bfc4fbb6aaa8809920830020e50ed11b278b0d6b660f33e8b7531b34ba4562b4

Analysis

max time kernel
150s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 07:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-30_e9112cf6139dcd6a8357c86527063392_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe
Size 23.3MB
Sample260930-hty2rasz6m
SHA256 bfc4fbb6aaa8809920830020e50ed11b278b0d6b660f33e8b7531b34ba4562b4
MD5 e9112cf6139dcd6a8357c86527063392
SHA1 0092664453dbb2ce8bc8c53d269045d398ea0558
SHA512 d9ab072ac73679f6fe00bd8b23ccd50d921e141f94cf8ef5c5d2138e5766476dcb7c69a59f42766b9765f7cbdf2de8169e0919448f3f202540552b568848365f
SSDEEP 393216:QAG4kPAN3tqMjTpT4SDsHNmx4kPAN3tqMjt4kPAN3tqMjd4kPAN3tqMjf4kPAN35:t3IA1tqutEo+XIA1tquOIA1tqu+IA1ts
TLSH
T1BF372304B7DA9626DC7E1A35D83693506770BC400B62C7AF63A47A3E5D337C05EA23B6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

backdoor discovery persistence privilege_escalation ransomware rat

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
7	3380	rundll32.exe

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (ea7f00c870e27815)\ImagePath = "\"C:\\Program Files (x86)\\ScreenConnect Client (ea7f00c870e27815)\\ScreenConnect.ClientService.exe\" \"?e=Access&y=Guest&h=instance-wyl5dg-relay.screenconnect.com&p=443&s=f43551ef-009e-4e36-8ace-ba19b1a0179c&k=BgIAAACkAABSU0ExAAgAAAEAAQAZhfNsnlCxl44DiqF%2fSjjyzm5bIkvBiJL5PI3io9zcg3v6ipXMk1PdWcCddZfkgPX1X57090KDVrxI61c4uqKTMUQOwUwMUsUDto6skFILk9Gxq98NsLmDdXpRZbCgJeElRkYBe9LkQxG3qCvhb%2beNygK%2b%2bRgWa9aXiUcVdRvviTbkloiSGHZByO31Vf%2bEwtYRv5uqfKDRs8FshkOd3vy%2bFP5FtUb5WTfPu99JbG566ci047pLYqZYU0DRVzG2S4dOd3OT%2f%2f2aXw7OXMEYD1%2ffjxC2DflaPaDAzQYYOA6dDsoui6%2fADeKVEZ5BjC8icnXc%2bzVEgxAnbdV8Ry3qdZrJ&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAAr1bNJNgslEq8JWp9nNYWAAAAAAACAAAAAAAQZgAAAAEAACAAAAAyWRWIxsWWzvR%2by4cdDh0R8RHRZjsz5Rrpx7%2bY%2fZrF2wAAAAAOgAAAAAIAACAAAADY22BQqoD0uBno%2bHCHPdj3%2fn6zhHvdNnO9qLogF3PNT6AEAAA%2bAXZc4ET30l8kqQC99FTHYBWGBoRRwUm87qlvWYHe2kHatwW0HvEnIr5e1cka%2bozWT0FKCnFkahqtD1LoiFvMPfeFBESNuZTXOhMvEv8%2bDhRO%2fL1e5OK341cSBqdE%2fH0ecKJBuj0AIxR3iPQ32L0FHmfgSNcEr1SRBTJ9838esXIx2NKFddkL8bvYP%2b26GCnbAbm%2fPQZzTtu18ODK2MVih5l8iK58FZxQiEKIJNS0%2bHBGOlFJYeDGN1CvMQx%2bsEwN2Qi0mSIGx2JzzQdV3j3o%2b6aCotJIXwSHwiHGlAHJ49auHPKXTdxlAv%2b17IimenSbeYZIAW0TO0zo7Tax12pzusCTFXLWLCfES5WorbG%2bsuGmAepnQawCWTDvuQXwQXFM%2f5umLWUoabELPz0HQ377Y%2b%2bFIzELrct3kAFw2KPzfNI%2bEqyAN9LaKY1wEICmxev350CVQObwMPForhr2pE%2fg0taPg1ow5hZRhE56HSJ4YjBRF7X1%2bdYLso7sRSJHxwJxkbqpBCMBT733ZSvBLVhudeO6f9JjjfHifWSYuDQC40YncDVBZUsYkdaaFLISvQ9U%2f9oQtwtgYEciHSMvmSG4ioyZv%2bKV2uyw76Zj7TVqu0cEyvH%2bpy55o70ZpzG6XaGIbtAy2ezP8YugZIEfB9dJ8blEVEU7xwWL99HBXZ%2bMiveKbOAnBbGHZbW69xxUJXveHtgoiOBBYtyVx%2frAvnKKrvWQH7VIEvm0xU0bxyD0gvQjAAjCpU55K4lJ4xBN4in6J%2fJ61%2bj%2b9VcDuQ1%2bxF6SsgTInxsSUU36IQ0tOvhwP3CPkEDio85GIh%2bKJlKfpa5h1XFvSg4SaxBzi5oyN%2bxRD4DkI8r%2b9c3X2asxeHWiyJyV6MS%2beixxaseWgjEtLBN4PSa5RIClD590L55sjoSTqM4E0uvxMhfu5Yz39PHm2W8qSAgIS09nW5%2fNHqe1tohawD2%2bzgcofoYJ7Gl8zpmcVFBItdlGNeBuX7J1jN2y6eyVvPxTuStNr70%2bO0RGxD5GDYStksz98vZ7UK7wKCYUgCYD56pvSw8CJDVVN7bdpm8eAsqTjE%2bQ03A%2fkCTQwqsD%2faOJdDwfg4i04Q%2bv8C81eOJ28EifKUL2KpCEYjct5yyzJGYvAJwj4PhpX%2fRWrK9lCXjjuVE1zc0kjSPE9xGfhrcneGqdR5DgkYnKHN5xplS2nWQ3cPhpTucRjKKX6S63xMitZcG7L6gYXoHKsfkBztPay986eubgmjsVTxjo6MbT%2fLtGyy6iq32ufIbzSzNFQFxBmSAX5zE4AqIeflF0ep8cu4ixp96K3UyMAgKZCwcgN3yCuhPr5aN3obpgH%2fhiEiJhkeOI5iu6vC3ukTeBluneIYZRqEnGZN2pmIjzha5yH3kNwYLKq%2b%2bSpe3Tdh%2f8Y0OLSuL3If58IEYZUDoOkUsMa0YsDk1u6GAqr9MXXNWwXz6qH%2fvnqtaE3lyAg3Xo8ufl8mMwEBJPIO%2bmBgeU8PBOEgzJdO1eXe3kQKqzTJUNK6ojTO7smcX89LRZsqIQvxY3sASw7dxJsFua%2f1%2fE30qUIV65JWOvr6sSdTdbOEAAAAB%2fOR9vG7GABCGycOOuEllrvl8Wyjc6ouFwK60LgZugg%2fgDME%2fqVzrH6Im9yhnihc57GzlpOF41WO2EryMiTL%2b7&c=Don&c=&c=&c=&c=&c=&c=&c=\""	ScreenConnect.ClientService.exe

ConnectWise ScreenConnect remote access tool
ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
backdoor rat

Enumerates connected drives 3 TTPs 47 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
	\??\F:\	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe

Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs

Suspicious Windows Authentication Registry Modification.

persistence privilege_escalation

Authentication Package

T1547.002

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\Authentication Packages = 6d007300760031005f003000000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800650061003700660030003000630038003700300065003200370038003100350029005c00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f0077007300410075007400680065006e007400690063006100740069006f006e005000610063006b006100670065002e0064006c006c0000000000	msiexec.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (ea7f00c870e27815)\auqlxay5.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (ea7f00c870e27815)\h2t2yi4x.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (ea7f00c870e27815)\h2t2yi4x.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (ea7f00c870e27815)\h2t2yi4x.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (ea7f00c870e27815)\4m53ygwv.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (ea7f00c870e27815)\4m53ygwv.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (ea7f00c870e27815)\auqlxay5.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (ea7f00c870e27815)\user.config	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (ea7f00c870e27815)\4m53ygwv.newcfg	ScreenConnect.ClientService.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Drops file in Program Files directory 17 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ScreenConnect Client (ea7f00c870e27815)\ScreenConnect.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (ea7f00c870e27815)\ScreenConnect.Windows.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (ea7f00c870e27815)\ScreenConnect.WindowsAuthenticationPackage.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (ea7f00c870e27815)\ScreenConnect.WindowsBackstageShell.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (ea7f00c870e27815)\Client.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (ea7f00c870e27815)\system.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (ea7f00c870e27815)\ScreenConnect.ClientService.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (ea7f00c870e27815)\ScreenConnect.WindowsFileManager.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (ea7f00c870e27815)\Client.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (ea7f00c870e27815)\ScreenConnect.Client.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (ea7f00c870e27815)\ScreenConnect.WindowsBackstageShell.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (ea7f00c870e27815)\ScreenConnect.WindowsCredentialProvider.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (ea7f00c870e27815)\ScreenConnect.ClientService.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (ea7f00c870e27815)\Client.Override.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (ea7f00c870e27815)\ScreenConnect.WindowsClient.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (ea7f00c870e27815)\ScreenConnect.WindowsClient.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (ea7f00c870e27815)\ScreenConnect.WindowsFileManager.exe	msiexec.exe

Drops file in Windows directory 17 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI8ECB.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8A83.tmp	msiexec.exe
File created	C:\Windows\Installer\wix{360CA6C8-0093-EE12-7FD1-B23179383681}.SchedServiceConfig.rmi	MsiExec.exe
File created	C:\Windows\Installer\e59841c.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF84A92337E54EF5BF.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF7BDA7DE3ED7DC4D5.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e59841a.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{360CA6C8-0093-EE12-7FD1-B23179383681}	msiexec.exe
File created	C:\Windows\Installer\{360CA6C8-0093-EE12-7FD1-B23179383681}\DefaultIcon	msiexec.exe
File created	C:\Windows\Installer\e59841a.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF51C08E1D7B6E6784.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF83A10D380A033831.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\{360CA6C8-0093-EE12-7FD1-B23179383681}\DefaultIcon	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8AC3.tmp	msiexec.exe

Executes dropped EXE 3 IoCs

pid	Process
4268	ScreenConnect.ClientService.exe
4856	ScreenConnect.WindowsClient.exe
2332	ScreenConnect.WindowsClient.exe

Loads dropped DLL 42 IoCs

pid	Process
2552	MsiExec.exe
4728	rundll32.exe
4728	rundll32.exe
4728	rundll32.exe
4728	rundll32.exe
4728	rundll32.exe
4728	rundll32.exe
4728	rundll32.exe
4728	rundll32.exe
4728	rundll32.exe
2552	MsiExec.exe
3380	rundll32.exe
3380	rundll32.exe
3380	rundll32.exe
3380	rundll32.exe
3380	rundll32.exe
3380	rundll32.exe
3380	rundll32.exe
3380	rundll32.exe
3380	rundll32.exe
2552	MsiExec.exe
3220	rundll32.exe
3220	rundll32.exe
3220	rundll32.exe
3220	rundll32.exe
3220	rundll32.exe
3220	rundll32.exe
3220	rundll32.exe
3220	rundll32.exe
3220	rundll32.exe
1408	MsiExec.exe
3172	MsiExec.exe
4268	ScreenConnect.ClientService.exe
4268	ScreenConnect.ClientService.exe
4268	ScreenConnect.ClientService.exe
4268	ScreenConnect.ClientService.exe
4268	ScreenConnect.ClientService.exe
4268	ScreenConnect.ClientService.exe
4268	ScreenConnect.ClientService.exe
4268	ScreenConnect.ClientService.exe
4268	ScreenConnect.ClientService.exe
4268	ScreenConnect.ClientService.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ScreenConnect.ClientService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ScreenConnect.ClientService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ScreenConnect.WindowsClient.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ScreenConnect.WindowsClient.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenConnect.ClientService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-30_e9112cf6139dcd6a8357c86527063392_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000b02efcd1ac1ce3290000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801b02efcd10000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101b02efcd1000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3b02efcd100000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6b02efcd100000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ScreenConnect.WindowsClient.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ScreenConnect.WindowsClient.exe

Modifies data under HKEY_USERS 13 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.ClientService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.ClientService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.WindowsClient.exe

Modifies registry class 37 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8C6AC063390021EEF71D2B1397836318\SourceList\Media\1 = ";"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-ea7f00c870e27815\UseOriginalUrlEncoding = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-ea7f00c870e27815	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-ea7f00c870e27815\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8C6AC063390021EEF71D2B1397836318\Full	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8C6AC063390021EEF71D2B1397836318\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\73C471878B1D552BAEF7008C072E8751\8C6AC063390021EEF71D2B1397836318	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-ea7f00c870e27815\shell\open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-ea7f00c870e27815\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (ea7f00c870e27815)\\ScreenConnect.WindowsClient.exe\" \"%1\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-DA2D-424F266F7580}\InprocServer32\ = "C:\\Program Files (x86)\\ScreenConnect Client (ea7f00c870e27815)\\ScreenConnect.WindowsCredentialProvider.dll"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8C6AC063390021EEF71D2B1397836318\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-ea7f00c870e27815\URL Protocol	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-DA2D-424F266F7580}\ = "ScreenConnect Client (ea7f00c870e27815) Credential Provider"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8C6AC063390021EEF71D2B1397836318\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\73C471878B1D552BAEF7008C072E8751	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-DA2D-424F266F7580}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-DA2D-424F266F7580}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8C6AC063390021EEF71D2B1397836318\ProductName = "ScreenConnect Client (ea7f00c870e27815)"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8C6AC063390021EEF71D2B1397836318\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8C6AC063390021EEF71D2B1397836318\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-ea7f00c870e27815	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-ea7f00c870e27815\shell	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8C6AC063390021EEF71D2B1397836318	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8C6AC063390021EEF71D2B1397836318\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8C6AC063390021EEF71D2B1397836318\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\26.7.2.9754\\ea7f00c870e27815\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8C6AC063390021EEF71D2B1397836318\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8C6AC063390021EEF71D2B1397836318\ProductIcon = "C:\\Windows\\Installer\\{360CA6C8-0093-EE12-7FD1-B23179383681}\\DefaultIcon"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8C6AC063390021EEF71D2B1397836318\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8C6AC063390021EEF71D2B1397836318\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\26.7.2.9754\\ea7f00c870e27815\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-ea7f00c870e27815\shell\open\command	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8C6AC063390021EEF71D2B1397836318\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8C6AC063390021EEF71D2B1397836318\SourceList\PackageName = "ScreenConnect.ClientSetup.msi"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8C6AC063390021EEF71D2B1397836318\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-DA2D-424F266F7580}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8C6AC063390021EEF71D2B1397836318	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8C6AC063390021EEF71D2B1397836318\PackageCode = "8C6AC063390021EEF71D2B1397836318"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8C6AC063390021EEF71D2B1397836318\Version = "436666370"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5456	msiexec.exe
5456	msiexec.exe
4268	ScreenConnect.ClientService.exe
4268	ScreenConnect.ClientService.exe
4268	ScreenConnect.ClientService.exe
4268	ScreenConnect.ClientService.exe
4268	ScreenConnect.ClientService.exe
4268	ScreenConnect.ClientService.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4504	2026-09-30_e9112cf6139dcd6a8357c86527063392_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe
Token: SeShutdownPrivilege	5788	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5788	msiexec.exe
Token: SeSecurityPrivilege	5456	msiexec.exe
Token: SeCreateTokenPrivilege	5788	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5788	msiexec.exe
Token: SeLockMemoryPrivilege	5788	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5788	msiexec.exe
Token: SeMachineAccountPrivilege	5788	msiexec.exe
Token: SeTcbPrivilege	5788	msiexec.exe
Token: SeSecurityPrivilege	5788	msiexec.exe
Token: SeTakeOwnershipPrivilege	5788	msiexec.exe
Token: SeLoadDriverPrivilege	5788	msiexec.exe
Token: SeSystemProfilePrivilege	5788	msiexec.exe
Token: SeSystemtimePrivilege	5788	msiexec.exe
Token: SeProfSingleProcessPrivilege	5788	msiexec.exe
Token: SeIncBasePriorityPrivilege	5788	msiexec.exe
Token: SeCreatePagefilePrivilege	5788	msiexec.exe
Token: SeCreatePermanentPrivilege	5788	msiexec.exe
Token: SeBackupPrivilege	5788	msiexec.exe
Token: SeRestorePrivilege	5788	msiexec.exe
Token: SeShutdownPrivilege	5788	msiexec.exe
Token: SeDebugPrivilege	5788	msiexec.exe
Token: SeAuditPrivilege	5788	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5788	msiexec.exe
Token: SeChangeNotifyPrivilege	5788	msiexec.exe
Token: SeRemoteShutdownPrivilege	5788	msiexec.exe
Token: SeUndockPrivilege	5788	msiexec.exe
Token: SeSyncAgentPrivilege	5788	msiexec.exe
Token: SeEnableDelegationPrivilege	5788	msiexec.exe
Token: SeManageVolumePrivilege	5788	msiexec.exe
Token: SeImpersonatePrivilege	5788	msiexec.exe
Token: SeCreateGlobalPrivilege	5788	msiexec.exe
Token: SeCreateTokenPrivilege	5788	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5788	msiexec.exe
Token: SeLockMemoryPrivilege	5788	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5788	msiexec.exe
Token: SeMachineAccountPrivilege	5788	msiexec.exe
Token: SeTcbPrivilege	5788	msiexec.exe
Token: SeSecurityPrivilege	5788	msiexec.exe
Token: SeTakeOwnershipPrivilege	5788	msiexec.exe
Token: SeLoadDriverPrivilege	5788	msiexec.exe
Token: SeSystemProfilePrivilege	5788	msiexec.exe
Token: SeSystemtimePrivilege	5788	msiexec.exe
Token: SeProfSingleProcessPrivilege	5788	msiexec.exe
Token: SeIncBasePriorityPrivilege	5788	msiexec.exe
Token: SeCreatePagefilePrivilege	5788	msiexec.exe
Token: SeCreatePermanentPrivilege	5788	msiexec.exe
Token: SeBackupPrivilege	5788	msiexec.exe
Token: SeRestorePrivilege	5788	msiexec.exe
Token: SeShutdownPrivilege	5788	msiexec.exe
Token: SeDebugPrivilege	5788	msiexec.exe
Token: SeAuditPrivilege	5788	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5788	msiexec.exe
Token: SeChangeNotifyPrivilege	5788	msiexec.exe
Token: SeRemoteShutdownPrivilege	5788	msiexec.exe
Token: SeUndockPrivilege	5788	msiexec.exe
Token: SeSyncAgentPrivilege	5788	msiexec.exe
Token: SeEnableDelegationPrivilege	5788	msiexec.exe
Token: SeManageVolumePrivilege	5788	msiexec.exe
Token: SeImpersonatePrivilege	5788	msiexec.exe
Token: SeCreateGlobalPrivilege	5788	msiexec.exe
Token: SeCreateTokenPrivilege	5788	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5788	msiexec.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
5788	msiexec.exe
5788	msiexec.exe
4856	ScreenConnect.WindowsClient.exe
4856	ScreenConnect.WindowsClient.exe
4856	ScreenConnect.WindowsClient.exe
4856	ScreenConnect.WindowsClient.exe
4856	ScreenConnect.WindowsClient.exe

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
4856	ScreenConnect.WindowsClient.exe
4856	ScreenConnect.WindowsClient.exe
4856	ScreenConnect.WindowsClient.exe
4856	ScreenConnect.WindowsClient.exe
4856	ScreenConnect.WindowsClient.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
5788	msiexec.exe
5456	msiexec.exe
2552	MsiExec.exe
1408	MsiExec.exe
3172	MsiExec.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4504 wrote to memory of 5788	4504	2026-09-30_e9112cf6139dcd6a8357c86527063392_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe	89
PID 5456 wrote to memory of 2552	5456	msiexec.exe	91
PID 2552 wrote to memory of 4728	2552	MsiExec.exe	92
PID 2552 wrote to memory of 3380	2552	MsiExec.exe	93
PID 2552 wrote to memory of 3220	2552	MsiExec.exe	94
PID 5456 wrote to memory of 1212	5456	msiexec.exe	100
PID 5456 wrote to memory of 1408	5456	msiexec.exe	102
PID 5456 wrote to memory of 3172	5456	msiexec.exe	103
PID 4268 wrote to memory of 4856	4268	ScreenConnect.ClientService.exe	106
PID 4268 wrote to memory of 2332	4268	ScreenConnect.ClientService.exe	107

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-09-30_e9112cf6139dcd6a8357c86527063392_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-30_e9112cf6139dcd6a8357c86527063392_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4504
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\26.7.2.9754\ea7f00c870e27815\ScreenConnect.ClientSetup.msi" SC_EXE_PATH="C:\Users\Admin\AppData\Local\Temp\2026-09-30_e9112cf6139dcd6a8357c86527063392_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe"
  2⤵
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:5788

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Boot or Logon Autostart Execution: Authentication Package
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5456
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 90036D42BFBFF565082332AAF019042D C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2552
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI2F92.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240726109 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:4728
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI336B.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240726921 11 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.CheckMsiMotw
    3⤵
    - Badlisted process makes network request
    - Loads dropped DLL
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    PID:3380
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI3929.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240728609 18 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.CheckMsiFileName
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:3220
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:1212
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding FBE27E0A29D2EDACAD5ED5C120731A5B
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1408
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 0C81167AFC5252DCEC44551F878DDF4F E Global\MSI0000
  2⤵
  - Drops file in Windows directory
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3172

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:2340

C:\Program Files (x86)\ScreenConnect Client (ea7f00c870e27815)\ScreenConnect.ClientService.exe
"C:\Program Files (x86)\ScreenConnect Client (ea7f00c870e27815)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=instance-wyl5dg-relay.screenconnect.com&p=443&s=f43551ef-009e-4e36-8ace-ba19b1a0179c&k=BgIAAACkAABSU0ExAAgAAAEAAQAZhfNsnlCxl44DiqF%2fSjjyzm5bIkvBiJL5PI3io9zcg3v6ipXMk1PdWcCddZfkgPX1X57090KDVrxI61c4uqKTMUQOwUwMUsUDto6skFILk9Gxq98NsLmDdXpRZbCgJeElRkYBe9LkQxG3qCvhb%2beNygK%2b%2bRgWa9aXiUcVdRvviTbkloiSGHZByO31Vf%2bEwtYRv5uqfKDRs8FshkOd3vy%2bFP5FtUb5WTfPu99JbG566ci047pLYqZYU0DRVzG2S4dOd3OT%2f%2f2aXw7OXMEYD1%2ffjxC2DflaPaDAzQYYOA6dDsoui6%2fADeKVEZ5BjC8icnXc%2bzVEgxAnbdV8Ry3qdZrJ&c=Don&c=&c=&c=&c=&c=&c=&c="
1⤵
- Sets service image path in registry
- Drops file in System32 directory
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4268
- C:\Program Files (x86)\ScreenConnect Client (ea7f00c870e27815)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (ea7f00c870e27815)\ScreenConnect.WindowsClient.exe" "RunRole" "850c9f60-a6be-4036-8f59-8b6f37d3b370" "User"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:4856
- C:\Program Files (x86)\ScreenConnect Client (ea7f00c870e27815)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (ea7f00c870e27815)\ScreenConnect.WindowsClient.exe" "RunRole" "df7821c2-97a3-4f17-a568-77e4cc0c1b1d" "System"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  PID:2332

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59841b.rbs

Path C:\Config.Msi\e59841b.rbs
Size 214KB
SHA256 c962821c07a0f6e545c51f60ae5211bc4094f796b416511f514f48791efe0ae4
MD5 852258035341e460f510c9b174c8bf45
SHA1 fa380a6b267a099c58522c2c043eb2ca06ec93a5
SHA512 6ad515c2eb33ff96c5c4c6561235d28006ee818f267cfdc9653bd41a533b243281f90814522be6744b55793f552837ef46802dfe6dfe657a6c60312c8f76df37
SSDEEP 3072:2p9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG8:2puH2aCGw1ST1wQLdqv8
TLSH
T103248C227480807EE7FA1A36D93F9A61BE7DF6240760C59EC3848C1E5D604D06BF6B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.Override.en-US.resources

Path C:\Program Files (x86)\ScreenConnect Client (ea7f00c870e27815)\Client.Override.en-US.resources
Size 256B
SHA256 28b9226583d81800feaa9909bd0b0bf8a44bcbd97e66246c1d17162582fd46b3
MD5 f3388c7522bf6cc666d66139887c165e
SHA1 9ef41c7cbb83dc7f92614086d497b9d6be84eec9
SHA512 a00217fb2cc0ec5036fda34fdc7044aa203a36a8ef1618d5421575c47d56b21420ed29ccb5023f1d07403a4c7ee66de7dffc2b98d9a2e600cef1624135a643c1
TLSH
T1B0D0A723075C50B9D9320E7B145862C20327D9059434552D9C94113DAEB2213CB92F77
MD5 SHA1 SHA512 TLSH

Submit Download

Client.en-US.resources

Path C:\Program Files (x86)\ScreenConnect Client (ea7f00c870e27815)\Client.en-US.resources
Size 65KB
SHA256 bd8901dd3666277f6d7aa1f4118ad53f5d4229c5d9f67f94e635bf2add3731dd
MD5 7596549052e6f60e5a50b72fbabbbc52
SHA1 b79c87fba66c4256b2bd8dbfa4e28f7e164b127a
SHA512 33d628e724a74a903c83fc830fa60e70bf2ddd89de8071184a5079cd601a354bbf2f50756ee7348bbbfcaed2f10fe0d1fd21ab547147fc13f142b4b27ba2b714
SSDEEP 1536:391nDzSbBYQdQ5Fe2rmcPpZfjZ8peFTp9EwILThIKC1QzpbLeMarw:391DzSbaQCe2rmcPpZfjZ8peFTp9EwII
TLSH
T10C531D1277FD0A18F5F36F75BE7A94619937BC5A2E25C06E1028854E0972F80C9B2773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.resources

Path C:\Program Files (x86)\ScreenConnect Client (ea7f00c870e27815)\Client.resources
Size 6KB
SHA256 bd34378ad99f7609fa0c7c8edde6337c738a61d288863015629329806a1cc728
MD5 1e863134f29bcabe1ee571c91ac4fbe6
SHA1 57cc5966fcae49019da5f8f507c840cedfc103f4
SHA512 7e2640c4ddb8719230de0ddb0d18f9a4b1499a037247f12b142b1c16a2a989390abcb5ac7816a63dbce2d43c08510cec7cfc87cd24458bc2fa919c396b36d4f9
SSDEEP 192:rpDZHfbkqYvZJG293IIs1Z4EO/nM3ZWYijpo2YG:rRZjkqYxJ3JI/sMJ/ijp/p
TLSH
T1D8D13BC49BFEAC3CF05E51BE3A7692990275FF113AA3C3582460106A7F228856C56737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll

Path C:\Program Files (x86)\ScreenConnect Client (ea7f00c870e27815)\ScreenConnect.Client.dll
Size 626KB
SHA256 99022250565e17f1545dcf99705003b9a54c93a039117c1b24c4550302cd07f0
MD5 982082fc06eebcae9c8e815d980e5f21
SHA1 48f1dad4bdfaf385c420f6f7586489837abf57d4
SHA512 b3f4354dff3cb1d95c049a449eed6103ce0af13621b2ae0951e043591ad77b4ffc9c90c73ee4b4cc1bbfb2fee21cf0911b348e0308b150a4bc7c7431c1aece1f
SSDEEP 12288:3Tn9Z1qMwReVMwsqviT2kkNv+zHTEavSW7OQniukGnKATV4:DLrviT/k6zEn8qu7KE4
TLSH
T15ED4C04EABD1991DED6E0B33E5912360DEB02CCA8597E72F2C2876B90D323C5668C1D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Program Files (x86)\ScreenConnect Client (ea7f00c870e27815)\ScreenConnect.ClientService.dll
Size 176KB
SHA256 b6c17ce1623c79f82db57d6e81c19533ba31704f8cb743901de114e208aec267
MD5 8254cbdcf429eb7f8a3347915cb338ed
SHA1 3cd26d9da09ecb177b6fa3c2a08d7988effd7cc6
SHA512 28b06a8c61a9e9deacaf87696fec66cbec84f13894963160ce7d3e4a86a25b901809882a28c7c7150f2e77fb584d36897da8d9c8f13cdd69ef31e881c9e69a18
SSDEEP 3072:Uymqqa3r9domas9/DuDHarMgxHC7Jn4rKbAfp1o0SQAVvRxjQOdc:Uy9qa7SjarMg4dny8AfhSnvjk
TLSH
T16E04AF49BF5AD926E49E0D32B424B2604BF274A2C9E6C79F2C9431FF6D163D12B442CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Program Files (x86)\ScreenConnect Client (ea7f00c870e27815)\ScreenConnect.ClientService.exe
Size 93KB
SHA256 00fcff730f9287d389de239f98067d33ced439db7c63303685dd89406178f223
MD5 6bd02189b1652252a89042c2c14243e4
SHA1 0340d679cc9e7481961c69b5791cc47f58824ff5
SHA512 e21b70503db23fff07d7b7b662ad5447580b90e07769fbf6170db64675375e6e1ba894cf7a7dc3ba7ce37160a17b75902dc202bef281d1323ddea1f2abee326f
SSDEEP 1536:1g1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgQU0HM67/+Y:WhbNDxZGXfdHrX7rAc6myJkgQU0Hbbx
TLSH
T13E935B13B5C28872D473093158E0DAB49A7FF9615E21DEEB3788022A4F741C1AE75EB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Program Files (x86)\ScreenConnect Client (ea7f00c870e27815)\ScreenConnect.Core.dll
Size 1.3MB
SHA256 6df43ab8382253d8ccdf78ff85e05d2e976932e45279c44974130c356d7e5685
MD5 4c4b1bb72c0f2fdb8d3656380582015e
SHA1 544b9429a084c509a13f71d494a4928f739adc84
SHA512 7509bff12a3ff189011a6762c7dc68a8b9d850a1bc74a394829c716890f1e2fe91c709ffe1634061b463d8c60fb1bee53d603b4b5f2e587c2fe36e6b977cb2fd
SSDEEP 24576:yAMrfURMaRbs/0mO6iC93ngDQaqtyOqmjsRa+:yAMrfU6WGnBgpYqmr+
TLSH
T171557D49BF85AB1BCC2D1672582063405BB0D0905AA3DB8F79F8B73E5D873982DC91ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Program Files (x86)\ScreenConnect Client (ea7f00c870e27815)\ScreenConnect.Windows.dll
Size 1.9MB
SHA256 0b20fac87e79850fedeb2ef4bee3e4b2602f92992ece03083c83a29dfb7e7f0a
MD5 91cf3c75ec3edb3f2cd6df59b415bd8d
SHA1 582df3e1e5a0c40ca68fb62232b47ba9325a7a82
SHA512 ce81350ebda30a145b7da2f1f9413252895dd7822924c1d0a2ca2a700cb4624e59ce53c88c081a8a8687771a2663218e624ee57e0b1fa2682afbcae2d10ce114
SSDEEP 24576:zSHF+GcvnrFj+Ifz3zvnXj/zXzvAAkGz8mvgt379S+2bfR+RfmTk1krT1iH4Sqfz:DGeJkGYYZTk+T1iH7efPfL5
TLSH
T17295AD45F6C368F6D46B053888BEA72AB7743C040315CAFB97C4AA396D337C09A36795
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsAuthenticationPackage.dll

Path C:\Program Files (x86)\ScreenConnect Client (ea7f00c870e27815)\ScreenConnect.WindowsAuthenticationPackage.dll
Size 254KB
SHA256 a5b8f0070201e4f26260af6a25941ea38bd7042aefd48cd68b9acf951fa99ee5
MD5 5adcb5ae1a1690be69fd22bdf3c2db60
SHA1 09a802b06a4387b0f13bf2cda84f53ca5bdc3785
SHA512 812be742f26d0c42fdde20ab4a02f1b47389f8d1acaa6a5bb3409ba27c64be444ac06d4129981b48fa02d4c06b526cb5006219541b0786f8f37cf2a183a18a73
SSDEEP 3072:qJvChyA4m2zNGvxDd6Q6dtaVNVrlaHpFahvJ9ERnWtMG8Ff2lt9Bgcld5aaYxg:0IvxDdL6d8VNdlC3g0RCXh5D
TLSH
T1C5448E15B7A40CB4EC77823888535A06E776BC160760E6CF03E0825ADF6F7D1A63E762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Program Files (x86)\ScreenConnect Client (ea7f00c870e27815)\ScreenConnect.WindowsClient.exe
Size 1.6MB
SHA256 50545c58d0aed811c5c9f803f9c1636501d47a7a388dfb30cbb9bb0232f53e4e
MD5 03372475a6891cc5588d72fc5794774f
SHA1 08c8a0d3afb2230eb67ca5c164d81e54a9ebde81
SHA512 1105ec1dc5f2f6d3fc489c3f9066306b377fd7474998a066f0b7968acfd091d456a3b5a2dcdf37f2cb2cf515a4ad75ea59b23c16e0faf2620aa74d63a89c4659
SSDEEP 24576:Md1RaADaOPdzpYHiIzFrJ/8Nj0Hf40svOVRewE+mWQiq5EhDazadbt+Kj9wDd14x:MdPaifGF184F4GQrzIlKfBK
TLSH
T1A175BF497FD8EE67C96F0B3B68601204BBB08495DB67CB4B6894BB7E0D813C46D056CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Program Files (x86)\ScreenConnect Client (ea7f00c870e27815)\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
TLSH
T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsCredentialProvider.dll

Path C:\Program Files (x86)\ScreenConnect Client (ea7f00c870e27815)\ScreenConnect.WindowsCredentialProvider.dll
Size 837KB
SHA256 007d698b6f330966e1018715f870b8ae0d1654fea08b71c53c8be1c9daa4ec61
MD5 b51bcc014411f3d810479e714cac6130
SHA1 91bd19c14c3e1721570e25271e156ac08e6e211a
SHA512 87c7ea578c74c8f89f722194eb4f546a4b5d8f42a99b7746f5b922afc7cee4999c0ebce479fe565c3fd67421966c614c1c0f55540b96fe24761345189897f8e8
SSDEEP 12288:YhPu/v5a+Hq+Mu4VrDgKOxbPEYK/TVdHOX:BvNH1Mu4VrDgK6byTVdHOX
TLSH
T1C3055B1BE79444B9C0ADC2B5C35B9736ABF5F4864A14B68F0BD40A227E3BF509B1D384
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.config

Path C:\Program Files (x86)\ScreenConnect Client (ea7f00c870e27815)\system.config
Size 966B
SHA256 9e95fffe145932b499af5004da0a4fa8431a381bda444829c0f3173ef1fd17cb
MD5 7f670b4aaf9f105d266ee7b40a73b378
SHA1 002e3270d06bbcb69605a5725d2fae34c0a186e2
SHA512 0f76ae4b2788d2336a6b84d53cb534c6a43e8f5707b3f6fafe606f78965837341bc93e0be06c24cdcee841cc1cc0af8ab8571c3f4d235d5040d78f9db3e2e17f
TLSH
T1F611447032C0691605B21D32C5014784FEB7579F2058108CB2AE037FAB755DB07A369D
MD5 SHA1 SHA512 TLSH

Submit Download

MSI2F92.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI2F92.tmp
Size 1.8MB
SHA256 111623b4d09b95f0252e26c67bee23f92e90aa56bca588f1b951d424e7bad996
MD5 8da8d914f3f0f0d1328e00dd77b7632e
SHA1 64659e9fbdd79ff3e9ecde549ae50ac1829fca18
SHA512 9716acf84a5d8bdff5081c38429a364a9e1dd233b5e17a3550c737052fe71763f553a994bbafdde254b351b151d21932222679d78372ed96ce340205e7c07e88
SSDEEP 49152:AGXTMptpwZ/1qSbc3CDsBAkgJ8phkZddQKlUf:AGjMpTw/w3CDsB0JCheQm2
TLSH
T17C95333177B28532F79529763FB0A3642EBE78A01AF0C24A3B4D1A5C5E24B41F959733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Deployment.WindowsInstaller.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI2F92.tmp-\Microsoft.Deployment.WindowsInstaller.dll
Size 172KB
SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
MD5 5ef88919012e4a3d8a1e2955dc8c8d81
SHA1 c0cfb830b8f1d990e3836e0bcc786e7972c9ed62
SHA512 4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684
SSDEEP 3072:FkfZS7FUguxN+77b1W5GR69UgoCaf8TpCnfKlRUjW01Ky4:x+c7b1W4R6joxfQE
TLSH
T14E045B2563FC473ECAEF87B4E2624251E7B2E2E97113DB0DDC8541AA2522780F792753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI2F92.tmp-\ScreenConnect.Core.dll
Size 1.3MB
SHA256 d6847d41b37f1760273deb8cca72b1ddafeb49286f1420ea0430b8932786bee3
MD5 965eca4cfa5e8c953deb2d011114e004
SHA1 3ed9c0702476cbdd9b71817b3fa16c550eab99bc
SHA512 04a015718cd9af209229b33f0a48d0f5a5d5df44d6d1cae7dd4f5b66305c1b75c62354fd72d4c1c584cbc05c72f6108995a231084fdb3e639b3c733ae5dcd51c
SSDEEP 24576:sAMrfURMaRbs/0mO6iC93ngDQaqtyOqmjsRa:sAMrfU6WGnBgpYqmr
TLSH
T1CE557C49BF86AB1BCC2D1672582063405BB0D0905AA3DB8F79F8B73D5D873982DC91ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.InstallerActions.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI2F92.tmp-\ScreenConnect.InstallerActions.dll
Size 24KB
SHA256 a5ae13cac4226eacde58262590d05081eab95cbf5f034fb4944ee88efa8097e7
MD5 f2d92986f9f88f2c8c4fbd68d21f7c95
SHA1 252de888c0a7dbe6474a1b5f5a523a415232b04c
SHA512 0e29ac1df6ea20dada88fdfa79bce5953ad8e903046106028f726fbba057dd1bc41a11ff092c25d276ddafe538b92fe4837790215158e806aa7e9a8c0e7c3606
SSDEEP 384:EoAazzV1VTsaS8hQlLkmoAQV7NaNeirM0dbMsFkjvZB120Rrt0:HAazC9QVMcLvrw
TLSH
T137B2D720674DE27AF9EA1634B563FBB001B3BDB3CCE9DA8565A420153D253E04FB5B06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI2F92.tmp-\ScreenConnect.Windows.dll
Size 1.9MB
SHA256 4ab116d00b89ec33c28ebaffaaf0c105057136bdb7c192853bf07ac15bd99567
MD5 5c219902addb58a98034d0f119a72ae6
SHA1 2e4332f9af50404721f5cf47f103ad1eb9d29e61
SHA512 c6a20c9ef30fdd1f21b6dcb226ef5d1ecfa1c4423146257cb9c7d1a03212618cb4b6ce0ecbeaf823d2cc42fcf74acfd725f31e62b46c4da7b4cb6f5a5731c10f
SSDEEP 24576:sSHF+GcvnrFj+Ifz3zvnXj/zXzvAAkGz8mvgt379S+2bfR+RfmTk1krT1iH4Sqf1:mGeJkGYYZTk+T1iH7efPfL
TLSH
T14595AD45F6C368F6D46B053888BEA72AB7743C040315CAFB97C4AA396D337C09A36795
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CustomAction.config

Path C:\Users\Admin\AppData\Local\Temp\MSI336B.tmp-\CustomAction.config
Size 234B
SHA256 7027b69ab6ebc9f3f7d2f6c800793fde2a057b76010d8cfd831cf440371b2b23
MD5 6f52ebea639fd7cefca18d9e5272463e
SHA1 b5e8387c2eb20dd37df8f4a3b9b0e875fa5415e3
SHA512 b5960066430ed40383d39365eadb3688cadadfeca382404924024c908e32c670afabd37ab41ff9e6ac97491a5eb8b55367d7199002bf8569cf545434ab2f271a
TLSH
T18CD0A70405D0FD1B5E231A2337524559FF34B1E290A44408B06F3A130A220CD4757317
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsInstaller.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI336B.tmp-\ScreenConnect.WindowsInstaller.dll
Size 400KB
SHA256 cb5617217783d9e1c2e06d9153490f12673a243eec3f665a0a3f8874da810c0a
MD5 0409f697bb7ced9cc2e7686fa836eafa
SHA1 48c88c7d2c24d899503756f22b5da1f266e87fca
SHA512 e85873ba8a96c6d9bb2f1a896504c7baf2a4e7ac766e997d206bb2f5bf7cbd6a634c2dab1359339a296a7290ddf3c9f4523c67e5b06acca844d7a9fc01a74c4d
SSDEEP 6144:MfbQXk3HCzi69A5cJfROOafFhcBluJa2mURcxuRGTIUZidxkvSa0/Xyhw:MfEYizvAM5OouOUSm2idxkvc/XN
TLSH
T16C949D2DBF8EA616FB1E0B77C451B210A7F0A0A71D9BC34F6DA9366D6C003D427952C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientSetup.msi

Path C:\Users\Admin\AppData\Local\Temp\ScreenConnect\26.7.2.9754\ea7f00c870e27815\ScreenConnect.ClientSetup.msi
Size 19.6MB
SHA256 3780a2063bab24745bcc979a08443e27023467089fad13d3ff9e94214c2a7a9e
MD5 06a32dc25d3d9640505828022ba0c945
SHA1 c77b34bdd383014498820a29e52515dc4f5b9280
SHA512 6865987a9aa3f03af89dbd3fd3b356df836e6c57e57879792f06a68657a5e8fff005bfe24adab5d9f349e705748d40236c57b54d38313d5571511e13c7e3c1ea
SSDEEP 393216:14kPAN3tqMjTpT4SDsHNmx4kPAN3tqMjt4kPAN3tqMjd4kPAN3tqMjf4kPAN3tqu:2IA1tqutEo+XIA1tquOIA1tqu+IA1tqV
TLSH
T15F27331433FD8125E8F62A38EE36C8A119717C45AE62C01F9322B45EAA7AD41D5F3773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI8AC3.tmp

Path C:\Windows\Installer\MSI8AC3.tmp
Size 202KB
SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
MD5 ba84dd4e0c1408828ccc1de09f585eda
SHA1 e8e10065d479f8f591b9885ea8487bc673301298
SHA512 7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290
SSDEEP 3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
TLSH
T129147C326494803EE7F91A36D93E9A61AE7DF6241760C99EC3848C0E5D604D06BF7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4m53ygwv.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (ea7f00c870e27815)\4m53ygwv.newcfg
Size 883B
SHA256 1e5ec45dd2e795fc9dcfe7af38a039704994fc97e35496e3672bd16edca13e36
MD5 97fe8969517cb1b192bdfcb5a2a07c90
SHA1 e67b56ba05bb97bc9590ef733ec727a5c7056e24
SHA512 9138b9c3db40bdce92901be6a464ec87d57bad9798e3995b92b30660791c58c667ee1cb7eba9642720b4c3e4388f84c553556cf3fd75d45fdc13bbd6c2f204e8
TLSH
T13411895871C09E4602B72E32E5314345FDB11A5702B570D874AE22375F705CF03E32EA
MD5 SHA1 SHA512 TLSH

Submit Download

h2t2yi4x.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (ea7f00c870e27815)\h2t2yi4x.newcfg
Size 683B
SHA256 65f81fc0e73e73314037f4fc062ae1a5f11b33aa867abcffe38057a33e3f8a88
MD5 afee6a3917fb2c35db2c1f673655a60e
SHA1 bcac34ddbd5dee7ef4eedfbe58a91fdfb8ffc130
SHA512 9c54494d548567b572c45608155b0fe9f4508caf883bb82edb37e33b08bb3d35fbc57d167b7f0959311f65427611824d091aa5a280f1bc1312e25235f14c91a5
TLSH
T13201F46571C0AE5702A36E32DA218345FE715A5B026520D874AE223B5F715CF07E32DA
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (ea7f00c870e27815)\user.config
Size 520B
SHA256 4042c442059aeabd5fffcc257f268576864948f0be0f434a8cd307bd7367b92e
MD5 39d552ce225a0a3c51977cde084a66a6
SHA1 9d41d929d04eccb6b36169c869d15d3673eae7e8
SHA512 64a1715ef14dc35ec128c906b54cad246eb17767927629810ac536dfe10fe13a1a46802305df7c8650f1cf9a283c5d843466506e2be6c069b0d6a4b3217538cf
TLSH
T10FF02EA131C06E4703635E33C5158741FE726B9B0551249874AF223B5F315CE03A32DE
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2332-227-0x00000000013B0000-0x00000000013F1000-memory.dmp

Download

memory/3380-75-0x0000000003370000-0x00000000033DA000-memory.dmp

Download

memory/4268-176-0x0000000003EE0000-0x0000000003F30000-memory.dmp

Download

memory/4268-199-0x00000000048A0000-0x0000000004976000-memory.dmp

Download

memory/4268-159-0x0000000003FF0000-0x0000000004142000-memory.dmp

Download

memory/4268-197-0x0000000003F60000-0x0000000003FA1000-memory.dmp

Download

memory/4268-163-0x0000000004330000-0x0000000004510000-memory.dmp

Download

memory/4268-153-0x0000000003D20000-0x0000000003D50000-memory.dmp

Download

memory/4268-195-0x0000000004610000-0x00000000046B0000-memory.dmp

Download

memory/4504-12-0x00000000748D0000-0x000000007508C000-memory.dmp

Download

memory/4504-10-0x00000000748D0000-0x000000007508C000-memory.dmp

Download

memory/4504-1-0x00000000043A0000-0x00000000043A8000-memory.dmp

Download

memory/4504-7-0x00000000073E0000-0x000000000799A000-memory.dmp

Download

memory/4504-8-0x0000000006F20000-0x0000000006FB2000-memory.dmp

Download

memory/4504-9-0x00000000748D0000-0x000000007508C000-memory.dmp

Download

memory/4504-2-0x00000000069C0000-0x00000000069CC000-memory.dmp

Download

memory/4504-6-0x0000000006C30000-0x0000000006E10000-memory.dmp

Download

memory/4504-0-0x00000000748E2000-0x00000000748E3000-memory.dmp

Download

memory/4504-5-0x0000000006BC0000-0x0000000006C2A000-memory.dmp

Download

memory/4504-3-0x00000000748D0000-0x000000007508C000-memory.dmp

Download

memory/4504-4-0x0000000006A50000-0x0000000006BA2000-memory.dmp

Download

memory/4728-45-0x0000000005AE0000-0x0000000005CC0000-memory.dmp

Download

memory/4728-37-0x00000000034E0000-0x00000000034EC000-memory.dmp

Download

memory/4728-41-0x00000000057A0000-0x00000000058F2000-memory.dmp

Download

memory/4728-33-0x00000000034A0000-0x00000000034CE000-memory.dmp

Download

memory/4856-220-0x000000001B2C0000-0x000000001B360000-memory.dmp

Download

memory/4856-219-0x00000000004D0000-0x000000000066C000-memory.dmp

Download

memory/4856-222-0x000000001BB00000-0x000000001BCE0000-memory.dmp

Download

memory/4856-221-0x000000001B7C0000-0x000000001B912000-memory.dmp

Download

memory/4856-223-0x000000001B220000-0x000000001B250000-memory.dmp

Download

memory/4856-224-0x000000001BCE0000-0x000000001BE68000-memory.dmp

Download

memory/4856-225-0x0000000000ED0000-0x0000000000F11000-memory.dmp

Download