024f
- SHA512 998b29e4e66ccc0cf411d8daf661eb25da4f257b16e7a79047316f81b12c49693cabb6a1012db14d398bbe78db48af85a7da01c1fc12a6d067852a144f0dbd6c
- SSDEEP 6144:HuPdHSnGdti7Bn2Bomiu7qTOGXwU6eISZl2JILinW5dQifdlb1QS/qhwDTax4kxP:Yd+McMYu7w1jXyadQmbb1QHMy1
- TLSH T151C47D12B39497F7C5AE037EE07053184272FA4564B6E38B65A8D4FA3C923C95D806FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (a0b8e396c9cd7941)\ScreenConnect.Windows.dll
- Size 1.7MB
- SHA256 2292aac48ad575c6d1ed99c862e3408e254db34b8fea50cf3594aa08f3e875d0
- MD5 63d6f975924dee293c5346992cf1b10d
- SHA1 33e47573b3b9e384128ca4f66d6ae73f83f3dd89
- SHA512 68a464b8c2a7017b7bd24521f995b1962969ebb9f0b088c2673b715df73b30e1461bbf1b111178067f2ff28105953e49ce27612956ec54cc32edf3a191cf6b0b
- SSDEEP 24576:S1/VFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUTz:o/VJkGYYpT0+TFiH7efPS
- TLSH T1FC85BD41E2C365F5D46B047888BF972AB6743C080365CAFB93D4AE366D33BC09A36756
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (a0b8e396c9cd7941)\ScreenConnect.WindowsAuthenticationPackage.dll
- Size 254KB
- SHA256 a5b8f0070201e4f26260af6a25941ea38bd7042aefd48cd68b9acf951fa99ee5
- MD5 5adcb5ae1a1690be69fd22bdf3c2db60
- SHA1 09a802b06a4387b0f13bf2cda84f53ca5bdc3785
- SHA512 812be742f26d0c42fdde20ab4a02f1b47389f8d1acaa6a5bb3409ba27c64be444ac06d4129981b48fa02d4c06b526cb5006219541b0786f8f37cf2a183a18a73
- SSDEEP 3072:qJvChyA4m2zNGvxDd6Q6dtaVNVrlaHpFahvJ9ERnWtMG8Ff2lt9Bgcld5aaYxg:0IvxDdL6d8VNdlC3g0RCXh5D
- TLSH T1C5448E15B7A40CB4EC77823888535A06E776BC160760E6CF03E0825ADF6F7D1A63E762
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (a0b8e396c9cd7941)\ScreenConnect.WindowsBackstageShell.exe
- Size 71KB
- SHA256 0e6502db9fcae756f42f1e32cbb70b87b54286cc9ea1b7a83f51f57b10975aad
- MD5 222611c5a579a6e22a3333dcd3587aba
- SHA1 a1cc8b62acbb217146525a20f26e9ef4241e8563
- SHA512 c498d3d23f9d0278b6b9b98e497fbe7d70ef02173b079ba03ec8ed3aa235102eefb59ee482288132ee2d9844935d1ac5ccbc0ba93a48825d89d2b515fa02551c
- SSDEEP 768:UzlYsf/wCdOBti+3kDeuRsUQHkyik5lvmDSmBsuMQX5E+TCMXESslUqt6LYiDLkN:URYKtdU39PVlvmDqfQX5E+TC7Sa6L7wF
- TLSH T135637E5023DC9535E9FF2E34B4E1F6600AB3BA638CE1D7D52DA821DA2E127C14F64396
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (a0b8e396c9cd7941)\ScreenConnect.WindowsBackstageShell.exe.config
- Size 266B
- SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
- MD5 728175e20ffbceb46760bb5e1112f38b
- SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
- SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
- TLSH T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (a0b8e396c9cd7941)\ScreenConnect.WindowsCredentialProvider.dll
- Size 838KB
- SHA256 3fa1fe4a588015cc94eceb06867f16a5e562293139fbf6b36bde21dba478968d
- MD5 d67718dfb12e8fa47be42c3d4b54d19f
- SHA1 e49eb358c1f6fe71b9b0babc391b8c137ba6e760
- SHA512 813c8661756d91645d80a4c9412280054a5b8e2d611fe6333d68f97db78c7fe815505ebecce511c7b8ca63b7c81432f0acfc6455f801d7bc844194e0c26c46ca
- SSDEEP 12288:8hUSQJg/+QShEMuu/gUD+FkoiS+upfHH4:8wNQrMuu/gUD+Son+2fn4
- TLSH T1D7054C1BE7A440B9C0ADC6B5C35B9736BBB6F4864514B29F07D40A227F6BF40AB1D384
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (a0b8e396c9cd7941)\ScreenConnect.WindowsFileManager.exe
- Size 91KB
- SHA256 a40087c78a18f9d177dfe5fa5f0bec2cf113a80c2ffbe4d0ec3d582b067120d5
- MD5 ebebb49c1d1e6f35febe4b8d4138f7b5
- SHA1 00337a0af8352464407d9b8f114ad798ba99bee5
- SHA512 ec5dca6e88e671be2c72afde9e235c0ce47e782bb96931c8d52dc0fe9e138dc14f84caef8bd29275daa75fb414c20000c84e94bc011e3095af4125d67ee4d831
- SSDEEP 1536:FHMxIdlP49mjI5kLP+VVVVVVVVVVVVVVVVVVVVVVVVVdibp7M:IIPHukLCwpA
- TLSH T1DD93D59235266235DEC5C033A492E9B19C377F6207FDC5BD28A1BA3639E03943E99D70
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (a0b8e396c9cd7941)\app.config
- Size 700B
- SHA256 9f8322c4c224444a7d9e266632e33f7baef362d5b9ff6fd9321648d25e148fa1
- MD5 f6b3410d6b076cf65e350c7925c5a874
- SHA1 4da737504c5795183fa11d70c944f3a0a7b17f1c
- SHA512 67dcfbae384187c2830f951363e5b4a72b372599bf7d093300de305bd65fcf7b423edb1bc90fd62645aac973385ec9860f72c7e7596f8e0af51ca7af389ac087
- TLSH T13E01A75D74C0AF5912B36A33D6314280EC704A63066560E478EF21375F31AD907B329A
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (a0b8e396c9cd7941)\system.config
- Size 964B
- SHA256 917ad5bf1a3ccd23218f68addf8825352c44fc3b086a8422591b23248099527b
- MD5 070e5883b24d64349ae86aa7412aa3c8
- SHA1 fd15e6fd81409feec095746288a5346cae642a98
- SHA512 57e8df38671741b9c2f528e7d9692854d0b9550cf1e3cfe35dc092e0b2fe6a655646aa2248086a6969a46b1ecf51dcc3138366a284480a662aa7db8b3e8ff105
- TLSH T1BD1144F539C07D5B07F32B22D51083C9EE31526A3499188D31AD153A9F30DEA43A35CE
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI76BD.tmp
- Size 1.1MB
- SHA256 cd6bccce073b2a5205840ec31c91df0d443cc57c68756de2c03e21db8e3fc157
- MD5 914db3d3a01cc102bfe18dbde54e56b3
- SHA1 91246f683c6b78f67bf0eb7dd0043dc459f548cb
- SHA512 58e60853dcd5cedfc83dca39e19a9c2a31d4ed6f230e393df9015f5e013189c9527db4e17e10f685c584b3c0e124573ac3ffd9ea24395e65b3a4eb681212ae7c
- SSDEEP 24576:bUUGGakXrcMRzUH1YWmDqSPe+YPF0KkCNWUj2+bI4ie8tj3Nz:sGak7lQ1VmD3Pd0F0TCUU3bpiLvz
- TLSH T13935231537B8803AF1A62A306D3590621EFDB8B556F5C2992B99053D0FF2B81DB79333
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI76BD.tmp-\Microsoft.Deployment.WindowsInstaller.dll
- Size 172KB
- SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
- MD5 5ef88919012e4a3d8a1e2955dc8c8d81
- SHA1 c0cfb830b8f1d990e3836e0bcc786e7972c9ed62
- SHA512 4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684
- SSDEEP 3072:FkfZS7FUguxN+77b1W5GR69UgoCaf8TpCnfKlRUjW01Ky4:x+c7b1W4R6joxfQE
- TLSH T14E045B2563FC473ECAEF87B4E2624251E7B2E2E97113DB0DDC8541AA2522780F792753
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI76BD.tmp-\ScreenConnect.Core.dll
- Size 562KB
- SHA256 c51a2b5cb5054ec0136e332bf290c8af3392d7936b5137a07423df08ab33d264
- MD5 d9ef4f245159eb7374677f603e18b9ec
- SHA1 e7aa0b8bce504d31323d10dd987fa2d517649191
- SHA512 c46494c811c828faffe9baea85cfb923a53ef088ee75d0798fea0482076b493c43ee4b2243a44e35e8e686423d108ee80ddad5546e723eb8ce9fb17f13041d80
- SSDEEP 6144:GuPdHSnGdti7Bn2Bomiu7qTOGXwU6eISZl2JILinW5dQifdlb1QS/qhwDTax4kxC:Fd+McMYu7w1jXyadQmbb1QHM
- TLSH T171C47D11B39497F7C5AE037EE07053180272FA4564B6E78B65A8E4FA3C923C95D806FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI76BD.tmp-\ScreenConnect.InstallerActions.dll
- Size 24KB
- SHA256 432abf3a198ff64fb2c660eb06b2bb33a16cf69fd28d836cfcb65c43d37dc462
- MD5 80d4201dcb4e018aaff5fc1a5859da40
- SHA1 f59cfd60eb1f56050d4f8439b6a5ddcf0a6d2883
- SHA512 d3f4c28df23bf4beae556eb05e825fbeffe99dbecda47072267b5ec0142085fb95bbedbadb93de1a34c5d7bfcb0661c359bd56dde18c209498b0a2c3488c72a8
- SSDEEP 384:VPJazzV1WTsaS8hQlL6QX4V7NaNeirM0dbMsFkjvZBPs0MY:VxazwQX4VMcLvXj
- TLSH T1B7B2C620678DE17AF9EE1634B563F7B002B3BDB3CCE9DA8665A410152D253E04FB5B06
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI76BD.tmp-\ScreenConnect.Windows.dll
- Size 1.7MB
- SHA256 10933424536d53e397f651915f862c933199c50722943c236b020787b2e8f147
- MD5 c261e034df63aca035d7914d354b9dca
- SHA1 50e59350f4b524e55eec1a7ee0531bf9ad33a33b
- SHA512 5c67ca36550bbe0dfb8c5f1f32c34045b42a72a6199802c4730694148eec630c345a42f99bf44f7a3a62bd19256ffdf170ec849b40bb976e48b601f2a15dac69
- SSDEEP 24576:91/VFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUTM:7/VJkGYYpT0+TFiH7efP
- TLSH T1E985BD41E2C365F5D46B047888BF972AB6743C080365CAFB93D4AE366D33BC09A36756
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI7AE4.tmp-\CustomAction.config
- Size 234B
- SHA256 7027b69ab6ebc9f3f7d2f6c800793fde2a057b76010d8cfd831cf440371b2b23
- MD5 6f52ebea639fd7cefca18d9e5272463e
- SHA1 b5e8387c2eb20dd37df8f4a3b9b0e875fa5415e3
- SHA512 b5960066430ed40383d39365eadb3688cadadfeca382404924024c908e32c670afabd37ab41ff9e6ac97491a5eb8b55367d7199002bf8569cf545434ab2f271a
- TLSH T18CD0A70405D0FD1B5E231A2337524559FF34B1E290A44408B06F3A130A220CD4757317
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI7AE4.tmp-\ScreenConnect.WindowsInstaller.dll
- Size 137KB
- SHA256 528242c7745783b3b4ae72fec13bb9bd49b17b0e00f60c027351147f21fdd359
- MD5 dc1e764763d65555086850eba51af5c4
- SHA1 66043dbac97f3b86c019c218e5b127bb7e4441b8
- SHA512 175cdd4fdadd07afb6f54f0f909aadd74a579e069ea69dc96ceb9c07c14df2dcd1c929dc821e7f242ab39abadb91dd7c7bdf832e7b13416167200860caa0f8a1
- SSDEEP 1536:M6PufIhTx7WsJU5Ds9ZrUP43IO6A16d2K7kvDutUVfh5U3KiQtlJRWq8qo0m1:RPufGKTJ44i+k1VfjRDn+
- TLSH T183D33A3463AC9A37E6EF5AB9E431B1440BF2B527B4A3F78D694864F81C127D14B20367
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ScreenConnect\26.1.24.9579\a0b8e396c9cd7941\ScreenConnect.ClientSetup.msi
- Size 16.4MB
- SHA256 5cd8ddfa079de6e9571ec573cf54010a4244f2bd4b633c7ad0ae4639e8cfdd3f
- MD5 24ea4b1e6a7ea4676018313119d028d9
- SHA1 7693f979962c8fcbe380cb3fb2ff92548cca78e1
- SHA512 e93a565268f2aebf7358f9e70e4fb2664892dd894df3d0f2623785a9b86206cfb41e3103e21ab3eacb617c45f9e7c054cbf3b24473b1f599b9f52fb746bdbf97
- SSDEEP 393216:6CXvI5MvHxuJXCXvI5MvHxSCXvI5MvHxNCXvI5MvHx2CXvI5MvHxWCXvI5MvHx4a:6Z6HxsZ6HxSZ6HxNZ6Hx2Z6HxWZ6Hx4a
- TLSH T1F10723626BF88564F1B76B74B9BC80A08A76FCA44F26D00F0770395E28B0F54D5A6737
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSIC6C2.tmp
- Size 202KB
- SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
- MD5 ba84dd4e0c1408828ccc1de09f585eda
- SHA1 e8e10065d479f8f591b9885ea8487bc673301298
- SHA512 7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290
- SSDEEP 3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
- TLSH T129147C326494803EE7F91A36D93E9A61AE7DF6241760C99EC3848C0E5D604D06BF7B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e59c008.msi
- Size 16.5MB
- SHA256 e7ad5637c83c68c2688e704cb3b111384f222654629b69571244f6a5b4100e03
- MD5 fd3f843913c859f1736c8cb044f2265c
- SHA1 d9226c440dfe540ea5de5782bac1ca0858d702bc
- SHA512 d6e4f4e7c956811eed3cb3c47a175bbd4956f509c32f9470cd765ecf04d19cb55821c3f065b6605149470c8ea9178aff79d27d61c210f1f8a066bd81cdd9acf5
- SSDEEP 393216:bowXSC6owXS0owXSQowXS/owXSKowXSdowXS4:bonC6on0onQon/onKondon4
- TLSH T15A07232223F6886EE4F21A36A9B965A01177BCA4D953C25F12707D5E7E71940ECB3333
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\{C89A6864-0271-672B-0630-AADC5FE48DD6}\DefaultIcon
- Size 1KB
- SHA256 87bed2d86c91b9f7d19adca1829df20881cbe9cc44638e073684d09c9b7cf11c
- MD5 a8b8f09d92363e54230bd83bb6e6f553
- SHA1 3c02161fa71951d60533cec49403fd7c199d06f8
- SHA512 1c6aeac8a83e3457606f8e52fce03d1afc3cc4f3e50c0dea828a74f8eb95b6751a4b9b6b2196422a421257df17798ed2aef2d37012de7a7d5fccfa7e74677222
- TLSH T1421175DF26906C7DC43D1DB245878A68F8BF4CD914D7A1D370A1103A15602CA43283EE
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (a0b8e396c9cd7941)\user.config
- Size 720B
- SHA256 a051b601a8699538e84e190eb2254736b30b142cc9041dcd8dad869b2af5fe15
- MD5 e62cdbf4779a42fc1ab55c1a87e1820a
- SHA1 d9806952e8e2961be9519cf3fa756f101cfec0bf
- SHA512 8e1f748e3cd8c6c61d717c5f9b3986e9f44eff6a9ebf56ff4030e3beeb21f6f58d82ba17324f2dc2d996ae919b238cbcd0f7d1cd2701574c2df44e2d4bb52bf9
- TLSH T1D30149A831C0AE5A03B76E33C5214345FD721A9B01A520E438EE6137AF305DB03E32EE
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (a0b8e396c9cd7941)\vsqk44r4.newcfg
- Size 883B
- SHA256 cb6207934c42f4f1b6d0819b8e9bdecf420dcb5f1b2dbc4726834da5c3ac82e7
- MD5 d548071b49bd2c13a9f6b4d005bdb7a7
- SHA1 9254eefef22a66dbd1bc082c3eab3923eac095a5
- SHA512 5c12cf102618503d75042919803e736608b3071f9d6b5743f4eb018a59ca95428409d59538867fc0c56d3f137b7cd0e276eacd8d9e34ed468852e33187f10b2d
- TLSH T126114EA871C49D5A02B75932D5214345FD711A5702A560E434EE61375F309DB07E32DA
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (a0b8e396c9cd7941)\xy13uyjg.newcfg
- Size 883B
- SHA256 9ffffd77374dc9d04b39392cfed57419463df8f20ba0237e5d6d38b11427b71f
- MD5 77f947c2e0f148304a1bf91ada8027c0
- SHA1 db9fe6c2a13f603757da71274e42905791f7719d
- SHA512 d0db6d4b9d5786c6b9d8cca5790692cd69b6375ed567ff60f96b8c17d7ae5a2a2bc1656be869595163c071f1598897345d48ae61887111e52e084e4a86e3b7c0
- TLSH T1871149A871C09E5A02B76A32D5214385FD721A5702A560E438EE21376F309DB07E32EA
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\ScreenConnect\26.1.24.9579\ScreenConnect.ClientSetup.exe
- Size 18.9MB
- SHA256 ed61d1e441d4ad5b2c313e64387d26755abb81e07d65d698e3dfb015bb8e856b
- MD5 a0bd73cb758b8e8afe5aef9a98b8af80
- SHA1 db2fafe0aa57aa5d4a4a186392e57b92ad14e41c
- SHA512 296d51903c0c5a76160027a9b27db5b9eb1c6aea418312aee50ff9b6871287096c4e10f3746334ed08f9751153616a3a0474fe95689acb39b771769d51dba136
- SSDEEP 393216:+towXSC6owXS0owXSQowXS/owXSKowXSdowXSc:oonC6on0onQon/onKondonc
- TLSH T13A172312B3E694BAD4B70639D87A62655236BC144752C3BF52A0BD6E2D32BC0DD32373
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 0a44ce0cc713c178451a2830d5e59b33edb38befbb70d34525778b88d26a6c10
- MD5 8343ce4518efc4fe967a609abf9a1ad5
- SHA1 d751eb84302838b11539d379aa54f353a763c251
- SHA512 c4e3c95bc6c6b7a036bdeaba89045bd911973f0990490747199c94f0ea9abf1968d2b1eb784f1e6694a31b82c921efc5b1900ea3af00e2c86e75768252393685
- SSDEEP 24576:cFo3DMPQdoO/vvTL/yAsMilQPrOWX7rf0R6e9BCE65iqpLNMMoR2s12Noea:dHM
- TLSH T16957B51436F92100E7F79E3CA8F06A234D397D5BAC19DE8D45511B8E0922F71E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{c61fbfff-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{b8305437-2b78-4687-87c8-71ce155a9ec7}_OnDiskSnapshotProp
- Size 6KB
- SHA256 82519564d83685b893b0ea50cb18642c8c330df0f9c90373cb702bc7afac5ea3
- MD5 4f01e924614730649f4fd03cef1cb336
- SHA1 afb2486310f483b870813bea8198efa095de7f54
- SHA512 2b44fedcbbf0595f64ffe761c68988b7bb8df0ba8f76bd75eb95bd1a572617ac121159d5b796a3f4a8586c3cc6c969a8a7474fa59de4fecce91b59402a322e17
- SSDEEP 96:F38LW5mdlDvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:Kiwl/b++uVm
- TLSH T142D179085AF54311E2B3AB3129F14557A877B911FF33CB8E0198238E6671A10F975F6B
- MD5 SHA1 SHA512 SSDEEP TLSH