Analysis
- max time kernel
148s - max time network
137s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/10/2026, 10:48
Behavioral task
behavioral1
Sample
2026-10-01_7ce801ca173aa4a6a39813d2acdb3864_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
25 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-01_7ce801ca173aa4a6a39813d2acdb3864_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
25 signatures
150 seconds
General
- Target 2026-10-01_7ce801ca173aa4a6a39813d2acdb3864_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe
- Size 12.0MB
- Sample261002-mv98maxfpb
- SHA256 a8307c1fd91a90df3253569a836c6ba1100ba5d9ccbbd805d2b8296f2606ebc3
- MD5 7ce801ca173aa4a6a39813d2acdb3864
- SHA1 2a81e18ae38d6c5cffbe7116a90354caad1ceab6
- SHA512 59f86eefdadc0753d2ae0313edb28f99e747c3c91f4dd4a2138f655ece78d5325dfa1f516829fae865881b88709f57a002c4b4537cfc7c8a489879a4611af35b
- SSDEEP 196608:9HfefPVksuCcGaDpxmcYMDgsuCcGaDpPsuCcGaDpAsuCcGaDpI:kuGdhMDPuGpuGYuGn
- TLSH T1CFC61201B3D59575D1BB0638E83A92656B35BC149716C7BF1398B9692E33BC08E323B3
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects encrypted or obfuscated .NET executables 1 IoCs
resource yara_rule behavioral2/files/0x001100000001c50c-149.dat INDICATOR_EXE_DotNET_Encrypted - Sets service image path in registry 3 TTPs 1 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (e8fdadd2eb33a1e9)\ImagePath = "\"C:\\Program Files (x86)\\ScreenConnect Client (e8fdadd2eb33a1e9)\\ScreenConnect.ClientService.exe\" \"?e=Access&y=Guest&h=instance-zkex5w-relay.screenconnect.com&p=443&s=aa88360e-69be-4055-9f95-4a2baebe014b&k=BgIAAACkAABSU0ExAAgAAAEAAQDJNR6p%2fe51sOx9sClTXvP42u41gaIwoNAIfvWjWHT3DehvWEJC0NTA7SMoDXF5IR4%2bxcnfIS%2fPVxiPot0zDG15Btcv3rEpMqjrk71CXudNtSpmWqUrYrVOp0RodR619NaeBnC5EyJFkZFOm3DQ7DZXYSBTUROwPYtHaBinwgE%2bfhBEWp928RUB49peykBRTr9wdONAZxYzkf0SEA6WbhHaUCwUQD%2bNMZx7Y9BPSdbMIrSirHa%2f9EieGi5d32eK35U3jj1Wbffhnj8jIRaMWM8vMq7AqVEvto%2bdiH4y5IM%2fohTJlTw4FLsLcTuhSHXjg3gQRHa2Z7JrVDuSWHSuNL%2fD&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAAgmur5uptdkCiRUhzqcqr7wAAAAACAAAAAAAQZgAAAAEAACAAAAAAkFy1GYwpw9QPUeodOs9rl8RnqEF7DTOqEw9EPHHThQAAAAAOgAAAAAIAACAAAAAfpPlvUGMXRXQCP1CJ8XkiIihyPm%2fSd84lShFcmX7FNaAEAACW2oAYC%2fkqDUU2lLQKsXNbBqnqn8uLO0Yr%2f%2b2Nex3DW5DIhtFA0B3ZebXk9nnHK02oUVIW7zzujnpAttZY2DwII%2bfPgArMNeChakWjSLKGKSSIK1WVrPfPIlCG8F6Gc1lDc8UQgY0izYdEbzHDUAdBfLgSkPY7tDEhN05sLyqk0p4vrju9qRQ5mdaBZfc4cTsFqImvNl2LpJxj5aumymPCc2SdCCZg6WUP%2b6xFr2K4JaxN71hMYxCLAqWlRY9A6RecnBs3piwH74oYvCYyH9%2bzhJGoPiOYwyptaERa2OLIRtUsipqnu7i236gUjgw8aVCjAnht62NPQ9Dx3oB185HxIh61WgxYCbV9%2fktD44hYrxWDSAmRRIkmJGTK%2bG9XcDUvRCFX7iaNaylHUmviaCQnGdC%2bzcLE3hVT2kKpbWtLd7vU%2bBc7Sf7WUhfkpQGfVPrsighVV18XJpIp%2bBRAmH2AVVQ2nn3o9hVhlIay9%2b7FL5J1POjz3un7H0tB7cfSqzBm5n247kZg1jFkmlOe2ONqFXWPSJG%2bAtq4vP5Rf0KEmtrwK9mUFDo6qyJe5OL%2fFlJ4QK6R%2biLSToxmYNmb7gKzIclADW1HoPL%2bWOskygdz7c%2fPYbLmOjUGXgAKbNtWDIe7Kb1XFglkgOiSF3mJH1lOd1rnEr9wkzI8dJ4LxUeWA53Z5wdmf5mr%2b1cO7lNyCMhlaCUotvnzS%2fkT5Y740LvjF6MCKQUpaB8HmsKyhMySK3LT%2fD0kRmmS72%2bv45h1nsDD%2bSJCoDIFcwT3wyV7QYkeLBnuef7kRl8DRd6AvFc8aLK9YemtsrniqeDL3p6D%2fhOFEILVlLMEKD7m6o%2fyDceN%2bTkoyQe627nY20BnMGJUWYXgjeC4v6gAlWwMspuiOMgzjZCkIweWj4k%2bsr2dP9wFDqKrN4H4fkfe%2bEENU4kGMnMZmfWEHoUk7svjYX1nwtXtO%2bycIYTZMpRgPYkQ3Fg9Re0EW6E0FQGUv9BiJYB8HZl26HA4pno4PonPKe3FmfeiUWTOGrtcxKDWvp79ppO%2fU%2f94%2bh%2fYjHjc3xLfEM%2f5hx6s%2fCfq0JalqgjPh1iUIvoGBYfKVAS%2bhbTBUkqhhm6N96i2xqxLwvxkYXtPkRwemSJYSa%2bsqxSs3mhxmaZOkFMR%2ft8or7O1MizDdd9IyZw5mLagnbkoX9PWROzFL%2fV80HY8O5w6sfr4D4Oc2GgQGHwDmxHhrb6rAGcKMY6rHWr9bANBY0jRWMLN2xqJc%2bPOKPNckGYJrEYwTdx1HVkeBjd8T1PNky2RSbDnIK9gwT2P%2btkH1QYrzMU5rO2rtRurc3WpTo0RmX8eHS%2b%2bU8Xzb5aMhaduNSCETebWgwYgTvOYoENUFGa7VGEfgLUvjShIiYm4J725Fm3W8ddc5IcsVHXGAbAySTAgkO%2f%2fPkg5PzXc13gg6B8VsD2%2bRkkGP7JKf4oqlEYgokp8Ogzh5%2bux2w%2bUiuATntcXEabEWeVdfy%2fuvrQOKmsJOENOY4uoKooujo81AWn8OG%2fvk%2fCc56PuBTQnJV9MHbEmHjDvl3JXsRZ8WbSCyC%2fTEV56pQQV2V22hUAAAABK6xxnnaunZdw55hyVJ9ty7mLhiIxwNTk7Esum3Pdtqev3tjxvIoLmQRtSe2QjEXV4qMM2HII41fJzT29r%2f%2b3L\"" ScreenConnect.ClientService.exe - Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 7 IoCs
pid Process 2844 ScreenConnect.ClientService.exe 4168 ScreenConnect.WindowsClient.exe 2672 ScreenConnect.WindowsClient.exe 5332 ScreenConnect.ClientSetup.exe 2580 ScreenConnect.ClientService.exe 1732 ScreenConnect.WindowsClient.exe 1976 ScreenConnect.WindowsClient.exe - Loads dropped DLL 44 IoCs
pid Process 2924 MsiExec.exe 2676 rundll32.exe 2676 rundll32.exe 2676 rundll32.exe 2676 rundll32.exe 2676 rundll32.exe 2676 rundll32.exe 2676 rundll32.exe 2676 rundll32.exe 2676 rundll32.exe 3728 MsiExec.exe 1660 MsiExec.exe 2844 ScreenConnect.ClientService.exe 2844 ScreenConnect.ClientService.exe 2844 ScreenConnect.ClientService.exe 2844 ScreenConnect.ClientService.exe 2844 ScreenConnect.ClientService.exe 2844 ScreenConnect.ClientService.exe 2844 ScreenConnect.ClientService.exe 2844 ScreenConnect.ClientService.exe 2844 ScreenConnect.ClientService.exe 2844 ScreenConnect.ClientService.exe 1576 MsiExec.exe 4820 rundll32.exe 4820 rundll32.exe 4820 rundll32.exe 4820 rundll32.exe 4820 rundll32.exe 4820 rundll32.exe 4820 rundll32.exe 4820 rundll32.exe 4820 rundll32.exe 1576 MsiExec.exe 1576 MsiExec.exe 2580 ScreenConnect.ClientService.exe 2580 ScreenConnect.ClientService.exe 2580 ScreenConnect.ClientService.exe 2580 ScreenConnect.ClientService.exe 2580 ScreenConnect.ClientService.exe 2580 ScreenConnect.ClientService.exe 2580 ScreenConnect.ClientService.exe 2580 ScreenConnect.ClientService.exe 2580 ScreenConnect.ClientService.exe 2580 ScreenConnect.ClientService.exe - Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\T: msiexec.exe \??\F:\ msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe \??\F:\ msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\X: msiexec.exe - Boot or Logon Autostart Execution: Authentication Package 1 TTPs 2 IoCs
Suspicious Windows Authentication Registry Modification.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\Authentication Packages = 6d007300760031005f003000000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800650038006600640061006400640032006500620033003300610031006500390029005c00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f0077007300410075007400680065006e007400690063006100740069006f006e005000610063006b006100670065002e0064006c006c0000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\Authentication Packages = 6d007300760031005f00300000000000 msiexec.exe - Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (e8fdadd2eb33a1e9)\a3occdxt.newcfg ScreenConnect.ClientService.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (e8fdadd2eb33a1e9)\bhf3x2bh.tmp ScreenConnect.ClientService.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (e8fdadd2eb33a1e9)\bhf3x2bh.newcfg ScreenConnect.ClientService.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (e8fdadd2eb33a1e9)\bhf3x2bh.newcfg ScreenConnect.ClientService.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (e8fdadd2eb33a1e9)\ww5ckfa4.tmp ScreenConnect.ClientService.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (e8fdadd2eb33a1e9)\ww5ckfa4.newcfg ScreenConnect.ClientService.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (e8fdadd2eb33a1e9)\ww5ckfa4.newcfg ScreenConnect.ClientService.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (e8fdadd2eb33a1e9)\wlpby5ll.tmp ScreenConnect.ClientService.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (e8fdadd2eb33a1e9)\wlpby5ll.newcfg ScreenConnect.ClientService.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (e8fdadd2eb33a1e9)\a3occdxt.tmp ScreenConnect.ClientService.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (e8fdadd2eb33a1e9)\a3occdxt.newcfg ScreenConnect.ClientService.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (e8fdadd2eb33a1e9)\user.config ScreenConnect.ClientService.exe - Drops file in Program Files directory 32 IoCs
description ioc Process File created C:\Program Files (x86)\ScreenConnect Client (e8fdadd2eb33a1e9)\ScreenConnect.Client.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (e8fdadd2eb33a1e9)\Client.en-US.resources msiexec.exe File opened for modification C:\Program Files (x86)\ScreenConnect Client (e8fdadd2eb33a1e9)\ScreenConnect.Core.dll msiexec.exe File opened for modification C:\Program Files (x86)\ScreenConnect Client (e8fdadd2eb33a1e9)\ScreenConnect.WindowsClient.exe.config msiexec.exe File opened for modification C:\Program Files (x86)\ScreenConnect Client (e8fdadd2eb33a1e9)\Client.resources msiexec.exe File opened for modification C:\Program Files (x86)\ScreenConnect Client (e8fdadd2eb33a1e9)\system.config msiexec.exe File opened for modification C:\Program Files (x86)\ScreenConnect Client (e8fdadd2eb33a1e9)\ScreenConnect.WindowsAuthenticationPackage.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (e8fdadd2eb33a1e9)\ScreenConnect.Core.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (e8fdadd2eb33a1e9)\ScreenConnect.WindowsClient.exe.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (e8fdadd2eb33a1e9)\system.config msiexec.exe File opened for modification C:\Program Files (x86)\ScreenConnect Client (e8fdadd2eb33a1e9)\ScreenConnect.WindowsBackstageShell.exe.config msiexec.exe File opened for modification C:\Program Files (x86)\ScreenConnect Client (e8fdadd2eb33a1e9)\ScreenConnect.WindowsFileManager.exe.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (e8fdadd2eb33a1e9)\ScreenConnect.WindowsFileManager.exe.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (e8fdadd2eb33a1e9)\ScreenConnect.ClientService.exe msiexec.exe File opened for modification C:\Program Files (x86)\ScreenConnect Client (e8fdadd2eb33a1e9)\ScreenConnect.WindowsClient.exe msiexec.exe File opened for modification C:\Program Files (x86)\ScreenConnect Client (e8fdadd2eb33a1e9)\ScreenConnect.ClientService.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (e8fdadd2eb33a1e9)\ScreenConnect.ClientService.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (e8fdadd2eb33a1e9)\ScreenConnect.WindowsBackstageShell.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (e8fdadd2eb33a1e9)\ScreenConnect.WindowsFileManager.exe msiexec.exe File opened for modification C:\Program Files (x86)\ScreenConnect Client (e8fdadd2eb33a1e9)\ScreenConnect.ClientService.dll msiexec.exe File opened for modification C:\Program Files (x86)\ScreenConnect Client (e8fdadd2eb33a1e9)\Client.en-US.resources msiexec.exe File opened for modification C:\Program Files (x86)\ScreenConnect Client (e8fdadd2eb33a1e9)\ScreenConnect.WindowsBackstageShell.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (e8fdadd2eb33a1e9)\ScreenConnect.Windows.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (e8fdadd2eb33a1e9)\ScreenConnect.WindowsBackstageShell.exe.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (e8fdadd2eb33a1e9)\Client.resources msiexec.exe File opened for modification C:\Program Files (x86)\ScreenConnect Client (e8fdadd2eb33a1e9)\ScreenConnect.Windows.dll msiexec.exe File opened for modification C:\Program Files (x86)\ScreenConnect Client (e8fdadd2eb33a1e9)\ScreenConnect.WindowsFileManager.exe msiexec.exe File opened for modification C:\Program Files (x86)\ScreenConnect Client (e8fdadd2eb33a1e9)\ScreenConnect.WindowsCredentialProvider.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (e8fdadd2eb33a1e9)\ScreenConnect.WindowsAuthenticationPackage.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (e8fdadd2eb33a1e9)\ScreenConnect.WindowsClient.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (e8fdadd2eb33a1e9)\ScreenConnect.WindowsCredentialProvider.dll msiexec.exe File opened for modification C:\Program Files (x86)\ScreenConnect Client (e8fdadd2eb33a1e9)\ScreenConnect.Client.dll msiexec.exe - Drops file in Windows directory 58 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSI2D3A.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2D3A.tmp-\Microsoft.Deployment.WindowsInstaller.Package.dll rundll32.exe File created C:\Windows\SystemTemp\~DFF91E1E55988C3637.TMP msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\SystemTemp\~DF005279321AD36A2D.TMP msiexec.exe File created C:\Windows\Installer\e5a477d.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI3644.tmp msiexec.exe File opened for modification C:\Windows\Installer\e5a477a.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI2D3A.tmp-\ScreenConnect.WindowsInstaller.dll rundll32.exe File created C:\Windows\SystemTemp\~DF4284E9C42EF0D931.TMP msiexec.exe File created C:\Windows\Installer\wix{DA72A70E-2502-D10B-6940-B3D3AEE0D119}.SchedServiceConfig.rmi MsiExec.exe File opened for modification C:\Windows\Installer\{DA72A70E-2502-D10B-6940-B3D3AEE0D119}\DefaultIcon msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\wix{5DEE8949-2387-0B52-3829-76324E06916E}.SchedServiceConfig.rmi MsiExec.exe File opened for modification C:\Windows\Installer\MSI34FB.tmp msiexec.exe File created C:\Windows\Installer\e5a477a.msi msiexec.exe File created C:\Windows\SystemTemp\~DF148D04B5C95D07EE.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI2D3A.tmp-\ScreenConnect.Core.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI2D3A.tmp-\Microsoft.Deployment.Compression.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI2D3A.tmp-\Microsoft.Deployment.Compression.Cab.dll rundll32.exe File created C:\Windows\SystemTemp\~DF2BB27814DB6775F5.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF875AC2BF44517776.TMP msiexec.exe File created C:\Windows\SystemTemp\~DFAB85D14042259EC4.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF3DAC96F3C8C7C35E.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF94143953BDDBD1FD.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF1B43DC5EB03372E0.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF837C673AA0E673DD.TMP msiexec.exe File created C:\Windows\SystemTemp\~DFE6A7B2757EA96D84.TMP msiexec.exe File created C:\Windows\Installer\SourceHash{5DEE8949-2387-0B52-3829-76324E06916E} msiexec.exe File opened for modification C:\Windows\Installer\MSI4C1E.tmp msiexec.exe File created C:\Windows\SystemTemp\ScreenConnect\25.8.3.9459\ScreenConnect.ClientSetup.exe ScreenConnect.ClientService.exe File created C:\Windows\Installer\SourceHash{DA72A70E-2502-D10B-6940-B3D3AEE0D119} msiexec.exe File opened for modification C:\Windows\Installer\MSI377F.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF8B065F06B2E441A7.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF3A8A32BBFFCB4927.TMP msiexec.exe File created C:\Windows\Installer\e5a477c.msi msiexec.exe File created C:\Windows\SystemTemp\~DFA2E30C7422558D63.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF9183C4F2990583D7.TMP msiexec.exe File created C:\Windows\SystemTemp\~DFEE3C45E7B4763A8E.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI2D3A.tmp-\ScreenConnect.InstallerActions.dll rundll32.exe File created C:\Windows\SystemTemp\~DF779B16928B458804.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI3684.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4C6D.tmp msiexec.exe File opened for modification C:\Windows\Installer\e5a477d.msi msiexec.exe File created C:\Windows\SystemTemp\~DF0352948346E2B8CB.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI2D3A.tmp-\ScreenConnect.Windows.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI4DA6.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2D3A.tmp-\CustomAction.config rundll32.exe File opened for modification C:\Windows\Installer\{5DEE8949-2387-0B52-3829-76324E06916E}\DefaultIcon msiexec.exe File opened for modification C:\Windows\Installer\MSI2D3A.tmp-\Microsoft.Deployment.WindowsInstaller.dll rundll32.exe File created C:\Windows\SystemTemp\~DFA9839B17A1A17FC5.TMP msiexec.exe File created C:\Windows\Installer\e5a4794.msi msiexec.exe File created C:\Windows\SystemTemp\~DF4F5F8B3D50F1CED0.TMP msiexec.exe File created C:\Windows\Installer\{5DEE8949-2387-0B52-3829-76324E06916E}\DefaultIcon msiexec.exe File created C:\Windows\Installer\{DA72A70E-2502-D10B-6940-B3D3AEE0D119}\DefaultIcon msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\ScreenConnect\26.6.6.9747\e8fdadd2eb33a1e9\ScreenConnect.ClientSetup.msi ScreenConnect.ClientSetup.exe File created C:\Windows\SystemTemp\~DF494615202A31DC15.TMP msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname ScreenConnect.WindowsClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname ScreenConnect.ClientService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain ScreenConnect.ClientService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname ScreenConnect.WindowsClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname ScreenConnect.ClientService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain ScreenConnect.ClientService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain ScreenConnect.WindowsClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain ScreenConnect.WindowsClient.exe - System Location Discovery: System Language Discovery 1 TTPs 12 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-01_7ce801ca173aa4a6a39813d2acdb3864_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ScreenConnect.ClientSetup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ScreenConnect.ClientService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ScreenConnect.ClientService.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000000463f4e358e8ea170000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c01200000000000000000000000027010100008838010463f4e30000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e841010463f4e3000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e30463f4e300000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e60463f4e300000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe - Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ScreenConnect.WindowsClient.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ScreenConnect.WindowsClient.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ScreenConnect.WindowsClient.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ScreenConnect.WindowsClient.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0001\Sequence = "1" msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0001 msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0002\Sequence = "1" msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" ScreenConnect.WindowsClient.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" ScreenConnect.ClientSetup.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ ScreenConnect.ClientService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" ScreenConnect.ClientService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Sequence = "2" msiexec.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0002\SessionHash = 586afdbff381af2c35a5bfc87e05d7357a21fc2675fcc0378809b045f3228ceb msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000 msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" ScreenConnect.WindowsClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root msiexec.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 244752272d3fb6fef9592d2fc80b8002b6fe5bc48f4f6420922a5759bb33d974 msiexec.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0001\RegProcs0000 = 300030003000300031003000340038003a00300031006400640035003200350062003a00610037003300640061006100390062000000300030003000300030006200310063003a00300031006400640035003200350062003a006100360036003300620039006600350000000000 msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" ScreenConnect.ClientService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ ScreenConnect.WindowsClient.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software msiexec.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0001\SessionHash = a9f79762931e0e4f6a9d51a67f098f4b32e2994dd21d7c9a36acf4b41aab027f msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust msiexec.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 1029be5d3827df045518604288a5d96e5c4ababfa0ce520120968f00359d6c10 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0002 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0002 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0001 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ ScreenConnect.WindowsClient.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" ScreenConnect.WindowsClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000 msiexec.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800650038006600640061006400640032006500620033003300610031006500390029005c00530063007200650065006e0043006f006e006e006500630074002e0043006c00690065006e00740053006500720076006900630065002e0064006c006c00000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800650038006600640061006400640032006500620033003300610031006500390029005c00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f007700730043006c00690065006e0074002e00650078006500000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800650038006600640061006400640032006500620033003300610031006500390029005c00530063007200650065006e0043006f006e006e006500630074002e0043006c00690065006e0074002e0064006c006c00000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800650038006600640061006400640032006500620033003300610031006500390029005c00530063007200650065006e0043006f006e006e006500630074002e0043006f00720065002e0064006c006c00000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800650038006600640061006400640032006500620033003300610031006500390029005c00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f00770073002e0064006c006c00000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800650038006600640061006400640032006500620033003300610031006500390029005c00530063007200650065006e0043006f006e006e006500630074002e0043006c00690065006e00740053006500720076006900630065002e0065007800650000000000 msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0001\Sequence = "2" msiexec.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0002\Owner = bc15000009ff0b985b52dd01 msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" ScreenConnect.ClientService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" ScreenConnect.WindowsClient.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" ScreenConnect.ClientSetup.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" ScreenConnect.ClientService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0001\Sequence = "3" msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" ScreenConnect.ClientService.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA msiexec.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0001\RegProcsHash = 02a99f77244d46de6dd64d81df35318a9efd3058a69696d89bd9551fe6068927 msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" ScreenConnect.WindowsClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs msiexec.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Owner = bc15000009ff0b985b52dd01 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0001 msiexec.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0001\Owner = 981300009fd82dc85b52dd01 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" ScreenConnect.ClientSetup.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Sequence = "3" msiexec.exe - Modifies registry class 64 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E07A27AD2052B01D96043B3DEA0E1D91\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-e8fdadd2eb33a1e9\UseOriginalUrlEncoding = "1" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9498EED5783225B083926723E46019E6\Clients = 3a0000000000 msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9498EED5783225B083926723E46019E6\SourceList\Media msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9498EED5783225B083926723E46019E6 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E07A27AD2052B01D96043B3DEA0E1D91 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E07A27AD2052B01D96043B3DEA0E1D91\ProductName = "ScreenConnect Client (e8fdadd2eb33a1e9)" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\9A300C169CDEC6B18EDFDA2DBE331A9E\E07A27AD2052B01D96043B3DEA0E1D91 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9498EED5783225B083926723E46019E6\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9498EED5783225B083926723E46019E6\AdvertiseFlags = "388" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\9A300C169CDEC6B18EDFDA2DBE331A9E\9498EED5783225B083926723E46019E6 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9498EED5783225B083926723E46019E6\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E07A27AD2052B01D96043B3DEA0E1D91\Full msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9498EED5783225B083926723E46019E6\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-e8fdadd2eb33a1e9\shell\open\command msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9498EED5783225B083926723E46019E6\PackageCode = "9498EED5783225B083926723E46019E6" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9498EED5783225B083926723E46019E6 msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-3AA4-2CE637B5BE5D}\InprocServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E07A27AD2052B01D96043B3DEA0E1D91\SourceList\Net\1 = "C:\\Windows\\SystemTemp\\ScreenConnect\\26.6.6.9747\\e8fdadd2eb33a1e9\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\9A300C169CDEC6B18EDFDA2DBE331A9E msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E07A27AD2052B01D96043B3DEA0E1D91\SourceList msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9498EED5783225B083926723E46019E6\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\sc-e8fdadd2eb33a1e9\shell\open\command msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-e8fdadd2eb33a1e9\shell msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\sc-e8fdadd2eb33a1e9 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-3AA4-2CE637B5BE5D}\InprocServer32\ = "C:\\Program Files (x86)\\ScreenConnect Client (e8fdadd2eb33a1e9)\\ScreenConnect.WindowsCredentialProvider.dll" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9498EED5783225B083926723E46019E6 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E07A27AD2052B01D96043B3DEA0E1D91\SourceList\Media msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E07A27AD2052B01D96043B3DEA0E1D91\Clients = 3a0000000000 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9498EED5783225B083926723E46019E6\Version = "419954691" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9498EED5783225B083926723E46019E6\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\25.8.3.9459\\e8fdadd2eb33a1e9\\" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9498EED5783225B083926723E46019E6\SourceList msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\sc-e8fdadd2eb33a1e9\shell\open msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\sc-e8fdadd2eb33a1e9 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E07A27AD2052B01D96043B3DEA0E1D91\InstanceType = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E07A27AD2052B01D96043B3DEA0E1D91\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-e8fdadd2eb33a1e9\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (e8fdadd2eb33a1e9)\\ScreenConnect.WindowsClient.exe\" \"%1\"" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9498EED5783225B083926723E46019E6\Full msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E07A27AD2052B01D96043B3DEA0E1D91\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9498EED5783225B083926723E46019E6\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-3AA4-2CE637B5BE5D}\InprocServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9498EED5783225B083926723E46019E6\ProductName = "ScreenConnect Client (e8fdadd2eb33a1e9)" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9498EED5783225B083926723E46019E6\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E07A27AD2052B01D96043B3DEA0E1D91\Version = "436600838" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E07A27AD2052B01D96043B3DEA0E1D91\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-3AA4-2CE637B5BE5D}\ = "ScreenConnect Client (e8fdadd2eb33a1e9) Credential Provider" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9498EED5783225B083926723E46019E6\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E07A27AD2052B01D96043B3DEA0E1D91\PackageCode = "E07A27AD2052B01D96043B3DEA0E1D91" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E07A27AD2052B01D96043B3DEA0E1D91\SourceList\PackageName = "ScreenConnect.ClientSetup.msi" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-3AA4-2CE637B5BE5D} msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9498EED5783225B083926723E46019E6\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9498EED5783225B083926723E46019E6\ProductIcon = "C:\\Windows\\Installer\\{5DEE8949-2387-0B52-3829-76324E06916E}\\DefaultIcon" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9498EED5783225B083926723E46019E6\SourceList\PackageName = "ScreenConnect.ClientSetup.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9498EED5783225B083926723E46019E6\SourceList\Media\1 = ";" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\sc-e8fdadd2eb33a1e9\shell\open\command msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E07A27AD2052B01D96043B3DEA0E1D91 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E07A27AD2052B01D96043B3DEA0E1D91\AdvertiseFlags = "388" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E07A27AD2052B01D96043B3DEA0E1D91\SourceList\LastUsedSource = "n;1;C:\\Windows\\SystemTemp\\ScreenConnect\\26.6.6.9747\\e8fdadd2eb33a1e9\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-e8fdadd2eb33a1e9\URL Protocol msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-e8fdadd2eb33a1e9\shell\open msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9498EED5783225B083926723E46019E6\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\25.8.3.9459\\e8fdadd2eb33a1e9\\" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\9A300C169CDEC6B18EDFDA2DBE331A9E msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\sc-e8fdadd2eb33a1e9\shell msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E07A27AD2052B01D96043B3DEA0E1D91\AuthorizedLUAApp = "0" msiexec.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5564 msiexec.exe 5564 msiexec.exe 2844 ScreenConnect.ClientService.exe 2844 ScreenConnect.ClientService.exe 2844 ScreenConnect.ClientService.exe 2844 ScreenConnect.ClientService.exe 2844 ScreenConnect.ClientService.exe 2844 ScreenConnect.ClientService.exe 5564 msiexec.exe 5564 msiexec.exe 5564 msiexec.exe 5564 msiexec.exe 5564 msiexec.exe 5564 msiexec.exe 5564 msiexec.exe 5564 msiexec.exe 5564 msiexec.exe 5564 msiexec.exe 5016 msiexec.exe 5016 msiexec.exe 5016 msiexec.exe 5016 msiexec.exe 5016 msiexec.exe 5016 msiexec.exe 5016 msiexec.exe 5016 msiexec.exe 5016 msiexec.exe 5016 msiexec.exe 5564 msiexec.exe 5564 msiexec.exe 5564 msiexec.exe 5564 msiexec.exe 5564 msiexec.exe 5564 msiexec.exe 5564 msiexec.exe 5564 msiexec.exe 5564 msiexec.exe 5564 msiexec.exe 5016 msiexec.exe 5016 msiexec.exe 5016 msiexec.exe 5016 msiexec.exe 5016 msiexec.exe 5016 msiexec.exe 5016 msiexec.exe 5016 msiexec.exe 5016 msiexec.exe 5016 msiexec.exe 5564 msiexec.exe 5564 msiexec.exe 5564 msiexec.exe 5564 msiexec.exe 5564 msiexec.exe 5564 msiexec.exe 5564 msiexec.exe 5564 msiexec.exe 5564 msiexec.exe 5564 msiexec.exe 5564 msiexec.exe 5564 msiexec.exe 5564 msiexec.exe 5564 msiexec.exe 5564 msiexec.exe 5564 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1376 2026-10-01_7ce801ca173aa4a6a39813d2acdb3864_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe Token: SeShutdownPrivilege 1960 msiexec.exe Token: SeIncreaseQuotaPrivilege 1960 msiexec.exe Token: SeSecurityPrivilege 5564 msiexec.exe Token: SeCreateTokenPrivilege 1960 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1960 msiexec.exe Token: SeLockMemoryPrivilege 1960 msiexec.exe Token: SeIncreaseQuotaPrivilege 1960 msiexec.exe Token: SeMachineAccountPrivilege 1960 msiexec.exe Token: SeTcbPrivilege 1960 msiexec.exe Token: SeSecurityPrivilege 1960 msiexec.exe Token: SeTakeOwnershipPrivilege 1960 msiexec.exe Token: SeLoadDriverPrivilege 1960 msiexec.exe Token: SeSystemProfilePrivilege 1960 msiexec.exe Token: SeSystemtimePrivilege 1960 msiexec.exe Token: SeProfSingleProcessPrivilege 1960 msiexec.exe Token: SeIncBasePriorityPrivilege 1960 msiexec.exe Token: SeCreatePagefilePrivilege 1960 msiexec.exe Token: SeCreatePermanentPrivilege 1960 msiexec.exe Token: SeBackupPrivilege 1960 msiexec.exe Token: SeRestorePrivilege 1960 msiexec.exe Token: SeShutdownPrivilege 1960 msiexec.exe Token: SeDebugPrivilege 1960 msiexec.exe Token: SeAuditPrivilege 1960 msiexec.exe Token: SeSystemEnvironmentPrivilege 1960 msiexec.exe Token: SeChangeNotifyPrivilege 1960 msiexec.exe Token: SeRemoteShutdownPrivilege 1960 msiexec.exe Token: SeUndockPrivilege 1960 msiexec.exe Token: SeSyncAgentPrivilege 1960 msiexec.exe Token: SeEnableDelegationPrivilege 1960 msiexec.exe Token: SeManageVolumePrivilege 1960 msiexec.exe Token: SeImpersonatePrivilege 1960 msiexec.exe Token: SeCreateGlobalPrivilege 1960 msiexec.exe Token: SeCreateTokenPrivilege 1960 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1960 msiexec.exe Token: SeLockMemoryPrivilege 1960 msiexec.exe Token: SeIncreaseQuotaPrivilege 1960 msiexec.exe Token: SeMachineAccountPrivilege 1960 msiexec.exe Token: SeTcbPrivilege 1960 msiexec.exe Token: SeSecurityPrivilege 1960 msiexec.exe Token: SeTakeOwnershipPrivilege 1960 msiexec.exe Token: SeLoadDriverPrivilege 1960 msiexec.exe Token: SeSystemProfilePrivilege 1960 msiexec.exe Token: SeSystemtimePrivilege 1960 msiexec.exe Token: SeProfSingleProcessPrivilege 1960 msiexec.exe Token: SeIncBasePriorityPrivilege 1960 msiexec.exe Token: SeCreatePagefilePrivilege 1960 msiexec.exe Token: SeCreatePermanentPrivilege 1960 msiexec.exe Token: SeBackupPrivilege 1960 msiexec.exe Token: SeRestorePrivilege 1960 msiexec.exe Token: SeShutdownPrivilege 1960 msiexec.exe Token: SeDebugPrivilege 1960 msiexec.exe Token: SeAuditPrivilege 1960 msiexec.exe Token: SeSystemEnvironmentPrivilege 1960 msiexec.exe Token: SeChangeNotifyPrivilege 1960 msiexec.exe Token: SeRemoteShutdownPrivilege 1960 msiexec.exe Token: SeUndockPrivilege 1960 msiexec.exe Token: SeSyncAgentPrivilege 1960 msiexec.exe Token: SeEnableDelegationPrivilege 1960 msiexec.exe Token: SeManageVolumePrivilege 1960 msiexec.exe Token: SeImpersonatePrivilege 1960 msiexec.exe Token: SeCreateGlobalPrivilege 1960 msiexec.exe Token: SeCreateTokenPrivilege 1960 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1960 msiexec.exe - Suspicious use of FindShellTrayWindow 12 IoCs
pid Process 1960 msiexec.exe 1960 msiexec.exe 4168 ScreenConnect.WindowsClient.exe 4168 ScreenConnect.WindowsClient.exe 4168 ScreenConnect.WindowsClient.exe 4168 ScreenConnect.WindowsClient.exe 4168 ScreenConnect.WindowsClient.exe 4168 ScreenConnect.WindowsClient.exe 1732 ScreenConnect.WindowsClient.exe 1732 ScreenConnect.WindowsClient.exe 1732 ScreenConnect.WindowsClient.exe 1732 ScreenConnect.WindowsClient.exe - Suspicious use of SendNotifyMessage 10 IoCs
pid Process 4168 ScreenConnect.WindowsClient.exe 4168 ScreenConnect.WindowsClient.exe 4168 ScreenConnect.WindowsClient.exe 4168 ScreenConnect.WindowsClient.exe 4168 ScreenConnect.WindowsClient.exe 4168 ScreenConnect.WindowsClient.exe 1732 ScreenConnect.WindowsClient.exe 1732 ScreenConnect.WindowsClient.exe 1732 ScreenConnect.WindowsClient.exe 1732 ScreenConnect.WindowsClient.exe - Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 1960 msiexec.exe 5564 msiexec.exe 2924 MsiExec.exe 3728 MsiExec.exe 1660 MsiExec.exe 5016 msiexec.exe 1576 MsiExec.exe - Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 1376 wrote to memory of 1960 1376 2026-10-01_7ce801ca173aa4a6a39813d2acdb3864_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe 88 PID 5564 wrote to memory of 2924 5564 msiexec.exe 90 PID 2924 wrote to memory of 2676 2924 MsiExec.exe 91 PID 5564 wrote to memory of 3024 5564 msiexec.exe 97 PID 5564 wrote to memory of 3728 5564 msiexec.exe 99 PID 5564 wrote to memory of 1660 5564 msiexec.exe 100 PID 2844 wrote to memory of 4168 2844 ScreenConnect.ClientService.exe 102 PID 2844 wrote to memory of 2672 2844 ScreenConnect.ClientService.exe 103 PID 2844 wrote to memory of 5332 2844 ScreenConnect.ClientService.exe 105 PID 5332 wrote to memory of 5016 5332 ScreenConnect.ClientSetup.exe 106 PID 5564 wrote to memory of 1576 5564 msiexec.exe 107 PID 1576 wrote to memory of 4820 1576 MsiExec.exe 108 PID 2580 wrote to memory of 1732 2580 ScreenConnect.ClientService.exe 110 PID 2580 wrote to memory of 1976 2580 ScreenConnect.ClientService.exe 111 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-01_7ce801ca173aa4a6a39813d2acdb3864_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-01_7ce801ca173aa4a6a39813d2acdb3864_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\25.8.3.9459\e8fdadd2eb33a1e9\ScreenConnect.ClientSetup.msi"2⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1960
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Boot or Logon Autostart Execution: Authentication Package
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5564 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 6287CDDF1EEE465E7B04D948A172B01D C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIF217.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240775859 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2676
-
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:3024
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding C8BD95580E0BDAEB6A54CCE70FA8D31A2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3728
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 8429C6AE4971C21838B3E01DA73DFDE1 E Global\MSI00002⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1660
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 251161A18670C7D3614AFD64B905850C E Global\MSI00002⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSI2D3A.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240856468 12 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4820
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:6080
-
C:\Program Files (x86)\ScreenConnect Client (e8fdadd2eb33a1e9)\ScreenConnect.ClientService.exe"C:\Program Files (x86)\ScreenConnect Client (e8fdadd2eb33a1e9)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=instance-zkex5w-relay.screenconnect.com&p=443&s=aa88360e-69be-4055-9f95-4a2baebe014b&k=BgIAAACkAABSU0ExAAgAAAEAAQDJNR6p%2fe51sOx9sClTXvP42u41gaIwoNAIfvWjWHT3DehvWEJC0NTA7SMoDXF5IR4%2bxcnfIS%2fPVxiPot0zDG15Btcv3rEpMqjrk71CXudNtSpmWqUrYrVOp0RodR619NaeBnC5EyJFkZFOm3DQ7DZXYSBTUROwPYtHaBinwgE%2bfhBEWp928RUB49peykBRTr9wdONAZxYzkf0SEA6WbhHaUCwUQD%2bNMZx7Y9BPSdbMIrSirHa%2f9EieGi5d32eK35U3jj1Wbffhnj8jIRaMWM8vMq7AqVEvto%2bdiH4y5IM%2fohTJlTw4FLsLcTuhSHXjg3gQRHa2Z7JrVDuSWHSuNL%2fD"1⤵
- Sets service image path in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Program Files (x86)\ScreenConnect Client (e8fdadd2eb33a1e9)\ScreenConnect.WindowsClient.exe"C:\Program Files (x86)\ScreenConnect Client (e8fdadd2eb33a1e9)\ScreenConnect.WindowsClient.exe" "RunRole" "2849b27f-c92f-4e12-8e3a-1816582c050d" "User"2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4168
-
-
C:\Program Files (x86)\ScreenConnect Client (e8fdadd2eb33a1e9)\ScreenConnect.WindowsClient.exe"C:\Program Files (x86)\ScreenConnect Client (e8fdadd2eb33a1e9)\ScreenConnect.WindowsClient.exe" "RunRole" "62c23171-888d-46d4-a13c-7e8574ab92d9" "System"2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Modifies data under HKEY_USERS
PID:2672
-
-
C:\Windows\SystemTemp\ScreenConnect\25.8.3.9459\ScreenConnect.ClientSetup.exe"C:\Windows\SystemTemp\ScreenConnect\25.8.3.9459\ScreenConnect.ClientSetup.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:5332 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Windows\SystemTemp\ScreenConnect\26.6.6.9747\e8fdadd2eb33a1e9\ScreenConnect.ClientSetup.msi" SC_EXE_PATH="C:\Windows\SystemTemp\ScreenConnect\25.8.3.9459\ScreenConnect.ClientSetup.exe"3⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5016
-
-
-
C:\Program Files (x86)\ScreenConnect Client (e8fdadd2eb33a1e9)\ScreenConnect.ClientService.exe"C:\Program Files (x86)\ScreenConnect Client (e8fdadd2eb33a1e9)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=instance-zkex5w-relay.screenconnect.com&p=443&s=aa88360e-69be-4055-9f95-4a2baebe014b&k=BgIAAACkAABSU0ExAAgAAAEAAQDJNR6p%2fe51sOx9sClTXvP42u41gaIwoNAIfvWjWHT3DehvWEJC0NTA7SMoDXF5IR4%2bxcnfIS%2fPVxiPot0zDG15Btcv3rEpMqjrk71CXudNtSpmWqUrYrVOp0RodR619NaeBnC5EyJFkZFOm3DQ7DZXYSBTUROwPYtHaBinwgE%2bfhBEWp928RUB49peykBRTr9wdONAZxYzkf0SEA6WbhHaUCwUQD%2bNMZx7Y9BPSdbMIrSirHa%2f9EieGi5d32eK35U3jj1Wbffhnj8jIRaMWM8vMq7AqVEvto%2bdiH4y5IM%2fohTJlTw4FLsLcTuhSHXjg3gQRHa2Z7JrVDuSWHSuNL%2fD&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAAgmur5uptdkCiRUhzqcqr7wAAAAACAAAAAAAQZgAAAAEAACAAAAAAkFy1GYwpw9QPUeodOs9rl8RnqEF7DTOqEw9EPHHThQAAAAAOgAAAAAIAACAAAAAfpPlvUGMXRXQCP1CJ8XkiIihyPm%2fSd84lShFcmX7FNaAEAACW2oAYC%2fkqDUU2lLQKsXNbBqnqn8uLO0Yr%2f%2b2Nex3DW5DIhtFA0B3ZebXk9nnHK02oUVIW7zzujnpAttZY2DwII%2bfPgArMNeChakWjSLKGKSSIK1WVrPfPIlCG8F6Gc1lDc8UQgY0izYdEbzHDUAdBfLgSkPY7tDEhN05sLyqk0p4vrju9qRQ5mdaBZfc4cTsFqImvNl2LpJxj5aumymPCc2SdCCZg6WUP%2b6xFr2K4JaxN71hMYxCLAqWlRY9A6RecnBs3piwH74oYvCYyH9%2bzhJGoPiOYwyptaERa2OLIRtUsipqnu7i236gUjgw8aVCjAnht62NPQ9Dx3oB185HxIh61WgxYCbV9%2fktD44hYrxWDSAmRRIkmJGTK%2bG9XcDUvRCFX7iaNaylHUmviaCQnGdC%2bzcLE3hVT2kKpbWtLd7vU%2bBc7Sf7WUhfkpQGfVPrsighVV18XJpIp%2bBRAmH2AVVQ2nn3o9hVhlIay9%2b7FL5J1POjz3un7H0tB7cfSqzBm5n247kZg1jFkmlOe2ONqFXWPSJG%2bAtq4vP5Rf0KEmtrwK9mUFDo6qyJe5OL%2fFlJ4QK6R%2biLSToxmYNmb7gKzIclADW1HoPL%2bWOskygdz7c%2fPYbLmOjUGXgAKbNtWDIe7Kb1XFglkgOiSF3mJH1lOd1rnEr9wkzI8dJ4LxUeWA53Z5wdmf5mr%2b1cO7lNyCMhlaCUotvnzS%2fkT5Y740LvjF6MCKQUpaB8HmsKyhMySK3LT%2fD0kRmmS72%2bv45h1nsDD%2bSJCoDIFcwT3wyV7QYkeLBnuef7kRl8DRd6AvFc8aLK9YemtsrniqeDL3p6D%2fhOFEILVlLMEKD7m6o%2fyDceN%2bTkoyQe627nY20BnMGJUWYXgjeC4v6gAlWwMspuiOMgzjZCkIweWj4k%2bsr2dP9wFDqKrN4H4fkfe%2bEENU4kGMnMZmfWEHoUk7svjYX1nwtXtO%2bycIYTZMpRgPYkQ3Fg9Re0EW6E0FQGUv9BiJYB8HZl26HA4pno4PonPKe3FmfeiUWTOGrtcxKDWvp79ppO%2fU%2f94%2bh%2fYjHjc3xLfEM%2f5hx6s%2fCfq0JalqgjPh1iUIvoGBYfKVAS%2bhbTBUkqhhm6N96i2xqxLwvxkYXtPkRwemSJYSa%2bsqxSs3mhxmaZOkFMR%2ft8or7O1MizDdd9IyZw5mLagnbkoX9PWROzFL%2fV80HY8O5w6sfr4D4Oc2GgQGHwDmxHhrb6rAGcKMY6rHWr9bANBY0jRWMLN2xqJc%2bPOKPNckGYJrEYwTdx1HVkeBjd8T1PNky2RSbDnIK9gwT2P%2btkH1QYrzMU5rO2rtRurc3WpTo0RmX8eHS%2b%2bU8Xzb5aMhaduNSCETebWgwYgTvOYoENUFGa7VGEfgLUvjShIiYm4J725Fm3W8ddc5IcsVHXGAbAySTAgkO%2f%2fPkg5PzXc13gg6B8VsD2%2bRkkGP7JKf4oqlEYgokp8Ogzh5%2bux2w%2bUiuATntcXEabEWeVdfy%2fuvrQOKmsJOENOY4uoKooujo81AWn8OG%2fvk%2fCc56PuBTQnJV9MHbEmHjDvl3JXsRZ8WbSCyC%2fTEV56pQQV2V22hUAAAABK6xxnnaunZdw55hyVJ9ty7mLhiIxwNTk7Esum3Pdtqev3tjxvIoLmQRtSe2QjEXV4qMM2HII41fJzT29r%2f%2b3L"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Program Files (x86)\ScreenConnect Client (e8fdadd2eb33a1e9)\ScreenConnect.WindowsClient.exe"C:\Program Files (x86)\ScreenConnect Client (e8fdadd2eb33a1e9)\ScreenConnect.WindowsClient.exe" "RunRole" "930ececb-e4a1-4bff-bd1a-44f4013dc8cc" "User"2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1732
-
-
C:\Program Files (x86)\ScreenConnect Client (e8fdadd2eb33a1e9)\ScreenConnect.WindowsClient.exe"C:\Program Files (x86)\ScreenConnect Client (e8fdadd2eb33a1e9)\ScreenConnect.WindowsClient.exe" "RunRole" "46cf641a-549c-4ee0-9169-df9efab93afc" "System"2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Modifies data under HKEY_USERS
PID:1976
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Authentication Package
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
2Authentication Package
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Component Object Model Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e5a477b.rbs
- Size 214KB
- SHA256 14dbbfbb5ff0e76ed08384d0352ed230f8d91a1fb3c9c85410bce0811471b1bd
- MD5 b53445e2f8606fb3eb63000d35e0a0cf
- SHA1 c02a6da7f33ec8e408dfacbb1853489893479445
- SHA512 47874890aac39741f954ca0d7e6acd8878a14e1db7e9a98a0b949d2a20008530a4b3a0eae746508fbe30a1c8c6be0fa4d59520a1b044c323f35cb557ed703494
- SSDEEP 3072:qe9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMGff:qeuH2aCGw1ST1wQLdqvff
- TLSH T1C0248C21B490807EE7FA1A36DD3E9A71BE3DF6241760C59E83848C1E5D604C16BF6B63
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e5a4782.rbs
- Size 18KB
- SHA256 9bac33447e633e48662918f5232e028f8b2fb6318a32694720296c662c3e6881
- MD5 bf4615ef273558086815af333e2dc06a
- SHA1 978f40c29acc8bd9f2f2ea4f861124264fc27ae8
- SHA512 eade1f3785bf08eafe514b6d6367c9b9fdaa9f6811b1ec7807eafce2369731542ad875f27e77efd1fee6179fec539df88ed63a217c4d6bf016788bc9949c8d10
- SSDEEP 384:ro8WRgvcdoqRg5cdxQP6Exu9qgDNeyfZDq5uPffV:rQgcg8jZ+5I
- TLSH T178924202F644A1F2EAA21B35DE530B24BF33DED46312024B919C913D4EA57837BBD5DA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e5a4793.rbs
- Size 214KB
- SHA256 8db6fbbded868d685f65d6a2f1fb500fabd4a6d0a57a4183b12efb5adc4a2725
- MD5 61c3ea35bf4266831a7461c39d693545
- SHA1 fb4088fbaca26c3ecc0afe68c90150964db83d54
- SHA512 1949144405e4896d6be6ed60ce93dfaa24b83641a74b1c003abb7403411e741c24499d431512ee715ef286bf377f0ce231846f44d2de820f0e06716bb7c450a3
- SSDEEP 3072:Ee9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMGU3:EeuH2aCGw1ST1wQLdqvU3
- TLSH T156248C217484907EE7FA1A32D93E9671BE3DF6241760C59EC3848C1E9DA04C06BF6B67
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (e8fdadd2eb33a1e9)\Client.en-US.resources
- Size 64KB
- SHA256 efdb0b4fcc38b52cbf72336bd107a814db8454003f3495de21e2026a148823ea
- MD5 92232708774febf9a4a464bbeda36215
- SHA1 521d4e630f5e00977bbca7cd17dd0d22dbe1ca9e
- SHA512 59442cbc57604f0dd170bb4f86f0e2b6c96408daf67250e6f40e00d034033b6871502cd83df0267f4628c3a035f191d56f26bf1927e691b5330524eb810852f2
- SSDEEP 1536:5fkiK2FoQ67wwLFSj7Be3sZvU/7UFN+9nwLLChTKN1ljpneMarA:5fkiK2FoQ6jFSj7Be3sZvU/7UFN+9nwS
- TLSH T1A8532E1277FD0A58F5F36F35BE7A94619937BC5A2E25C06E1028815E09B2F80C9B2773
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (e8fdadd2eb33a1e9)\Client.resources
- Size 2KB
- SHA256 4514129a17cafb2891674dd75cf25dfc3e2ac08a08f7adebeba3519f2313ac5e
- MD5 c4f2cff169ba9db3e208c833c73431d9
- SHA1 3cca7222ebc8a51750157c908a7ba2ddfb49083b
- SHA512 c68ff4e9925b99cd50a8f36dc4b5a3ed3c9e62874248d93714cd2e3059e2157f1b4db9c1aae60ba6a3f121e2231b88c824eb805599d98eddbcd31e35b4ed4c62
- TLSH T12F41E2550BFA286CF4BBABF6AEF990AA1273FE253931C37C1810101A67312824900B33
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (e8fdadd2eb33a1e9)\ScreenConnect.Client.dll
- Size 400KB
- SHA256 8fee0d45becac2193c051caaf2c32877ec5dfaad2a22c3eb78d1a55fe3173751
- MD5 c1420c61d20566d22ecb8f4a5e50dfdd
- SHA1 d754c7b709d8a4f0d7582806bf5cce908141edb1
- SHA512 b758b64a7dbf978d0a06d4434e0f1dec434090eefab928b2f211ef7ea9bd0cc0b56bbf8b8d66da22387254cdd10d779f50f928a34a68f607f8c09c65d0b68452
- SSDEEP 6144:rMSiC+oXJNbZvH8ETEavHy+vd7JPYIYyqQni65/PGu:QSF+K5HHTEavSW7OQni3u
- TLSH T18D94CF85B3B84D2DFAAF0A37F46081258E739C456552F66D0E44B9F80AB37938644FE3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (e8fdadd2eb33a1e9)\ScreenConnect.ClientService.dll
- Size 78KB
- SHA256 d4514e348a8441ccbe7c20be83b56527459f20d1914a967982e86a489cb18689
- MD5 acea4e610335c3e5c235c71cf3aee758
- SHA1 cf234d604bfbd1e8277c8136e866a38efd66e78b
- SHA512 ca006105db0d15ee827b0d5102e0b5963db4c6165c45e7334aed9fade913b9bb0d62ad7c6e70579c669bd32cb1b685d763b713c737f3de622cea0247c57fd541
- SSDEEP 1536:O7xQmiDqhpozTKpA9mH50asYXk/QQV3lTjmkbP+K79:O7xQmKCpST1O50C0QQVFjAKh
- TLSH T1FC733C41A3AC9E26C9DF5E7874A5B0450F709A02D4B7FBDD9D8DE4EA1E463C12A003DB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (e8fdadd2eb33a1e9)\ScreenConnect.ClientService.exe
- Size 93KB
- SHA256 daf90f551154b29e6cfb993b80c23a4e4a9cac8c150700c9cdd3d5a2ec4636f9
- MD5 409a1fe79d7efa05e0c766816b57ad92
- SHA1 f3b7ffb7a5054c43db124da93c376c96c442302a
- SHA512 49451826e61b4430d646e80a1a7f7c2f9782de29ff2f6a73254b31a1692a905fbee4593bc7a86752ce99b40060d53a375c6a52e5ae76ba93521413ebdb1dd04b
- SSDEEP 1536:Kg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgEU0HMi7Gp:LhbNDxZGXfdHrX7rAc6myJkgEU0HLip
- TLSH T166935B13B9C28872D473093158E0DAB49A3FF9615E61DEAB3788022E4F741C1AE75E77
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (e8fdadd2eb33a1e9)\ScreenConnect.Core.dll
- Size 553KB
- SHA256 5ed986f56a7f2f2aa93ff8b1e074957bf155eaf3ae7fb8fab93b847856b6875e
- MD5 679f56a57f68d9f1b99935c526d07f7c
- SHA1 f961bca09a2b10b88d88ffc28c57b5dcce3af5d8
- SHA512 188a15c7c245c8386716a93cf6ce93bb658c34bd47b094a82f118bf81a2442543cb68a9f7ff4763808c00b55b655dc5fc211e497379c8d756f18a8c4893751c1
- SSDEEP 12288:ixzn3KCeQqm1mHw3TFvG5qm7Xb2nX/fPw:cm88b9w/fI
- TLSH T1B8C47E9133988B2AC5EF4B3BE470D5542A71E524B00EE35B2A99F5E51E8234B4E0C7F7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (e8fdadd2eb33a1e9)\ScreenConnect.Windows.dll
- Size 1.7MB
- SHA256 3b7f542950500ba9416c2c8ae9131d9ac2cc5da63c9dd1132077f4efc12e04c4
- MD5 681cd793733a6151ebfcfe7f5d8cf929
- SHA1 b476c760319e7693de10b8ade26d1d4a8e9fb1c9
- SHA512 bfb244fcfe69dfe6f15f3678045400e14c4ff8af615d6990365ac28cb15e82765263bfb38cc8ea294820517c598936461ab7b16efb67ea55f1fe3246efc78c20
- SSDEEP 24576:MhpJFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUTd:GpJJkGYYpT0+TFiH7efPQ
- TLSH T13185AD41E2C369F5D46B047888BF572AAA743C080325CAFB97D4BE356D33BC09A36756
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (e8fdadd2eb33a1e9)\ScreenConnect.WindowsAuthenticationPackage.dll
- Size 254KB
- SHA256 a5b8f0070201e4f26260af6a25941ea38bd7042aefd48cd68b9acf951fa99ee5
- MD5 5adcb5ae1a1690be69fd22bdf3c2db60
- SHA1 09a802b06a4387b0f13bf2cda84f53ca5bdc3785
- SHA512 812be742f26d0c42fdde20ab4a02f1b47389f8d1acaa6a5bb3409ba27c64be444ac06d4129981b48fa02d4c06b526cb5006219541b0786f8f37cf2a183a18a73
- SSDEEP 3072:qJvChyA4m2zNGvxDd6Q6dtaVNVrlaHpFahvJ9ERnWtMG8Ff2lt9Bgcld5aaYxg:0IvxDdL6d8VNdlC3g0RCXh5D
- TLSH T1C5448E15B7A40CB4EC77823888535A06E776BC160760E6CF03E0825ADF6F7D1A63E762
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (e8fdadd2eb33a1e9)\ScreenConnect.WindowsBackstageShell.exe
- Size 59KB
- SHA256 ef2492bf1abb19772694c9c933dff1d6ec9c8bf9a7b360a6715f0ec01c62fdba
- MD5 5c55e4da6f1a4e2c3ab99ea590e39960
- SHA1 616804dbc37309513bb3503f1c7cdc2b2eb4eb1a
- SHA512 50721d5fd6307f90a98b157cefedf35077de27fd7d62b56c3b61510baf9f783cec91006c75bca86d734985d319642480160c28ceee1a76f8987b42cb1f0f980e
- SSDEEP 1536:CoSOs/MRZFe9a6lDvmDTyQX5E+TC7lh2syGbIi7o9:CoTsCZFe9dmyQOV0is
- TLSH T1E6538E4163E84619C9FF2E7CB8F2A1141EB1EA439441EBAE0DCD65EA1E537815F203E7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (e8fdadd2eb33a1e9)\ScreenConnect.WindowsClient.exe
- Size 603KB
- SHA256 54e693ce780f45dbed9ee4eb54e33d9ff3bbb16403431e433eb762cc540cfbdc
- MD5 03fc0c98d24fef160d4cc49e71819b7f
- SHA1 64b4353e5a2e444756a2ca12af764e2c34fddb50
- SHA512 9830560052ac861bab88eb1eebcfeb9b9c46e8d3f5a8629c17a1d7e089b4ae9d56f195858e5a4cca59fd05e1e819de943b2c6dc86d0456838522fbb8c40e8ceb
- SSDEEP 12288:QJdIARli93cAz7QWG+xNXe9si+T3zD9muf:+li9bBJTnouf
- TLSH T16DD46C2173BCDA3BC8BF0779B0E118645FB0F8156685E78E8904A9D90FD739A49443EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (e8fdadd2eb33a1e9)\ScreenConnect.WindowsClient.exe.config
- Size 266B
- SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
- MD5 728175e20ffbceb46760bb5e1112f38b
- SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
- SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
- TLSH T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (e8fdadd2eb33a1e9)\ScreenConnect.WindowsCredentialProvider.dll
- Size 838KB
- SHA256 fb1ea7f67eb0fd17b01b09e435f1eb92c1d46e1a3bb37023f757c0ba13e49686
- MD5 c6684d9a43590a7c309d723c2d70cb39
- SHA1 36a20cfd5ef12986fe4a5b3349eda3520e431b03
- SHA512 3eba63e12e3969e46afeb788904a7349a0fd3b9e2d7b12054dc0ef7e0cd2388e0f5929eba8611c4a7ae8d94879b0b78ee76e3d4f0246e4516ad4b9f7ccf519af
- SSDEEP 12288:ZhUSQJg/+QShEMuu/gUD+FkoiS+upfHHe:ZwNQrMuu/gUD+Son+2fne
- TLSH T1C2054C1BE7A440B9C0ADC6B5C35B9736BBB6F4864514B29F07D40A227F6BF40AB1D384
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (e8fdadd2eb33a1e9)\ScreenConnect.WindowsFileManager.exe
- Size 79KB
- SHA256 c5737f9f9e56bba91002244214d4251c8b4553dec225b88be15ed1f70673f4fc
- MD5 6ab77922584249a5997d93e1ce96e12f
- SHA1 8c1bb25d14d96d45320e8ec5c158c32832b3fbc3
- SHA512 b4a74282cd0a1489a5a0cde3c7984fb4befe554c31f13af388a238a642069685a0c2de12279b2528bb2f66cf65484cba09eb293c98ef6443a4174df78ff57087
- SSDEEP 1536:htyOl44zzb0I5kLP+VVVVVVVVVVVVVVVVVVVVVVVVVC7WP7y:iI8ukLdSP2
- TLSH T1EB83E58235762231DF85C4379492C9B59C366F22133DC5BD2DA2FE3A69F13443A8ADB0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (e8fdadd2eb33a1e9)\system.config
- Size 962B
- SHA256 ca88bae6f959d8703761f096a8fc039e28aedc7fe5eb58b4b202121d77d7f5b5
- MD5 596ecd901a8309a9c25e06d6dc25e284
- SHA1 88389ac14c92c4b2b395d47611bf75fe1db8859a
- SHA512 315bc54d673d7deebc779ccc00c31dfb4967db13d3f17dd6037433f716e5a7d5caffc119c13ef478a16ba8cb6c4e397586c3cf59bd41f1254b85ea272672d5cd
- TLSH T1A91110B275847E9602633F32C9128385AE3213AB22596198395E133B6BB168F03A319D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSIF217.tmp
- Size 1.1MB
- SHA256 c91253aeeb18f1644b6922afd49bdbe28fdbac5b569cf027910bb8c9818c3cb0
- MD5 7d861e9f8ae9a8ba82222cc406ab8b38
- SHA1 c8f72b731b64da4b7b2ce588a0876943d7c0e3b1
- SHA512 2db2457ff213ac7660f5a1003e3e9d812bd8d7573b948364d2e50ba5db97286d4d454809943d732ef070259c41609246fdd4ffeb74c3662d2464c4dd4b9c5ccc
- SSDEEP 24576:Y8UUGGU9PRgFFzDtK9Uk/YG00SuH7jG3NK/C0kCzSYKPsN3hG0:0GUBRMFz09Uk/Z3SuH7jYNGCfPYKUR
- TLSH T1D335232132F8687AF1523D342F64B2B115FFB6B16871839D6B49076CAFA17C1A974323
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSIF217.tmp-\Microsoft.Deployment.WindowsInstaller.dll
- Size 172KB
- SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
- MD5 5ef88919012e4a3d8a1e2955dc8c8d81
- SHA1 c0cfb830b8f1d990e3836e0bcc786e7972c9ed62
- SHA512 4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684
- SSDEEP 3072:FkfZS7FUguxN+77b1W5GR69UgoCaf8TpCnfKlRUjW01Ky4:x+c7b1W4R6joxfQE
- TLSH T14E045B2563FC473ECAEF87B4E2624251E7B2E2E97113DB0DDC8541AA2522780F792753
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSIF217.tmp-\ScreenConnect.Core.dll
- Size 543KB
- SHA256 0674a743c28a375eb237441f29576f2868cfa384bdd0fbb17b6ff18c777f8f39
- MD5 ebf9f7b3a5b896972178856058ce0f8f
- SHA1 c9ab0ad2252446b902ac9b9b45fcdfe791b01d1f
- SHA512 ea7e381594da3528d873cf2c186121bb43aa96bb9631aa7d3c6644331e317662278557a9f84c47b26ffd6bee991519487836f5b3fe8665ddf6437a496ca8406f
- SSDEEP 12288:Fxzn3KCeQqm1mHw3TFvG5qm7Xb2nX/fP:Lm88b9w/f
- TLSH T1E3C47E9133988B2AC5EF4B3BE470D9542A31E524B00EE75B2A99F5E51D8234B4E0C7F7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSIF217.tmp-\ScreenConnect.InstallerActions.dll
- Size 11KB
- SHA256 bc49ae49953a147ccb8837824e506e656b1c83388f59f981077de27d9603f15b
- MD5 957085ebd43b1f7749b9fdd5c87e9e9a
- SHA1 4f81c27f18f1efccb5fbea59e6a097aac12d099a
- SHA512 2e0d19dd5854d3da46fa2b48ecdf7376630e35cc8d209eabdbb2a101e53ff0c1e74a00716b1aa6b9db8d7a4dd4eb00b2bd426f4bbb58350101ccd959fab1b000
- SSDEEP 192:48/Qp6lCJuV3jEXtyVNamVNG1YZfCrMmbfHJ7kjvLNbbuLd9NEFbqt:V/cBJaYXt2NaheUrMmb/FkjvLZbuZ5t
- TLSH T15632E70037DC973AE8BE0F78EEB362910A71EB64A011DF2E18CC51569C367409EA07B7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSIF217.tmp-\ScreenConnect.Windows.dll
- Size 1.7MB
- SHA256 29d6495186ad750cc241a5bf82d328b4ce184be729466b9fc1a68e20f4c0d421
- MD5 5d332329ba433ed64e8cb8e546dc74a9
- SHA1 d7d454aa276a8bb4e99343dd5ae7a36cd41e3696
- SHA512 95499c971d4c276e162173a7c2a3a5c45f988a60a140a7fe3007196c52e894e11e7dfce156efca17a5d3843811cfaec3be41c9c32ece54a61363a1fe11135c55
- SSDEEP 24576:YhpJFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUTM:ipJJkGYYpT0+TFiH7efP
- TLSH T14085BD41E2C365F5D46B047888BF572AAA743C080325CAFB97D4BE396D33BC09A36756
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ScreenConnect\25.8.3.9459\e8fdadd2eb33a1e9\ScreenConnect.ClientSetup.msi
- Size 9.6MB
- SHA256 d067239513f218876dc3d9432175277e8dc363ef0456bcb2da3e5eab538980e9
- MD5 15d58d368e4384a50017b6ec2448d795
- SHA1 44bd38ce30bd57bf1bf714f9921cd15bdd7361b8
- SHA512 a8fa860dd6c76d468f2d8f3cd7dbe102cae8d41f53a0816c312ba40ebde6892f32b493a9a3be0214317bf5332d4e6969a0f9285d47d0b3d23a1af0802f0204e2
- SSDEEP 196608:dsuCcGaDpxmcYMDgsuCcGaDpPsuCcGaDpAsuCcGaDp:euGdhMDPuGpuGYuG
- TLSH T108A6231126E89134F6B31735FE3A56F55A3ABC25DD23C12F1268B91A2A73D808D72373
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI2D3A.tmp
- Size 1.9MB
- SHA256 1dabfa60015c186a4315f16d46d9e53435dc259c52843e73dac0d04be92f9a84
- MD5 efa3cd7e5bdd04fe37a130e51fdf950c
- SHA1 bce97de0f0a7c985c3a29db0b7dfe734470a6d0c
- SHA512 04a3f21ffd6e01c1b215d7378527d2d51b9c76faa8960e32da3bf06bf54aafa71dbf607745d77f2c9f198355d7d9c05806f7d8fe09d6bdbf60dccc1dc88d75e6
- SSDEEP 49152:CGItINWG7/6NfA3BF5h/rvK7e4devyryUpEHLM:CGUQHUI3rK7eyevZUpEHI
- TLSH T18995236037FD9574D6E63B312AA889A412FFB0317674C38866841AAD0FF1F85DB60367
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI2D3A.tmp-\CustomAction.config
- Size 234B
- SHA256 7027b69ab6ebc9f3f7d2f6c800793fde2a057b76010d8cfd831cf440371b2b23
- MD5 6f52ebea639fd7cefca18d9e5272463e
- SHA1 b5e8387c2eb20dd37df8f4a3b9b0e875fa5415e3
- SHA512 b5960066430ed40383d39365eadb3688cadadfeca382404924024c908e32c670afabd37ab41ff9e6ac97491a5eb8b55367d7199002bf8569cf545434ab2f271a
- TLSH T18CD0A70405D0FD1B5E231A2337524559FF34B1E290A44408B06F3A130A220CD4757317
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Installer\MSI2D3A.tmp-\ScreenConnect.Core.dll
- Size 1.3MB
- SHA256 e5fd82d18c2dcaadbfc4b72b56573e819cc3e8ee6406f2edb982cc073dc607bb
- MD5 9e220b9cd7ecb714c101c2b07a039b8a
- SHA1 23aee367b77a5da5ff356df0f998deec625d25d6
- SHA512 73ac4fe50fbbf1ce8dd6907161ce0f17fdb13af8de773a1999e9768312f63223683badc0542fb5f68113367f617aa8552de95f6b812adf7898edacf68feaa824
- SSDEEP 24576:OpIxpRkVYVdqvM2Dj5AmhstUJQf72OmswiC6EHspN6TSZsyPX3U:qIxpW9j5bhUp2sEH4HPnU
- TLSH T125558E4ABFC6AB17CD7D0633586163005BB0D0909AA7D71F39B8A73D5D863D82E881ED
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI2D3A.tmp-\ScreenConnect.InstallerActions.dll
- Size 24KB
- SHA256 cf8505204b1458dac9cb3002fd5bbd5fac43c5b4702aa0153fb4b9a2cfcf954a
- MD5 c060e1dcf5402d3bda57c00fa2fd56fb
- SHA1 45b319fe4fdb0d546368487c758ac4a0c60737c5
- SHA512 4941965012aa81ac02c1bc161d6e3f4aad195a8bc47094afdd192252478eb530bba744ab4f8d615fcb867fe1a8bc91623dfb1ad70491d83e2ff05aaa25dfe5a4
- SSDEEP 384:cSazzV1VTsaS8hQlLkmoAAV7NaNeirM0dbMsFkjvZBN20dN5:hazC9AVMcLv/d
- TLSH T126B2E720674CE27AF9EA1634B563FBB011B3BDB3CCE9DA8565A420153D253E04FB5B06
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI2D3A.tmp-\ScreenConnect.Windows.dll
- Size 1.8MB
- SHA256 ed1b4eb6c24c85392f692bf5863d9ccb76575051bb605360961b9d7624a371c6
- MD5 58aa4d11a9e686a21fcd5cf8f29141bb
- SHA1 20710c94635ff8184ab7779aeb572d73dd39bc2a
- SHA512 801b4ddd92ca2071e3f21c3bbdfadc8a5e2bf01a0428cda3b656cefe4f854b4d5618e2c060e5a90e2985febb404cbc8adf5b4e56c377f5b31407c9f47d2e09f0
- SSDEEP 24576:n5wRfUFj+Ifz3zvnXj/zXzvAAkGz8mvgt379S+2bfR+RfmTk1krT1iH4SqfKPTsF:nsUJkGYYZTk+T1iH7efPDp
- TLSH T1AB95AD45F6C365F6D42F047888BE632AB6743C040315CAFB97D4AA3A6D33BC09A36795
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI4C6D.tmp
- Size 202KB
- SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
- MD5 ba84dd4e0c1408828ccc1de09f585eda
- SHA1 e8e10065d479f8f591b9885ea8487bc673301298
- SHA512 7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290
- SSDEEP 3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
- TLSH T129147C326494803EE7F91A36D93E9A61AE7DF6241760C99EC3848C0E5D604D06BF7B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\{DA72A70E-2502-D10B-6940-B3D3AEE0D119}\DefaultIcon
- Size 1KB
- SHA256 87bed2d86c91b9f7d19adca1829df20881cbe9cc44638e073684d09c9b7cf11c
- MD5 a8b8f09d92363e54230bd83bb6e6f553
- SHA1 3c02161fa71951d60533cec49403fd7c199d06f8
- SHA512 1c6aeac8a83e3457606f8e52fce03d1afc3cc4f3e50c0dea828a74f8eb95b6751a4b9b6b2196422a421257df17798ed2aef2d37012de7a7d5fccfa7e74677222
- TLSH T1421175DF26906C7DC43D1DB245878A68F8BF4CD914D7A1D370A1103A15602CA43283EE
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (e8fdadd2eb33a1e9)\a3occdxt.newcfg
- Size 720B
- SHA256 147bdfb5dc3b9153de49c79039e6f67b966e510390aa4e71e67de77e29842b93
- MD5 fd9d25a05b408089919e6a78fef835fd
- SHA1 d11031c7425e6c9186a7545dbb574522079379b8
- SHA512 3eccd0186fdda15b49125b9a54dbbc283bb54f3b20f1224bdacdeaadea5591b89ada552d046e52f09cf4661c3e1ac101eff34b747e5ab00d688b7488875a14c7
- TLSH T1A30149A832C0AE5A03B36E33D6214385FD725A9B116560D434AE223B5F705DB03E36DE
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (e8fdadd2eb33a1e9)\bhf3x2bh.newcfg
- Size 883B
- SHA256 62dfe81722a3050bd75e61c6b800fd3d38f393c18858d0d71c038423d02f2a85
- MD5 f81ffc1b5f83ee80f16b48579d93b9c2
- SHA1 02728bf459cf7d37225b66ab7574bc8cefc438f1
- SHA512 0d303915e750680a0239689cc1609071ecfdd38a74ba6448d6490c925a865270dbdde0e64cddc7f2b96ebc580a1084bd94fddb56bae3660c5c90e62fdb4d9516
- TLSH T175116D6872C09EAA02B72A32E6314385FD725A97127560D434EE21375F705DB07E36DA
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (e8fdadd2eb33a1e9)\ww5ckfa4.newcfg
- Size 883B
- SHA256 ee6d49d925215f53f665105944c12998865646ca6c46049e0d6b40c5915b9484
- MD5 9cd3e192520d73097af3ec13ae947675
- SHA1 1c1793310d0cbe38b46ab914ac77539f3eda6faa
- SHA512 a8fd70266bb840ca6ac9be24e058b12a0537cc1a6855acfbfe7471b8e15d740d711ba5dd071719b3d13fd4e090af034dc8b3ca3a381293e063329eef30fb09cf
- TLSH T1FC11BD6872C09EAA02B72E32E6324385FD321A97027560D434EE21375F709DB03E36DA
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\ScreenConnect\25.8.3.9459\ScreenConnect.ClientSetup.exe
- Size 19.8MB
- SHA256 b04e7bbbf7c092600a5fcf2b22d1412c9056a163212979ca6ab2dbaf7996c0c3
- MD5 b8c73f4e2cb6b5fbf3890ba08fff4a50
- SHA1 0b33602c3d050b38bf85dca51d72693dad3fa610
- SHA512 f9ff2eb46f5112d6aea63118fdba00b0e6868b4d28abc5197e7af46d870286be349c51f9a61caa03c6bc3481e9992d4d2ae31a9c56f3fe953a7094bd06bfc7f0
- SSDEEP 393216:Nk6ohU+8bjJ86Qq9ySZ8EZ6ohU+8bjJ8P6ohU+8bjJ8o6ohU+8bjJ8/:Voh0bjn9ySZzgoh0bjroh0bj8oh0bjG
- TLSH T144272301BBC69A66D87F0635987AA3106775BC404B52C7AF27E07B3D1D327C05E623EA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\ScreenConnect\26.6.6.9747\e8fdadd2eb33a1e9\ScreenConnect.ClientSetup.msi
- Size 16.2MB
- SHA256 995dd1c2cd7a55a038fc89275521a51e04a079e02fcf0c867708a03cd2650c65
- MD5 2f8f48b2c7257a90356a62638489ec02
- SHA1 559048d61a931a5b54d8b151ad282a3e95c83611
- SHA512 1721cca4b4d99b6b38a85c2bf7975073ad9a3cca3ee1eb03b4277db94752c5b4ca708031bab80d638b8223a6f6fc1b14268f40720d14a354f52a3006bea626ce
- SSDEEP 393216:j6ohU+8bjJ86Qq9ySZ8EZ6ohU+8bjJ8P6ohU+8bjJ8o6ohU+8bjJ8:2oh0bjn9ySZzgoh0bjroh0bj8oh0bj
- TLSH T1960733211BF8C855EAB30B75FA7B86B44637BC51A912D05F03A03E1D1972E819EA3377
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 126c3c29fc22c6efb1569f5dc5fd7197727e2ae58c731798033e82e4dec77b55
- MD5 cf6c8c2d6c04b60173741d2a033822f9
- SHA1 0d921762b3d29eb348db8032804f6e969b4cc19e
- SHA512 9b082d074351f372e871d5f472481c66e922bc5953eab00df5dd4d2bb71c6d77c33fbbf4a05f9507758e70f768c649d28648fb97cd9b5f1451473bcc7177e9b4
- SSDEEP 24576:jFo3DMPDdoO/vvTL/Sgn3iFwfru9MrwkEqhl9qJfBiJ6JQ2XMYR23uNmz+n:NHI
- TLSH T1A657022472F92211E7F39E3CA8F06A23493E7D9B9C15DE8D45411B4E0862F71E872F66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{e3f46304-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{0558a6e1-2346-4325-a40f-40d4133d9524}_OnDiskSnapshotProp
- Size 6KB
- SHA256 987da09630021d574200b9c4ec922bbb2e9a18bb21e6c08ae8868cad0f804a5a
- MD5 8856d3a980106c6be57dc6f4fc2df137
- SHA1 e62b81893e6b2ab59e71b828e44b27355e26fac5
- SHA512 41fc305d6feb90f91b712cbeb4211a6c86de184c3868976129e6f3aa98148cddc4cfa9bc892178e7042300da4faf16c87a49ad6bb323d8be6dc7fe7638d245a0
- SSDEEP 96:FyPgjOvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:wPpb++uVm
- TLSH T1BDD199084AF54711E2B3AB3128F14557A877B811FF33CB8E0198238E6670A10F835F6B
- MD5 SHA1 SHA512 SSDEEP TLSH