89d45f6c3848b504b43402f1941d62839338f25e65400110a06c045062aa9ebd

Analysis

max time kernel
150s
max time network
136s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/09/2026, 03:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-27_88fc65315371f2380fd533268da16d86_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe
Size 23.1MB
Sample260928-d1ffrstfrc
SHA256 89d45f6c3848b504b43402f1941d62839338f25e65400110a06c045062aa9ebd
MD5 88fc65315371f2380fd533268da16d86
SHA1 09cf860e0442a0d27c11d1229cb4c5cf96c31543
SHA512 d9821cd5de6a3b8e0173b5f3a281db34ffec904fdeb1c23744637660c825966086ea5711b614a087d422e8caf0c116349008490edc1df559a5f2e27e55a42627
SSDEEP 393216:bTNnqtWFKPsEoQoNnqtWFKPs3NnqtWFKPsiNnqtWFKPsGNnqtWFKPsyNnqtWFKPs:bTNnqtLPP6NnqtLPaNnqtLPxNnqtLP7Z
TLSH
T14837234A77DAA226D53E0230D476625067B0FD589B32C7AF27E4773E1C31BC0AE61396
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

backdoor discovery persistence ransomware rat

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
7	1944	rundll32.exe

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (33b6c4085e5a3354)\ImagePath = "\"C:\\Program Files (x86)\\ScreenConnect Client (33b6c4085e5a3354)\\ScreenConnect.ClientService.exe\" \"?e=Access&y=Guest&s=4e124a79-0f99-470c-a9ea-e79a5b8650fd&k=BgIAAACkAABSU0ExAAgAAAEAAQAhM4THwufaLcD3wa%2bs22S6nSS8qmEP%2bGZPxvfaSjFqLL5ZufNjdhcHaIRwbHRFFjI99Ke6c661VeKePqvXrVfMKzSwg5dq%2f2ilzu8KuG2j%2fLN2tl82GsOGYP3wzktnzBtUlnd%2ftibBYGLsLdeksWIY%2bAxnjfgmGpzA7hvLqXdYN6MMY%2fDeY5uKOntLl84kIlWiiqGLG%2fXcia1VRC5f7%2bSWJigUp%2fVJf8J7awWokGiC%2fRqkx7Kj1suwqpuIqL5iDXxuMra%2f%2fngTqBRk6zscfG806UKgzhMcwMzIsG0XPlS9k1Lq5BvGDVUM%2feVJYld80RJ%2fTCCE1NvhBxzkFq6fv3qs&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAAuwOc0MvmGkW8AYN2uR5KzAAAAAACAAAAAAAQZgAAAAEAACAAAAAJJB83Vi4%2fvc7IQufJHt2tvqquiFIs%2bBJ2cteixgTnpgAAAAAOgAAAAAIAACAAAABNGBEp6tt2HyjJleZ1C3kmOwIllZIM317QEAw8Cpg8MqAEAAAU9grxGDmV05nZoeW6TwQt7aZlgPydOcOP1EvoAtdf8ilQbbIYwVJqNn0ZxT51AlgS%2f9iL7woT8Fku5pwdI45kGnejiuKoj3j0UthVDiMx9AbIKRbNyWmFenGJpCYZ2WfhJRSSc8mJ%2bskD%2bMf%2f9c7z2%2bDMQLasHgF17iMUFK7IsZ64iq5t4PR7WjqTzmerdwVphKpvjj6Q7qxe5YxceMbURlGnuC3cUxMQXoTj1i9Xfbz2%2b8QRvTVBBhFVPjSwo%2fBE1m7%2fW6d%2fSRsqbTNePOrHX3XNwQxbxJBNBXrQa6as2CkxBOVQ82JF1mu%2fKLeTpyqpaXWHyu%2f6yd4IiKaJu8dZ%2baDtQGhM64dhCp%2f18k4Mwjup1ADUElX9omYIYYFT9rMoOEglmsOczCLA1FPMHadowC43xETRd26mDR2zNHqhAK4O49lHO%2fkKF0ksnMnSsAGo4ElZdeMucHN%2bUUlxwfSl%2bZo2v06eR1hPBavedH9LlR%2f0d61Q5STKwIVUsZzsKjfC2s5eLzaT5U%2bhCnbSmonZ9z7aogof8gvfUJuFKYMeb8e0wtM1%2fpTyUlIzJFW5F7R4msLX%2biloEcsrw0Okoiyg6iH%2bGpun2EAUxUhCTBFGN6PozuYHijDpBEjAmGO%2b02qZunW%2fZYS2vrCe2yyDgLWT10zPpwXHHz7DjCu7STULuGlyM0xPoO8Mq5GCak4%2fgOF%2fQnMcI7rdaSTMstX44IjJ74LgQMXKS9L1nJdnDXeCN%2feD1E9ZP7M0HsFO6D9fcdXmGvRh%2bR8yeqn%2bohVs1gnS7u29%2bGYuqLASbioXEeVfPzP8qUYiKDbnTDeLYxsVR2pJHtOPffluZ9iUN8WFpveF0IwrqUp4Eo3U3hHI%2fkUsAlyEwwTAJ7OXZM1buASCuQAJbjAli%2fVvvDE%2bvUInVfPLOsa3LdCk2ZcclEffi9qGePz2lVz3efUpjF9cBz8i5UbPfkF9t8Da0ncJdHv6EXpeo1iQSL7OpWhFyfNP3o8cKWwu8cXkBpzNm3YH%2bXERS4qOIrS7YwSi%2bLpfA2rfpm0jBV2jPpqM%2fh0aRpVIgtT79RRelHvDW%2fldZF5da%2f1Tcro1ndzCYy7gesTRLcOup0HeWnz5%2fL1SfXPs2pxm4RRynjDinQP%2fqr0HYL24UvDvV5DKALyS%2bqQKZgQyak%2bmkREFrs2s2v0OOyVWLPjgECHrJCJ9tI72zBHrduvi%2b4afsZVS61jounHk9buNJZ%2bxH2%2bZZgNTNahzo6Icp9HPgkJ6ZjjnsPQf9BYWN6f6Y6OJQs86KF%2b1tWf2UUP%2b30fIEjWbvM%2b17PxXkKRJqaomHebaZfNU%2bLZbeZbqGMmeAf7rKYdnktKLsgNoDClsTwPPWP5AMHbUFpn8THUwR%2flL5oMVBsdkcfbEhCsetaClqj6qc0X3c6M071aBY2rQ0AgiNkX%2fukopV2hsyCakQ3axM4UbsoMtNLPwsMtx3qUIAcl589xIwexTRCunJHFZ%2flmlCsXZ7uO7XfhIm8Y248lp7mMvuwpFKPLGQXq%2fqn2AdZPn2%2bUeYB9ZXkvPFWIP%2fdUMmeHZ5TX9aAku6cDCunxOW%2fYxSUAAAAD93lvKsuhVJ2Mes4UlTID4IyPrg0bpGGBC0fVhpk%2fwkUT5chlfuAv%2f5hZJNR7uJvz1l1OQLhQpRS4QsdpkN3Lr\""	ScreenConnect.ClientService.exe

ConnectWise ScreenConnect remote access tool
ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
backdoor rat

Enumerates connected drives 3 TTPs 47 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
	\??\F:\	msiexec.exe

Drops file in System32 directory 27 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (33b6c4085e5a3354)\qtkpiz2s.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (33b6c4085e5a3354)\zmpkfmmb.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (33b6c4085e5a3354)\3ypez2ue.tmp	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (33b6c4085e5a3354)\3ypez2ue.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (33b6c4085e5a3354)\nqemfn5k.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (33b6c4085e5a3354)\very33h1.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (33b6c4085e5a3354)\very33h1.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (33b6c4085e5a3354)\very33h1.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (33b6c4085e5a3354)\zmpkfmmb.tmp	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (33b6c4085e5a3354)\zmpkfmmb.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (33b6c4085e5a3354)\3ypez2ue.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (33b6c4085e5a3354)\d5jirooh.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (33b6c4085e5a3354)\s4op4cmb.tmp	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (33b6c4085e5a3354)\user.config	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (33b6c4085e5a3354)\nqemfn5k.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (33b6c4085e5a3354)\d5jirooh.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (33b6c4085e5a3354)\d5jirooh.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (33b6c4085e5a3354)\v3jfdckt.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (33b6c4085e5a3354)\qtkpiz2s.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (33b6c4085e5a3354)\qtkpiz2s.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (33b6c4085e5a3354)\zfqj2vnl.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (33b6c4085e5a3354)\zfqj2vnl.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (33b6c4085e5a3354)\zfqj2vnl.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (33b6c4085e5a3354)\s4op4cmb.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (33b6c4085e5a3354)\v3jfdckt.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (33b6c4085e5a3354)\v3jfdckt.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (33b6c4085e5a3354)\nqemfn5k.newcfg	ScreenConnect.ClientService.exe

Drops file in Program Files directory 16 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ScreenConnect Client (33b6c4085e5a3354)\ScreenConnect.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (33b6c4085e5a3354)\ScreenConnect.WindowsBackstageShell.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (33b6c4085e5a3354)\app.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (33b6c4085e5a3354)\ScreenConnect.Windows.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (33b6c4085e5a3354)\ScreenConnect.WindowsClient.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (33b6c4085e5a3354)\ScreenConnect.WindowsFileManager.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (33b6c4085e5a3354)\Client.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (33b6c4085e5a3354)\ScreenConnect.Client.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (33b6c4085e5a3354)\ScreenConnect.WindowsClient.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (33b6c4085e5a3354)\ScreenConnect.WindowsFileManager.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (33b6c4085e5a3354)\Client.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (33b6c4085e5a3354)\ScreenConnect.ClientService.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (33b6c4085e5a3354)\ScreenConnect.WindowsBackstageShell.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (33b6c4085e5a3354)\ScreenConnect.ClientService.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (33b6c4085e5a3354)\Client.Override.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (33b6c4085e5a3354)\system.config	msiexec.exe

Drops file in Windows directory 17 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7B70.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF61447C5C6ABB0A5F.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e5975a3.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFE48351129B59F182.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7E50.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF0D29E11BA27FC4EA.TMP	msiexec.exe
File created	C:\Windows\Installer\e5975a3.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7BBF.tmp	msiexec.exe
File created	C:\Windows\Installer\wix{6B950BDA-BE88-BBFE-254F-6E4C064C990C}.SchedServiceConfig.rmi	MsiExec.exe
File created	C:\Windows\Installer\e5975a5.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{6B950BDA-BE88-BBFE-254F-6E4C064C990C}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF1F150F55133351EA.TMP	msiexec.exe
File created	C:\Windows\Installer\{6B950BDA-BE88-BBFE-254F-6E4C064C990C}\DefaultIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\{6B950BDA-BE88-BBFE-254F-6E4C064C990C}\DefaultIcon	msiexec.exe

Executes dropped EXE 2 IoCs

pid	Process
5728	ScreenConnect.ClientService.exe
1780	ScreenConnect.WindowsClient.exe

Loads dropped DLL 42 IoCs

pid	Process
1304	MsiExec.exe
5828	rundll32.exe
5828	rundll32.exe
5828	rundll32.exe
5828	rundll32.exe
5828	rundll32.exe
5828	rundll32.exe
5828	rundll32.exe
5828	rundll32.exe
5828	rundll32.exe
1304	MsiExec.exe
1944	rundll32.exe
1944	rundll32.exe
1944	rundll32.exe
1944	rundll32.exe
1944	rundll32.exe
1944	rundll32.exe
1944	rundll32.exe
1944	rundll32.exe
1944	rundll32.exe
1304	MsiExec.exe
5564	rundll32.exe
5564	rundll32.exe
5564	rundll32.exe
5564	rundll32.exe
5564	rundll32.exe
5564	rundll32.exe
5564	rundll32.exe
5564	rundll32.exe
5564	rundll32.exe
1336	MsiExec.exe
5036	MsiExec.exe
5728	ScreenConnect.ClientService.exe
5728	ScreenConnect.ClientService.exe
5728	ScreenConnect.ClientService.exe
5728	ScreenConnect.ClientService.exe
5728	ScreenConnect.ClientService.exe
5728	ScreenConnect.ClientService.exe
5728	ScreenConnect.ClientService.exe
5728	ScreenConnect.ClientService.exe
5728	ScreenConnect.ClientService.exe
5728	ScreenConnect.ClientService.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ScreenConnect.ClientService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ScreenConnect.ClientService.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-27_88fc65315371f2380fd533268da16d86_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenConnect.ClientService.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000000de3438a4f689b710000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c01200000000000000000000000027010100008838010de3438a0000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e841010de3438a000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e30de3438a00000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e60de3438a00000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies data under HKEY_USERS 8 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.ClientService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.ClientService.exe

Modifies registry class 32 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ADB059B688EBEFBB52F4E6C460C499C0\ProductName = "ScreenConnect Client (33b6c4085e5a3354)"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-33b6c4085e5a3354\shell\open\command	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ADB059B688EBEFBB52F4E6C460C499C0\Version = "436273174"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-33b6c4085e5a3354\UseOriginalUrlEncoding = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-33b6c4085e5a3354\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (33b6c4085e5a3354)\\ScreenConnect.WindowsClient.exe\" \"%1\""	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ADB059B688EBEFBB52F4E6C460C499C0	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ADB059B688EBEFBB52F4E6C460C499C0\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\26.1.22.9573\\33b6c4085e5a3354\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ADB059B688EBEFBB52F4E6C460C499C0\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ADB059B688EBEFBB52F4E6C460C499C0\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ADB059B688EBEFBB52F4E6C460C499C0\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ADB059B688EBEFBB52F4E6C460C499C0\SourceList\Media	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ADB059B688EBEFBB52F4E6C460C499C0\Clients = 3a0000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ADB059B688EBEFBB52F4E6C460C499C0\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ADB059B688EBEFBB52F4E6C460C499C0\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ADB059B688EBEFBB52F4E6C460C499C0\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-33b6c4085e5a3354\shell\open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ADB059B688EBEFBB52F4E6C460C499C0\ProductIcon = "C:\\Windows\\Installer\\{6B950BDA-BE88-BBFE-254F-6E4C064C990C}\\DefaultIcon"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\628E2E77D9D9EA94336B4C80E5A53345\ADB059B688EBEFBB52F4E6C460C499C0	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ADB059B688EBEFBB52F4E6C460C499C0\SourceList\PackageName = "ScreenConnect.ClientSetup.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ADB059B688EBEFBB52F4E6C460C499C0\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\26.1.22.9573\\33b6c4085e5a3354\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ADB059B688EBEFBB52F4E6C460C499C0\PackageCode = "ADB059B688EBEFBB52F4E6C460C499C0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-33b6c4085e5a3354	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-33b6c4085e5a3354\URL Protocol	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ADB059B688EBEFBB52F4E6C460C499C0\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-33b6c4085e5a3354\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-33b6c4085e5a3354\shell	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\ADB059B688EBEFBB52F4E6C460C499C0\Full	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ADB059B688EBEFBB52F4E6C460C499C0\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\628E2E77D9D9EA94336B4C80E5A53345	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ADB059B688EBEFBB52F4E6C460C499C0\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-33b6c4085e5a3354	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\ADB059B688EBEFBB52F4E6C460C499C0	msiexec.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3192	msiexec.exe
3192	msiexec.exe
5728	ScreenConnect.ClientService.exe
5728	ScreenConnect.ClientService.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1196	2026-09-27_88fc65315371f2380fd533268da16d86_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe
Token: SeShutdownPrivilege	5808	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5808	msiexec.exe
Token: SeSecurityPrivilege	3192	msiexec.exe
Token: SeCreateTokenPrivilege	5808	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5808	msiexec.exe
Token: SeLockMemoryPrivilege	5808	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5808	msiexec.exe
Token: SeMachineAccountPrivilege	5808	msiexec.exe
Token: SeTcbPrivilege	5808	msiexec.exe
Token: SeSecurityPrivilege	5808	msiexec.exe
Token: SeTakeOwnershipPrivilege	5808	msiexec.exe
Token: SeLoadDriverPrivilege	5808	msiexec.exe
Token: SeSystemProfilePrivilege	5808	msiexec.exe
Token: SeSystemtimePrivilege	5808	msiexec.exe
Token: SeProfSingleProcessPrivilege	5808	msiexec.exe
Token: SeIncBasePriorityPrivilege	5808	msiexec.exe
Token: SeCreatePagefilePrivilege	5808	msiexec.exe
Token: SeCreatePermanentPrivilege	5808	msiexec.exe
Token: SeBackupPrivilege	5808	msiexec.exe
Token: SeRestorePrivilege	5808	msiexec.exe
Token: SeShutdownPrivilege	5808	msiexec.exe
Token: SeDebugPrivilege	5808	msiexec.exe
Token: SeAuditPrivilege	5808	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5808	msiexec.exe
Token: SeChangeNotifyPrivilege	5808	msiexec.exe
Token: SeRemoteShutdownPrivilege	5808	msiexec.exe
Token: SeUndockPrivilege	5808	msiexec.exe
Token: SeSyncAgentPrivilege	5808	msiexec.exe
Token: SeEnableDelegationPrivilege	5808	msiexec.exe
Token: SeManageVolumePrivilege	5808	msiexec.exe
Token: SeImpersonatePrivilege	5808	msiexec.exe
Token: SeCreateGlobalPrivilege	5808	msiexec.exe
Token: SeCreateTokenPrivilege	5808	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5808	msiexec.exe
Token: SeLockMemoryPrivilege	5808	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5808	msiexec.exe
Token: SeMachineAccountPrivilege	5808	msiexec.exe
Token: SeTcbPrivilege	5808	msiexec.exe
Token: SeSecurityPrivilege	5808	msiexec.exe
Token: SeTakeOwnershipPrivilege	5808	msiexec.exe
Token: SeLoadDriverPrivilege	5808	msiexec.exe
Token: SeSystemProfilePrivilege	5808	msiexec.exe
Token: SeSystemtimePrivilege	5808	msiexec.exe
Token: SeProfSingleProcessPrivilege	5808	msiexec.exe
Token: SeIncBasePriorityPrivilege	5808	msiexec.exe
Token: SeCreatePagefilePrivilege	5808	msiexec.exe
Token: SeCreatePermanentPrivilege	5808	msiexec.exe
Token: SeBackupPrivilege	5808	msiexec.exe
Token: SeRestorePrivilege	5808	msiexec.exe
Token: SeShutdownPrivilege	5808	msiexec.exe
Token: SeDebugPrivilege	5808	msiexec.exe
Token: SeAuditPrivilege	5808	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5808	msiexec.exe
Token: SeChangeNotifyPrivilege	5808	msiexec.exe
Token: SeRemoteShutdownPrivilege	5808	msiexec.exe
Token: SeUndockPrivilege	5808	msiexec.exe
Token: SeSyncAgentPrivilege	5808	msiexec.exe
Token: SeEnableDelegationPrivilege	5808	msiexec.exe
Token: SeManageVolumePrivilege	5808	msiexec.exe
Token: SeImpersonatePrivilege	5808	msiexec.exe
Token: SeCreateGlobalPrivilege	5808	msiexec.exe
Token: SeCreateTokenPrivilege	5808	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5808	msiexec.exe

Suspicious use of FindShellTrayWindow 20 IoCs

pid	Process
5808	msiexec.exe
5808	msiexec.exe
1780	ScreenConnect.WindowsClient.exe
1780	ScreenConnect.WindowsClient.exe
1780	ScreenConnect.WindowsClient.exe
1780	ScreenConnect.WindowsClient.exe
1780	ScreenConnect.WindowsClient.exe
1780	ScreenConnect.WindowsClient.exe
1780	ScreenConnect.WindowsClient.exe
1780	ScreenConnect.WindowsClient.exe
1780	ScreenConnect.WindowsClient.exe
1780	ScreenConnect.WindowsClient.exe
1780	ScreenConnect.WindowsClient.exe
1780	ScreenConnect.WindowsClient.exe
1780	ScreenConnect.WindowsClient.exe
1780	ScreenConnect.WindowsClient.exe
1780	ScreenConnect.WindowsClient.exe
1780	ScreenConnect.WindowsClient.exe
1780	ScreenConnect.WindowsClient.exe
1780	ScreenConnect.WindowsClient.exe

Suspicious use of SendNotifyMessage 18 IoCs

pid	Process
1780	ScreenConnect.WindowsClient.exe
1780	ScreenConnect.WindowsClient.exe
1780	ScreenConnect.WindowsClient.exe
1780	ScreenConnect.WindowsClient.exe
1780	ScreenConnect.WindowsClient.exe
1780	ScreenConnect.WindowsClient.exe
1780	ScreenConnect.WindowsClient.exe
1780	ScreenConnect.WindowsClient.exe
1780	ScreenConnect.WindowsClient.exe
1780	ScreenConnect.WindowsClient.exe
1780	ScreenConnect.WindowsClient.exe
1780	ScreenConnect.WindowsClient.exe
1780	ScreenConnect.WindowsClient.exe
1780	ScreenConnect.WindowsClient.exe
1780	ScreenConnect.WindowsClient.exe
1780	ScreenConnect.WindowsClient.exe
1780	ScreenConnect.WindowsClient.exe
1780	ScreenConnect.WindowsClient.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
5808	msiexec.exe
3192	msiexec.exe
1304	MsiExec.exe
1336	MsiExec.exe
5036	MsiExec.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1196 wrote to memory of 5808	1196	2026-09-27_88fc65315371f2380fd533268da16d86_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe	90
PID 3192 wrote to memory of 1304	3192	msiexec.exe	92
PID 1304 wrote to memory of 5828	1304	MsiExec.exe	93
PID 1304 wrote to memory of 1944	1304	MsiExec.exe	94
PID 1304 wrote to memory of 5564	1304	MsiExec.exe	95
PID 3192 wrote to memory of 1280	3192	msiexec.exe	101
PID 3192 wrote to memory of 1336	3192	msiexec.exe	103
PID 3192 wrote to memory of 5036	3192	msiexec.exe	104
PID 5728 wrote to memory of 1780	5728	ScreenConnect.ClientService.exe	106

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-09-27_88fc65315371f2380fd533268da16d86_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-27_88fc65315371f2380fd533268da16d86_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1196
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\26.1.22.9573\33b6c4085e5a3354\ScreenConnect.ClientSetup.msi" SC_EXE_PATH="C:\Users\Admin\AppData\Local\Temp\2026-09-27_88fc65315371f2380fd533268da16d86_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe"
  2⤵
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:5808

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3192
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 8346D5295FDD7C358158F206B37FFADE C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1304
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI22EF.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240722875 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:5828
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI28CC.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240724218 8 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.CheckMsiMotw
    3⤵
    - Badlisted process makes network request
    - Loads dropped DLL
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    PID:1944
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI30FB.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240726437 15 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.CheckMsiFileName
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:5564
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:1280
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 591CC6A3265D2A479EB23834313E8726
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1336
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 2E05370D6EBC8C78A52D85312A9A3CCF E Global\MSI0000
  2⤵
  - Drops file in Windows directory
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5036

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:1224

C:\Program Files (x86)\ScreenConnect Client (33b6c4085e5a3354)\ScreenConnect.ClientService.exe
"C:\Program Files (x86)\ScreenConnect Client (33b6c4085e5a3354)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&s=4e124a79-0f99-470c-a9ea-e79a5b8650fd&k=BgIAAACkAABSU0ExAAgAAAEAAQAhM4THwufaLcD3wa%2bs22S6nSS8qmEP%2bGZPxvfaSjFqLL5ZufNjdhcHaIRwbHRFFjI99Ke6c661VeKePqvXrVfMKzSwg5dq%2f2ilzu8KuG2j%2fLN2tl82GsOGYP3wzktnzBtUlnd%2ftibBYGLsLdeksWIY%2bAxnjfgmGpzA7hvLqXdYN6MMY%2fDeY5uKOntLl84kIlWiiqGLG%2fXcia1VRC5f7%2bSWJigUp%2fVJf8J7awWokGiC%2fRqkx7Kj1suwqpuIqL5iDXxuMra%2f%2fngTqBRk6zscfG806UKgzhMcwMzIsG0XPlS9k1Lq5BvGDVUM%2feVJYld80RJ%2fTCCE1NvhBxzkFq6fv3qs"
1⤵
- Sets service image path in registry
- Drops file in System32 directory
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5728
- C:\Program Files (x86)\ScreenConnect Client (33b6c4085e5a3354)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (33b6c4085e5a3354)\ScreenConnect.WindowsClient.exe" "RunRole" "a776884e-9158-4cf3-ad69-d82169f706ae" "User"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1780

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5975a4.rbs

Path C:\Config.Msi\e5975a4.rbs
Size 213KB
SHA256 309d8b10f2ef01b8f68ff195191a162793c539c27421adde6af563e87fb35e28
MD5 e65e33231acd137b2955bad816764d01
SHA1 b5d1444f8fd0da04bf3adb6b27980e434098485b
SHA512 297673589550bdcfd30e35f7bdf996409bb62e75f545f98974286a365d3e5cc9c7c03d6e3dc3f476dc2c31963bb47680e81934dae9b61e4e36f3a08683ff57be
SSDEEP 3072:hw9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMGx:hwuH2aCGw1ST1wQLdqvx
TLSH
T120248D227481807EE7FA1A32DA3E96717E7DF6241760C59EC3888C1E5D604C06BF6B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.Override.en-US.resources

Path C:\Program Files (x86)\ScreenConnect Client (33b6c4085e5a3354)\Client.Override.en-US.resources
Size 512B
SHA256 11ba44d5e7efcac648651a286ed71b1d17d7cf638b5715bdb39fcf4854b1cac8
MD5 cff727d1ed264afe80d0b7a2d9c450ec
SHA1 750391d4e1d1efe7ec27945fa24b18f428c73587
SHA512 0194aad81f75e27a9a90269022df3a38d56c115d75e0b83caa4f314d9060137be5063ab53b180443e6a950ff7f93c8659a9cf1ec76d4e4095ba6c47349e3dbfc
TLSH
T10EF08626739C1179D5E2177B285631C1167BA92D8124546D6854102C5AB260A4F91B72
MD5 SHA1 SHA512 TLSH

Submit Download

Client.en-US.resources

Path C:\Program Files (x86)\ScreenConnect Client (33b6c4085e5a3354)\Client.en-US.resources
Size 64KB
SHA256 efdb0b4fcc38b52cbf72336bd107a814db8454003f3495de21e2026a148823ea
MD5 92232708774febf9a4a464bbeda36215
SHA1 521d4e630f5e00977bbca7cd17dd0d22dbe1ca9e
SHA512 59442cbc57604f0dd170bb4f86f0e2b6c96408daf67250e6f40e00d034033b6871502cd83df0267f4628c3a035f191d56f26bf1927e691b5330524eb810852f2
SSDEEP 1536:5fkiK2FoQ67wwLFSj7Be3sZvU/7UFN+9nwLLChTKN1ljpneMarA:5fkiK2FoQ6jFSj7Be3sZvU/7UFN+9nwS
TLSH
T1A8532E1277FD0A58F5F36F35BE7A94619937BC5A2E25C06E1028815E09B2F80C9B2773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.resources

Path C:\Program Files (x86)\ScreenConnect Client (33b6c4085e5a3354)\Client.resources
Size 6KB
SHA256 bd34378ad99f7609fa0c7c8edde6337c738a61d288863015629329806a1cc728
MD5 1e863134f29bcabe1ee571c91ac4fbe6
SHA1 57cc5966fcae49019da5f8f507c840cedfc103f4
SHA512 7e2640c4ddb8719230de0ddb0d18f9a4b1499a037247f12b142b1c16a2a989390abcb5ac7816a63dbce2d43c08510cec7cfc87cd24458bc2fa919c396b36d4f9
SSDEEP 192:rpDZHfbkqYvZJG293IIs1Z4EO/nM3ZWYijpo2YG:rRZjkqYxJ3JI/sMJ/ijp/p
TLSH
T1D8D13BC49BFEAC3CF05E51BE3A7692990275FF113AA3C3582460106A7F228856C56737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll

Path C:\Program Files (x86)\ScreenConnect Client (33b6c4085e5a3354)\ScreenConnect.Client.dll
Size 627KB
SHA256 3fc7102580f90887ab0e4fd7e108ffb39d9e36534b29dc3cafc0bf10467a94cc
MD5 27c02d668fcfc55020ba75063bc85563
SHA1 91d3a411e69d3098b89c4e56cf9f0f4b8dfab565
SHA512 dc6473ca7aa7bfdb3404af4f36609629eaf3f07034531ffec4d90c6d6f63baa4bdd197eef59fcde3ef4d794c831e10cb3acff1ae2dc243121f3a1314d832c0d7
SSDEEP 12288:7ihGnk1kEWlCpr/auIiEbmtzHTEavSW7OQninLiCE:gUkqEvkm5zEn8qnLiCE
TLSH
T126D4CF4EAB5BBA2AED2E0B33E6D22214D6B16C8B9657D31F0D58767C0D723C4368D1C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Program Files (x86)\ScreenConnect Client (33b6c4085e5a3354)\ScreenConnect.ClientService.dll
Size 174KB
SHA256 a017d0c0cd76141c117fd0a4f36665a647459294586b76a6edccb863b8148f41
MD5 439628eff70ce81c304308595bc43703
SHA1 991bdb4432c3c9d59c06b311eb58cebdd14b4d44
SHA512 26056d68a52a43db847ac1e6db227e3afcc7bb78851f95b5847754b73a6c3827f48ff2adf0d49157a4960c2c89ea2180b2df4526ce3485c80db8b0e4f75bd150
SSDEEP 3072:9dDDAVOQIhfToHux9kG77T9cBuP1LQOVaE2NUO:L37/VToHWHTyBuPhsEU
TLSH
T13F04BF49B78DD466D5AE0E3BF4A2B31052F1A483DAE6C34B7C9862ED0E557C02F583C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Program Files (x86)\ScreenConnect Client (33b6c4085e5a3354)\ScreenConnect.ClientService.exe
Size 93KB
SHA256 c33178431989f7c07990d9bcaae98d979952913f1c2ec6ea2e1be800bd908ace
MD5 b3fab2382e7c3216c33cbde92301baad
SHA1 891102ab1096a67a044b98b8621c7d933af780b4
SHA512 6fcceb64d1452aa35867770ec39b4e55afa3026e9a934222fd7df075542820821ede2c6288626f2ba12884c95e6335bc1619939ea455238708adb43df12232f5
SSDEEP 1536:9g1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkg0T0HMs7fJ:OhbNDxZGXfdHrX7rAc6myJkg0T0HZt
TLSH
T110935B13B5C28872D573093158E0DAB09A3FF9615E21DEAB3798022E4F741C1AE75EB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Program Files (x86)\ScreenConnect Client (33b6c4085e5a3354)\ScreenConnect.Core.dll
Size 1.3MB
SHA256 91395fd9d3d73f7ae1cfc03ced567c41723af3f7c89f9e2dfc723f04c998e43b
MD5 809940a4ef998e8a6e3f7cbcbf5eb116
SHA1 56fd54ef2ac56a2bb6b60ff5c72a217ea0a5b8df
SHA512 eeeaa0fa983f7f693c4b61d77d3e5f0b8dd822a3ad378ebfff579a0e4bcfd828f7f1f8491dd03fb806c02783417dee690915b311d4a57dd39e2f82516a2540d7
SSDEEP 24576:cIL5B780ayXesApw/S0p9CmAtCQHCVSUU3:h/8CesAp0AEQi4N
TLSH
T185558D8E7B89E327C96D067384A05244A7B4D1E29F33D75B2AE4B73D4C993A87D481CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Program Files (x86)\ScreenConnect Client (33b6c4085e5a3354)\ScreenConnect.Windows.dll
Size 1.9MB
SHA256 e1fc8b745d4c7df758ad73262d49ddc00b41bb030f42f406ab4152806d955939
MD5 9e60031a8df3c15413960b0cbb7c3aac
SHA1 73a2792bc20d80c6fa762f909f7eda856d19fff4
SHA512 9fdf2deb8f75bcf16d220a803a1c4b2976c14567a0958acb862232f20d8f2e624dc000aaee1d9f5c4e9442c615fb6d230fbbb2c631e65d7df811659843f4260d
SSDEEP 24576:6PgarZ/yMFj+Ifz3zvnXj/zXzvAAkGz8mvgt379S+2bfR+RfmTk1krT1iH4SqfKM:6PgGZVJkGYYZTk+T1iH7efPQUt
TLSH
T1CF95BD45E2C364FAD46B047888BE632AA7743C040755CBFB97D0AE3A6D337C09A36795
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Program Files (x86)\ScreenConnect Client (33b6c4085e5a3354)\ScreenConnect.WindowsClient.exe
Size 1.5MB
SHA256 84931cb275766dd20c7fe74aaeebf9ef7e942303d7d51ec89bb3889ea5bc625d
MD5 e18f54f4157fd34972d216094882e3b5
SHA1 9af326d317bdd9c633d82b9104267fd692cb0478
SHA512 8d945dda53f6f11e572c4ddc0d2d7d42e87427b7576fd618e6c4bf879fb6228a964b5b3cf0ba39436efc3cc4cb02371fe92a9ccac59f94d89101cfc1c2afdc92
SSDEEP 24576:u7OY8eADWeHgv4tqI+9O/IgIFK/Gl/7RgxNHOa0qAG+he3FTYr:u7A0vU/Gl/FbS4
TLSH
T1ED75AE1E7ED5EE3BC85E4B769061121477F084918B37CB076CA4BBBE2D813846E186DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Program Files (x86)\ScreenConnect Client (33b6c4085e5a3354)\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
TLSH
T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
MD5 SHA1 SHA512 TLSH

Submit Download

app.config

Path C:\Program Files (x86)\ScreenConnect Client (33b6c4085e5a3354)\app.config
Size 1KB
SHA256 fe761bb417da73b7815b4971655ec9c8996d683c54124a8f4e941e55beb51ef5
MD5 7e1034e481880a67529f54fa97be9eca
SHA1 bc8c3cd3aa8814aa09b4e3210a60fa152d9f0244
SHA512 290e2cf61eb1edc1d9e177547bad817a3006136bbca7a8ff654c7aed5364636eae3d478ee716cbdb61d57d6b4de0e1672786e5c05da5b8fec48fb480efcf5c31
TLSH
T1D921B42CB1C1BE5915775A32E6324280ECB049631176B4A474EE31379F70ADA0BF36E6
MD5 SHA1 SHA512 TLSH

Submit Download

system.config

Path C:\Program Files (x86)\ScreenConnect Client (33b6c4085e5a3354)\system.config
Size 918B
SHA256 b39d0bde906effde1987909a742084ed5b6bdc2c72bf40a8931fabb32c6aa742
MD5 384a77aa8b7280dd1a6f73e8dec3884b
SHA1 8a3446a3f36029437bffe244125c421014d2040d
SHA512 41c4f0d7d8e9a648cc254bfa204aaf0fdfd52a80b6274cd8fbb3d9e164e6f94f05ff3ba27cf54bfd19b1a449ad691ccd763e5558e41fbf9be116b18c5edaa88a
TLSH
T12B11276035C07D8612B31922C62D0784AFB6064F156510567C6F5239EF35CDA47731EF
MD5 SHA1 SHA512 TLSH

Submit Download

MSI22EF.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI22EF.tmp
Size 1.9MB
SHA256 c3a5f064e96eb90a4eb8e8b70d93ba0b937a4538026cc387190ab91660911253
MD5 2ce6bd3e862f720673d1ebb8a0e90a11
SHA1 0b66bff27b0769c4110e0772948bba1fa0d16402
SHA512 8bf35b511e49377e160893008139b3b759330056b517117c857b8114c7d12864d95e645577c38dc1c50e2a883a90ba4185b9524d080dea66b8b11989c98d1bd3
SSDEEP 49152:sGe/UEuuUNVvqifTEjVU10PPxGhMSujg+gZs566W:sGquucfTwMhMSPFAy
TLSH
T16195331032EA4175F29797302C307166AF7D7DA0C9B9864B7B8A426C8FB17806BB5773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Deployment.WindowsInstaller.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI22EF.tmp-\Microsoft.Deployment.WindowsInstaller.dll
Size 172KB
SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
MD5 5ef88919012e4a3d8a1e2955dc8c8d81
SHA1 c0cfb830b8f1d990e3836e0bcc786e7972c9ed62
SHA512 4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684
SSDEEP 3072:FkfZS7FUguxN+77b1W5GR69UgoCaf8TpCnfKlRUjW01Ky4:x+c7b1W4R6joxfQE
TLSH
T14E045B2563FC473ECAEF87B4E2624251E7B2E2E97113DB0DDC8541AA2522780F792753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI22EF.tmp-\ScreenConnect.Core.dll
Size 1.3MB
SHA256 0b2e8272829e33c5bcbe41bd623f8921ae82929d133fd300e0ec7314659ebcef
MD5 0746f508ac67650a74e7db2ff3d992b1
SHA1 da3fe1ea787dda6beb3a9019ef5ace8a425dd90b
SHA512 936b91fe412769b5a950892cf9ba4cd29055451528605f6b4e5498a1005ca7b5161b32a8513ad729574c428d923b611a9e53313289b071bddfe152a51f4de094
SSDEEP 24576:8IL5B780ayXesApw/S0p9CmAtCQHCVSUU:B/8CesAp0AEQi4
TLSH
T1D4558D8E7B89E327C96D067384A05244A7B4D1E29F33D75B2AF4B73D4C993A86D481CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.InstallerActions.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI22EF.tmp-\ScreenConnect.InstallerActions.dll
Size 24KB
SHA256 f6beee151434f97bda71817a550165b96d92369e289366ed5f2493995dde79ac
MD5 5047196995605763ab98c033ed338eb5
SHA1 37cc22f1aaf8f21b16d0c6e9a55dbf43e0ffbaa0
SHA512 1a504feb9c66e4e7a38f9dd9169bb4b49d89cf6a12b053c140f9539a8ac45e1d9e5f28bb8aa466ccddfc2cf0ca9ba0f67179f4ba95f50636136f319f7531e923
SSDEEP 384:bkazzV1WTsaS8hQlL6QXMrV7NaNeirM0dbMsFkjvZBys0t8:QazwQX4VMcLv+i
TLSH
T12DB2D620678DE17AF9EA1634B563FBB001B3BDB3CCE9DA8565A420153D253E04FB5B06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI22EF.tmp-\ScreenConnect.Windows.dll
Size 1.9MB
SHA256 ab6e0f401cfa0b72fcf25917a9abd2049754a8200ec8ee07f1ef64bd9d403e34
MD5 baa6011c83912bfbed625a1a4ebe5de5
SHA1 d430bef4e289d1fb46470efda1fe1bb8e28094cb
SHA512 286fff7cebfbfa0ecc322296d899f8b8b900872c49acca3656a4ceff6c476e9f22abdd52e7d7b547d79f302816a281d28c5a2dbfc7a1156a7827697b599156a5
SSDEEP 24576:iPgarZ/yMFj+Ifz3zvnXj/zXzvAAkGz8mvgt379S+2bfR+RfmTk1krT1iH4SqfKE:iPgGZVJkGYYZTk+T1iH7efPQU
TLSH
T15B95AD45E2C365FAD46B047888BE632AA7743C040355CBFB97D0AE3A6D337C09A36795
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CustomAction.config

Path C:\Users\Admin\AppData\Local\Temp\MSI28CC.tmp-\CustomAction.config
Size 234B
SHA256 7027b69ab6ebc9f3f7d2f6c800793fde2a057b76010d8cfd831cf440371b2b23
MD5 6f52ebea639fd7cefca18d9e5272463e
SHA1 b5e8387c2eb20dd37df8f4a3b9b0e875fa5415e3
SHA512 b5960066430ed40383d39365eadb3688cadadfeca382404924024c908e32c670afabd37ab41ff9e6ac97491a5eb8b55367d7199002bf8569cf545434ab2f271a
TLSH
T18CD0A70405D0FD1B5E231A2337524559FF34B1E290A44408B06F3A130A220CD4757317
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsInstaller.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI28CC.tmp-\ScreenConnect.WindowsInstaller.dll
Size 400KB
SHA256 9a32251ecdabf148f0b881144a5d1dd5586170bbb89b95a1479b92b5705a851f
MD5 4b4aa1fc211d317320c7b8da9e366117
SHA1 0d41ff76d7922f120dc592c2a325c36b6e713796
SHA512 83bda99a8babfcad1b9f1b320044f43e773b648ab04afed6c46ff0ab5760e5ed228a63199c62c1404a9872c1c07a92d4ee383d6308c6d7b2def3894adccfb94c
SSDEEP 12288:++9r8e9RK3gBvEi9tQxOmubbzaGyNN5XLKu:Z9r8fQvEi9tQxOmubbzYXLd
TLSH
T18A949E1DBF49A757E92E0B3BC4227100D2F4E09B9AA7D38F9C84226E2D14BD87B551C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientSetup.msi

Path C:\Users\Admin\AppData\Local\Temp\ScreenConnect\26.1.22.9573\33b6c4085e5a3354\ScreenConnect.ClientSetup.msi
Size 19.4MB
SHA256 3edc4bde5e9d52224fda6b4e5ffae16b16d5642cb052a0408bb69c4390f7d00d
MD5 2ce7cb37429326c12d4cf941f36745ef
SHA1 f58543039e70aea05f16cab88ec3a856776777b7
SHA512 cd1ac86bb0d3ef22b41de9e9813cedff912c5394235d7f147dd8d56f952bec281aaf0e6e831e3de0de61bfe5905d33a9c01d4a9f6baf75e765930711d0e58576
SSDEEP 393216:hNnqtWFKPsEoQoNnqtWFKPs3NnqtWFKPsiNnqtWFKPsGNnqtWFKPsyNnqtWFKPs:hNnqtLPP6NnqtLPaNnqtLPxNnqtLP7Nn
TLSH
T1B227233132FE5204F6325730F47A54D428B6FE2CEE35C51E23A5B52E2D71E919AA2723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI7BBF.tmp

Path C:\Windows\Installer\MSI7BBF.tmp
Size 202KB
SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
MD5 ba84dd4e0c1408828ccc1de09f585eda
SHA1 e8e10065d479f8f591b9885ea8487bc673301298
SHA512 7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290
SSDEEP 3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
TLSH
T129147C326494803EE7F91A36D93E9A61AE7DF6241760C99EC3848C0E5D604D06BF7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3ypez2ue.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (33b6c4085e5a3354)\3ypez2ue.newcfg
Size 588B
SHA256 09f0c657e3f08019d2a93c26ff3d162b3aa433641d63539ba738c63cce284898
MD5 a96a191efb8ef37c14403d5df55e5f0d
SHA1 eebcffbf9f9b1f549bd2103ad8c34c7af5a60110
SHA512 76d18f2501576c4f2eb5d91a637bcf529142a127990025660d47809d96ca973bf5ccd0b2beef87b8343f4692e13c1d5cf99991634e03eeee51cee03ca2ae55cc
TLSH
T140F08BA43084BE0B03735E23C9114744FE715B9B0519209874AF12369F325DF03A31EF
MD5 SHA1 SHA512 TLSH

Submit Download

d5jirooh.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (33b6c4085e5a3354)\d5jirooh.newcfg
Size 588B
SHA256 34ff62ca0070582684c3cc97b6d6a603547731390e0aed4def0e955a0560d4de
MD5 54b40bc4995e785d75e9b449e086eb4a
SHA1 36ea9c90e640303ad77900428fb04755aa209799
SHA512 691715bfc4fa1bce1a9002949c1b01b56e656a1443ee230b5ac1f3e69adc5d84f6b13c570b9fb6357d97a3d094208c2ee79b35bdd0db20a8d96ae0aefe2c625b
TLSH
T1D0F08BA53084BE4603B36E23C5115744FE715B9B0119209CB4AF22369F325DF03A32EF
MD5 SHA1 SHA512 TLSH

Submit Download

nqemfn5k.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (33b6c4085e5a3354)\nqemfn5k.newcfg
Size 588B
SHA256 26c516302d56ac491fc461a7a5ab9a306094587c12b38e2f282f1a1a805c2398
MD5 a8ead6ada01774c83b5657d054ae7fd7
SHA1 6ea6db3d0f417629b1465ca09035ac037846614c
SHA512 d66e90d18a54af8ec11bccd284be060c0cd2a02d8a3e438f3c31d7d4dfb3689cee1627059389c6f4229e8203b1836f2bfba59186fd680a57da8b1e7806046823
TLSH
T1D9F08BA53084BE0603735E23C9115784FE715B9B0119209C74AF12369F325DF03A31EF
MD5 SHA1 SHA512 TLSH

Submit Download

qtkpiz2s.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (33b6c4085e5a3354)\qtkpiz2s.newcfg
Size 588B
SHA256 d887cb0826b4fd35a4c2fe8cac415d40ddd4de8871e41d52f77ccb2022a2e8b7
MD5 285d6290e8ec00d79e61bd6d08b8eb4e
SHA1 37495fdf07aaa3bd992c3f509b54cb03a12f07ad
SHA512 fb3c24d379372bae86d9787a6e4a8f045ed5c3f79b0499cc5134aa4b9a3383a3a862d9d0a30def15ab42fccc3040b8efe039787af326222659eab1730bae7230
TLSH
T151F08BA43084BE0603735E23C9154744FE725B9B0519209874AF12369F325DF03A31EF
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (33b6c4085e5a3354)\user.config
Size 588B
SHA256 687bc6b5653a526a1e726f46253dad49e880e520eecfb6ed1432e4567dd36115
MD5 b9b14fca7733b57ecf32a1560834b600
SHA1 e0c2e4461b3143e36e45efe2fd5eb087253dc641
SHA512 f486f73147cd2304c3b830bf7aea0de337490d0ca36947446c751550de03748a79e026b171357648de75a8bc4982cb82c314f67baf74eca54b86b11c817c1486
TLSH
T169F08BA53084BE0603735E23C9115744FE715B9B0119209874AF12369F325DF03A31EF
MD5 SHA1 SHA512 TLSH

Submit Download

v3jfdckt.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (33b6c4085e5a3354)\v3jfdckt.newcfg
Size 588B
SHA256 51b07b11f9f92df19cec7451e6612c51417dc3af26524420351ccfa618815acd
MD5 5f2270b35b6358a439a609a660232519
SHA1 3c7e77a22385f9471157164a5d85c51e59549e22
SHA512 8d4d84059123052d7ccba50c7d51d8ee0b7f10f76671bb45ca971b9310a6560c8aa9113f5f8961698d1df69194ad6c11563777bd53ad960336c6ca8f4e98f60f
TLSH
T108F046A53084BE0603735E23C9155744FE715B9B0119209874AF12369F3259F03A31EF
MD5 SHA1 SHA512 TLSH

Submit Download

very33h1.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (33b6c4085e5a3354)\very33h1.newcfg
Size 588B
SHA256 6a21d983e8195fb0672842e495c55ae7f2cc293950d0eb37635500758777359b
MD5 bff9e644d55ed1d08d79b54bafa6d4fa
SHA1 86d213c45bc2b6c1490dab3e3515d10357521b84
SHA512 866edc6c1f03628f88b8fc407660685db94a1698f8b824d35ce41af8100ccb04b4e71a6f9509cecba65edcd4a4768e4467448387717351b8fea10fb3ea733a9a
TLSH
T1ABF08BA43084BE4A03735E23C9114744FE715B9B01192098B4AF12769F325DF03A31EF
MD5 SHA1 SHA512 TLSH

Submit Download

zfqj2vnl.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (33b6c4085e5a3354)\zfqj2vnl.newcfg
Size 588B
SHA256 ade2e33b7ec6d719957d72e52c79b29a571ef59fffb56bdd4573d3b67f52d581
MD5 adc8cf4a592b1adc81af9769935d554a
SHA1 13e6d6b368f55ea8e8bdfe7046fa37093fcf7f41
SHA512 844edf269173ad1b9b05b8c82ac2749b1472ac0bfc5e530d987e3ac1a397bb8443013d93b3b3dc270d9ea2a8d037c3171eab5e786b069c4b4fab6fae9e000cde
TLSH
T17CF046A43484BE4603735E23C5115784FE715B9B0119209CB4AF22369F3259F03A31EF
MD5 SHA1 SHA512 TLSH

Submit Download

zmpkfmmb.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (33b6c4085e5a3354)\zmpkfmmb.newcfg
Size 588B
SHA256 8bc4132f1f5b2149f7e4fc853a9e3c45fbdf47ce106f7739a4991b84466aed0d
MD5 b5c5a84ae322607bef5b057d355f6073
SHA1 e9de696aa7bc1202a2cf4bea0a37124ad4c4a6da
SHA512 afc8dd90ce6496cf5df2654490f67760a6b786bef24d5f5c9d26c7c8538dcc03d4f1eb53c446009d08b5eecbf528065e408b5afa3db615b0d0b57967a45ffd42
TLSH
T1B1F08BA43084BE4603735E23C9114744FE716B9B01192098B4AF22369F325DF03A31EF
MD5 SHA1 SHA512 TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 4a81e30f26b21db32147977ab8dc4c7961803c4c0ee1c5685147a555b714f338
MD5 74dceedc65a34b40a5c2f0f570e96291
SHA1 c32db9a801e85a72762f917fc5c86a30281c750a
SHA512 a4e7d9067403a281b0e78b1e558b5d9703df422061b6038f1cc9e2d6dd9b94de3a67b16b8ef3e4aca0d55aac56e6f947b2acc3a2caaff900ea9fbc41ef99ad33
SSDEEP 24576:1Fo3DMPedoO/vvTL/SQuOCVAPbeEl7pd0josdzQ2YLAaJZP+sohm+nEf6OU:OHU
TLSH
T11E57C32436F92210E7F79E3DA8F06A27893A7D5B9C15DE8D05411B4E0822F71E872F67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{882c2c49-0720-4316-8801-d0af34cbe85b}_OnDiskSnapshotProp

Path \??\Volume{8a43e30d-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{882c2c49-0720-4316-8801-d0af34cbe85b}_OnDiskSnapshotProp
Size 6KB
SHA256 efa0454af8a865d72dfdf4f7f25d3bb4c929c8a2819adad09e6ad1c775805fd0
MD5 5bbc797b19f665b542a934b9702cc060
SHA1 be0ccc2ea98085fb19d8dfcadad0e6b8da3a0dc4
SHA512 fb089a05837652168a391d58cbfd0a7f55f15aaf17f10ecbdf52c5cc7cf8cbb299ab77bd7abb28230945aa954796427d34ae027d75b0c4dfd5e5e69010e5fc59
SSDEEP 96:FlxLHTvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:nxb++uVm
TLSH
T1F6D189185AF54311E2B3AB7128F14557A877B812FF33CB8E0198238E6631911F936F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1196-7-0x0000000006A60000-0x0000000006C46000-memory.dmp

Download

memory/1196-1-0x0000000006170000-0x0000000006178000-memory.dmp

Download

memory/1196-9-0x0000000007200000-0x00000000077BA000-memory.dmp

Download

memory/1196-10-0x0000000007110000-0x00000000071A2000-memory.dmp

Download

memory/1196-0-0x0000000074B42000-0x0000000074B43000-memory.dmp

Download

memory/1196-8-0x0000000074B30000-0x00000000752EC000-memory.dmp

Download

memory/1196-11-0x0000000074B30000-0x00000000752EC000-memory.dmp

Download

memory/1196-6-0x0000000074B30000-0x00000000752EC000-memory.dmp

Download

memory/1196-4-0x00000000064A0000-0x00000000065F0000-memory.dmp

Download

memory/1196-3-0x0000000074B30000-0x00000000752EC000-memory.dmp

Download

memory/1196-2-0x00000000061A0000-0x00000000061B0000-memory.dmp

Download

memory/1196-5-0x0000000006750000-0x00000000067BA000-memory.dmp

Download

memory/1196-13-0x0000000074B30000-0x00000000752EC000-memory.dmp

Download

memory/1780-191-0x000000001B4F0000-0x000000001B590000-memory.dmp

Download

memory/1780-192-0x000000001BAE0000-0x000000001BC30000-memory.dmp

Download

memory/1780-193-0x000000001BE20000-0x000000001C006000-memory.dmp

Download

memory/1780-194-0x000000001C6A0000-0x000000001C828000-memory.dmp

Download

memory/1780-195-0x0000000000E90000-0x0000000000EC0000-memory.dmp

Download

memory/1780-196-0x00000000026D0000-0x0000000002700000-memory.dmp

Download

memory/1780-190-0x0000000000470000-0x00000000005FA000-memory.dmp

Download

memory/1944-76-0x0000000005230000-0x000000000529A000-memory.dmp

Download

memory/3192-210-0x0000024C36560000-0x0000024C36F04000-memory.dmp

Download

memory/5728-159-0x0000000003E90000-0x0000000003FE0000-memory.dmp

Download

memory/5728-181-0x0000000004B80000-0x0000000004C20000-memory.dmp

Download

memory/5728-177-0x0000000004A90000-0x0000000004AE0000-memory.dmp

Download

memory/5728-163-0x0000000004590000-0x0000000004776000-memory.dmp

Download

memory/5728-153-0x0000000003CC0000-0x0000000003CF0000-memory.dmp

Download

memory/5828-46-0x0000000006040000-0x0000000006226000-memory.dmp

Download

memory/5828-42-0x0000000005D00000-0x0000000005E50000-memory.dmp

Download

memory/5828-38-0x0000000005AC0000-0x0000000005ACC000-memory.dmp

Download

memory/5828-34-0x0000000005A80000-0x0000000005AAE000-memory.dmp

Download